.\" @(#) $Name: cflowd-2-1-b1 $ $Id: flowwatch.man.in,v 1.4 1999/05/26 11:01:08 dwm Exp $
.TH flowwatch l LOCAL
.SH NAME
flowwatch \- utility for selecting and viewing flows in real time
.SH SYNOPSIS
flowwatch [-v] [-c configFile] [-o outFile] filterExpression
.SH DESCRIPTION
.I flowwatch
is used to select and view flows in real time as they are received
by \fIcflowdmux\fR.
.SH WARNING
\fIflowwatch\fR is slow due to its use of a flex lexer and re-evaluation
of the \fIfilterExpression\fR for every flow.  You should be careful
using it at this point in time, since it could cause a bottleneck in
the cflowd system (which will cause \fIcflowdmux\fR to miss flows).
.SH REQUIRED ARGUMENTS
.IP "\fBfilterExpression"
The \fIfilterExpression\fR is used to select particular
flows.  \fIfilterExpression\fR should be an expression which will 
evaluate to true or false.

.nf
Possible flow entry field operands:

   router      router which sent the flow
   srcaddr     source host IP address of flow
   dstaddr     destination host IP address of flow
   inputif     input interface index (ifIndex)
   outputif    output interface index (ifIndex)
   srcport     source port number
   dstport     destination port number
   pkts        packets sent in flow
   bytes       bytes sent in flow
   nexthop     IP nexthop for flow
   starttime   start time of flow
   endtime     end time of flow
   protocol    IP protocol (1 = ICMP, 6 = TCP, etc.)
   tos         IP Type Of Service of flow
   srcas       source AS of flow
   dstas       destination AS of flow
   srcmask     source network mask length (bits)
   dstmask     destination network mask length (bits)
   tcpflags    bitwise OR of all TCP flags seen in flow 
                 (0x10 for non-TCP flows)
   enginetype  flow-export engine type (RSP or VIP)
   engineid    flow-export engine id (identifies VIP adapter)
   all         special keyword, means match all flows
   now         special keyword, means current time

Possible operators:

   <     less than
   <=    less than or equal
   ==    equal
   !=    not equal
   >=    greater than or equal
   >     greater than
   &&    logical AND
   ||    logical OR
   !     logical NOT
   &     bitwise AND
   |     bitwise inclusive OR
   (     left paren
   )     right paren
   /     division
   %     modulo
   *     multiplication
   -     subtraction
   +     addition
   ~     bitwise NOT
.fi

Operator precedence is exactly the same as that in the C programming
language.  Using parentheses in expressions to make precedence 
explicit (and obvious) is recommended.
.SH OPTIONS
.IP "\fB-v"
The \fI-v\fR option causes \fIflowwatch\fR to print version information
and exit immediately.
.IP "\fB-c configFile"
The \fI-c configfile\fR option can be used to specify a cflowd
configuration file.  If not specified, a compiled-in default will be
used.
.IP "\fB-o outFile"
By default, \fIflowwatch\fR will show the flows on stdout.  Using the
\fI-o outFile\fR option, you can dump the selected flows into \fIoutFile\fR
and then use \fBflowdump\fR on \fIoutFile\fR.

.SH EXAMPLES
.nf
flowwatch '(protocol == 6) && (dstas == 2056) && \\
  ((tcpflags & 0x02) == 0x02))'
.fi
.SH FILES
.IP "\fB@sysconfdir@/cflowd.conf"
The compiled-in default cflowd configuration file.
.SH SEE ALSO
flowdump(l), cflowd(l), cflowdmux(l), cfdnets(l), cfdportmatrix(l), 
cfdifmatrix(l), cfdprotos(l), cfdnexthops(l), cfdcollect(l)
.SH ACKNOWLEDGEMENTS
.IP "\fBflowwatch\fR and documentation written by:"

.br
Daniel W. McRobb
.br
CAIDA, October 1998
.SH RELEASE NAME
@DOC_VERSION@
