Patch to add a "-l" option to flow-export so IP addresses will be output in
longint format rather than dotted quad (saves gobs of space in database).

Get the actual patch here
Get FC4 RPMS of 0.68b+patch here

by Void Main (warning: extreme hack)

--- flow-tools-0.68/src/flow-export.c.orig      2004-03-30 21:11:14.000000000 -0600
+++ flow-tools-0.68/src/flow-export.c   2005-12-09 00:05:01.000000000 -0600
@@ -115,7 +115,7 @@
 struct jump format[] = {{format0}, {format1}, {format2}, {format3},
                         {format4}, {format5}};

-int debug;
+int debug, longips;

 int main(int argc, char **argv)
 {
@@ -131,6 +131,7 @@
   format_index = 0;
   bzero(&opt, sizeof opt);
   ascii_mask = 0;
+  longips = 0;

   opt.cflowd_mask = 0xFFFFFFFFL;
   opt.ft_mask = 0xFFFFFFFFFFFFFFFFLL;
@@ -138,7 +139,7 @@
   /* profile */
   ftprof_start (&ftp);

-  while ((i = getopt(argc, argv, "h?d:f:m:u:")) != -1)
+  while ((i = getopt(argc, argv, "h?d:f:m:u:l")) != -1)

     switch (i) {

@@ -173,6 +174,10 @@
       strcpy(opt.dbaseURI, optarg);
       break;

+    case 'l': /* IP addresses in longint format */
+      longips = 1;
+      break;
+
     default:
       usage();
       exit (1);
@@ -1171,11 +1176,12 @@
 int fmt_xfields_val(char *fmt_buf, char *rec, struct fts3rec_offsets *fo,
   u_int64 xfields, int quote)
 {
-  int comma, len;
+  int comma, len, len2, i;

   fmt_buf[0] = 0;
+  char str[20];

-  len = comma = 0;
+  len = comma = len2 = i = 0;

   if (xfields & FT_XFIELD_UNIX_SECS) {
     if (comma) fmt_buf[len++] = ',';
@@ -1200,10 +1206,20 @@

   if (xfields & FT_XFIELD_EXADDR) {
     if (comma) fmt_buf[len++] = ',';
-    if (quote) fmt_buf[len++] = '"';
-    len += fmt_ipv4(fmt_buf+len, *((u_int32*)(rec+fo->exaddr)),
-      FMT_JUST_LEFT);
-    if (quote) fmt_buf[len++] = '"';
+    if (longips) {
+      str[0] = 0;
+      sprintf(str,"%u",*((u_int32*)(rec+fo->exaddr)));
+      len2 = strlen(str);
+      for (i=0;i<len2;i++) {
+         fmt_buf[len+i] = str[i];
+      }
+      len += len2;
+    } else {
+      if (quote) fmt_buf[len++] = '"';
+      len += fmt_ipv4(fmt_buf+len, *((u_int32*)(rec+fo->exaddr)),
+        FMT_JUST_LEFT);
+      if (quote) fmt_buf[len++] = '"';
+    }
     comma = 1;
   }

@@ -1258,19 +1274,39 @@

   if (xfields & FT_XFIELD_SRCADDR) {
     if (comma) fmt_buf[len++] = ',';
-    if (quote) fmt_buf[len++] = '"';
-    len += fmt_ipv4(fmt_buf+len, *((u_int32*)(rec+fo->srcaddr)),
-      FMT_JUST_LEFT);
-    if (quote) fmt_buf[len++] = '"';
+    if (longips) {
+      str[0] = 0;
+      sprintf(str,"%u",*((u_int32*)(rec+fo->srcaddr)));
+      len2 = strlen(str);
+      for (i=0;i<len2;i++) {
+         fmt_buf[len+i] = str[i];
+      }
+      len += len2;
+    } else {
+      if (quote) fmt_buf[len++] = '"';
+      len += fmt_ipv4(fmt_buf+len, *((u_int32*)(rec+fo->srcaddr)),
+        FMT_JUST_LEFT);
+      if (quote) fmt_buf[len++] = '"';
+    }
     comma = 1;
   }

   if (xfields & FT_XFIELD_DSTADDR) {
     if (comma) fmt_buf[len++] = ',';
-    if (quote) fmt_buf[len++] = '"';
-    len += fmt_ipv4(fmt_buf+len, *((u_int32*)(rec+fo->dstaddr)),
-      FMT_JUST_LEFT);
-    if (quote) fmt_buf[len++] = '"';
+    if (longips) {
+      str[0] = 0;
+      sprintf(str,"%u",*((u_int32*)(rec+fo->dstaddr)));
+      len2 = strlen(str);
+      for (i=0;i<len2;i++) {
+         fmt_buf[len+i] = str[i];
+      }
+      len += len2;
+    } else {
+      if (quote) fmt_buf[len++] = '"';
+      len += fmt_ipv4(fmt_buf+len, *((u_int32*)(rec+fo->dstaddr)),
+        FMT_JUST_LEFT);
+      if (quote) fmt_buf[len++] = '"';
+    }
     comma = 1;
   }

@@ -1429,7 +1465,7 @@

 void usage(void) {

-  fprintf(stderr, "Usage: flow-export [-h] [-d debug_level] [-f format] [-m mask_fields] -u [database URI]\n");
+  fprintf(stderr, "Usage: flow-export [-l (long ips)] [-h] [-d debug_level] [-f format] [-m mask_fields] -u [database URI]\n");
   fprintf(stderr, "\n%s version %s: built by %s\n", PACKAGE, VERSION, FT_PROG_BUILD);