flow-tools(1)

NAME
flow-tools — Tool set for working with NetFlow data.

DESCRIPTION

Flow-tools is a collection of programs used to process NetFlow data.

Flow data is collected and stored by default in host byte order, yet the files are portable across big and little endian architectures.

Commands that utilize the network use a localip/remoteip/port designation for communication. "localip" is the IP address the host will use as a source for sending or bind to when receiving NetFlow PDU's (ie the destination address of the exporter. Configuring the "localip" to 0 will force the kernel to decide what IP address to use for sending and listen on all IP addresses for receiving. "remoteip" is the destination IP address used for sending or the expected address of the source when receiving. If the "remoteip" is 0 then the application will accept flows from any source address. The "port" is the UDP port number used for sending or receiving. When using multicast addresses the localip/remoteip/port is used to represent the source, group, and port respectively.

Flows are exported from a router in a number of different configurable versions. A flow is a collection of key fields and additional data. The flow key is {srcaddr, dstaddr, input, output, srcport, dstport, prot, ToS}. Flow-tools supports one export version per file.

Export versions 1, 5, 6, and 7 all maintain {nexthop, dPkts, dOctets, First, Last, flags}, ie the next-hop IP address, number of packets, number of octets (bytes), start time, end time, and flags such as the TCP header bits. Version 5 adds the additional fields {src_as, dst_as, src_mask, dst_mask}, ie source AS, destination AS, source network mask, and destination network mask. Version 7 which is specific to the Catalyst switches adds in addition to the version 5 fields {router_sc}, which is the Router IP address which populates the flow cache shortcut in the Supervisor. Version 6 which is not officially supported by Cisco adds in addition to the version 5 fields {in_encaps, out_encaps, peer_nexthop}, ie the input and output interface encapsulation size, and the IP address of the next hop within the peer. Version 1 exports do not contain a sequence number and therefore should be avoided, although it is safe to store the data as version 1 if the additional fields are not used.

Version 8 IOS NetFlow is a second level flow cache that reduces the data exported from the router. There are currently 11 formats, all of which provide {dFlows, dOctets, dPkts, First, Last} for the key fields.

  8.1 -  Source and Destination AS, Input and Output interface
  8.2 -  Protocol and Port
  8.3 -  Source Prefix and Input interface
  8.4 -  Destination Prefix and Output interface
  8.5 -  Source/Destination Prefix and Input/Output interface
  8.9 -  8.1 + ToS
  8.10 - 8.2 + ToS
  8.11 - 8.3 + ToS
  8.12 - 8.5 + ToS
  8.13 - 8.2 + ToS
  8.14 - 8.3 + ports + ToS

Version 8 CatIOS NetFlow appears to be a less fine grained first level flow cache.

  8.6 - Destination IP, ToS, Marked ToS,
  8.7 - Source/Destination IP, Input/Output interface, ToS, Marked ToS,
  8.8 - Source/Destination IP, Source/Destination Port, Input/Output interface, ToS, Marked ToS,

flow-capture - collect flows from an exporter and store them to disk. Disk space is managed by expiring (removing) old flow files based on a configurable archive size or number of files.

flow-cat - concatenate flow files.

flow-dscan - detect network scanning and other suspicious activity

flow-expire - expire (remove) old flow files.

flow-fanout - fanout flows from a exporter to multiple collectors. Also supports multicast.

flow-gen - Generate flows for testing.

flow-header - Display flow file meta information.

flow-merge - Merge flows files so that records are preserved in relative chronological order.

flow-print - Formatted ASCII output.

flow-receive - Receive flows in NetFlow format from a network.

flow-send - Send flows over a network in NetFlow format.

flow-split - Split flow files into smaller files.

flow-stat - Generate usage reports based on IP address, IP address pairs, ports, packets, bytes, interfaces, next hops, autonomous systems, ToS bits, exporters, and tags.

flow-xlate - Translate various fields of flow recrods.

AUTHOR

Mark Fullmer maf@splintered.net

flow-merge by Larry Lidz ellidz@eridu.uchicago.edu

Patches and other contribitions by a list too long to mention here.

flow-tools is avalable at (link to URL http://www.splintered.net/sw/flow-tools) .

A mailing list is maintained at flow-tools@splintered.net

SEE ALSO

flow-capture(1) flow-cat(1) flow-dscan(1) flow-expire(1) flow-export(1) flow-fanout(1) flow-filter(1) flow-gen(1) flow-header(1) flow-import(1) flow-merge(1) flow-print(1) flow-send(1) flow-split(1) flow-merge(1) flow-stat(1) flow-xlate(1)