Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages


home | help
flow-fanout(1)		    General Commands Manual		flow-fanout(1)

       flow-fanout -- Fanout (replicate) flow exports to many destinations.

       flow-fanout  [-h]   [-A	AS0_substitution]   [-d	debug_level]  [-f fil-
       ter_fname]  [-F filter_definition]   [-m	 privacy_mask]	 [-p  pidfile]
       [-s]  [-S stat_interval]	 [-V pdu_version]  [-x xmit_delay] localip/re-
       moteip/port localip/remoteip/port ...

       The flow-fanout utility will replicate flows  arriving  on  localip/re-
       moteip/port to destination(s) specified by localip/remoteip/port.

       Flows  processed	by multiple exporters will be mixed into a single out-
       put stream.  This functionality appeared	to support Cisco Catalyst  ex-
       ports and may have other	uses.

       A SIGQUIT or SIGTERM signal will	cause flow-fanout to exit.

       -A AS0_substitution
		 Cisco's NetFlow exports represent the local autonomous	system
		 as 0 instead of the real value.  This option can be  used  to
		 replace the 0 in the export with the a	configured value.  Un-
		 fortunately under certain configurations AS 0 can also	repre-
		 sent  a  cache	miss or	non forwarded traffic so use with cau-

       -d debug_level
		 Enable	debugging.

       -f filter_fname
		 Filter	 list  filename.   Defaults  to	  /usr/local/etc/flow-

       -F filter_definition
		 Select	the active definition.	Defaults to default.

       -h	 Display help.

       -m privacy_mask
		 Apply	privacy_mask  to the source and	destination IP address
		 of flows.  For	example	a privacy_mask of	 would
		 convert  flows	 with source/destination IP addresses
		 and to and respectively.

       -p pidfile
		 Configure the process ID file.	 Use -	to  disable  pid  file

       -s	 Spoof	the source IP address.	If the IP address is 0 then it
		 is replaced with the exporter source IP.

       -S stat_interval
		 When configured flow-fanout will emit a  timestamped  message
		 on  stderr  every  stat_interval  minutes indicating counters
		 such as the number of flows received, packets processed,  and
		 lost flows.

       -V pdu_version
		 Use pdu_version format	output.

	   1	NetFlow	version	1 (No sequence numbers,	AS, or mask)
	   5	NetFlow	version	5
	   6	NetFlow	version	6 (5+ Encapsulation size)
	   7	NetFlow	version	7 (Catalyst switches)
	   8.1	NetFlow	AS Aggregation
	   8.2	NetFlow	Proto Port Aggregation
	   8.3	NetFlow	Source Prefix Aggregation
	   8.4	NetFlow	Destination Prefix Aggregation
	   8.5	NetFlow	Prefix Aggregation
	   8.6	NetFlow	Destination (Catalyst switches)
	   8.7	NetFlow	Source Destination (Catalyst switches)
	   8.8	NetFlow	Full Flow (Catalyst switches)
	   8.9	NetFlow	ToS AS Aggregation
	   8.10	NetFlow	ToS Proto Port Aggregation
	   8.11	NetFlow	ToS Source Prefix Aggregation
	   8.12	NetFlow	ToS Destination	Prefix Aggregation
	   8.13	NetFlow	ToS Prefix Aggregation
	   8.14	NetFlow	ToS Prefix Port	Aggregation
	   1005	Flow-Tools tagged version 5

       -x xmit_delay
		 Configure a microsecond transmit delay	between	packets.  This
		 may be	necessary in some configurations to prevent a transmit
		 buffer	overrun.

       Replicate  flows	 arriving to local IP address from the	router
       exporting with IP address on port 9500 to localhost port  9500
       and port 9200.	The exports sent to will be sent with
       a source	IP address of which must be a valid local IP address.

	 flow-fanout 0/0/9500

       NetFlow exports do not contain the exporter IP address inside the  pay-
       load  so	 the original exporter IP address (typically a router) will be
       lost when using flow-fanout.  A work around for this  protocol  limita-
       tion is to use local IP aliases and the localip option.

       When  the  spoofing option is used multiple exporters with different IP
       addresses will share the	same sequence number but will have the	origi-
       nal  source IP.	Fixing this requires per source	: destination sequence
       number mapping.	It is much easier to just use  multiple	 instances  of
       flow-fanout running on different	ports.

       Mark Fullmer




Want to link to this manual page? Use this URL:

home | help