Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages


home | help
nfdump(1)							     nfdump(1)

       nfdump -	netflow	display	and analyze program

       nfdump [options]	[filter]

       nfdump  is the netflow display and analyzing program of the nfdump tool
       set.  It	reads the netflow data from files stored by  nfcapd  and  pro-
       cesses the flows	according the options given. The filter	syntax is com-
       parable to tcpdump and extended for netflow data. Nfdump	can also  dis-
       play many different top N flow and flow element statistics.

       -r inputfile
	  Read input data from inputfile. Default is read from stdin.

       -R expr
	  Read	input from a sequence of files in the same directory. expr may
	  be one of:
	   /any/dir	     Read recursively all files	in directory dir.
	   /dir/file	     Read all files beginning with file.
	   /dir/file1:file2  Read all files from file1 to file2.

	   When	using in combination with a sub	hierarchy:
	   Read	all files from sub1/sub2/file1 sub3/sub4/file2 iterating  over
	   all required	hierarchy levels.

	   Note: files are read	in alphabetical	sequence.

       -M expr
	  Read	 input	 from	multiple   directories.	  expr	 looks	 like:
	  /any/path/to/dir1:dir2:dir3 etc. and will be expanded	to the	direc-
	  tories:  /any/path/to/dir1,  /any/path/to/dir2 and /any/path/to/dir3
	  Any number of	colon separated	directories may	be given. The files to
	  read	are specified by -r or -R and are expected to exist in all the
	  given	directories.  The options -r and -R must not contain  any  di-
	  rectory part when used in conjunction	with -M.

       -m depricated option. Use -O tstart instead.

       -O order
	  Set sort order to print flows	or aggregated flows. order can be:
	    flows    Sort according the	number of flows
	    packets  Sort according to (in)packets
	    ipkg     Same as packets
	    opkg     Sort according to output packets
	    bytes    Sort according to (in)bytes
	    ibyte    Same as bytes
	    obyte    Sort according to output bytes
	    pps	     Sort according to (in)packets per second
	    ipps     Same as ipps
	    opps     Sort according to out packets per second
	    bps	     Sort according to (in)bytes per second
	    ibps     Same as bps
	    obps     Sort according to output bytes per	second
	    bpp	     Sort according to (in)bytes per packet
	    ibpp     Same as bpp
	    obpp     Sort according to output packets
	    tstart   Sort according to start time of flow - former -m
	    tend"    Sort according to end time	of flows

       -w outputfile
	  If specified writes binary netflow records to	outputfile ready to be
	  processed again with nfdump. The default output is ASCII on  stdout.
	  In  combination  with	 options  -m,  -a, -b, and -B write aggregated
	  and/or sorted	flow cache in binary format to disk.

       -f filterfile
	  Reads	the filter syntax from filterfile. Note: Any filter  specified
	  directly on the command line takes precedence	over -f.

       -t timewin
	  Process  only	 flows,	 which	fall in	the time window	timewin, where
	  timewin is YYYY/MM/dd.hh:mm:ss[-YYYY/MM/dd.hh:mm:ss].	Any  parts  of
	  the	time   spec   may   be	 omitted  e.g  YYYY/MM/dd  expands  to
	  YYYY/MM/dd.00:00:00-infinity and processes all flow from a given day
	  onwards.  The	 time  window  may also	be specified as	+/- n. In this
	  case it is relativ to	the beginning or end of	all flows.  +10	 means
	  the  first 10	seconds	of all flows, -10 means	the last 10 seconds of
	  all flows.

       -c num
	  Limit	the number of records to read and process from file(es)	to the
	  first	num flows.

       -a Aggregate  netflow  data.  Automatically  implies -a.	Aggregation is
	  done at connection level by  taking  the  5-tuple  protocol,	srcip,
	  dstip, srcport and dstport.

       -A aggregation
	  Similar to Flexible Netflow (FNF), netflow records can be aggregated
	  by any number	of given v9 fields. aggregation	 is  a	','  separated
	  list of recognised tags of the following list:
	    proto      IP protocol
	    srcip      Source IP address
	    dstip      Destination IP address
	    srcip4/net IPv4 source IP address with applied netmask
	    srcip6/net IPv6 source IP address with applied netmask
	    dstip4/net IPv4 destination	IP address with	applied	netmask
	    dstip6/net IPv6 destination	IP address with	applied	netmask
	    srcnet     Apply netmask srcmask in	netflow	record for source IP
	    dstnet     Apply netmask dstmask in	netflow	record for dest	IP
	    srcport    Source port
	    dstport    Destination port
	    srcmask    Source mask
	    dstmask    Destination mask
	    srcvlan    Source vlan label
	    dstvlan    Destination vlan	label
	    srcas      Source AS number
	    dstas      Destination AS number
	    nextas     BGP Next	AS
	    prevas     BGP Previous AS
	    inif       SNMP input interface number
	    outif      SNMP output interface number
	    next       IP next hop
	    bgpnext    BGP next	hop
	    insrcmac   In source MAC address
	    outdstmac  out destination MAC address
	    indstmac   In destintation MAC address
	    outsrcmac  Out source MAC address
	    tos	       Source type of service
	    srctos     Source type of Service
	    dsttos     Destination type	of Service
	    mpls1      MPLS label 1
	    mpls2      MPLS label 2
	    mpls3      MPLS label 3
	    mpls4      MPLS label 4
	    mpls5      MPLS label 5
	    mpls6      MPLS label 6
	    mpls7      MPLS label 7
	    mpls8      MPLS label 8
	    mpls9      MPLS label 9
	    mpls10     MPLS label 10
	    router     Exporting router	IP

	  nfdump  automatically	 compiles an appropriate output	format for the
	  selected aggregation unless an explicit output format	is given.  The
	  automatic  output  format  is	 identical to -o 'fmt:%ts %td <fields>
	  %pkt %byt %bps %bpp %fl' where <fields> represents the selected  ag-
	  gregation tags.

	      -A proto,srcip,dstport

	      -A srcas,dstas

       -b Aggregate  netflow records as	bidirectional flows. Automatically im-
	  plies	-a.  Aggregation is done on connection	level  by  taking  the
	  5-tuple  protocol, srcip, dstip, srcport and dstport,	or the reverse
	  order	for the	corresponding connection flow. Input and output	 pack-
	  ets/bytes  are  counted and reported separate. Both flows are	merged
	  into a single	record.	An appropriate output format is	selected auto-
	  matically, which may be overwritten by any -o	format option.

       -B Like	-b but automagically swaps flows, such that src	port is	> 1024
	  and dst port is < 1024 as some exporters do  not  care  sending  the
	  flows	in proper order. It's considered to be a convenient option. If
	  src and dst port are > 1024 or < 1024, the flows are taken as	is.

       -I Print	flow statistics	from file specified by -r, or timeslot	speci-
	  fied by -R/-M.

       -D dns
	  Set dns as nameserver	to lookup hostnames.

       -s statistic[:p][/orderby]
	  Generate the Top N flow or flow element statistic. statistic can be:
	    record    Statistic	about arregated	netflow	records.
	    srcip     Statistic	about source IP	addresses
	    dstip     Statistic	about destination IP addresses
	    ip	      Statistic	about any (source or destination) IP addresses
	    nhip      Statistic	about next hop IP addresses
	    nhbip     Statistic	about BGP next hop IP addresses
	    router    Statistic	about exporting	router IP address
	    srcport   Statistic	about source ports
	    dstport   Statistic	about destination ports
	    port      Statistic	about any (source or destination) ports
	    tos	      Statistic	about type of service -	default	src
	    srctos    Statistic	about src type of service
	    dsttos    Statistic	about dst type of service
	    dir	      Statistic	about flow directions ingress/egress
	    srcas     Statistic	about source AS	numbers
	    dstas     Statistic	about destination AS numbers
	    as	      Statistic	about any (source or destination) AS numbers
	    inif      Statistic	about input interface
	    outif     Statistic	about output interface
	    if	      Statistic	about any interface
	    srcmask   Statistic	about src mask
	    dstmask   Statistic	about dst mask
	    srcvlan   Statistic	about src vlan label
	    dstvlan   Statistic	about dst vlan label
	    vlan      Statistic	about any vlan label
	    insrcmac  Statistic	about input src	MAC address
	    outdstmac Statistic	about output dst MAC address
	    indstmac  Statistic	about input dst	MAC address
	    outsrcmac Statistic	about output src MAC address
	    srcmac    Statistic	about any src MAC address
	    dstmac    Statistic	about any dst MAC address
	    inmac     Statistic	about any input	MAC address
	    outmac    Statistic	about any output MAC address
	    mask      Statistic	about any mask
	    proto     Statistic	about IP protocols
	    mpls1     Statistic	about MPLS label 1
	    mpls2     Statistic	about MPLS label 2
	    mpls3     Statistic	about MPLS label 3
	    mpls4     Statistic	about MPLS label 4
	    mpls5     Statistic	about MPLS label 5
	    mpls6     Statistic	about MPLS label 6
	    mpls7     Statistic	about MPLS label 7
	    mpls8     Statistic	about MPLS label 8
	    mpls9     Statistic	about MPLS label 9
	    mpls10    Statistic	about MPLS label 10
	    sysid     Internal SysID of	exporter

	    NSEL/ASA stats
	    event     NSEL/ASA event
	    xevent    NSEL/ASA extended	event
	    xsrcip    NSEL/ASA translated src IP address
	    xsrcport  NSEL/ASA translated src port
	    xdstip    NSEL/ASA translated dst IP address
	    xdstport  NSEL/ASA translated dst port
	    iacl      NSEL/ASA ingress ACL
	    iace      NSEL/ASA ingress ACE
	    ixace     NSEL/ASA ingress xACE
	    eacl      NSEL/ASA egress ACL
	    eace      NSEL/ASA egress ACE
	    exace     NSEL/ASA egress xACE

	    NAT	stats
	    nevent    NAT event
	    vrf/ivrf  NAT ingress vrf
	    evrf      NAT egress vrf
	    nsrcip    NAT src IP address
	    nsrcport  NAT src port
	    ndstip    NAT dst IP address
	    ndstport  NAT dst port

	  By adding :p to the statistic	name, the resulting statistic is split
	  up into transport layer protocols. Default is	transport protocol in-
	  dependent statistics.

	  orderby  is optional and specifies the order by which	the statistics
	  is ordered and can be	flows, packets,	bytes, pps, bps	 or  bpp.  You
	  may  specify more than one orderby which results in the same statis-
	  tic but ordered differently. If no orderby is	given, statistics  are
	  ordered  by  flows.  You can specify as many -s flow element statis-
	  tics on the command line for the same	run.

	     -s	srcip -s ip/flows -s dstport/pps/packets/bytes -s record/bytes

       -O orderby
	  Specifies the	default	orderby	for flow element statistics -s,	 which
	  applies  when	no orderby is given at -s. orderby can be flows, pack-
	  ets, bytes, pps, bps or bpp. Defaults	to flows.

       -l [+/-]packet_num
	  Limit	 statistics  output  to	 those	records	 above	or  below  the
	  packet_num  limit.  packet_num  accepts positive or negative numbers
	  followed by 'K' , 'M'	or 'G' 10E3, 10E6 or 10E9 flows	 respectively.
	  See also note	at -L

       -L [+/-]byte_num
	  Limit	statistics output to those records above or below the byte_num
	  limit. byte_num accepts positive or negative numbers followed	by 'K'
	  , 'M'	or 'G' 10E3, 10E6 or 10E9 bytes	respectively. Note: These lim-
	  its only apply to the	statistics and	aggregated  outputs  generated
	  with -a -s.  To filter netflow records by packets and	bytes, use the
	  filter syntax	'packets' and 'bytes' described	below.

       -n num
	  For record statistics	(-s .. ): Define the number for	the Top	N. De-
	  faults to 10.	 Use -n	0 to list all records.
	  For  record sorting and aggregation (-a .. -O	..): Limit the records
	  to the first top num sorted records.	if not specified or  -n	 0  is
	  given, all records are listed.

       -o format
	  Selects  the	output format to print flows or	flow record statistics
	  (-s record). The following formats are available:
	    raw	     Print each	file flow record on multiple lines.
	    line     Print each	flow on	one line. Default format.
	    long     Print each	flow on	one line with more details
	    biline   Same as line, but for bidir flows
	    bilong   Same as long, but for bidir flows
	    extended Print each	flow on	one line with even more	details.
	    nsel     Print each	NSEL event on one line.	 Default  if  NSEL/ASA
	    nel	     Print each	NAT event on one line. Default if NEL enabled.
	    csv	     Comma separated output for	machine	readable processing.
	    pipe     Legacy machine readable format: fields '|'	separated.
	    fmt:format User defined output format.
	  For  each  defined output format except -o fmt:<format> an IPv6 long
	  output format	exists.	 line6,	long6 and extended6. See  output  for-
	  mats below for more information.

       -q Suppress the header line and the statistics at the bottom.

       -N Print	plain numbers in output. Easier	for post-parsing.

       -i ident
	  Change ident label in	file, specified	by -r to ident

       -v file
	  Verify  file.	Print data file	version, number	of blocks and compres-
	  sion status.

       -E file
	  Print	exporter/sampler list found in file. In	case of	a nfcapd  col-
	  lector  file,	 an additional statistics per exporter is printed with
	  number of flows, packets and sequence	errors.

       -x file
	  Scan and print extension maps	located	in file	file

       -j Compress flows. Use bz2 compression in output	file. Space  efficient

       -z Compress  flows.  Use	 fast LZO1X-1 compression in output file. Time
	  efficient method

       -J num
	  Change compression for file(s) given by -r <file> or -R <dir>	num: 0
	  uncompress, 1: LZO1X-1 compression, 2: bz2 compression

       -Z Check	filter syntax and exit.	Sets the return	value accordingly.

       -X Compiles  the	filer syntax and dumps the filter engine table to std-
	  out.	This is	for debugging purpose only.

       -V Print	nfdump version and exit.

       -h Print	help text on stdout with all options and exit.

	   0   No error.
	   255 Initialization failed.
	   254 Error in	filter syntax.
	   250 Internal	error.

       The output format raw prints each flow record on	 multiple  lines,  in-
       cluding	all  information available in the record. This is the most de-
       tailed view on a	flow.

       Other output formats print each flow on a single	line. Predefined  out-
       put  formats  are line, long and	extended The output format line	is the
       default output format when no format is specified.  It limits  the  im-
       formation to the	connection details as well as number of	packets, bytes
       and flows.

       The output format long is identical to the format  line,	 and  includes
       additional information such as TCP flags	and Type of Service.

       The  output  format  extended  is identical to the format long, and in-
       cludes additional computed information such as pps, bps and bpp.


	  Date flow start: Start time flow first seen. ISO 8601	format includ-
	  ing miliseconds.

	  Duration: Duration of	the flow in seconds and	miliseconds.  If flows
	  are aggregated, duration is the time span over the entire periode of
	  time from first seen to last seen.

	  Proto: Protocol used in the connection.

	  Src IP Addr:Port: Source IP address and source port.

	  Dst  IP  Addr:Port: Destination IP address and destination port.  In
	  case of ICMP,	port is	decodes	as type.code.

	  Flags: TCP flags ORed	of the connection.

	  Tos: Type of service.

	  Packets: The number of packets in this flow.	If  flows  are	aggre-
	  gated, the packets are summed	up.

	  Bytes:  The  number  of bytes	in this	flow. If flows are aggregated,
	  the bytes are	summed up.

	  pps: The calculated packets per second: number of  packets  /	 dura-
	  tion.	  If flows are aggregated this results in the average pps dur-
	  ing this periode of time.

	  bps: The calculated bits per second: 8 * number of bytes / duration.
	  If  flows are	aggregated this	results	in the average bps during this
	  periode of time.

	  Bpp: The calculated bytes per	packet:	number of bytes	 /  number  of
	  packets.  If	flows  are  aggregated this results in the average bpp
	  during this periode of time.

	  Flows: Number	of flows. If flows are listed only, this number	is al-
	  ways 1. If flows are aggregated, this	shows the number of aggregated
	  flows	to one record.

       Numbers larger than 1'000'000 (1000*1000), are scaled to	4  digits  and
       one  decimal  digit  including the scaling factor M, G or T for cleaner
       output, e.g. 923.4 M

       To make the output more readable, IPv6 addresses	are shrinked  down  to
       16 characters. The seven	most and seven least digits connected with two
       dots '..' are displayed in any normal output formats.  To  display  the
       full IPv6 address, use the appropriate long format, which is the	format
       name followed by	a 6.

       Example:	-o line	displays an IPv6 address as 2001:23..80:d01e where  as
       the   format  -o	 line6	displays  the  IPv6  address  in  full	length
       2001:234:aabb::211:24ff:fe80:d01e.  The combination of -o  line	-6  is
       equivalent to -o	line6.

       The  output  format  fmt:<format>  allows you to	define your own	output
       format.	A format description format consists of	a single line contain-
       ing arbitrary strings and format	specifier as described below

	  %<format> Inserts the	predefined format at this position. e.g. %line
	  %ff	    flow record	flags in hex.
	  %ts	    Start Time - first seen
	  %te	    End	Time - last seen
	  %tr	    Time the flow was received by the collector
	  %td	    Duration
	  %pr	    Protocol
	  %exp	    Exporter ID
	  %eng	    Engine Type/ID
	  %sa	    Source Address
	  %da	    Destination	Address
	  %sap	    Source Address:Port
	  %dap	    Destination	Address:Port
	  %sp	    Source Port
	  %dp	    Destination	Port
	  %sn	    Source Network, mask applied
	  %dn	    Destination	Network, mask applied
	  %nh	    Next-hop IP	Address
	  %nhb	    BGP	Next-hop IP Address
	  %ra	    Router IP Address
	  %sas	    Source AS
	  %das	    Destination	AS
	  %nas	    Next AS
	  %pas	    Previous AS
	  %in	    Input Interface num
	  %out	    Output Interface num
	  %pkt	    Packets - default input
	  %ipkt	    Input Packets
	  %opkt	    Output Packets
	  %byt	    Bytes - default input
	  %ibyt	    Input Bytes
	  %obyt	    Output Bytes
	  %fl	    Flows
	  %flg	    TCP	Flags
	  %tos	    Tos	- default src
	  %stos	    Src	Tos
	  %dtos	    Dst	Tos
	  %dir	    Direction: ingress,	egress
	  %smk	    Src	mask
	  %dmk	    Dst	mask
	  %fwd	    Forwarding Status
	  %svln	    Src	vlan label
	  %dvln	    Dst	vlan label
	  %ismc	    Input Src Mac Addr
	  %odmc	    Output Dst Mac Addr
	  %idmc	    Input Dst Mac Addr
	  %osmc	    Output Src Mac Addr
	  %mpls1    MPLS label 1
	  %mpls2    MPLS label 2
	  %mpls3    MPLS label 3
	  %mpls4    MPLS label 4
	  %mpls5    MPLS label 5
	  %mpls6    MPLS label 6
	  %mpls7    MPLS label 7
	  %mpls8    MPLS label 8
	  %mpls9    MPLS label 9
	  %mpls10   MPLS label 10
	  %mpls	    MPLS labels	1-10
	  %bps	    bps	- bits per second
	  %pps	    pps	- packets per second
	  %bpp	    bps	- Bytes	per package

	  NSEL specific	formats
	  %nfc	    NSEL connection ID
	  %evt	    NSEL event
	  %xevt	    NSEL extended event
	  %msec	    NSEL event time in msec
	  %iacl	    NSEL ingress ACL
	  %eacl	    NSEL egress	ACL
	  %xsa	    NSEL XLATE src IP address
	  %xda	    NSEL XLATE dst IP address
	  %xsp	    NSEL XLATE src port
	  %xdp	    NSEL SLATE dst port
	  %xsap	    Xlate Source Address:Port
	  %xdap	    Xlate Destination Address:Port
	  %uname    NSEL user name

	  NEL/NAT specific formats
	  %nevt	    NAT	event -	same as	%evt
	  %ivrf	    NAT	ingress	VRF ID
	  %evrf	    NAT	egress VRF ID
	  %nsa	    NAT	src IP address
	  %nda	    NAT	dst IP address
	  %nsp	    NAT	src port
	  %ndp	    NAT	dst port
	  %pbstart  NAT	pool block start
	  %pbend    NAT	pool block end
	  %pbstep   NAT	pool block step
	  %pbsize   NAT	pool block size

	  Nprobe formats
	  %cl	    Client latency
	  %sl	    Server latency
	  %al	    Application	latency

       The  "flow  flags"  format  (%ff) prints	the internal record flags as a
       single hexadecimal number, consisting of	any of these flag values or-ed

	  1    Record contains IPv6 addresses
	  2    Packet counters are 64-bit
	  4    Byte counters are 64-bit
	  8    IP next hop is an IPv6 address
	  16   BGP next	hop is an IPv6 address
	  32   Exporting router	is an IPv6 address
	  64   Record is an EVENT record
	  128  Record is sampled

       Example:	the standard output format long	can be created as
	  -o "fmt:%ts %td %pr %sap -> %dap %flg	%tos %pkt %byt %fl"

       You  may	 also  define your own output format and have it compiled into
       nfdump.	See nfdump.c section Output Formats for	more details.

       The csv output format is	intended to be read  by	 another  program  for
       further	processing.  As	an example, see	the Perl program.
       The cvs output format consists of one or	more  output  blocks  and  one
       summary	block. Each output block starts	with a cvs index line followed
       by the cvs record lines.	The index lines	describes the order, how  each
       following record	is composed.

	  Index	line:	ts,te,td,sa,da,sp,dp,pr,...
	  Record line:	2004-07-11 10:30:00,2004-07-11 10:30:10,10.010,...

       All records are in ASCII	readable form. Numbers are not scaled, so each
       line can	easily be parsed.

       Indices used in nfdump 1.6:

	  ts,te,td    time records: t-start, t-end, duration
	  sa,da	      src dst address sp,dp	  src, dst port
	  pr	      protocol PF_INET or PF_INET6
	  flg	      TCP Flags:
			 000001	FIN.
			 000010	SYN
			 000100	RESET
			 001000	PUSH
			 010000	ACK
			 100000	URGENT
			 e.g. 6	=> SYN + RESET
	  fwd	      forwarding status
	  stos	      src tos
	  ipkt,ibyt   input packets/bytes
	  opkt,obyt   output packets, bytes
	  in,out      input/output interface SNMP number
	  sas,das     src, dst AS
	  smk,dmk     src, dst mask
	  dtos	      dst tos
	  dir	      direction
	  nh,nhb      nethop IP	address, bgp next hop IP
	  svln,dvln   src, dst vlan id
	  ismc,odmc   input src, output	dst MAC
	  idmc,osmc   input dst, output	src MAC
	  mpls1,mpls2 MPLS label 1-10
	  ra	      router IP
	  eng	      router engine type/id

       See	for more details.

       The filter syntax is similar to the well	known  pcap  library  used  by
       tcpdump.	  The filter can be either specified on	the command line after
       all options or in a separate file. It can span several lines.  Anything
       after a '#' is treated as a comment and ignored to the end of the line.
       There is	virtually no limit in the length of the	filter expression. All
       keywords	are case independent.

       Any filter consists of one or more expressions expr. Any	number of expr
       can be linked together:

       expr and	expr, expr or expr, not	expr and ( expr	).

       Expr can	be one of the following	filter primitives:

	   @include <file>
	   include the content of _file_ into filter.

       ip version
	   inet	 or ipv4 for IPv4
	   inet6 or ipv6 for IPv6

	   proto <protocol>
	   proto <number>
	   where <protocol> is known protocol such as tcp, udp,	 icmp,	icmp6,
	   gre,	esp, ah, etc. or a valid protocol number: 6, 17	etc.

       IP address
	   [src|dst] ip	<ipaddr>
	   [src|dst] host <ipaddr>
	   with	 _ipaddr_ as any valid IPv4, IPv6 address, or a	full qualified
	   hostname.  In case of a hostname, the IP address is	looked	up  in
	   DNS.	  If  more than	a single IP address is found, all IP addresses
	   are chained together. (ip1 or ip2 or	ip3 ...	)

	   To check if an IP address is	in a known IP list, use
	   [src|dst] ip	in [ <iplist> ]
	   [src|dst] host in [ <iplist>	]
	   _iplist_ is a space or comma	separated list of individual  <ipaddr>
	   or  full  qualified	hostnames, which are looked up in DNS. If more
	   than	a single IP address is found, all IP addresses	are  put  into
	   the list.

	   IP  addresses,  networks, ports, AS number etc. can be specifically
	   selected by using a direction qualifier, such as src	or dst.	  They
	   can	also  be used in combination with and and or.  such as src and
	   dst ip ...

	   [src|dst] net a.b.c.d m.n.r.s
	   Select the IPv4 network a.b.c.d with	netmask	m.n.r.s.

	   [src|dst] net <net>/<num>
	   with	_net_ as a valid IPv4 or IPv6 network and _num_	 as  maskbits.
	   The	number of mask bits must match the appropriate address familiy
	   in IPv4 or IPv6. Networks may be abreviated such  as	 172.16/16  if
	   they	are unambiguous.

	   [src|dst] port [comp] <num>
	   with	_num_ as any valid port	number.	 If comp is omitted,
	    '='	is assumed. comp is explained more detailed below.
	   [src|dst] port in [ <portlist> ]
	   A  port  can	be compared against a know list, where <portlist> is a
	   space separated list	of individual port numbers.

	   icmp-type <num>
	   icmp-code <num>
	   with	_num_ as a valid icmp type/code.  This	automatically  implies
	   proto icmp.

       Router ID
	   engine-type <num>
	   engine-id <num>
	   sysid <num>
	   with	_num_ as a valid router	engine type/id or exporter ID(0..255).

	   [in|out] if <num>
	   Select input	or output or either interface ID, with num as the SNMP
	   interface number.
	   Example: in if 3

       AS numbers
	   [src|dst|prev|next] as [comp] <num>
	   Selects source, dstination, previous, next or any  AS  number  with
	   _num_  as  any  valid  as number. 32bit AS numbers are suported. If
	   comp	is omitted, '='	is assumed. comp is  explained	more  detailed

	   [src|dst|prev|next] as in [ <ASlist>	]
	   An AS number	can be compared	against	a know list, where <ASlist> is
	   a space or comma separated list of individual AS numbers.

       Prefix mask bits
	   [src|dst] mask <bits>
	   with	_bits_ as any valid prefix mask	bit value.

       Vlan labels
	   [src|dst] vlan <num>
	   with	_num_ as any valid vlan	label.

	   flags <tcpflags>
	   with	_tcpflags_ as a	combination of:
	      A	   ACK.
	      S	   SYN.
	      F	   FIN.
	      R	   Reset.
	      P	   Push.
	      U	   Urgent.
	      X	   All flags on.
       The ordering of the flags is not	 relevant.  Flags  not	mentioned  are
       treated	as  don't care.	 In order to get those flows with only the SYN
       flag set, use the syntax	'flags S and not flags AFRPU'.

       Next hop	IP
	   next	ip <ipaddr>
	   with	_ipaddr_ as IPv4/IPv6 IP address of next hop router.

       Next-hop	router's IP in the BGP domain
	   bgpnext ip <ipaddr>
	   with	_ipaddr_ as IPv4/IPv6 next-hop router's	IP in the BGP  domain.
	   ( v9	#18 )

       Router IP
	   router ip <ipaddr>
	   Filter the flows according the IP address of	the exporting router.

       MAC addresses
	   [InOutSrcDst] mac <addr>
	   With	 _addr_	any valid MAC address. mac can be more specific	speci-
	   fied	by using any combination of a direction	specifier  as  defined
	   by CISCO v9.	 in src, in dst, out src, out dst.

       MPLS labels
	   mpls	label<n> [comp]	<num>
	   With	 _n_ as	any mpls label number 1..10. Filters exactly specified
	   mpls	eos [comp] <num>
	   Filters End of Stack	label for a given value	_num_.
	   mpls	exp<n> [comp] <bits>
	   Filters experimental	bits of	label _n_ with _bits_ 0..7.

	   packets [comp] <num>	[scale]
	   To filter for netflow records with a	specific packet	count.
	   Example: packets > 1k

	   bytes [comp]	<num> [scale]
	   To filter for netflow records with a	specific byte count.
	   Example: bytes 46 filters all empty IPv4 packets

       Aggregated flows
	   flows [comp]	<num> [scale]
	   To filter for netflow records with a	specific number	of  aggregated

       Type of Service (TOS)
	   [SourceDestination] tos <num>
	   With	_num_ 0..255. For compatibility	with nfump 1.5.x: tos <num> is
	   equivalent with src tos <num>

       Packets per second: Calculated value.
	   pps [comp] num [scale]
	   To filter for flows with specific packets per second.

       Duration: Calculated value
	   duration [comp] num
	   To filter for flows with specific duration in miliseconds.

       Bits per	second:	Calculated value.
	   bps [comp] num [scale]
	   To filter for flows with specific bytes per second.

       Bytes per packet: Calculated value.
	   bpp [comp] num [scale]
	   To filter for flows with specific bytes per packet.

       scale scaling factor. Maybe k m g. Factor is 1000

       comp The	following comparators are supported:
	   =, ==, >, <,	EQ, LT,	GT .  If comp is omitted, '=' is assumed.

       NSEL/ASA	specific filters:

       NSEL/ASA	Event
	   asa event <ignore|create|term|delete|deny>
	   asa event [comp] <number>
	   select NSEL/ASA event by name or number. If given as	number it  can
	   be compared with a number

       NSEL/ASA	denied reason
	   asa event denied <ingress|egress|interface|nosyn>
	   Select a NSEL/ASA denied event by type

       NSEL/ASA	extended events
	   asa xevent [comp] <num>
	   Select  an  extended	 NSELL ASA event by number, or optionally com-
	   pared by a number.

       X-late IP addresses and ports
	   [src|dst] xip <ip>
	   Select the translated IP address

	   [src|dst] xnet <net>/<num>
	   with	_net_ as a valid translated IPv4 or IPv6 network and _num_  as
	   maskbits.   The  number of mask bits	must match the appropriate ad-
	   dress familiy in IPv4 or IPv6. Networks may be abreviated  such  as
	   172.16/16 if	they are unambiguous.

	   [src|dst] xport <port>
	   Select the translated port

       NSEL/ASA	ingress/egress
	   ingress <ACL|ACE|XACE> [comp] number
	   Select/compare an ingress ACL

	   egress ACL [comp] <number>
	   Select/compare an egress ACL

       NEL specific NAT	filters:

       NAT Event
	   nat event <add|delete>
	   nat event [comp] <number>
	   select  NEL	NAT event by name or number. If	given as number	it can
	   be compared with a number

       NEL NAT ip addresses and	ports
	   [src|dst] nip <ip>
	   Select the NAT IP address

	   [src|dst] nport <port>
	   Select the NAT port

       NEL NAT vrf
	   ingress vrf <num> Select the	vrf

       nfdump -r /and/dir/nfcapd.201107110845 -c 100 'proto tcp	and (  src  ip  or	 dst  ip	)' Dumps the first 100 netflow
       records which match the given filter:

       nfdump -r /and/dir/nfcapd.201107110845 -B Map matching flows as bin-di-
       rectional single	flow.

       nfdump	 -R   /and/dir/nfcapd.201107110845:nfcapd.200407110945	 'host' Dumps all netflow records of host from July 11
       08:45 - 09:45

       nfdump  -M /to/and/dir1:dir2 -R nfcapd.200407110845:nfcapd.200407110945
       -s record -n 20 Generates the Top 20 statistics	from  08:45  to	 09:45
       from 3 sources

       nfdump -r /and/dir/nfcapd.201107110845 -s record	-n 20 -o extended Gen-
       erates the Top 20 statistics, extended output format

       nfdump -r /and/dir/nfcapd.201107110845 -s record	-n 20 'in if 5 and bps
       >  10k'	Generates the Top 20 statistics	from flows comming from	inter-
       face 5

       nfdump -r /and/dir/nfcapd.201107110845 'inet6 and proto tcp and	(  src
       port > 1024 and dst port	80 ) Dumps all port 80 IPv6 connections	to any
       web server.

       Generating the statistics for data files	of a  few  hundred  MB	is  no
       problem.	However	be careful if you want to create statistics of several
       GB of data. This	may consume a lot of memory and	can take a while. Flow
       anonymization has moved into nfanon.

       nfcapd(1), nfanon(1), nfprofile(1), nfreplay(1)

       There  is  still	the famous last	bug. Please report them	- all the last
       bugs - back to me.

				  2009-09-09			     nfdump(1)


Want to link to this manual page? Use this URL:

home | help