1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
...\" $Header: /usr/src/docbook-to-man/cmd/RCS/docbook-to-man.sh,v 1.3 1996/06/17 03:36:49 fld Exp $
...\"
...\" transcript compatibility for postscript use.
...\"
...\" synopsis: .P! <file.ps>
...\"
.de P!
\\&.
.fl \" force out current output buffer
\\!%PB
\\!/showpage{}def
...\" the following is from Ken Flowers -- it prevents dictionary overflows
\\!/tempdict 200 dict def tempdict begin
.fl \" prolog
.sy cat \\$1\" bring in postscript file
...\" the following line matches the tempdict above
\\!end % tempdict %
\\!PE
\\!.
.sp \\$2u \" move below the image
..
.de pF
.ie \\*(f1 .ds f1 \\n(.f
.el .ie \\*(f2 .ds f2 \\n(.f
.el .ie \\*(f3 .ds f3 \\n(.f
.el .ie \\*(f4 .ds f4 \\n(.f
.el .tm ? font overflow
.ft \\$1
..
.de fP
.ie !\\*(f4 \{\
. ft \\*(f4
. ds f4\"
' br \}
.el .ie !\\*(f3 \{\
. ft \\*(f3
. ds f3\"
' br \}
.el .ie !\\*(f2 \{\
. ft \\*(f2
. ds f2\"
' br \}
.el .ie !\\*(f1 \{\
. ft \\*(f1
. ds f1\"
' br \}
.el .tm ? font underflow
..
.ds f1\"
.ds f2\"
.ds f3\"
.ds f4\"
.ta 8n 16n 24n 32n 40n 48n 56n 64n 72n
.TH "\fBflow-mask\fP" "1"
.SH "NAME"
\fBflow-mask\fP \(em Apply tags to flow files\&.
.SH "SYNOPSIS"
.PP
\fBflow-mask\fP [-hk] [-b\fI big\fP|\fIlittle\fP] [-C\fI comment\fP] [-d\fI debug_level\fP] [-m\fI mask_fname\fP] [-M\fI active_def\fP \&...]
.SH "DESCRIPTION"
.PP
The \fBflow-mask\fP utility is used to modify the
source and destination mask length\&'s in flow records\&.
.SH "OPTIONS"
.IP "-b\fI big\fP|\fIlittle\fP" 10
Byte order of output\&.
.IP "-C\fI Comment\fP" 10
Add a comment\&.
.IP "-d\fI debug_level\fP" 10
Enable debugging\&.
.IP "-h" 10
Display help\&.
.IP "-k" 10
Keep time from input\&.
.IP "-m\fI mask_fname\fP" 10
Load masks from \fBmask_name\fP\&. Defaults to
\fB@localstatedir@/cfg/mask\fP
.IP "-M\fI mask_def\fP" 10
Use \fIactive_def\fP as the active tag definition(s)\&.
.PP
.PP
The configuration file is a collection of definitions\&. A definition
lists a sequence of prefixes and the mask length to replace the matching
prefix with\&.
Lines begining with # are treated as comments and ignored\&.
.PP
.PP
.nf
mask-definition command Description
----------------------------------------------------------------------
mask-definition Begin mask-definition section
mask-definition foo
prefix List the prefix to match on and the
replacement mask\&.
prefix 128\&.146/16 24
.fi
.SH "EXAMPLES"
.PP
.nf
\f(CW#
#file: masks
#
mask-definition foo
# All networks in 128\&.146/16 are /24\&'s\&.
prefix 128\&.146/16 24
# except for 128\&.146\&.214/24, which are /32\&'s\&.
prefix 128\&.146\&.214/24 32\fR
.fi
.PP
.PP
\fBflow-cat \fBflows\fP | flow-mask -mfoo -Fmasks | flow-print -f4\fP
.SH "FILES"
.PP
Configuration files:
Mask - \fB@localstatedir@/cfg/mask\&.cfg\fP\&.
.SH "BUGS"
.PP
None known\&.
.SH "AUTHOR"
.PP
Mark Fullmer maf@splintered\&.net
.SH "SEE ALSO"
.PP
\fBflow-tools\fP(1)
...\" created by instant / docbook-to-man, Fri 02 Jan 2004, 16:26
|
