flow-fanout(1)

1FLOW-FANOUT(1)                                                  FLOW-FANOUT(1)
2
3
4

NAME

6       flow-fanout - Fanout (replicate) flow exports to many destinations.
7

SYNOPSIS

9       flow-fanout  [  -h ]  [ -A AS0_substitution ]  [ -d debug_level ]  [ -f
10       filter_fname ]  [ -F filter_definition ]  [ -m  privacy_mask  ]   [  -p
11       pidfile  ]   [  -s  ]   [  -S stat_interval ]  [ -V pdu_version ]  [ -x
12       xmit_delay ]  localip/remoteip/port localip/remoteip/port...
13

DESCRIPTION

15       The   flow-fanout   utility   will   replicate   flows   arriving    on
16       localip/remoteip/port      to      destination(s)      specified     by
17       localip/remoteip/port.
18
19       Flows processed by multiple exporters will be mixed into a single  out‐
20       put  stream.  This  functionality  appeared  to  support Cisco Catalyst
21       exports and may have other uses.
22
23       A SIGQUIT or SIGTERM signal will cause flow-fanout to exit.
24

OPTIONS

26       -A AS0_substitution
27              Cisco's NetFlow exports represent the local autonomous system as
28              0  instead of the real value. This option can be used to replace
29              the 0 in the export with the a configured  value.  Unfortunately
30              under  certain  configurations  AS  0 can also represent a cache
31              miss or non forwarded traffic so use with caution.
32
33       -d debug_level
34              Enable debugging.
35
36       -f filter_fname
37              Filter list filename. Defaults to /etc/flow-tools/cfg/filter.
38
39       -F filter_definition
40              Select the active definition. Defaults to default.
41
42       -h     Display help.
43
44       -m privacy_mask
45              Apply privacy_mask to the source and destination IP  address  of
46              flows. For example a privacy_mask of 255.255.255.0 would convert
47              flows with source/destination IP addresses 10.1.1.1 and 10.2.2.2
48              to 10.1.1.0 and 10.2.2.0 respectively.
49
50       -p pidfile
51              Configure  the  process  ID file. Use - to disable pid file cre‐
52              ation.
53
54       -s     Spoof the source IP address. If the IP address is 0 then  it  is
55              replaced with the exporter source IP.
56
57       -S stat_interval
58              When  configured  flow-fanout will emit a timestamped message on
59              stderr every stat_interval minutes indicating counters  such  as
60              the number of flows received, packets processed, and lost flows.
61
62       -V pdu_version
63              Use pdu_version format output.
64
65                  1    NetFlow version 1 (No sequence numbers, AS, or mask)
66                  5    NetFlow version 5
67                  6    NetFlow version 6 (5+ Encapsulation size)
68                  7    NetFlow version 7 (Catalyst switches)
69                  8.1  NetFlow AS Aggregation
70                  8.2  NetFlow Proto Port Aggregation
71                  8.3  NetFlow Source Prefix Aggregation
72                  8.4  NetFlow Destination Prefix Aggregation
73                  8.5  NetFlow Prefix Aggregation
74                  8.6  NetFlow Destination (Catalyst switches)
75                  8.7  NetFlow Source Destination (Catalyst switches)
76                  8.8  NetFlow Full Flow (Catalyst switches)
77                  8.9  NetFlow ToS AS Aggregation
78                  8.10 NetFlow ToS Proto Port Aggregation
79                  8.11 NetFlow ToS Source Prefix Aggregation
80                  8.12 NetFlow ToS Destination Prefix Aggregation
81                  8.13 NetFlow ToS Prefix Aggregation
82                  8.14 NetFlow ToS Prefix Port Aggregation
83                  1005 Flow-Tools tagged version 5
84
85
86       -x xmit_delay
87              Configure a microsecond transmit delay between packets. This may
88              be necessary in some configurations to prevent a transmit buffer
89              overrun.
90

EXAMPLES

92       Replicate  flows  arriving to local IP address 10.0.0.1 from the router
93       exporting with IP address 10.1.1.1 on port 9500 to localhost port  9500
94       and  10.5.5.5 port 9200. The exports sent to 10.5.5.5 will be sent with
95       a source IP address of 10.0.0.5 which must be a valid local IP address.
96
97       flow-fanout 10.0.0.1/10.1.1.1/9500 0/0/9500 10.0.0.5/10.5.5.5/9200
98

BUGS

100       NetFlow exports do not contain the exporter IP address inside the  pay‐
101       load  so  the original exporter IP address (typically a router) will be
102       lost when using flow-fanout. A work around for this protocol limitation
103       is  to  use local IP aliases and the localip option.  When the spoofing
104       option is used multiple exporters  with  different  IP  addresses  will
105       share  the  same  sequence number but will have the original source IP.
106       Fixing this requires per source : destination sequence number  mapping.
107       It is much easier to just use multiple instances of flow-fanout running
108       on different ports.
109

AUTHOR

111       Mark Fullmer <maf@splintered.net>
112