Man Linux: Main Page and Category List

flow-stat(1)                                                      flow-stat(1)

NAME

       flow-stat — Generate reports with flow data.

SYNOPSIS

       flow-stat [-hnpPw]  [-d debug_level]  [-f format]  [-S sort_field]  [-s
       sort_field]  [-t tally_lines]  [-T title]

DESCRIPTION

       The flow-stat utility generates usage reports for flow data sets by  IP
       address,  IP  address  pairs,  ports,  packets, bytes, interfaces, next
       hops, autonomous systems, ToS bits, exporters, and tags.

OPTIONS

       -d debug_level
                 Enable debugging.

       -f format

       Report format.  Choose from the following:

           0  Overall Summary
           1  Average packet size distribution
           2  Packets per flow distribution
           3  Octets per flow distribution
           4  Bandwidth per flow distribution
           5  UDP/TCP destination port
           6  UDP/TCP source port
           7  UDP/TCP port
           8  Destination IP
           9  Source IP
           10 Source/Destination IP
           11 Source or Destination IP
           12 IP protocol
           13 octets for flow duration plot data
           14 packets for flow duration plot data
           15 short summary
           16 IP Next Hop
           17 Input interface
           18 Output interface
           19 Source AS
           20 Destination AS
           21 Source/Destination AS
           22 IP ToS
           23 Input/Output Interface
           24 Source Prefix
           25 Destination Prefix
           26 Source/Destination Prefix
           27 Exporter IP
           28 Engine Id
           29 Engine Type
           30 Source Tag
           31 Destination Tag
           32 Source/Destination Tag

       -h        Display help.

       -n        Use symbolic names where appropriate.

       -p        Display header information.

       -P        Report as percent total.

       -s sort_field
                 Sort ascending on field sort_field.

       -S sort_field
                 Sort descending on field sort_field.

       -t tally_lines
                 Tally totals every tally_lineslines.

       -T title  Set report title to title.

       -w        Wide output.

EXAMPLES

       Provide a report on top source/destination IP pairs sorted  by  octets,
       report  in  percent  total  form for the flows in /flows/krc4.  Use the
       preload option to flow-cat to preserve meta information and display  it
       with flow-stat.

         flow-cat -p /flows/krc4 | flow-stat -f10 -P -p -S4

EXAMPLES

       Many  times a campus network will have a single border router which has
       one interface  pointing  to  the  internal  side  and  many  interfaces
       pointing  to  other  providers.   These  interfaces  each have a unique
       numerical id known in  SNMP  terms  as  an  ifIndex.   The  ifIndex  to
       interface  name  mappings  can  be  determined  by using a tool such as
       snmpwalk or using show commands in recent  versions  of  IOS  with  the
       ’show  snmp  mib  ifmib  ifindex’ or JunOS ’show interfaces’.  Once the
       ifIndex for each interface is known flow-filter can  be  combined  with
       flow-stat   to   provide  reports  such  as  inbound  vs  outbound  top
       src/destination IP addresses.

       Provide a top source IP address report by outbound traffic, ie the  top
       senders  of  traffic  on the campus network.  Assume the ifIndex of the
       campus interface is 5.

         flow-cat -p /flows/krc4 | flow-filter -i5 | flow-stat -f9 -P -p -S3

EXAMPLES

       Provide a top destination IP address report by outbound traffic, ie the
       top  sinks of traffic on the campus network.  Assume the ifIndex of the
       campus interface is 5.

         flow-cat -p /flows/krc4 | flow-filter -I5 | flow-stat -f8 -P -p -S3

EXAMPLES

       Provide a top source/destination AS report.  Use symbolic names.

         flow-cat -p /flows/krc4 | flow-stat -f20 -n -P -p -S4

BUGS

       None known.

AUTHOR

       Mark Fullmer maf@splintered.net

SEE ALSO

       flow-tools(1)

                                                                  flow-stat(1)