flow-filter(1)                       General Commands Manual                       flow-filter(1)

NAME

       flow-filter — Filter flows.

SYNOPSIS

       flow-filter  [-hko]  [-a src_as_filter]  [-A dst_as_filter]  [-b big|little]  [-C comment]
       [-D dstaddr_filter_name]   [-d  debug_level]   [-e  exaddr_filter]   [-f  acl_fname]   [-i
       input_filter]    [-I   output_filter]    [-p  srcport_filter]   [-P  dstport_filter]   [-r
       ipprot_filter]  [-S srcaddr_filter_name]   [-t  tos_filter]   [-T  tcp_flags_filter]   [-x
       nexthop_filter_name]  [-z z_level]

DESCRIPTION

       The  flow-filter  utility  will  filter  flows  based on user selectable criteria.  The IP
       address filters are defined in flow.acl or by the filename specified by -f.

       Other filters such as input interface and ports are defined on the  command  line.   These
       filters  accept  range and negation operators, ie -i1-15 for input interfaces 1 through 15
       or -i1,15 for input interfaces 1 and 15, or !1,15 for not input interfaces 1 and 15.

       The syntax is kludgy and needs reworked but works for most applications.

OPTIONS

       -a src_as_filter
                 Source AS filter, ie -a159 to permit Autonomous System 159.

       -A dst_as_filter
                 Destination AS filter, ie -A159,3112 to permit Autonomous Systems 159 and 3112.

       -b big|little
                 Byte order of output.

       -C Comment
                 Add a comment.

       -d debug_level
                 Enable debugging.

       -D dstaddr_filter_name
                 Destination IP address filter.  This is the name or number of a standard  access
                 list defined in flow.acl or the file specified by -f.

       -e exaddr_filter
                 Exporter IP address filter.  One exporter address can be filtered.

       -f acl_fname
                 Access list filename.  Defaults to flow.acl.

       -h        Display help.

       -i input_filter
                 Input interface filter, ie -i0 to permit traffic from interface 0.

       -k        Keep time from input.

       -I output_filter
                 Output interface filter, ie -I0 to permit traffic to interface 0.

       -o        Logical OR instead of AND filters.

       -p srcport_filter
                 Source port filter, ie -p80 to only permit source port 80.

       -P dstport_filter
                 Destination port filter, ie -P80,8080 to permit destination ports 80 and 8080.

       -r ipprot_filter
                 IP Protocol filter, ie -r6 to only permit TCP traffic.

       -S srcaddr_filter_name
                 Source  IP address filter.  This is the name or number of a standard access list
                 defined in flow.acl or the file specified by -f.

       -t tos_filter
                 ToS bits filter.  An optional mask is available which  is  applied  to  the  tos
                 field  before  comparing  to  the  filter  list.  For example to match a tos bit
                 pattern of 101xxxxx use 0xA0/0xE0.

       -T tcp_flags_filter
                 TCP bits filter.  An optional mask is available which  is  applied  to  the  TCP
                 flags  field  before comparing to the filter list.  For example to match a flows
                 with the SYN bit set use 0x2/0x2.

       -x nexthop_filter_name
                 NextHop IP address filter.  This is the name or number of a standard access list
                 defined in flow.acl or the file specified by -f.

       -z z_level
                 Configure  compression  level to  z_level.  0 is disabled (no compression), 9 is
                 highest compression.

EXAMPLES

       Print all traffic with a destination port of 80.

         flow-cat /flows/krc4 | flow-filter -P80 | flow-print

       Print all traffic with with source IP 10.0.0.1.  Populate flow.acl with
         ip access-list standard badguy permit host 10.0.0.1

         flow-cat /flows/krc4 | flow-filter -Sbadguy | flow-print

       Report all destinations that IP 10.0.0.1 has sent traffic to.  Sort by  octets.   Populate
       flow.acl with
         ip access-list standard badguy permit host 10.0.0.1

         flow-cat /flows/krc4 | flow-filter -Sbadguy | flow-stat -f8 -S2

BUGS

       Extended  access  lists  are  not  fully implemented.  The command line filter syntax is a
       kludge.

NOTES

       Use flow-nfilter.

AUTHOR

       Mark Fullmer maf@splintered.net

SEE ALSO

       flow-tools(1)

                                                                                   flow-filter(1)