> > >flow-capture > NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.73 "> > CLASS="REFENTRY" BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#0000FF" VLINK="#840084" ALINK="#0000FF" > > NAME="AEN1" > CLASS="APPLICATION" >flow-capture > > > CLASS="REFNAMEDIV" > NAME="AEN6" > > >Name > CLASS="APPLICATION" >flow-capture > -- Manage storage of flow file archives by expiring old data. > CLASS="REFSYNOPSISDIV" > NAME="AEN10" > > >Synopsis > > CLASS="COMMAND" >flow-capture > [-h] [-A CLASS="REPLACEABLE" > > AS0_substitution > >] [-b CLASS="REPLACEABLE" > > big|little > >] [-C CLASS="REPLACEABLE" > > comment > >] [-c CLASS="REPLACEABLE" > > flow_clients > >] [-d CLASS="REPLACEABLE" > > debug_level > >] [-D CLASS="REPLACEABLE" > > daemonize > >] [-e CLASS="REPLACEABLE" > > expire_count > >] [-f CLASS="REPLACEABLE" > > filter_fname > >] [-F CLASS="REPLACEABLE" > > filter_definition > >] [-E CLASS="REPLACEABLE" > > expire_size > >] [-m CLASS="REPLACEABLE" > > privacy_mask > >] [-n CLASS="REPLACEABLE" > > rotations > >] [-N CLASS="REPLACEABLE" > > nesting_level > >] [-p CLASS="REPLACEABLE" > > pidfile > >] [-R CLASS="REPLACEABLE" > > rotate_program > >] [-S CLASS="REPLACEABLE" > > stat_interval > >] [-t CLASS="REPLACEABLE" > > tag_fname > >] [-T CLASS="REPLACEABLE" > > active_def > >| CLASS="REPLACEABLE" > >active_def,active_def > >...] [-V CLASS="REPLACEABLE" > > pdu_version > >] [-z CLASS="REPLACEABLE" > > z_level > >] {-w CLASS="REPLACEABLE" > > workdir > >} { CLASS="REPLACEABLE" > >localip/remoteip/port > >} > > CLASS="REFSECT1" > NAME="AEN59" > > >DESCRIPTION > >The CLASS="COMMAND" >flow-capture > utility will receive and store NetFlow exports to disk. The flow files are rotated CLASS="REPLACEABLE" > >rotations > >times per day and expiration of old flow files can be configured by number of files or total space utilization. Files are stored in CLASS="FILENAME" >workdir > and can optionally be stored in additional levels of directories. Active files created by CLASS="COMMAND" >flow-capture > begin with 'tmp'. Files that are complete begin with 'ft'. > >When the CLASS="REPLACEABLE" > >remoteip > > is configured only flows from that exporter will be processed, this is the most secure and recommended configuration. When the CLASS="REPLACEABLE" > >localip > > is configured CLASS="COMMAND" >flow-capture > will only process flows sent to the CLASS="REPLACEABLE" > > localip > > IP address. If CLASS="REPLACEABLE" > >remoteip > > is 0 (not configured) flows from any source IP address are accepted. Multiple non aggregated PDU versions may be accepted at once to support Cisco's Catalyst 6500 NetFlow implementation which exports from both the supervisor and MSFC with the same IP address and same port but different export versions. In this case the exports will be stored in the format specified by CLASS="REPLACEABLE" > >pdu_version > > or whichever export type is received first. > >NetFlow exports are UDP and do not employ congestion control or a retransmission mechanism. If the server flow-capture is configured on is too busy, or the network is congested or lossy NetFlow exports will be lost. An estimate of lost flows is recorded in the flow files, and logged via syslog. Most servers will provide a count of dropped packets due to full socket buffers via the CLASS="COMMAND" >netstat > utility. For example CLASS="COMMAND" >netstat -s | grep full > will provide a count of UDP packets dropped due to full socket buffers. If this is a persistent occurrence either CLASS="COMMAND" >flow-capture > will need a larger server or the compression level should be decreased with -z. > >A SIGHUP signal will cause CLASS="COMMAND" >flow-capture > to close the current file and create a new one. > >A SIGQUIT signal will cause CLASS="COMMAND" >flow-capture > to close the current file and exit. > > CLASS="REFSECT1" > NAME="AEN81" > > >OPTIONS > > > CLASS="VARIABLELIST" > > >-A CLASS="REPLACEABLE" > > AS0_substitution > > > > >Cisco's NetFlow exports represent the local autonomous system as 0 instead of the real value. This option can be used to replace the 0 in the export with the a configured value. Unfortunately under certain configurations AS 0 can also represent a cache miss or non forwarded traffic so use with caution. > > >-b CLASS="REPLACEABLE" > > big > >| CLASS="REPLACEABLE" > >little > > > > >Byte order of output. > > >-c CLASS="REPLACEABLE" > > flow_clients > > > > >Enable CLASS="REPLACEABLE" > >flow_clients > > TCP clients. When libwrap is available the client must be in a permit list for the service flow-capture-client. > > >-C CLASS="REPLACEABLE" > > Comment > > > > >Add a comment. > > >-d CLASS="REPLACEABLE" > > debug_level > > > > >Enable debugging. > > >-e CLASS="REPLACEABLE" > > expire_count > > > > >Retain the maximum number of files so that the total file count is less than CLASS="REPLACEABLE" > >expire_count > >. Defaults to 0 (do not expire). > > >-E CLASS="REPLACEABLE" > > expire_size > > > > >Retain the maximum number of files so that the total storage is less than CLASS="REPLACEABLE" > >expire_size > >. The letters b,K,M,G can be used as multipliers, ie 16 Megabytes is 16M. Default to 0 (do not expire). > > >-f CLASS="REPLACEABLE" > > filter_fname > > > > >Filter list filename. Defaults to CLASS="FILENAME" >@localstatedir@/cfg/filter >. > > >-F CLASS="REPLACEABLE" > > filter_definition > > > > >Select the active definition. Defaults to default. > > >-h > > >Display help. > > >-m CLASS="REPLACEABLE" > > privacy_mask > > > > >Apply CLASS="REPLACEABLE" > >privacy_mask > > to the source and destination IP address of flows. For example a privacy_mask of 255.255.255.0 would convert flows with source/destination IP addresses 10.1.1.1 and 10.2.2.2 to 10.1.1.0 and 10.2.2.0 respectively. > > >-n CLASS="REPLACEABLE" > > rotations > > > > >Configure the number of times flow-capture will create a new file per day. The default is 95, or every 15 minutes. > > >-N CLASS="REPLACEABLE" > > nesting_level > > > > >Configure the nesting level for storing flow files. The default is 0. -3 YYYY/YYYY-MM/YYYY-MM-DD/flow-file -2 YYYY-MM/YYYY-MM-DD/flow-file -1 YYYY-MM-DD/flow-file 0 flow-file 1 YYYY/flow-file 2 YYYY/YYYY-MM/flow-file 3 YYYY/YYYY-MM/YYYY-MM-DD/flow-file > > >-p CLASS="REPLACEABLE" > > pidfile > > > > >Configure the process ID file. Use - to disable pid file creation. > > >-R CLASS="REPLACEABLE" > > rotate_program > > > > >Execute CLASS="REPLACEABLE" > >rotate_program > > with the first argument as the flow file name after rotating it. > > >-S CLASS="REPLACEABLE" > > stat_interval > > > > >When configured CLASS="COMMAND" >flow-capture > will log a timestamped message every CLASS="REPLACEABLE" > >stat_interval > > minutes indicating counters such as the number of flows received, packets processed, and lost flows. > > >-t CLASS="REPLACEABLE" > > tag_fname > > > > >Load tags from CLASS="FILENAME" >tag_name > > > >-T CLASS="REPLACEABLE" > > active_def > >| CLASS="REPLACEABLE" > >active_def,active_def... > > > > >Use CLASS="REPLACEABLE" > >active_def > > as the active tag definition(s). > > >-V CLASS="REPLACEABLE" > > pdu_version > > > > >Use CLASS="REPLACEABLE" > >pdu_version > > format output. CLASS="LITERALLAYOUT" > 1 NetFlow version 1 (No sequence numbers, AS, or mask) 5 NetFlow version 5 6 NetFlow version 6 (5+ Encapsulation size) 7 NetFlow version 7 (Catalyst switches) 8.1 NetFlow AS Aggregation 8.2 NetFlow Proto Port Aggregation 8.3 NetFlow Source Prefix Aggregation 8.4 NetFlow Destination Prefix Aggregation 8.5 NetFlow Prefix Aggregation 8.6 NetFlow Destination (Catalyst switches) 8.7 NetFlow Source Destination (Catalyst switches) 8.8 NetFlow Full Flow (Catalyst switches) 8.9 NetFlow ToS AS Aggregation 8.10 NetFlow ToS Proto Port Aggregation 8.11 NetFlow ToS Source Prefix Aggregation 8.12 NetFlow ToS Destination Prefix Aggregation 8.13 NetFlow ToS Prefix Aggregation 8.14 NetFlow ToS Prefix Port Aggregation 1005 Flow-Tools tagged version 5 > > > >-w CLASS="REPLACEABLE" > > workdir > > > > >Work in CLASS="FILENAME" >workdir >. > > >-z CLASS="REPLACEABLE" > > z_level > > > > >Configure compression level to CLASS="REPLACEABLE" > > z_level > >. 0 is disabled (no compression), 9 is highest compression. > > > > > CLASS="REFSECT1" > NAME="AEN204" > > >EXAMPLES > CLASS="INFORMALEXAMPLE" > NAME="AEN206" > > > > >Receive flows from the exporter at 10.0.0.1 port 9800. Maintain 5 Gigabytes of flow files in /flows/krc4. Mask the source and destination IP addresses contained in the flow exports with 255.255.248.0. > > CLASS="COMMAND" >flow-capture -w /flows/krc4 -m 255.255.248.0 -E5G 0/10.0.0.1/9800 > > > > > CLASS="INFORMALEXAMPLE" > NAME="AEN210" > > > > >Receive flows from any exporter on port 9800. Do not perform any flow file space management. Store the exports in /flows/krc4. Emit a stat log message every 5 minutes. > > CLASS="COMMAND" >flow-capture -w /flows/krc4 0/0/9800 -S5 > > > > > > CLASS="REFSECT1" > NAME="AEN214" > > >BUGS > >Empty directories are not removed. > > CLASS="REFSECT1" > NAME="AEN217" > > >AUTHOR > >Mark Fullmer CLASS="EMAIL" >< HREF="mailto:maf@splintered.net" >maf@splintered.net >> > > > CLASS="REFSECT1" > NAME="AEN224" > > >SEE ALSO > > CLASS="APPLICATION" >flow-tools >(1) > > > >
