flow-xlate (1) - Linux Manuals

flow-xlate: Apply translations to selected fields of a flow.


flow-xlate - Apply translations to selected fields of a flow.


flow-xlate [ -hkn ] [ -b big|little ] [ -C comment ] [ -d debug_level ] [ -v variable binding ] [ -V flow_version ] [ -x xlate_fname ] [ -X xlate_definition ] [ -z z_level ]


The flow-xlate utility is used to apply translations to flows. Translations are defined in a configuration file and are composed of actions and a definition to invoke action(s). The definitions are in the form of terms, each term can have a filter and multiple actions.

Words in the configuration file of the form @VAR or @{VAR:default} will be expanded at run-time by setting variable names with the -v option.

Translation actions begin with the xlate-action keyword followed by a symbolic name. Each action has a type defined below.

Translation definitions begin with the xlate-definition keyword followed by a symbolic name. Each definition is composed of terms which are evaluated in the order of the configuration file. A term may invoke a filter to conditionally invoke an action.

Action type/sub-commands                Description/Example
ip-source-address-to-network            Zero host bits based on mask.
ip-destination-address-to-network       Zero host bits based on mask.

  (no sub-commands)

ip-source-address-to-class-network      Zero source host bits to
                                        match class.
ip-destination-address-to-class-network Zero dst host bits to
                                        match class.
  (no sub-commands)

ip-source-address-anonymize             Anonymize source address.
ip-destination-address-anonymize        Anonymize destination address.
ip-address-anonymize                    Anonymize src/dst address.

    algorithm                           Algorithm.  cryptopan-aes128 is
                                        currently supported.
                                         algorithm cryptopan-aes128

    key                                 Key.  Key is 128 bits in hex.
                                         key 0123456789ABCDEFG

    key-file                            File to load key from.  Key is
                                        128 bits in hex.
                                         key-file /mfstmp/secret-key

    key-file-refresh                    How often to check the key file.
                                        Interval is in minutes, the
                                        optional second argument is
                                        hour:min:sec to specify the
                                        first refresh.  This example
                                        will load a new key every day
                                        at 12:00:00.
                                         14400 12:00:00

ip-address-privacy-mask                 Apply a mask to the source and
                                        destination address to remove

ip-port-privacy-mask                    Apply a mask to the source and
                                        destination port to remove

tag-mask                                Apply mask to the source and
                                        destination tag.

    mask                                Source and Destination mask
                                        to apply.
                                         mask 0xFFFF 0xFFFF

scale                                   Scale packets and bytes.

  scale                                 Scale to apply.
                                         scale 100

replace-source-as0                      Replace source AS 0
replace-destination-as0                 Replace destination AS 0

  as                                    AS replacement value.
                                         as 3112


-b big|little
Byte order of output.
-C Comment
Add a comment.
-d debug_level
Enable debugging.
Display help.
Keep time from input.
Don't load configuration file. Useful only with -V
-v variable binding
Set a variable FOO=bar.
-V pdu_version
Use pdu_version format output.

    1    NetFlow version 1 (No sequence numbers, AS, or mask)
    5    NetFlow version 5
    6    NetFlow version 6 (5+ Encapsulation size)
    7    NetFlow version 7 (Catalyst switches)
    8.1  NetFlow AS Aggregation
    8.2  NetFlow Proto Port Aggregation
    8.3  NetFlow Source Prefix Aggregation
    8.4  NetFlow Destination Prefix Aggregation
    8.5  NetFlow Prefix Aggregation
    8.6  NetFlow Destination (Catalyst switches)
    8.7  NetFlow Source Destination (Catalyst switches)
    8.8  NetFlow Full Flow (Catalyst switches)
    8.9  NetFlow ToS AS Aggregation
    8.10 NetFlow ToS Proto Port Aggregation
    8.11 NetFlow ToS Source Prefix Aggregation
    8.12 NetFlow ToS Destination Prefix Aggregation
    8.13 NetFlow ToS Prefix Aggregation
    8.14 NetFlow ToS Prefix Port Aggregation
    1005 Flow-Tools tagged version 5
-x xlate_fname
Translation config file name. Defaults to /etc/flow-tools/cfg/xlate.cfg
-X xlate_definition
Translation definition. Defaults to default.
-z z_level
Configure compression level to z_level. 0 is disabled (no compression), 9 is highest compression.


Convert the version 7 flows in flows.v7 to version 5, storing the result in flows.v5.

flow-xlate -V5 < flows.v7 > flows.v5

Set the low 11 bits in the IP addresses to zero unless the address is multicast or it belongs to the 192.88.99/24 network.

# xlate.cfg
include-filter filter.cfg

  type ip-address-privacy-mask
xlate-action UNICAST-PRIVACY
  type ip-address-privacy-mask
  mask 0xFFFFFF00 0xFFFFF800

xlate-definition abilene_privacy
    filter mcast
    filter ucast

# filter.cfg
filter-primitive MCAST
  type ip-address-mask

filter-primitive UCAST
  type ip-address-mask
  default permit

filter-primitive SKIP
  type ip-address-mask
  default permit

filter-definition mcast
  match ip-destination-address MCAST

filter-definition ucast
  match ip-destination-address UCAST
  match ip-destination-address SKIP
  match ip-source-address SKIP
flow-cat flows | flow-xlate -xxlate.cfg -Xabilene_privacy | flow-print


Configuration files: Symbols - /etc/flow-tools/sym/*. Filter - /etc/flow-tools/cfg/filter.cfg. Xlate - /etc/flow-tools/cfg/xlate.cfg.


The scale option can overflow the 32 bit flow counters. This could be solved by detecting this condition and splitting the flow in two.

Translation between aggregated and non aggregated formats is not supported.


Mark Fullmer <maf [at] splintered.net>