File: flow-stat.html

package info (click to toggle)
flow-tools 1%3A0.68-10
links: PTS
area: main
in suites: etch, etch-m68k
size: 5,120 kB
ctags: 5,259
sloc: ansic: 43,197; sh: 1,611; perl: 661; python: 629; yacc: 303; makefile: 206; lex: 49
file content (418 lines) | stat: -rw-r--r-- 7,349 bytes
parent folder | download | duplicates (5)
<HTML
><HEAD
><TITLE
>flow-stat</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.71
"></HEAD
><BODY
CLASS="REFENTRY"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><H1
><A
NAME="AEN1"
><SPAN
CLASS="APPLICATION"
>flow-stat</SPAN
></A
></H1
><DIV
CLASS="REFNAMEDIV"
><A
NAME="AEN6"
></A
><H2
>Name</H2
><SPAN
CLASS="APPLICATION"
>flow-stat</SPAN
>&nbsp;--&nbsp;Generate reports with flow data.</DIV
><DIV
CLASS="REFSYNOPSISDIV"
><A
NAME="AEN10"
></A
><H2
>Synopsis</H2
><P
><B
CLASS="COMMAND"
>flow-stat</B
>  [-hnpPw] [-d<TT
CLASS="REPLACEABLE"
><I
> debug_level</I
></TT
>] [-f<TT
CLASS="REPLACEABLE"
><I
> format</I
></TT
>] [-S<TT
CLASS="REPLACEABLE"
><I
> sort_field</I
></TT
>] [-s<TT
CLASS="REPLACEABLE"
><I
> sort_field</I
></TT
>] [-t<TT
CLASS="REPLACEABLE"
><I
> tally_lines</I
></TT
>] [-T<TT
CLASS="REPLACEABLE"
><I
> title</I
></TT
>]</P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN26"
></A
><H2
>DESCRIPTION</H2
><P
>The <B
CLASS="COMMAND"
>flow-stat</B
> utility generates usage reports for flow
data sets by IP address, IP address pairs, ports, packets, bytes,
interfaces, next hops, autonomous systems, ToS bits, exporters, and tags.</P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN30"
></A
><H2
>OPTIONS</H2
><P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
>-d<TT
CLASS="REPLACEABLE"
><I
> debug_level</I
></TT
></DT
><DD
><P
>Enable debugging.</P
></DD
><DT
>-f<TT
CLASS="REPLACEABLE"
><I
> format</I
></TT
></DT
><DD
><P
><P
CLASS="LITERALLAYOUT"
>Report&nbsp;format.&nbsp;&nbsp;Choose&nbsp;from&nbsp;the&nbsp;following:<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;&nbsp;Overall&nbsp;Summary<br>
&nbsp;&nbsp;&nbsp;&nbsp;1&nbsp;&nbsp;Average&nbsp;packet&nbsp;size&nbsp;distribution<br>
&nbsp;&nbsp;&nbsp;&nbsp;2&nbsp;&nbsp;Packets&nbsp;per&nbsp;flow&nbsp;distribution<br>
&nbsp;&nbsp;&nbsp;&nbsp;3&nbsp;&nbsp;Octets&nbsp;per&nbsp;flow&nbsp;distribution<br>
&nbsp;&nbsp;&nbsp;&nbsp;4&nbsp;&nbsp;Bandwidth&nbsp;per&nbsp;flow&nbsp;distribution<br>
&nbsp;&nbsp;&nbsp;&nbsp;5&nbsp;&nbsp;UDP/TCP&nbsp;destination&nbsp;port<br>
&nbsp;&nbsp;&nbsp;&nbsp;6&nbsp;&nbsp;UDP/TCP&nbsp;source&nbsp;port<br>
&nbsp;&nbsp;&nbsp;&nbsp;7&nbsp;&nbsp;UDP/TCP&nbsp;port<br>
&nbsp;&nbsp;&nbsp;&nbsp;8&nbsp;&nbsp;Destination&nbsp;IP<br>
&nbsp;&nbsp;&nbsp;&nbsp;9&nbsp;&nbsp;Source&nbsp;IP<br>
&nbsp;&nbsp;&nbsp;&nbsp;10&nbsp;Source/Destination&nbsp;IP<br>
&nbsp;&nbsp;&nbsp;&nbsp;11&nbsp;Source&nbsp;or&nbsp;Destination&nbsp;IP<br>
&nbsp;&nbsp;&nbsp;&nbsp;12&nbsp;IP&nbsp;protocol<br>
&nbsp;&nbsp;&nbsp;&nbsp;13&nbsp;octets&nbsp;for&nbsp;flow&nbsp;duration&nbsp;plot&nbsp;data<br>
&nbsp;&nbsp;&nbsp;&nbsp;14&nbsp;packets&nbsp;for&nbsp;flow&nbsp;duration&nbsp;plot&nbsp;data<br>
&nbsp;&nbsp;&nbsp;&nbsp;15&nbsp;short&nbsp;summary<br>
&nbsp;&nbsp;&nbsp;&nbsp;16&nbsp;IP&nbsp;Next&nbsp;Hop<br>
&nbsp;&nbsp;&nbsp;&nbsp;17&nbsp;Input&nbsp;interface<br>
&nbsp;&nbsp;&nbsp;&nbsp;18&nbsp;Output&nbsp;interface<br>
&nbsp;&nbsp;&nbsp;&nbsp;19&nbsp;Source&nbsp;AS<br>
&nbsp;&nbsp;&nbsp;&nbsp;20&nbsp;Destination&nbsp;AS<br>
&nbsp;&nbsp;&nbsp;&nbsp;21&nbsp;Source/Destination&nbsp;AS<br>
&nbsp;&nbsp;&nbsp;&nbsp;22&nbsp;IP&nbsp;ToS<br>
&nbsp;&nbsp;&nbsp;&nbsp;23&nbsp;Input/Output&nbsp;Interface<br>
&nbsp;&nbsp;&nbsp;&nbsp;24&nbsp;Source&nbsp;Prefix<br>
&nbsp;&nbsp;&nbsp;&nbsp;25&nbsp;Destination&nbsp;Prefix<br>
&nbsp;&nbsp;&nbsp;&nbsp;26&nbsp;Source/Destination&nbsp;Prefix<br>
&nbsp;&nbsp;&nbsp;&nbsp;27&nbsp;Exporter&nbsp;IP<br>
&nbsp;&nbsp;&nbsp;&nbsp;28&nbsp;Engine&nbsp;Id<br>
&nbsp;&nbsp;&nbsp;&nbsp;29&nbsp;Engine&nbsp;Type<br>
&nbsp;&nbsp;&nbsp;&nbsp;30&nbsp;Source&nbsp;Tag<br>
&nbsp;&nbsp;&nbsp;&nbsp;31&nbsp;Destination&nbsp;Tag<br>
&nbsp;&nbsp;&nbsp;&nbsp;32&nbsp;Source/Destination&nbsp;Tag</P
></P
></DD
><DT
>-h</DT
><DD
><P
>Display help.</P
></DD
><DT
>-n</DT
><DD
><P
>Use symbolic names where appropriate.</P
></DD
><DT
>-p</DT
><DD
><P
>Display header information.</P
></DD
><DT
>-P</DT
><DD
><P
>Report as percent total.</P
></DD
><DT
>-s<TT
CLASS="REPLACEABLE"
><I
> sort_field</I
></TT
></DT
><DD
><P
>Sort ascending on field <TT
CLASS="REPLACEABLE"
><I
>sort_field</I
></TT
>.</P
></DD
><DT
>-S<TT
CLASS="REPLACEABLE"
><I
> sort_field</I
></TT
></DT
><DD
><P
>Sort descending on field <TT
CLASS="REPLACEABLE"
><I
>sort_field</I
></TT
>.</P
></DD
><DT
>-t<TT
CLASS="REPLACEABLE"
><I
> tally_lines</I
></TT
></DT
><DD
><P
>Tally totals every <TT
CLASS="REPLACEABLE"
><I
>tally_lines</I
></TT
>lines.</P
></DD
><DT
>-T<TT
CLASS="REPLACEABLE"
><I
> title</I
></TT
></DT
><DD
><P
>Set report title to <TT
CLASS="REPLACEABLE"
><I
>title</I
></TT
>.</P
></DD
><DT
>-w</DT
><DD
><P
>Wide output.</P
></DD
></DL
></DIV
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN88"
></A
><H2
>EXAMPLES</H2
><DIV
CLASS="INFORMALEXAMPLE"
><A
NAME="AEN90"
></A
><P
></P
><P
>Provide a report on top source/destination IP pairs sorted by octets, report
in percent total form for the flows in <TT
CLASS="FILENAME"
>/flows/krc4</TT
>.
Use the preload option to flow-cat to preserve meta information and 
display it with flow-stat.</P
><P
>  <B
CLASS="COMMAND"
>flow-cat -p /flows/krc4 | flow-stat -f10 -P -p -S4</B
></P
><P
></P
></DIV
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN95"
></A
><H2
>EXAMPLES</H2
><DIV
CLASS="INFORMALEXAMPLE"
><A
NAME="AEN97"
></A
><P
></P
><P
>Many times a campus network will have a single border router which has
one interface pointing to the internal side and many interfaces pointing
to other providers.  These interfaces each have a unique numerical id
known in SNMP terms as an ifIndex.  The ifIndex to interface name mappings
can be determined by using a tool such as <SPAN
CLASS="APPLICATION"
>snmpwalk</SPAN
>
or using show commands in recent versions of IOS with the
'show snmp mib ifmib ifindex' or JunOS 'show interfaces'.  Once the ifIndex
for each interface is known flow-filter can be combined with flow-stat to
provide reports such as inbound vs outbound top src/destination IP
addresses.

Provide a top source IP address report by outbound traffic, ie the top
senders of traffic on the campus network.  Assume the ifIndex of the
campus interface is 5.</P
><P
>  flow-cat -p /flows/krc4 | flow-filter -i5 | flow-stat -f9 -P -p -S3 </P
><P
></P
></DIV
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN101"
></A
><H2
>EXAMPLES</H2
><DIV
CLASS="INFORMALEXAMPLE"
><A
NAME="AEN103"
></A
><P
></P
><P
>Provide a top destination IP address report by outbound traffic, ie the top
sinks of traffic on the campus network.  Assume the ifIndex of the
campus interface is 5.</P
><P
>  flow-cat -p /flows/krc4 | flow-filter -I5 | flow-stat -f8 -P -p -S3 </P
><P
></P
></DIV
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN106"
></A
><H2
>EXAMPLES</H2
><DIV
CLASS="INFORMALEXAMPLE"
><A
NAME="AEN108"
></A
><P
></P
><P
>Provide a top source/destination AS report.  Use symbolic names.</P
><P
>  flow-cat -p /flows/krc4 | flow-stat -f20 -n -P -p -S4 </P
><P
></P
></DIV
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN111"
></A
><H2
>BUGS</H2
><P
>None known.</P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN114"
></A
><H2
>AUTHOR</H2
><P
>Mark Fullmer
<TT
CLASS="EMAIL"
>&#60;<A
HREF="mailto:maf@splintered.net"
>maf@splintered.net</A
>&#62;</TT
></P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN121"
></A
><H2
>SEE ALSO</H2
><P
><SPAN
CLASS="APPLICATION"
>flow-tools</SPAN
>(1)</P
></DIV
></BODY
></HTML
>