flow-receive(1) 					      General Commands Manual						   flow-receive(1)

NAME

       flow-receive -- Receive flow data with the NetFlow protocol.

SYNOPSIS

       flow-receive  [-h]   [-b  big|little]  [-C comment]  [-d debug_level]  [-o output_file]	[-S stat_interval]  [-V pdu_version]  [-z z_level]
       localip/remoteip/port

DESCRIPTION

       The flow-receive utility is used to receive flows in NetFlow format.  When the remoteip is configured only flows from that exporter will be
       processed, this is the most secure and recommended configuration.  When the localip is configured flow-receive will only process flows sent
       to the  localip IP address.  If remoteip is 0 (not configured) flows from any source IP address are accepted.  Multiple non aggregated  PDU
       versions  may  be  accepted at once to support Cisco's Catalyst 6500 NetFlow implementation which exports from both the supervisor and MSFC
       with the same IP address and same port but different export versions.  In this case the exports will be stored in the format  specified	by
       the -V flag or whichever export type is received first.

OPTIONS

       -b big|little
		 Byte order of output.

       -C Comment
		 Add a comment.

       -d debug_level
		 Enable debugging.

       -h	 Display help.

       -o file	 Write to file instead of the standard out.

       -S stat_interval
		 When  configured  flow-receive  will emit a timestamped message on stderr every stat_interval minutes indicating counters such as
		 the number of flows received, packets processed, and lost flows.

       -V pdu_version
		 Use pdu_version format output.

       1    NetFlow version 1 (No sequence numbers, AS, or mask)
       5    NetFlow version 5
       6    NetFlow version 6 (5+ Encapsulation size)
       7    NetFlow version 7 (Catalyst switches)
       8.1  NetFlow AS Aggregation
       8.2  NetFlow Proto Port Aggregation
       8.3  NetFlow Source Prefix Aggregation
       8.4  NetFlow Destination Prefix Aggregation
       8.5  NetFlow Prefix Aggregation
       8.6  NetFlow Destination (Catalyst switches)
       8.7  NetFlow Source Destination (Catalyst switches)
       8.8  NetFlow Full Flow (Catalyst switches)
       8.9  NetFlow ToS AS Aggregation
       8.10 NetFlow ToS Proto Port Aggregation
       8.11 NetFlow ToS Source Prefix Aggregation
       8.12 NetFlow ToS Destination Prefix Aggregation
       8.13 NetFlow ToS Prefix Aggregation
       8.14 NetFlow ToS Prefix Port Aggregation
       1005 Flow-Tools tagged version 5

       -z z_level
		 Configure compression level to  z_level.  0 is disabled (no compression), 9 is highest compression.

EXAMPLES

       Listen on port 9800 on any local interface for exports from IP address 10.0.0.1, store the exports in flows

       flow-receive 0/10.0.0.1/9800 > flows

       Listen on port 9800 on any local interface from any IP address, display the received flows with flow-print.

       flow-receive 0/0/9800 | flow-print

BUGS

       It is not currently possible to convert between the aggregated formats (8.x) and the non aggregated formats (1,5,6,7).

AUTHOR

       Mark Fullmer maf@splintered.net

SEE ALSO

       flow-tools(1)

																   flow-receive(1)