.TH "\fBflow-receive\fP" "1" 
.SH "NAME" 
\fBflow-receive\fP \(em Receive flow data with the NetFlow protocol. 
.SH "SYNOPSIS" 
.PP 
\fBflow-receive\fR [\-h]  [\-b\fI big|little\fR]  [\-C\fI comment\fR]  [\-d\fI debug_level\fR]  [\-o\fI output_file\fR]  [\-S\fI stat_interval\fR]  [\-V\fI pdu_version\fR]  [\-z\fI z_level\fR] \fIlocalip/remoteip/port\fR  
.SH "DESCRIPTION" 
.PP 
The \fBflow-receive\fR utility is used to receive flows in NetFlow 
format.  When the \fIremoteip\fR is configured only flows 
from that exporter will be processed, this is the most secure and recommended 
configuration.  When the \fIlocalip\fR is configured 
\fBflow-receive\fR will only process flows 
sent to the \fI localip\fR IP address.  If 
\fIremoteip\fR is 0 (not configured) flows from any 
source IP address are accepted.  Multiple non aggregated PDU versions may 
be accepted at once to support Cisco's Catalyst 6500 NetFlow 
implementation which exports from both the supervisor and MSFC with the 
same IP address and same port but different export versions.  In this case 
the exports will be stored in the format specified by the \-V flag or 
whichever export type is received first. 
 
.SH "OPTIONS" 
.IP "\-b\fI big\fR|\fIlittle\fR" 10 
Byte order of output. 
.IP "\-C\fI Comment\fR" 10 
Add a comment. 
.IP "\-d\fI debug_level\fR" 10 
Enable debugging. 
.IP "\-h" 10 
Display help. 
.IP "\-o\fI file\fR" 10 
Write to \fBfile\fP instead of the standard out. 
.IP "\-S\fI stat_interval\fR" 10 
When configured \fBflow-receive\fR will emit a timestamped 
message on stderr every \fIstat_interval\fR minutes 
indicating counters such as the number of flows received, packets processed, 
and lost flows. 
.IP "\-V\fI pdu_version\fR" 10 
Use \fIpdu_version\fR format output. 
.PP 
.nf 
1    NetFlow version 1 (No sequence numbers, AS, or mask) 
5    NetFlow version 5 
6    NetFlow version 6 (5+ Encapsulation size) 
7    NetFlow version 7 (Catalyst switches) 
8.1  NetFlow AS Aggregation 
8.2  NetFlow Proto Port Aggregation 
8.3  NetFlow Source Prefix Aggregation 
8.4  NetFlow Destination Prefix Aggregation 
8.5  NetFlow Prefix Aggregation 
8.6  NetFlow Destination (Catalyst switches) 
8.7  NetFlow Source Destination (Catalyst switches) 
8.8  NetFlow Full Flow (Catalyst switches) 
8.9  NetFlow ToS AS Aggregation 
8.10 NetFlow ToS Proto Port Aggregation 
8.11 NetFlow ToS Source Prefix Aggregation 
8.12 NetFlow ToS Destination Prefix Aggregation 
8.13 NetFlow ToS Prefix Aggregation 
8.14 NetFlow ToS Prefix Port Aggregation 
1005 Flow-Tools tagged version 5 
.fi 
.IP "\-z\fI z_level\fR" 10 
Configure compression level to \fI z_level\fR.  0 is 
disabled (no compression), 9 is highest compression.    
.SH "EXAMPLES" 
.PP 
Listen on port 9800 on any local interface for exports from IP address 
10.0.0.1, store the exports in \fBflows\fP 
.PP 
\fBflow-receive\fR 0/10.0.0.1/9800 > \fBflows\fP 
.PP 
Listen on port 9800 on any local interface from any IP address, display 
the received flows with flow-print. 
.PP 
\fBflow-receive\fR 0/0/9800 | \fBflow-print\fR 
.SH "BUGS" 
.PP 
It is not currently possible to convert between the aggregated formats (8.x) 
and the non aggregated formats (1,5,6,7). 
.SH "AUTHOR" 
.PP 
Mark Fullmer maf@splintered.net 
.SH "SEE ALSO" 
.PP 
\fBflow-tools\fP(1) 
.\" created by instant / docbook-to-man, Wed 25 May 2005, 18:25