---
name: "flow-filter"
section: "1"
platform: "linux"
package: "flow-tools"
version: "1:0.68-12.5+b3"
release: "Debian 10 (Buster)"
platforms: ["linux"]
url: "https://new.carta.tech/flow-filter"
---

# flow-filter(1)

Filter flows.

## NAME

**flow-filter** — Filter flows.

## SYNOPSIS

**flow-filter** \[-hko\]  \[-a *src\_as\_filter*\]  \[-A *dst\_as\_filter*\]  \[-b *big*\|*little*\]  \[-C *comment*\]  \[-D *dstaddr\_filter\_name*\]  \[-d *debug\_level*\]  \[-e *exaddr\_filter*\]  \[-f *acl\_fname*\]  \[-i *input\_filter*\]  \[-I *output\_filter*\]  \[-p *srcport\_filter*\]  \[-P *dstport\_filter*\]  \[-r *ipprot\_filter*\]  \[-S *srcaddr\_filter\_name*\]  \[-t *tos\_filter*\]  \[-T *tcp\_flags\_filter*\]  \[-x *nexthop\_filter\_name*\]  \[-z *z\_level*\]

## DESCRIPTION

The **flow-filter** utility will filter flows based on user selectable criteria.  The IP address filters are defined in  **flow.acl** or by the filename specified by -f.

Other filters such as input interface and ports are defined on the command line.  These filters accept range and negation operators, ie -i1-15 for input interfaces 1 through 15 or -i1,15 for input interfaces 1 and 15, or !1,15 for not input interfaces 1 and 15.

The syntax is kludgy and needs reworked but works for most applications.

## OPTIONS

- \-a *src\_as\_filter*

  Source AS filter, ie -a159 to permit Autonomous System 159.

- \-A *dst\_as\_filter*

  Destination AS filter, ie -A159,3112 to permit Autonomous Systems 159 and 3112.

- \-b *big*\|*little*

  Byte order of output.

- \-C *Comment*

  Add a comment.

- \-d *debug\_level*

  Enable debugging.

- \-D *dstaddr\_filter\_name*

  Destination IP address filter.  This is the name or number of a standard access list defined in **flow.acl** or the file specified by -f.

- \-e *exaddr\_filter*

  Exporter IP address filter.  One exporter address can be filtered.

- \-f *acl\_fname*

  Access list filename.  Defaults to **flow.acl**.

- \-h

  Display help.

- \-i *input\_filter*

  Input interface filter, ie -i0 to permit traffic from interface 0.

- \-k

  Keep time from input.

- \-I *output\_filter*

  Output interface filter, ie -I0 to permit traffic to interface 0.

- \-o

  Logical OR instead of AND filters.

- \-p *srcport\_filter*

  Source port filter, ie -p80 to only permit source port 80.

- \-P *dstport\_filter*

  Destination port filter, ie -P80,8080 to permit destination ports 80 and 8080.

- \-r *ipprot\_filter*

  IP Protocol filter, ie -r6 to only permit TCP traffic.

- \-S *srcaddr\_filter\_name*

  Source IP address filter.  This is the name or number of a standard access list defined in **flow.acl** or the file specified by -f.

- \-t *tos\_filter*

  ToS bits filter.  An optional mask is available which is applied to the tos field before comparing to the filter list.  For example to match a tos bit pattern of 101xxxxx use 0xA0/0xE0.

- \-T *tcp\_flags\_filter*

  TCP bits filter.  An optional mask is available which is applied to the TCP flags field before comparing to the filter list.  For example to match a flows with the SYN bit set use 0x2/0x2.

- \-x *nexthop\_filter\_name*

  NextHop IP address filter.  This is the name or number of a standard access list defined in **flow.acl** or the file specified by -f.

- \-z *z\_level*

  Configure compression level to  *z\_level*.  0 is disabled (no compression), 9 is highest compression.

## EXAMPLES

Print all traffic with a destination port of 80.

  **flow-cat /flows/krc4 \| flow-filter -P80 \| flow-print**

Print all traffic with with source IP 10.0.0.1.  Populate **flow.acl** with\
   ip access-list standard badguy permit host 10.0.0.1

  **flow-cat /flows/krc4 \| flow-filter -Sbadguy \| flow-print**

Report all destinations that IP 10.0.0.1 has sent traffic to.  Sort by octets.  Populate **flow.acl** with\
   ip access-list standard badguy permit host 10.0.0.1

  **flow-cat /flows/krc4 \| flow-filter -Sbadguy \| flow-stat -f8 -S2**

## BUGS

Extended access lists are not fully implemented. The command line filter syntax is a kludge.

## NOTES

Use flow-nfilter.

## AUTHOR

Mark Fullmer maf@splintered.net

## SEE ALSO

[**flow-tools**(1)](/flow-tools/1.md)