FLOW-SEARCH(1)

NAME
flow-search - apply flow-filter to many flow files in a simple-minded way

SYNOPSIS
flow-search from|to acl-name file1 file2... flow-search between acl1 acl2 file1 file2...

DESCRIPTION
flow-search provides a simple way to apply flow-filter in a simple-minded way to a large number of flow log files. flow-search from acl is equivalent to running flow-filter -S acl -D all -f Flow.acl on each file, flow-search to acl is equivalent to flow-filter -S all -D acl -f Flow.acl, and flow-search between acl1 acl2 is equivalent to running flow-filter -S acl1 -D acl2 -f Flow.acl on the logs. The file Flow.acl must exist in the current directory where flow-search is run from. flow-search creates an output file in the current containing the results of flow-filter for each of the named input logs. Result files are named direction.aclname.logfile, so if we ran flow-search from attacker /var/nf/cf05.2000-02-28.022501, we would end up with a file named from.attacker.cf05.2000-02-28.022501 in the current directory.

Note that flow-search is only pulling out flows that are going in one direction - to get a complete view of the traffic stream between two hosts, or coming in and out of a set of hosts, we would need to search for traffic in the reverse direction as well. flow-search was written this way since its simple and usually "good enough".

See the documentation for flow-filter for a description of standard access control lists.

SEE ALSO
flow-capture(1), flow-cat(1), flow-connect(1), flow-dscan(1),flow-expire(1), flow-export(1), flow-fanout(1), flow-filter(1), flow-gen(1), flow-interfaces(1), flow-print(1), flow-profile(1), flow-receive(1), flow-search(1), flow-send(1), flow-sort(1), flow-stat(1),

BUGS
It would be nice to be able to easily get the reverse flows also (e.g. get traffic to an ACL as well as traffic from an ACL), rather than having to run two searches. On the other hand, it isn't hard to run two searches.