— Fanout (replicate) flow exports to many
[-h] [-A AS0_substitution
] [-d debug_level
] [-F filter_definition
] [-p pidfile
] [-s] [-S stat_interval
] [-x xmit_delay
utility will replicate flows arriving on
localip/remoteip/port to destination(s) specified by localip/remoteip/port.
Flows processed by multiple exporters will be mixed into a single output stream.
This functionality appeared to support Cisco Catalyst exports and may have
A SIGQUIT or SIGTERM signal will cause flow-fanout
- -A AS0_substitution
- Cisco's NetFlow exports represent the local autonomous
system as 0 instead of the real value. This option can be used to replace
the 0 in the export with the a configured value. Unfortunately under
certain configurations AS 0 can also represent a cache miss or non
forwarded traffic so use with caution.
- -d debug_level
- Enable debugging.
- -f filter_fname
- Filter list filename. Defaults to
- -F filter_definition
- Select the active definition. Defaults to default.
- Display help.
- -m privacy_mask
- Apply privacy_mask to the source and destination IP
address of flows. For example a privacy_mask of 255.255.255.0 would
convert flows with source/destination IP addresses 10.1.1.1 and 10.2.2.2
to 10.1.1.0 and 10.2.2.0 respectively.
- -p pidfile
- Configure the process ID file. Use - to disable pid file
- Spoof the source IP address. If the IP address is 0 then it
is replaced with the exporter source IP.
- -S stat_interval
- When configured flow-fanout will emit a timestamped
message on stderr every stat_interval minutes indicating counters
such as the number of flows received, packets processed, and lost
- -V pdu_version
- Use pdu_version format output.
1 NetFlow version 1 (No sequence numbers, AS, or mask)
5 NetFlow version 5
6 NetFlow version 6 (5+ Encapsulation size)
7 NetFlow version 7 (Catalyst switches)
8.1 NetFlow AS Aggregation
8.2 NetFlow Proto Port Aggregation
8.3 NetFlow Source Prefix Aggregation
8.4 NetFlow Destination Prefix Aggregation
8.5 NetFlow Prefix Aggregation
8.6 NetFlow Destination (Catalyst switches)
8.7 NetFlow Source Destination (Catalyst switches)
8.8 NetFlow Full Flow (Catalyst switches)
8.9 NetFlow ToS AS Aggregation
8.10 NetFlow ToS Proto Port Aggregation
8.11 NetFlow ToS Source Prefix Aggregation
8.12 NetFlow ToS Destination Prefix Aggregation
8.13 NetFlow ToS Prefix Aggregation
8.14 NetFlow ToS Prefix Port Aggregation
1005 Flow-Tools tagged version 5
- -x xmit_delay
- Configure a microsecond transmit delay between packets.
This may be necessary in some configurations to prevent a transmit buffer
Replicate flows arriving to local IP address 10.0.0.1 from the router exporting
with IP address 10.1.1.1 on port 9500 to localhost port 9500 and 10.5.5.5 port
9200. The exports sent to 10.5.5.5 will be sent with a source IP address of
10.0.0.5 which must be a valid local IP address.
flow-fanout 10.0.0.1/10.1.1.1/9500 0/0/9500 10.0.0.5/10.5.5.5/9200
NetFlow exports do not contain the exporter IP address inside the payload so the
original exporter IP address (typically a router) will be lost when using
. A work around for this protocol limitation is to use local
IP aliases and the localip
When the spoofing option is used multiple exporters with different IP addresses
will share the same sequence number but will have the original source IP.
Fixing this requires per source : destination sequence number mapping. It is
much easier to just use multiple instances of flow-fanout running on different
Mark Fullmer email@example.com