FLOW-FILTER(1)

NAME
flow-filter - filter flows (grep for flows, sort of)

SYNOPSIS
flow-filter [ -a src-as-list ] [ -A dst-as-list ] [ -b little|big ] [ -C comment ] [ -d debuglevel ] [ -f acl-file ] [ -p src-port-list ] [ -P dst-port-list ] [ -r ip-proto-list ] [ -S src-acl-filter ] [ -D dst-acl-filter ] [ -E extended-acl-filter ] [ -z compress-level ] [ -i input-interface-list ] [ -I output-interface-list ]

DESCRIPTION
flow-filter filters flows (hence the name :-). Currently only understands standard access lists, and 11.2 named standard access lists. See the examples below for a more complete sense of the power of this program.

OPTIONS
More than you can shake a stick at. Note that in the case of lists, you can use ',' to separate list elements (e.g. 60,100 would match 60 or 100), '-' to create a range (e.g. 10-20,60 would match 10 through 20 or 60), and '!' to invert a list (e.g. !10-20 would match everything except 10 through 20). Match flows by source or destination AS (autonomous system number). Default is to match all. Set the output byte order. Include a comment in the header in the output. Set the debugging level. File to read CISCO style ACLs from. Default is Flow.acl in the current directory. Match flows by source or destination port number. -p 21-25,111 would match all flows with a source port (TCP or UDP) of 21, 22, 23, 24, 25 or 111. Use -r to filter by IP protocol type. Match flows by their IP protocol type (e.g. TCP, UDP, ICMP, PPTP, etc.) Note that you must use numeric values here - 6 for TCP, 17 for UDP, 1 for ICMP, etc. Match flows using CISCO standard access control lists. These ACLs are read from the ACL definition file, which you select with -f. Not implemented yet. Sorry! Set the compression level for the output records. Match flows by input or output interface numbers.

EXAMPLES
Here's a sample Flow.acl file:

    ip access-list standard all permit any
    ip access-list standard victim permit 1.2.3.4 0.0.0.0
    ip access-list standard victim deny any
    ip access-list standard osu permit 128.146.222.0 0.0.0.255
    ip access-list standard osu permit 164.107.1.1 0.0.0.0
    ip access-list standard osu deny any
    ip access-list standard attacker permit 10.0.0.1 0.0.0.0
    ip access-list standard attacker permit 10.0.0.2 0.0.0.0
    ip access-list standard attacker deny any
Let's suppose that the interface that we're looking at flows from the router that connects our network (128.146.0.0 and 164.107.0.0) to the Internet (everything else), and that that interface number is 7.

We get a call from the admins of 1.2.3.4 indicating that they've seen a breakin from our address space earlier today (April 19, 2000). To see the corresponding traffic from today to their site, use:

    flow-cat cf05.2000-04-19* | flow-filter -D victim -I 7 |
       flow-print -f 5 | less
That would show the flows for the traffic going to their site, and we should be able to confirm whether there's activity that corresponds to their claim (remember that many types of Internet attacks can come from spoofed addresses, and so we might not see corresponding flows from our network even though the victim thinks that the attack originates here).

This should also help us identify hosts on our network that were the sources of the attacks on the victim hosts. So we create a second ACL, called osu, that matches those addresses. We might then look to see where else those hosts connected on the Internet:

    ... | flow-filter -S osu -I 7 | ...
Now we can try to pick out signs of attacks against other sites on the Internet so that we can warn them that they may have been broken into.

To identify how our hosts were broken into, we would search for traffic to the OSU hosts (note that now we're looking at traffic coming in on interface 7):

    ... | flow-filter -D osu -i 7 | ...
We peruse that traffic to try to identify attacking hosts, and create another ACL called attacker. Now we can try to identify other OSU hosts that might have been compromised:

    ... | flow-filter -S attacker -i 7 | ...
To single out traffic between one group of hosts and another, use -S and -D together:

    ... | flow-filter -S attacker -D osu | ...
To see all the traffic from the OSU hosts except for web traffic, we might do something like this:

    ... | flow-filter -S osu -P !80,8080,443 | ...
Note that this will eliminate UDP and TCP traffic to those ports.

See also flow-search. Note that it is often easier to simply use 'awk' to filter the output once you've narrowed the focus sufficiently with flow-filter. For example:

    ... | flow-filter -S osu | flow-print -f 5 | awk '$9 == 6 && ($8
       != 80 && $8 != 443)' | less

SEE ALSO
flow-capture(1), flow-cat(1), flow-connect(1), flow-dscan(1),flow-expire(1), flow-export(1), flow-fanout(1), flow-filter(1), flow-gen(1), flow-interfaces(1), flow-print(1), flow-profile(1), flow-receive(1), flow-search(1), flow-send(1), flow-sort(1), flow-stat(1),

BUGS
Extended ACLs aren't supported yet, but would be nice. It would also be nice to be able to construct logical expressions from these primitives (ala tcpdump).

Note that flows are exported in order of their ending time. This complicates interpretation, since you may not see things in the right order. See flow-sort, or use the UNIX sort command to sort the output from flow-print.