Skip to content

Commit e1ba5fd

Browse files
committed
Viewer: output format improvements, added new readme
The plugin now dependes on ipfixcol v2.1.0 (requires list iterators provided by libfds v0.2.0)
1 parent 62d5eab commit e1ba5fd

File tree

5 files changed

+488
-170
lines changed

5 files changed

+488
-170
lines changed
Lines changed: 79 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,19 @@
11
Viewer (output plugin)
22
=====================
33

4-
The plugin provides a way how to observe functionality of collector.
5-
Viewer module prints information about incoming IPFIX packets and data inside of them.
4+
The plugin converts IPFIX Messages into plain text and prints them on standard output.
5+
6+
The main goal of the plugin is to show content of received IPFIX Messages in human readable form.
7+
Each IPFIX Message is broken down into IPFIX Sets and each IPFIX Set is further broken down into
8+
(Options) Template/Data records and so on. Fields of the Data records are formatted according
9+
to the expected data type, if their corresponding Information Element definitions are known to
10+
the collector. Therefore, the output can be also used to determine missing Information Element
11+
definitions.
12+
13+
Biflow records and structured data types are also supported and appropriately formatted.
14+
Output is not supposed to be further parsed because its format can be changed in the future.
15+
However, if you are interested into processing Data Records, consider using other
16+
plugins such as JSON, UniRec, etc.
617

718
Example configuration
819
---------------------
@@ -12,10 +23,74 @@ Example configuration
1223
<output>
1324
<name>Viewer output</name>
1425
<plugin>viewer</plugin>
15-
<params>
16-
</params>
26+
<params/>
1727
</output>
1828
1929
Parameters
2030
----------
2131

32+
Parameters are not supported by the plugin.
33+
34+
Example output
35+
--------------
36+
37+
Below you can see example output for anonymized IPFIX Messages. The message structure and
38+
available fields of Data Record vary from exporter to exporter.
39+
40+
.. code-block::
41+
42+
IPFIX Message header:
43+
Version: 10
44+
Length: 176
45+
Export time: 1455534348
46+
Sequence no.: 0
47+
ODID: 1
48+
49+
Set Header:
50+
Set ID: 2 (Template Set)
51+
Length: 160
52+
Template Record (#1)
53+
Template ID: 256
54+
Field Count: 27
55+
EN: 0 ID: 1 Size: 4 | iana:octetDeltaCount
56+
EN: 0 ID: 2 Size: 4 | iana:packetDeltaCount
57+
EN: 0 ID: 152 Size: 8 | iana:flowStartMilliseconds
58+
EN: 0 ID: 153 Size: 8 | iana:flowEndMilliseconds
59+
EN: 0 ID: 10 Size: 2 | iana:ingressInterface
60+
EN: 0 ID: 60 Size: 1 | iana:ipVersion
61+
EN: 0 ID: 8 Size: 4 | iana:sourceIPv4Address
62+
EN: 0 ID: 12 Size: 4 | iana:destinationIPv4Address
63+
EN: 0 ID: 5 Size: 1 | iana:ipClassOfService
64+
EN: 0 ID: 192 Size: 1 | iana:ipTTL
65+
EN: 0 ID: 4 Size: 1 | iana:protocolIdentifier
66+
EN: 0 ID: 7 Size: 2 | iana:sourceTransportPort
67+
EN: 0 ID: 11 Size: 2 | iana:destinationTransportPort
68+
... <~ output shortened for clarity ~> ...
69+
70+
-------------------------------------------------------------------
71+
IPFIX Message header:
72+
Version: 10
73+
Length: 216
74+
Export time: 1455534348
75+
Sequence no.: 0
76+
ODID: 1
77+
78+
Set Header:
79+
Set ID: 256 (Data Set)
80+
Length: 200
81+
Template ID: 256
82+
Data Record (#1) [Length: 95]:
83+
EN: 0 ID: 1 iana:octetDeltaCount : 76 octets
84+
EN: 0 ID: 2 iana:packetDeltaCount : 1 packets
85+
EN: 0 ID: 152 iana:flowStartMilliseconds : 2016-02-15T11:05:48.150Z
86+
EN: 0 ID: 153 iana:flowEndMilliseconds : 2016-02-15T11:05:48.150Z
87+
EN: 0 ID: 10 iana:ingressInterface : 1
88+
EN: 0 ID: 60 iana:ipVersion : 4
89+
EN: 0 ID: 8 iana:sourceIPv4Address : 209.246.218.165
90+
EN: 0 ID: 12 iana:destinationIPv4Address : 93.113.168.59
91+
EN: 0 ID: 5 iana:ipClassOfService : 0
92+
EN: 0 ID: 192 iana:ipTTL : 122 hops
93+
EN: 0 ID: 4 iana:protocolIdentifier : 17
94+
EN: 0 ID: 7 iana:sourceTransportPort : 62299
95+
EN: 0 ID: 11 iana:destinationTransportPort : 53
96+
... <~ output shortened for clarity ~> ...

0 commit comments

Comments
 (0)