flow-stat(1)                         General Commands Manual                         flow-stat(1)

NAME

       flow-stat — Generate reports with flow data.

SYNOPSIS

       flow-stat  [-hnpPw]   [-d debug_level]  [-f format]  [-S sort_field]  [-s sort_field]  [-t
       tally_lines]  [-T title]

DESCRIPTION

       The flow-stat utility generates usage reports for flow data sets by IP address, IP address
       pairs,  ports,  packets,  bytes,  interfaces,  next  hops,  autonomous  systems, ToS bits,
       exporters, and tags.

OPTIONS

       -d debug_level
                 Enable debugging.

       -f format

       Report format.  Choose from the following:

           0  Overall Summary
           1  Average packet size distribution
           2  Packets per flow distribution
           3  Octets per flow distribution
           4  Bandwidth per flow distribution
           5  UDP/TCP destination port
           6  UDP/TCP source port
           7  UDP/TCP port
           8  Destination IP
           9  Source IP
           10 Source/Destination IP
           11 Source or Destination IP
           12 IP protocol
           13 octets for flow duration plot data
           14 packets for flow duration plot data
           15 short summary
           16 IP Next Hop
           17 Input interface
           18 Output interface
           19 Source AS
           20 Destination AS
           21 Source/Destination AS
           22 IP ToS
           23 Input/Output Interface
           24 Source Prefix
           25 Destination Prefix
           26 Source/Destination Prefix
           27 Exporter IP
           28 Engine Id
           29 Engine Type
           30 Source Tag
           31 Destination Tag
           32 Source/Destination Tag

       -h        Display help.

       -n        Use symbolic names where appropriate.

       -p        Display header information.

       -P        Report as percent total.

       -s sort_field
                 Sort ascending on field sort_field.

       -S sort_field
                 Sort descending on field sort_field.

       -t tally_lines
                 Tally totals every tally_lineslines.

       -T title  Set report title to title.

       -w        Wide output.

EXAMPLES

       Provide a report on top source/destination IP pairs sorted by octets,  report  in  percent
       total  form  for the flows in /flows/krc4.  Use the preload option to flow-cat to preserve
       meta information and display it with flow-stat.

         flow-cat -p /flows/krc4 | flow-stat -f10 -P -p -S4

EXAMPLES

       Many times a campus network will have a single  border  router  which  has  one  interface
       pointing  to  the  internal  side  and many interfaces pointing to other providers.  These
       interfaces each have a unique numerical id known in SNMP terms as an ifIndex.  The ifIndex
       to  interface  name  mappings  can be determined by using a tool such as snmpwalk or using
       show commands in recent versions of IOS with the 'show snmp mib ifmib  ifindex'  or  JunOS
       'show  interfaces'.   Once  the  ifIndex  for  each  interface is known flow-filter can be
       combined with flow-stat to provide reports such as inbound vs outbound top src/destination
       IP addresses.

       Provide  a top source IP address report by outbound traffic, ie the top senders of traffic
       on the campus network.  Assume the ifIndex of the campus interface is 5.

         flow-cat -p /flows/krc4 | flow-filter -i5 | flow-stat -f9 -P -p -S3

EXAMPLES

       Provide a top destination IP address report by outbound  traffic,  ie  the  top  sinks  of
       traffic on the campus network.  Assume the ifIndex of the campus interface is 5.

         flow-cat -p /flows/krc4 | flow-filter -I5 | flow-stat -f8 -P -p -S3

EXAMPLES

       Provide a top source/destination AS report.  Use symbolic names.

         flow-cat -p /flows/krc4 | flow-stat -f20 -n -P -p -S4

BUGS

       None known.

AUTHOR

       Mark Fullmer maf@splintered.net

SEE ALSO

       flow-tools(1)

                                                                                     flow-stat(1)