flow-stat(1)						      General Commands Manual						      flow-stat(1)

NAME

       flow-stat -- Generate reports with flow data.

SYNOPSIS

       flow-stat [-hnpPw]  [-d debug_level]  [-f format]  [-S sort_field]  [-s sort_field]  [-t tally_lines]  [-T title]

DESCRIPTION

       The  flow-stat  utility generates usage reports for flow data sets by IP address, IP address pairs, ports, packets, bytes, interfaces, next
       hops, autonomous systems, ToS bits, exporters, and tags.

OPTIONS

       -d debug_level
		 Enable debugging.

       -f format

       Report format.  Choose from the following:

	   0  Overall Summary
	   1  Average packet size distribution
	   2  Packets per flow distribution
	   3  Octets per flow distribution
	   4  Bandwidth per flow distribution
	   5  UDP/TCP destination port
	   6  UDP/TCP source port
	   7  UDP/TCP port
	   8  Destination IP
	   9  Source IP
	   10 Source/Destination IP
	   11 Source or Destination IP
	   12 IP protocol
	   13 octets for flow duration plot data
	   14 packets for flow duration plot data
	   15 short summary
	   16 IP Next Hop
	   17 Input interface
	   18 Output interface
	   19 Source AS
	   20 Destination AS
	   21 Source/Destination AS
	   22 IP ToS
	   23 Input/Output Interface
	   24 Source Prefix
	   25 Destination Prefix
	   26 Source/Destination Prefix
	   27 Exporter IP
	   28 Engine Id
	   29 Engine Type
	   30 Source Tag
	   31 Destination Tag
	   32 Source/Destination Tag

       -h	 Display help.

       -n	 Use symbolic names where appropriate.

       -p	 Display header information.

       -P	 Report as percent total.

       -s sort_field
		 Sort ascending on field sort_field.

       -S sort_field
		 Sort descending on field sort_field.

       -t tally_lines
		 Tally totals every tally_lineslines.

       -T title  Set report title to title.

       -w	 Wide output.

EXAMPLES

       Provide a report on top source/destination IP pairs sorted by octets, report in percent total form for the flows in /flows/krc4.   Use  the
       preload option to flow-cat to preserve meta information and display it with flow-stat.

	 flow-cat -p /flows/krc4 | flow-stat -f10 -P -p -S4

EXAMPLES

       Many  times  a  campus  network	will have a single border router which has one interface pointing to the internal side and many interfaces
       pointing to other providers.  These interfaces each have a unique numerical id known in SNMP terms as an ifIndex.  The ifIndex to interface
       name  mappings  can be determined by using a tool such as snmpwalk or using show commands in recent versions of IOS with the 'show snmp mib
       ifmib ifindex' or JunOS 'show interfaces'.  Once the ifIndex for each interface is known flow-filter can be combined with flow-stat to pro-
       vide reports such as inbound vs outbound top src/destination IP addresses.

       Provide a top source IP address report by outbound traffic, ie the top senders of traffic on the campus network.  Assume the ifIndex of the
       campus interface is 5.

	 flow-cat -p /flows/krc4 | flow-filter -i5 | flow-stat -f9 -P -p -S3

EXAMPLES

       Provide a top destination IP address report by outbound traffic, ie the top sinks of traffic on the campus network.  Assume the ifIndex	of
       the campus interface is 5.

	 flow-cat -p /flows/krc4 | flow-filter -I5 | flow-stat -f8 -P -p -S3

EXAMPLES

       Provide a top source/destination AS report.  Use symbolic names.

	 flow-cat -p /flows/krc4 | flow-stat -f20 -n -P -p -S4

BUGS

       None known.

AUTHOR

       Mark Fullmer maf@splintered.net

SEE ALSO

       flow-tools(1)

																      flow-stat(1)