=pod

=head1 NAME

B<rwsetintersect> - Perform intersection operations on IPset files

=head1 SYNOPSIS

  rwsetintersect  --add-set=IPSET_FILE
        [--add-set=IPSET_FILE...] [--remove-set=IPSET_FILE...]
        [--compression-method=COMP_METHOD]
        {--print-ips | --integer-ips | --set-file=IPSET_FILE}

=head1 DESCRIPTION

B<rwsetintersect> takes multiple binary IPset files and intersects
them, generating a new IPset which can be saved in a binary IPset file
or written to the standard output when the standard output is not
connected to a terminal.  An output destination must be specified.

The IPset files are specified as either B<--add-set> or
B<--remove-set>; at least one B<--add-set> IPset must be specified.

First, B<rwsetintersect> performs the intersection of all specified
B<--add-set> files.  From the resulting IPset, B<rwsetintersect> then
removes all addresses specified in the B<--remove-set> files.

B<rwsetintersect> uses binary IPset files, not SiLK Flow data.

=head1 OPTIONS

Option names may be abbreviated if the abbreviation is unique or is an
exact match for an option.  A parameter to an option may be specified
as B<--arg>=I<param> or B<--arg> I<param>, though the first form is
required for options that take optional parameters.

=over 4

=item B<--add-set>=I<IPSET_FILE>

Specifies an intersection add file.  At the minimum, one add file must
be specified.  Use C<stdin> to read a binary IPset from the standard
input.

=item B<--remove-set>=I<IPSET_FILE>

Specifies an intersection remove file.  Remove files are optional.
Use C<stdin> to read a binary IPset from the standard input.

=item B<--compression-method>=I<COMP_METHOD>

Set the compression method of the output to I<COMP_METHOD>.  Some SiLK
tools can use an external library to compress their binary output.
The list of available compression methods and the default method are
set when SiLK is compiled (the B<--help> and B<--version> switches
print the available and default compression methods) and depend on
which supported libraries are found.  SiLK can support:

=over 4

=item none

Do not compress the output using an external library

=item zlib

Use the B<zlib(3)> library for compressing the output

=item lzo1x

Use the I<lzo1x> algorithm from the LZO real time compression library
for compression

=item best

Use whichever available method gives the C<best> compression in
general, though not necessarily the C<best> for this particular
output.

=back

=back

One of the following output switches is required; multiple switches
may be specified:

=over 4

=item B<--print-ips>

Print the resulting IP addresses to the standard output.

=item B<--integer-ips>

Enable the B<--print-ips> option, but print the IPs as integers
instead of as dotted decimal.

=item B<--set-file>=I<IPSET_FILE>

Write the IP addresses to a binary IPset file named I<IPSET_FILE>.
Use C<stdout> to write the IPset to the standard output.

=back

=head1 EXAMPLES

B<rwsetintersect> uses add-sets and remove-sets.  An add-set IPset is
intersected in the normal fashion, while a remove-set's negation is
intersected.

For example, assume the following sets A,B,C,D:

  A = {1,2,3,4}
  B = {2,3,4,5}
  C = {3,4,5,6}
  D = {8,9,10,11}

then:

  A /\ B
      --add-set=A --add-set=B would result in {2,3,4}

  A /\ C
      --add-set=A --add-set=C would result in {3,4}

  A /\ D
      --add-set=A --add-set=D would result in {}

  A /\ ~D
      --add-set=A --remove-set=D would result in {1,2,3,4}

  A /\ ~A
      --add-set=A --remove-set=A would result in {}

  B /\ ~A
      --add-set=B --remove-set=A would result in {5}

  A /\ ~B
      --add-set=A --remove-set=B would result in {1}


=head1 NOTES

B<rwsettool> supersedes B<rwsetunion>.

All B<--add-set> operations are performed first, followed by all
B<--remove-set> operations.


=head1 SEE ALSO

B<rwsettool(1)>, B<rwset(1)>, B<rwsetbuild(1)>, B<rwsetcat(1)>

=cut

$SiLK: rwsetintersect.pod 6651 2007-03-14 13:03:31Z mthomas $

Local Variables:
mode:text
indent-tabs-mode:nil
End: