transcript compatibility for postscript use.
synopsis: .P! <file.ps>
\. .fl \" force out current output buffer \\!%PB \\!/showpage{}def the following is from Ken Flowers -- it prevents dictionary overflows
\\!/tempdict 200 dict def tempdict begin .fl \" prolog .sy cat \\$1\" bring in postscript file the following line matches the tempdict above
\\!end % tempdict % \\!PE \\!. .. .. . ft \\*(f4 . ds f4\" ' br \} . ft \\*(f3 . ds f3\" ' br \} . ft \\*(f2 . ds f2\" ' br \} . ft \\*(f1 . ds f1\" ' br \} ..
flow-fanout [-h] [-A AS0_substitution] [-d debug_level] [-f filter_fname] [-F filter_definition] [-m privacy_mask] [-p pidfile] [-s] [-S stat_interval] [-V pdu_version] [-x xmit_delay] localip/remoteip/port localip/remoteip/port ...
The flow-fanout utility will replicate flows arriving on localip/remoteip/port to destination(s) specified by localip/remoteip/port.
Flows processed by multiple exporters will be mixed into a single output stream. This functionality appeared to support Cisco Catalyst exports and may have other uses.
A SIGQUIT or SIGTERM signal will cause flow-fanout to exit.
1 NetFlow version 1 (No sequence numbers, AS, or mask) 5 NetFlow version 5 6 NetFlow version 6 (5+ Encapsulation size) 7 NetFlow version 7 (Catalyst switches) 8.1 NetFlow AS Aggregation 8.2 NetFlow Proto Port Aggregation 8.3 NetFlow Source Prefix Aggregation 8.4 NetFlow Destination Prefix Aggregation 8.5 NetFlow Prefix Aggregation 8.6 NetFlow Destination (Catalyst switches) 8.7 NetFlow Source Destination (Catalyst switches) 8.8 NetFlow Full Flow (Catalyst switches) 8.9 NetFlow ToS AS Aggregation 8.10 NetFlow ToS Proto Port Aggregation 8.11 NetFlow ToS Source Prefix Aggregation 8.12 NetFlow ToS Destination Prefix Aggregation 8.13 NetFlow ToS Prefix Aggregation 8.14 NetFlow ToS Prefix Port Aggregation 1005 Flow-Tools tagged version 5
Replicate flows arriving to local IP address 10.0.0.1 from the router exporting with IP address 10.1.1.1 on port 9500 to localhost port 9500 and 10.5.5.5 port 9200. The exports sent to 10.5.5.5 will be sent with a source IP address of 10.0.0.5 which must be a valid local IP address.
flow-fanout 10.0.0.1/10.1.1.1/9500 0/0/9500 10.0.0.5/10.5.5.5/9200
NetFlow exports do not contain the exporter IP address inside the payload so the original exporter IP address (typically a router) will be lost when using flow-fanout. A work around for this protocol limitation is to use local IP aliases and the localip option. When the spoofing option is used multiple exporters with different IP addresses will share the same sequence number but will have the original source IP. Fixing this requires per source : destination sequence number mapping. It is much easier to just use multiple instances of flow-fanout running on different ports.
Mark Fullmer maf@splintered.net
flow-tools(1)
created by instant / docbook-to-man, Thu 11 Feb 2021, 21:34