netflow,抓包

								>				>				>flow-merge				>				NAME="GENERATOR"				CONTENT="Modular DocBook HTML Stylesheet Version 1.71				">				>				CLASS="REFENTRY"				BGCOLOR="#FFFFFF"				TEXT="#000000"				LINK="#0000FF"				VLINK="#840084"				ALINK="#0000FF"				>				>				NAME="AEN1"				>				CLASS="APPLICATION"				>flow-merge				>				>				>				CLASS="REFNAMEDIV"				>				NAME="AEN6"				>				>				>Name				>				CLASS="APPLICATION"				>flow-merge				> -- Merge flow files.				>				CLASS="REFSYNOPSISDIV"				>				NAME="AEN10"				>				>				>Synopsis				>				>				CLASS="COMMAND"				>flow-merge				>  [-aghm] [-b				CLASS="REPLACEABLE"				>				> big				>				>|				CLASS="REPLACEABLE"				>				>little				>				>] [-C				CLASS="REPLACEABLE"				>				> comment				>				>] [-d				CLASS="REPLACEABLE"				>				> debug_level				>				>] [-o				CLASS="REPLACEABLE"				>				> filename				>				>] [-z				CLASS="REPLACEABLE"				>				> z_level				>				>] [				CLASS="REPLACEABLE"				>				>file				>				>|				CLASS="REPLACEABLE"				>				>directory				>				>...]				>				>				CLASS="REFSECT1"				>				NAME="AEN28"				>				>				>DESCRIPTION				>				>The 				CLASS="COMMAND"				>flow-merge				> utility processes files and/or directories				of files in the flow-tools format.  The resulting merged data set is				written to the standard output or 				CLASS="FILENAME"				>file				> specified by								CLASS="OPTION"				>-o				>.  If 				CLASS="FILENAME"				>file				> is a single dash (`-')				or absent, flow-merge will read from the standard input.  Unlike flow-cat,				flow-merge interleaves flow records preserving the relative chronological				order.				>				>				CLASS="REFSECT1"				>				NAME="AEN35"				>				>				>OPTIONS				>				>				>				CLASS="VARIABLELIST"				>				>				>-a				>				>				>Do not ignore filenames that begin with 				CLASS="FILENAME"				>tmp				>.				>				>				>-b				CLASS="REPLACEABLE"				>				> big				>				>|				CLASS="REPLACEABLE"				>				>little				>				>				>				>				>Byte order of output.				>				>				>-C				CLASS="REPLACEABLE"				>				> Comment				>				>				>				>				>Add a comment.				>				>				>-d				CLASS="REPLACEABLE"				>				> debug_level				>				>				>				>				>Enable debugging.				>				>				>-g				>				>				>Sort file list by capture start time before processing.				>				>				>-h				>				>				>Display help.				>				>				>-m				>				>				>Disable the use of mmap().				>				>				>-p				>				>				>Preload headers.  Use to preserve meta information such as lost flows.				>				>				>-o				CLASS="REPLACEABLE"				>				> file				>				>				>				>				>Write to 				CLASS="FILENAME"				>file				> instead of the standard out.				>				>				>-z				CLASS="REPLACEABLE"				>				> z_level				>				>				>				>				>Configure compression level to 				CLASS="REPLACEABLE"				>				> z_level				>				>.  0 is				disabled (no compression), 9 is highest compression.				>				>				>				CLASS="REPLACEABLE"				>				>file				>				>|				CLASS="REPLACEABLE"				>				>directory...				>				>				>				>				>Process the files and/or directory.				>				>				>				>				>				CLASS="REFSECT1"				>				NAME="AEN93"				>				>				>EXAMPLES				>				CLASS="INFORMALEXAMPLE"				>				NAME="AEN95"				>				>				>				>				>Merge all flow files begining with ft-v05.2001-05.01, use 				flow-print to display the results.				>				>    				CLASS="COMMAND"				>flow-merge ft-v05.2001-05-01.* | flow-print				>				>				>				>				>				>				CLASS="REFSECT1"				>				NAME="AEN99"				>				>				>BUGS				>				>None known.				>				>				CLASS="REFSECT1"				>				NAME="AEN102"				>				>				>AUTHOR				>				>Larry Lidz								CLASS="EMAIL"				><				HREF="mailto:ellidz@eridu.uchicago.edu"				>ellidz@eridu.uchicago.edu				>>				>				>				>				CLASS="REFSECT1"				>				NAME="AEN109"				>				>				>SEE ALSO				>				>				CLASS="APPLICATION"				>flow-tools				>(1)				>				>				>				>