1nfreplay(1)                                                        nfreplay(1)
2
3
4

NAME

6       nfreplay - netflow replay program
7

SYNOPSIS

9       nfreplay [options] [filter]
10

DESCRIPTION

12       nfreplay  is  the  netflow  replay  program of the nfdump tool set.  It
13       reads data from files stored by nfcapd and sents the netflow data to  a
14       host or a multicat group. The filter syntax is equivalent to nfdump. If
15       a filter is supplied, only  the  matching  flows  are  sent.   See  the
16       nfdump(1) man page for a detailed description of the filter syntax. All
17       records are sent as netflow version 5.
18
19

OPTIONS

21       -H remotehost
22          Send all flows to this remote host. Accepts a  symbolic  name  or  a
23          IPv4/IPv6 IP address.  Defaults to IPv4 localhost 127.0.0.1.
24
25       -j mcastgroup
26          Join  this  multicast  group  and send all flows to this group host.
27          Accepts a symbolic name or multicast IPv4/IPv6 IP address.
28
29       -p port
30          Send all flows to this port on the remote side. Default is 9995.
31
32       -4 Forces nfreplay to send flows to a IPv4 address only.  Can  be  used
33          together  with  -i  if  the remote host has an IPv4 and IPv6 address
34          record.
35
36       -6 Forces nfreplay to send flows to a IPv6 address only.  Can  be  used
37          together  with  -i  if  the remote host has an IPv4 and IPv6 address
38          record.
39
40       -v num
41          Send flows as netflow version  num.  5  and  9  are  supported.  The
42          default  is  sending  the  flows  as netflow version 5. In version 5
43          mode, IPv6 flows, are skipped and 64bit counters  are  truncated  to
44          32bit.
45
46       -d usec
47          Delay  each  record  by  usec mirco seconds, to avoid overrun on the
48          remote side. Default is 10.
49
50       -b buffersize
51          Set send buffer size in bytes. Useful for large  data  to  transfer.
52          Default is system dependent.
53
54       -r inputfile
55          Read input data from inputfile. Default is read from stdin.
56
57       -t timewin
58          Send  only  flows,  which  fall  in  the  time window timewin, where
59          timewin is YYYY/MM/dd.hh:mm:ss[-YYYY/MM/dd.hh:mm:ss]. Any  parts  of
60          the   time   spec   may   be   omitted  e.g  YYYY/MM/dd  expands  to
61          YYYY/MM/dd.00:00:00-YYYY/MM/dd.23:59:59 and sends all  flow  from  a
62          given day.
63
64       -z num
65          Flows  are  sent with their "real distribution" acrross time (with a
66          speed coefficient) -z 1 : 5 minutes of records will  be  sent  in  5
67          minutes.   -z  20  : 5 minutes of record will be sent in 5/20 = 0.25
68          minutes.
69
70       -c num
71          Limit number of records to send to the first num flows.
72
73       -V Print nfreplay version and exit.
74
75       -h Print help text on stdout with all options and exit.
76

RETURN VALUE

78       Returns
79           0   No error.
80           255 Initialization failed.
81           254 Error in filter syntax.
82           250 Internal error.
83

NOTES

SEE ALSO

86       nfcapd(1), nfdump(1), nfprofile(1)
87

BUGS

89                                  2009-09-09                       nfreplay(1)