See the Getting Started and Command Usage documents.
t2_report[++]
?
See the answer to the question: How do I get routing tables for ASFinder?
crl_flow
? Does crl_flow
use the FIN packet for flow termination?
The current version of
crl_flow
doesn't look for FIN or any other
protocol feature to detect the end of a flow; it only uses
timing. With the -I
option, a flow ends when the
interval ends (so at the end of each interval, all flows are
considered expired). With a -T
option, a flow ends
when some specified amount of time has passed since the last
packet was seen matching the 5-tuple of source IP address,
destination IP address, protocol, source port, and destination
port. Flows are still reported at the end of every interval.
So, with -T
, a report will show 2 tables per (sub)interface:
flows that expired sometime during the interval, and flows that
are still active as of the end of the interval. A long-lived
flow may be reported in the active table of many intervals, with
accumulating values. When a flow expires, any new packets with
the same 5-tuple are considered part of a new flow; this is why
you may see values greater than 1 in the flows column when you
use -T
.