1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
...\" $Header: /usr/src/docbook-to-man/cmd/RCS/docbook-to-man.sh,v 1.3 1996/06/17 03:36:49 fld Exp $
...\"
...\" transcript compatibility for postscript use.
...\"
...\" synopsis: .P! <file.ps>
...\"
.de P!
\\&.
.fl \" force out current output buffer
\\!%PB
\\!/showpage{}def
...\" the following is from Ken Flowers -- it prevents dictionary overflows
\\!/tempdict 200 dict def tempdict begin
.fl \" prolog
.sy cat \\$1\" bring in postscript file
...\" the following line matches the tempdict above
\\!end % tempdict %
\\!PE
\\!.
.sp \\$2u \" move below the image
..
.de pF
.ie \\*(f1 .ds f1 \\n(.f
.el .ie \\*(f2 .ds f2 \\n(.f
.el .ie \\*(f3 .ds f3 \\n(.f
.el .ie \\*(f4 .ds f4 \\n(.f
.el .tm ? font overflow
.ft \\$1
..
.de fP
.ie !\\*(f4 \{\
. ft \\*(f4
. ds f4\"
' br \}
.el .ie !\\*(f3 \{\
. ft \\*(f3
. ds f3\"
' br \}
.el .ie !\\*(f2 \{\
. ft \\*(f2
. ds f2\"
' br \}
.el .ie !\\*(f1 \{\
. ft \\*(f1
. ds f1\"
' br \}
.el .tm ? font underflow
..
.ds f1\"
.ds f2\"
.ds f3\"
.ds f4\"
.ta 8n 16n 24n 32n 40n 48n 56n 64n 72n
.TH "\fBflow-send\fP" "1"
.SH "NAME"
\fBflow-send\fP \(em Transmit flow data with the NetFlow protocol\&.
.SH "SYNOPSIS"
.PP
\fBflow-send\fP [-h] [-d\fI debug_level\fP] [-m\fI privacy_mask\fP] [-s] [-x\fI xmit_delay\fP] [-V\fI pdu_version\fP] \fIlocalip/remoteip/port\fP
.SH "DESCRIPTION"
.PP
The \fBflow-send\fP utility is used to transmit flows in NetFlow
format to a collector specified by localip/remoteip/port\&.
.SH "OPTIONS"
.IP "-d\fI debug_level\fP" 10
Enable debugging\&.
.IP "-h" 10
Display help\&.
.IP "-s" 10
Enable spoofing of source IP address\&.
.IP "-m\fI privacy_mask\fP" 10
Apply \fIprivacy_mask\fP to the source and destination IP
address of flows\&. For example a privacy_mask of 255\&.255\&.255\&.0 would convert
flows with source/destination IP addresses 10\&.1\&.1\&.1 and 10\&.2\&.2\&.2 to 10\&.1\&.1\&.0
and 10\&.2\&.2\&.0 respectively\&.
.IP "-V\fI pdu_version\fP" 10
Use \fIpdu_version\fP format when transmitting\&.
.PP
.nf
1 NetFlow version 1 (No sequence numbers, AS, or mask)
5 NetFlow version 5
6 NetFlow version 6 (5+ Encapsulation size)
7 NetFlow version 7 (Catalyst switches)
8\&.1 NetFlow AS Aggregation
8\&.2 NetFlow Proto Port Aggregation
8\&.3 NetFlow Source Prefix Aggregation
8\&.4 NetFlow Destination Prefix Aggregation
8\&.5 NetFlow Prefix Aggregation
8\&.6 NetFlow Destination (Catalyst switches)
8\&.7 NetFlow Source Destination (Catalyst switches)
8\&.8 NetFlow Full Flow (Catalyst switches)
8\&.9 NetFlow ToS AS Aggregation
8\&.10 NetFlow ToS Proto Port Aggregation
8\&.11 NetFlow ToS Source Prefix Aggregation
8\&.12 NetFlow ToS Destination Prefix Aggregation
8\&.13 NetFlow ToS Prefix Aggregation
8\&.14 NetFlow ToS Prefix Port Aggregation
1005 Flow-Tools tagged version 5
.fi
.IP "-x\fI xmit_delay\fP" 10
Configure a microsecond transmit delay between packets\&. This may be necessary in some configurations to prevent a transmit buffer overrun\&.
.SH "EXAMPLES"
.PP
Transmit all flows in the directory /flows/krc4 to the collector at 10\&.0\&.0\&.1
listening on port 9500\&.
.PP
\fBflow-cat /flows/krc4 | flow-send 0/10\&.0\&.0\&.1/9500\fP
.PP
Generate a test pattern of version 7 flows and send them to a collector at 10\&.0\&.0\&.1 listening on port 9500\&.
.PP
\fBflow-gen -V7 | flow-send 0/10\&.0\&.0\&.1/9500\fP
.SH "BUGS"
.PP
It is not currently possible to convert between the aggregated formats (8\&.x)
and the non aggregated formats (1,5,6,7)\&.
.SH "AUTHOR"
.PP
Mark Fullmer maf@splintered\&.net
.SH "SEE ALSO"
.PP
\fBflow-tools\fP(1)
...\" created by instant / docbook-to-man, Thu 03 Apr 2003, 10:02
|
