flow-report.html.in

netflow,抓包

input/output-interface/source/destination-as
                             Input/Output Interface and
                             Source/Destination AS.

engine-id                    Engine ID.

engine-type                  Engine Type.

source-tag                   Source Tag.

destination-tag              Destination Tag.

source/destination-tag       Source/Destination Tag.

ip-source-address/ip-source-port
                             IP Source Address and IP Source Port.

ip-source-address/ip-destination-port
                             IP Source Address and IP Destination Port.

ip-destination-address/ip-source-port
                             IP Destination Address and IP Source Port.

ip-destination-address/ip-destination-port
                             IP Destination Address and
                             IP Destination Port.

ip-source-address/ip-source/destination-port
                             IP Source Address and
                             IP Source/Destination Port.

ip-destination-address/ip-source/destination-port
                             IP Destination Address and
                             IP Source/Destination Port.

ip-source/destination-address/ip-source-port
                             IP Source/Destination Address and
                             IP Source Port.

ip-source/destination-address/ip-destination-port
                             IP Source/Destination Address and
                             IP Destination Port.

ip-source/destination-address/ip-source/destination-port
                             IP Source/Destination Address and
                             IP Source/Destination Port.

ip-source-address/input/output-interface
                             IP Source Address and
                             Input/Output Interface.

ip-destination-address/input/output-interface
                             IP Destination Address and
                             Input/Output Interface.

ip-source-address/source/destination-as
                             IP Source Address and
                             Source/Destination AS.

ip-destination-address/source/destination-as
                             IP Destination Address and
                             Source/Destination AS.

ip-address                   IP Address (both source and destination).

ip-port                      IP Port (both source and destination).

ip-source-address-destination-count
                             Count of destination IP addresses associated
                             with a source IP address.

ip-destination-address-source-count
                             Count of source IP addresses associated
                             with a destination IP address.

linear-interpolated-flows-octets-packets
                             Linear interpolated distribution of flows,
                             octets and packets.  The distribution is done
                             across the start and end time of the flow.

first                        First packet of flow distribution.

last                         Last packet of flow distribution.

duration                     Duration of flow distribution.

ip-source-address/source-tag
                             IP Source Address and
                             Source tag.

ip-source-address/destination-tag
                             IP Source Address and
                             Destination tag.

ip-destination-address/source-tag
                             IP Destination Address and
                             Source tag.

ip-destination-address/destination-tag
                             IP Destination Address and
                             Destination tag.

ip-source/destination-address/source/destination-tag
                             IP Source/Destination Address and
                             Source/Destination tag.

ip-source/destination-address/ip-protocol/ip-tos
                             IP Source/Destination Address, IP Protocol,
                             and ToS.

ip-source/destination-address/ip-protocol/ip-tos/ip-source/destination-port
                             IP Source/Destination Addess, IP Protocol,
                             IP Tos, IP Source/Destination Port.&#13;</PRE
></P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN38"
></A
><H2
>OPTIONS</H2
><P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
>-d<TT
CLASS="REPLACEABLE"
><I
> debug_level</I
></TT
></DT
><DD
><P
>Enable debugging.</P
></DD
><DT
>-s<TT
CLASS="REPLACEABLE"
><I
> stat_fname</I
></TT
></DT
><DD
><P
>Report configuration filename.  Defaults to <TT
CLASS="FILENAME"
>@localstatedir@/cfg/stat</TT
>.</P
></DD
><DT
>-S<TT
CLASS="REPLACEABLE"
><I
> stat_definition</I
></TT
></DT
><DD
><P
>Select the active definition.</P
></DD
><DT
>-v<TT
CLASS="REPLACEABLE"
><I
> variable binding</I
></TT
></DT
><DD
><P
>Set a variable FOO=bar.</P
></DD
><DT
>-h</DT
><DD
><P
>Display help.</P
></DD
></DL
></DIV
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN66"
></A
><H2
>EXAMPLES</H2
><DIV
CLASS="INFORMALEXAMPLE"
><A
NAME="AEN68"
></A
><P
></P
><P
>An example of report configuration file
<PRE
CLASS="SCREEN"
># stat config file

include-filter /tmp/filter

stat-report t1
  type summary-detail
  filter default
  scale 100 
  output
    format ascii
    options +header,+xheader,+totals
    fields +other
    path /tmp/output1

stat-report t6
  type ip-source-port  
  output
    format ascii
    options +header,+xheader,+totals,+names,+percent-total
    sort +pps
    tally 5
    path /tmp/output6

stat-definition test
  filter tcp
  report t1
  report t6</PRE
>
<PRE
CLASS="SCREEN"
># filter config file

filter-primitive TCP
  type ip-protocol
  permit TCP

filter-definition tcp
  match ip-protocol TCP</PRE
>

<B
CLASS="COMMAND"
>flow-cat <TT
CLASS="FILENAME"
>flows</TT
> | flow-report -stest -Stest</B
>&#13;</P
><P
></P
></DIV
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN74"
></A
><H2
>IMPLEMENTATION NOTES</H2
><P
>Packet size calculations are dOctets / dPkts, ie an average packet size.  It
is not possible to get a true packet size from flow exports.

pps and bps calculations are an average of the averages.

Flows that do not have a duration (start == end) are not counted in the
pps and bps calculations.

Flows without a packet or octet count are ignored.&#13;</P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN77"
></A
><H2
>FILES</H2
><P
>Symbols are located in <TT
CLASS="FILENAME"
>@localstatedir@/sym/*</TT
></P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN81"
></A
><H2
>BUGS</H2
><P
>None known.</P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN84"
></A
><H2
>AUTHOR</H2
><P
>Mark Fullmer
<TT
CLASS="EMAIL"
>&#60;<A
HREF="mailto:[e-mail]"
>[e-mail]</A
>&#62;</TT
></P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN91"
></A
><H2
>SEE ALSO</H2
><P
><SPAN
CLASS="APPLICATION"
>flow-tools</SPAN
>(1)</P
></DIV
></BODY
></HTML
>