flow-report.1.in

netflow,抓包

ip-destination-address/destination-as
                             IP Destination Address and Destination AS\&.

ip-source/destination-address/source-as
                             IP Source/Destination Address and Source AS\&.

ip-source/destination-address/destination-as
                             IP Source/Destination Address and
                             Destination AS\&.

ip-source/destination-address/source/destination-as
                             IP Source/Destination Address and
                             Source/Destination AS\&.

ip-source-address/input-interface
                             IP Source Address and Input Interface\&.

ip-destination-address/input-interface
                             IP Destination Address and Input Interface\&.

ip-source-address/output-interface
                             IP Source Address and Output Interface\&.

ip-destination-address/output-interface
                             IP Destination Address and Output Interface\&.

ip-source/destination-address/input-interface
                             IP Source/Destination Address and
                             Input Interface\&.

ip-source/destination-address/output-interface
                             IP Source/Destination Address and
                             Output Interface\&.

ip-source/destination-address/input/output-interface
                             IP Source/Destination Address and
                             Input/Output Interface\&.

input-interface/source-as    Input Interface and Source AS\&.

input-interface/destination-as
                             Input Interface and Destination AS\&.

output-interface/source-as
                             Output Interface and Source AS\&.

output-interface/destination-as
                             Output Interface and Destination AS\&.

input-interface/source/destination-as
                             Input Interface and Source/Destination AS\&.

output-interface/source/destination-as
                             Output Interface and Source/Destination AS\&.

input/output-interface/source/destination-as
                             Input/Output Interface and
                             Source/Destination AS\&.

engine-id                    Engine ID\&.

engine-type                  Engine Type\&.

source-tag                   Source Tag\&.

destination-tag              Destination Tag\&.

source/destination-tag       Source/Destination Tag\&.

ip-source-address/ip-source-port
                             IP Source Address and IP Source Port\&.

ip-source-address/ip-destination-port
                             IP Source Address and IP Destination Port\&.

ip-destination-address/ip-source-port
                             IP Destination Address and IP Source Port\&.

ip-destination-address/ip-destination-port
                             IP Destination Address and
                             IP Destination Port\&.

ip-source-address/ip-source/destination-port
                             IP Source Address and
                             IP Source/Destination Port\&.

ip-destination-address/ip-source/destination-port
                             IP Destination Address and
                             IP Source/Destination Port\&.

ip-source/destination-address/ip-source-port
                             IP Source/Destination Address and
                             IP Source Port\&.

ip-source/destination-address/ip-destination-port
                             IP Source/Destination Address and
                             IP Destination Port\&.

ip-source/destination-address/ip-source/destination-port
                             IP Source/Destination Address and
                             IP Source/Destination Port\&.

ip-source-address/input/output-interface
                             IP Source Address and
                             Input/Output Interface\&.

ip-destination-address/input/output-interface
                             IP Destination Address and
                             Input/Output Interface\&.

ip-source-address/source/destination-as
                             IP Source Address and
                             Source/Destination AS\&.

ip-destination-address/source/destination-as
                             IP Destination Address and
                             Source/Destination AS\&.

ip-address                   IP Address (both source and destination)\&.

ip-port                      IP Port (both source and destination)\&.

ip-source-address-destination-count
                             Count of destination IP addresses associated
                             with a source IP address\&.

ip-destination-address-source-count
                             Count of source IP addresses associated
                             with a destination IP address\&.

linear-interpolated-flows-octets-packets
                             Linear interpolated distribution of flows,
                             octets and packets\&.  The distribution is done
                             across the start and end time of the flow\&.

first                        First packet of flow distribution\&.

last                         Last packet of flow distribution\&.

duration                     Duration of flow distribution\&.

ip-source-address/source-tag
                             IP Source Address and
                             Source tag\&.

ip-source-address/destination-tag
                             IP Source Address and
                             Destination tag\&.

ip-destination-address/source-tag
                             IP Destination Address and
                             Source tag\&.

ip-destination-address/destination-tag
                             IP Destination Address and
                             Destination tag\&.

ip-source/destination-address/source/destination-tag
                             IP Source/Destination Address and
                             Source/Destination tag\&.

ip-source/destination-address/ip-protocol/ip-tos
                             IP Source/Destination Address, IP Protocol,
                             and ToS\&.

ip-source/destination-address/ip-protocol/ip-tos/ip-source/destination-port
                             IP Source/Destination Addess, IP Protocol,
                             IP Tos, IP Source/Destination Port\&.
.fi
.SH "OPTIONS"
.IP "-d\fI debug_level\fP" 10
Enable debugging\&.
.IP "-s\fI stat_fname\fP" 10
Report configuration filename\&.  Defaults to \fB@localstatedir@/cfg/stat\fP\&.
.IP "-S\fI stat_definition\fP" 10
Select the active definition\&.
.IP "-v\fI variable binding\fP" 10
Set a variable FOO=bar\&.
.IP "-h" 10
Display help\&.
.SH "EXAMPLES"
.PP
An example of report configuration file
.PP
.nf
# stat config file

include-filter /tmp/filter

stat-report t1
  type summary-detail
  filter default
  scale 100 
  output
    format ascii
    options +header,+xheader,+totals
    fields +other
    path /tmp/output1

stat-report t6
  type ip-source-port  
  output
    format ascii
    options +header,+xheader,+totals,+names,+percent-total
    sort +pps
    tally 5
    path /tmp/output6

stat-definition test
  filter tcp
  report t1
  report t6
.fi
.PP
.nf
# filter config file

filter-primitive TCP
  type ip-protocol
  permit TCP

filter-definition tcp
  match ip-protocol TCP
.fi
 
\fBflow-cat \fBflows\fP | flow-report -stest -Stest\fP
.SH "IMPLEMENTATION NOTES"
.PP
Packet size calculations are dOctets / dPkts, ie an average packet size\&.  It
is not possible to get a true packet size from flow exports\&.

pps and bps calculations are an average of the averages\&.

Flows that do not have a duration (start == end) are not counted in the
pps and bps calculations\&.

Flows without a packet or octet count are ignored\&.
.SH "FILES"
.PP
Symbols are located in \fB@localstatedir@/sym/*\fP
.SH "BUGS"
.PP
None known\&.
.SH "AUTHOR"
.PP
Mark Fullmer maf@splintered\&.net
.SH "SEE ALSO"
.PP
\fBflow-tools\fP(1)
...\" created by instant / docbook-to-man, Wed 12 Mar 2003, 22:01