Brief instructions for setting up flow-fanout
---------------------------------------------

# apt-get install flow-tools

Add something like this to /etc/rc.local: here we assume the original source
is 10.10.0.254 and the local machine is 10.10.0.250. We will resend the
packets to 10.10.0.1-26 and to localhost.

flow-fanout 10.10.0.250/10.10.0.254/2002 \
  10.10.0.250/10.10.0.1/2002 \
  10.10.0.250/10.10.0.2/2002 \
  10.10.0.250/10.10.0.3/2002 \
  10.10.0.250/10.10.0.4/2002 \
  10.10.0.250/10.10.0.5/2002 \
  10.10.0.250/10.10.0.6/2002 \
  10.10.0.250/10.10.0.7/2002 \
  10.10.0.250/10.10.0.8/2002 \
  10.10.0.250/10.10.0.9/2002 \
  10.10.0.250/10.10.0.10/2002 \
  10.10.0.250/10.10.0.11/2002 \
  10.10.0.250/10.10.0.12/2002 \
  10.10.0.250/10.10.0.13/2002 \
  10.10.0.250/10.10.0.14/2002 \
  10.10.0.250/10.10.0.15/2002 \
  10.10.0.250/10.10.0.16/2002 \
  10.10.0.250/10.10.0.17/2002 \
  10.10.0.250/10.10.0.18/2002 \
  10.10.0.250/10.10.0.19/2002 \
  10.10.0.250/10.10.0.20/2002 \
  10.10.0.250/10.10.0.21/2002 \
  10.10.0.250/10.10.0.22/2002 \
  10.10.0.250/10.10.0.23/2002 \
  10.10.0.250/10.10.0.24/2002 \
  10.10.0.250/10.10.0.25/2002 \
  10.10.0.250/10.10.0.26/2002 \
  0/0/2002

If you are also running nfcapd (for nfsen) on the local box, you need to
change it to bind to localhost, by adding '-b 127.0.0.1' to the command
line.

The way nfsen starts nfcapd is stupid and non-extensible, but you can frig
it by editing /var/nfsen/etc/nfsen.conf and setting:

$BUFFLEN = "2000 -b 127.0.0.1";