OnWorks favicon

flow-report - Online in the Cloud

Run flow-report in OnWorks free hosting provider over Ubuntu Online, Fedora Online, Windows online emulator or MAC OS online emulator

This is the command flow-report that can be run in the OnWorks free hosting provider using one of our multiple free online workstations such as Ubuntu Online, Fedora Online, Windows online emulator or MAC OS online emulator



flow-report — Generate reports from flow data.


flow-report [-h] [-d debug_level] [-s stat_fname] [-S stat_definition] [-v variable


The flow-report utility will generate reports from flow data. The reports are easy to
parse ASCII text that can be used by a front end to produce readable reports, graphs, and

Reports are definied in a configuration file by the 'stat-report' keyword followed by a
report name. Each report has a type defined below and other commands. Reports are
grouped into a definition with the 'stat-definition' keyword followed by a definition
name. Each definition can invoke a filter and optionally apply tags.

Words in the configuration file of the form @VAR or @{VAR:default} will be expanded at
run-time by setting variable names with the -v option.

Generated reports consist of comment lines and report lines. Comment lines begin with a #
and include details such as the options used, report name, records in the report, and the
report line format. Some of the more verbose comments can be controlled with the +header
and +xheader options. By default this information is not displayed. A column title
beginning with the string rec precedes the report lines. Report lines consist of key
fields, such as an IP address and calculated totals for that key such as the number of

The summary-detail report is a little bit different from other reports in that it has
multiple title lines and no key fields.

The column titles are described below.

+time_real Difference between the real time of the first and last
+aflowtime Total time of the flows / Total number of flows.
+aps Total Octets / Total Packets (Average Packet Size)
+afs Total Octets / Total Flows / (Average Flow Size)
+apf Total Packets / Total Flows (Average Packets / Flow)
+fps Total Flows / (Last End Time of Flow -
First Start Time of Flow) (Average Flows / Second)
+fps_real (Average Flows / Second in realtime)
+psizeN Average Packet Size buckets.
+fpsizeN Packets / Flow buckets.
+fosizeN Octets / Flow buckets.
+ftimeN Time / Flow buckets.

ignores Flows with a packet count of 0.

SSS-count Count of of an item, example source-ip-address-count

SSS* key fields, example source-ip-address
index Report line index.
first Time of first flow in unix_secs format.
last Time of last flow in unix_secs format.

flows Summation of flows/key.
octets Summation of octets/key.
packets Summation of packets/key.
duration End time of Flow - Start time of Flow.
avg-bps Average Bits/Second.
min-bps Minimum Bits/Second.
max-bps Maximum Bits/Second.
avg-pps Average Packets/Second.
min-pps Minimum Packets/Second.
max-pps Maximum Packets/Second.
frecs Records used in average calculations.

Note fields with a + are only available in the summary-detail report.

The PPS and BPS calculations will not always be correct due to flows which only have one
packet, or some other condition where the start time is equal to the end time. In this
case these flows are not used in the PPS and BPS calculations. To facilitate aggregating
multiple reports and retaining the PPS and BPS fields, the number of flows counted is
available in the frecs field.

stat-report command Description/Example
type Define the report type.
type destination-tag

filter Apply this filter definition.
filter permit-only-tcp

scale Scale report by n.
scale 100

tag-mask Apply source and destination mask to tag.
tag-mask 0xFF00 0xFF00

ip-source-address-format Format of source IP address.
address - address, ie
prefix-len - address/len ie
prefix-mask- prefix/len 128.146.1/24

Format of destination IP address.
address - address, ie
prefix-len - address/len ie
prefix-mask- prefix/len 128.146.1/24

output Start an output configuration. Multiple
output configurations can be configured
per report.

output option Description/Example

path Pathname of output. If the path begins
with a | the output is a pipe. The
pathname is formatted through strftime().
Directories not in the path are
automatically created.
path /tmp/%Y/%m/%d/foo.out

time What time to use when formatting the
pathname with strftime.
now - current time
start - first flow
end - last flow
mid - average of first and last.

tally Emit a % total line every n records.
tally 10

format Output format. Currently only ascii.
format ascii

sort Sort on a field. + ascending, - descending.
sort +flows - sort on the flows field

Sortable fields are flows,octets,packets,

records Truncate report at n records.
records 10

fields Enable/Disable fields with +/-. Fields:
fields +key,+flows,+octets,+packets,

For reports with one key, the key
field is referenced with key, else

Note that the count field is only available
in select reports, those which end in

options Enable/Disable options with +/-
+header - include header.
+xheader - include extra header.
+totals - include a totals line.
+percent-total - report in % total form.
+names - use symbolic names.
options +header,+xheader

stat-definition option Description/Example
filter Apply this filter definition.
filter default

tag Apply this tag definition.
tag default

mask Apply this mask definition.
mask default

report Invoke this report. Multiple reports can
be set.
report foo

time-series How often to produce a report in seconds.
time-series 60

global options Description/Example
include-tag Specify path to include tag definitions.
include-tag /flows/tags/test1

include-filter Specify path to include filter definitions.
include-filter /flows/filters/test1

include-mask Specify path to include mask definitions.
include-filter /flows/masks/test1

Report type Summarization Key Elements.
summary-detail Totals plus quick breakdown.

summary-counters Totals only.

packet-size Average packet size distribution.

octets Octets per flow distribution.

packets Packets per flow distribution.

ip-source-port IP Source Port.

ip-destination-port IP Destination Port.

ip-source/destination-port IP Source/Destination Port pair.

bps Bits/Second distribution.

pps Packets/Second distribution.

IP class with ASM/SSM Multicast breakout.

ip-protocol IP Protocol.

ip-tos IP Type of Service.

ip-next-hop-address IP Next Hop Address.

ip-source-address IP Source Address.

ip-destination-address IP Destination Address.

IP Source/Destination Address pair.

ip-exporter-address IP Exporter Address.

input-interface Input Interface.

output-interface Output Interface.

input/output-interface Input/Output Interface pair.

source-as Source AS.

destination-as Destination AS.

source/destination-as Source/Destination AS.

ip-source-address/source-as IP Source Addrss and Source AS.

IP Destination Address and Source AS.

IP Source Address and Destination AS.

IP Destination Address and Destination AS.

IP Source/Destination Address and Source AS.

IP Source/Destination Address and
Destination AS.

IP Source/Destination Address and
Source/Destination AS.

IP Source Address and Input Interface.

IP Destination Address and Input Interface.

IP Source Address and Output Interface.

IP Destination Address and Output Interface.

IP Source/Destination Address and
Input Interface.

IP Source/Destination Address and
Output Interface.

IP Source/Destination Address and
Input/Output Interface.

input-interface/source-as Input Interface and Source AS.

Input Interface and Destination AS.

Output Interface and Source AS.

Output Interface and Destination AS.

Input Interface and Source/Destination AS.

Output Interface and Source/Destination AS.

Input/Output Interface and
Source/Destination AS.

engine-id Engine ID.

engine-type Engine Type.

source-tag Source Tag.

destination-tag Destination Tag.

source/destination-tag Source/Destination Tag.

IP Source Address and IP Source Port.

IP Source Address and IP Destination Port.

IP Destination Address and IP Source Port.

IP Destination Address and
IP Destination Port.

IP Source Address and
IP Source/Destination Port.

IP Destination Address and
IP Source/Destination Port.

IP Source/Destination Address and
IP Source Port.

IP Source/Destination Address and
IP Destination Port.

IP Source/Destination Address and
IP Source/Destination Port.

IP Source Address and
Input/Output Interface.

IP Destination Address and
Input/Output Interface.

IP Source Address and
Source/Destination AS.

IP Destination Address and
Source/Destination AS.

ip-address IP Address (both source and destination).

ip-port IP Port (both source and destination).

Count of destination IP addresses associated
with a source IP address.

Count of source IP addresses associated
with a destination IP address.

Linear interpolated distribution of flows,
octets and packets. The distribution is
done across the start and end time of the

first First packet of flow distribution.

last Last packet of flow distribution.

duration Duration of flow distribution.

IP Source Address and
Source tag.

IP Source Address and
Destination tag.

IP Destination Address and
Source tag.

IP Destination Address and
Destination tag.

IP Source/Destination Address and
Source/Destination tag.

IP Source/Destination Address, IP Protocol,
and ToS.

IP Source/Destination Addess, IP Protocol,
IP Tos, IP Source/Destination Port.


-d debug_level
Enable debugging.

-s stat_fname
Report configuration filename. Defaults to /etc/flow-tools/cfg/stat.

-S stat_definition
Select the active definition.

-v variable binding
Set a variable FOO=bar.

-h Display help. -hh will list the available reports.


An example of report configuration file

# stat config file

include-filter /tmp/filter

stat-report t1
type summary-detail
filter default
scale 100
format ascii
options +header,+xheader,+totals
fields +other
path /tmp/output1

stat-report t6
type ip-source-port
format ascii
options +header,+xheader,+totals,+names,+percent-total
sort +pps
tally 5
path /tmp/output6

stat-definition test
filter tcp
report t1
report t6

# filter config file

filter-primitive TCP
type ip-protocol
permit TCP

filter-definition tcp
match ip-protocol TCP

flow-cat flows | flow-report -stest -Stest


Packet size calculations are dOctets / dPkts, ie an average packet size. It is not
possible to get a true packet size from flow exports.

pps and bps calculations are an average of the averages.

Flows that do not have a duration (start == end) are not counted in the pps and bps

Flows without a packet or octet count are ignored.

Use flow-report online using onworks.net services

Free Servers & Workstations

Download Windows & Linux apps

Linux commands