FLOW-STAT(1)

NAME
flow-stat - Generate reports with flow data.

SYNOPSIS

flow-stat [ -hnpPw ] [ -d debug_level ] [ -f format ] [ -S sort_field ] [ -s sort_field ] [ -t tally_lines ] [ -T title ]

DESCRIPTION

The flow-stat utility generates usage reports for flow data sets by IP address, IP address pairs, ports, packets, bytes, interfaces, next hops, autonomous systems, ToS bits, exporters, and tags.

OPTIONS

-d debug_level
    Enable debugging.

-f format

    Report format.  Choose from the following:
        0  Overall Summary
        1  Average packet size distribution
        2  Packets per flow distribution
        3  Octets per flow distribution
        4  Bandwidth per flow distribution
        5  UDP/TCP destination port
        6  UDP/TCP source port
        7  UDP/TCP port
        8  Destination IP
        9  Source IP
        10 Source/Destination IP
        11 Source or Destination IP
        12 IP protocol
        13 octets for flow duration plot data
        14 packets for flow duration plot data
        15 short summary
        16 IP Next Hop
        17 Input interface
        18 Output interface
        19 Source AS
        20 Destination AS
        21 Source/Destination AS
        22 IP ToS
        23 Input/Output Interface
        24 Source Prefix
        25 Destination Prefix
        26 Source/Destination Prefix
        27 Exporter IP
        28 Engine Id
        29 Engine Type
        30 Source Tag
        31 Destination Tag
        32 Source/Destination Tag

-h  Display help.

-n  Use symbolic names where appropriate.

-p  Display header information.

-P  Report as percent total.

-s sort_field
    Sort ascending on field sort_field.

-S sort_field
    Sort descending on field sort_field.

-t tally_lines
    Tally totals every tally_lineslines.

-T title
    Set report title to title.

-w  Wide output.

EXAMPLES

Provide a report on top source/destination IP pairs sorted by octets, report in percent total form for the flows in /flows/krc4. Use the preload option to flow-cat to preserve meta information and display it with flow-stat.

flow-cat -p /flows/krc4 | flow-stat -f10 -P -p -S4

EXAMPLES

Many times a campus network will have a single border router which has one interface pointing to the internal side and many interfaces pointing to other providers. These interfaces each have a unique numerical id known in SNMP terms as an ifIndex. The ifIndex to interface name mappings can be determined by using a tool such as snmpwalk or using show commands in recent versions of IOS with the 'show snmp mib ifmib ifindex' or JunOS 'show interfaces'. Once the ifIndex for each interface is known flow-filter can be combined with flow-stat to provide reports such as inbound vs outbound top src/destination IP addresses. Provide a top source IP address report by outbound traffic, ie the top senders of traffic on the campus network. Assume the ifIndex of the campus interface is 5.

flow-cat -p /flows/krc4 | flow-filter -i5 | flow-stat -f9 -P -p -S3

EXAMPLES

Provide a top destination IP address report by outbound traffic, ie the top sinks of traffic on the campus network. Assume the ifIndex of the campus interface is 5.

flow-cat -p /flows/krc4 | flow-filter -I5 | flow-stat -f8 -P -p -S3

EXAMPLES

Provide a top source/destination AS report. Use symbolic names.

flow-cat -p /flows/krc4 | flow-stat -f20 -n -P -p -S4

BUGS

None known.

AUTHOR

Mark Fullmer <maf@splintered.net>

SEE ALSO

flow-tools(1)