Flow-tools is library and a collection of programs used to collect,
send, process, and generate reports from NetFlow data. The tools can be
used together on a single server or distributed to multiple servers for
large deployments. The flow-toools library provides an API for development
of custom applications for NetFlow export versions 1,5,6 and the 14 currently
defined version 8 subversions. A Perl and Python interface have been
contributed and are included in the distribution.
flow-capture The flow-capture utility will receive and store NetFlow exports to disk. The flow files are rotated rotationstimes per day and expiration of old flow files can... flow-cat The flow-cat utility processes files and/or directories of files in the flow-tools format. The resulting concatenated data set is written to the standard output... flow-dscan The flow-dscan utility is used to detect suspicious activity such as port scanning, host scanning, and flows with unusually high octets or packets. A source and... flow-expire The flow-expire utility will remove the oldest flow files in a directory based on either a count of files or space utilization. The directory is recursively... flow-export The flow-export utility will convert flow-tools flow files to ASCII CSV, cflowd, pcap, wire, mySQL, and PGSQL format. flow-fanout The flow-fanout utility will replicate flows arriving on localip/remoteip/port to destination(s) specified by localip/remoteip/port. Flows processed by multiple... flow-filter The flow-filter utility will filter flows based on user selectable criteria. The IP address filters are defined in flow.acl or by the filename specified by -f... flow-gen The flow-gen utility generates a test pattern of flows in any of the currently supported export versions typically for debugging purposes. flow-header The flow-header utility will display the flow meta information flow-tools uses internally. flow-import The flow-import utility will convert data from cflowd and ASCII CSV files into flow-tools format. flow-mask The flow-mask utility is used to modify the source and destination mask length's in flow records. flow-merge The flow-merge utility processes files and/or directories of files in the flow-tools format. The resulting merged data set is written to the standard output or... flow-nfilter The flow-nfilter utility will filter flows based on user selectable criteria. Filters are defined in a configuration file and are composed of primitives and a... flow-print The flow-print utility will display flow data in ASCII using pre-defined formats selectable with -f. flow-receive The flow-receive utility is used to receive flows in NetFlow format. When the remoteip is configured only flows from that exporter will be processed, this is... flow-report The flow-report utility will generate reports from flow data. The reports are easy to parse ASCII text that can be used by a front end to produce readable... flow-rptfmt The flow-rptfmt utility processes the CSV output of flow-report into formatted ASCII or HTML. Sorting, maximum display lines, field filter, header display, and... flow-send The flow-send utility is used to transmit flows in NetFlow format to a collector specified by localip/remoteip/port. flow-split The flow-split utility will split a flow file into smaller files based on the the number of flows or the ammount of time that has passed. flow-stat The flow-stat utility generates usage reports for flow data sets by IP address, IP address pairs, ports, packets, bytes, interfaces, next hops, autonomous... flow-tag The flow-tag utility is used to add or modify source and destination tags in flow records. Tags are 32 bit identifiers derived from rules and fields in a flow... flow-tools Flow-tools is library and a collection of programs used to collect, send, process, and generate reports from NetFlow data. The tools can be used together on a... flow-tools-examples NetFlow is configured on each input interface, then global commands are used to specify the export destination. To ensure a consistant source address address... flow-xlate The flow-xlate utility is used to apply translations to flows. Translations are defined in a configuration file and are composed of actions and a definition to...