FLOW-STAT(1)

NAME
flow-stat - summarize flows into various reports

SYNOPSIS
flow-stat [ -c comment-char ] [ -d debug-level ] [ -f format ] [ -h?nCpP ] [ -s field ] [ -S field ]

DESCRIPTION
flow-stat summarizes flows into useful reports, many of which can be viewed in gnuplot.

You can select the report style with -f. Current reports include:

OPTIONS
Set the comment character for the report. Set the debug level. Set the style of report generated. Get help, list the formats/reports supported. Print symbolic names. Summarize IP to classful networks. Print header. Print percents. Sort low to high on field number field. Sort high to low on field number field.

EXAMPLES
Top10 list by UDP/TCP source/destination port by octets (a packet with srcport=4567 dstport=80 is counted twice, which usually produces more useful reports for services that live on ports < 1024): S2 sorts in ascending order on field 2 (octets)

    flow-stat -f7 -S2 < rawflow.08-06-96.8 | head -15

Top10 list by UDP/TCP source/destination port by packets

    flow-stat -f7 -S3 < rawflow.08-06-96.8 | head -15
Top10 list by IP source destination by octets (a packet with srcaddr=1.2.3.4 dstaddr=4.5.6 is counted twich, which can make more sense in the case of measuring traffic for an AS at a single border router)

    flow-stat -f10 < rawflow.08-06-96.8 | sort -n -r +2 -3 | head -10
Interesting plot of flow duration vs. octets/flow. Duration is the X axis, bytes is y:

    flow-stat -f13 < rawflow.08-06-96.8 > plotdata
    tail -1 plotdata.  use the min/max values to setup gnuplot
    gnuplot> set xrange [1457359112:1460916528]
    gnuplot> set yrange [0:24261610]
    gnuplot> plot 'plotdata' with lines
Histogram of byte count of ports < 1024:

    cat rawflow.08-06-96.8 | flow-stat -f7 > plotdata
    gnuplot> set xrange [0:1024]
    gnuplot> plot 'plotdata
Source/Destination matrix

    flow-stat -f10 < rawflow.08-06-96.8

SEE ALSO
flow-capture(1), flow-cat(1), flow-connect(1), flow-dscan(1),flow-expire(1), flow-export(1), flow-fanout(1), flow-filter(1), flow-gen(1), flow-interfaces(1), flow-print(1), flow-profile(1), flow-receive(1), flow-search(1), flow-send(1), flow-sort(1), flow-stat(1),

BUGS
flow-stat uses a large stack. For some systems, a limit stacksize 8m may be needed before running it.

flow-stat can't sort the hash tables yet.

flow-stat doesn't do all it says.

...more stats like aspath, histories, etc.