📄 flow-filter.html
字号:
<HTML><HEAD><TITLE>flow-filter</TITLE><METANAME="GENERATOR"CONTENT="Modular DocBook HTML Stylesheet Version 1.73"></HEAD><BODYCLASS="REFENTRY"BGCOLOR="#FFFFFF"TEXT="#000000"LINK="#0000FF"VLINK="#840084"ALINK="#0000FF"><H1><ANAME="AEN1"><SPANCLASS="APPLICATION">flow-filter</SPAN></A></H1><DIVCLASS="REFNAMEDIV"><ANAME="AEN6"></A><H2>Name</H2><SPANCLASS="APPLICATION">flow-filter</SPAN> -- Filter flows.</DIV><DIVCLASS="REFSYNOPSISDIV"><ANAME="AEN10"></A><H2>Synopsis</H2><P><BCLASS="COMMAND">flow-filter</B> [-hko] [-a<TTCLASS="REPLACEABLE"><I> src_as_filter</I></TT>] [-A<TTCLASS="REPLACEABLE"><I> dst_as_filter</I></TT>] [-b<TTCLASS="REPLACEABLE"><I> big</I></TT>|<TTCLASS="REPLACEABLE"><I>little</I></TT>] [-C<TTCLASS="REPLACEABLE"><I> comment</I></TT>] [-D<TTCLASS="REPLACEABLE"><I> dstaddr_filter_name</I></TT>] [-d<TTCLASS="REPLACEABLE"><I> debug_level</I></TT>] [-f<TTCLASS="REPLACEABLE"><I> acl_fname</I></TT>] [-i<TTCLASS="REPLACEABLE"><I> input_filter</I></TT>] [-I<TTCLASS="REPLACEABLE"><I> output_filter</I></TT>] [-p<TTCLASS="REPLACEABLE"><I> srcport_filter</I></TT>] [-P<TTCLASS="REPLACEABLE"><I> dstport_filter</I></TT>] [-r<TTCLASS="REPLACEABLE"><I> ipprot_filter</I></TT>] [-S<TTCLASS="REPLACEABLE"><I> srcaddr_filter_name</I></TT>] [-t<TTCLASS="REPLACEABLE"><I> tos_filter</I></TT>] [-T<TTCLASS="REPLACEABLE"><I> tcp_flags_filter</I></TT>] [-x<TTCLASS="REPLACEABLE"><I> nexthop_filter_name</I></TT>] [-z<TTCLASS="REPLACEABLE"><I> z_level</I></TT>]</P></DIV><DIVCLASS="REFSECT1"><ANAME="AEN49"></A><H2>DESCRIPTION</H2><P>The <BCLASS="COMMAND">flow-filter</B> utility will filter flows based onuser selectable criteria. The IP address filters are defined in <TTCLASS="FILENAME">flow.acl</TT> or by the filename specified by -f.</P><P>Other filters such as input interface and ports are defined on thecommand line. These filters accept range and negation operators, ie-i1-15 for input interfaces 1 through 15 or -i1,15 for input interfaces1 and 15, or !1,15 for not input interfaces 1 and 15.</P><P>The syntax is kludgy and needs reworked but works for most applications. </P></DIV><DIVCLASS="REFSECT1"><ANAME="AEN56"></A><H2>OPTIONS</H2><P></P><DIVCLASS="VARIABLELIST"><DL><DT>-a<TTCLASS="REPLACEABLE"><I> src_as_filter</I></TT></DT><DD><P>Source AS filter, ie -a159 to permit Autonomous System 159.</P></DD><DT>-A<TTCLASS="REPLACEABLE"><I> dst_as_filter</I></TT></DT><DD><P>Destination AS filter, ie -A159,3112 to permit Autonomous Systems 159 and 3112.</P></DD><DT>-b<TTCLASS="REPLACEABLE"><I> big</I></TT>|<TTCLASS="REPLACEABLE"><I>little</I></TT></DT><DD><P>Byte order of output.</P></DD><DT>-C<TTCLASS="REPLACEABLE"><I> Comment</I></TT></DT><DD><P>Add a comment. </P></DD><DT>-d<TTCLASS="REPLACEABLE"><I> debug_level</I></TT></DT><DD><P>Enable debugging.</P></DD><DT>-D<TTCLASS="REPLACEABLE"><I> dstaddr_filter_name</I></TT></DT><DD><P>Destination IP address filter. This is the name or number of a standardaccess list defined in <TTCLASS="FILENAME">flow.acl</TT> or the file specifiedby -f.</P></DD><DT>-f<TTCLASS="REPLACEABLE"><I> acl_fname</I></TT></DT><DD><P>Access list filename. Defaults to <TTCLASS="FILENAME">flow.acl</TT>.</P></DD><DT>-h</DT><DD><P>Display help.</P></DD><DT>-i<TTCLASS="REPLACEABLE"><I> input_filter</I></TT></DT><DD><P>Input interface filter, ie -i0 to permit traffic from interface 0.</P></DD><DT>-k</DT><DD><P>Keep time from input.</P></DD><DT>-I<TTCLASS="REPLACEABLE"><I> output_filter</I></TT></DT><DD><P>Output interface filter, ie -I0 to permit traffic to interface 0.</P></DD><DT>-o</DT><DD><P>Logical OR instead of AND filters.</P></DD><DT>-p<TTCLASS="REPLACEABLE"><I> srcport_filter</I></TT></DT><DD><P>Source port filter, ie -p80 to only permit source port 80.</P></DD><DT>-P<TTCLASS="REPLACEABLE"><I> dstport_filter</I></TT></DT><DD><P>Destination port filter, ie -P80,8080 to permit destination ports 80 and 8080.</P></DD><DT>-r<TTCLASS="REPLACEABLE"><I> ipprot_filter</I></TT></DT><DD><P>IP Protocol filter, ie -r6 to only permit TCP traffic.</P></DD><DT>-S<TTCLASS="REPLACEABLE"><I> srcaddr_filter_name</I></TT></DT><DD><P>Source IP address filter. This is the name or number of a standardaccess list defined in <TTCLASS="FILENAME">flow.acl</TT> or the filespecified by -f.</P></DD><DT>-t<TTCLASS="REPLACEABLE"><I> tos_filter</I></TT></DT><DD><P>ToS bits filter. An optional mask is available which is applied tothe tos field before comparing to the filter list. For example tomatch a tos bit pattern of 101xxxxx use 0xA0/0xE0.</P></DD><DT>-T<TTCLASS="REPLACEABLE"><I> tcp_flags_filter</I></TT></DT><DD><P>TCP bits filter. An optional mask is available which is applied tothe TCP flags field before comparing to the filter list. For example tomatch a flows with the SYN bit set use 0x2/0x2.</P></DD><DT>-x<TTCLASS="REPLACEABLE"><I> nexthop_filter_name</I></TT></DT><DD><P>NextHop IP address filter. This is the name or number of a standardaccess list defined in <TTCLASS="FILENAME">flow.acl</TT> or the filespecified by -f.</P></DD><DT>-z<TTCLASS="REPLACEABLE"><I> z_level</I></TT></DT><DD><P>Configure compression level to <TTCLASS="REPLACEABLE"><I> z_level</I></TT>. 0 isdisabled (no compression), 9 is highest compression.</P></DD></DL></DIV></DIV><DIVCLASS="REFSECT1"><ANAME="AEN162"></A><H2>EXAMPLES</H2><DIVCLASS="INFORMALEXAMPLE"><ANAME="AEN164"></A><P></P><P>Print all traffic with a destination port of 80.</P><P> <BCLASS="COMMAND">flow-cat /flows/krc4 | flow-filter -P80 | flow-print</B></P><P></P></DIV><DIVCLASS="INFORMALEXAMPLE"><ANAME="AEN168"></A><P></P><P>Print all traffic with with source IP 10.0.0.1. Populate<TTCLASS="FILENAME">flow.acl</TT> with ip access-list standard badguy permit host 10.0.0.1</P><P> <BCLASS="COMMAND">flow-cat /flows/krc4 | flow-filter -Sbadguy | flow-print</B></P><P></P></DIV><DIVCLASS="INFORMALEXAMPLE"><ANAME="AEN173"></A><P></P><P>Report all destinations that IP 10.0.0.1 has sent traffic to. Sort byoctets. Populate <TTCLASS="FILENAME">flow.acl</TT> with ip access-list standard badguy permit host 10.0.0.1</P><P> <BCLASS="COMMAND">flow-cat /flows/krc4 | flow-filter -Sbadguy | flow-stat -f8 -S2</B></P><P></P></DIV></DIV><DIVCLASS="REFSECT1"><ANAME="AEN178"></A><H2>BUGS</H2><P>Extended access lists are not fully implemented.The command line filter syntax is a kludge.</P></DIV><DIVCLASS="REFSECT1"><ANAME="AEN181"></A><H2>NOTES</H2><P>Use flow-nfilter instead.</P></DIV><DIVCLASS="REFSECT1"><ANAME="AEN184"></A><H2>AUTHOR</H2><P>Mark Fullmer<TTCLASS="EMAIL"><<AHREF="mailto:maf@splintered.net">maf@splintered.net</A>></TT></P></DIV><DIVCLASS="REFSECT1"><ANAME="AEN191"></A><H2>SEE ALSO</H2><P><SPANCLASS="APPLICATION">flow-tools</SPAN>(1)</P></DIV></BODY></HTML>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -