flow-stat(1)                                 General Commands Manual                                flow-stat(1)

NAME

       flow-stat — Generate reports with flow data.

SYNOPSIS

       flow-stat  [-hnpPw]   [-d  debug_level]   [-f format]  [-S sort_field]  [-s sort_field]  [-t tally_lines]
       [-T title]

DESCRIPTION

       The flow-stat utility generates usage reports for flow data sets by IP address, IP address pairs,  ports,
       packets, bytes, interfaces, next hops, autonomous systems, ToS bits, exporters, and tags.

OPTIONS

       -d debug_level
                 Enable debugging.

       -f format

       Report format.  Choose from the following:

           0  Overall Summary
           1  Average packet size distribution
           2  Packets per flow distribution
           3  Octets per flow distribution
           4  Bandwidth per flow distribution
           5  UDP/TCP destination port
           6  UDP/TCP source port
           7  UDP/TCP port
           8  Destination IP
           9  Source IP
           10 Source/Destination IP
           11 Source or Destination IP
           12 IP protocol
           13 octets for flow duration plot data
           14 packets for flow duration plot data
           15 short summary
           16 IP Next Hop
           17 Input interface
           18 Output interface
           19 Source AS
           20 Destination AS
           21 Source/Destination AS
           22 IP ToS
           23 Input/Output Interface
           24 Source Prefix
           25 Destination Prefix
           26 Source/Destination Prefix
           27 Exporter IP
           28 Engine Id
           29 Engine Type
           30 Source Tag
           31 Destination Tag
           32 Source/Destination Tag

       -h        Display help.

       -n        Use symbolic names where appropriate.

       -p        Display header information.

       -P        Report as percent total.

       -s sort_field
                 Sort ascending on field sort_field.

       -S sort_field
                 Sort descending on field sort_field.

       -t tally_lines
                 Tally totals every tally_lineslines.

       -T title  Set report title to title.

       -w        Wide output.

EXAMPLES

       Provide  a  report  on top source/destination IP pairs sorted by octets, report in percent total form for
       the flows in /flows/krc4.  Use the preload option to flow-cat to preserve meta information and display it
       with flow-stat.

         flow-cat -p /flows/krc4 | flow-stat -f10 -P -p -S4

EXAMPLES

       Many times a campus network will have a single border router which has  one  interface  pointing  to  the
       internal  side  and  many  interfaces  pointing  to other providers.  These interfaces each have a unique
       numerical id known in SNMP terms as an ifIndex.  The ifIndex to interface name mappings can be determined
       by using a tool such as snmpwalk or using show commands in recent versions of IOS with the 'show snmp mib
       ifmib ifindex' or JunOS 'show interfaces'.  Once the ifIndex for each interface is known flow-filter  can
       be  combined  with  flow-stat  to  provide  reports  such  as  inbound vs outbound top src/destination IP
       addresses.

       Provide a top source IP address report by outbound traffic, ie the top senders of traffic on  the  campus
       network.  Assume the ifIndex of the campus interface is 5.

         flow-cat -p /flows/krc4 | flow-filter -i5 | flow-stat -f9 -P -p -S3

EXAMPLES

       Provide  a  top  destination  IP  address  report by outbound traffic, ie the top sinks of traffic on the
       campus network.  Assume the ifIndex of the campus interface is 5.

         flow-cat -p /flows/krc4 | flow-filter -I5 | flow-stat -f8 -P -p -S3

EXAMPLES

       Provide a top source/destination AS report.  Use symbolic names.

         flow-cat -p /flows/krc4 | flow-stat -f20 -n -P -p -S4

BUGS

       None known.

AUTHOR

       Mark Fullmer maf@splintered.net

SEE ALSO

       flow-tools(1)

                                                                                                    flow-stat(1)