Free netflow tools software for linux

flow-tools is a set of programs for processing and managing NetFlow exports from Cisco and Juniper routers. The tools included are: flow-capture, flow-cat, flow-dscan, flow-expire, flow-export, flow-fanout, flow-filter, flow-gen, flow-header, flow-import, flow-mask, flow-merge, flow-nfilter, flow-print, flow-receive, flow-report, flow-send, flow-split, flow-stat, flow-tag, and flow-xlate.

Flow data is collected and stored by default in host byte ordera nd the files are portable across every endian architectures.

Commands that utilize the network use a localip/remoteip/port designation for communication. "localip" is the IP address the host will use as a source for sending or bind to when receiving NetFlow PDUs (ie the destination address of the exporter. Configuring the "localip" to 0 will force the kernel to decide what IP address to use for sending and listen on all IP addresses for receiving. "remoteip" is the destination IP address used for sending or the expected address of the source when receiving. If the "remoteip" is 0 then the application will accept flows from any source address. The "port" is the UDP port number used for sending or receiving. When using multicast addresses the localip/remoteip/port is used to represent the source, group, and port respectively.

Flows are exported from a router in a number of different configurable versions. A flow is a collection of key fields and additional data. The flow key is {srcaddr, dstaddr, input, output, srcport, dstport, prot, ToS}. Flow-tools supports one export version per file.

Export versions 1, 5, 6, and 7 all maintain {nexthop, dPkts, dOctets, First, Last, flags}, ie the next-hop IP address, number of packets, number of octets (bytes), start time, end time, and flags such as the TCP header bits. Version 5 adds the additional fields {src_as, dst_as, src_mask, dst_mask}, ie source AS, destination AS, source network mask, and destination network mask. Version 7 which is specific to the Catalyst switches adds in addition to the version 5 fields {router_sc}, which is the Router IP address which populates the flow cache shortcut in the Supervisor. Version 6 which is not officially supported by Cisco adds in addition to the version 5 fields {in_encaps, out_encaps, peer_nexthop}, ie the input and output interface encapsulation size, and the IP address of the next hop within the peer. Version 1 exports do not contain a sequence number and therefore should be avoided, although it is safe to store the data as version 1 if the additional fields are not used.

Version 8 IOS NetFlow is a second level flow cache that reduces the data exported from the router. There are currently 11 formats, all of which provide {dFlows, dOctets, dPkts, First, Last} for the key fields.

8.1 - Source and Destination AS, Input and Output interface
8.2 - Protocol and Port
8.3 - Source Prefix and Input interface
8.4 - Destination Prefix and Output interface
8.5 - Source/Destination Prefix and Input/Output interface
8.9 - 8.1 + ToS
8.10 - 8.2 + ToS
8.11 - 8.3 + ToS
8.12 - 8.5 + ToS
8.13 - 8.2 + ToS
8.14 - 8.3 + ports + ToS

Version 8 CatIOS NetFlow appears to be a less fine grained first level flow cache.

8.6 - Destination IP, ToS, Marked ToS,
8.7 - Source/Destination IP, Input/Output interface, ToS, Marked ToS,
8.8 - Source/Destination IP, Source/Destination Port,
Input/Output interface, ToS, Marked ToS,

The following programs are included in the flow-tools distribution.

flow-capture - Collect, compress, store, and manage disk space for exported flows from a router.
flow-cat - Concatenate flow files. Typically flow files will contain a small window of 5 or 15 minutes of exports. Flow-cat can be used to append files for generating reports that span longer time periods.
flow-fanout - Replicate NetFlow datagrams to unicast or multicast destinations. Flow-fanout is used to facilitate multiple collectors attached to a single router.
flow-report - Generate reports for NetFlow data sets. Reports include source/destination IP pairs, source/destination AS, and top talkers. Over 50 reports are currently supported.
flow-tag - Tag flows based on IP address or AS #. Flow-tag is used to group flows by customer network. The tags can later be used with flow-fanout or flow-report to generate customer based traffic reports.
flow-filter - Filter flows based on any of the export fields. Flow-filter is used in-line with other programs to generate reports based on flows matching filter expressions.
flow-import - Import data from ASCII or cflowd format.
flow-export - Export data to ASCII or cflowd format.
flow-send - Send data over the network using the NetFlow protocol.
flow-receive - Receive exports using the NetFlow protocol without storing to disk like flow-capture.
flow-gen - Generate test data.
flow-dscan - Simple tool for detecting some types of network scanning and Denial of Service attacks.
flow-merge - Merge flow files in chronoligical order.
flow-xlate - Perform translations on some flow fields.
flow-expire - Expire flows using the same policy of flow-capture.
flow-header - Display meta information in flow file.
flow-split - Split flow files into smaller files based on size, time, or tags.

KMail Power Tools is meant to be a suite of enhancements to KMail and may be other mail user agents.
It is currently composed of only one (perl) script that acts as a filter (take input from stdin, outputs the modified mail to stdout), adds dialog boxes to kmail, and allows the user to:
- remove all attachments from an email (no user interaction),
- remove selectively attachments, after asking the user,
detach (i.e. save then remove) any attachment to a directory chosen by the user,
- hence reducing the size of your mailbox, while allowing you to backup important attached files.
All these actions are logged within a sentence in the mail body (see below).
Note: removing and detaching is already supported by Thunderbird, but my favourite mailer program is KMail, then...
How it works
KMail allows the definition of filters (like any other email program), but you can define filters:
- which are launched manually,
- which can be programs reading your email on stdin and outputing the result on stdout (or "pipe through").
So I had the idea to use this in order to enhance KMail, and allow it to remove and detach attachments: kmailpt will read and interpret the email (thank you Perl MIME::Parser), then depending on the command line switches, popup a dialog box to ask the user for a directory where to save attachments, and ask him which attachment to remove/detach (thank you Kdialog!).
Also, the sentence "[Attachment removed by jice (26/02/2007 20:33:01): bill.zip]" will be added to the mail body. When you detach an email, it will add a similar sentence, and if the mail body is html, you will even get a link to the new location of the file: "[Attachment saved by jice (26/02/2007 20:36:17) to heavenly.gif]", on which you can even click in order to view the detached file. For text/plain messages, the sentence will be something like: "[Attachment saved by jice (26/02/2007 20:36:17) to file:///home/jice/Images/heavenly.gif]" (unfortunately, although kmail renders http:// or ftp:// urls as links, file:// are not (yet?) - I should enter a bug on bugs.kde.org for this...).
Should you want to know the currently available command line switches, here is the help:
Usage: kmailpt [options]
kmailpt takes an email on stdin, performs actions based
on this mail, then output an email on stdout.
Without any option, it will remove any file attached.
Options:
-d detach the attachments (save and remove)
-q ask which attachment to remove
-h prints this help

CryptoMX Tools is a set of encryption, steganography, cipher, hashing and conversion tools designed to work on any operating system with any Javascript-capable browser.
Enhancements:
- Added SHA-256 Algorithm.
- Used COPYING, README, AUTHORS, and ChangeLog Files.
- Removed a bit of useless code.
- Decreased Filesize.
- Misc. Fixes.

Dustbowl Clan Tools project is a community system for e-sport teams and gaming clans.

It provides an integrated forum, scheduler, voting system, and lots of other features. It is PHP/MySQL-based and supports multiple languages.

Webmasters Tools is a set of free open-source tools to do the work of the webmaster,
under the OSS licence.

Programs included:

metagen Program to generate meta-tags for your web pages.
metarep Report meta-tags and links in web pages.
updater Copy a part of a web page to all others.
outline Build a tutorial from simple unformatted text files.
makelist Build a page made of the list of links from a directory.

Web tools are free software; you can redistribute the archive and/or modify the programs under the terms of the OSS licence.

The Linux Wireless Extension and the Wireless Tools are an Open Source project sponsored by Hewlett Packard (through my contribution) since 1996, and build with the contribution of many Linux users all over the world.

The Wireless Extension (WE) is a generic API allowing a driver to expose to the user space configuration and statistics specific to common Wireless LANs. The beauty of it is that a single set of tool can support all the variations of Wireless LANs, regardless of their type (as long as the driver support Wireless Extension).

Another advantage is these parameters may be changed on the fly without restarting the driver (or Linux).

The Wireless Tools (WT) is a set of tools allowing to manipulate the Wireless Extensions. They use a textual interface and are rather crude, but aim to support the full Wireless Extension. There are many other tools you can use with Wireless Extensions, however Wireless Tools is the reference implementation.

iwconfig manipulate the basic wireless parameters
iwlist allow to initiate scanning and list frequencies, bit-rates, encryption keys...
iwspy allow to get per node link quality
iwpriv allow to manipulate the Wireless Extensions specific to a driver (private)
ifrename allow to name interfaces based on various static criteria

Most Linux distributions also have integrated Wireless Extensions support in their networking initialisation scripts, for easier boot-time configuration of wireless interfaces. They also include Wireless Tools as part of their standard packages.
Wireless configuration can also be done using the Hotplug scripts and distribution specific support, this enable the proper support of any removable wireless interface (Pcmcia, CardBus, USB...).

Any versions of the Pcmcia package offer the possibility to do wireless configuration of Pcmcia and Cardbus card through thefile wireless.opts. This allow to fully integrate wireless settings in the Pcmcia scheme mechansism. However, this method is now deprecated in favor of distribution specific methods.

Please note that the Wireless Tools (starting with version 19) supports fully IEEE 802.11 parameters and devices, support older style of devices and most proprietary protocols, and are prepared to handle HiperLan as well. More recent versions of course adds more 802.11 support.

But, unfortunately not all drivers support all these features...

The mjpeg programs are a set of tools that can do recording of videos and playback, simple cut-and-paste editing and the MPEG compression of audio and video under Linux.
Recording is supported for the Zoran based cards like the Buz (Iomega), DC10 (MIRO, Pinnacle), Matrox Marvel cards and the LML33 (Linux Media Labs). See related pages to the right to find the right driver for your card.
The recorded videos can be converted to MPEG streams. The software playback of MPEG streams works with almost every player and every OS.
You can produce special forms of MPEG streams like VCD (Video CD) and SVCD for hardware playback.
A key design objective of the tools is interoperability with other video tools:
The tools can be used used to edit, playback and compress motion JPEG (MJPEG) AVIs captured using the xawtv package.
The tools can be used to edit playback and compress MJPEG streams created and editted with broadcast 2000. N.b. the current mpeg2movie high bit-rate MPEG encoder is in large part derived from an obsolescent snapshot of the mjpegtools MPEG encoder.
Enhancements:
- changes in YUV4MPEG2 API to offer support for multiple colorspaces (particularly useful for DV video), so that multiple planar YUV formats (also monochrome or alpha) are supported.
- most filtering tools have been adapted to support multiple YUV formats, so that you will not lose quality/precision in conversion steps.
- Many new or dramatically improved filters including (but not limited to):
*) yuvdenoise (denoising filter)
*) yuvdeinterlace (intelligent deinterlacing program)
*) y4munsharp (unsharp mask image sharpening program)
- Improvements in the IDCT/DCT routines in the MPEG-1/-2 encoder (much more exact now and not subject to overflow/truncation on the IA32 arch).
- MANY new utilties for importing/exporting data:
*) New and improved PGM/PNM conversion programs for dealing with PPM data.
*) Utilities to convert raw (headerless) YUV data to and from YUV4MPEG2 format. Useful when interfacing with other program suites.
*) Program (yuyvtoy4m) to convert 4:2:2 data from digital cameras into YUV4MPEG2 format for use with mjpegtools.
*) y4mstabilizer for stabilizing images with unsteady camera work
- Improvements and fixes in mplex for handling PCM audio (LPCM audio actually works now)
- DPME (Dual Prime Motion Estimation) in the encoder (mpeg2enc) is fully functional (it was present but buggy/artifacted in the earlier releases)
- Rate control in the encoder improved considerably.
- Much better Quicktime file handling (via libquicktime) especially the audio tracks.
- Besides the always-excellent x86 support, we now have full support for AMD64 (including MMX/SSE/etc. optimizations) and for PPC (e.g. Linux or OS/X), and win32 support is also available (via Cygwin/Mingw).