Flow-mask (1) Linux Manual Page

NAME

flow-mask – Apply tags to flow files.

SYNOPSIS

flow-mask [ -hk ] [ -b big|little ] [ -C comment ] [ -d debug_level ] [ -m mask_fname ] [ -M active_def… ]

DESCRIPTION

The flow-mask utility is used to modify the source and destination mask length’s in flow records.

OPTIONS

-b big|little: Byte order of output.
-C Comment: Add a comment.
-d debug_level: Enable debugging.
-h: Display help.
-k: Keep time from input.
-m mask_fname: Load masks from mask_name. Defaults to /etc/flow-tools/cfg/mask
-M mask_def: Use active_def as the active tag definition(s).

The configuration file is a collection of definitions. A definition lists a sequence of prefixes and the mask length to replace the matching prefix with. Lines begining with # are treated as comments and ignored.


mask - definition command Description-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --mask - definition Begin mask - definition section mask - definition foo prefix List the prefix to match on and the replacement mask.prefix 128.146 / 16 24

EXAMPLES

#
#file: masks
#
mask-definition foo
# All networks in 128.146/16 are /24's.
 prefix 128.146/16 24
# except for 128.146.214/24, which are /32's.
 prefix 128.146.214/24 32

flow-cat flows | flow-mask -mfoo -Fmasks | flow-print -f4

FILES

Configuration files: Mask – /etc/flow-tools/cfg/mask.cfg.

BUGS

None known.

AUTHOR

Mark Fullmer <maf [at] splintered.net>

flow-mask (1) Linux Manual Page