NAME
nfreplay - netflow replay program
SYNOPSIS
nfreplay [options] [filter]
DESCRIPTION
nfreplay is the netflow replay program of the nfdump tool set. It
reads data from files stored by nfcapd and sents the netflow data to a
host or a multicat group. The filter syntax is equivalent to nfdump. If
a filter is supplied, only the matching flows are sent. See the
nfdump(1) man page for a detailed description of the filter syntax. All
records are sent as netflow version 5.
OPTIONS
-H remotehost
Send all flows to this remote host. Accepts a symbolic name or a
IPv4/IPv6 IP address. Defaults to IPv4 localhost 127.0.0.1.
-j mcastgroup
Join this multicast group and send all flows to this group host.
Accepts a symbolic name or multicast IPv4/IPv6 IP address.
-p port
Send all fows to this port on the remote side. Default is 9995.
-4 Forces nfreplay to send flows to a IPv4 address only. Can be used
together with -i if the remote host has an IPv4 and IPv6 address
record.
-6 Forces nfreplay to send flows to a IPv6 address only. Can be used
together with -i if the remote host has an IPv4 and IPv6 address
record.
-v num
Send flows as netflow version num. 5 and 9 are supported. The
default is sending the flows as netflow version 5. In version 5
mode, IPv6 flows, are skipped and 64bit counters are truncated to
32bit.
-d usec
Delay each record bei usec mirco seconds, to avoid overrun on the
remote side. Default is 10.
-b buffersize
Set send buffer size in bytes. Useful for large data to transfer.
Default is system dependent.
-r inputfile
Read input data from inputfile. Default is read from stdin.
-t timewin
Send only flows, which fall in the time window timewin, where
timewin is YYYY/MM/dd.hh:mm:ss[-YYYY/MM/dd.hh:mm:ss]. Any parts of
the time spec may be omitted e.g YYYY/MM/dd expands to
YYYY/MM/dd.00:00:00-YYYY/MM/dd.23:59:59 and sends all flow from a
given day.
-c num
Limit number of records to send to the first num flows.
-V Print nfreplay version and exit.
-h Print help text on stdout with all options and exit.
RETURN VALUE
Returns
0 No error.
255 Initialization failed.
254 Error in filter syntax.
250 Internal error.
NOTES
SEE ALSO
nfcapd(1), nfdump(1), nfprofile(1)
BUGS
2009-09-09 nfreplay(1)