2
6 flow-filter — Filter flows.
7
9 flow-filter [-hko] [-a src_as_filter] [-A dst_as_filter] [-b
10 big|little] [-C comment] [-D dstaddr_filter_name] [-d debug_level]
11 [-e exaddr_filter] [-f acl_fname] [-i input_filter] [-I output_fil‐
12 ter] [-p srcport_filter] [-P dstport_filter] [-r ipprot_filter] [-S
13 srcaddr_filter_name] [-t tos_filter] [-T tcp_flags_filter] [-x nex‐
14 thop_filter_name] [-z z_level]
15
17 The flow-filter utility will filter flows based on user selectable cri‐
18 teria. The IP address filters are defined in flow.acl or by the file‐
19 name specified by -f.
20 Other filters such as input interface and ports are defined on the com‐
22 mand line. These filters accept range and negation operators, ie
23 -i1-15 for input interfaces 1 through 15 or -i1,15 for input interfaces
24 1 and 15, or !1,15 for not input interfaces 1 and 15.
25 The syntax is kludgy and needs reworked but works for most applica‐
27 tions.
28
30 -a src_as_filter
31 Source AS filter, ie -a159 to permit Autonomous System 159.
32 -A dst_as_filter
34 Destination AS filter, ie -A159,3112 to permit Autonomous
35 Systems 159 and 3112.
36 -b big|little
38 Byte order of output.
39 -C Comment
41 Add a comment.
42 -d debug_level
44 Enable debugging.
45 -D dstaddr_filter_name
47 Destination IP address filter. This is the name or number of
48 a standard access list defined in flow.acl or the file speci‐
49 fied by -f.
50 -e exaddr_filter
52 Exporter IP address filter. One exporter address can be fil‐
53 tered.
54 -f acl_fname
56 Access list filename. Defaults to flow.acl.
57 -h Display help.
59 -i input_filter
61 Input interface filter, ie -i0 to permit traffic from inter‐
62 face 0.
63 -k Keep time from input.
65 -I output_filter
67 Output interface filter, ie -I0 to permit traffic to inter‐
68 face 0.
69 -o Logical OR instead of AND filters.
71 -p srcport_filter
73 Source port filter, ie -p80 to only permit source port 80.
74 -P dstport_filter
76 Destination port filter, ie -P80,8080 to permit destination
77 ports 80 and 8080.
78 -r ipprot_filter
80 IP Protocol filter, ie -r6 to only permit TCP traffic.
81 -S srcaddr_filter_name
83 Source IP address filter. This is the name or number of a
84 standard access list defined in flow.acl or the file speci‐
85 fied by -f.
86 -t tos_filter
88 ToS bits filter. An optional mask is available which is
89 applied to the tos field before comparing to the filter list.
90 For example to match a tos bit pattern of 101xxxxx use
91 0xA0/0xE0.
92 -T tcp_flags_filter
94 TCP bits filter. An optional mask is available which is
95 applied to the TCP flags field before comparing to the filter
96 list. For example to match a flows with the SYN bit set use
97 0x2/0x2.
98 -x nexthop_filter_name
100 NextHop IP address filter. This is the name or number of a
101 standard access list defined in flow.acl or the file speci‐
102 fied by -f.
103 -z z_level
105 Configure compression level to z_level. 0 is disabled (no
106 compression), 9 is highest compression.
107
109 Print all traffic with a destination port of 80.
110 flow-cat /flows/krc4 | flow-filter -P80 | flow-print
112 Print all traffic with with source IP 10.0.0.1. Populate flow.acl with
114 ip access-list standard badguy permit host 10.0.0.1
115 flow-cat /flows/krc4 | flow-filter -Sbadguy | flow-print
117 Report all destinations that IP 10.0.0.1 has sent traffic to. Sort by
119 octets. Populate flow.acl with
120 ip access-list standard badguy permit host 10.0.0.1
121 flow-cat /flows/krc4 | flow-filter -Sbadguy | flow-stat -f8 -S2
123
125 Extended access lists are not fully implemented. The command line fil‐
126 ter syntax is a kludge.
127
129 Use flow-nfilter.
130
132 Mark Fullmer maf@splintered.net
133
135 flow-tools(1)
136 flow-filter(1)