root/trunk/src/rules.txt @ 16

# This file is an exemple
# you must create your own rules

# #: commented line
# N: rule name (string without space)
# O: output type (only socket in this release)
# C: check field : C <field ID> <operator> <value> 
# A: aggregation scheme (not present in this release)
# R: field ID to record (not present in this release), if no record all fields
#    are recorded
# field IDs can be found on the following url:
# http://www.cisco.com/en/US/tech/tk648/tk362/technologies_white_paper09186a00800a3db9.shtml
# in table 6

# get all IPv6 flow seen by the collector, send it to a remote client
# field 60 is the IP_PROTOCOL_VERSIO? 
N test
O socket 10.0.0.1 3234
C 60 = 6

# get all IPv4 flow of a host, send it to a remote client
# field 8 is the IPv4_SRC_ADDR
N test
O socket 127.0.0.1 2222
C 8 = 192.68.0.1

# get flows from one IPv6 address, send it to a remote client
N test2
O socket 10.0.0.2 2222
C 27 = 2001:620:0:4:203:baff:fe4c:d99b

# This rule depends on functionnality not present in this beta release
# from TCP flows
# prefix aggregation
# five minutes
# record in/out octets
N TCPVolumetry
O file ascii /tmp/output2.txt
A P
R 4 1 R 4 25

# This rule depends on functionnality not present in this beta release
# get all flows whom size between 15 & 16 Mo
# record all fields in a file
N Get_From_Size
O file bin /tmp/output.txt
C 1 > 15 C 1 < 16

N 141.renater.fr
O socket 141.renater.fr 2222
C 60 = 6