Provided by: flow-tools_0.68-12.5build6_amd64 bug

flow-fanout(1)                       General Commands Manual                       flow-fanout(1)

NAME

       flow-fanout — Fanout (replicate) flow exports to many destinations.

SYNOPSIS

       flow-fanout   [-h]   [-A  AS0_substitution]   [-d  debug_level]   [-f  filter_fname]   [-F
       filter_definition]   [-m  privacy_mask]   [-p  pidfile]   [-s]   [-S  stat_interval]   [-V
       pdu_version]  [-x xmit_delay] localip/remoteip/port localip/remoteip/port ...

DESCRIPTION

       The  flow-fanout  utility  will  replicate  flows  arriving  on  localip/remoteip/port  to
       destination(s) specified by localip/remoteip/port.

       Flows processed by multiple exporters will be mixed into a  single  output  stream.   This
       functionality appeared to support Cisco Catalyst exports and may have other uses.

       A SIGQUIT or SIGTERM signal will cause flow-fanout to exit.

OPTIONS

       -A AS0_substitution
                 Cisco's  NetFlow  exports  represent the local autonomous system as 0 instead of
                 the real value.  This option can be used to replace the 0 in the export with the
                 a  configured  value.   Unfortunately under certain configurations AS 0 can also
                 represent a cache miss or non forwarded traffic so use with caution.

       -d debug_level
                 Enable debugging.

       -f filter_fname
                 Filter list filename.  Defaults to /etc/flow-tools/cfg/filter.

       -F filter_definition
                 Select the active definition.  Defaults to default.

       -h        Display help.

       -m privacy_mask
                 Apply privacy_mask to the source and  destination  IP  address  of  flows.   For
                 example   a   privacy_mask   of   255.255.255.0   would   convert   flows   with
                 source/destination IP addresses 10.1.1.1 and 10.2.2.2 to 10.1.1.0  and  10.2.2.0
                 respectively.

       -p pidfile
                 Configure the process ID file.  Use - to disable pid file creation.

       -s        Spoof  the  source  IP address.  If the IP address is 0 then it is replaced with
                 the exporter source IP.

       -S stat_interval
                 When configured flow-fanout will emit a  timestamped  message  on  stderr  every
                 stat_interval  minutes indicating counters such as the number of flows received,
                 packets processed, and lost flows.

       -V pdu_version
                 Use pdu_version format output.

           1    NetFlow version 1 (No sequence numbers, AS, or mask)
           5    NetFlow version 5
           6    NetFlow version 6 (5+ Encapsulation size)
           7    NetFlow version 7 (Catalyst switches)
           8.1  NetFlow AS Aggregation
           8.2  NetFlow Proto Port Aggregation
           8.3  NetFlow Source Prefix Aggregation
           8.4  NetFlow Destination Prefix Aggregation
           8.5  NetFlow Prefix Aggregation
           8.6  NetFlow Destination (Catalyst switches)
           8.7  NetFlow Source Destination (Catalyst switches)
           8.8  NetFlow Full Flow (Catalyst switches)
           8.9  NetFlow ToS AS Aggregation
           8.10 NetFlow ToS Proto Port Aggregation
           8.11 NetFlow ToS Source Prefix Aggregation
           8.12 NetFlow ToS Destination Prefix Aggregation
           8.13 NetFlow ToS Prefix Aggregation
           8.14 NetFlow ToS Prefix Port Aggregation
           1005 Flow-Tools tagged version 5

       -x xmit_delay
                 Configure a microsecond transmit delay between packets.  This may  be  necessary
                 in some configurations to prevent a transmit buffer overrun.

EXAMPLES

       Replicate  flows  arriving  to local IP address 10.0.0.1 from the router exporting with IP
       address 10.1.1.1 on port 9500 to localhost port 9500 and 10.5.5.5 port 9200.  The  exports
       sent  to  10.5.5.5 will be sent with a source IP address of 10.0.0.5 which must be a valid
       local IP address.

         flow-fanout 10.0.0.1/10.1.1.1/9500 0/0/9500 10.0.0.5/10.5.5.5/9200

BUGS

       NetFlow exports do not contain the exporter IP address inside the payload so the  original
       exporter  IP  address  (typically  a  router) will be lost when using flow-fanout.  A work
       around for this protocol limitation is to use local IP aliases and the localip option.

       When the spoofing option is used multiple exporters with different IP addresses will share
       the  same  sequence number but will have the original source IP.  Fixing this requires per
       source : destination sequence number mapping.  It is much  easier  to  just  use  multiple
       instances of flow-fanout running on different ports.

AUTHOR

       Mark Fullmer maf@splintered.net

SEE ALSO

       flow-tools(1)

                                                                                   flow-fanout(1)