flow-stat - summarize flows into various reports
flow-stat [ -c comment-char
] [ -d debug-level
] [ -f format
] [ -h?nCpP ] [ -s field
] [ -S field
]
flow-stat summarizes flows into useful reports, many of which can be viewed in gnuplot.
You can select the report style with -f. Current reports include:
Set the comment character for the report.
Set the debug level.
Set the style of report generated.
Get help, list the formats/reports supported.
Print symbolic names.
Summarize IP to classful networks.
Print header.
Print percents.
Sort low to high on field number field.
Sort high to low on field number field.
Top10 list by UDP/TCP source/destination port by octets (a packet with srcport=4567 dstport=80 is counted twice, which usually produces more useful reports for services that live on ports < 1024): S2 sorts in ascending order on field 2 (octets) flow-stat -f7 -S2 < rawflow.08-06-96.8 | head -15
Top10 list by UDP/TCP source/destination port by packets
flow-stat -f7 -S3 < rawflow.08-06-96.8 | head -15
Top10 list by IP source destination by octets (a packet with srcaddr=1.2.3.4 dstaddr=4.5.6 is counted twich, which can make more sense in the case of measuring traffic for an AS at a single border router)
flow-stat -f10 < rawflow.08-06-96.8 | sort -n -r +2 -3 | head -10
Interesting plot of flow duration vs. octets/flow. Duration is the X axis, bytes is y:
flow-stat -f13 < rawflow.08-06-96.8 > plotdata tail -1 plotdata. use the min/max values to setup gnuplot gnuplot> set xrange [1457359112:1460916528] gnuplot> set yrange [0:24261610] gnuplot> plot 'plotdata' with lines
Histogram of byte count of ports < 1024:
cat rawflow.08-06-96.8 | flow-stat -f7 > plotdata gnuplot> set xrange [0:1024] gnuplot> plot 'plotdata
Source/Destination matrix
flow-stat -f10 < rawflow.08-06-96.8
flow-capture(1), flow-cat(1), flow-connect(1), flow-dscan(1),flow-expire(1), flow-export(1), flow-fanout(1), flow-filter(1), flow-gen(1), flow-interfaces(1), flow-print(1), flow-profile(1), flow-receive(1), flow-search(1), flow-send(1), flow-sort(1), flow-stat(1),
flow-stat uses a large stack. For some systems, a limit stacksize 8m may be needed before running it.
flow-stat can't sort the hash tables yet.
flow-stat doesn't do all it says.
...more stats like aspath, histories, etc.