AxuFlow Teaser

Gathered on this page are some examples of what the AxuFlow commands look and feel like. There are also some specialized tools that aren't listed on this page.

The design philosophy behind AxuFlow is that all the tools are and fast and as efficient as possible. All the data is stored in mmap()ed files. Every flow description starts at a power-of-two boundary for highly optimized code generation. All shorts and longs are properly aligned in the files. The library can automatically create index files to the flow data files for faster searches. Any field can be indexed and combined indexes can also be created.


Usage: afd [-hk] [-e expression | -f filename] [-t columns] flowsavefiles
        -e filter entries
        -f read filter expression from file
        -h suppress table headers
        -k short hand for "-t CDEFGHKL"
        -t which table columns are shown
A - router ip B - next hop C - source address D - destination address
E - source port F - destination port G - source as H - destination as
I - input interface J - output interface K - packets L - bytes
M - tcp flags N - protocol O - type of service
Example expressions:
src_addr= or dst_addr= and src_as=6667

!(dst_addr= and dst_port < 1024


Axuflowcollector doesn't care about command line parameters. It just collects the flows and saves them as efficiently as possible. It also supports receiving the flows over multicast.


Axuflowstorer processes and moves the collected files to other directories where they can be processed more easily. Axuflowstorer usage:

Usage: ./axuflowstorer configuration_file_name
Configuration file example:
# Comment

# name template for new files
new testa

# name template for where to move the files after processing
store ../testb

# between checks
sleep 61

# If Cisco indexes the flow via IGP, it can't find its AS:
rewrite AS6667
rewrite AS6667
rewrite AS6667
rewrite AS6667
rewrite AS8230