FLOW-XLATE(1)

💅 FLOW-XLATE(1) — the flow-tools glow-up page

okay bestie, gather round, because this is flow-xlate from flow-tools, manual section 1, and she is that girl. Let's get into it. ✨

---

🌸 NAME 🌸

flow-xlate — Apply translations to selected fields of a flow. no cap, that's the whole gig.

---

🎀 SYNOPSIS 🎀

flow-xlate [ -hkn ]  [ -b big|little ]  [ -C comment ]  [ -d debug_level
]  [ -v variable binding ]  [ -V flow_version ]  [ -x xlate_fname ]  [
-X xlate_definition ]  [ -z z_level ]

---

🦋 DESCRIPTION 🦋

So the flow-xlate utility is used to apply translations to flows. Translations live in a configuration file, and they're made of actions plus a definition that invokes action(s). Definitions are in the form of terms, and each term can have a filter and multiple actions. it's giving modular, honestly.

Words in the configuration file of the form @VAR or @{VAR:default} get expanded at run-time by setting variable names with the -v option. very variable, very slay.

Translation actions begin with the xlate-action keyword followed by a symbolic name. Each action has a type defined below.

Translation definitions begin with the xlate-definition keyword followed by a symbolic name. Each definition is composed of terms which are evaluated in the order of the configuration file. A term may invoke a filter to conditionally invoke an action. periods. 💅

---

✨ Action types and their sub-commands ✨

🧚 Address → network

• ip-source-address-to-network — Zero host bits based on mask.
• ip-destination-address-to-network — Zero host bits based on mask.
  • (no sub-commands) — literally none, she's self-sufficient.

🧚 Address → class network

• ip-source-address-to-class-network — Zero source host bits to match class.
• ip-destination-address-to-class-network — Zero dst host bits to match class.
  • (no sub-commands)

🧚 Anonymize

• ip-source-address-anonymize — Anonymize source address.
• ip-destination-address-anonymize — Anonymize destination address.
• ip-address-anonymize — Anonymize src/dst address.

All three of these share the same sub-commands:

• algorithm — Algorithm. cryptopan-aes128 is currently supported.

algorithm cryptopan-aes128

• key — Key. Key is 128 bits in hex.

key 0123456789ABCDEFG

• key-file — File to load key from. Key is 128 bits in hex.

key-file /mfstmp/secret-key

• key-file-refresh — How often to check the key file. Interval is in minutes, the optional second argument is hour:min:sec to specify the first refresh. This example will load a new key every day at 12:00:00.

14400 12:00:00

🧚 Privacy masks

• ip-address-privacy-mask — Apply a mask to the source and destination address to remove bits.
• ip-port-privacy-mask — Apply a mask to the source and destination port to remove bits.

🧚 tag-mask

• tag-mask — Apply mask to the source and destination tag.
  • mask — Source and Destination mask to apply.

 mask 0xFFFF 0xFFFF

🧚 scale

• scale — Scale packets and bytes.
  • scale — Scale to apply.

 scale 100

🧚 replace AS 0

• replace-source-as0 — Replace source AS 0
• replace-destination-as0 — Replace destination AS 0
  • as — AS replacement value.

 as 3112

---

👑 OPTIONS 👑

• -b big|little — Byte order of output.
• -C Comment — Add a comment.
• -d debug_level — Enable debugging.
• -h — Display help.
• -k — Keep time from input.
• -n — Don't load configuration file. Useful only with -V
• -v variable binding — Set a variable FOO=bar.
• -V pdu_version — Use pdu_version format output. the roster:
  1. 1 — NetFlow version 1 (No sequence numbers, AS, or mask)
  2. 5 — NetFlow version 5
  3. 6 — NetFlow version 6 (5+ Encapsulation size)
  4. 7 — NetFlow version 7 (Catalyst switches)
  5. 8.1 — NetFlow AS Aggregation
  6. 8.2 — NetFlow Proto Port Aggregation
  7. 8.3 — NetFlow Source Prefix Aggregation
  8. 8.4 — NetFlow Destination Prefix Aggregation
  9. 8.5 — NetFlow Prefix Aggregation
  10. 8.6 — NetFlow Destination (Catalyst switches)
  11. 8.7 — NetFlow Source Destination (Catalyst switches)
  12. 8.8 — NetFlow Full Flow (Catalyst switches)
  13. 8.9 — NetFlow ToS AS Aggregation
  14. 8.10 — NetFlow ToS Proto Port Aggregation
  15. 8.11 — NetFlow ToS Source Prefix Aggregation
  16. 8.12 — NetFlow ToS Destination Prefix Aggregation
  17. 8.13 — NetFlow ToS Prefix Aggregation
  18. 8.14 — NetFlow ToS Prefix Port Aggregation
  19. 1005 — Flow-Tools tagged version 5
• -x xlate_fname — Translation config file name. Defaults to /etc/flow-tools/cfg/xlate.cfg
• -X xlate_definition — Translation definition. Defaults to default.
• -z z_level — Configure compression level to z_level. 0 is disabled (no compression), 9 is highest compression.

---

🌈 EXAMPLES 🌈

🍓 example one: downgrade that version

Convert the version 7 flows in flows.v7 to version 5, storing the result in flows.v5.

flow-xlate -V5 < flows.v7 > flows.v5

🍓 example two: the privacy mask saga

Set the low 11 bits in the IP addresses to zero unless the address is multicast or it belongs to the 192.88.99/24 network.

# xlate.cfg
include-filter filter.cfg

xlate-action MULTICAST-PRIVACY
  type ip-address-privacy-mask
  mask 0xFFFFFFFF 0xFFFFFFFF

xlate-action UNICAST-PRIVACY
  type ip-address-privacy-mask
  mask 0xFFFFFF00 0xFFFFF800

xlate-definition abilene_privacy
  term
    filter mcast
    action MULTICAST-PRIVACY
    stop
  term
    filter ucast
    action UNICAST-PRIVACY

# filter.cfg
filter-primitive MCAST
  type ip-address-mask
  permit 224.0.0.0 240.0.0.0

filter-primitive UCAST
  type ip-address-mask
  deny 224.0.0.0 240.0.0.0
  default permit

filter-primitive SKIP
  type ip-address-mask
  deny 192.88.99.0 255.255.255.0
  default permit

filter-definition mcast
  match ip-destination-address MCAST

filter-definition ucast
  match ip-destination-address UCAST
  match ip-destination-address SKIP
  match ip-source-address SKIP

flow-cat flows | flow-xlate -xxlate.cfg -Xabilene_privacy | flow-print

---

🫶 FILES 🫶

Configuration files:

• Symbols — /etc/flow-tools/sym/*.
• Filter — /etc/flow-tools/cfg/filter.cfg.
• Xlate — /etc/flow-tools/cfg/xlate.cfg.

---

💀 BUGS 💀

bestie. listen. the scale option can overflow the 32 bit flow counters. This could be solved by detecting this condition and splitting the flow in two. (she has not been solved. be careful.)

Translation between aggregated and non aggregated formats is not supported. don't try it, it's not a vibe.

---

💜 AUTHOR 💜

Mark Fullmer <maf@splintered.net> — the icon, the legend, the moment.

---

⭐ SEE ALSO ⭐

flow-tools(1)

---

and that's the whole page, bestie 🎀 — straight from the flow-tools set, dated 26 Август 2010 (that's August 26, 2010 for the calendar girlies), and yes it really is titled FLOW-XLATE(1) at the top and bottom like a little matching set. periodt. 💖