Skip to content

Commit 07ad74b

Browse files
ZadamsaZadamsa
committed
Add "Developer" page
1 parent 31f9ad3 commit 07ad74b

31 files changed

+1122
-25
lines changed

‎_developer/BSTATS.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
title: BSTATS
3+
description: List of fields exported together with basic flow fields on the interface by BSTATS plugin. The plugin is compiled to export the first BSTATS_MAXELENCOUNT (15 by default) burst in each direction. The bursts are computed separately for each direction. Burst is defined by MINIMAL_PACKETS_IN_BURST (3 by default) and by MAXIMAL_INTERPKT_TIME (1000 ms by default) between packets to be included in a burst. When the flow contains less then MINIMAL_PACKETS_IN_BURST packets, the fields are not exported to reduce output bandwidth.
4+
fields:
5+
-
6+
name: "SBI_BRST_PACKETS"
7+
type: "uint32*"
8+
ipfix: "0/291"
9+
value: " SRC->DST: Number of packets transmitted in ith burst"
10+
-
11+
name: "SBI_BRST_BYTES"
12+
type: "uint32*"
13+
ipfix: "0/291"
14+
value: " SRC->DST: Number of bytes transmitted in ith burst"
15+
-
16+
name: "SBI_BRST_TIME_START"
17+
type: "time*"
18+
ipfix: "0/291"
19+
value: " SRC->DST: Start time of the ith burst"
20+
-
21+
name: "SBI_BRST_TIME_STOP"
22+
type: "time*"
23+
ipfix: "0/291"
24+
value: " SRC->DST: End time of the ith burst"
25+
-
26+
name: "DBI_BRST_PACKETS"
27+
type: "uint32*"
28+
ipfix: "0/291"
29+
value: " DST->SRC: Number of packets transmitted in ith burst"
30+
-
31+
name: "DBI_BRST_BYTES"
32+
type: "uint32*"
33+
ipfix: "0/291"
34+
value: " DST->SRC: Number of bytes transmitted in ith burst"
35+
-
36+
name: "DBI_BRST_TIME_START"
37+
type: "time*"
38+
ipfix: "0/291"
39+
value: " DST->SRC: Start time of the ith burst"
40+
-
41+
name: "DBI_BRST_TIME_STOP"
42+
type: "time*"
43+
ipfix: "0/291"
44+
value: " DST->SRC: End time of the ith burst"
45+
---

‎_developer/DNS-SD.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
title: DNS-SD
3+
description: List of unirec fields exported together with basic flow fields on interface by DNS-SD plugin.
4+
fields:
5+
-
6+
name: "DNSSD_QUERIES"
7+
type: "string"
8+
ipfix: "8057/826"
9+
value: " list of queries for services"
10+
-
11+
name: "DNSSD_RESPONSES"
12+
type: "string"
13+
ipfix: "8057/827"
14+
value: " list of advertised services"
15+
---

‎_developer/DNS.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
---
2+
title: DNS
3+
description: List of unirec fields exported together with basic flow fields on interface by DNS plugin.
4+
fields:
5+
-
6+
name: "DNS_ID"
7+
type: "uint16"
8+
ipfix: "8057/10"
9+
value: "transaction ID"
10+
-
11+
name: "DNS_ANSWERS"
12+
type: "uint16"
13+
ipfix: "8057/14"
14+
value: "number of DNS answer records"
15+
-
16+
name: "DNS_RCODE"
17+
type: "uint8"
18+
ipfix: "8057/1"
19+
value: "response code field"
20+
-
21+
name: "DNS_NAME"
22+
type: "string"
23+
ipfix: "8057/2"
24+
value: "question domain name"
25+
-
26+
name: "DNS_QTYPE"
27+
type: "uint16"
28+
ipfix: "8057/3"
29+
value: "question type field"
30+
-
31+
name: "DNS_CLASS"
32+
type: "uint16"
33+
ipfix: "8057/4"
34+
value: "class field of DNS question"
35+
-
36+
name: "DNS_RR_TTL"
37+
type: "uint32"
38+
ipfix: "8057/5"
39+
value: "resource record TTL field"
40+
-
41+
name: "DNS_RLENGTH"
42+
type: "uint16"
43+
ipfix: "8057/6"
44+
value: "length of DNS_RDATA"
45+
-
46+
ipfix: "8057/7"
47+
name: "DNS_RDATA"
48+
type: "bytes"
49+
value: "resource record specific data"
50+
-
51+
name: "DNS_PSIZE"
52+
type: "uint16"
53+
ipfix: "8057/8"
54+
value: "requestor's payload size"
55+
-
56+
name: "DNS_DO"
57+
type: "uint8"
58+
ipfix: "8057/9"
59+
value: "DNSSEC OK bit"
60+
---

‎_developer/Flow Hash.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
title: Flow Hash
3+
description: List of fields exported together with basic flow fields on interface by flow_hash plugin.
4+
fields:
5+
-
6+
name: "FLOW_ID"
7+
type: "uint64"
8+
ipfix: "0/148"
9+
value: " Hash of the flow - unique flow id"
10+
---

‎_developer/HTTP.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
title: HTTP
3+
description: List of unirec fields exported together with basic flow fields on interface by HTTP plugin.
4+
fields:
5+
-
6+
name: "HTTP_DOMAIN"
7+
type: "string"
8+
ipfix: "39499/1"
9+
value: "HTTP request host"
10+
-
11+
name: "HTTP_URI"
12+
type: "string"
13+
ipfix: "39499/2"
14+
value: "HTTP request url"
15+
-
16+
name: "HTTP_USERAGENT"
17+
type: "string"
18+
ipfix: "39499/20"
19+
value: "HTTP request user agent"
20+
-
21+
name: "HTTP_REFERER"
22+
type: "string"
23+
ipfix: "39499/3"
24+
value: "HTTP request referer"
25+
-
26+
name: "HTTP_STATUS"
27+
type: "uint16"
28+
ipfix: "39499/12"
29+
value: "HTTP response code"
30+
-
31+
name: "HTTP_CONTENT_TYPE"
32+
type: "string"
33+
ipfix: "39499/10"
34+
value: "HTTP response content type"
35+
-
36+
name: "HTTP_METHOD"
37+
type: "string"
38+
ipfix: "39499/200"
39+
value: "HTTP request method"
40+
-
41+
name: "HTTP_SERVER"
42+
type: "string"
43+
ipfix: "39499/201"
44+
value: "HTTP response server"
45+
-
46+
name: "HTTP_SET_COOKIE_NAMES"
47+
type: "string"
48+
ipfix: "39499/202"
49+
value: "HTTP response all set-cookie names separated by a delimiter"
50+
---

‎_developer/ICMP.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
title: ICMP
3+
description: List of fields exported together with basic flow fields on interface by icmp plugin.
4+
fields:
5+
-
6+
name: "L4_ICMP_TYPE_CODE"
7+
type: "uint16"
8+
ipfix: "0/32"
9+
value: " ICMP type (MSB) and code (LSB)"
10+
11+
---

‎_developer/IDPContent.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
title: IDPContent
3+
description: List of fields exported together with basic flow fields on the interface by IDPContent plugin. The plugin is compiled to export IDPCONTENT_SIZE (100 by default) bytes from the first data packet in SRC -> DST direction, and the first data packet in DST -> SRC direction.
4+
fields:
5+
-
6+
name: "IDP_CONTENT"
7+
type: "bytes"
8+
ipfix: "8057/850"
9+
value: " Content of first data packet from SRC -> DST"
10+
-
11+
name: "IDP_CONTENT_REV"
12+
type: "bytes"
13+
ipfix: "8057/851"
14+
value: " Content of first data packet from DST -> SRC"
15+
---

‎_developer/MPLS.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
title: MPLS
3+
description: List of fields exported together with basic flow fields on interface by mpls plugin.
4+
fields:
5+
-
6+
name: "MPLS_TOP_LABEL_STACK_SECTION"
7+
type: "bytes"
8+
ipfix: "0/70"
9+
value: " MPLS label section (without TTL), always 3 bytes"
10+
---

‎_developer/MQTT.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
title: MQTT
3+
description: List of unirec fields exported together with basic flow fields on interface by MQTT plugin.
4+
fields:
5+
-
6+
name: "MQTT_TYPE_CUMULATIVE"
7+
type: "uint16"
8+
ipfix: "8057/1033"
9+
value: " types of packets and session present flag cumulative"
10+
-
11+
name: "MQTT_VERSION"
12+
type: "uint8"
13+
ipfix: "8057/1034"
14+
value: " MQTT version"
15+
-
16+
name: "MQTT_CONNECTION_FLAGS"
17+
type: "uint8"
18+
ipfix: "8057/1035"
19+
value: " last CONNECT packet flags"
20+
-
21+
name: "MQTT_KEEP_ALIVE"
22+
type: "uint16"
23+
ipfix: "8057/1036"
24+
value: " last CONNECT keep alive"
25+
-
26+
name: "MQTT_CONNECTION_RETURN_CODE"
27+
type: "uint8"
28+
ipfix: "8057/1037"
29+
value: " last CONNECT return code"
30+
-
31+
name: "MQTT_PUBLISH_FLAGS"
32+
type: "uint8"
33+
ipfix: "8057/1038"
34+
value: " cumulative of PUBLISH packet flags"
35+
-
36+
name: "MQTT_TOPICS"
37+
type: "string"
38+
ipfix: "8057/1039"
39+
value: " topics from PUBLISH packets headers"
40+
---

‎_developer/NTP.md‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
---
2+
title: NTP
3+
description: List of unirec fields exported together with basic flow fields on interface by NTP plugin.
4+
fields:
5+
-
6+
name: "NTP_LEAP"
7+
type: "uint8"
8+
ipfix: "8057/18"
9+
value: " NTP leap field"
10+
-
11+
name: "NTP_VERSION"
12+
type: "uint8"
13+
ipfix: "8057/19"
14+
value: " NTP message version"
15+
-
16+
name: "NTP_MODE"
17+
type: "uint8"
18+
ipfix: "8057/20"
19+
value: " NTP mode field"
20+
-
21+
name: "NTP_STRATUM"
22+
type: "uint8"
23+
ipfix: "8057/21"
24+
value: " NTP stratum field"
25+
-
26+
name: "NTP_POLL"
27+
type: "uint8"
28+
ipfix: "8057/22"
29+
value: " NTP poll interval"
30+
-
31+
name: "NTP_PRECISION"
32+
type: "uint8"
33+
ipfix: "8057/23"
34+
value: " NTP precision field"
35+
-
36+
name: "NTP_DELAY"
37+
type: "uint32"
38+
ipfix: "8057/24"
39+
value: " NTP root delay"
40+
-
41+
name: "NTP_DISPERSION"
42+
type: "uint32"
43+
ipfix: "8057/25"
44+
value: " NTP root dispersion"
45+
-
46+
name: "NTP_REF_ID"
47+
type: "string"
48+
ipfix: "8057/26"
49+
value: " NTP reference ID"
50+
-
51+
name: "NTP_REF"
52+
type: "string"
53+
ipfix: "8057/27"
54+
value: " NTP reference timestamp"
55+
-
56+
name: "NTP_ORIG"
57+
type: "string"
58+
ipfix: "8057/28"
59+
value: " NTP origin timestamp"
60+
-
61+
name: "NTP_RECV"
62+
type: "string"
63+
ipfix: "8057/29"
64+
value: " NTP receive timestamp"
65+
-
66+
name: "NTP_SENT"
67+
type: "string"
68+
ipfix: "8057/30"
69+
value: " NTP transmit timestamp"
70+
---

0 commit comments

Comments
 (0)