hhg
flow-tools
flow-dyn

The flow-dyn program

flow-dyn tags dynamic flows.

Interface

	flow-dyn opts rulefile

opts is a series of getopt-style options.

flow-dyn reads rules from rulefile

Similarly to other flow-tools programs, flow-dyn reads from standard input and writes to standard output.

Options

General options:

• -b order: Byte order of output. Either 'big' or 'little'.
• -z z_level: Configure compression level to z_level. 0 is disabled (no compression), 9 is highest compression.

Tagging options:

• -t s: If s is 'dst', then match destination IP and set destination tag (default). If it is 'src', then match source IP and set source tag. If it is 'both', then do both.

Rule format

A rule is one line.

Each rule contains an address, a colon, a timestamp, a colon, a timestamp, a colon, and a tag.

address is an IPv4 address in dotted decimal format (x.x.x.x).

timestamp is a unix timestamp. The two timestamps define an interval [first, second] where second > first. Two intervals with the same IP may not overlap (only one allocation at any given time).

Here's an example of a rule:

	1.2.3.4:1066234667:1066234671:100