flow-cat(1)

1FLOW-CAT(1)                                                        FLOW-CAT(1)
2
3
4

NAME

6       flow-cat - Concatenate flow files
7

SYNOPSIS

9       flow-cat  [  -aghmp  ]   [  -b  big|little  ]   [  -C  comment  ]  [ -d
10       debug_level ]  [ -o filename ]  [ -t start_time ]  [ -T start_time ]  [
11       -z z_level ]  [ file|directory... ]
12

DESCRIPTION

14       The flow-cat utility processes files and/or directories of files in the
15       flow-tools format. The resulting concatenated data set  is  written  to
16       the  standard  output or file specified by -o. If file is a single dash
17       (`-') or absent, flow-cat will read from the standard input.
18

OPTIONS

20       -a     Do not ignore filenames that begin with tmp.
21
22       -b big|little
23              Byte order of output.
24
25       -C Comment
26              Add a comment.
27
28       -d debug_level
29              Enable debugging.
30
31       -g     Sort file list by capture start time before processing.
32
33       -h     Display help.
34
35       -m     Disable the use of mmap().
36
37       -p     Preload headers. Use to preserve meta information such  as  lost
38              flows.
39
40       -o file
41              Write to file instead of the standard out.
42
43       -t start_time
44              Select flow files up to start_time. If used with -T select files
45              between start_time and end_time.
46
47       -T end_time
48              Select flow files after end_time. If used with -t  select  files
49              between start_time and end_time.
50
51       -z z_level
52              Configure  compression level to  z_level. 0 is disabled (no com‐
53              pression), 9 is highest compression.
54
55       file|directory...
56              Process the files and/or directory.
57

TIME/DATE PARSING

59       start_time and end_time parsing is implemented with getdate.y,  a  com‐
60       monly  used  function  to  process  free-form time date specifications.
61       Example usage borrowed from cvs: 1 month ago 2 hours ago 400000 seconds
62       ago  last  year  last Monday yesterday a fortnight ago 3/31/92 10:00:07
63       PST January 23, 1987 10:05pm 22:00 GMT
64

EXAMPLES

66       Concatenate all flow files begining with ft-v05.2001-05.01,  use  flow-
67       print to display the results.
68
69       flow-cat ft-v05.2001-05-01.* | flow-print
70
71       Concatenate  flow  files in /flows/krc4, store store the output in com‐
72       pressed.flows at compression level 9 (best). The headers are  preloaded
73       so  various  metadata  such as the flow count is correct in the result.
74       Filenames begining with tmp which are typically in-progress flow  files
75       from flow-capture are not processed.
76
77       flow-cat -p -z9 /flows/krc4 > compressed.flows
78

BUGS

80       None known.
81

AUTHOR

83       Mark Fullmer <maf@splintered.net>
84