flow-tag(1)

NAME
flow-tag — Apply tags to flow files.

SYNOPSIS

flow-tag [-h] [-b big|little] [-C comment] [-d debug_level] [-t tag_fname] [-T active_def|active_def,active_def ...]

DESCRIPTION

The flow-tag utility is used to add or modify source and destination tags in flow records. Tags are 32 bit identifiers derived from rules and fields in a flow record. Tags can be used to group flows with common prefixes, autonomous systems, next hops, exporter id and/or input/output interface. flow-stat can be used with tagged flows to produce group based reports. For example, all outbound traffic for a customer where the customer is defined by a list of IP prefixes.

OPTIONS

-b big|little
    Byte order of output.

-C Comment
    Add a comment.

-d debug_level
    Enable debugging.

-h  Display help.

-t tag_fname
    Load tags from tag_name

-T active_def|active_def,active_def...
    Use active_def as the active tag definition(s).

The configuration file is a collection of actions and definitions. An action is triggered by a definition and a definition is invoked only if listed with the -T flag. Lines begining with # are treated as comments and ignored.

An action is configured to match one of {src-prefix,dst-prefix,prefix, src-as,dst-as,as,next-hop} or source prefix, destination prefix, source or destination prefix, source AS, destination AS, source or destination AS, and IP next hop respectively.

The remaining configuration of an action is a series of match and set commands. The set can be one of {set-src,set-dst,or-src,or-dst} or set destination tag, and set source tag, logically OR source tag, and logically OR destination tag respectively.

A definition lists a set of actions which are evaluated if the filter criteria is met. Filters for a definition include {input-filter,output-filter,exporter} or input interface ifIndex list, output interface ifIndex list, and exporter IP address respectively.

EXAMPLES

The meaning of a tag is user defined. The following example uses 16 bits of a tag as a customer ID and 4 bits as a customer type. flow-xlatecan be used to apply a mask to these fields.

# file: gigapop-tags
# tag format
#
# 0       7         15        23        31
# 0000 0000 0000 0000 0000 0000 0000 0000 (32 bits)
# RRRRRRRRRRRRRR TTTT NNNNNNNNNNNNNNNNNNN
#              |    |                   | Site name
#              |    | Site type
#              | Reserved
#
#
# SITE_NAME_MASK = 0x0000FFFF
# SITE_TYPE_MASK = 0x00FF0000
#
# ID             Name
#---------------------------------
# 0x0001         OSU
# 0x0002         CWRU
# 0x0003         BGSU
# ... etc
# 0x0019         MULTICAST
#
# ID             Type
#------------------------
# 0x01         Participant
# 0x02         SEGP
# 0x03         Sponsored-Participant
# 0x04         Gigapop
# 0x05         MULTICAST
tag-action OHIO-GIGAPOP_DST
 type dst-prefix
# OSU
 match 128.146/16 set-dst     0x010001
 match 164.107/16 set-dst     0x010001
 match 140.254/16 set-dst     0x010001
 match 192.153.26/24 set-dst  0x010001
# CWRU
 match 129.22/16 set-dst      0x010002
 match 192.5.110/24 set-dst   0x010002
# BGSU
 match 129.1/16 set-dst       0x010003
# ...etc
# MULTICAST
 match 224/4 set-dst 0x050019
tag-action OHIO-GIGAPOP_SRC
 type src-prefix
# OSU
 match 128.146/16 set-src     0x010001
 match 164.107/16 set-src     0x010001
 match 140.254/16 set-src     0x010001
 match 192.153.26/24 set-src  0x010001
# CWRU
 match 129.22/16 set-src      0x010002
 match 192.5.110/24 set-src   0x010002
# BGSU
 match 129.1/16 set-src       0x010003
# ...etc
tag-action OTHER_DST
 match 0/0 set-dst 0x0

tag-action OTHER_SRC
 match 0/0 set-src 0x0
tag-definition OHIO-GIGAPOP_DST
# Abilene interface
 input-filter 25
 action OHIO-GIGAPOP_DST
 action OTHER_DST

tag-definition OHIO-GIGAPOP_SRC
# Abilene interface
 output-filter 25
 action OHIO-GIGAPOP_SRC
 action OTHER_SRC

First populate /usr/local/etc/flow-tools/tag_defs for flow-stat to use as symbols.

0x0001 OSU
0x0002 CWRU
0x0003 BGSU
0x0019 MULTICAST
0x010000 PART
0x020000 SEGP
0x030000 SPART
0x040000 GIGAPOP
0x050000 MULTICAST

To generate a report for outgoing traffic to Abilene based on customer ID:

flow-cat flows | flow-filter -I25 | flow-tag -t gigapop-tags -TOHIO-GIGAPOP_SRC | flow-xlate -t0x0000FFFF | flow-stat -n -f30 -S2

#  --- ---- ---- Report Information --- --- ---
#
# Fields:    Total
# Symbols:   Enabled
# Sorting:   Descending Field 2
# Name:      Source Tag
#
# Args:      ../flow-stat -n -f30 -S2
#
#
# Src Tag   flows                 octets                packets
#
OSU         4942230               181326237007          302476793
CWRU        874883                54358312807           70589318
BGSU        1008797               7600209852            22060870

To generate a report for inbound traffic from Abilene based on customer type:

flow-cat flows | flow-filter -i25 | flow-tag -t gigapop-tags -TOHIO-GIGAPOP_DST | flow-xlate -T0xFF0000 | flow-stat -n -f31 -S2

#  --- ---- ---- Report Information --- --- ---
#
# Fields:    Total
# Symbols:   Enabled
# Sorting:   Descending Field 2
# Name:      Destination Tag
#
# Args:      ../flow-stat -n -f31 -S2
#
#
# Dst Tag   flows                 octets                packets
#
PART        15923156              663289954569          981163979
SEGP        4995795               135525076170          196534917
MULTICAST   45171                 49866825003           137798118
GIGAPOP     942209                26422533266           23199961
SPART       73998                 5170323905            7597985

BUGS

None known.

AUTHOR

Mark Fullmer maf@splintered.net

SEE ALSO

flow-tools(1)