flow-nfilter.html.in
来自「netflow,抓包」· IN 代码 · 共 565 行
IN
565 行
<HTML><HEAD><TITLE>flow-nfilter</TITLE><METANAME="GENERATOR"CONTENT="Modular DocBook HTML Stylesheet Version 1.73"></HEAD><BODYCLASS="REFENTRY"BGCOLOR="#FFFFFF"TEXT="#000000"LINK="#0000FF"VLINK="#840084"ALINK="#0000FF"><H1><ANAME="AEN1"><SPANCLASS="APPLICATION">flow-nfilter</SPAN></A></H1><DIVCLASS="REFNAMEDIV"><ANAME="AEN6"></A><H2>Name</H2><SPANCLASS="APPLICATION">flow-nfilter</SPAN> -- Filter flows.</DIV><DIVCLASS="REFSYNOPSISDIV"><ANAME="AEN10"></A><H2>Synopsis</H2><P><BCLASS="COMMAND">flow-nfilter</B> [-hk] [-b<TTCLASS="REPLACEABLE"><I> big</I></TT>|<TTCLASS="REPLACEABLE"><I>little</I></TT>] [-C<TTCLASS="REPLACEABLE"><I> comment</I></TT>] [-d<TTCLASS="REPLACEABLE"><I> debug_level</I></TT>] [-f<TTCLASS="REPLACEABLE"><I> filter_fname</I></TT>] [-F<TTCLASS="REPLACEABLE"><I> filter_definition</I></TT>] [-z<TTCLASS="REPLACEABLE"><I> z_level</I></TT>]</P></DIV><DIVCLASS="REFSECT1"><ANAME="AEN27"></A><H2>DESCRIPTION</H2><P>The <BCLASS="COMMAND">flow-nfilter</B> utility will filter flows based onuser selectable criteria. Filters are composed of primitives and a definition. Definitions contain match lines grouped to formlogical AND and OR operations on the flow using the selected primitives.A definition may contain the invert command which will invert theresult of the evaluation.</P><P>Filter primitives begin with the filter-primitive keyword followed bya symbolic name. Each primitive has a type defined below.A list of permit and or deny keywords followedby an argument are later evaulated to determine if the flow is permitted ordenied. The default action for a primitive is to deny which may be changed with the default keyword. Symbolic substitutions are done whereappropriate.</P><P></P><P>The match keyword in a definition selects the criteria to match a primitive.A match type may allow more than one type of primitive, for example thesrc-ip-addr match type will accept any of {ip-address, ip-address-mask,ip-address-prefix} primitive types.</P><P><PRECLASS="SCREEN"> Primitive type Type Description/Example-------------------------------------------------------------------as Bucket Autonomous System Number. 600,159,3112ip-address-prefix-len Numeric Integer from 0 to 32. 16-31ip-protocol Bucket Integer from 0 to 255. 6,17,1ip-tos Bucket Integer from 0 to 255 with mask. 0xA0/0xE0ip-tcp-flags Bucket Integer from 0 to 255 with mask. 0x2/0x2ifindex Bucket Integer from 0 to 65535 0,5,10engine Bucket Integer from 0 to 255. 0ip-port Bucket Integer from 0 to 255. 80,8080,23,22ip-address Hash List of IP Addresses. 10.0.0.1ip-address-mask List List of IP address/mask pairs. 10.1.0.0 255.255.0.0ip-address-prefix Trie List of IP address/mask pairs. 10.1/16tag Hash List of tags. 0xFF00tag-mask List List of tags. 0xF000/0xFF00counter List List of Integers with qualifier. lt 32time List List of relative time specifiers. gt 5:00time-date List List of absolute time specifiers. gt December 12, 2002 5:13:21double List List of doubles with qualifier. lt 32.0rate Element Rate is calculated as 1/rate. permit 100Match type Description Primitives accepted-------------------------------------------------------------------source-as Source AS asdestination-as Destination AS asip-source-address Source IP Address ip-address, ip-address-mask, ip-address-prefixip-destination-address Destination IP Address ip-address, ip-address-mask, ip-address-prefixip-exporter-address Exporter IP Address ip-address, ip-address-mask, ip-address-prefixip-nexthop-address NextHop IP Address ip-address, ip-address-mask, ip-address-prefixip-shortcut-address Shortcut IP Address ip-address, ip-address-mask, ip-address-prefixip-protocol IP Protocol ip-protocolip-source-address-prefix-len Source IP address ip-address-prefix-len prefix lengthip-destination-address-prefix-len Destination IP address ip-address-prefix-len prefix length ip-tos IP Type Of Service ip-tosip-marked-tos IP Type Of Service ip-tosip-tcp-flags IP/TCP Flags ip-tcp-flagsip-source-port Source IP Port ip-port eg TCP/UDPip-destination-port Destination IP Port ip-port eg TCP/UDPinput-interface Source ifIndex ifindex eg Input Interfaceoutput-interface Destination ifIndex ifindex eg Output Interfacestart-time Start Time of flow time, time-dateend-time End Time of Flow time, time-dateflows Number of flows counteroctets Number of octets counterpackets Number of packets counterduration Duration of flow in ms counterengine-id Engine ID engineengine-type Engine Type enginesource-tag Source Tag tag, tag-maskdestination-tag Destination Tag tag, tag-maskpps Packets Per Second doublebps Bits Per Second doublerandom-sample Random Sample rate </PRE></P></DIV><DIVCLASS="REFSECT1"><ANAME="AEN36"></A><H2>OPTIONS</H2><P></P><DIVCLASS="VARIABLELIST"><DL><DT>-b<TTCLASS="REPLACEABLE"><I> big</I></TT>|<TTCLASS="REPLACEABLE"><I>little</I></TT></DT><DD><P>Byte order of output.</P></DD><DT>-C<TTCLASS="REPLACEABLE"><I> Comment</I></TT></DT><DD><P>Add a comment. </P></DD><DT>-d<TTCLASS="REPLACEABLE"><I> debug_level</I></TT></DT><DD><P>Enable debugging.</P></DD><DT>-f<TTCLASS="REPLACEABLE"><I> filter_fname</I></TT></DT><DD><P>Filter list filename. Defaults to <TTCLASS="FILENAME">@localstatedir@/cfg/filter</TT>.</P></DD><DT>-F<TTCLASS="REPLACEABLE"><I> filter_definition</I></TT></DT><DD><P>Select the active definition. Defaults to default.</P></DD><DT>-h</DT><DD><P>Display help.</P></DD><DT>-k</DT><DD><P>Keep time from input.</P></DD><DT>-z<TTCLASS="REPLACEABLE"><I> z_level</I></TT></DT><DD><P>Configure compression level to <TTCLASS="REPLACEABLE"><I> z_level</I></TT>. 0 isdisabled (no compression), 9 is highest compression.</P></DD></DL></DIV></DIV><DIVCLASS="REFSECT1"><ANAME="AEN80"></A><H2>EXAMPLES</H2><DIVCLASS="INFORMALEXAMPLE"><ANAME="AEN82"></A><P></P><P>An example of filter configuration file.<PRECLASS="SCREEN"> filter-primitive srate type rate permit 100filter-primitive test-as type as permit 600,159filter-primitive test-prefix-len type ip-address-prefix-len permit 32filter-primitive test-protocol type ip-protocol permit tcpfilter-primitive test-tos type ip-tos mask 0xA0 permit 0xE0filter-primitive test-tcp-flags type ip-tcp-flags mask 0x2 permit 0x2filter-primitive test-ifindex type ifindex permit 0,5,10filter-primitive test-engine type engine permit 0filter-primitive test-port type ip-port permit https permit 80 default denyfilter-primitive test-address type ip-address permit 0.0.0.1 permit 0.0.0.2 default denyfilter-primitive test-address-mask type ip-address-mask permit 128.146.197.1 255.255.255.255 permit 128.146.197.2 255.255.255.255filter-primitive test-prefix type ip-address-prefix permit 128.146.0.0/16 default denyfilter-primitive test-tag type tag permit 0x00 permit 0x01 permit 0xFFfilter-primitive test-tag-mask type tag-mask permit OSU 0xFF permit 0xFF 0xFF default denyfilter-primitive test-counter type counter permit lt 5 permit gt 10 default denyfilter-primitive test-time-date type time-date permit gt December 12, 2002 5:13:21filter-primitive test-time type time-date permit gt 12:15:00filter-definition sample-1-in-100 match random-sample sratefilter-definition t1 match engine-type test-engine or match destination-tag test-tag-mask</PRE></P><P></P></DIV><DIVCLASS="INFORMALEXAMPLE"><ANAME="AEN85"></A><P></P><P>Display all flows with a destination port of 80 or source port of 25 (smtp)starting after Dec 12, 2001. The file <TTCLASS="FILENAME">test</TT> ispopulated with the following:<PCLASS="LITERALLAYOUT">filter-primitive port80<br> type ip-port<br> permit 80<br><br>filter-primitive port25<br> type ip-port<br> permit smtp<br><br>filter-primitive dec12<br> type time-date<br> permit gt Dec 12, 2001<br><br>filter-definition foo<br> match ip-source-port port80<br> match start-time dec12<br> or<br> match ip-destination-port port25<br> match start-time dec12</P><BCLASS="COMMAND">flow-cat <TTCLASS="FILENAME">flows</TT> | flow-nfilter -ftest -Ffoo | flow-print</B> </P><P></P></DIV></DIV><DIVCLASS="REFSECT1"><ANAME="AEN91"></A><H2>BUGS</H2><P>None known.</P></DIV><DIVCLASS="REFSECT1"><ANAME="AEN94"></A><H2>AUTHOR</H2><P>Mark Fullmer<TTCLASS="EMAIL"><<AHREF="mailto:maf@splintered.net">maf@splintered.net</A>></TT></P></DIV><DIVCLASS="REFSECT1"><ANAME="AEN101"></A><H2>SEE ALSO</H2><P><SPANCLASS="APPLICATION">flow-tools</SPAN>(1)</P></DIV></BODY></HTML>⌨️ 快捷键说明
复制代码Ctrl + C
搜索代码Ctrl + F
全屏模式F11
增大字号Ctrl + =
减小字号Ctrl + -
显示快捷键?