FLOW-FANOUT(1)

🌸 FLOW-FANOUT 💅

okay bestie, gather round, because this is the flow-fanout manual page and it's literally the group-chat relay of the Unix networking world. she's a flow-tools girlie and her whole personality is: take flows, copy them, send them everywhere. fanout (replicate) flow exports to many destinations. no cap.

---

✨ SYNOPSIS ✨

flow-fanout [ -h ]  [ -A AS0_substitution ]  [ -d debug_level ]  [ -f
filter_fname ]  [ -F filter_definition ]  [ -m privacy_mask ]  [ -p
pidfile ]  [ -s ]  [ -S stat_interval ]  [ -V pdu_version ]  [ -x
xmit_delay ]  localip/remoteip/port localip/remoteip/port...

---

🦋 DESCRIPTION 🦋

so the tea is this: the flow-fanout utility will replicate flows arriving on localip/remoteip/port to destination(s) specified by localip/remoteip/port. that's it, that's the whole job. she's a copy-paste queen and she ate. 💅

flows processed by multiple exporters will be mixed into a single output stream. this functionality appeared to support Cisco Catalyst exports and may have other uses. (iykyk. she's versatile. she contains multitudes. 🎀)

heads up bestie: a SIGQUIT or SIGTERM signal will cause flow-fanout to exit. so like… be nice to her. 😭

---

💖 OPTIONS 💖

• -A AS0_substitution — Cisco's NetFlow exports represent the local autonomous system as 0 instead of the real value. this option can be used to replace the 0 in the export with the a configured value. unfortunately under certain configurations AS 0 can also represent a cache miss or non forwarded traffic so use with caution. not me being honest about the vibes. 🙈
• -d debug_level — Enable debugging. spill the diagnostics, girl. 🔍
• -f filter_fname — Filter list filename. Defaults to /etc/flow-tools/cfg/filter. she lives there fr fr.
• -F filter_definition — Select the active definition. Defaults to default. the default default. iconic.
• -h — Display help. when in doubt, ask her. 🫶
• -m privacy_mask — Apply privacy_mask to the source and destination IP address of flows. For example a privacy_mask of 255.255.255.0 would convert flows with source/destination IP addresses 10.1.1.1 and 10.2.2.2 to 10.1.1.0 and 10.2.2.0 respectively. blur the last octet, protect the girlies. 🕶️
• -p pidfile — Configure the process ID file. Use - to disable pid file creation. no pid, no problem.
• -s — Spoof the source IP address. If the IP address is 0 then it is replaced with the exporter source IP. she's wearing a little disguise ✨
• -S stat_interval — When configured flow-fanout will emit a timestamped message on stderr every stat_interval minutes indicating counters such as the number of flows received, packets processed, and lost flows. progress updates, because we love a check-in. 📊
• -V pdu_version — Use pdu_version format output. the whole menu, bestie:
  • 1 — NetFlow version 1 (No sequence numbers, AS, or mask)
  • 5 — NetFlow version 5
  • 6 — NetFlow version 6 (5+ Encapsulation size)
  • 7 — NetFlow version 7 (Catalyst switches)
  • 8.1 — NetFlow AS Aggregation
  • 8.2 — NetFlow Proto Port Aggregation
  • 8.3 — NetFlow Source Prefix Aggregation
  • 8.4 — NetFlow Destination Prefix Aggregation
  • 8.5 — NetFlow Prefix Aggregation
  • 8.6 — NetFlow Destination (Catalyst switches)
  • 8.7 — NetFlow Source Destination (Catalyst switches)
  • 8.8 — NetFlow Full Flow (Catalyst switches)
  • 8.9 — NetFlow ToS AS Aggregation
  • 8.10 — NetFlow ToS Proto Port Aggregation
  • 8.11 — NetFlow ToS Source Prefix Aggregation
  • 8.12 — NetFlow ToS Destination Prefix Aggregation
  • 8.13 — NetFlow ToS Prefix Aggregation
  • 8.14 — NetFlow ToS Prefix Port Aggregation
  • 1005 — Flow-Tools tagged version 5
• -x xmit_delay — Configure a microsecond transmit delay between packets. This may be necessary in some configurations to prevent a transmit buffer overrun. she's pacing herself. self-care. 🧚

---

🌈 EXAMPLES 🌈

Replicate flows arriving to local IP address 10.0.0.1 from the router exporting with IP address 10.1.1.1 on port 9500 to localhost port 9500 and 10.5.5.5 port 9200. The exports sent to 10.5.5.5 will be sent with a source IP address of 10.0.0.5 which must be a valid local IP address.

flow-fanout 10.0.0.1/10.1.1.1/9500 0/0/9500 10.0.0.5/10.5.5.5/9200

look at her go. one command, two destinations, zero drama. 🫶

---

💀 BUGS 💀

NetFlow exports do not contain the exporter IP address inside the payload so the original exporter IP address (typically a router) will be lost when using flow-fanout. A work around for this protocol limitation is to use local IP aliases and the localip option. When the spoofing option is used multiple exporters with different IP addresses will share the same sequence number but will have the original source IP. Fixing this requires per source : destination sequence number mapping. It is much easier to just use multiple instances of flow-fanout running on different ports. (aka: when in doubt, run more of her. she's happy to clone herself. 👑)

---

👑 AUTHOR 👑

Mark Fullmer <maf@splintered.net>

---

🎀 SEE ALSO 🎀

flow-tools(1)

---

okay that's the whole page, bestie, you're officially fluent. this lil legend is from flow-tools and the version on the tin is dated 26 Август 2010 (that's the day she dropped, and honestly she still eats). mwah, go replicate responsibly. 💖✨🦋🌸🎀