5. Software

5.1 How do I start using the software?

See the Getting Started and Command Usage documents.

5.2 Where can I get a routing table to use t2_report[++]?

See the answer to the question: How do I get routing tables for ASFinder?

5.3 How can I control when a flow is finished using crl_flow? Does crl_flow use the FIN packet for flow termination?

The current version of crl_flow doesn't look for FIN or any other protocol feature to detect the end of a flow; it only uses timing. With the -I option, a flow ends when the interval ends (so at the end of each interval, all flows are considered expired). With a -T option, a flow ends when some specified amount of time has passed since the last packet was seen matching the flow id. Expired flows are still reported at the end of every interval, and at the end of the run any flows that never expired are reported. With the -A option, still-active flows are reported every interval. When a flow expires, any new packets with the same flow id are considered part of a new flow; this is why you may see values greater than 1 in the flows column when you use -T.