flow-report.sgml

netflow,抓包

<!DOCTYPE refentry PUBLIC "-//Davenport//DTD DocBook V3.0//EN">
<refentry>

<refmeta>
<refentrytitle>
<application>flow-report</application>
</refentrytitle>
<manvolnum>1</manvolnum>
</refmeta>

<refnamediv>
<refname>
<application>flow-report</application>
</refname>
<refpurpose>
Generate reports from flow data.
</refpurpose>
</refnamediv>

<refsynopsisdiv>
<cmdsynopsis>
<command>flow-report</command>
<arg>-h</arg>
<arg>-d<replaceable> debug_level</replaceable></arg>
<arg>-s<replaceable> stat_fname</replaceable></arg>
<arg>-S<replaceable> stat_definition</replaceable></arg>
<arg>-v<replaceable> variable binding</replaceable></arg>
</cmdsynopsis>
</refsynopsisdiv>

<refsect1>
<title>DESCRIPTION</title>
<para>
The <command>flow-report</command> utility will generate reports
from flow data.  The reports are easy to parse ASCII text that
can be used by a front end to produce readable reports, graphs,
and charts.
</para>
<para>
Reports are definied by the 'stat-report' keyword followed by a report
name.  Each report has a type defined below and other commands.  Reports
are grouped into a definition with the 'stat-definition' keyword
followed by a definition name.  Each definition can invoke a filter
and optionally apply tags.
</para>
<para>
</para>
<para>
<screen>
stat-report command          Description/Example
------------------------------------------------------------------------
type                         Define the report type.
                             type destination-tag

filter                       Apply this filter definition.
                             filter permit-only-tcp


scale                        Scale report by n.
                             scale 100


tag-mask                     Apply source and destination mask to tag.
                             tag-mask 0xFF00 0xFF00

ip-source-address-format     Format of source IP address.
                             address    -  address, ie 128.146.1.7
                             prefix-len -  address/len ie 128.146.1.7/24
                             prefix-mask-  prefix/len 128.146.1/24

ip-destination-address-format
                             Format of destination IP address.
                             address    -  address, ie 128.146.1.7
                             prefix-len -  address/len ie 128.146.1.7/24
                             prefix-mask-  prefix/len 128.146.1/24

output                       Start an output configuration.  Multiple
                             output configurations can be configured
                             per report.

</screen>
</para>
<para>
<screen>
output option                Description/Example
-------------------------------------------------------------------------

path                         Pathname of output.  If the path begins
                             with a | the output is a pipe.  The
                             pathname is formatted through strftime().
                             Directories not in the path are
                             automatically created.
                             path /tmp/%Y/%m/%d/foo.out

time                         What time to use when formatting the
                             pathname with strftime.
                             now         - current time
                             start       - first flow
                             end         - last flow
                             mid         - average of first and last.


tally                        Emit a % total line every n records.
                             tally 10

format                       Output format.  Currently only ascii.
                             format ascii

sort                         Sort on a field.  + ascending, - descending.
                             sort +flows    - sort on the flows field


records                      Truncate report at n records.
                             records 10

fields                       Enable/Disable fields with +/-.  Fields:
                             index,first,last,flows,octets,packets,
                             duration,pps,bps,other,key,key1,key2,
                             key3,key4,count.
                             fields +key,+flows,+octets,+packets,

options                      Enable/Disable options with +/-
                             +header        - include header.
                             +xheader       - include extra header.
                             +totals        - include a totals line.
                             +percent-total - report in % total form.
                             +names         - use symbolic names.
                             options +header,+xheader

</screen>
</para>
<para>
<screen>
stat-definition option       Description/Example
-------------------------------------------------------------------------
filter                       Apply this filter definition.
                             filter default

tag                          Apply this tag definition.
                             tag default

mask                         Apply this mask definition.
                             mask default

report                       Invoke this report.  Multiple reports can
                             be set.
                             report foo

time-series                  How often to produce a report dump in seconds.
                             time-series 60

</screen>
</para>
<para>
<screen>
global options               Description/Example
-------------------------------------------------------------------------
include-tag                  Specify path to include tag definitions.
                             include-tag /flows/tags/test1

include-filter               Specify path to include filter definitions.
                             include-filter /flows/filters/test1

include-mask                 Specify path to include mask definitions.
                             include-filter /flows/masks/test1


</screen>
</para>
<para>
<screen>
Report type                  Summarization Key Elements.
------------------------------------------------------------------------
summary-detail               Totals plus quick breakdown.

summary-counters             Totals only.

packet-size                  Average packet size distribution.

octets                       Octets per flow distribution.

packets                      Packets per flow distribution.

ip-source-port               IP Source Port.

ip-destination-port          IP Destination Port.

ip-source/destination-port   IP Source/Destination Port pair.

bps                          Bits/Second distribution.

pps                          Packets/Second distribution.

ip-destination-address-type
                             IP class with ASM/SSM Multicast breakout.

ip-protocol                  IP Protocol.

ip-tos                       IP Type of Service.

ip-next-hop-address          IP Next Hop Address.

ip-source-address            IP Source Address.

ip-destination-address       IP Destination Address.

ip-source/destination-address
                             IP Source/Destination Address pair.

ip-exporter-address          IP Exporter Address.

input-interface              Input Interface.

output-interface             Output Interface.

input/output-interface       Input/Output Interface pair.

source-as                    Source AS.

destination-as               Destination AS.

source/destination-as        Source/Destination AS.

ip-source-address/source-as  IP Source Addrss and Source AS.

ip-destination-address/source-as
                             IP Destination Address and Source AS.

ip-source-address/destination-as
                             IP Source Address and Destination AS.

ip-destination-address/destination-as
                             IP Destination Address and Destination AS.

ip-source/destination-address/source-as
                             IP Source/Destination Address and Source AS.

ip-source/destination-address/destination-as
                             IP Source/Destination Address and
                             Destination AS.

ip-source/destination-address/source/destination-as
                             IP Source/Destination Address and
                             Source/Destination AS.

ip-source-address/input-interface
                             IP Source Address and Input Interface.

ip-destination-address/input-interface
                             IP Destination Address and Input Interface.

ip-source-address/output-interface
                             IP Source Address and Output Interface.

ip-destination-address/output-interface
                             IP Destination Address and Output Interface.

ip-source/destination-address/input-interface
                             IP Source/Destination Address and
                             Input Interface.

ip-source/destination-address/output-interface
                             IP Source/Destination Address and
                             Output Interface.

ip-source/destination-address/input/output-interface
                             IP Source/Destination Address and
                             Input/Output Interface.

input-interface/source-as    Input Interface and Source AS.

input-interface/destination-as
                             Input Interface and Destination AS.

output-interface/source-as
                             Output Interface and Source AS.

output-interface/destination-as
                             Output Interface and Destination AS.

input-interface/source/destination-as