.\" @(#) $Name: cflowd-2-1-b1 $ $Id: flowdump.man.in,v 1.7 1999/05/26 11:01:07 dwm Exp $
.TH flowdump l LOCAL
.SH NAME
flowdump \- utility for selecting and viewing raw flows from a cflowd flow file
.SH SYNOPSIS
flowdump [-v] [-c] [-e filterExpression] [-o outFile] inFile(s)
.SH DESCRIPTION
.I flowdump
is used to select and view raw flows from a \fIcflowd\fR raw flow file.
.SH REQUIRED ARGUMENTS
.IP "\fBinFile(s)"
You must specify one or more \fIinFile(s)\fR on the command line.  The
\fIinFile(s)\fR are raw flow files output from \fIcflowd\fR.  You may use
"-" to indicate standard input (so you can pipe to \fIflowdump\fR).
.SH OPTIONS
.IP "\fB-v"
The \fI-v\fR option causes \fIflowdump\fR to print version information
and exit immediately.
.IP "\fB-c"
The \fI-c\fR option causes \fIflowdump\fR to print the number of flows
matched in the input.  When this options is used, \fIflowdump\fR will
not write an ouput file or print flows on stdout.  If \fI-e
filterExpression\fR is also specified, the reported flow count will be
for those flows which matched the filter expression (i.e. the flows
for which the expression evaluated to true).  The output of this 
option looks something like:
.nf

matched 200325 of 552054 flows
.fi

.IP "\fB-e filterExpression"
The \fI-e filterExpression\fR option can be used to select particular
flows from the \fIinFile(s)\fR.  \fIfilterExpression\fR should be an
expression which will evaluate to true or false.

.nf
Possible flow entry field operands:

   router      router which sent the flow
   srcaddr     source host IP address of flow
   dstaddr     destination host IP address of flow
   inputif     input interface index (ifIndex)
   outputif    output interface index (ifIndex)
   srcport     source port number
   dstport     destination port number
   pkts        packets sent in flow
   bytes       bytes sent in flow
   nexthop     IP nexthop for flow
   starttime   start time of flow
   endtime     end time of flow
   protocol    IP protocol (1 = ICMP, 6 = TCP, etc.)
   tos         IP Type Of Service of flow
   srcas       source AS of flow
   dstas       destination AS of flow
   srcmask     source network mask length (bits)
   dstmask     destination network mask length (bits)
   tcpflags    bitwise OR of all TCP flags seen in flow 
                 (0x10 for non-TCP flows)
   enginetype  flow-export engine type (RSP or VIP)
   engineid    flow-export engine id (identifies VIP adapter)
   all         special keyword, means match all flows
   now         special keyword, means current time

Possible operators:

   <     less than
   <=    less than or equal
   ==    equal
   !=    not equal
   >=    greater than or equal
   >     greater than
   &&    logical AND
   ||    logical OR
   !     logical NOT
   &     bitwise AND
   |     bitwise inclusive OR
   (     left paren
   )     right paren
   /     division
   %     modulo
   *     multiplication
   -     subtraction
   +     addition
   ~     bitwise NOT
.fi

Operator precedence is exactly the same as that in the C programming
language.  Note I *highly* recommend using parentheses in expressions
to make precedence explicit (and obvious).
.IP "\fB-o outFile"
By default, \fIflowdump\fR will show the flows on stdout.  Using the
\fI-o outFile\fR option, you can dump the selected flows into \fIoutFile\fR
and then use \fBflowdump\fR on \fIoutFile\fR.
.SH EXAMPLES
.nf
flowdump -e '(protocol == 6) && (dstas == 2056) && \\
  ((tcpflags & 0x02) == 0x02))' 204.212.46.1.flows.1
.fi
.SH FILES
.IP "\fB@sysconfdir@/cflowd.conf"
The compiled-in default cflowd configuration file.
.SH SEE ALSO
cflowd(l), cflowdmux(l), cfdnets(l), cfdportmatrix(l), cfdifmatrix(l),
cfdprotos(l), cfdnexthops(l), cfdcollect(l)
.SH ACKNOWLEDGEMENTS
.IP "\fBflowdump \fRand documentation written by:"

.br
Daniel W. McRobb
.br
CAIDA, September 1998
.SH RELEASE NAME
@DOC_VERSION@
