FLOW-TOOLS(1)

🌸 NAME 🌸

flow-tools — bestie, it's the tool set for working with NetFlow data. that's the whole thing. 💅

---

✨ DESCRIPTION ✨

okay so. flow-tools is literally a library and a whole collection of programs used to collect, send, process, and generate reports from NetFlow data. You can run all the tools together on a single server, or spread them across multiple servers when your deployment is giving large scale. The flow-tools library hands you an API so you can build your own custom applications for NetFlow export versions 1, 5, 6, and the 14 version 8 subversions that are currently defined. A Perl interface and a Python interface have been contributed by other people and are included in the distribution. community slay 🫶

Flow data gets collected and stored in host byte order by default, but the files are portable across big and little endian architectures. no cap, your files will travel. ✈️

Commands that use the network use a localip/remoteip/port designation to talk to each other. so:

• localip — the IP address the host will use as a source when sending, or will bind to when receiving NetFlow PDU's (ie the destination address of the exporter). If you configure localip to 0, that forces the kernel to decide what IP address to use for sending, and to listen on all IP addresses for receiving.
• remoteip — the destination IP address used for sending, or the expected address of the source when receiving. If remoteip is 0 then the application will accept flows from any source address. free-for-all energy.
• port — the UDP port number used for sending or receiving.

When you're using multicast addresses, that same localip/remoteip/port triple represents the source, the group, and the port, respectively. iykyk. 🌈

Flows get exported from a router in a number of different configurable versions. A flow is a collection of key fields plus some additional data. The flow key is:

{srcaddr, dstaddr, input, output, srcport, dstport, prot, ToS}

and flow-tools supports one export version per file. periodt.

---

🌟 the export versions, a saga

Export versions 1, 5, 6, and 7 all maintain:

{nexthop, dPkts, dOctets, First, Last, flags}

ie the next-hop IP address, number of packets, number of octets (bytes), start time, end time, and flags such as the TCP header bits.

• Version 5 adds the additional fields {src_as, dst_as, src_mask, dst_mask} — ie source AS, destination AS, source network mask, and destination network mask.
• Version 7, which is specific to the Catalyst switches, adds on top of the version 5 fields {router_sc} — the Router IP address which populates the flow cache shortcut in the Supervisor.
• Version 6, which is not officially supported by Cisco, adds on top of the version 5 fields {in_encaps, out_encaps, peer_nexthop} — ie the input and output interface encapsulation size, and the IP address of the next hop within the peer.
• Version 1 exports do not contain a sequence number and therefore should be avoided 🚩 — although it is safe to store the data as version 1 if the additional fields are not used.

---

💫 version 8 IOS NetFlow

Version 8 IOS NetFlow is a second level flow cache that reduces the data exported from the router. There are currently 11 formats, and all of them provide {dFlows, dOctets, dPkts, First, Last} for the key fields. here's the menu, bestie:

• 8.1 — Source and Destination AS, Input and Output interface
• 8.2 — Protocol and Port
• 8.3 — Source Prefix and Input interface
• 8.4 — Destination Prefix and Output interface
• 8.5 — Source/Destination Prefix and Input/Output interface
• 8.9 — 8.1 + ToS
• 8.10 — 8.2 + ToS
• 8.11 — 8.3 + ToS
• 8.12 — 8.5 + ToS
• 8.13 — 8.2 + ToS
• 8.14 — 8.3 + ports + ToS

---

🦋 version 8 CatIOS NetFlow

Version 8 CatIOS NetFlow appears to be a less fine grained first level flow cache. lowkey simpler, highkey still doing the job:

• 8.6 — Destination IP, ToS, Marked ToS,
• 8.7 — Source/Destination IP, Input/Output interface, ToS, Marked ToS,
• 8.8 — Source/Destination IP, Source/Destination Port, Input/Output interface, ToS, Marked ToS,

---

👑 the programs, aka the whole squad

The following programs are included in the flow-tools distribution. meet the girlies:

• flow-capture — Collect, compress, store, and manage disk space for exported flows from a router.
• flow-cat — Concatenate flow files. Typically flow files will contain a small window of 5 or 15 minutes of exports. flow-cat can be used to append files for generating reports that span longer time periods.
• flow-fanout — Replicate NetFlow datagrams to unicast or multicast destinations. flow-fanout is used to facilitate multiple collectors attached to a single router.
• flow-report — Generate reports for NetFlow data sets. Reports include source/destination IP pairs, source/destination AS, and top talkers. Over 50 reports are currently supported.
• flow-tag — Tag flows based on IP address or AS #. flow-tag is used to group flows by customer network. The tags can later be used with flow-fanout or flow-report to generate customer based traffic reports.
• flow-filter — Filter flows based on any of the export fields. flow-filter is used in-line with other programs to generate reports based on flows matching filter expressions.
• flow-import — Import data from ASCII or cflowd format.
• flow-export — Export data to ASCII or cflowd format.
• flow-send — Send data over the network using the NetFlow protocol.
• flow-receive — Receive exports using the NetFlow protocol without storing to disk like flow-capture.
• flow-gen — Generate test data.
• flow-dscan — Simple tool for detecting some types of network scanning and Denial of Service attacks.
• flow-merge — Merge flow files in chronological order.
• flow-xlate — Perform translations on some flow fields.
• flow-expire — Expire flows using the same policy of flow-capture.
• flow-header — Display meta information in flow file.
• flow-split — Split flow files into smaller files based on size, time, or tags.

---

🎀 AUTHOR 🎀

Mark Fullmer <maf@splintered.net>

flow-merge by Larry Lidz <ellidz@eridu.uchicago.edu>

Patches and other contribitions by a list too long to mention here. 😭 (we see you, anonymous legends)

flow-tools is avalable at <URL:http://www.splintered.net/sw/flow-tools>.

A mailing list is maintained at <flow-tools@splintered.net>

---

💜 SEE ALSO 💜

flow-capture(1) flow-cat(1) flow-dscan(1) flow-expire(1) flow-export(1) flow-fanout(1) flow-filter(1) flow-nfilter(1) flow-gen(1) flow-header(1) flow-import(1) flow-merge(1) flow-print(1) flow-receive(1) flow-report(1) flow-send(1) flow-split(1) flow-stat(1) flow-tag(1) flow-xlate(1)

---

okay that's the whole page bestie, go read the rest of them 💖

this has been FLOW-TOOLS(1), dated 26 Август 2010 — mwah, drink water, and remember: one export version per file. 🍓