flow-xlate(1)

NAME
flow-xlate — Apply translations to selected fields of a flow.

SYNOPSIS

flow-xlate [-hkn] [-b big|little] [-C comment] [-d debug_level] [-V flow_version] [-x xlate_fname] [-X xlate_definition] [-z z_level]

DESCRIPTION

The flow-xlate utility is used to apply translations to flows. Translations are composed of actions and a definition to invoke action(s). The definitions are in the form of terms, each term can have a filter and multiple actions.

Translation actions begin with the xlate-action keyword followed by a symbolic name. Each action has a type defined below.

Translation definitions begin with the xlate-definition keyword followed by a symbolic name. Each definition is composed of terms which are evaluated in the order of the configuration file. A term may invoke a filter to conditionally invoke an action.

Action type                             Description/Example
------------------------------------------------------------------------
ip-source-address-to-network            Remove host bits based on mask.
ip-destination-address-to-network       Remove host bits based on mask.
ip-source-address-to-class-network      Remove host bits to match class.
ip-destination-address-to-class-network
                                        Remove host bits to match class.
ip-address-privacy-mask                 Apply a mask to the source and
                                        destination address to remove
                                        bits.
                                         mask 0xFFFFFF00 0xFFFFFF00
scale                                   Scale packets and bytes
                                        scale 100
tag-mask                                Apply mask to the source and
                                        destination tag.
                                        mask 0xFFFFFF00 0xFFFFFFFF
replace-source-as0                      Replace source AS 0
                                        as 3112
replace-destination-as0                 Replace destination AS 0
                                        as 3112

OPTIONS

-b big|little
    Byte order of output.

-C Comment
    Add a comment.

-d debug_level
    Enable debugging.

-h  Display help.

-k  Keep time from input.

-n  Don't load configuration file. Useful only with -V

-V pdu_version
    Use pdu_version format output.

    1    NetFlow version 1 (No sequence numbers, AS, or mask)
    5    NetFlow version 5
    6    NetFlow version 6 (5+ Encapsulation size)
    7    NetFlow version 7 (Catalyst switches)
    8.1  NetFlow AS Aggregation
    8.2  NetFlow Proto Port Aggregation
    8.3  NetFlow Source Prefix Aggregation
    8.4  NetFlow Destination Prefix Aggregation
    8.5  NetFlow Prefix Aggregation
    8.6  NetFlow Destination (Catalyst switches)
    8.7  NetFlow Source Destination (Catalyst switches)
    8.8  NetFlow Full Flow (Catalyst switches)
    8.9  NetFlow ToS AS Aggregation
    8.10 NetFlow ToS Proto Port Aggregation
    8.11 NetFlow ToS Source Prefix Aggregation
    8.12 NetFlow ToS Destination Prefix Aggregation
    8.13 NetFlow ToS Prefix Aggregation
    8.14 NetFlow ToS Prefix Port Aggregation
    1005 Flow-Tools tagged version 5

-x xlate_fname
    Translation config file name. Defaults to /usr/local/var/cfg/xlate.cfg

-X xlate_definition
    Translation definition. Defaults to default.

-z z_level
    Configure compression level to z_level. 0 is disabled (no compression), 9 is highest compression.

EXAMPLES

Convert the version 7 flows in flows.v7 to version 5, storing the result in flows.v5.

  flow-xlate -V5 < flows.v7 > flows.v5

Set the low 11 bits in the IP addresses to zero unless the address is multicast or it belongs to the 192.88.99/24 network.

# xlate.cfg
include-filter filter.cfg
xlate-action MULTICAST-PRIVACY
  type ip-address-privacy-mask
  mask 0xFFFFFFFF 0xFFFFFFFF

xlate-action UNICAST-PRIVACY
  type ip-address-privacy-mask
  mask 0xFFFFFF00 0xFFFFF800
xlate-definition abilene_privacy
  term
    filter mcast
    action MULTICAST-PRIVACY
    stop
  term
    filter ucast
    action UNICAST-PRIVACY

# filter.cfg
filter-primitive MCAST
  type ip-address-mask
  permit 224.0.0.0 240.0.0.0
filter-primitive UCAST
  type ip-address-mask
  deny 224.0.0.0 240.0.0.0
  default permit
filter-primitive SKIP
  type ip-address-mask
  deny 192.88.99.0 255.255.255.0
filter-definition mcast
  match ip-destination-address MCAST
filter-definition ucast
  match ip-destination-address UCAST
  match ip-destination-address SKIP
  match ip-source-address SKIP

flow-cat flows | flow-xlate -xxlate.cfg -Xabilene_privacy | flow-print

BUGS

The scale option can overflow the 32 bit flow counters. This could be solved by detecting this condition and splitting the flow in two.

Translation between aggregated and non aggregated formats is not supported.

AUTHOR

Mark Fullmer maf@splintered.net

SEE ALSO

flow-tools(1)