flow-receive(1)

NAME
flow-receive — Receive flow data with the NetFlow protocol.

SYNOPSIS

flow-receive [-h] [-A AS0_substitution] [-b big|little] [-C comment] [-d debug_level] [-f filter_fname] [-F filter_definition] [-m privacy_mask] [-o output_file] [-S stat_interval] [-t tag_fname] [-T active_def|active_def,active_def ...] [-V pdu_version] [-z z_level] localip/remoteip/port

DESCRIPTION

The flow-receive utility is used to receive flows in NetFlow format. When the remoteip is configured only flows from that exporter will be processed, this is the most secure and recommended configuration. When the localip is configured flow-receive will only process flows sent to the localip IP address. If remoteip is 0 (not configured) flows from any source IP address are accepted. Multiple non aggregated PDU versions may be accepted at once to support Cisco's Catalyst 6500 NetFlow implementation which exports from both the supervisor and MSFC with the same IP address and same port but different export versions. In this case the exports will be stored in the format specified by the -V flag or whichever export type is received first.

OPTIONS

-A AS0_substitution
    Cisco's NetFlow exports represent the local autonomous system as 0 instead of the real value. This option can be used to replace the 0 in the export with the a configured value. Unfortunately under certain configurations AS 0 can also represent a cache miss or non forwarded traffic so use with caution.

-b big|little
    Byte order of output.

-C Comment
    Add a comment.

-d debug_level
    Enable debugging.

-f filter_fname
    Filter list filename. Defaults to /usr/local/etc/flow-tools/filter.

-F filter_definition
    Select the active definition. Defaults to default.

-h  Display help.

-m privacy_mask
    Apply privacy_mask to the source and destination IP address of flows. For example a privacy_mask of 255.255.255.0 would convert flows with source/destination IP addresses 10.1.1.1 and 10.2.2.2 to 10.1.1.0 and 10.2.2.0 respectively.

-o file
    Write to file instead of the standard out.

-S stat_interval
    When configured flow-receive will emit a timestamped message on stderr every stat_interval minutes indicating counters such as the number of flows received, packets processed, and lost flows.

-t tag_fname
    Load tags from tag_name

-T active_def|active_def,active_def...
    Use active_def as the active tag definition(s).

-V pdu_version
    Use pdu_version format output.

    1    NetFlow version 1 (No sequence numbers, AS, or mask)
    5    NetFlow version 5
    6    NetFlow version 6 (5+ Encapsulation size)
    7    NetFlow version 7 (Catalyst switches)
    8.1  NetFlow AS Aggregation
    8.2  NetFlow Proto Port Aggregation
    8.3  NetFlow Source Prefix Aggregation
    8.4  NetFlow Destination Prefix Aggregation
    8.5  NetFlow Prefix Aggregation
    8.6  NetFlow Destination (Catalyst switches)
    8.7  NetFlow Source Destination (Catalyst switches)
    8.8  NetFlow Full Flow (Catalyst switches)
    8.9  NetFlow ToS AS Aggregation
    8.10 NetFlow ToS Proto Port Aggregation
    8.11 NetFlow ToS Source Prefix Aggregation
    8.12 NetFlow ToS Destination Prefix Aggregation
    8.13 NetFlow ToS Prefix Aggregation
    8.14 NetFlow ToS Prefix Port Aggregation
    1005 Flow-Tools tagged version 5

-z z_level
    Configure compression level to z_level. 0 is disabled (no compression), 9 is highest compression.

EXAMPLES

Listen on port 9800 on any local interface for exports from IP address 10.0.0.1, store the exports in flows

  flow-receive 0/10.0.0.1/9800 > flows

Listen on port 9800 on any local interface from any IP address, display the received flows with flow-print.

  flow-receive 0/0/9800 | flow-print

BUGS

It is not currently possible to convert between the aggregated formats (8.x) and the non aggregated formats (1,5,6,7).

AUTHOR

Mark Fullmer maf@splintered.net

SEE ALSO

flow-tools(1)