flow-fanout(1)						      General Commands Manual						    flow-fanout(1)

NAME

       flow-fanout -- Fanout (replicate) flow exports to many destinations.

SYNOPSIS

       flow-fanout [-h]  [-A AS0_substitution]	[-d debug_level]  [-f filter_fname]  [-F filter_definition]  [-m privacy_mask]	[-p pidfile]  [-s]
       [-S stat_interval]  [-V pdu_version]  [-x xmit_delay] localip/remoteip/port localip/remoteip/port ...

DESCRIPTION

       The flow-fanout utility will replicate flows arriving on localip/remoteip/port to destination(s) specified by localip/remoteip/port.

       Flows processed by multiple exporters will be mixed into a single output stream.  This functionality appeared  to  support  Cisco  Catalyst
       exports and may have other uses.

       A SIGQUIT or SIGTERM signal will cause flow-fanout to exit.

OPTIONS

       -A AS0_substitution
		 Cisco's NetFlow exports represent the local autonomous system as 0 instead of the real value.	This option can be used to replace
		 the 0 in the export with the a configured value.  Unfortunately under certain configurations AS 0 can also represent a cache miss
		 or non forwarded traffic so use with caution.

       -d debug_level
		 Enable debugging.

       -f filter_fname
		 Filter list filename.	Defaults to /etc/flow-tools/cfg/filter.

       -F filter_definition
		 Select the active definition.	Defaults to default.

       -h	 Display help.

       -m privacy_mask
		 Apply	privacy_mask to the source and destination IP address of flows.  For example a privacy_mask of 255.255.255.0 would convert
		 flows with source/destination IP addresses 10.1.1.1 and 10.2.2.2 to 10.1.1.0 and 10.2.2.0 respectively.

       -p pidfile
		 Configure the process ID file.  Use - to disable pid file creation.

       -s	 Spoof the source IP address.  If the IP address is 0 then it is replaced with the exporter source IP.

       -S stat_interval
		 When configured flow-fanout will emit a timestamped message on stderr every stat_interval minutes indicating counters such as the
		 number of flows received, packets processed, and lost flows.

       -V pdu_version
		 Use pdu_version format output.

	   1	NetFlow version 1 (No sequence numbers, AS, or mask)
	   5	NetFlow version 5
	   6	NetFlow version 6 (5+ Encapsulation size)
	   7	NetFlow version 7 (Catalyst switches)
	   8.1	NetFlow AS Aggregation
	   8.2	NetFlow Proto Port Aggregation
	   8.3	NetFlow Source Prefix Aggregation
	   8.4	NetFlow Destination Prefix Aggregation
	   8.5	NetFlow Prefix Aggregation
	   8.6	NetFlow Destination (Catalyst switches)
	   8.7	NetFlow Source Destination (Catalyst switches)
	   8.8	NetFlow Full Flow (Catalyst switches)
	   8.9	NetFlow ToS AS Aggregation
	   8.10 NetFlow ToS Proto Port Aggregation
	   8.11 NetFlow ToS Source Prefix Aggregation
	   8.12 NetFlow ToS Destination Prefix Aggregation
	   8.13 NetFlow ToS Prefix Aggregation
	   8.14 NetFlow ToS Prefix Port Aggregation
	   1005 Flow-Tools tagged version 5

       -x xmit_delay
		 Configure  a microsecond transmit delay between packets.  This may be necessary in some configurations to prevent a transmit buf-
		 fer overrun.

EXAMPLES

       Replicate flows arriving to local IP address 10.0.0.1 from the router exporting with IP address 10.1.1.1 on port  9500  to  localhost  port
       9500 and 10.5.5.5 port 9200.  The exports sent to 10.5.5.5 will be sent with a source IP address of 10.0.0.5 which must be a valid local IP
       address.

	 flow-fanout 10.0.0.1/10.1.1.1/9500 0/0/9500 10.0.0.5/10.5.5.5/9200

BUGS

       NetFlow exports do not contain the exporter IP address inside the payload so the original exporter IP address (typically a router) will	be
       lost when using flow-fanout.  A work around for this protocol limitation is to use local IP aliases and the localip option.

       When the spoofing option is used multiple exporters with different IP addresses will share the same sequence number but will have the orig-
       inal source IP.	Fixing this requires per source : destination sequence number mapping.	It is much easier to just use  multiple  instances
       of flow-fanout running on different ports.

AUTHOR

       Mark Fullmer maf@splintered.net

SEE ALSO

       flow-tools(1)

																    flow-fanout(1)