flow-report.1.in

netflow,抓包

...\" $Header: /usr/src/docbook-to-man/cmd/RCS/docbook-to-man.sh,v 1.3 1996/06/17 03:36:49 fld Exp $
...\"
...\"	transcript compatibility for postscript use.
...\"
...\"	synopsis:  .P! <file.ps>
...\"
.de P!
\\&.
.fl			\" force out current output buffer
\\!%PB
\\!/showpage{}def
...\" the following is from Ken Flowers -- it prevents dictionary overflows
\\!/tempdict 200 dict def tempdict begin
.fl			\" prolog
.sy cat \\$1\" bring in postscript file
...\" the following line matches the tempdict above
\\!end % tempdict %
\\!PE
\\!.
.sp \\$2u	\" move below the image
..
.de pF
.ie     \\*(f1 .ds f1 \\n(.f
.el .ie \\*(f2 .ds f2 \\n(.f
.el .ie \\*(f3 .ds f3 \\n(.f
.el .ie \\*(f4 .ds f4 \\n(.f
.el .tm ? font overflow
.ft \\$1
..
.de fP
.ie     !\\*(f4 \{\
.	ft \\*(f4
.	ds f4\"
'	br \}
.el .ie !\\*(f3 \{\
.	ft \\*(f3
.	ds f3\"
'	br \}
.el .ie !\\*(f2 \{\
.	ft \\*(f2
.	ds f2\"
'	br \}
.el .ie !\\*(f1 \{\
.	ft \\*(f1
.	ds f1\"
'	br \}
.el .tm ? font underflow
..
.ds f1\"
.ds f2\"
.ds f3\"
.ds f4\"
.ta 8n 16n 24n 32n 40n 48n 56n 64n 72n 
.TH "\fBflow-report\fP" "1"
.SH "NAME"
\fBflow-report\fP \(em Generate reports from flow data\&.
.SH "SYNOPSIS"
.PP
\fBflow-report\fP [-h]  [-d\fI debug_level\fP]  [-s\fI stat_fname\fP]  [-S\fI stat_definition\fP]  [-v\fI variable binding\fP] 
.SH "DESCRIPTION"
.PP
The \fBflow-report\fP utility will generate reports
from flow data\&.  The reports are easy to parse ASCII text that
can be used by a front end to produce readable reports, graphs,
and charts\&.
.PP
Reports are definied by the \&'stat-report\&' keyword followed by a report
name\&.  Each report has a type defined below and other commands\&.  Reports
are grouped into a definition with the \&'stat-definition\&' keyword
followed by a definition name\&.  Each definition can invoke a filter
and optionally apply tags\&.
.PP
.PP
.PP
.nf
stat-report command          Description/Example
------------------------------------------------------------------------
type                         Define the report type\&.
                             type destination-tag

filter                       Apply this filter definition\&.
                             filter permit-only-tcp


scale                        Scale report by n\&.
                             scale 100


tag-mask                     Apply source and destination mask to tag\&.
                             tag-mask 0xFF00 0xFF00

ip-source-address-format     Format of source IP address\&.
                             address    -  address, ie 128\&.146\&.1\&.7
                             prefix-len -  address/len ie 128\&.146\&.1\&.7/24
                             prefix-mask-  prefix/len 128\&.146\&.1/24

ip-destination-address-format
                             Format of destination IP address\&.
                             address    -  address, ie 128\&.146\&.1\&.7
                             prefix-len -  address/len ie 128\&.146\&.1\&.7/24
                             prefix-mask-  prefix/len 128\&.146\&.1/24

output                       Start an output configuration\&.  Multiple
                             output configurations can be configured
                             per report\&.
.fi
.PP
.PP
.nf
output option                Description/Example
-------------------------------------------------------------------------

path                         Pathname of output\&.  If the path begins
                             with a | the output is a pipe\&.  The
                             pathname is formatted through strftime()\&.
                             Directories not in the path are
                             automatically created\&.
                             path /tmp/%Y/%m/%d/foo\&.out

time                         What time to use when formatting the
                             pathname with strftime\&.
                             now         - current time
                             start       - first flow
                             end         - last flow
                             mid         - average of first and last\&.


tally                        Emit a % total line every n records\&.
                             tally 10

format                       Output format\&.  Currently only ascii\&.
                             format ascii

sort                         Sort on a field\&.  + ascending, - descending\&.
                             sort +flows    - sort on the flows field


records                      Truncate report at n records\&.
                             records 10

fields                       Enable/Disable fields with +/-\&.  Fields:
                             index,first,last,flows,octets,packets,
                             duration,pps,bps,other,key,key1,key2,
                             key3,key4,count\&.
                             fields +key,+flows,+octets,+packets,

options                      Enable/Disable options with +/-
                             +header        - include header\&.
                             +xheader       - include extra header\&.
                             +totals        - include a totals line\&.
                             +percent-total - report in % total form\&.
                             +names         - use symbolic names\&.
                             options +header,+xheader
.fi
.PP
.PP
.nf
stat-definition option       Description/Example
-------------------------------------------------------------------------
filter                       Apply this filter definition\&.
                             filter default

tag                          Apply this tag definition\&.
                             tag default

mask                         Apply this mask definition\&.
                             mask default

report                       Invoke this report\&.  Multiple reports can
                             be set\&.
                             report foo

time-series                  How often to produce a report dump in seconds\&.
                             time-series 60
.fi
.PP
.PP
.nf
global options               Description/Example
-------------------------------------------------------------------------
include-tag                  Specify path to include tag definitions\&.
                             include-tag /flows/tags/test1

include-filter               Specify path to include filter definitions\&.
                             include-filter /flows/filters/test1

include-mask                 Specify path to include mask definitions\&.
                             include-filter /flows/masks/test1

.fi
.PP
.PP
.nf
Report type                  Summarization Key Elements\&.
------------------------------------------------------------------------
summary-detail               Totals plus quick breakdown\&.

summary-counters             Totals only\&.

packet-size                  Average packet size distribution\&.

octets                       Octets per flow distribution\&.

packets                      Packets per flow distribution\&.

ip-source-port               IP Source Port\&.

ip-destination-port          IP Destination Port\&.

ip-source/destination-port   IP Source/Destination Port pair\&.

bps                          Bits/Second distribution\&.

pps                          Packets/Second distribution\&.

ip-destination-address-type
                             IP class with ASM/SSM Multicast breakout\&.

ip-protocol                  IP Protocol\&.

ip-tos                       IP Type of Service\&.

ip-next-hop-address          IP Next Hop Address\&.

ip-source-address            IP Source Address\&.

ip-destination-address       IP Destination Address\&.

ip-source/destination-address
                             IP Source/Destination Address pair\&.

ip-exporter-address          IP Exporter Address\&.

input-interface              Input Interface\&.

output-interface             Output Interface\&.

input/output-interface       Input/Output Interface pair\&.

source-as                    Source AS\&.

destination-as               Destination AS\&.

source/destination-as        Source/Destination AS\&.

ip-source-address/source-as  IP Source Addrss and Source AS\&.

ip-destination-address/source-as
                             IP Destination Address and Source AS\&.

ip-source-address/destination-as
                             IP Source Address and Destination AS\&.