flow-receive(1)                              General Commands Manual                             flow-receive(1)

NAME

       flow-receive — Receive flow data with the NetFlow protocol.

SYNOPSIS

       flow-receive  [-h]  [-b big|little]  [-C comment]  [-d debug_level]  [-o output_file]  [-S stat_interval]
       [-V pdu_version]  [-z z_level] localip/remoteip/port

DESCRIPTION

       The flow-receive utility is used to receive flows in NetFlow format.  When  the  remoteip  is  configured
       only  flows  from that exporter will be processed, this is the most secure and recommended configuration.
       When the localip is configured flow-receive will only process flows sent to the  localip IP address.   If
       remoteip  is  0  (not configured) flows from any source IP address are accepted.  Multiple non aggregated
       PDU versions may be accepted at once to  support  Cisco's  Catalyst  6500  NetFlow  implementation  which
       exports  from  both  the  supervisor and MSFC with the same IP address and same port but different export
       versions.  In this case the exports will be stored in the format specified by the -V  flag  or  whichever
       export type is received first.

OPTIONS

       -b big|little
                 Byte order of output.

       -C Comment
                 Add a comment.

       -d debug_level
                 Enable debugging.

       -h        Display help.

       -o file   Write to file instead of the standard out.

       -S stat_interval
                 When  configured  flow-receive  will  emit  a timestamped message on stderr every stat_interval
                 minutes indicating counters such as the number of flows received, packets processed,  and  lost
                 flows.

       -V pdu_version
                 Use pdu_version format output.

       1    NetFlow version 1 (No sequence numbers, AS, or mask)
       5    NetFlow version 5
       6    NetFlow version 6 (5+ Encapsulation size)
       7    NetFlow version 7 (Catalyst switches)
       8.1  NetFlow AS Aggregation
       8.2  NetFlow Proto Port Aggregation
       8.3  NetFlow Source Prefix Aggregation
       8.4  NetFlow Destination Prefix Aggregation
       8.5  NetFlow Prefix Aggregation
       8.6  NetFlow Destination (Catalyst switches)
       8.7  NetFlow Source Destination (Catalyst switches)
       8.8  NetFlow Full Flow (Catalyst switches)
       8.9  NetFlow ToS AS Aggregation
       8.10 NetFlow ToS Proto Port Aggregation
       8.11 NetFlow ToS Source Prefix Aggregation
       8.12 NetFlow ToS Destination Prefix Aggregation
       8.13 NetFlow ToS Prefix Aggregation
       8.14 NetFlow ToS Prefix Port Aggregation
       1005 Flow-Tools tagged version 5

       -z z_level
                 Configure  compression  level  to   z_level.   0  is  disabled  (no  compression), 9 is highest
                 compression.

EXAMPLES

       Listen on port 9800 on any local interface for exports from IP address 10.0.0.1,  store  the  exports  in
       flows

       flow-receive 0/10.0.0.1/9800 > flows

       Listen  on  port  9800  on any local interface from any IP address, display the received flows with flow-
       print.

       flow-receive 0/0/9800 | flow-print

BUGS

       It is not currently possible to convert between the aggregated  formats  (8.x)  and  the  non  aggregated
       formats (1,5,6,7).

AUTHOR

       Mark Fullmer maf@splintered.net

SEE ALSO

       flow-tools(1)

                                                                                                 flow-receive(1)