1<!DOCTYPE refentry PUBLIC "-//Davenport//DTD DocBook V3.0//EN"> 2<refentry> 3 4<refmeta> 5<refentrytitle> 6<application>flow-stat</application> 7</refentrytitle> 8<manvolnum>1</manvolnum> 9</refmeta> 10 11<refnamediv> 12<refname> 13<application>flow-stat</application> 14</refname> 15<refpurpose> 16Generate reports with flow data. 17</refpurpose> 18</refnamediv> 19 20<refsynopsisdiv> 21<cmdsynopsis> 22<command>flow-stat</command> 23<arg>-hnpPw</arg> 24<arg>-d<replaceable> debug_level</replaceable></arg> 25<arg>-f<replaceable> format</replaceable></arg> 26<arg>-S<replaceable> sort_field</replaceable></arg> 27<arg>-s<replaceable> sort_field</replaceable></arg> 28<arg>-t<replaceable> tally_lines</replaceable></arg> 29<arg>-T<replaceable> title</replaceable></arg> 30</cmdsynopsis> 31</refsynopsisdiv> 32 33 34<refsect1> 35<title>DESCRIPTION</title> 36<para> 37The <command>flow-stat</command> utility generates usage reports for flow 38data sets by IP address, IP address pairs, ports, packets, bytes, 39interfaces, next hops, autonomous systems, ToS bits, exporters, and tags. 40</para> 41</refsect1> 42 43<refsect1> 44<title>OPTIONS</title> 45<variablelist> 46 47<varlistentry> 48<term>-d<replaceable> debug_level</replaceable></term> 49<listitem> 50<para> 51Enable debugging. 52</para> 53</listitem> 54</varlistentry> 55 56<varlistentry> 57<term>-f<replaceable> format</replaceable></term> 58<listitem> 59<para> 60<literallayout> 61Report format. Choose from the following: 62 63 0 Overall Summary 64 1 Average packet size distribution 65 2 Packets per flow distribution 66 3 Octets per flow distribution 67 4 Bandwidth per flow distribution 68 5 UDP/TCP destination port 69 6 UDP/TCP source port 70 7 UDP/TCP port 71 8 Destination IP 72 9 Source IP 73 10 Source/Destination IP 74 11 Source or Destination IP 75 12 IP protocol 76 13 octets for flow duration plot data 77 14 packets for flow duration plot data 78 15 short summary 79 16 IP Next Hop 80 17 Input interface 81 18 Output interface 82 19 Source AS 83 20 Destination AS 84 21 Source/Destination AS 85 22 IP ToS 86 23 Input/Output Interface 87 24 Source Prefix 88 25 Destination Prefix 89 26 Source/Destination Prefix 90 27 Exporter IP 91 28 Engine Id 92 29 Engine Type 93 30 Source Tag 94 31 Destination Tag 95 32 Source/Destination Tag 96</literallayout> 97</para> 98</listitem> 99</varlistentry> 100 101<varlistentry> 102<term>-h</term> 103<listitem> 104<para> 105Display help. 106</para> 107</listitem> 108</varlistentry> 109 110<varlistentry> 111<term>-n</term> 112<listitem> 113<para> 114Use symbolic names where appropriate. 115</para> 116</listitem> 117</varlistentry> 118 119<varlistentry> 120<term>-p</term> 121<listitem> 122<para> 123Display header information. 124</para> 125</listitem> 126</varlistentry> 127 128<varlistentry> 129<term>-P</term> 130<listitem> 131<para> 132Report as percent total. 133</para> 134</listitem> 135</varlistentry> 136 137<varlistentry> 138<term>-s<replaceable> sort_field</replaceable></term> 139<listitem> 140<para> 141Sort ascending on field <replaceable>sort_field</replaceable>. 142</para> 143</listitem> 144</varlistentry> 145 146<varlistentry> 147<term>-S<replaceable> sort_field</replaceable></term> 148<listitem> 149<para> 150Sort descending on field <replaceable>sort_field</replaceable>. 151</para> 152</listitem> 153</varlistentry> 154 155<varlistentry> 156<term>-t<replaceable> tally_lines</replaceable></term> 157<listitem> 158<para> 159Tally totals every <replaceable>tally_lines</replaceable>lines. 160</para> 161</listitem> 162</varlistentry> 163 164<varlistentry> 165<term>-T<replaceable> title</replaceable></term> 166<listitem> 167<para> 168Set report title to <replaceable>title</replaceable>. 169</para> 170</listitem> 171</varlistentry> 172 173<varlistentry> 174<term>-w</term> 175<listitem> 176<para> 177Wide output. 178</para> 179</listitem> 180</varlistentry> 181 182</variablelist> 183</refsect1> 184 185<refsect1> 186<title>EXAMPLES</title> 187<informalexample> 188<para> 189Provide a report on top source/destination IP pairs sorted by octets, report 190in percent total form for the flows in <filename>/flows/krc4</filename>. 191Use the preload option to flow-cat to preserve meta information and 192display it with flow-stat. 193</para> 194<para> 195 <command>flow-cat -p /flows/krc4 | flow-stat -f10 -P -p -S4</command> 196</para> 197</informalexample> 198</refsect1> 199 200<refsect1> 201<title>EXAMPLES</title> 202<informalexample> 203<para> 204Many times a campus network will have a single border router which has 205one interface pointing to the internal side and many interfaces pointing 206to other providers. These interfaces each have a unique numerical id 207known in SNMP terms as an ifIndex. The ifIndex to interface name mappings 208can be determined by using a tool such as <application>snmpwalk</application> 209or using show commands in recent versions of IOS with the 210'show snmp mib ifmib ifindex' or JunOS 'show interfaces'. Once the ifIndex 211for each interface is known flow-filter can be combined with flow-stat to 212provide reports such as inbound vs outbound top src/destination IP 213addresses. 214 215Provide a top source IP address report by outbound traffic, ie the top 216senders of traffic on the campus network. Assume the ifIndex of the 217campus interface is 5. 218</para> 219<para> 220 flow-cat -p /flows/krc4 | flow-filter -i5 | flow-stat -f9 -P -p -S3 221</para> 222</informalexample> 223</refsect1> 224 225<refsect1> 226<title>EXAMPLES</title> 227<informalexample> 228<para> 229Provide a top destination IP address report by outbound traffic, ie the top 230sinks of traffic on the campus network. Assume the ifIndex of the 231campus interface is 5. 232</para> 233<para> 234 flow-cat -p /flows/krc4 | flow-filter -I5 | flow-stat -f8 -P -p -S3 235</para> 236</informalexample> 237</refsect1> 238 239<refsect1> 240<title>EXAMPLES</title> 241<informalexample> 242<para> 243Provide a top source/destination AS report. Use symbolic names. 244</para> 245<para> 246 flow-cat -p /flows/krc4 | flow-stat -f20 -n -P -p -S4 247</para> 248</informalexample> 249</refsect1> 250 251 252<refsect1> 253<title>BUGS</title> 254<para> 255None known. 256</para> 257</refsect1> 258 259<refsect1> 260<title>AUTHOR</title> 261<para> 262<author> 263<firstname>Mark</firstname> 264<surname>Fullmer</surname> 265</author> 266<email>maf@splintered.net</email> 267</para> 268</refsect1> 269 270<refsect1> 271<title>SEE ALSO</title> 272<para> 273<application>flow-tools</application>(1) 274</para> 275</refsect1> 276 277</refentry> 278