JavaScript is required to for searching.
Skip Navigation Links
Exit Print View
man pages section 1M: System Administration Commands     Oracle Solaris 11.1 Information Library
search filter icon
search icon

Document Information

Preface

Introduction

System Administration Commands - Part 1

6to4relay(1M)

acct(1M)

acctadm(1M)

acctcms(1M)

acctcon1(1M)

acctcon(1M)

acctcon2(1M)

acctdisk(1M)

acctdusg(1M)

acctmerg(1M)

accton(1M)

acctprc1(1M)

acctprc(1M)

acctprc2(1M)

acctsh(1M)

acctwtmp(1M)

acpihpd(1M)

adbgen(1M)

add_allocatable(1M)

addbadsec(1M)

add_drv(1M)

aimanifest(1M)

arp(1M)

asradm(1M)

asr-notify(1M)

atohexlabel(1M)

audit(1M)

auditconfig(1M)

auditd(1M)

auditrecord(1M)

auditreduce(1M)

auditstat(1M)

audit_warn(1M)

automount(1M)

automountd(1M)

autopush(1M)

bart(1M)

beadm(1M)

boot(1M)

bootadm(1M)

bootconfchk(1M)

bootparamd(1M)

busstat(1M)

captoinfo(1M)

catman(1M)

cfgadm(1M)

cfgadm_ac(1M)

cfgadm_cardbus(1M)

cfgadm_fp(1M)

cfgadm_ib(1M)

cfgadm_pci(1M)

cfgadm_sata(1M)

cfgadm_sbd(1M)

cfgadm_scsi(1M)

cfgadm_sdcard(1M)

cfgadm_shp(1M)

cfgadm_sysctrl(1M)

cfgadm_usb(1M)

chargefee(1M)

chat(1M)

check-hostname(1M)

check-permissions(1M)

chk_encodings(1M)

chroot(1M)

cimworkshop(1M)

ckpacct(1M)

clear_locks(1M)

clinfo(1M)

closewtmp(1M)

clri(1M)

comsat(1M)

configCCR(1M)

consadm(1m)

console-reset(1M)

coreadm(1M)

cpustat(1M)

croinfo(1M)

cron(1M)

cryptoadm(1M)

datadm(1M)

dcopy(1M)

dcs(1M)

dd(1M)

ddu(1M)

ddu-text(1M)

devchassisd(1M)

devfsadm(1M)

devfsadmd(1M)

device_allocate(1M)

device_remap(1M)

devinfo(1M)

devlinks(1M)

devnm(1M)

devprop(1M)

df(1M)

dfmounts(1M)

dfmounts_nfs(1M)

dfshares(1M)

dfshares_nfs(1M)

df_ufs(1M)

dhcpagent(1M)

dhcpconfig(1M)

dhcpmgr(1M)

dhtadm(1M)

dig(1M)

directoryserver(1M)

diskinfo(1M)

disks(1M)

diskscan(1M)

dispadmin(1M)

distro_const(1M)

dladm(1M)

dlmgmtd(1M)

dlstat(1M)

dmesg(1M)

dminfo(1M)

dns-sd(1M)

dnssec-dsfromkey(1M)

dnssec-keyfromlabel(1M)

dnssec-keygen(1M)

dnssec-makekeyset(1M)

dnssec-signkey(1M)

dnssec-signzone(1M)

dodisk(1M)

domainname(1M)

drd(1M)

drvconfig(1M)

dsbitmap(1M)

dscfg(1M)

dscfgadm(1M)

dscfglockd(1M)

dsstat(1M)

dsvclockd(1M)

dtrace(1M)

dumpadm(1M)

editmap(1M)

edquota(1M)

eeprom(1M)

efdaemon(1M)

embedded_su(1M)

emCCR(1M)

emocmrsp(1M)

etrn(1M)

fbconfig(1M)

fbconf_xorg(1M)

fcadm(1M)

fcinfo(1M)

fdetach(1M)

fdisk(1M)

ff(1M)

ff_ufs(1M)

fingerd(1M)

fiocompress(1M)

flowadm(1M)

flowstat(1M)

fmadm(1M)

fmd(1M)

fmdump(1M)

fmstat(1M)

fmthard(1M)

format(1M)

fruadm(1M)

fsck(1M)

fsck_pcfs(1M)

fsck_udfs(1M)

fsck_ufs(1M)

fsdb(1M)

fsdb_udfs(1M)

fsdb_ufs(1M)

fsflush(1M)

fsirand(1M)

fssnap(1M)

fssnap_ufs(1M)

fsstat(1M)

fstyp(1M)

fuser(1M)

fwflash(1M)

fwtmp(1M)

getdevpolicy(1M)

getent(1M)

gettable(1M)

getty(1M)

gkadmin(1M)

groupadd(1M)

groupdel(1M)

groupmod(1M)

growfs(1M)

grpck(1M)

gsscred(1M)

gssd(1M)

hald(1M)

hal-device(1M)

hal-fdi-validate(1M)

hal-find(1M)

hal-find-by-capability(1M)

hal-find-by-property(1M)

hal-get-property(1M)

hal-set-property(1M)

halt(1M)

hextoalabel(1M)

host(1M)

hostconfig(1M)

hotplug(1M)

hotplugd(1M)

htable(1M)

ickey(1M)

id(1M)

idmap(1M)

idmapd(1M)

idsconfig(1M)

ifconfig(1M)

if_mpadm(1M)

ifparse(1M)

iiadm(1M)

iicpbmp(1M)

iicpshd(1M)

ikeadm(1M)

ikecert(1M)

ilbadm(1M)

ilbd(1M)

ilomconfig(1M)

imqadmin(1M)

imqbrokerd(1M)

imqcmd(1M)

imqdbmgr(1M)

imqkeytool(1M)

imqobjmgr(1M)

imqusermgr(1M)

in.chargend(1M)

in.comsat(1M)

in.daytimed(1M)

in.dhcpd(1M)

in.discardd(1M)

in.echod(1M)

inetadm(1M)

inetconv(1M)

inetd(1M)

in.fingerd(1M)

infocmp(1M)

in.iked(1M)

init(1M)

init.sma(1M)

init.wbem(1M)

inityp2l(1M)

in.lpd(1M)

in.mpathd(1M)

in.named(1M)

in.ndpd(1M)

in.rarpd(1M)

in.rdisc(1M)

in.rexecd(1M)

in.ripngd(1M)

in.rlogind(1M)

in.routed(1M)

in.rshd(1M)

in.rwhod(1M)

install(1M)

installadm(1M)

installboot(1M)

installf(1M)

installgrub(1M)

in.stdiscover(1M)

in.stlisten(1M)

in.talkd(1M)

in.telnetd(1M)

in.tftpd(1M)

in.timed(1M)

intrd(1M)

intrstat(1M)

in.uucpd(1M)

iostat(1M)

ipaddrsel(1M)

ipadm(1M)

ipf(1M)

ipfs(1M)

ipfstat(1M)

ipmgmtd(1M)

ipmon(1M)

ipmpstat(1M)

ipnat(1M)

ippool(1M)

ipqosconf(1M)

ipsecalgs(1M)

ipsecconf(1M)

ipseckey(1M)

iscsiadm(1M)

isns(1M)

isnsadm(1M)

itadm(1M)

itu(1M)

js2ai(1M)

k5srvutil(1M)

kadb(1M)

kadmin(1M)

kadmind(1M)

kadmin.local(1M)

kcfd(1M)

kclient(1M)

kdb5_ldap_util(1M)

kdb5_util(1M)

kdcmgr(1M)

kernel(1M)

keyserv(1M)

killall(1M)

kmem_task(1M)

kmscfg(1M)

kprop(1M)

kpropd(1M)

kproplog(1M)

krb5kdc(1M)

ksslcfg(1M)

kstat(1M)

ktkt_warnd(1M)

labeld(1M)

labelit(1M)

labelit_hsfs(1M)

labelit_udfs(1M)

labelit_ufs(1M)

lastlogin(1M)

latencytop(1M)

ldapaddent(1M)

ldap_cachemgr(1M)

ldapclient(1M)

ldmad(1M)

link(1M)

llc2_loop(1M)

lldpadm(1M)

lldpd(1M)

lms(1M)

locator(1M)

lockd(1M)

lockfs(1M)

lockstat(1M)

lofiadm(1M)

logadm(1M)

logins(1M)

lshal(1M)

System Administration Commands - Part 2

System Administration Commands - Part 3

flowadm

- administer bandwidth resource control for protocols, services, containers, and virtual machines

Synopsis

flowadm
flowadm show-flow [-P] [[-p] -o field[,...]] [-l link] [flow]
flowadm add-flow [-t] [-R root-dir] -l link -a attr=value[,...]
     [-p prop=value[,...]] flow
flowadm remove-flow [-t] [-R root-dir] {-l link | flow}
flowadm set-flowprop [-t] [-R root-dir] -p prop=value[,...] flow
flowadm reset-flowprop [-t] [-R root-dir] [-p prop[,...]] flow
flowadm show-flowprop [-P] [[-c] -o field[,...]] [-l link]
     [-p prop[,...]] [flow]
flowadm help [subcommand-name]

Description

The flowadm command is used to create, modify, remove, and show networking bandwidth and associated resources for a type of traffic on a particular link.

The flowadm command allows users to manage networking bandwidth resources for a transport, service, or a subnet. The service is specified as a combination of transport and local port. The subnet is specified by its IP address and subnet mask. The command can be used on any type of data link, including physical links, virtual NICs, and link aggregations.

A flow is defined as a set of attributes based on Layer 3 and Layer 4 headers, which can be used to identify a protocol, service, or a virtual machine.

Inbound and outbound packet are matched to flows in a very fast and scalable way, so that limits can be enforced with minimal performance impact.

The flowadm command can be used to identify a flow without imposing any bandwidth resource control. This would result in better observability for the flow when used along with flowstat(1M).

Flows can be created, modified, and removed in both global and non-global zones. A zone administrator can create a flow only in his zone, global or non-global. However, a flow created in the global zone can migrate to a non-global zone, as described in the following paragraph. An administrator can modify or remove a flow only from within the zone, global or non-global, in which the flow was created. From the global zone, one can view all flows on a system, within the global and any non-global zones. From a non-global zone, one can view only those flows in that zone.

After an administrator creates a flow in the global zone, the data link associated with that flow can be assigned to a non-global zone. In such a case, the associated flow is also assigned to the same non-global zone. When this non-global zone is halted, the data link and its associated flow return to the global zone.

Different zone names distinguish flows of the same name. For example, one can have three flows named fastpak, if each fastpak is in a different zone. For example, zone1/fastpak, zone2/fastpak, and zone3/fastpak are all valid zone names.

flowadm is implemented as a set of subcommands with corresponding options. Options are described in the context of each subcommand. If flowadm is invoked with no subcommand, then all of the flows configured on the system will be displayed. See EXAMPLES below for more information.

Sub-commands

The following subcommands are supported:

flowadm show-flow [-pP] [-o field[,...]] [-l link] [flow]

Show flow configuration information (the default) or statistics, either for all flows, all flows on a link, or for the specified flow.

-o field[,...]

A case-insensitive, comma-separated list of output fields to display. The field name must be one of the fields listed below, or a special value all, to display all fields. For each flow found, the following fields can be displayed:

flow

The name of the flow.

link

The name of the link the flow is on.

ipaddr

IP address of the flow. This can be either local or remote depending on how the flow was defined.

transport

The name of the layer for protocol to be used.

port

Local port of service for flow.

dsfield

Differentiated services value for flow and mask used with DSFIELD value to state the bits of interest in the differentiated services field of the IP header.

-p, -–parseable

Display using a stable machine-parseable format.

-P, -–persistent

Display persistent flow property information.

-l link, -–link=link | flow

Display information for all flows on the named link or information for the named flow.

flowadm add-flow [-t] [-R root-dir] -l link -a attr=value[,...] -p prop=value[,...] flow

Adds a flow to the system. The flow is identified by its flow attributes and properties.

As part of identifying a particular flow, its bandwidth resource can be limited.

-t, -–temporary

The changes are temporary and will not persist across reboots. Persistence is the default.

-R root-dir, -–root-dir=root-dir

Specifies an alternate root directory where flowadm should apply persistent creation.

-l link, -–link=link

Specify the link to which the flow will be added.

-a attr=value[,...], -–attr=value

A comma-separated list of attributes to be set to the specified values.

-p prop=value[,...], -–prop=value[,...]

A comma-separated list of properties to be set to the specified values.

flowadm remove-flow [-t] [-R root-dir] -l {link | flow}

Remove an existing flow identified by its link or name.

-t, -–temporary

The changes are temporary and will not persist across reboots. Persistence is the default.

-R root-dir, -–root-dir=root-dir

Specifies an alternate root directory where flowadm should apply persistent removal.

-l link | flow, -–link=link | flow

If a link is specified, remove all flows from that link. If a single flow is specified, remove only that flow.

flowadm set-flowprop [-t] [-R root-dir] -p prop=value[,...] flow

Set values of one or more properties on the flow specified by name. The complete list of properties can be retrieved using the show-flow subcommand.

-t, -–temporary

The changes are temporary and will not persist across reboots. Persistence is the default.

-R root-dir, -–root-dir=root-dir

Specifies an alternate root directory where flowadm should apply persistent setting of properties.

-p prop=value[,...], -–prop=value[,...]

A comma-separated list of properties to be set to the specified values.

flowadm reset-flowprop [-t] [-R root-dir] -p [prop=value[,...]] flow

Resets one or more properties to their default values on the specified flow. If no properties are specified, all properties are reset. See the show-flowprop subcommand for a description of properties, which includes their default values.

-t, -–temporary

Specifies that the resets are temporary. Temporary resets last until the next reboot.

-R root-dir, -–root-dir=root-dir

Specifies an alternate root directory where flowadm should apply persistent setting of properties.

-p prop=value[,...], -–prop=value[,...]

A comma-separated list of properties to be reset.

flowadm show-flowprop [-cP] [-l link] [-p prop[,...]] [flow]

Show the current or persistent values of one or more properties, either for all flows, flows on a specified link, or for the specified flow.

By default, current values are shown. If no properties are specified, all available flow properties are displayed. For each property, the following fields are displayed:

FLOW

The name of the flow.

PROPERTY

The name of the property.

VALUE

The current (or persistent) property value. The value is shown as -- (double hyphen), if it is not set, and ? (question mark), if the value is unknown. Persistent values that are not set or have been reset will be shown as -- and will use the system DEFAULT value (if any).

DEFAULT

The default value of the property. If the property has no default value, -- (double hyphen), is shown.

POSSIBLE

A comma-separated list of the values the property can have. If the values span a numeric range, the minimum and maximum values might be shown as shorthand. If the possible values are unknown or unbounded, -- (double hyphen), is shown.

Flow properties are documented in the “Flow Properties” section, below.

-c, -–parseable

Display using a stable machine-parseable format.

-P, -–persistent

Display persistent flow property information.

-p prop[,...], -–prop=prop[,...]

A comma-separated list of properties to show.

flowadm help [subcommand-name]

Displays all the supported flowadm subcommands or usage for the given subcommand. If you display help for a specific subcommand, the command syntax is displayed, along with an example. Using flowadm help without any argument displays all the subcommands.

Flow Attributes

The flow operand that identifies a flow in a flowadm command is a comma-separated list of one or more keyword, value pairs from the list below.

local_ip[/prefix_len]

Identifies a network flow by the local IP address. value must be a IPv4 address in dotted-decimal notation or an IPv6 address in colon-separated notation. prefix_len is optional.

If prefix_len is specified, it describes the netmask for a subnet address, following the same notation convention of ifconfig(1M) and route(1M) addresses. If unspecified, the given IP address will be considered as a host address for which the default prefix length for a IPv4 address is /32 and for IPv6 is /128.

remote_ip[/prefix_len]

Identifies a network flow by the remote IP address. The syntax is the same as local_ip attributes

transport={tcp|udp|sctp|icmp|icmpv6}

Identifies a layer 4 protocol to be used. It is typically used in combination with local_port or remote_port to identify the local or remote service that needs special attention.

local_port

Identifies a service specified by the local port.

remote_port

Identifies a service specified by the remote port.

dsfield[:dsfield_mask]

Identifies the 8-bit differentiated services field (as defined in RFC 2474).

The optional dsfield_mask is used to state the bits of interest in the differentiated services field when comparing with the dsfield value. A 0 in a bit position indicates that the bit value needs to be ignored and a 1 indicates otherwise. The mask can range from 0x01 to 0xff. If dsfield_mask is not specified, the default mask 0xff is used. Both the dsfield value and mask must be in hexadecimal.

The following combinations of attributes are supported:

local_ip=address[/prefixlen]
remote_ip=address[/prefixlen]
transport={tcp|udp|sctp|icmp|icmpv6}
transport={tcp|udp|sctp},local_port=port
transport={tcp|udp|sctp},remote_port=port
dsfield=val[:dsfield_mask]

On a given link, the combinations above are mutually exclusive. All the flows on a given link must have the same combination and only the attribute values differentiate the flows. An attempt to create flows of different combinations will fail.

Restrictions

There are individual flow restrictions and flow restrictions per zone.

Individual Flow Restrictions

Restrictions on individual flows do not require knowledge of other flows that have been added to the link.

An attribute can be listed only once for each flow. For example, the following command is not valid:

# flowadm add-flow -l vnic1 -a local_port=80,local_port=8080 httpflow

transport and local_port or transport and remote_port:

TCP, UDP, or SCTP flows can be specified with a local port or with a remote port. An ICMP or ICMPv6 flow that specifies a port is not allowed.

If either local_port or remote_port is specifed, the transport must be either TCP, UDP or SCTP.

The following commands are valid:

# flowadm add-flow -l e1000g0 -a transport=udp udpflow
# flowadm add-flow -l e1000g0 -a transport=tcp,local_port=80 \
udp80flow

The following commands are not valid:

# flowadm add-flow -l e1000g0 -a remote_port=25 flow25
# flowadm add-flow -l e1000g0 -a transport=icmpv6,remote_port=16 \
flow16
Flow Restrictions Per Zone

Within a zone, no two flows can have the same name. After adding a flow with the link specified, the link will not be required for display, modification, or deletion of the flow.

Flow Properties

The following flow properties are supported. Note that the ability to set a given property to a given value depends on the driver and hardware.

maxbw

Sets the full duplex bandwidth for the flow. The bandwidth is specified as an integer with one of the scale suffixes(K, M, or G for Kbps, Mbps, and Gbps). If no units are specified, the input value will be read as Mbps. The default is no bandwidth limit.

Examples

Example 1 Displaying Flow Configuration

The following command invokes flowadm with no arguments, thereby displaying all flows in the system.

# flowadm
FLOW        LINK    IPADDR          PROTO  LPORT   RPORT   DSFLD
tcpflow     net0    --              tcp    --      --      --
udpflow     net0    --              udp    --      --      --

Example 2 Creating a Policy Around a Mission-Critical Port

The command below creates a policy around inbound HTTPS traffic on an HTTPS server so that HTTPS obtains dedicated NIC hardware and kernel TCP/IP resources. The name specified, https-1, can be used later to modify or delete the policy.

# flowadm add-flow -l bge0 -a transport=TCP,local_port=443 https-1
# flowadm show-flow -l bge0
FLOW         LINK         IP ADDR            PROTO  PORT  RPORT   DSFLD
https1       bge0         --                 tcp    443   --      --

Example 3 Modifying an Existing Policy to Add Bandwidth Resource Control

The following command modifies the https-1 policy from the preceding example. The command adds bandwidth control.

# flowadm set-flowprop -p maxbw=500M https-1
# flowadm show-flow https-1
FLOW         LINK         IP ADDR            PROTO  PORT  RPORT   DSFLD
https1       bge0         --                 tcp    443   --      --

# flowadm show-flowprop https-1
FLOW        PROPERTY    VALUE     DEFAULT      POSSIBLE
https-1     maxbw       500       --           --

Example 4 Limiting the UDP Bandwidth Usage

The following command creates a policy for UDP protocol so that it cannot consume more than 100Mbps of available bandwidth. The flow is named limit-udp-1.

# flowadm add-flow -l bge0 -a transport=UDP -p maxbw=100M, \
limit-udp-1

Example 5 Setting Policy, Making Use of dsfield Attribute

The following command sets a policy for EF PHB (DSCP value of 101110 from RFC 2598) with a bandwidth of 500 Mbps. The dsfield value for this flow will be 0x2e (101110) with the dsfield_mask being 0xfc (because we want to ignore the 2 least significant bits).

# flowadm add-flow -l bge0 -a dsfield=0x2e:0xfc \
-p maxbw=500M efphb-flow

Example 6 Viewing Flows in Multiple Zones

The following command shows two flows of the same name. The first flow is in the global zone, the second is in the zone zone1. The command is invoked from the global zone, enabling you to view all flows on the system

# flowadm show-flow
FLOW        LINK        IPADDR            PROTO  LPORT   RPORT   DSFLD
tcpflow     e1000g2     --                tcp    --      --      --
zone1/tcpflow e1000g1   --                tcp    --      --      --

Example 7 Combining Invalid Flows

All the flows on a given link must have the same combination of attributes. Consider the following sequence:

# flowadm add-flow -l e1000g0 -a transport=tcp,local_port=443 httpsflow
# flowadm add-flow -l e1000g0 -a local_ip=192.1.168.157 ngzflow

The second command will fail because the first flow uses the combination:

transport={tcp|udp|sctp},local_port=port

...which is incompatible with the combination used in the second flow:

local_ip[/prefixlen]=address

Example 8 Display Help

The following command lists the flowadm subcommands.

# flowadm help
The following subcommands are supported:
Flow subcommands : add-flow, remove-flow, reset-flowprop, 
set-flowprop, show-flow, show-flowprop

For more info, run: flowadm help subcommand

The following command illustrates the use of flowadm help with a specific subcommand.

# flowadm help add-flow
        usage:
add-flow    [-t] [-R root-dir] -l link -a attr=value[,...]
     [-p prop=value,...] flow

example:
# flowadm add-flow -l net0 -a transport=tcp -p maxbw=100 tcpflow

Exit Status

0

All actions were performed successfully.

>0

An error occurred.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE
ATTRIBUTE VALUE
Availability
system/network
Interface Stability
Committed

See Also

acctadm(1M), dladm(1M), flowstat(1M), ifconfig(1M), prstat(1M), route(1M), attributes(5), ifconfig(1M)

Notes

The show-usage subcommand, present in previous releases of flowadm, has been replaced by the flowstat(1M) -h command.