flow-import(1) flow-import(1)
NAME
flow-import — Import flows into flow-tools from other NetFlow packages.
SYNOPSIS
flow-import [-h] [-b big|little] [-d debug_level] [-f format] [-m
mask_fields] [-V pdu_version] [-z z_level]
DESCRIPTION
The flow-import utility will convert data from cflowd and ASCII CSV
files into flow-tools format.
OPTIONS
-b big|little
Byte order of output.
-d debug_level
Enable debugging.
-f format Export format. Supported formats are:
0 cflowd
2 ASCII CSV
3 Cisco NFCollector
-h Display help.
-m mask_fields
Select fields for cflowd and ASCII formats. The mask_fields
is built from a bitwise OR of the following:
UNIX_SECS 0x0000000000000001LL
UNIX_NSECS 0x0000000000000002LL
SYSUPTIME 0x0000000000000004LL
EXADDR 0x0000000000000008LL
DFLOWS 0x0000000000000010LL
DPKTS 0x0000000000000020LL
DOCTETS 0x0000000000000040LL
FIRST 0x0000000000000080LL
LAST 0x0000000000000100LL
ENGINE_TYPE 0x0000000000000200LL
ENGINE_ID 0x0000000000000400LL
SRCADDR 0x0000000000001000LL
DSTADDR 0x0000000000002000LL
SRC_PREFIX 0x0000000000004000LL
DST_PREFIX 0x0000000000008000LL
NEXTHOP 0x0000000000010000LL
INPUT 0x0000000000020000LL
OUTPUT 0x0000000000040000LL
SRCPORT 0x0000000000080000LL
DSTPORT 0x0000000000100000LL
PROT 0x0000000000200000LL
TOS 0x0000000000400000LL
TCP_FLAGS 0x0000000000800000LL
SRC_MASK 0x0000000001000000LL
DST_MASK 0x0000000002000000LL
SRC_AS 0x0000000004000000LL
DST_AS 0x0000000008000000LL
IN_ENCAPS 0x0000000010000000LL
OUT_ENCAPS 0x0000000020000000LL
PEER_NEXTHOP 0x0000000040000000LL
ROUTER_SC 0x0000000080000000LL
EXTRA_PKTS 0x0000000100000000LL
MARKED_TOS 0x0000000200000000LL
The default value is all fields applicable to the
pdu_version.
-V pdu_version
Use pdu_version format output.
1 NetFlow version 1 (No sequence numbers, AS, or mask)
5 NetFlow version 5
6 NetFlow version 6 (5+ Encapsulation size)
7 NetFlow version 7 (Catalyst switches)
8.1 NetFlow AS Aggregation
8.2 NetFlow Proto Port Aggregation
8.3 NetFlow Source Prefix Aggregation
8.4 NetFlow Destination Prefix Aggregation
8.5 NetFlow Prefix Aggregation
8.6 NetFlow Destination (Catalyst switches)
8.7 NetFlow Source Destination (Catalyst switches)
8.8 NetFlow Full Flow (Catalyst switches)
8.9 NetFlow ToS AS Aggregation
8.10 NetFlow ToS Proto Port Aggregation
8.11 NetFlow ToS Source Prefix Aggregation
8.12 NetFlow ToS Destination Prefix Aggregation
8.13 NetFlow ToS Prefix Aggregation
8.14 NetFlow ToS Prefix Port Aggregation
1005 Flow-Tools tagged version 5
-z z_level
Configure compression level to z_level. 0 is disabled (no
compression), 9 is highest compression.
EXAMPLES
Convert the cflowd file flows.cflowd to the flow-tools file flows.
Store as Version 5 with compression level 5.
flow-import -V5 -z5 -f0 < flows.cflowd > flows
EXAMPLES
Convert the ASCII CSV data in flows.ascii to flow-tools format. The
ASCII data must include all fields represented by 0xFF31EF in the order
listed above. Store as Version 5 with no compression.
flow-import -z0 -f2 -m0xFF31EF < flows.ascii > flows
BUGS
The pcap format is a hack.
AUTHOR
Mark Fullmer maf@splintered.net
SEE ALSO
flow-tools(1)
flow-import(1)