Skip to content

Commit 866dfaf

Browse files
sedmichaLukas955
authored andcommitted
IPFIX output plugin: Improved README
1 parent f7af676 commit 866dfaf

File tree

1 file changed

+11
-1
lines changed

1 file changed

+11
-1
lines changed

src/plugins/output/ipfix/README.rst

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,17 @@
11
IPFIX (output plugin)
22
=====================
33

4-
The plugin outputs incoming IPFIX data to a file or a series of files in the IPFIX format.
4+
The plugin outputs incoming IPFIX Data to an IPFIX File or a series of IPFIX Files.
5+
6+
An IPFIX File is a serialized stream of IPFIX Messages. Simply put, the plugin stores all valid packets received by the collector into one or more IPFIX Files. Although this is not an optimal way to store flows, it can be quite useful for testing purposes - capture flow records into IPFIX File(s) and replay them using ipfixsend2 tool.
7+
8+
After a new file is started, all the (options) templates seen in the (options) template sets of an ODID that are still available are written to the file once the first IPFIX Message corresponding to the ODID arrives with at least one successfully parsed data record. This is necessary so each file can be used individually independent of the (options) template sets from previous files.
9+
10+
11+
Limitations
12+
-----------
13+
As there is no session information in raw IPFIX Data, we can't distinguish messages from multiple sessions using the same ODID. For this reason, the same ODID can only be used by one session at a time, and all messages from other sessions using the ODID that's already in use are ignored and a warning message is printed. All ODIDs used by a session are released once the session closes and they can be used by another session.
14+
515

616
Example configuration
717
---------------------

0 commit comments

Comments
 (0)