Package flow-tools

Tool set for working with NetFlow data

http://code.google.com/p/flow-tools/

Flow-tools is library and a collection of programs used to collect,
send, process, and generate reports from NetFlow data. The tools can be
used together on a single server or distributed to multiple servers for
large deployments. The flow-toools library provides an API for development
of custom applications for NetFlow export versions 1,5,6 and the 14 currently
defined version 8 subversions. A Perl and Python interface have been
contributed and are included in the distribution.

General Commands (Section 1)
flow-capture
The flow-capture utility will receive and store NetFlow exports to disk. The flow files are rotated rotationstimes per day and expiration of old flow files can...
flow-cat
The flow-cat utility processes files and/or directories of files in the flow-tools format. The resulting concatenated data set is written to the standard output...
flow-dscan
The flow-dscan utility is used to detect suspicious activity such as port scanning, host scanning, and flows with unusually high octets or packets. A source and...
flow-expire
The flow-expire utility will remove the oldest flow files in a directory based on either a count of files or space utilization. The directory is recursively...
flow-export
The flow-export utility will convert flow-tools flow files to ASCII CSV, cflowd, pcap, wire, mySQL, and PGSQL format.
flow-fanout
The flow-fanout utility will replicate flows arriving on localip/remoteip/port to destination(s) specified by localip/remoteip/port. Flows processed by multiple...
flow-filter
The flow-filter utility will filter flows based on user selectable criteria. The IP address filters are defined in flow.acl or by the filename specified by -f...
flow-gen
The flow-gen utility generates a test pattern of flows in any of the currently supported export versions typically for debugging purposes.
flow-header
The flow-header utility will display the flow meta information flow-tools uses internally.
flow-import
The flow-import utility will convert data from cflowd and ASCII CSV files into flow-tools format.
flow-mask
The flow-mask utility is used to modify the source and destination mask length's in flow records.
flow-merge
The flow-merge utility processes files and/or directories of files in the flow-tools format. The resulting merged data set is written to the standard output or...
flow-nfilter
The flow-nfilter utility will filter flows based on user selectable criteria. Filters are defined in a configuration file and are composed of primitives and a...
flow-print
The flow-print utility will display flow data in ASCII using pre-defined formats selectable with -f.
flow-receive
The flow-receive utility is used to receive flows in NetFlow format. When the remoteip is configured only flows from that exporter will be processed, this is...
flow-report
The flow-report utility will generate reports from flow data. The reports are easy to parse ASCII text that can be used by a front end to produce readable...
flow-rptfmt
The flow-rptfmt utility processes the CSV output of flow-report into formatted ASCII or HTML. Sorting, maximum display lines, field filter, header display, and...
flow-send
The flow-send utility is used to transmit flows in NetFlow format to a collector specified by localip/remoteip/port.
flow-split
The flow-split utility will split a flow file into smaller files based on the the number of flows or the ammount of time that has passed.
flow-stat
The flow-stat utility generates usage reports for flow data sets by IP address, IP address pairs, ports, packets, bytes, interfaces, next hops, autonomous...
flow-tag
The flow-tag utility is used to add or modify source and destination tags in flow records. Tags are 32 bit identifiers derived from rules and fields in a flow...
flow-tools
Flow-tools is library and a collection of programs used to collect, send, process, and generate reports from NetFlow data. The tools can be used together on a...
flow-tools-examples
NetFlow is configured on each input interface, then global commands are used to specify the export destination. To ensure a consistant source address address...
flow-xlate
The flow-xlate utility is used to apply translations to flows. Translations are defined in a configuration file and are composed of actions and a definition to...