RWNETMASK(1)

NAME
rwnetmask - Zero out lower bits of IP addresses in SiLK Flow records

SYNOPSIS
  rwnetmask [--sip-prefix-length=N] [--dip-prefix-length=N]
        [--nhip-prefix-length=N] [--output-path=PATH]
        [FILES]

DESCRIPTION
rwnetmask reads SiLK Flow records from file(s) named on the command line, sets the prefix of the source IP, destination IP, and/or next hop IP to the specified value(s) by masking the least significant bits of the address(es), and writes the modified SiLK Flow records to the specified output path. Modifying the IP addresses allows one to group IPs into arbitrary CIDR blocks. Multiple prefix-lengths may be specified; at least one must be specified.

When no file names are specified on the command line, rwnetmask attempts to read flow records from the standard input. To read the standard input in addition to files, specify "-" or "stdin" on the command line. When no output path is specified and the standard output is not connected to a terminal, rwnetmask writes the records to the standard output.

OPTIONS
Option names may be abbreviated if the abbreviation is unique or is an exact match for an option. A parameter to an option may be specified as --arg=param or --arg param, though the first form is required for options that take optional parameters.

--sip-prefix-length=N
    Specify the number of most significant of the source address to keep. The default is to not mask off any bits (i.e., N=32).

--dip-prefix-length=N
    Specify the number of most significant bits of the destination address to keep. The default is to not mask off any bits (i.e., N=32).

--nhip-prefix-length=N
    Specify the number of most significant bits of the next-hop address to keep. The default is to not mask off any bits (i.e., N=32).

--output-path=PATH
    Write the output to the named PATH. PATH may be a file, named pipe, or the symbols "stdout" or "-" to write to the standard output. When not specified, output will be written to the standard output. rwnetmask will exit with an error if the output path is the standard output and the standard output is connected to a terminal.

EXAMPLES
To summarize the TCP traffic from your network to each /24 on the Internet, use:

 rwfilter --type=out,outweb --proto=6 --pass=stdout |  \
     rwnetmask --dip-prefix-mast 24 |                  \
     rwaddrcount --use-dest --sort --print-rec
 IP Address| Bytes|Packets|Records|         Start Time|...
 10.10.35.0|  2345|     52|      6|01/15/2003 19:30:31|
  10.23.3.0|   118|      2|      1|01/16/2003 19:38:40|
  10.23.4.0| 20858|    263|     16|01/16/2003 16:54:25|
 10.31.49.0|266920|   3885|   1092|01/11/2003 02:04:11|
 10.126.7.0| 36912|    260|      9|01/16/2003 17:03:28|
 ....

SEE ALSO
rwfilter(1)