Skip to content

Commit 3b7e1da

Browse files
author
Pavel Siska
committed
WIP
1 parent 537eb74 commit 3b7e1da

File tree

1 file changed

+72
-1
lines changed

1 file changed

+72
-1
lines changed

‎README.md‎

Lines changed: 72 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,84 @@
66
</div>
77
</br>
88

9-
The ipfixprobe is a high-performance flow exporter. It creates bidirectional flows from packet input and exports them to output interface. The ipfixprobe support vide variety of flow extenstion for application layer protocol information. The flow extension can be turned on with process plugins. We support TLS, QUIC, HTTP, DNS and many more. Just check our [documentation](https://ipfixprobe.cesnet.cz).
9+
ipfixprobe is a high-performance, modular flow exporter that processes packets into bidirectional flows and exports them via a selected output plugin.
10+
It supports a wide range of application-layer protocol parsers, including TLS, QUIC, HTTP, DNS, and many others. These protocol-specific extensions can be enabled via process plugins in the configuration.
11+
12+
Need more details? Check out our [documentation](https://ipfixprobe.cesnet.cz) for a full list of supported protocols and usage examples.
1013

1114
[![](https://img.shields.io/badge/license-BSD-blue.svg)](https://github.com/CESNET/ipfixprobe/blob/master/LICENSE)
1215
[![](https://img.shields.io/badge/docs-ipfixprobe-blue.svg)](https://ipfixprobe.cesnet.cz)
1316
![Coverity Scan](https://img.shields.io/coverity/scan/22112)
1417
![GitHub top language](https://img.shields.io/github/languages/top/CESNET/ipfixprobe)
1518

19+
## ✨ Key Features
20+
21+
- Modular input–parser–output architecture
22+
- High-speed processing (DPDK, multi-threaded, NUMA-aware)
23+
- Built-in protocol parsers: TLS, QUIC, HTTP, DNS, …
24+
- Bidirectional flow (biflow) support
25+
- Real-time telemetry and statistics
26+
27+
## 🧩 Available Plugins
28+
29+
### Input Plugins
30+
List of input plugins with estimated performance and configuration complexity.
31+
32+
| Plugin | Max Throughput | Usage Complexity | Description |
33+
|---------------|----------------|------------------|-------------------------------------------|
34+
| [`pcap_live`](./src/plugins/input/pcap/README.md#pcap-live-input-plugin) | ~1 Gbps | Easy | captures packets from a live network interface |
35+
| [`pcap_file`](./src/plugins/input/pcap/README.md#pcap-file-input-plugin) | ~1 Gbps | Easy | reads packets from an offline PCAP file |
36+
| [`raw`](./src/plugins/input/raw/README.md) | ~1 Gbps | Easy | captures packets using a raw socket |
37+
| [`ndp`](./src/plugins/input/nfb/README.md) | 400 Gbps | Medium | uses CESNET NFB/NDP hardware for packet input |
38+
| [`dpdk`](./src/plugins/input/dpdk/README.md#dpdk-input-plugin) | 400 Gbps | Complex | receives packets via high-performance DPDK |
39+
| [`dpdk-ring`](./src/plugins/input/dpdk/README.md) | 400 Gbps | Complex | receives packets from a shared DPDK memory ring |
40+
41+
### Process Plugins
42+
43+
These plugins extract protocol-specific or behavioral information from packets and enrich flow records with metadata.
44+
45+
| Plugin | Description |
46+
|---------------|--------------------------------------------------------------|
47+
| [`basic`](./src/plugins/process/basic/README.md) | extracts basic L3/L4 flow fields (IPs, ports, protocol) |
48+
| [`basicplus`](./src/plugins/process/basicplus/README.md) | adds common L3/L4 flow fields (e.g., ports, IPs, TCP flags) |
49+
| [`bstats`](./src/plugins/process/bstats/README.md) | basic flow statistics (packet/byte counters, duration, ...) |
50+
| [`dns`](./src/plugins/process/dns/README.md) | extracts DNS queries, responses, and domains |
51+
| [`dnssd`](./src/plugins/process/dnssd/README.md) | parses DNS Service Discovery (mDNS) traffic |
52+
| [`flowHash`](./src/plugins/process/flowHash/README.md) | extracts a flow hash |
53+
| [`http`](./src/plugins/process/http/README.md) | extracts HTTP methods, hosts, URIs, status codes |
54+
| [`icmp`](./src/plugins/process/icmp/README.md) | extracts ICMP type/code and related metadata |
55+
| [`idpContent`](./src/plugins/process/idpContent/README.md) | parses IDP content in flows |
56+
| [`mpls`](./src/plugins/process/mpls/README.md) | extracts MPLS labels and encapsulation metadata |
57+
| [`mqtt`](./src/plugins/process/mqtt/README.md) | parses MQTT protocol traffic (IoT messaging) |
58+
| [`netbios`](./src/plugins/process/netbios/README.md) | extracts NetBIOS session and name service info |
59+
| [`nettisa`](./src/plugins/process/nettisa/README.md) | parses NETTISA related metadata (experimental) |
60+
| [`ntp`](./src/plugins/process/ntp/README.md) | extracts NTP timestamps and server info |
61+
| [`osquery`](./src/plugins/process/osquery/README.md) | parses osquery-generated data streams |
62+
| [`ovpn`](./src/plugins/process/ovpn/README.md) | extracts metadata from OpenVPN tunnels |
63+
| [`passiveDns`](./src/plugins/process/passiveDns/README.md) | generates passive DNS entries from observed DNS traffic |
64+
| [`phists`](./src/plugins/process/phists/README.md) | parses phishing-related signatures (heuristic) |
65+
| [`pstats`](./src/plugins/process/pstats/README.md) | advanced packet statistics (e.g., inter-packet gaps) |
66+
| [`quic`](./src/plugins/process/quic/README.md) | parses QUIC protocol including SNI, versions, ALPN |
67+
| [`rtsp`](./src/plugins/process/rtsp/README.md) | extracts RTSP stream metadata |
68+
| [`sip`](./src/plugins/process/sip/README.md) | parses SIP call setup, headers, and codecs |
69+
| [`smtp`](./src/plugins/process/smtp/README.md) | extracts SMTP envelope data (from, to, subject, etc.) |
70+
| [`ssaDetector`](./src/plugins/process/ssaDetector/README.md) | performs simple anomaly detection based on traffic patterns |
71+
| [`ssdp`](./src/plugins/process/ssdp/README.md) | parses SSDP (UPnP discovery) protocol |
72+
| [`tls`](./src/plugins/process/tls/README.md) | extracts TLS handshake info (SNI, version, JA3, cert info) |
73+
| [`vlan`](./src/plugins/process/vlan/README.md) | extracts VLAN IDs and QinQ encapsulation |
74+
| [`wg`](./src/plugins/process/wg/README.md) | parses WireGuard handshake and endpoint metadata |
75+
76+
### Output Plugins
77+
78+
These plugins export flow records to various formats and external systems.
79+
80+
| Plugin | Description |
81+
|---------------|-----------------------------------------------------------------------------|
82+
| [`ipfix`](./src/plugins/output/ipfix/README.md) | exports flow records in IPFIX format to a remote collector (UDP/TCP) |
83+
| [`text`](./src/plugins/output/text/README.md) | writes flow records in human-readable text to a file or stdout |
84+
| [`unirec`](./src/plugins/output/unirec/README.md) | exports flow records using the UniRec format for NEMEA/TRAP ecosystem |
85+
86+
1687

1788
## 🛠️ Installation
1889
The RPM packages for RHEL based distributions can be downloaded from our [copr repository](https://copr.fedorainfracloud.org/coprs/g/CESNET/ipfixprobe/package/ipfixprobe/). Or just simply run:

0 commit comments

Comments
 (0)