$Header: /usr/src/docbook-to-man/cmd/RCS/docbook-to-man.sh,v 1.3 1996/06/17 03:36:49 fld Exp $

transcript compatibility for postscript use.

synopsis: .P! <file.ps>

\. .fl \" force out current output buffer \\!%PB \\!/showpage{}def the following is from Ken Flowers -- it prevents dictionary overflows
\\!/tempdict 200 dict def tempdict begin .fl \" prolog .sy cat \\$1\" bring in postscript file the following line matches the tempdict above
\\!end % tempdict % \\!PE \\!. .. .. . ft \\*(f4 . ds f4\" ' br \} . ft \\*(f3 . ds f3\" ' br \} . ft \\*(f2 . ds f2\" ' br \} . ft \\*(f1 . ds f1\" ' br \} .. flow-stat \(em Generate reports with flow data.

flow-stat [-hnpPw] [-d debug_level] [-f format] [-S sort_field] [-s sort_field] [-t tally_lines] [-T title]

The flow-stat utility generates usage reports for flow data sets by IP address, IP address pairs, ports, packets, bytes, interfaces, next hops, autonomous systems, ToS bits, exporters, and tags.

Enable debugging.

Report format. Choose from the following:

 0 Overall Summary
 1 Average packet size distribution
 2 Packets per flow distribution
 3 Octets per flow distribution
 4 Bandwidth per flow distribution
 5 UDP/TCP destination port
 6 UDP/TCP source port
 7 UDP/TCP port
 8 Destination IP
 9 Source IP
 10 Source/Destination IP
 11 Source or Destination IP
 12 IP protocol
 13 octets for flow duration plot data
 14 packets for flow duration plot data
 15 short summary
 16 IP Next Hop
 17 Input interface
 18 Output interface
 19 Source AS
 20 Destination AS
 21 Source/Destination AS
 22 IP ToS
 23 Input/Output Interface
 24 Source Prefix
 25 Destination Prefix
 26 Source/Destination Prefix
 27 Exporter IP
 28 Engine Id
 29 Engine Type
 30 Source Tag
 31 Destination Tag
 32 Source/Destination Tag

Display help. Use symbolic names where appropriate. Display header information. Report as percent total. Sort ascending on field sort_field. Sort descending on field sort_field. Tally totals every tally_lineslines. Set report title to title. Wide output.

Provide a report on top source/destination IP pairs sorted by octets, report in percent total form for the flows in /flows/krc4. Use the preload option to flow-cat to preserve meta information and display it with flow-stat.

flow-cat -p /flows/krc4 | flow-stat -f10 -P -p -S4

Many times a campus network will have a single border router which has one interface pointing to the internal side and many interfaces pointing to other providers. These interfaces each have a unique numerical id known in SNMP terms as an ifIndex. The ifIndex to interface name mappings can be determined by using a tool such as snmpwalk or using show commands in recent versions of IOS with the 'show snmp mib ifmib ifindex' or JunOS 'show interfaces'. Once the ifIndex for each interface is known flow-filter can be combined with flow-stat to provide reports such as inbound vs outbound top src/destination IP addresses. Provide a top source IP address report by outbound traffic, ie the top senders of traffic on the campus network. Assume the ifIndex of the campus interface is 5.

flow-cat -p /flows/krc4 | flow-filter -i5 | flow-stat -f9 -P -p -S3

Provide a top destination IP address report by outbound traffic, ie the top sinks of traffic on the campus network. Assume the ifIndex of the campus interface is 5.

flow-cat -p /flows/krc4 | flow-filter -I5 | flow-stat -f8 -P -p -S3

Provide a top source/destination AS report. Use symbolic names.

flow-cat -p /flows/krc4 | flow-stat -f20 -n -P -p -S4

None known.

Mark Fullmer maf@splintered.net

flow-tools(1) created by instant / docbook-to-man, Thu 11 Feb 2021, 21:34