.\" Automatically generated by Pod::Man 4.10 (Pod::Simple 3.35)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings.  \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
.\" nothing in troff, for use with C<>.
.tr \(*W-
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
.    ds -- \(*W-
.    ds PI pi
.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
.    ds L" ""
.    ds R" ""
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds -- \|\(em\|
.    ds PI \(*p
.    ds L" ``
.    ds R" ''
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
.    if \nF \{\
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{\
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\" ========================================================================
.\"
.IX Title "Cflow 3pm"
.TH Cflow 3pm "2019-01-28" "perl v5.28.1" "User Contributed Perl Documentation"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH "NAME"
Cflow::find \- find "interesting" flows in raw IP flow files
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
.Vb 1
\&   use Cflow;
\&
\&   Cflow::verbose(1);
\&   Cflow::find(\e&wanted, <*.flows*>);
\&
\&   sub wanted { ... }
.Ve
.PP
or:
.PP
.Vb 1
\&   Cflow::find(\e&wanted, \e&perfile, <*.flows*>);
\&
\&   sub perfile { 
\&      my $fname = shift;
\&      ...
\&   }
.Ve
.SH "BACKROUND"
.IX Header "BACKROUND"
This module implements an \s-1API\s0 for processing \s-1IP\s0 flow accounting
information which as been collected from routers and written into flow
files by one of the various flow collectors listed below.
.PP
It was originally conceived and written for use by FlowScan:
.PP
.Vb 1
\&   http://net.doit.wisc.edu/~plonka/FlowScan/
.Ve
.SH "Flow File Sources"
.IX Header "Flow File Sources"
This package is of little use on its own.  It requires input in the
form of time-stamped raw flow files produced by other software
packages.  These \*(L"flow sources\*(R" either snoop a local ethernet (via
libpcap) or collect flow information from \s-1IP\s0 routers that are
configured to export said information.  The following flow sources are
supported:
.IP "argus by Carter Bullard:" 4
.IX Item "argus by Carter Bullard:"
.Vb 1
\&   http://www.qosient.com/argus/
.Ve
.IP "flow-tools by Mark Fullmer (with NetFlow v1, v5, v6, or v7):" 4
.IX Item "flow-tools by Mark Fullmer (with NetFlow v1, v5, v6, or v7):"
.Vb 1
\&   http://www.splintered.net/sw/flow\-tools/
.Ve
.IP "\s-1CAIDA\s0's cflowd (with NetFlow v5):" 4
.IX Item "CAIDA's cflowd (with NetFlow v5):"
.Vb 2
\&   http://www.caida.org/tools/measurement/cflowd/
\&   http://net.doit.wisc.edu/~plonka/cflowd/
.Ve
.IP "lfapd by Steve Premeau (with LFAPv4):" 4
.IX Item "lfapd by Steve Premeau (with LFAPv4):"
.Vb 1
\&   http://www.nmops.org/
.Ve
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
\&\fBCflow::find()\fR will iterate across all the flows in the specified
files.  It will call your \fBwanted()\fR function once per flow record.  If
the file name argument passed to \fBfind()\fR is specified as \*(L"\-\*(R", flows will
be read from standard input.
.PP
The \fBwanted()\fR function does whatever you write it to do.  For instance,
it could simply print interesting flows or it might maintain byte,
packet, and flow counters which could be written to a database after
the find subroutine completes.
.PP
Within your \fBwanted()\fR function, tests on the \*(L"current\*(R" flow can be
performed using the following variables:
.ie n .IP "$Cflow::unix_secs" 4
.el .IP "\f(CW$Cflow::unix_secs\fR" 4
.IX Item "$Cflow::unix_secs"
secs since epoch (deprecated)
.ie n .IP "$Cflow::exporter" 4
.el .IP "\f(CW$Cflow::exporter\fR" 4
.IX Item "$Cflow::exporter"
Exporter \s-1IP\s0 Address as a host-ordered \*(L"long\*(R"
.ie n .IP "$Cflow::exporterip" 4
.el .IP "\f(CW$Cflow::exporterip\fR" 4
.IX Item "$Cflow::exporterip"
Exporter \s-1IP\s0 Address as dotted-decimal string
.ie n .IP "$Cflow::localtime" 4
.el .IP "\f(CW$Cflow::localtime\fR" 4
.IX Item "$Cflow::localtime"
\&\f(CW$Cflow::unix_secs\fR interpreted as localtime with this \fBstrftime\fR\|(3) format:
.Sp
.Vb 1
\&   %Y/%m/%d %H:%M:%S
.Ve
.ie n .IP "$Cflow::srcaddr" 4
.el .IP "\f(CW$Cflow::srcaddr\fR" 4
.IX Item "$Cflow::srcaddr"
Source \s-1IP\s0 Address as a host-ordered \*(L"long\*(R"
.ie n .IP "$Cflow::srcip" 4
.el .IP "\f(CW$Cflow::srcip\fR" 4
.IX Item "$Cflow::srcip"
Source \s-1IP\s0 Address as a dotted-decimal string
.ie n .IP "$Cflow::dstaddr" 4
.el .IP "\f(CW$Cflow::dstaddr\fR" 4
.IX Item "$Cflow::dstaddr"
Destination \s-1IP\s0 Address as a host-ordered \*(L"long\*(R"
.ie n .IP "$Cflow::dstip" 4
.el .IP "\f(CW$Cflow::dstip\fR" 4
.IX Item "$Cflow::dstip"
Destination \s-1IP\s0 Address as a dotted-decimal string
.ie n .IP "$Cflow::input_if" 4
.el .IP "\f(CW$Cflow::input_if\fR" 4
.IX Item "$Cflow::input_if"
Input interface index
.ie n .IP "$Cflow::output_if" 4
.el .IP "\f(CW$Cflow::output_if\fR" 4
.IX Item "$Cflow::output_if"
Output interface index
.ie n .IP "$Cflow::srcport" 4
.el .IP "\f(CW$Cflow::srcport\fR" 4
.IX Item "$Cflow::srcport"
\&\s-1TCP/UDP\s0 src port number or equivalent
.ie n .IP "$Cflow::dstport" 4
.el .IP "\f(CW$Cflow::dstport\fR" 4
.IX Item "$Cflow::dstport"
\&\s-1TCP/UDP\s0 dst port number or equivalent
.ie n .IP "$Cflow::ICMPType" 4
.el .IP "\f(CW$Cflow::ICMPType\fR" 4
.IX Item "$Cflow::ICMPType"
high byte of \f(CW$Cflow::dstport\fR
.Sp
Undefined if the current flow is not an \s-1ICMP\s0 flow.
.ie n .IP "$Cflow::ICMPCode" 4
.el .IP "\f(CW$Cflow::ICMPCode\fR" 4
.IX Item "$Cflow::ICMPCode"
low byte of \f(CW$Cflow::dstport\fR
.Sp
Undefined if the current flow is not an \s-1ICMP\s0 flow.
.ie n .IP "$Cflow::ICMPTypeCode" 4
.el .IP "\f(CW$Cflow::ICMPTypeCode\fR" 4
.IX Item "$Cflow::ICMPTypeCode"
symbolic representation of \f(CW$Cflow::dstport\fR
.Sp
The value is a the type-specific \s-1ICMP\s0 code, if any, followed by the \s-1ICMP\s0 type.
E.g.
.Sp
.Vb 2
\&   ECHO
\&   HOST_UNREACH
.Ve
.Sp
Undefined if the current flow is not an \s-1ICMP\s0 flow.
.ie n .IP "$Cflow::pkts" 4
.el .IP "\f(CW$Cflow::pkts\fR" 4
.IX Item "$Cflow::pkts"
Packets sent in Duration
.ie n .IP "$Cflow::bytes" 4
.el .IP "\f(CW$Cflow::bytes\fR" 4
.IX Item "$Cflow::bytes"
Octets sent in Duration
.ie n .IP "$Cflow::nexthop" 4
.el .IP "\f(CW$Cflow::nexthop\fR" 4
.IX Item "$Cflow::nexthop"
Next hop router's \s-1IP\s0 Address as a host-ordered \*(L"long\*(R"
.ie n .IP "$Cflow::nexthopip" 4
.el .IP "\f(CW$Cflow::nexthopip\fR" 4
.IX Item "$Cflow::nexthopip"
Next hop router's \s-1IP\s0 Address as a dotted-decimal string
.ie n .IP "$Cflow::startime" 4
.el .IP "\f(CW$Cflow::startime\fR" 4
.IX Item "$Cflow::startime"
secs since epoch at start of flow
.ie n .IP "$Cflow::start_msecs" 4
.el .IP "\f(CW$Cflow::start_msecs\fR" 4
.IX Item "$Cflow::start_msecs"
fractional portion of startime (in milliseconds)
.Sp
This will be zero unless the source is flow-tools or argus.
.ie n .IP "$Cflow::endtime" 4
.el .IP "\f(CW$Cflow::endtime\fR" 4
.IX Item "$Cflow::endtime"
secs since epoch at last packet of flow
.ie n .IP "$Cflow::end_msecs" 4
.el .IP "\f(CW$Cflow::end_msecs\fR" 4
.IX Item "$Cflow::end_msecs"
fractional portion of endtime (in milliseconds)
.Sp
This will be zero unless the source is flow-tools or argus.
.ie n .IP "$Cflow::protocol" 4
.el .IP "\f(CW$Cflow::protocol\fR" 4
.IX Item "$Cflow::protocol"
\&\s-1IP\s0 protocol number (as is specified in \fI/etc/protocols\fR, i.e.
1=ICMP, 6=TCP, 17=UDP, etc.)
.ie n .IP "$Cflow::tos" 4
.el .IP "\f(CW$Cflow::tos\fR" 4
.IX Item "$Cflow::tos"
\&\s-1IP\s0 Type-of-Service
.ie n .IP "$Cflow::tcp_flags" 4
.el .IP "\f(CW$Cflow::tcp_flags\fR" 4
.IX Item "$Cflow::tcp_flags"
bitwise \s-1OR\s0 of all \s-1TCP\s0 flags that were set within packets in the flow;
0x10 for non-TCP flows
.ie n .IP "$Cflow::TCPFlags" 4
.el .IP "\f(CW$Cflow::TCPFlags\fR" 4
.IX Item "$Cflow::TCPFlags"
symbolic representation of \f(CW$Cflow::tcp_flags\fR
The value will be a bitwise-or expression.
E.g.
.Sp
.Vb 1
\&   PUSH|SYN|FIN|ACK
.Ve
.Sp
Undefined if the current flow is not a \s-1TCP\s0 flow.
.ie n .IP "$Cflow::raw" 4
.el .IP "\f(CW$Cflow::raw\fR" 4
.IX Item "$Cflow::raw"
the entire \*(L"packed\*(R" flow record as read from the input file
.Sp
This is useful when the \*(L"wanted\*(R" subroutine wants to
write the flow to another \s-1FILEHANDLE. E\s0.g.:
.Sp
.Vb 1
\&   syswrite(FILEHANDLE, $Cflow::raw, length $Cflow::raw)
.Ve
.ie n .IP "$Cflow::reraw" 4
.el .IP "\f(CW$Cflow::reraw\fR" 4
.IX Item "$Cflow::reraw"
the entire \*(L"re-packed\*(R" flow record formatted like \f(CW$Cflow::raw\fR.
.Sp
This is useful when the \*(L"wanted\*(R" subroutine wants to write a modified flow
to another \s-1FILEHANDLE. E\s0.g.:
.Sp
.Vb 3
\&   $srcaddr = my_encode($srcaddr);
\&   $dstaddr = my_encode($dstaddr);
\&   syswrite(FILEHANDLE, $Cflow::reraw, length $Cflow::raw)
.Ve
.Sp
These flow variables are packed into \f(CW$Cflow::reraw:\fR
.Sp
.Vb 12
\&   $Cflow::index, $Cflow::exporter,
\&   $Cflow::srcaddr, $Cflow::dstaddr,
\&   $Cflow::input_if, $Cflow::output_if,
\&   $Cflow::srcport, $Cflow::dstport,
\&   $Cflow::pkts, $Cflow::bytes,
\&   $Cflow::nexthop,
\&   $Cflow::startime, $Cflow::endtime,
\&   $Cflow::protocol, $Cflow::tos,
\&   $Cflow::src_as, $Cflow::dst_as,
\&   $Cflow::src_mask, $Cflow::dst_mask,
\&   $Cflow::tcp_flags,
\&   $Cflow::engine_type, $Cflow::engine_id
.Ve
.ie n .IP "$Cflow::Bps" 4
.el .IP "\f(CW$Cflow::Bps\fR" 4
.IX Item "$Cflow::Bps"
the minimum bytes per second for the current flow
.ie n .IP "$Cflow::pps" 4
.el .IP "\f(CW$Cflow::pps\fR" 4
.IX Item "$Cflow::pps"
the minimum packets per second for the current flow
.PP
The following variables are undefined if using NetFlow v1 (which does
not contain the requisite information):
.ie n .IP "$Cflow::src_as" 4
.el .IP "\f(CW$Cflow::src_as\fR" 4
.IX Item "$Cflow::src_as"
originating or peer \s-1AS\s0 of source address
.ie n .IP "$Cflow::dst_as" 4
.el .IP "\f(CW$Cflow::dst_as\fR" 4
.IX Item "$Cflow::dst_as"
originating or peer \s-1AS\s0 of destination address
.PP
The following variables are undefined if using NetFlow v1 or LFAPv4
(which do not contain the requisite information):
.ie n .IP "$Cflow::src_mask" 4
.el .IP "\f(CW$Cflow::src_mask\fR" 4
.IX Item "$Cflow::src_mask"
source address prefix mask bits
.ie n .IP "$Cflow::dst_mask" 4
.el .IP "\f(CW$Cflow::dst_mask\fR" 4
.IX Item "$Cflow::dst_mask"
destination address prefix mask bits
.ie n .IP "$Cflow::engine_type" 4
.el .IP "\f(CW$Cflow::engine_type\fR" 4
.IX Item "$Cflow::engine_type"
type of flow switching engine
.ie n .IP "$Cflow::engine_id" 4
.el .IP "\f(CW$Cflow::engine_id\fR" 4
.IX Item "$Cflow::engine_id"
\&\s-1ID\s0 of the flow switching engine
.PP
Optionally, a reference to a \fBperfile()\fR function can be passed to
Cflow::find as the argument following the reference to the \fBwanted()\fR
function.  This \fBperfile()\fR function will be called once for each flow
file.  The argument to the \fBperfile()\fR function will be name of the flow
file which is about to be processed.  The purpose of the \fBperfile()\fR
function is to allow you to periodically report the progress of
\&\fBCflow::find()\fR and to provide an opportunity to periodically reclaim
storage used by data objects that may have been allocated or maintained
by the \fBwanted()\fR function.  For instance, when counting the number of
active hosts \s-1IP\s0 addresses in each time-stamped flow file, \fBperfile()\fR can
reset the counter to zero and clear the search tree or hash used to
remember those \s-1IP\s0 addresses.
.PP
Since Cflow is an Exporter, you can request that all those scalar
flow variables be exported (so that you need not use the \*(L"Cflow::\*(R"
prefix):
.PP
.Vb 1
\&   use Cflow qw(:flowvars);
.Ve
.PP
Also, you can request that the symbolic names for the \s-1TCP\s0 flags,
\&\s-1ICMP\s0 types, and/or \s-1ICMP\s0 codes be exported:
.PP
.Vb 1
\&   use Cflow qw(:tcpflags :icmptypes :icmpcodes);
.Ve
.PP
The tcpflags are:
.PP
.Vb 1
\&   $TH_FIN $TH_SYN $TH_RST $TH_PUSH $TH_ACK $TH_URG
.Ve
.PP
The icmptypes are:
.PP
.Vb 5
\&   $ICMP_ECHOREPLY     $ICMP_DEST_UNREACH $ICMP_SOURCE_QUENCH
\&   $ICMP_REDIRECT      $ICMP_ECHO         $ICMP_TIME_EXCEEDED
\&   $ICMP_PARAMETERPROB $ICMP_TIMESTAMP    $ICMP_TIMESTAMPREPLY
\&   $ICMP_INFO_REQUEST  $ICMP_INFO_REPLY   $ICMP_ADDRESS
\&   $ICMP_ADDRESSREPLY
.Ve
.PP
The icmpcodes are:
.PP
.Vb 8
\&   $ICMP_NET_UNREACH  $ICMP_HOST_UNREACH $ICMP_PROT_UNREACH
\&   $ICMP_PORT_UNREACH $ICMP_FRAG_NEEDED  $ICMP_SR_FAILED
\&   $ICMP_NET_UNKNOWN  $ICMP_HOST_UNKNOWN $ICMP_HOST_ISOLATED
\&   $ICMP_NET_ANO      $ICMP_HOST_ANO     $ICMP_NET_UNR_TOS
\&   $ICMP_HOST_UNR_TOS $ICMP_PKT_FILTERED $ICMP_PREC_VIOLATION
\&   $ICMP_PREC_CUTOFF  $ICMP_UNREACH      $ICMP_REDIR_NET
\&   $ICMP_REDIR_HOST   $ICMP_REDIR_NETTOS $ICMP_REDIR_HOSTTOS
\&   $ICMP_EXC_TTL      $ICMP_EXC_FRAGTIME
.Ve
.PP
Please note that the names above are not necessarily exactly the same
as the names of the flags, types, and codes as set in the values of the
aforemented \f(CW$Cflow::TCPFlags\fR and \f(CW$Cflow::ICMPTypeCode\fR flow variables.
.PP
Lastly, as is usually the case for modules, the subroutine names can be
imported, and a minimum version of Cflow can be specified:
.PP
.Vb 1
\&   use Cflow qw(:flowvars find verbose 1.031);
.Ve
.PP
\&\fBCflow::find()\fR returns a \*(L"hit-ratio\*(R".  This hit-ratio is a string
formatted similarly to that of the value of a perl hash when taken in a
scalar context.  This hit-ratio indicates ((# of \*(L"wanted\*(R" flows) / (#
of scanned flows)).  A flow is considered to have been \*(L"wanted\*(R" if your
\&\fBwanted()\fR function returns non-zero.
.PP
\&\fBCflow::verbose()\fR takes a single scalar boolean argument which indicates
whether or not you wish warning messages to be generated to \s-1STDERR\s0 when
\&\*(L"problems\*(R" occur.  Verbose mode is set by default.
.SH "EXAMPLES"
.IX Header "EXAMPLES"
Here's a complete example with a sample wanted function.  It will print
all \s-1UDP\s0 flows that involve either a source or destination port of 31337
and port on the other end that is unreserved (greater than 1024):
.PP
.Vb 1
\&   use Cflow qw(:flowvars find);
\&
\&   my $udp = getprotobyname(\*(Aqudp\*(Aq);
\&   verbose(0);
\&   find(\e&wanted, @ARGV? @ARGV : <*.flows*>);
\&
\&   sub wanted {
\&      return if ($srcport < 1024 || $dstport < 1024);
\&      return unless (($srcport == 31337 || $dstport == 31337) &&
\&                      $udp == $protocol);
\&
\&      printf("%s %15.15s.%\-5hu %15.15s.%\-5hu %2hu %10u %10u\en",
\&             $localtime,
\&             $srcip,
\&             $srcport,
\&             $dstip,
\&             $dstport,
\&             $protocol,
\&             $pkts,
\&             $bytes)
\&   }
.Ve
.PP
Here's an example which demonstrates a technique which can be used to
pass arbitrary arguments to your wanted function by passing a reference
to an anonymous subroutine as the \fBwanted()\fR function argument to
\&\fBCflow::find()\fR:
.PP
.Vb 4
\&   sub wanted {
\&      my @params = @_;
\&      # ...
\&   }
\&
\&   Cflow::find(sub { wanted(@params) }, @files);
.Ve
.SH "ARGUS NOTES"
.IX Header "ARGUS NOTES"
Argus uses a bidirectional flow model.  This means that some argus
flows represent packets not only in the forward direction (from
\&\*(L"source\*(R" to \*(L"destination\*(R"), but also in the reverse direction (from the
so-called \*(L"destination\*(R" to the \*(L"source\*(R").  However, this module uses a
unidirection flow model, and therfore splits some argus flows into two
unidirectional flows for the purpose of reporting.
.PP
Currently, using this module's \s-1API\s0 there is no way to determine if two
subsequently reported unidirectional flows were really a single argus
flow.  This may be addressed in a future release of this package.
.PP
Furthermore, for argus flows which represent bidirectional \s-1ICMP\s0
traffic, this module presumes that all the reverse packets were
ECHOREPLYs (sic).  This is sometimes incorrect as described here:
.PP
.Vb 1
\&   http://www.theorygroup.com/Archive/Argus/2002/msg00016.html
.Ve
.PP
and will be fixed in a future release of this package.
.PP
Timestamps ($startime and \f(CW$endtime\fR) are sometimes reported incorrectly
for bidirectional argus flows that represent only one packet in each
direction.  This will be fixed in a future release.
.PP
Argus flows sometimes contain information which does not map directly
to the flow variables presented by this module.  For the time being,
this information is simply not accessible through this module's \s-1API.\s0
This may be addressed in a future release.
.PP
Lastly, argus flows produced from observed traffic on a local ethernet
do not contain enough information to meaningfully set the values of all
this module's flow variables.  For instance, the next-hop and
input/output ifIndex numbers are missing.  For the time being, all
argus flows accessed throught this module's \s-1API\s0 will have both the
\&\f(CW$input_if\fR and \f(CW$output_if\fR as 42.  Althought 42 is the answer to life,
the universe, and everthing, in this context, it is just an arbitrary
number.  It is important that \f(CW$output_if\fR is non-zero, however, since
existing FlowScan reports interpret an \f(CW$output_if\fR value of zero to mean
that the traffic represented by that flow was not forwarded (i.e.
dropped).  For similar reasons, the \f(CW$nexthopip\fR for all argus flows is
reported as \*(L"127.0.0.1\*(R".
.SH "BUGS"
.IX Header "BUGS"
Currently, only NetFlow version 5 is supported when reading
cflowd-format raw flow files.
.PP
When built with support for flow-tools and attempting to read
a cflowd format raw flow file from standard input, you'll get the
error:
.PP
.Vb 1
\&   open "\-": No such file or directory
.Ve
.PP
For the time being, the workaround is to write the content to a file
and read it from directly from there rather than from standard input.
(This happens because we can't close and re-open file descriptor zero
after determining that the content was not in flow-tools format.)
.PP
When built with support for flow-tools and using verbose mode,
Cflow::find will generate warnings if you process a cflowd format raw
flow file.  This happens because it will first attempt to open the file
as a flow-tools format raw flow file (which will produce a warning
message), and then revert to handling it as cflowd format raw flow
file.
.PP
Likewise, when built with support for argus and attempting to read a
cflowd format raw flow file from standard input, you'll get this
warning message:
.PP
.Vb 1
\&   not Argus\-2.0 data stream.
.Ve
.PP
This is because argus (as of argus\-2.0.4) doesn't seem to have a mode
in which such warning messages are supressed.
.PP
The \f(CW$Cflow::raw\fR flow variable contains the flow record in cflowd
format, even if it was read from a raw flow file produced by flow-tools
or argus.  Because cflowd discards the fractional portion of the flow
start and end time, only the whole seconds portion of these times will
be retained.  (That is, the raw record in \f(CW$Cflow::raw\fR does not contain
the \f(CW$start_msecs\fR and \f(CW$end_msecs\fR, so using \f(CW$Cflow::raw\fR to convert to
cflowd format is a lossy operation.)
.PP
When used with cflowd, \fBCflow::find()\fR will generate warnings if the flow
data file is \*(L"invalid\*(R" as far as its concerned.  To avoid this, you
must be using Cisco version 5 flow-export and configure cflowd so that
it saves all flow-export data.  This is the default behavior when
cflowd produces time-stamped raw flow files after being patched as
described here:
.PP
.Vb 1
\&   http://net.doit.wisc.edu/~plonka/cflowd/
.Ve
.SH "NOTES"
.IX Header "NOTES"
The interface presented by this package is a blatant ripoff of
File::Find.
.SH "AUTHOR"
.IX Header "AUTHOR"
Dave Plonka <plonka@doit.wisc.edu>
.PP
Copyright (C) 1998\-2002  Dave Plonka.
This program is free software; you can redistribute it and/or modify it
under the terms of the \s-1GNU\s0 General Public License as published by the
Free Software Foundation; either version 2 of the License, or (at your
option) any later version.
.SH "VERSION"
.IX Header "VERSION"
The version number is the module file \s-1RCS\s0 revision number (\fB\f(CB$Revision:\fB 1.51 $\fR)
with the minor number printed right justified with leading zeroes to 3
decimal places.  For instance, \s-1RCS\s0 revision 1.1 would yield a package
version number of 1.001.
.PP
This is so that revision 1.10 (which is version 1.010), for example,
will test greater than revision 1.2 (which is version 1.002) when you
want to \fBrequire\fR a minimum version of this module.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
\&\fBperl\fR\|(1), Socket, Net::Netmask, Net::Patricia.