1<!DOCTYPE refentry PUBLIC "-//Davenport//DTD DocBook V3.0//EN">
2<refentry>
3
4<refmeta>
5<refentrytitle>
6<application>flow-fanout</application>
7</refentrytitle>
8<manvolnum>1</manvolnum>
9</refmeta>
10
11<refnamediv>
12<refname>
13<application>flow-fanout</application>
14</refname>
15<refpurpose>
16Fanout (replicate) flow exports to many destinations.
17</refpurpose>
18</refnamediv>
19
20<refsynopsisdiv>
21<cmdsynopsis>
22<command>flow-fanout</command>
23<arg>-h</arg>
24<arg>-A<replaceable> AS0_substitution</replaceable></arg>
25<arg>-d<replaceable> debug_level</replaceable></arg>
26<arg>-f<replaceable> filter_fname</replaceable></arg>
27<arg>-F<replaceable> filter_definition</replaceable></arg>
28<arg>-m<replaceable> privacy_mask</replaceable></arg>
29<arg>-p<replaceable> pidfile</replaceable></arg>
30<arg>-s</arg>
31<arg>-S<replaceable> stat_interval</replaceable></arg>
32<arg>-V<replaceable> pdu_version</replaceable></arg>
33<arg>-x<replaceable> xmit_delay</replaceable></arg>
34<arg choice="req"><replaceable>localip/remoteip/port</replaceable></arg>
35<arg choice="req" rep="repeat"><replaceable>localip/remoteip/port</replaceable></arg>
36
37</cmdsynopsis>
38</refsynopsisdiv>
39
40<refsect1>
41<title>DESCRIPTION</title>
42<para>
43The <command>flow-fanout</command> utility will replicate flows arriving
44on localip/remoteip/port to destination(s) specified by localip/remoteip/port.
45</para>
46<para>
47Flows processed by multiple exporters will be mixed into a single output
48stream.  This functionality appeared to support Cisco Catalyst exports and
49may have other uses.
50</para>
51<para>
52A SIGQUIT or SIGTERM signal will cause <command>flow-fanout</command> to exit.
53</para>
54</refsect1>
55
56<refsect1>
57<title>OPTIONS</title>
58<variablelist>
59
60<varlistentry>
61<term>-A<replaceable> AS0_substitution</replaceable></term>
62<listitem>
63<para>
64Cisco's NetFlow exports represent the local autonomous system as 0 instead of
65the real value.  This option can be used to replace the 0 in the export with
66the a configured value.  Unfortunately under certain configurations AS 0 can
67also represent a cache miss or non forwarded traffic so use with caution.
68</para>
69</listitem>
70</varlistentry>
71
72
73<varlistentry>
74<term>-d<replaceable> debug_level</replaceable></term>
75<listitem>
76<para>
77Enable debugging.
78</para>
79</listitem>
80</varlistentry>
81
82<varlistentry>
83<term>-f<replaceable> filter_fname</replaceable></term>
84<listitem>
85<para>
86Filter list filename.  Defaults to <filename>/usr/local/etc/flow-tools/filter</filename>.
87</para>
88</listitem>
89</varlistentry>
90
91<varlistentry>
92<term>-F<replaceable> filter_definition</replaceable></term>
93<listitem>
94<para>
95Select the active definition.  Defaults to default.
96</para>
97</listitem>
98</varlistentry>
99
100
101<varlistentry>
102<term>-h</term>
103<listitem>
104<para>
105Display help.
106</para>
107</listitem>
108</varlistentry>
109
110<varlistentry>
111<term>-m<replaceable> privacy_mask</replaceable></term>
112<listitem>
113<para>
114Apply <replaceable>privacy_mask</replaceable> to the source and destination IP
115address of flows.  For example a privacy_mask of 255.255.255.0 would convert
116flows with source/destination IP addresses 10.1.1.1 and 10.2.2.2 to 10.1.1.0
117and 10.2.2.0 respectively.
118</para>
119</listitem>
120</varlistentry>
121
122<varlistentry>
123<term>-p<replaceable> pidfile</replaceable></term>
124<listitem>
125<para>
126Configure the process ID file.  Use - to disable pid file creation.
127</para>
128</listitem>
129</varlistentry>
130
131<varlistentry>
132<term>-s</term>
133<listitem>
134<para>
135Spoof the source IP address.  If the IP address is 0 then it is replaced
136with the exporter source IP.
137</para>
138</listitem>
139</varlistentry>
140
141<varlistentry>
142<term>-S<replaceable> stat_interval</replaceable></term>
143<listitem>
144<para>
145When configured <command>flow-fanout</command> will emit a timestamped
146message on stderr every <replaceable>stat_interval</replaceable> minutes
147indicating counters such as the number of flows received, packets processed,
148and lost flows.
149</para>
150</listitem>
151</varlistentry>
152
153<varlistentry>
154<term>-V<replaceable> pdu_version</replaceable></term>
155<listitem>
156<para>
157Use <replaceable>pdu_version</replaceable> format output.
158<literallayout>
159    1    NetFlow version 1 (No sequence numbers, AS, or mask)
160    5    NetFlow version 5
161    6    NetFlow version 6 (5+ Encapsulation size)
162    7    NetFlow version 7 (Catalyst switches)
163    8.1  NetFlow AS Aggregation
164    8.2  NetFlow Proto Port Aggregation
165    8.3  NetFlow Source Prefix Aggregation
166    8.4  NetFlow Destination Prefix Aggregation
167    8.5  NetFlow Prefix Aggregation
168    8.6  NetFlow Destination (Catalyst switches)
169    8.7  NetFlow Source Destination (Catalyst switches)
170    8.8  NetFlow Full Flow (Catalyst switches)
171    8.9  NetFlow ToS AS Aggregation
172    8.10 NetFlow ToS Proto Port Aggregation
173    8.11 NetFlow ToS Source Prefix Aggregation
174    8.12 NetFlow ToS Destination Prefix Aggregation
175    8.13 NetFlow ToS Prefix Aggregation
176    8.14 NetFlow ToS Prefix Port Aggregation
177    1005 Flow-Tools tagged version 5
178</literallayout>
179</para>
180</listitem>
181</varlistentry>
182
183<varlistentry>
184<term>-x<replaceable> xmit_delay</replaceable></term>
185<listitem>
186<para>
187Configure a microsecond transmit delay between packets.  This may be necessary in some configurations to prevent a transmit buffer overrun.
188</para>
189</listitem>
190</varlistentry>
191
192</variablelist>
193</refsect1>
194
195<refsect1>
196<title>EXAMPLES</title>
197<informalexample>
198<para>
199Replicate flows arriving to local IP address 10.0.0.1 from the router
200exporting with IP address 10.1.1.1 on port 9500 to localhost port 9500
201and 10.5.5.5 port 9200.  The exports sent to 10.5.5.5 will be sent with
202a source IP address of 10.0.0.5 which must be a valid local IP address.
203</para>
204<para>
205  <command>flow-fanout 10.0.0.1/10.1.1.1/9500 0/0/9500 10.0.0.5/10.5.5.5/9200</command>
206</para>
207</informalexample>
208</refsect1>
209<refsect1>
210<title>BUGS</title>
211<para>
212NetFlow exports do not contain the exporter IP address inside the payload so
213the original exporter IP address (typically a router) will be lost when using
214<command>flow-fanout</command>.  A work around for this protocol limitation
215is to use local IP aliases and the <replaceable>localip</replaceable> option.
216
217When the spoofing option is used multiple exporters with different IP addresses
218will share the same sequence number but will have the original source IP.
219Fixing this requires per source : destination sequence number mapping.  It
220is much easier to just use multiple instances of flow-fanout running on
221different ports.
222
223</para>
224</refsect1>
225
226<refsect1>
227<title>AUTHOR</title>
228<para>
229<author>
230<firstname>Mark</firstname>
231<surname>Fullmer</surname>
232</author>
233<email>maf@splintered.net</email>
234</para>
235</refsect1>
236
237<refsect1>
238<title>SEE ALSO</title>
239<para>
240<application>flow-tools</application>(1)
241</para>
242</refsect1>
243
244</refentry>
245