File: flow-receive.html.in

package info (click to toggle)
flow-tools 1%3A0.68-12.1
links: PTS
area: main
in suites: jessie, jessie-kfreebsd, wheezy
size: 5,136 kB
ctags: 5,259
sloc: ansic: 43,197; sh: 1,674; perl: 661; python: 629; yacc: 303; makefile: 208; lex: 49
file content (373 lines) | stat: -rw-r--r-- 6,492 bytes
parent folder | download | duplicates (4)
<HTML
><HEAD
><TITLE
>flow-receive</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.73
"></HEAD
><BODY
CLASS="REFENTRY"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><H1
><A
NAME="AEN1"
><SPAN
CLASS="APPLICATION"
>flow-receive</SPAN
></A
></H1
><DIV
CLASS="REFNAMEDIV"
><A
NAME="AEN6"
></A
><H2
>Name</H2
><SPAN
CLASS="APPLICATION"
>flow-receive</SPAN
>&nbsp;--&nbsp;Receive flow data with the NetFlow protocol.</DIV
><DIV
CLASS="REFSYNOPSISDIV"
><A
NAME="AEN10"
></A
><H2
>Synopsis</H2
><P
><B
CLASS="COMMAND"
>flow-receive</B
>  [-h] [-b<TT
CLASS="REPLACEABLE"
><I
> big|little</I
></TT
>] [-C<TT
CLASS="REPLACEABLE"
><I
> comment</I
></TT
>] [-d<TT
CLASS="REPLACEABLE"
><I
> debug_level</I
></TT
>] [-o<TT
CLASS="REPLACEABLE"
><I
> output_file</I
></TT
>] [-S<TT
CLASS="REPLACEABLE"
><I
> stat_interval</I
></TT
>] [-V<TT
CLASS="REPLACEABLE"
><I
> pdu_version</I
></TT
>] [-z<TT
CLASS="REPLACEABLE"
><I
> z_level</I
></TT
>] {<TT
CLASS="REPLACEABLE"
><I
>localip/remoteip/port</I
></TT
>}</P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN30"
></A
><H2
>DESCRIPTION</H2
><P
>The <B
CLASS="COMMAND"
>flow-receive</B
> utility is used to receive flows in NetFlow
format.  When the <TT
CLASS="REPLACEABLE"
><I
>remoteip</I
></TT
> is configured only flows
from that exporter will be processed, this is the most secure and recommended
configuration.  When the <TT
CLASS="REPLACEABLE"
><I
>localip</I
></TT
> is configured
<B
CLASS="COMMAND"
>flow-receive</B
> will only process flows
sent to the <TT
CLASS="REPLACEABLE"
><I
> localip</I
></TT
> IP address.  If
<TT
CLASS="REPLACEABLE"
><I
>remoteip</I
></TT
> is 0 (not configured) flows from any
source IP address are accepted.  Multiple non aggregated PDU versions may
be accepted at once to support Cisco's Catalyst 6500 NetFlow
implementation which exports from both the supervisor and MSFC with the
same IP address and same port but different export versions.  In this case
the exports will be stored in the format specified by the -V flag or
whichever export type is received first.
 </P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN39"
></A
><H2
>OPTIONS</H2
><P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
>-b<TT
CLASS="REPLACEABLE"
><I
> big</I
></TT
>|<TT
CLASS="REPLACEABLE"
><I
>little</I
></TT
></DT
><DD
><P
>Byte order of output.</P
></DD
><DT
>-C<TT
CLASS="REPLACEABLE"
><I
> Comment</I
></TT
></DT
><DD
><P
>Add a comment.</P
></DD
><DT
>-d<TT
CLASS="REPLACEABLE"
><I
> debug_level</I
></TT
></DT
><DD
><P
>Enable debugging.</P
></DD
><DT
>-h</DT
><DD
><P
>Display help.</P
></DD
><DT
>-o<TT
CLASS="REPLACEABLE"
><I
> file</I
></TT
></DT
><DD
><P
>Write to <TT
CLASS="FILENAME"
>file</TT
> instead of the standard out.</P
></DD
><DT
>-S<TT
CLASS="REPLACEABLE"
><I
> stat_interval</I
></TT
></DT
><DD
><P
>When configured <B
CLASS="COMMAND"
>flow-receive</B
> will emit a timestamped
message on stderr every <TT
CLASS="REPLACEABLE"
><I
>stat_interval</I
></TT
> minutes
indicating counters such as the number of flows received, packets processed,
and lost flows.</P
></DD
><DT
>-V<TT
CLASS="REPLACEABLE"
><I
> pdu_version</I
></TT
></DT
><DD
><P
>Use <TT
CLASS="REPLACEABLE"
><I
>pdu_version</I
></TT
> format output.
<P
CLASS="LITERALLAYOUT"
>&nbsp;&nbsp;&nbsp;&nbsp;1&nbsp;&nbsp;&nbsp;&nbsp;NetFlow&nbsp;version&nbsp;1&nbsp;(No&nbsp;sequence&nbsp;numbers,&nbsp;AS,&nbsp;or&nbsp;mask)<br>
&nbsp;&nbsp;&nbsp;&nbsp;5&nbsp;&nbsp;&nbsp;&nbsp;NetFlow&nbsp;version&nbsp;5<br>
&nbsp;&nbsp;&nbsp;&nbsp;6&nbsp;&nbsp;&nbsp;&nbsp;NetFlow&nbsp;version&nbsp;6&nbsp;(5+&nbsp;Encapsulation&nbsp;size)<br>
&nbsp;&nbsp;&nbsp;&nbsp;7&nbsp;&nbsp;&nbsp;&nbsp;NetFlow&nbsp;version&nbsp;7&nbsp;(Catalyst&nbsp;switches)<br>
&nbsp;&nbsp;&nbsp;&nbsp;8.1&nbsp;&nbsp;NetFlow&nbsp;AS&nbsp;Aggregation<br>
&nbsp;&nbsp;&nbsp;&nbsp;8.2&nbsp;&nbsp;NetFlow&nbsp;Proto&nbsp;Port&nbsp;Aggregation<br>
&nbsp;&nbsp;&nbsp;&nbsp;8.3&nbsp;&nbsp;NetFlow&nbsp;Source&nbsp;Prefix&nbsp;Aggregation<br>
&nbsp;&nbsp;&nbsp;&nbsp;8.4&nbsp;&nbsp;NetFlow&nbsp;Destination&nbsp;Prefix&nbsp;Aggregation<br>
&nbsp;&nbsp;&nbsp;&nbsp;8.5&nbsp;&nbsp;NetFlow&nbsp;Prefix&nbsp;Aggregation<br>
&nbsp;&nbsp;&nbsp;&nbsp;8.6&nbsp;&nbsp;NetFlow&nbsp;Destination&nbsp;(Catalyst&nbsp;switches)<br>
&nbsp;&nbsp;&nbsp;&nbsp;8.7&nbsp;&nbsp;NetFlow&nbsp;Source&nbsp;Destination&nbsp;(Catalyst&nbsp;switches)<br>
&nbsp;&nbsp;&nbsp;&nbsp;8.8&nbsp;&nbsp;NetFlow&nbsp;Full&nbsp;Flow&nbsp;(Catalyst&nbsp;switches)<br>
&nbsp;&nbsp;&nbsp;&nbsp;8.9&nbsp;&nbsp;NetFlow&nbsp;ToS&nbsp;AS&nbsp;Aggregation<br>
&nbsp;&nbsp;&nbsp;&nbsp;8.10&nbsp;NetFlow&nbsp;ToS&nbsp;Proto&nbsp;Port&nbsp;Aggregation<br>
&nbsp;&nbsp;&nbsp;&nbsp;8.11&nbsp;NetFlow&nbsp;ToS&nbsp;Source&nbsp;Prefix&nbsp;Aggregation<br>
&nbsp;&nbsp;&nbsp;&nbsp;8.12&nbsp;NetFlow&nbsp;ToS&nbsp;Destination&nbsp;Prefix&nbsp;Aggregation<br>
&nbsp;&nbsp;&nbsp;&nbsp;8.13&nbsp;NetFlow&nbsp;ToS&nbsp;Prefix&nbsp;Aggregation<br>
&nbsp;&nbsp;&nbsp;&nbsp;8.14&nbsp;NetFlow&nbsp;ToS&nbsp;Prefix&nbsp;Port&nbsp;Aggregation<br>
&nbsp;&nbsp;&nbsp;&nbsp;1005&nbsp;Flow-Tools&nbsp;tagged&nbsp;version&nbsp;5</P
></P
></DD
><DT
>-z<TT
CLASS="REPLACEABLE"
><I
> z_level</I
></TT
></DT
><DD
><P
>Configure compression level to <TT
CLASS="REPLACEABLE"
><I
> z_level</I
></TT
>.  0 is
disabled (no compression), 9 is highest compression.   </P
></DD
></DL
></DIV
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN88"
></A
><H2
>EXAMPLES</H2
><DIV
CLASS="INFORMALEXAMPLE"
><A
NAME="AEN90"
></A
><P
></P
><P
>Listen on port 9800 on any local interface for exports from IP address
10.0.0.1, store the exports in <TT
CLASS="FILENAME"
>flows</TT
></P
><P
>  <B
CLASS="COMMAND"
>flow-receive</B
> 0/10.0.0.1/9800 &#62; <TT
CLASS="FILENAME"
>flows</TT
></P
><P
>Listen on port 9800 on any local interface from any IP address, display
the received flows with flow-print.</P
><P
>  <B
CLASS="COMMAND"
>flow-receive</B
> 0/0/9800 | <B
CLASS="COMMAND"
>flow-print</B
></P
><P
></P
></DIV
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN100"
></A
><H2
>BUGS</H2
><P
>It is not currently possible to convert between the aggregated formats (8.x)
and the non aggregated formats (1,5,6,7).</P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN103"
></A
><H2
>AUTHOR</H2
><P
>Mark Fullmer
<TT
CLASS="EMAIL"
>&#60;<A
HREF="mailto:maf@splintered.net"
>maf@splintered.net</A
>&#62;</TT
></P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN110"
></A
><H2
>SEE ALSO</H2
><P
><SPAN
CLASS="APPLICATION"
>flow-tools</SPAN
>(1)</P
></DIV
></BODY
></HTML
>