1<!DOCTYPE refentry PUBLIC "-//Davenport//DTD DocBook V3.0//EN">
2<refentry>
3
4<refmeta>
5<refentrytitle>
6<application>flow-stat</application>
7</refentrytitle>
8<manvolnum>1</manvolnum>
9</refmeta>
10
11<refnamediv>
12<refname>
13<application>flow-stat</application>
14</refname>
15<refpurpose>
16Generate reports with flow data.
17</refpurpose>
18</refnamediv>
19
20<refsynopsisdiv>
21<cmdsynopsis>
22<command>flow-stat</command>
23<arg>-hnpPw</arg>
24<arg>-d<replaceable> debug_level</replaceable></arg>
25<arg>-f<replaceable> format</replaceable></arg>
26<arg>-S<replaceable> sort_field</replaceable></arg>
27<arg>-s<replaceable> sort_field</replaceable></arg>
28<arg>-t<replaceable> tally_lines</replaceable></arg>
29<arg>-T<replaceable> title</replaceable></arg>
30</cmdsynopsis>
31</refsynopsisdiv>
32
33
34<refsect1>
35<title>DESCRIPTION</title>
36<para>
37The <command>flow-stat</command> utility generates usage reports for flow
38data sets by IP address, IP address pairs, ports, packets, bytes,
39interfaces, next hops, autonomous systems, ToS bits, exporters, and tags.
40</para>
41</refsect1>
42
43<refsect1>
44<title>OPTIONS</title>
45<variablelist>
46
47<varlistentry>
48<term>-d<replaceable> debug_level</replaceable></term>
49<listitem>
50<para>
51Enable debugging.
52</para>
53</listitem>
54</varlistentry>
55
56<varlistentry>
57<term>-f<replaceable> format</replaceable></term>
58<listitem>
59<para>
60<literallayout>
61Report format.  Choose from the following:
62
63    0  Overall Summary
64    1  Average packet size distribution
65    2  Packets per flow distribution
66    3  Octets per flow distribution
67    4  Bandwidth per flow distribution
68    5  UDP/TCP destination port
69    6  UDP/TCP source port
70    7  UDP/TCP port
71    8  Destination IP
72    9  Source IP
73    10 Source/Destination IP
74    11 Source or Destination IP
75    12 IP protocol
76    13 octets for flow duration plot data
77    14 packets for flow duration plot data
78    15 short summary
79    16 IP Next Hop
80    17 Input interface
81    18 Output interface
82    19 Source AS
83    20 Destination AS
84    21 Source/Destination AS
85    22 IP ToS
86    23 Input/Output Interface
87    24 Source Prefix
88    25 Destination Prefix
89    26 Source/Destination Prefix
90    27 Exporter IP
91    28 Engine Id
92    29 Engine Type
93    30 Source Tag
94    31 Destination Tag
95    32 Source/Destination Tag
96</literallayout>
97</para>
98</listitem>
99</varlistentry>
100
101<varlistentry>
102<term>-h</term>
103<listitem>
104<para>
105Display help.
106</para>
107</listitem>
108</varlistentry>
109
110<varlistentry>
111<term>-n</term>
112<listitem>
113<para>
114Use symbolic names where appropriate.
115</para>
116</listitem>
117</varlistentry>
118
119<varlistentry>
120<term>-p</term>
121<listitem>
122<para>
123Display header information.
124</para>
125</listitem>
126</varlistentry>
127
128<varlistentry>
129<term>-P</term>
130<listitem>
131<para>
132Report as percent total.
133</para>
134</listitem>
135</varlistentry>
136
137<varlistentry>
138<term>-s<replaceable> sort_field</replaceable></term>
139<listitem>
140<para>
141Sort ascending on field <replaceable>sort_field</replaceable>.
142</para>
143</listitem>
144</varlistentry>
145
146<varlistentry>
147<term>-S<replaceable> sort_field</replaceable></term>
148<listitem>
149<para>
150Sort descending on field <replaceable>sort_field</replaceable>.
151</para>
152</listitem>
153</varlistentry>
154
155<varlistentry>
156<term>-t<replaceable> tally_lines</replaceable></term>
157<listitem>
158<para>
159Tally totals every <replaceable>tally_lines</replaceable>lines.
160</para>
161</listitem>
162</varlistentry>
163
164<varlistentry>
165<term>-T<replaceable> title</replaceable></term>
166<listitem>
167<para>
168Set report title to <replaceable>title</replaceable>.
169</para>
170</listitem>
171</varlistentry>
172
173<varlistentry>
174<term>-w</term>
175<listitem>
176<para>
177Wide output.
178</para>
179</listitem>
180</varlistentry>
181
182</variablelist>
183</refsect1>
184
185<refsect1>
186<title>EXAMPLES</title>
187<informalexample>
188<para>
189Provide a report on top source/destination IP pairs sorted by octets, report
190in percent total form for the flows in <filename>/flows/krc4</filename>.
191Use the preload option to flow-cat to preserve meta information and
192display it with flow-stat.
193</para>
194<para>
195  <command>flow-cat -p /flows/krc4 | flow-stat -f10 -P -p -S4</command>
196</para>
197</informalexample>
198</refsect1>
199
200<refsect1>
201<title>EXAMPLES</title>
202<informalexample>
203<para>
204Many times a campus network will have a single border router which has
205one interface pointing to the internal side and many interfaces pointing
206to other providers.  These interfaces each have a unique numerical id
207known in SNMP terms as an ifIndex.  The ifIndex to interface name mappings
208can be determined by using a tool such as <application>snmpwalk</application>
209or using show commands in recent versions of IOS with the
210'show snmp mib ifmib ifindex' or JunOS 'show interfaces'.  Once the ifIndex
211for each interface is known flow-filter can be combined with flow-stat to
212provide reports such as inbound vs outbound top src/destination IP
213addresses.
214
215Provide a top source IP address report by outbound traffic, ie the top
216senders of traffic on the campus network.  Assume the ifIndex of the
217campus interface is 5.
218</para>
219<para>
220  flow-cat -p /flows/krc4 | flow-filter -i5 | flow-stat -f9 -P -p -S3
221</para>
222</informalexample>
223</refsect1>
224
225<refsect1>
226<title>EXAMPLES</title>
227<informalexample>
228<para>
229Provide a top destination IP address report by outbound traffic, ie the top
230sinks of traffic on the campus network.  Assume the ifIndex of the
231campus interface is 5.
232</para>
233<para>
234  flow-cat -p /flows/krc4 | flow-filter -I5 | flow-stat -f8 -P -p -S3
235</para>
236</informalexample>
237</refsect1>
238
239<refsect1>
240<title>EXAMPLES</title>
241<informalexample>
242<para>
243Provide a top source/destination AS report.  Use symbolic names.
244</para>
245<para>
246  flow-cat -p /flows/krc4 | flow-stat -f20 -n -P -p -S4
247</para>
248</informalexample>
249</refsect1>
250
251
252<refsect1>
253<title>BUGS</title>
254<para>
255None known.
256</para>
257</refsect1>
258
259<refsect1>
260<title>AUTHOR</title>
261<para>
262<author>
263<firstname>Mark</firstname>
264<surname>Fullmer</surname>
265</author>
266<email>maf@splintered.net</email>
267</para>
268</refsect1>
269
270<refsect1>
271<title>SEE ALSO</title>
272<para>
273<application>flow-tools</application>(1)
274</para>
275</refsect1>
276
277</refentry>
278