FLOW-FILTER(1)

💅 FLOW-FILTER, bestie 💅

okay so real talk: this is the manpage for flow-filter(1), and it is exactly the little gremlin you want when you've got a big pile of flows and you're like "no, not those ones, only the cute ones." Filtering flows, that's the whole gig. Let's get into it 🦋

---

✨ SYNOPSIS ✨

flow-filter [ -hko ] [ -a src_as_filter ] [ -A dst_as_filter ] [ -b big|little ] [ -C comment ] [ -D dstaddr_filter_name ] [ -d debug_level ] [ -e exaddr_filter ] [ -f acl_fname ] [ -i input_filter ] [ -I output_filter ] [ -p srcport_filter ] [ -P dstport_filter ] [ -r ipprot_filter ] [ -S srcaddr_filter_name ] [ -t tos_filter ] [ -T tcp_flags_filter ] [ -x nexthop_filter_name ] [ -z z_level ]

---

🌸 DESCRIPTION 🌸

so flow-filter is the utility that filters flows based on criteria you pick. main character energy, you choose. 💖

the IP address filters live in flow.acl, or in whatever filename you point at with -f.

other filters, like input interface and ports, you just define right there on the command line. and here's the fun part: those filters accept range and negation operators. like:

• -i1-15 → input interfaces 1 through 15
• -i1,15 → input interfaces 1 and 15
• !1,15 → NOT input interfaces 1 and 15

ngl the syntax is kludgy and honestly needs reworked, but it works for most applications. it's giving "we'll fix it later" and later never came 😭 periodt.

---

🎀 OPTIONS 🎀

• -a src_as_filter — source AS filter. like -a159 to permit Autonomous System 159.
• -A dst_as_filter — destination AS filter. like -A159,3112 to permit Autonomous Systems 159 and 3112.
• -b big|little — byte order of the output.
• -C Comment — add a comment. lil note for the girlies 📝
• -d debug_level — turn on debugging.
• -D dstaddr_filter_name — destination IP address filter. this is the name or number of a standard access list defined in flow.acl or in the file you gave to -f.
• -e exaddr_filter — exporter IP address filter. one exporter address can be filtered. just the one, bestie.
• -f acl_fname — access list filename. defaults to flow.acl.
• -h — display help. your little rescue button 🫶
• -i input_filter — input interface filter. like -i0 to permit traffic from interface 0.
• -k — keep time from input.
• -I output_filter — output interface filter. like -I0 to permit traffic to interface 0.
• -o — logical OR instead of AND filters. switch the vibe from "all of these" to "any of these."
• -p srcport_filter — source port filter. like -p80 to only permit source port 80.
• -P dstport_filter — destination port filter. like -P80,8080 to permit destination ports 80 and 8080.
• -r ipprot_filter — IP Protocol filter. like -r6 to only permit TCP traffic.
• -S srcaddr_filter_name — source IP address filter. this is the name or number of a standard access list defined in flow.acl or in the file you gave to -f.
• -t tos_filter — ToS bits filter. there's an optional mask you can use, and it gets applied to the tos field before comparing to the filter list. example: to match a tos bit pattern of 101xxxxx, use 0xA0/0xE0.
• -T tcp_flags_filter — TCP bits filter. again, optional mask, applied to the TCP flags field before comparing to the filter list. example: to match flows with the SYN bit set, use 0x2/0x2.
• -x nexthop_filter_name — NextHop IP address filter. this is the name or number of a standard access list defined in flow.acl or in the file you gave to -f.
• -z z_level — configure compression level to z_level. 0 is disabled (no compression), 9 is highest compression. glow-up for your file sizes 🔥

---

🌈 EXAMPLES 🌈

print all traffic with a destination port of 80.

flow-cat /flows/krc4 | flow-filter -P80 | flow-print

print all traffic with with source IP 10.0.0.1. (yes the original says "with with", we're keeping the lore, no cap 😭) populate flow.acl with:

ip access-list standard badguy permit host 10.0.0.1

then:

flow-cat /flows/krc4 | flow-filter -Sbadguy | flow-print

report all destinations that IP 10.0.0.1 has sent traffic to. sort by octets. populate flow.acl with:

ip access-list standard badguy permit host 10.0.0.1

then:

flow-cat /flows/krc4 | flow-filter -Sbadguy | flow-stat -f8 -S2

---

💀 BUGS 💀

• extended access lists are not fully implemented. not me finding the unfinished part 🙈
• the command line filter syntax is a kludge. (we said it, they said it, everybody knows 💀)

---

👑 NOTES 👑

use flow-nfilter. that's it, that's the note. the older sibling said what it said 💅

---

🫶 AUTHOR 🫶

Mark Fullmer <maf@splintered.net>

---

🔥 SEE ALSO 🔥

flow-tools(1)

---

and that's the whole page, bestie ✨ this lil icon was dated 26 Август 2010 (that's August 26, 2010, and yes it's serving multilingual queen energy 🌍) — it shipped as part of the flow-tools collection, and honestly? still iconic. go filter something. slay 💖🎀🦋