flow-import(1) [debian man page]
flow-import(1) General Commands Manual flow-import(1) NAME
flow-import -- Import flows into flow-tools from other NetFlow packages. SYNOPSIS
flow-import [-h] [-b big|little] [-d debug_level] [-f format] [-m mask_fields] [-V pdu_version] [-z z_level] DESCRIPTION
The flow-import utility will convert data from cflowd and ASCII CSV files into flow-tools format. OPTIONS
-b big|little Byte order of output. -d debug_level Enable debugging. -f format Export format. Supported formats are: 0 cflowd 2 ASCII CSV 3 Cisco NFCollector -h Display help. -m mask_fields Select fields for cflowd and ASCII formats. The mask_fields is built from a bitwise OR of the following: UNIX_SECS 0x0000000000000001LL UNIX_NSECS 0x0000000000000002LL SYSUPTIME 0x0000000000000004LL EXADDR 0x0000000000000008LL DFLOWS 0x0000000000000010LL DPKTS 0x0000000000000020LL DOCTETS 0x0000000000000040LL FIRST 0x0000000000000080LL LAST 0x0000000000000100LL ENGINE_TYPE 0x0000000000000200LL ENGINE_ID 0x0000000000000400LL SRCADDR 0x0000000000001000LL DSTADDR 0x0000000000002000LL SRC_PREFIX 0x0000000000004000LL DST_PREFIX 0x0000000000008000LL NEXTHOP 0x0000000000010000LL INPUT 0x0000000000020000LL OUTPUT 0x0000000000040000LL SRCPORT 0x0000000000080000LL DSTPORT 0x0000000000100000LL PROT 0x0000000000200000LL TOS 0x0000000000400000LL TCP_FLAGS 0x0000000000800000LL SRC_MASK 0x0000000001000000LL DST_MASK 0x0000000002000000LL SRC_AS 0x0000000004000000LL DST_AS 0x0000000008000000LL IN_ENCAPS 0x0000000010000000LL OUT_ENCAPS 0x0000000020000000LL PEER_NEXTHOP 0x0000000040000000LL ROUTER_SC 0x0000000080000000LL EXTRA_PKTS 0x0000000100000000LL MARKED_TOS 0x0000000200000000LL The default value is all fields applicable to the pdu_version. -V pdu_version Use pdu_version format output. 1 NetFlow version 1 (No sequence numbers, AS, or mask) 5 NetFlow version 5 6 NetFlow version 6 (5+ Encapsulation size) 7 NetFlow version 7 (Catalyst switches) 8.1 NetFlow AS Aggregation 8.2 NetFlow Proto Port Aggregation 8.3 NetFlow Source Prefix Aggregation 8.4 NetFlow Destination Prefix Aggregation 8.5 NetFlow Prefix Aggregation 8.6 NetFlow Destination (Catalyst switches) 8.7 NetFlow Source Destination (Catalyst switches) 8.8 NetFlow Full Flow (Catalyst switches) 8.9 NetFlow ToS AS Aggregation 8.10 NetFlow ToS Proto Port Aggregation 8.11 NetFlow ToS Source Prefix Aggregation 8.12 NetFlow ToS Destination Prefix Aggregation 8.13 NetFlow ToS Prefix Aggregation 8.14 NetFlow ToS Prefix Port Aggregation 1005 Flow-Tools tagged version 5 -z z_level Configure compression level to z_level. 0 is disabled (no compression), 9 is highest compression. EXAMPLES
Convert the cflowd file flows.cflowd to the flow-tools file flows. Store as Version 5 with compression level 5. flow-import -V5 -z5 -f0 < flows.cflowd > flows EXAMPLES
Convert the ASCII CSV data in flows.ascii to flow-tools format. The ASCII data must include all fields represented by 0xFF31EF in the order listed above. Store as Version 5 with no compression. flow-import -z0 -f2 -m0xFF31EF < flows.ascii > flows BUGS
The pcap format is a hack. AUTHOR
Mark Fullmer maf@splintered.net SEE ALSO
flow-tools(1) flow-import(1)
Check Out this Related Man Page
flow-fanout(1) General Commands Manual flow-fanout(1) NAME
flow-fanout -- Fanout (replicate) flow exports to many destinations. SYNOPSIS
flow-fanout [-h] [-A AS0_substitution] [-d debug_level] [-f filter_fname] [-F filter_definition] [-m privacy_mask] [-p pidfile] [-s] [-S stat_interval] [-V pdu_version] [-x xmit_delay] localip/remoteip/port localip/remoteip/port ... DESCRIPTION
The flow-fanout utility will replicate flows arriving on localip/remoteip/port to destination(s) specified by localip/remoteip/port. Flows processed by multiple exporters will be mixed into a single output stream. This functionality appeared to support Cisco Catalyst exports and may have other uses. A SIGQUIT or SIGTERM signal will cause flow-fanout to exit. OPTIONS
-A AS0_substitution Cisco's NetFlow exports represent the local autonomous system as 0 instead of the real value. This option can be used to replace the 0 in the export with the a configured value. Unfortunately under certain configurations AS 0 can also represent a cache miss or non forwarded traffic so use with caution. -d debug_level Enable debugging. -f filter_fname Filter list filename. Defaults to /etc/flow-tools/cfg/filter. -F filter_definition Select the active definition. Defaults to default. -h Display help. -m privacy_mask Apply privacy_mask to the source and destination IP address of flows. For example a privacy_mask of 255.255.255.0 would convert flows with source/destination IP addresses 10.1.1.1 and 10.2.2.2 to 10.1.1.0 and 10.2.2.0 respectively. -p pidfile Configure the process ID file. Use - to disable pid file creation. -s Spoof the source IP address. If the IP address is 0 then it is replaced with the exporter source IP. -S stat_interval When configured flow-fanout will emit a timestamped message on stderr every stat_interval minutes indicating counters such as the number of flows received, packets processed, and lost flows. -V pdu_version Use pdu_version format output. 1 NetFlow version 1 (No sequence numbers, AS, or mask) 5 NetFlow version 5 6 NetFlow version 6 (5+ Encapsulation size) 7 NetFlow version 7 (Catalyst switches) 8.1 NetFlow AS Aggregation 8.2 NetFlow Proto Port Aggregation 8.3 NetFlow Source Prefix Aggregation 8.4 NetFlow Destination Prefix Aggregation 8.5 NetFlow Prefix Aggregation 8.6 NetFlow Destination (Catalyst switches) 8.7 NetFlow Source Destination (Catalyst switches) 8.8 NetFlow Full Flow (Catalyst switches) 8.9 NetFlow ToS AS Aggregation 8.10 NetFlow ToS Proto Port Aggregation 8.11 NetFlow ToS Source Prefix Aggregation 8.12 NetFlow ToS Destination Prefix Aggregation 8.13 NetFlow ToS Prefix Aggregation 8.14 NetFlow ToS Prefix Port Aggregation 1005 Flow-Tools tagged version 5 -x xmit_delay Configure a microsecond transmit delay between packets. This may be necessary in some configurations to prevent a transmit buf- fer overrun. EXAMPLES
Replicate flows arriving to local IP address 10.0.0.1 from the router exporting with IP address 10.1.1.1 on port 9500 to localhost port 9500 and 10.5.5.5 port 9200. The exports sent to 10.5.5.5 will be sent with a source IP address of 10.0.0.5 which must be a valid local IP address. flow-fanout 10.0.0.1/10.1.1.1/9500 0/0/9500 10.0.0.5/10.5.5.5/9200 BUGS
NetFlow exports do not contain the exporter IP address inside the payload so the original exporter IP address (typically a router) will be lost when using flow-fanout. A work around for this protocol limitation is to use local IP aliases and the localip option. When the spoofing option is used multiple exporters with different IP addresses will share the same sequence number but will have the orig- inal source IP. Fixing this requires per source : destination sequence number mapping. It is much easier to just use multiple instances of flow-fanout running on different ports. AUTHOR
Mark Fullmer maf@splintered.net SEE ALSO
flow-tools(1) flow-fanout(1)