flow-fanout(1)

NAME
flow-fanout — Fanout (replicate) flow exports to many destinations.

SYNOPSIS

flow-fanout [-h] [-d debug_level] [-x xmit_delay] localip/remoteip/port localip/remoteip/port ...

DESCRIPTION

The flow-fanout utility will replicate flows arriving on localip/remoteip/port to destination(s) specified by localip/remoteip/port.

OPTIONS

-d debug_level
    Enable debugging.

-h  Display help.

-x xmit_delay
    Configure a microsecond transmit delay between packets. This may be necessary in some configurations to prevent a transmit buffer overrun.

EXAMPLES

Replicate flows arriving to local IP address 10.0.0.1 from the router exporting with IP address 10.1.1.1 on port 9500 to localhost port 9500 and 10.5.5.5 port 9200. The exports sent to 10.5.5.5 will be sent with a source IP address of 10.0.0.5 which must be a valid local IP address.

  flow-fanout 10.0.0.1/10.1.1.1/9500 0/0/9500 10.0.0.5/10.5.5.5/9200

BUGS

NetFlow exports do not contain the exporter IP address inside the payload so the original exporter IP address (typically a router) will be lost when using flow-fanout. A work around for this protocol limitation is to use local IP aliases and the localip option.

AUTHOR

Mark Fullmer maf@splintered.net

SEE ALSO

flow-tools(1)