flow-import 1 flow-import Import flows into flow-tools from other NetFlow packages. flow-import -h -b big|little -d debug_level -f format -m mask_fields -V pdu_version -z z_level The flow-import utility will convert data from cflowd and ASCII CSV files into flow-tools format. -b big|little Byte order of output. -d debug_level Enable debugging. -f format Export format. Supported formats are: 0 cflowd 2 ASCII CSV 3 Cisco NFCollector -h Display help. -m mask_fields Select fields for cflowd and ASCII formats. The mask_fields is built from a bitwise OR of the following: UNIX_SECS 0x0000000000000001LL UNIX_NSECS 0x0000000000000002LL SYSUPTIME 0x0000000000000004LL EXADDR 0x0000000000000008LL DFLOWS 0x0000000000000010LL DPKTS 0x0000000000000020LL DOCTETS 0x0000000000000040LL FIRST 0x0000000000000080LL LAST 0x0000000000000100LL ENGINE_TYPE 0x0000000000000200LL ENGINE_ID 0x0000000000000400LL SRCADDR 0x0000000000001000LL DSTADDR 0x0000000000002000LL SRC_PREFIX 0x0000000000004000LL DST_PREFIX 0x0000000000008000LL NEXTHOP 0x0000000000010000LL INPUT 0x0000000000020000LL OUTPUT 0x0000000000040000LL SRCPORT 0x0000000000080000LL DSTPORT 0x0000000000100000LL PROT 0x0000000000200000LL TOS 0x0000000000400000LL TCP_FLAGS 0x0000000000800000LL SRC_MASK 0x0000000001000000LL DST_MASK 0x0000000002000000LL SRC_AS 0x0000000004000000LL DST_AS 0x0000000008000000LL IN_ENCAPS 0x0000000010000000LL OUT_ENCAPS 0x0000000020000000LL PEER_NEXTHOP 0x0000000040000000LL ROUTER_SC 0x0000000080000000LL EXTRA_PKTS 0x0000000100000000LL MARKED_TOS 0x0000000200000000LL The default value is all fields applicable to the pdu_version. -V pdu_version Use pdu_version format output. 1 NetFlow version 1 (No sequence numbers, AS, or mask) 5 NetFlow version 5 6 NetFlow version 6 (5+ Encapsulation size) 7 NetFlow version 7 (Catalyst switches) 8.1 NetFlow AS Aggregation 8.2 NetFlow Proto Port Aggregation 8.3 NetFlow Source Prefix Aggregation 8.4 NetFlow Destination Prefix Aggregation 8.5 NetFlow Prefix Aggregation 8.6 NetFlow Destination (Catalyst switches) 8.7 NetFlow Source Destination (Catalyst switches) 8.8 NetFlow Full Flow (Catalyst switches) 8.9 NetFlow ToS AS Aggregation 8.10 NetFlow ToS Proto Port Aggregation 8.11 NetFlow ToS Source Prefix Aggregation 8.12 NetFlow ToS Destination Prefix Aggregation 8.13 NetFlow ToS Prefix Aggregation 8.14 NetFlow ToS Prefix Port Aggregation 1005 Flow-Tools tagged version 5 -z z_level Configure compression level to z_level. 0 is disabled (no compression), 9 is highest compression. Convert the cflowd file flows.cflowd to the flow-tools file flows. Store as Version 5 with compression level 5. flow-import -V5 -z5 -f0 < flows.cflowd > flows Convert the ASCII CSV data in flows.ascii to flow-tools format. The ASCII data must include all fields represented by 0xFF31EF in the order listed above. Store as Version 5 with no compression. flow-import -z0 -f2 -m0xFF31EF < flows.ascii > flows The pcap format is a hack. Mark Fullmer maf@splintered.net flow-tools(1)