Next Previous Contents

5. Software

5.1 How do I start using the software?

See the Getting Started and Command Usage documents.

5.2 Where can a get a routing table to use t2_report[++]?

See the answer to the question: How do I get routing tables for ASFinder?

5.3 How can one control when a flow is finished using crl_flow? Does crl_flow use the FIN packet for flow termination?

The current version of crl_flow doesn't look for FIN or any other protocol feature to detect the end of a flow; it only uses timing. With the -I option, a flow ends when the interval ends (so at the end of each interval, all flows are considered expired). With a -T option, a flow ends when some specified amount of time has passed since the last packet was seen matching the 5-tuple of source IP address, destination IP address, protocol, source port, and destination port. Flows are still reported at the end of every interval. So, with -T, a report will show 2 tables per (sub)interface: flows that expired sometime during the interval, and flows that are still active as of the end of the interval. A long-lived flow may be reported in the active table of many intervals, with accumulating values. When a flow expires, any new packets with the same 5-tuple are considered part of a new flow; this is why you may see values greater than 1 in the flows column when you use -T.


Next Previous Contents