flow-import(1)						      General Commands Manual						    flow-import(1)

NAME

       flow-import -- Import flows into flow-tools from other NetFlow packages.

SYNOPSIS

       flow-import [-h]  [-b big|little]  [-d debug_level]  [-f format]  [-m mask_fields]  [-V pdu_version]  [-z z_level]

DESCRIPTION

       The flow-import utility will convert data from cflowd and ASCII CSV files into flow-tools format.

OPTIONS

       -b big|little
		 Byte order of output.

       -d debug_level
		 Enable debugging.

       -f format Export format.  Supported formats are:

	 0 cflowd
	 2 ASCII CSV
	 3 Cisco NFCollector

       -h	 Display help.

       -m mask_fields
		 Select fields for cflowd and ASCII formats.  The mask_fields is built from a bitwise OR of the following:

	   UNIX_SECS	   0x0000000000000001LL
	   UNIX_NSECS	   0x0000000000000002LL
	   SYSUPTIME	   0x0000000000000004LL
	   EXADDR	   0x0000000000000008LL

	   DFLOWS	   0x0000000000000010LL
	   DPKTS	   0x0000000000000020LL
	   DOCTETS	   0x0000000000000040LL
	   FIRST	   0x0000000000000080LL

	   LAST 	   0x0000000000000100LL
	   ENGINE_TYPE	   0x0000000000000200LL
	   ENGINE_ID	   0x0000000000000400LL

	   SRCADDR	   0x0000000000001000LL
	   DSTADDR	   0x0000000000002000LL
	   SRC_PREFIX	   0x0000000000004000LL
	   DST_PREFIX	   0x0000000000008000LL
	   NEXTHOP	   0x0000000000010000LL
	   INPUT	   0x0000000000020000LL
	   OUTPUT	   0x0000000000040000LL
	   SRCPORT	   0x0000000000080000LL

	   DSTPORT	   0x0000000000100000LL
	   PROT 	   0x0000000000200000LL
	   TOS		   0x0000000000400000LL
	   TCP_FLAGS	   0x0000000000800000LL

	   SRC_MASK	   0x0000000001000000LL
	   DST_MASK	   0x0000000002000000LL
	   SRC_AS	   0x0000000004000000LL
	   DST_AS	   0x0000000008000000LL

	   IN_ENCAPS	   0x0000000010000000LL
	   OUT_ENCAPS	   0x0000000020000000LL
	   PEER_NEXTHOP    0x0000000040000000LL
	   ROUTER_SC	   0x0000000080000000LL
	   EXTRA_PKTS	   0x0000000100000000LL
	   MARKED_TOS	   0x0000000200000000LL

		 The default value is all fields applicable to the pdu_version.

       -V pdu_version
		 Use pdu_version format output.

	   1	NetFlow version 1 (No sequence numbers, AS, or mask)
	   5	NetFlow version 5
	   6	NetFlow version 6 (5+ Encapsulation size)
	   7	NetFlow version 7 (Catalyst switches)
	   8.1	NetFlow AS Aggregation
	   8.2	NetFlow Proto Port Aggregation
	   8.3	NetFlow Source Prefix Aggregation
	   8.4	NetFlow Destination Prefix Aggregation
	   8.5	NetFlow Prefix Aggregation
	   8.6	NetFlow Destination (Catalyst switches)
	   8.7	NetFlow Source Destination (Catalyst switches)
	   8.8	NetFlow Full Flow (Catalyst switches)
	   8.9	NetFlow ToS AS Aggregation
	   8.10 NetFlow ToS Proto Port Aggregation
	   8.11 NetFlow ToS Source Prefix Aggregation
	   8.12 NetFlow ToS Destination Prefix Aggregation
	   8.13 NetFlow ToS Prefix Aggregation
	   8.14 NetFlow ToS Prefix Port Aggregation
	   1005 Flow-Tools tagged version 5

       -z z_level
		 Configure compression level to  z_level.  0 is disabled (no compression), 9 is highest compression.

EXAMPLES

       Convert the cflowd file flows.cflowd to the flow-tools file flows.  Store as Version 5 with compression level 5.

	 flow-import -V5 -z5 -f0 < flows.cflowd > flows

EXAMPLES

       Convert	the  ASCII  CSV  data  in flows.ascii to flow-tools format.  The ASCII data must include all fields represented by 0xFF31EF in the
       order listed above.  Store as Version 5 with no compression.

	 flow-import -z0 -f2 -m0xFF31EF < flows.ascii > flows

BUGS

       The pcap format is a hack.

AUTHOR

       Mark Fullmer maf@splintered.net

SEE ALSO

       flow-tools(1)

																    flow-import(1)