PFFLOWD(8)

NAME
pfflowd - Traffic flow monitoring

SYNOPSIS
pfflowd [-dDh] [-S direction] [-i interface] [-n host:port] [-r pcap_file] [-v netflow_version] [bpf_program]

DESCRIPTION
pfflowd is a daemon which converts status update packets from pf(4) sent over its pfsync(4) interface to Cisco NetFlow(tm) datagrams. These UDP datagrams are then exported to the specified host and port. pfflowd will (unless placed in debugging mode) drop privileges and chroot to an empty directory upon startup.

The command-line options are as follows:

-S direction
    Restrict creation of flow records to states matching direction, which may be in, out or any (default: any). This corresponds to the direction specified in the pf(4) rule that caused the generation of the state. E.g. a "pass in ... keep state" rule corresponds to a in direction.

-n host:port
    Specify the host (an IP address in dotted-quad format) and port that the accounting datagrams are to be sent to. Note that it is possible to run this daemon without specifying a host and port to export flows to, but this doesn't make much sense unless one is running in debug mode.

-i interface
    Specify a network interface on which to listen for traffic. -i or the -r As it only makes sense to listen on pfsync(4) interfaces, this argument is optional (defaulting to pfsync0).

-r pcap_file
    Specify that pfflowd should read from a pcap(3) packet capture (such as one created with the -w option of tcpdump(8)) file rather than a network interface. pfflowd will process the whole capture file and then exit. One would normally use the -d flag to keep the process in the foreground in this mode.

-v netflow_version
    Select which version of the NetFlow protocol that pfflowd should send. Currently, pfflowd support NetFlow versions 1 and 5. The default is to send NetFlow v.5 datagrams.

-d  Specify that pfflowd should not fork and daemonise itself.

-D  Places pfflowd in a debugging mode. This implies the -d flag and turns on additional debugging output. Please note that this flag

-h  Displays commandline usage information.

Any further commandline arguments will be concatenated together and applied as a bpf(4) packet filter. This filter will cause pfflowd to ignore the specified traffic.

BUGS
A bpf program specified on the commandline does not do what one may expect (i.e. select traffic for accounting). Rather, it doesn't do much at all. To select traffic for accounting, use the no-sync argument in pf.conf. This argument is available in OpenBSD 3.5 and later.

pfflowd works round the 32-bit limit of packet and byte counters in the NetFlow v.1 and v.5 protocols by sending multiple flows in cases where a counter has exceeded 2^32. For instance, pfflowd will generate three NetFlow packets for a 10 gigabyte flow that has been recorded by pfsync(4) (2 x 4GB flows and 1 x 2GB flow). In these cases, any packet or byte counter that does not exceed 2^32 will be zero in all but the first packet.

pfflowd does not try to avoid generating NetFlow packets for flows resulting from its own datagram output. This is easily avoided by not creating state on this traffic.

AUTHORS
Damien Miller <djm@mindrot.org>

SEE ALSO
softflowctl(8), tcpdump(8), pcap(3), bpf(4)

    http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/nfc/nfc_3_0/nfc_ug/nfcform.htm