FLOW-STAT(1)

💖 FLOW-STAT — the flow-stat(1) page, but make it cute 💖

okay bestie, pull up a chair 🪑✨ this is flow-stat from section 1 of the manual, and she is literally the girl who turns your boring flow data into a whole report. no cap.

---

🌸 NAME 🌸

flow-stat — Generate reports with flow data. that's it, that's the job, and she ate 💅

---

✨ SYNOPSIS ✨

flow-stat [ -hnpPw ]  [ -d debug_level ]  [ -f format ]  [ -S sort_field
]  [ -s sort_field ]  [ -t tally_lines ]  [ -T title ]

like… look at those brackets. so many little optional besties. pick and choose, queen 👑

---

🦋 DESCRIPTION 🦋

The flow-stat utility generates usage reports for flow data sets. and when I say reports I mean it — she will report on you by IP address, IP address pairs, ports, packets, bytes, interfaces, next hops, autonomous systems, ToS bits, exporters, and tags. the range?? unmatched. she's giving main character energy in every single category fr fr 😭💖

---

🎀 OPTIONS 🎀

• -d debug_level — Enable debugging. turn the lights on, bestie 🔦
• -f format — Report format. Choose from the following, and yes there are THIRTY-TWO of them, we are not skipping a single one, periodt:
  • 0 — Overall Summary
  • 1 — Average packet size distribution
  • 2 — Packets per flow distribution
  • 3 — Octets per flow distribution
  • 4 — Bandwidth per flow distribution
  • 5 — UDP/TCP destination port
  • 6 — UDP/TCP source port
  • 7 — UDP/TCP port
  • 8 — Destination IP
  • 9 — Source IP
  • 10 — Source/Destination IP
  • 11 — Source or Destination IP
  • 12 — IP protocol
  • 13 — octets for flow duration plot data
  • 14 — packets for flow duration plot data
  • 15 — short summary
  • 16 — IP Next Hop
  • 17 — Input interface
  • 18 — Output interface
  • 19 — Source AS
  • 20 — Destination AS
  • 21 — Source/Destination AS
  • 22 — IP ToS
  • 23 — Input/Output Interface
  • 24 — Source Prefix
  • 25 — Destination Prefix
  • 26 — Source/Destination Prefix
  • 27 — Exporter IP
  • 28 — Engine Id
  • 29 — Engine Type
  • 30 — Source Tag
  • 31 — Destination Tag
  • 32 — Source/Destination Tag
• -h — Display help. she'll explain herself, iconically 💁♀️
• -n — Use symbolic names where appropriate. names > numbers, it's giving ✨aesthetic✨
• -p — Display header information. show me the receipts 📋
• -P — Report as percent total. math but make it cute 🧮💅
• -s sort_field — Sort ascending on field sort_field. smallest to biggest, humble and organized 🍓
• -S sort_field — Sort descending on field sort_field. biggest to smallest, main character first 👑
• -t tally_lines — Tally totals every tally_lines lines. lil running count moment 🧚
• -T title — Set report title to title. name your child, you're the parent now 🎀
• -w — Wide output. she's spreading out, taking up space, as she should 🌈

---

💜 EXAMPLES 💜

Provide a report on top source/destination IP pairs sorted by octets, report in percent total form for the flows in /flows/krc4. Use the preload option to flow-cat to preserve meta information and display it with flow-stat.

flow-cat -p /flows/krc4 | flow-stat -f10 -P -p -S4

---

🔥 EXAMPLES 🔥

Many times a campus network will have a single border router which has one interface pointing to the internal side and many interfaces pointing to other providers. These interfaces each have a unique numerical id known in SNMP terms as an ifIndex. The ifIndex to interface name mappings can be determined by using a tool such as snmpwalk or using show commands in recent versions of IOS with the 'show snmp mib ifmib ifindex' or JunOS 'show interfaces'. Once the ifIndex for each interface is known flow-filter can be combined with flow-stat to provide reports such as inbound vs outbound top src/destination IP addresses. Provide a top source IP address report by outbound traffic, ie the top senders of traffic on the campus network. Assume the ifIndex of the campus interface is 5.

flow-cat -p /flows/krc4 | flow-filter -i5 | flow-stat -f9 -P -p -S3

like yes bestie, we're doing campus networking now, keep up 🌸

---

🫶 EXAMPLES 🫶

Provide a top destination IP address report by outbound traffic, ie the top sinks of traffic on the campus network. Assume the ifIndex of the campus interface is 5.

flow-cat -p /flows/krc4 | flow-filter -I5 | flow-stat -f8 -P -p -S3

(sinks >>> senders, both valid, no judgement 💖)

---

⭐ EXAMPLES ⭐

Provide a top source/destination AS report. Use symbolic names.

flow-cat -p /flows/krc4 | flow-stat -f20 -n -P -p -S4

---

😭 BUGS 😭

None known. not a single one. she's flawless, we don't know her 💀✨

---

💅 AUTHOR 💅

Mark Fullmer <maf@splintered.net>

---

🦋 SEE ALSO 🦋

flow-tools(1)

---

k that's the whole page bestie, every flag accounted for, nothing dropped, we do not skip content in this house 🏠💖

---

okay and for the lil sign-off moment: this whole thing is the flow-stat(1) manual page, dated 26 Август 2010 — yes the date is in Russian, and yes she still ate. go generate some reports, queen 👑🌈💖