Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help
flow-fanout(1)		    General Commands Manual		flow-fanout(1)

NAME
       flow-fanout -- Fanout (replicate) flow exports to many destinations.

SYNOPSIS
       flow-fanout  [-h]   [-A	AS0_substitution]   [-d	debug_level]  [-f fil-
       ter_fname]  [-F filter_definition]   [-m	 privacy_mask]	 [-p  pidfile]
       [-s]  [-S stat_interval]	 [-V pdu_version]  [-x xmit_delay] localip/re-
       moteip/port localip/remoteip/port ...

DESCRIPTION
       The flow-fanout utility will replicate flows  arriving  on  localip/re-
       moteip/port to destination(s) specified by localip/remoteip/port.

       Flows  processed	by multiple exporters will be mixed into a single out-
       put stream.  This functionality appeared	to support Cisco Catalyst  ex-
       ports and may have other	uses.

       A SIGQUIT or SIGTERM signal will	cause flow-fanout to exit.

OPTIONS
       -A AS0_substitution
		 Cisco's NetFlow exports represent the local autonomous	system
		 as 0 instead of the real value.  This option can be  used  to
		 replace the 0 in the export with the a	configured value.  Un-
		 fortunately under certain configurations AS 0 can also	repre-
		 sent  a  cache	miss or	non forwarded traffic so use with cau-
		 tion.

       -d debug_level
		 Enable	debugging.

       -f filter_fname
		 Filter	list filename.	Defaults to @sysconfdir@/cfg/filter.

       -F filter_definition
		 Select	the active definition.	Defaults to default.

       -h	 Display help.

       -m privacy_mask
		 Apply privacy_mask to the source and destination  IP  address
		 of  flows.  For example a privacy_mask	of 255.255.255.0 would
		 convert flows with source/destination IP  addresses  10.1.1.1
		 and 10.2.2.2 to 10.1.1.0 and 10.2.2.0 respectively.

       -p pidfile
		 Configure  the	 process  ID  file.  Use - to disable pid file
		 creation.

       -s	 Spoof the source IP address.  If the IP address is 0 then  it
		 is replaced with the exporter source IP.

       -S stat_interval
		 When  configured  flow-fanout will emit a timestamped message
		 on stderr every  stat_interval	 minutes  indicating  counters
		 such  as the number of	flows received,	packets	processed, and
		 lost flows.

       -V pdu_version
		 Use pdu_version format	output.

	   1	NetFlow	version	1 (No sequence numbers,	AS, or mask)
	   5	NetFlow	version	5
	   6	NetFlow	version	6 (5+ Encapsulation size)
	   7	NetFlow	version	7 (Catalyst switches)
	   8.1	NetFlow	AS Aggregation
	   8.2	NetFlow	Proto Port Aggregation
	   8.3	NetFlow	Source Prefix Aggregation
	   8.4	NetFlow	Destination Prefix Aggregation
	   8.5	NetFlow	Prefix Aggregation
	   8.6	NetFlow	Destination (Catalyst switches)
	   8.7	NetFlow	Source Destination (Catalyst switches)
	   8.8	NetFlow	Full Flow (Catalyst switches)
	   8.9	NetFlow	ToS AS Aggregation
	   8.10	NetFlow	ToS Proto Port Aggregation
	   8.11	NetFlow	ToS Source Prefix Aggregation
	   8.12	NetFlow	ToS Destination	Prefix Aggregation
	   8.13	NetFlow	ToS Prefix Aggregation
	   8.14	NetFlow	ToS Prefix Port	Aggregation
	   1005	Flow-Tools tagged version 5

       -x xmit_delay
		 Configure a microsecond transmit delay	between	packets.  This
		 may be	necessary in some configurations to prevent a transmit
		 buffer	overrun.

EXAMPLES
       Replicate flows arriving	to local IP address 10.0.0.1 from  the	router
       exporting  with IP address 10.1.1.1 on port 9500	to localhost port 9500
       and 10.5.5.5 port 9200.	The exports sent to 10.5.5.5 will be sent with
       a source	IP address of 10.0.0.5 which must be a valid local IP address.

	 flow-fanout 10.0.0.1/10.1.1.1/9500 0/0/9500 10.0.0.5/10.5.5.5/9200

BUGS
       NetFlow	exports	do not contain the exporter IP address inside the pay-
       load so the original exporter IP	address	(typically a router)  will  be
       lost  when  using flow-fanout.  A work around for this protocol limita-
       tion is to use local IP aliases and the localip option.

       When the	spoofing option	is used	multiple exporters with	 different  IP
       addresses  will share the same sequence number but will have the	origi-
       nal source IP.  Fixing this requires per	source : destination  sequence
       number  mapping.	  It  is much easier to	just use multiple instances of
       flow-fanout running on different	ports.

AUTHOR
       Mark Fullmer maf@splintered.net

SEE ALSO
       flow-tools(1)

								flow-fanout(1)

NAME | SYNOPSIS | DESCRIPTION | OPTIONS | EXAMPLES | BUGS | AUTHOR | SEE ALSO

Want to link to this manual page? Use this URL:
<https://www.freebsd.org/cgi/man.cgi?query=flow-fanout&sektion=1&manpath=FreeBSD+12.1-RELEASE+and+Ports>

home | help