1FLOW-FANOUT(1) FLOW-FANOUT(1)
2
6 flow-fanout - Fanout (replicate) flow exports to many destinations.
7
9 flow-fanout [ -h ] [ -A AS0_substitution ] [ -d debug_level ] [ -f
10 filter_fname ] [ -F filter_definition ] [ -m privacy_mask ] [ -p
11 pidfile ] [ -s ] [ -S stat_interval ] [ -V pdu_version ] [ -x
12 xmit_delay ] localip/remoteip/port localip/remoteip/port...
13
15 The flow-fanout utility will replicate flows arriving on
16 localip/remoteip/port to destination(s) specified by
17 localip/remoteip/port.
18 Flows processed by multiple exporters will be mixed into a single out‐
20 put stream. This functionality appeared to support Cisco Catalyst
21 exports and may have other uses.
22 A SIGQUIT or SIGTERM signal will cause flow-fanout to exit.
24
26 -A AS0_substitution
27 Cisco's NetFlow exports represent the local autonomous system as
28 0 instead of the real value. This option can be used to replace
29 the 0 in the export with the a configured value. Unfortunately
30 under certain configurations AS 0 can also represent a cache
31 miss or non forwarded traffic so use with caution.
32 -d debug_level
34 Enable debugging.
35 -f filter_fname
37 Filter list filename. Defaults to /etc/flow-tools/cfg/filter.
38 -F filter_definition
40 Select the active definition. Defaults to default.
41 -h Display help.
43 -m privacy_mask
45 Apply privacy_mask to the source and destination IP address of
46 flows. For example a privacy_mask of 255.255.255.0 would convert
47 flows with source/destination IP addresses 10.1.1.1 and 10.2.2.2
48 to 10.1.1.0 and 10.2.2.0 respectively.
49 -p pidfile
51 Configure the process ID file. Use - to disable pid file cre‐
52 ation.
53 -s Spoof the source IP address. If the IP address is 0 then it is
55 replaced with the exporter source IP.
56 -S stat_interval
58 When configured flow-fanout will emit a timestamped message on
59 stderr every stat_interval minutes indicating counters such as
60 the number of flows received, packets processed, and lost flows.
61 -V pdu_version
63 Use pdu_version format output.
64 1 NetFlow version 1 (No sequence numbers, AS, or mask)
66 5 NetFlow version 5
67 6 NetFlow version 6 (5+ Encapsulation size)
68 7 NetFlow version 7 (Catalyst switches)
69 8.1 NetFlow AS Aggregation
70 8.2 NetFlow Proto Port Aggregation
71 8.3 NetFlow Source Prefix Aggregation
72 8.4 NetFlow Destination Prefix Aggregation
73 8.5 NetFlow Prefix Aggregation
74 8.6 NetFlow Destination (Catalyst switches)
75 8.7 NetFlow Source Destination (Catalyst switches)
76 8.8 NetFlow Full Flow (Catalyst switches)
77 8.9 NetFlow ToS AS Aggregation
78 8.10 NetFlow ToS Proto Port Aggregation
79 8.11 NetFlow ToS Source Prefix Aggregation
80 8.12 NetFlow ToS Destination Prefix Aggregation
81 8.13 NetFlow ToS Prefix Aggregation
82 8.14 NetFlow ToS Prefix Port Aggregation
83 1005 Flow-Tools tagged version 5
84 -x xmit_delay
87 Configure a microsecond transmit delay between packets. This may
88 be necessary in some configurations to prevent a transmit buffer
89 overrun.
90
92 Replicate flows arriving to local IP address 10.0.0.1 from the router
93 exporting with IP address 10.1.1.1 on port 9500 to localhost port 9500
94 and 10.5.5.5 port 9200. The exports sent to 10.5.5.5 will be sent with
95 a source IP address of 10.0.0.5 which must be a valid local IP address.
96 flow-fanout 10.0.0.1/10.1.1.1/9500 0/0/9500 10.0.0.5/10.5.5.5/9200
98
100 NetFlow exports do not contain the exporter IP address inside the pay‐
101 load so the original exporter IP address (typically a router) will be
102 lost when using flow-fanout. A work around for this protocol limitation
103 is to use local IP aliases and the localip option. When the spoofing
104 option is used multiple exporters with different IP addresses will
105 share the same sequence number but will have the original source IP.
106 Fixing this requires per source : destination sequence number mapping.
107 It is much easier to just use multiple instances of flow-fanout running
108 on different ports.
109
111 Mark Fullmer <maf@splintered.net>
112
114 flow-tools(1)
115 11 Февраль 2009 FLOW-FANOUT(1)