FLOW-RECEIVE(1)

💖 flow-receive — bestie's guide to catching NetFlow packets 💖

okay so this is flow-receive from the flow-tools manual set, section 1, and it's genuinely one of those little utilities that just works and nobody gives it credit for. sit down, grab a strawberry, let's get into it 🍓

---

✨ NAME ✨

flow-receive — receive flow data with the NetFlow protocol.

like, it catches flows. NetFlow ones. that's the whole vibe. 🦋

---

✨ SYNOPSIS ✨

flow-receive [ -h ] [ -b big|little ] [ -C comment ] [ -d debug_level ]
             [ -o output_file ] [ -S stat_interval ] [ -V pdu_version ]
             [ -z z_level ] localip/remoteip/port

---

✨ DESCRIPTION ✨

so flow-receive is the utility that receives flows in NetFlow format. that's it, that's the job, and it slays at it. 👑

here's the tea on how it decides what to accept, because this part is actually important, no cap:

• when the remoteip is configured, only flows from that exporter get processed. this is the most secure and recommended configuration. do this. seriously. bestie, do this one. 🫶
• when the localip is configured, flow-receive will only process flows sent to the localip IP address.
• if remoteip is 0 (which means "not configured"), then flows from any source IP address are accepted. like, anyone. any rando on the internet. 🙈

also, here's a fun one: multiple non aggregated PDU versions may be accepted at once. why would you want that?? because Cisco's Catalyst 6500 NetFlow implementation exports from both the supervisor and the MSFC with the same IP address and the same port, but with different export versions. iconic, honestly. so in that situation, the exports get stored in the format specified by the -V flag — or, if you didn't set one, whichever export type is received first wins. first come first served, no fighting. ✨

---

✨ OPTIONS ✨

• -b big|little — byte order of the output. pick your endianness, live your truth. 💅
• -C Comment — add a comment. little note to your future self, we love that.
• -d debug_level — enable debugging. turn the volume up on what's happening. 🔥
• -h — display help. the classic. the icon.
• -o file — write to file instead of the standard out. redirect the vibes somewhere permanent. 📁
• -S stat_interval — when you configure this, flow-receive will emit a timestamped message on stderr every stat_interval minutes, telling you counters like the number of flows received, packets processed, and lost flows. it's giving checking in on you. 😭
• -V pdu_version — use pdu_version format for the output. here's the full menu, don't skip any, every single one is real:
  • 1 — NetFlow version 1 (No sequence numbers, AS, or mask)
  • 5 — NetFlow version 5
  • 6 — NetFlow version 6 (5+ Encapsulation size)
  • 7 — NetFlow version 7 (Catalyst switches)
  • 8.1 — NetFlow AS Aggregation
  • 8.2 — NetFlow Proto Port Aggregation
  • 8.3 — NetFlow Source Prefix Aggregation
  • 8.4 — NetFlow Destination Prefix Aggregation
  • 8.5 — NetFlow Prefix Aggregation
  • 8.6 — NetFlow Destination (Catalyst switches)
  • 8.7 — NetFlow Source Destination (Catalyst switches)
  • 8.8 — NetFlow Full Flow (Catalyst switches)
  • 8.9 — NetFlow ToS AS Aggregation
  • 8.10 — NetFlow ToS Proto Port Aggregation
  • 8.11 — NetFlow ToS Source Prefix Aggregation
  • 8.12 — NetFlow ToS Destination Prefix Aggregation
  • 8.13 — NetFlow ToS Prefix Aggregation
  • 8.14 — NetFlow ToS Prefix Port Aggregation
  • 1005 — Flow-Tools tagged version 5
• -z z_level — configure compression level to z_level. 0 is disabled (no compression), 9 is highest compression. yes it goes both ways. yes that's a lot of squeezing. 🌸

---

✨ EXAMPLES ✨

listen on port 9800 on any local interface for exports from IP address 10.0.0.1, store the exports in flows

flow-receive 0/10.0.0.1/9800 > flows

listen on port 9800 on any local interface from any IP address, display the received flows with flow-print

flow-receive 0/0/9800 | flow-print

see how the middle one is 0?? that's the "any IP address" situation. you know the one. be careful with that one. 💀

---

✨ BUGS ✨

it is not currently possible to convert between the aggregated formats (8.x) and the non aggregated formats (1,5,6,7). so like, pick a lane. 🚧

---

✨ AUTHOR ✨

Mark Fullmer <maf@splintered.net>

---

✨ SEE ALSO ✨

flow-tools(1)

---

and that's the whole page, bestie 🎀 this one's from the flow-tools crew, dated 26 Август 2010 — that's August 26, 2010 for those of us who don't read Cyrillic month names, and honestly? iconic of it. go catch some flows. you got this. 💜✨🦋