PFLOW(4)

💅 PFLOW(4) — like, the kernel interface for pflow data export, bestie ✨

okay so this is section 4 of the kernel interfaces manual (Kernel Interfaces Manual), and the star of the show is pflow — say hi 👋

---

🦋 NAME

pflow — the kernel interface for pflow data export. that's it, that's the vibe 💖

---

🌸 SYNOPSIS

pseudo-device pflow

literally just that one line, no cap ✨

---

🎀 DESCRIPTION

okay so the pflow subsystem exports pflow accounting data straight outta the kernel using udp(4) packets. and get this — pflow is compatible with netflow version 5 and IPFIX (10) 🔥 where does the data even come from? it's extracted from the pf(4) state table. slay.

you can create multiple pflow interfaces at runtime with the pflowctlN -c command — yes, more than one, go off 👑. but each interface must be configured with a flow receiver IP address and a flow receiver port number. non-negotiable, bestie.

⚠️ only states created by a rule marked with the pflow keyword get exported by pflow. like, only those ones. don't come crying to me about your other flows 🙈

pflow will attempt to export multiple pflow records in one UDP packet — bundling, we love efficiency 💅 — but it will not hold a record for longer than 30 seconds. thirty. seconds. clock's ticking ⏰

each packet seen on this interface has one header and a variable number of flows. the header indicates:

• the version of the protocol
• number of flows in the packet
• a unique sequence number
• system time
• an engine ID and type

header and flow structs are defined in <net/pflow.h> — go look, iykyk 🧚

the pflow source and destination addresses are controlled by pflowctl(8). so:

• src is the sender IP address of the UDP packet, which can be used to identify the source of the data on the pflow collector 💌
• dst defines the collector IP address and the port
• the dst IP address and port must be defined to enable the export of flows — like, required required 😭

for example, the following command sets 10.0.0.1 as the source and 10.0.0.2:1234 as destination:

# pflowctl -s pflow0 src 10.0.0.1 dst 10.0.0.2:1234

and the protocol is set to IPFIX with the following command:

# pflowctl -s pflow0 proto 10

iconic. periodt. 🫶

---

🌈 SEE ALSO

netintro(4), pf(4), udp(4), pf.conf(5), pflowctl(8), tcpdump(8) — the whole friend group, honestly 💜

---

⭐ STANDARDS

B. Claise, Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information, RFC 5101, January 2008. 📚 academic queen behavior

---

💀 HISTORY

the pflow device first appeared in OpenBSD 4.5 and was imported into FreeBSD 15.0 . so it's been around, it's got lore 🦋

---

🙈 BUGS

okay so here's the messy part, don't @ me:

• a state created by pfsync(4) can have a creation or expiration time before the machine came up 😭 in this case, pflow pretends such flows were created or expired when the machine came up. it's just vibes, it's fine.
• the IPFIX implementation is incomplete: the required transport protocol SCTP is not supported. transport over TCP and DTLS protected flow export is also not supported. like... not supported at all 💀

---

and that's the whole page, bestie 🎀 this one's from the Debian crew, dated January 08, 2024 — mwah, sending you the entire flow of love 💖✨