NAME¶

nfreplay — replay binary flow files as netflow version v5 or v9 to a remote host

SYNOPSIS¶

DESCRIPTION¶

nfreplay reads binary flow files stored by any nfdump collector and sends the flow records to a remote host or a multicast group.

nfreplay sends the data as netflow v5 or v9 to the remote location.

nfreplay accepts a filter to limit the flows to be sent. The filter syntax is equivalent to nfdump.

The options are as follows:

-r flowfile

Read input data from flowfile.

-H remotehost

Send all flows to this remote host. Accepts a symbolic name or a IPv4/IPv6 IP address.

-j mcastgroup

Join this multicast group and send all flows to this group host. Accepts a symbolic name or multicast IPv4/IPv6 IP address.

-p port

Send all flows to this port on the remote side. Default is 9995.

-S Sourceaddr

Use the specified source IP address to send the flows

-4

Forces nfreplay to send flows to a IPv4 address only. Can be used if the remote host has an IPv4 and IPv6 address record.

-6

Forces nfreplay to send flows to a IPv6 address only. Can be used if the remote host has an IPv4 and IPv6 address record.

-v version

Send flows as netflow version version. Versions 5, 9 and 250 are supported. In v5 mode, all additional elements to a standard v5 record are skipped and 64bit counters are truncated to 32bit. Version 250 sends flows in nfdump's own native record format, as used between nfcapd and nfpcapd, without any conversion or loss of precision. The default is v9.

-d usec

Delay each record by usec microseconds, to avoid overrun on the remote host. Default is 1 microsecond.

-b buffsize

Set send buffer to buffsize size in bytes. Useful to buffer larger data transfers.

-z num

Flows are sent with their "real distribution" across time (with a speed coefficient)

• -z 1 : 5 minutes of records will be sent in 5 minutes.
• -z 20 : 5 minutes of record will be sent in 5/20 = 0.25 minutes.

-c num

Limit number of records to send to the first num flows.

-f filterfile

Read the flow filter from filterfile.

-t timewin

Restrict replay to an nfdump time-window expression.

-E

Enable diagnostic verbosity (equivalent to verbosity level 1).

-L facility

Log diagnostic output to syslog facility facility instead of stderr.

-i remotehost

Compatibility alias for -H.

-Y

Require confirmation before sending flows.

-V

Print nfreplay version and exit.

-h

Print help text on stdout with all options and exit.

EXIT STATUS¶

nfreplay returns

• 255 Initialization failed.
• 254 Error in filter syntax.
• 250 Internal error.

SEE ALSO¶

nfcapd(1), nfdump(1)