flow-split(1) [debian man page]

flow-split(1)						      General Commands Manual						     flow-split(1)

NAME

       flow-split -- Split flow files into smaller files.

SYNOPSIS

       flow-split [-gGhn]  [-b big|little]  [-C comment]  [-d debug_level]  [-N nflows]  [-o outfile_basename]	[-T nseconds]  [-z z_level]

DESCRIPTION

       The flow-split utility will split a flow file into smaller files based on the the number of flows or the ammount of time that has passed.

OPTIONS

       -b big|little
		 Byte order of output.

       -C Comment
		 Add a comment.

       -d debug_level
		 Enable debugging.

       -g	 Split on source tag.

       -G	 Split on destination tag.

       -h	 Display help.

       -n	 Use symbols for tag field in filename.

       -N nflows Split after processing nflows.

       -o outfile_basename
		 The basename of the resulting files.

       -T nsecond
		 Split after processing an interval of nseconds flows.

       -z z_level
		 Configure compression level to  z_level.  0 is disabled (no compression), 9 is highest compression.

EXAMPLES

       Create 1 minute flow files from the flow archive in /flows/krc4.  Store the results in /flows/krc4.split

	 flow-cat /flows/krc4 | flow-split -T60 -o /flows/krc4.split/1min.

BUGS

       None known.

AUTHOR

       Mark Fullmer maf@splintered.net

SEE ALSO

       flow-tools(1)

																     flow-split(1)

flow-cat(1)						      General Commands Manual						       flow-cat(1)

NAME

       flow-cat -- Concatenate flow files

SYNOPSIS

       flow-cat  [-aghmp]   [-b  big|little]   [-C  comment]   [-d  debug_level]   [-o	filename]   [-t start_time]  [-T start_time]  [-z z_level]
       [file|directory ...]

DESCRIPTION

       The flow-cat utility processes files and/or directories of files in the flow-tools format.  The resulting concatenated data set is  written
       to the standard output or file specified by -o.	If file is a single dash (`-') or absent, flow-cat will read from the standard input.

OPTIONS

       -a	 Do not ignore filenames that begin with tmp.

       -b big|little
		 Byte order of output.

       -C Comment
		 Add a comment.

       -d debug_level
		 Enable debugging.

       -g	 Sort file list by capture start time before processing.

       -h	 Display help.

       -m	 Disable the use of mmap().

       -p	 Preload headers.  Use to preserve meta information such as lost flows.

       -o file	 Write to file instead of the standard out.

       -t start_time
		 Select flow files up to start_time.  If used with -T select files between start_time and end_time.

       -T end_time
		 Select flow files after end_time.  If used with -t select files between start_time and end_time.

       -z z_level
		 Configure compression level to  z_level.  0 is disabled (no compression), 9 is highest compression.

       file|directory...
		 Process the files and/or directory.

TIME
/DATE parsing
       start_time  and	end_time  parsing  is  implemented with getdate.y, a commonly used function to process free-form time date specifications.
       Example usage borrowed from cvs:
	   1 month ago
	   2 hours ago
	   400000 seconds ago
	   last year
	   last Monday
	   yesterday
	   a fortnight ago
	   3/31/92 10:00:07 PST
	   January 23, 1987 10:05pm
	   22:00 GMT

EXAMPLES

       Concatenate all flow files begining with ft-v05.2001-05.01, use flow-print to display the results.

	   flow-cat ft-v05.2001-05-01.* | flow-print

       Concatenate flow files in /flows/krc4, store store the output in compressed.flows at compression level 9 (best).  The headers are preloaded
       so  various  metadata  such  as	the flow count is correct in the result.  Filenames begining with tmp which are typically in-progress flow
       files from flow-capture are not processed.

	   flow-cat -p -z9 /flows/krc4 > compressed.flows

BUGS

       None known.

AUTHOR

       Mark Fullmer maf@splintered.net

SEE ALSO

       flow-tools(1)

																       flow-cat(1)