flow-receive(1) [debian man page]
flow-receive(1) General Commands Manual flow-receive(1) NAME
flow-receive -- Receive flow data with the NetFlow protocol. SYNOPSIS
flow-receive [-h] [-b big|little] [-C comment] [-d debug_level] [-o output_file] [-S stat_interval] [-V pdu_version] [-z z_level] localip/remoteip/port DESCRIPTION
The flow-receive utility is used to receive flows in NetFlow format. When the remoteip is configured only flows from that exporter will be processed, this is the most secure and recommended configuration. When the localip is configured flow-receive will only process flows sent to the localip IP address. If remoteip is 0 (not configured) flows from any source IP address are accepted. Multiple non aggregated PDU versions may be accepted at once to support Cisco's Catalyst 6500 NetFlow implementation which exports from both the supervisor and MSFC with the same IP address and same port but different export versions. In this case the exports will be stored in the format specified by the -V flag or whichever export type is received first. OPTIONS
-b big|little Byte order of output. -C Comment Add a comment. -d debug_level Enable debugging. -h Display help. -o file Write to file instead of the standard out. -S stat_interval When configured flow-receive will emit a timestamped message on stderr every stat_interval minutes indicating counters such as the number of flows received, packets processed, and lost flows. -V pdu_version Use pdu_version format output. 1 NetFlow version 1 (No sequence numbers, AS, or mask) 5 NetFlow version 5 6 NetFlow version 6 (5+ Encapsulation size) 7 NetFlow version 7 (Catalyst switches) 8.1 NetFlow AS Aggregation 8.2 NetFlow Proto Port Aggregation 8.3 NetFlow Source Prefix Aggregation 8.4 NetFlow Destination Prefix Aggregation 8.5 NetFlow Prefix Aggregation 8.6 NetFlow Destination (Catalyst switches) 8.7 NetFlow Source Destination (Catalyst switches) 8.8 NetFlow Full Flow (Catalyst switches) 8.9 NetFlow ToS AS Aggregation 8.10 NetFlow ToS Proto Port Aggregation 8.11 NetFlow ToS Source Prefix Aggregation 8.12 NetFlow ToS Destination Prefix Aggregation 8.13 NetFlow ToS Prefix Aggregation 8.14 NetFlow ToS Prefix Port Aggregation 1005 Flow-Tools tagged version 5 -z z_level Configure compression level to z_level. 0 is disabled (no compression), 9 is highest compression. EXAMPLES
Listen on port 9800 on any local interface for exports from IP address 10.0.0.1, store the exports in flows flow-receive 0/10.0.0.1/9800 > flows Listen on port 9800 on any local interface from any IP address, display the received flows with flow-print. flow-receive 0/0/9800 | flow-print BUGS
It is not currently possible to convert between the aggregated formats (8.x) and the non aggregated formats (1,5,6,7). AUTHOR
Mark Fullmer maf@splintered.net SEE ALSO
flow-tools(1) flow-receive(1)
Check Out this Related Man Page
flow-import(1) General Commands Manual flow-import(1) NAME
flow-import -- Import flows into flow-tools from other NetFlow packages. SYNOPSIS
flow-import [-h] [-b big|little] [-d debug_level] [-f format] [-m mask_fields] [-V pdu_version] [-z z_level] DESCRIPTION
The flow-import utility will convert data from cflowd and ASCII CSV files into flow-tools format. OPTIONS
-b big|little Byte order of output. -d debug_level Enable debugging. -f format Export format. Supported formats are: 0 cflowd 2 ASCII CSV 3 Cisco NFCollector -h Display help. -m mask_fields Select fields for cflowd and ASCII formats. The mask_fields is built from a bitwise OR of the following: UNIX_SECS 0x0000000000000001LL UNIX_NSECS 0x0000000000000002LL SYSUPTIME 0x0000000000000004LL EXADDR 0x0000000000000008LL DFLOWS 0x0000000000000010LL DPKTS 0x0000000000000020LL DOCTETS 0x0000000000000040LL FIRST 0x0000000000000080LL LAST 0x0000000000000100LL ENGINE_TYPE 0x0000000000000200LL ENGINE_ID 0x0000000000000400LL SRCADDR 0x0000000000001000LL DSTADDR 0x0000000000002000LL SRC_PREFIX 0x0000000000004000LL DST_PREFIX 0x0000000000008000LL NEXTHOP 0x0000000000010000LL INPUT 0x0000000000020000LL OUTPUT 0x0000000000040000LL SRCPORT 0x0000000000080000LL DSTPORT 0x0000000000100000LL PROT 0x0000000000200000LL TOS 0x0000000000400000LL TCP_FLAGS 0x0000000000800000LL SRC_MASK 0x0000000001000000LL DST_MASK 0x0000000002000000LL SRC_AS 0x0000000004000000LL DST_AS 0x0000000008000000LL IN_ENCAPS 0x0000000010000000LL OUT_ENCAPS 0x0000000020000000LL PEER_NEXTHOP 0x0000000040000000LL ROUTER_SC 0x0000000080000000LL EXTRA_PKTS 0x0000000100000000LL MARKED_TOS 0x0000000200000000LL The default value is all fields applicable to the pdu_version. -V pdu_version Use pdu_version format output. 1 NetFlow version 1 (No sequence numbers, AS, or mask) 5 NetFlow version 5 6 NetFlow version 6 (5+ Encapsulation size) 7 NetFlow version 7 (Catalyst switches) 8.1 NetFlow AS Aggregation 8.2 NetFlow Proto Port Aggregation 8.3 NetFlow Source Prefix Aggregation 8.4 NetFlow Destination Prefix Aggregation 8.5 NetFlow Prefix Aggregation 8.6 NetFlow Destination (Catalyst switches) 8.7 NetFlow Source Destination (Catalyst switches) 8.8 NetFlow Full Flow (Catalyst switches) 8.9 NetFlow ToS AS Aggregation 8.10 NetFlow ToS Proto Port Aggregation 8.11 NetFlow ToS Source Prefix Aggregation 8.12 NetFlow ToS Destination Prefix Aggregation 8.13 NetFlow ToS Prefix Aggregation 8.14 NetFlow ToS Prefix Port Aggregation 1005 Flow-Tools tagged version 5 -z z_level Configure compression level to z_level. 0 is disabled (no compression), 9 is highest compression. EXAMPLES
Convert the cflowd file flows.cflowd to the flow-tools file flows. Store as Version 5 with compression level 5. flow-import -V5 -z5 -f0 < flows.cflowd > flows EXAMPLES
Convert the ASCII CSV data in flows.ascii to flow-tools format. The ASCII data must include all fields represented by 0xFF31EF in the order listed above. Store as Version 5 with no compression. flow-import -z0 -f2 -m0xFF31EF < flows.ascii > flows BUGS
The pcap format is a hack. AUTHOR
Mark Fullmer maf@splintered.net SEE ALSO
flow-tools(1) flow-import(1)