flow-xlate.html

来自「netflow,抓包」· HTML 代码 · 共 426 行

HTML
426 行
字号 
<HTML><HEAD><TITLE>flow-xlate</TITLE><METANAME="GENERATOR"CONTENT="Modular DocBook HTML Stylesheet Version 1.71"></HEAD><BODYCLASS="REFENTRY"BGCOLOR="#FFFFFF"TEXT="#000000"LINK="#0000FF"VLINK="#840084"ALINK="#0000FF"><H1><ANAME="AEN1"><SPANCLASS="APPLICATION">flow-xlate</SPAN></A></H1><DIVCLASS="REFNAMEDIV"><ANAME="AEN6"></A><H2>Name</H2><SPANCLASS="APPLICATION">flow-xlate</SPAN>&nbsp;--&nbsp;Apply translations to selected fields of a flow.</DIV><DIVCLASS="REFSYNOPSISDIV"><ANAME="AEN10"></A><H2>Synopsis</H2><P><BCLASS="COMMAND">flow-xlate</B>  [-fhl] [-0<TTCLASS="REPLACEABLE"><I> AS0_substitution</I></TT>] [-b<TTCLASS="REPLACEABLE"><I> big</I></TT>|<TTCLASS="REPLACEABLE"><I>little</I></TT>] [-C<TTCLASS="REPLACEABLE"><I> comment</I></TT>] [-d<TTCLASS="REPLACEABLE"><I> debug_level</I></TT>] [-m<TTCLASS="REPLACEABLE"><I> privacy_mask</I></TT>] [-s<TTCLASS="REPLACEABLE"><I> scale</I></TT>] [-t<TTCLASS="REPLACEABLE"><I> src_tag_mask</I></TT>] [-T<TTCLASS="REPLACEABLE"><I> dst_tag_mask</I></TT>] [-V<TTCLASS="REPLACEABLE"><I> pdu_version</I></TT>] [-z<TTCLASS="REPLACEABLE"><I> z_level</I></TT>]</P></DIV><DIVCLASS="REFSECT1"><ANAME="AEN35"></A><H2>DESCRIPTION</H2><P>The <BCLASS="COMMAND">flow-xlate</B> utility can translate between thenon aggregated flow export versions (1,5,6,7) and modify some fieldsof a flow.</P></DIV><DIVCLASS="REFSECT1"><ANAME="AEN39"></A><H2>OPTIONS</H2><P></P><DIVCLASS="VARIABLELIST"><DL><DT>-0<TTCLASS="REPLACEABLE"><I> AS0_substitution</I></TT></DT><DD><P>Cisco's NetFlow exports represent the local autonomous system as 0 instead ofthe real value.  This option can be used to replace the 0 in the export withthe a configured value.  Unfortunately under certain configurations AS 0 canalso represent a cache miss or non forwarded traffic so use with caution.</P></DD><DT>-b<TTCLASS="REPLACEABLE"><I> big</I></TT>|<TTCLASS="REPLACEABLE"><I>little</I></TT></DT><DD><P>Byte order of output.</P></DD><DT>-C<TTCLASS="REPLACEABLE"><I> Comment</I></TT></DT><DD><P>Add a comment.</P></DD><DT>-d<TTCLASS="REPLACEABLE"><I> debug_level</I></TT></DT><DD><P>Enable debugging.</P></DD><DT>-f</DT><DD><P>Convert the source and destination IP addresses to network addressesusing the mask bits in the flow.  For example 128.146.1.7/16 would become128.146/16</P></DD><DT>-h</DT><DD><P>Display help.</P></DD><DT>-l</DT><DD><P>Convert the source and destination IP addresses to legacy classfulnetwork addresses.  For example 128.146.1.7 would become 128.146.0.0.</P></DD><DT>-m<TTCLASS="REPLACEABLE"><I> privacy_mask</I></TT></DT><DD><P>Apply <TTCLASS="REPLACEABLE"><I>privacy_mask</I></TT> to the source and destination IPaddress of flows.  For example a privacy_mask of 255.255.255.0 would convertflows with source/destination IP addresses 10.1.1.1 and 10.2.2.2 to 10.1.1.0and 10.2.2.0 respectively.</P></DD><DT>-n<TTCLASS="REPLACEABLE"><I> version</I></TT></DT><DD><P>Generate version type exports.  Supported versions are:<PCLASS="LITERALLAYOUT">&nbsp;&nbsp;&nbsp;&nbsp;1&nbsp;&nbsp;&nbsp;&nbsp;NetFlow&nbsp;version&nbsp;1&nbsp;(No&nbsp;sequence&nbsp;numbers,&nbsp;AS,&nbsp;or&nbsp;mask)<br>&nbsp;&nbsp;&nbsp;&nbsp;5&nbsp;&nbsp;&nbsp;&nbsp;NetFlow&nbsp;version&nbsp;5<br>&nbsp;&nbsp;&nbsp;&nbsp;6&nbsp;&nbsp;&nbsp;&nbsp;NetFlow&nbsp;version&nbsp;6&nbsp;(5+&nbsp;Encapsulation&nbsp;size)<br>&nbsp;&nbsp;&nbsp;&nbsp;7&nbsp;&nbsp;&nbsp;&nbsp;NetFlow&nbsp;version&nbsp;7&nbsp;(Catalyst&nbsp;switches)<br>&nbsp;&nbsp;&nbsp;&nbsp;8.1&nbsp;&nbsp;NetFlow&nbsp;AS&nbsp;Aggregation<br>&nbsp;&nbsp;&nbsp;&nbsp;8.2&nbsp;&nbsp;NetFlow&nbsp;Proto&nbsp;Port&nbsp;Aggregation<br>&nbsp;&nbsp;&nbsp;&nbsp;8.3&nbsp;&nbsp;NetFlow&nbsp;Source&nbsp;Prefix&nbsp;Aggregation<br>&nbsp;&nbsp;&nbsp;&nbsp;8.4&nbsp;&nbsp;NetFlow&nbsp;Destination&nbsp;Prefix&nbsp;Aggregation<br>&nbsp;&nbsp;&nbsp;&nbsp;8.5&nbsp;&nbsp;NetFlow&nbsp;Prefix&nbsp;Aggregation<br>&nbsp;&nbsp;&nbsp;&nbsp;8.6&nbsp;&nbsp;NetFlow&nbsp;Destination&nbsp;(Catalyst&nbsp;switches)<br>&nbsp;&nbsp;&nbsp;&nbsp;8.7&nbsp;&nbsp;NetFlow&nbsp;Source&nbsp;Destination&nbsp;(Catalyst&nbsp;switches)<br>&nbsp;&nbsp;&nbsp;&nbsp;8.8&nbsp;&nbsp;NetFlow&nbsp;Full&nbsp;Flow&nbsp;(Catalyst&nbsp;switches)<br>&nbsp;&nbsp;&nbsp;&nbsp;8.9&nbsp;&nbsp;NetFlow&nbsp;ToS&nbsp;AS&nbsp;Aggregation<br>&nbsp;&nbsp;&nbsp;&nbsp;8.10&nbsp;NetFlow&nbsp;ToS&nbsp;Proto&nbsp;Port&nbsp;Aggregation<br>&nbsp;&nbsp;&nbsp;&nbsp;8.11&nbsp;NetFlow&nbsp;ToS&nbsp;Source&nbsp;Prefix&nbsp;Aggregation<br>&nbsp;&nbsp;&nbsp;&nbsp;8.12&nbsp;NetFlow&nbsp;ToS&nbsp;Destination&nbsp;Prefix&nbsp;Aggregation<br>&nbsp;&nbsp;&nbsp;&nbsp;8.13&nbsp;NetFlow&nbsp;ToS&nbsp;Prefix&nbsp;Aggregation<br>&nbsp;&nbsp;&nbsp;&nbsp;8.14&nbsp;NetFlow&nbsp;ToS&nbsp;Prefix&nbsp;Port&nbsp;Aggregation<br>&nbsp;&nbsp;&nbsp;&nbsp;1005&nbsp;Flow-Tools&nbsp;tagged&nbsp;version&nbsp;5</P></P></DD><DT>-s<TTCLASS="REPLACEABLE"><I> scale</I></TT></DT><DD><P>Scale the flows and octets and packets fields by <TTCLASS="REPLACEABLE"><I>scale</I></TT>.</P></DD><DT>-t<TTCLASS="REPLACEABLE"><I> src_tag_mask</I></TT></DT><DD><P>AND <TTCLASS="REPLACEABLE"><I>src_tag_mask</I></TT> with src_tag in flow.</P></DD><DT>-T<TTCLASS="REPLACEABLE"><I> dst_tag_mask</I></TT></DT><DD><P>AND <TTCLASS="REPLACEABLE"><I>dst_tag_mask</I></TT> with dst_tag in flow.</P></DD><DT>-z<TTCLASS="REPLACEABLE"><I> z_level</I></TT></DT><DD><P>Configure compression level to <TTCLASS="REPLACEABLE"><I> z_level</I></TT>.  0 isdisabled (no compression), 9 is highest compression.</P></DD></DL></DIV></DIV><DIVCLASS="REFSECT1"><ANAME="AEN111"></A><H2>EXAMPLES</H2><DIVCLASS="INFORMALEXAMPLE"><ANAME="AEN113"></A><P></P><P>Convert the version 7 flows in <TTCLASS="FILENAME">flows.v7</TT> to version 5,storing the result in <TTCLASS="FILENAME">flows.v5</TT>.</P><P>  <BCLASS="COMMAND">flow-xlate -V5 &lt; flows.v7 &gt; flows.v5</B></P><P></P></DIV></DIV><DIVCLASS="REFSECT1"><ANAME="AEN119"></A><H2>EXAMPLES</H2><DIVCLASS="INFORMALEXAMPLE"><ANAME="AEN121"></A><P></P><P>Summarize IP addresses to IP network numbers and generate a source prefixlist report sorted by octets.</P><P>  <BCLASS="COMMAND">flow-xlate -f &lt; flows | flow-stat -f9 -w -S2</B></P><P></P></DIV></DIV><DIVCLASS="REFSECT1"><ANAME="AEN125"></A><H2>BUGS</H2><P>The scale option can overflow the 32 bit flow counters.  This could besolved by detecting this condition and splitting the flow in two.</P><P>Translation between aggregated and non aggregated formats is not supported.</P></DIV><DIVCLASS="REFSECT1"><ANAME="AEN129"></A><H2>AUTHOR</H2><P>Mark Fullmer<TTCLASS="EMAIL">&#60;<AHREF="mailto:maf@splintered.net">maf@splintered.net</A>&#62;</TT></P></DIV><DIVCLASS="REFSECT1"><ANAME="AEN136"></A><H2>SEE ALSO</H2><P><SPANCLASS="APPLICATION">flow-tools</SPAN>(1)</P></DIV></BODY></HTML>

flow-xlate.html - 源码说明

本页面展示了「netflow,抓包」中的 flow-xlate.html 源码文件，采用 HTML 编程语言编写，共 426 行代码。您可以在线阅读完整代码内容，也可以返回资源详情页下载完整源码包进行本地学习和开发。

虫虫下载站收录了大量与netflow相关的技术资源，包括源代码、技术文档、电路图等，是电子工程师和嵌入式开发者的专业学习平台。

⌨️ 快捷键说明

复制代码Ctrl + C
搜索代码Ctrl + F
全屏模式F11
增大字号Ctrl + =
减小字号Ctrl + -
显示快捷键?