Skip to content

Commit 8026500

Browse files
Zainullin DamirZainullin Damir
Zainullin Damir
authored and
Zainullin Damir
committed
++
1 parent c5b0e0f commit 8026500

File tree

103 files changed

+3443
-2971
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

103 files changed

+3443
-2971
lines changed

‎src/plugins/process/dnssd/README.md‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,9 @@ The **DNSSD Plugin** extends flow records with DNS-SD (DNS Service Discovery) qu
88

99
## Parameters
1010

11-
| Long name | Short name | Type | Default | Description |
12-
| -------------------------------------------------------------------------------------------------------------------------------- | ---------- | -------------- | ------------ | ----------------------------------------------------- |
13-
| `txt` | `t` | `Path to file` | **Disabled** | If no file provided, processes all DNSSD TXT records. |
14-
| If a file is provided, only processes TXT records listed in the file. Whitelist format is `service.domain,txt_key1,txt_key2,...` |
11+
| Long name | Short name | Type | Default | Description |
12+
| --------- | ---------- | -------------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
13+
| `txt` | `t` | `Path to file` | **Disabled** | If no file provided, processes all DNSSD TXT records. If a file is provided, only processes TXT records listed in the file. Whitelist format is `service.domain,txt_key1,txt_key2,...` |
1514

1615
## Output Fields
1716

‎src/plugins/process/flowHash/README.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@ The **FlowHash Plugin** extends flow records with flow hashing information.
88

99
## Output Fields
1010

11-
| Field Name | Data Type | Description |
12-
|-----------------|-----------|----------------------------------------|
13-
| `FLOW_ID`| `uint64_t` | Assigned flow hash |
11+
| Field Name | Data Type | Description |
12+
| ---------- | ---------- | ------------------ |
13+
| `FLOW_ID` | `uint64_t` | Assigned flow hash |
1414

1515
## Usage
1616

@@ -20,11 +20,11 @@ Add the plugin to your ipfixprobe YAML configuration:
2020

2121
```yaml
2222
process_plugins:
23-
- flowhash
23+
- flowhash
2424
```
2525
2626
### CLI Usage
2727
2828
You can also enable the plugin directly from the command line:
2929
30-
```ipfixprobe -p flowhash ...```
30+
`ipfixprobe -p flowhash ...`

‎src/plugins/process/http/README.md‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -10,17 +10,17 @@ Plugin enables detailed analysis of HTTP traffic by extracting key fields from H
1010

1111
## Output Fields
1212

13-
| Field Name | Data Type | Description |
14-
|-----------------|-----------|----------------------------------------|
15-
| `HTTP_REQUEST_METHOD`| `string` | HTTP request method (e.g., GET, POST) |
16-
| `HTTP_REQUEST_HOST`| `string` | Requested HTTP host |
17-
| `HTTP_REQUEST_URL`| `string` | Requested URL |
18-
| `HTTP_REQUEST_AGENT`| `string` | User agent of the requester |
19-
| `HTTP_REQUEST_REFERER`| `string` | HTTP request referer |
20-
| `HTTP_RESPONSE_STATUS_CODE`| `uint16_t` | Response status code |
21-
| `HTTP_RESPONSE_CONTENT_TYPE`| `string` | Response content type |
22-
| `HTTP_RESPONSE_SERVER`| `string` | Response server |
23-
| `HTTP_RESPONSE_SET_COOKIE_NAMES`| `string` | Concatenated names of cookies that were set |
13+
| Field Name | Data Type | Description |
14+
| -------------------------------- | ---------- | ------------------------------------------- |
15+
| `HTTP_REQUEST_METHOD` | `string` | HTTP request method (e.g., GET, POST) |
16+
| `HTTP_REQUEST_HOST` | `string` | Requested HTTP host |
17+
| `HTTP_REQUEST_URL` | `string` | Requested URL |
18+
| `HTTP_REQUEST_AGENT` | `string` | User agent of the requester |
19+
| `HTTP_REQUEST_REFERER` | `string` | HTTP request referer |
20+
| `HTTP_RESPONSE_STATUS_CODE` | `uint16_t` | Response status code |
21+
| `HTTP_RESPONSE_CONTENT_TYPE` | `string` | Response content type |
22+
| `HTTP_RESPONSE_SERVER` | `string` | Response server |
23+
| `HTTP_RESPONSE_SET_COOKIE_NAMES` | `string` | Concatenated names of cookies that were set |
2424

2525
## Usage
2626

@@ -37,4 +37,4 @@ process_plugins:
3737
3838
You can also enable the plugin directly from the command line:
3939
40-
```ipfixprobe -p http ...```
40+
`ipfixprobe -p http ...`

‎src/plugins/process/icmp/README.md‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@ Plugin extracts and exports ICMP type and code if present.
44

55
## Output Fields
66

7-
| Field Name | Data Type | Description |
8-
|-----------------|-----------|----------------------------------------|
9-
| `L4_ICMP_TYPE_CODE` | `uint16_t` | ICMP type in first byte and code in the second byte |
7+
| Field Name | Data Type | Description |
8+
| ------------------- | ---------- | --------------------------------------------------- |
9+
| `L4_ICMP_TYPE_CODE` | `uint16_t` | ICMP type in first byte and code in the second byte |
1010

1111
## Usage
1212

@@ -23,6 +23,4 @@ process_plugins:
2323
2424
You can also enable the plugin directly from the command line:
2525
26-
```ipfixprobe -p icmp ...```
27-
28-
26+
`ipfixprobe -p icmp ...`

‎src/plugins/process/idpContent/README.md‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,10 @@ Plugin captures and exports the payloads of the first packets.
88

99
## Output Fields
1010

11-
| Field Name | Data Type | Description |
12-
|-----------------|-----------|----------------------------------------|
13-
| `IDP_CONTENT`| `bytes` | Payload of first packet (source → destination) |
14-
| `IDP_CONTENT_REV`| `bytes` | Payload of first packet (destination → source) |
11+
| Field Name | Data Type | Description |
12+
| ----------------- | --------- | ---------------------------------------------- |
13+
| `IDP_CONTENT` | `bytes` | Payload of first packet (source → destination) |
14+
| `IDP_CONTENT_REV` | `bytes` | Payload of first packet (destination → source) |
1515

1616
## Usage
1717

@@ -28,5 +28,4 @@ process_plugins:
2828
2929
You can also enable the plugin directly from the command line:
3030
31-
```ipfixprobe -p idpcontent ...```
32-
31+
`ipfixprobe -p idpcontent ...`

‎src/plugins/process/mpls/README.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@ Plugin extracts and exports MPLS top label if present.
44

55
## Output Fields
66

7-
| Field Name | Data Type | Description |
8-
|-----------------|-----------|----------------------------------------|
9-
| `MPLS_TOP_LABEL_STACK_SECTION` | `uint32_t` | MPLS top label from the packet |
7+
| Field Name | Data Type | Description |
8+
| ------------------------------ | ---------- | ------------------------------ |
9+
| `MPLS_TOP_LABEL_STACK_SECTION` | `uint32_t` | MPLS top label from the packet |
1010

1111
## Usage
1212

@@ -23,4 +23,4 @@ process_plugins:
2323
2424
You can also enable the plugin directly from the command line:
2525
26-
```ipfixprobe -p mpls ...```
26+
`ipfixprobe -p mpls ...`

‎src/plugins/process/mqtt/README.md‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -6,28 +6,28 @@ The **MQTT Plugin** extends flow records with MQTT (Message Queuing Telemetry Tr
66

77
- Extracts and exports MQTT fields if flow contains MQTT information.
88
- Only MQTT v3.1.1 and v5.0 are supported.
9-
- Flow is finished when *disconect* message is received.
9+
- Flow is finished when _disconect_ message is received.
1010

1111
## Parameters
1212

13-
| Long name | Short name | Type | Default | Description |
14-
|-----------|------------|--------|---------|-------------------------------------------------------------|
15-
| `tc` | `topiccount` | `int` | 10 | Maximal count of topics from *publish* messages to save |
13+
| Long name | Short name | Type | Default | Description |
14+
| --------- | ------------ | ----- | ------- | ------------------------------------------------------- |
15+
| `tc` | `topiccount` | `int` | 10 | Maximal count of topics from _publish_ messages to save |
1616

1717
## Output Fields
1818

19-
| Field Name | Data Type | Description |
20-
|-----------------|-----------|----------------------------------------|
21-
| `MQQT_TYPE_CUMULATIVE`| `uint16_t` | Bitfield of messages that were detected during the communication. Each value takes 1 bit.
22-
DISCONNECT \| PINGRESP \| PINGREQ \| UNSUBACK \| UNSUBSCRIBE \|
23-
SUBACK \| SUBSCRIBE \| PUBCOMP \| PUBREL \| PUBREC \| PUBACK \| PUBLISH \|
24-
CONNACK \| CONNECT \| session present flag from *connection* message\|
25-
| `MQTT_VERSION`| `uint8_t` | Identifies the MQTT version being used. |
26-
| `MQTT_CONNECTION_FLAGS`| `uint8_t` | Flags of *connection* message. |
27-
| `MQTT_KEEP_ALIVE`| `uint16_t` | MQTT connection keep alive |
28-
| `MQTT_CONNECTION_RETURN_CODE`| `uint8_t` | Return code value from *connack* message. |
29-
| `MQTT_PUBLISH_FLAGS`| `uint8_t` | Cumulative of *publish* message flags. |
30-
| `MQTT_TOPICS`| `string` | Concatenation of **topiccount** topics from *publish* messages. |
19+
| Field Name | Data Type | Description |
20+
| -------------------------------------------------------------------------- | ---------- | ----------------------------------------------------------------------------------------- |
21+
| `MQQT_TYPE_CUMULATIVE` | `uint16_t` | Bitfield of messages that were detected during the communication. Each value takes 1 bit. |
22+
| DISCONNECT \| PINGRESP \| PINGREQ \| UNSUBACK \| UNSUBSCRIBE \| |
23+
| SUBACK \| SUBSCRIBE \| PUBCOMP \| PUBREL \| PUBREC \| PUBACK \| PUBLISH \| |
24+
| CONNACK \| CONNECT \| session present flag from _connection_ message\| |
25+
| `MQTT_VERSION` | `uint8_t` | Identifies the MQTT version being used. |
26+
| `MQTT_CONNECTION_FLAGS` | `uint8_t` | Flags of _connection_ message. |
27+
| `MQTT_KEEP_ALIVE` | `uint16_t` | MQTT connection keep alive |
28+
| `MQTT_CONNECTION_RETURN_CODE` | `uint8_t` | Return code value from _connack_ message. |
29+
| `MQTT_PUBLISH_FLAGS` | `uint8_t` | Cumulative of _publish_ message flags. |
30+
| `MQTT_TOPICS` | `string` | Concatenation of **topiccount** topics from _publish_ messages. |
3131

3232
## Usage
3333

@@ -37,12 +37,12 @@ Add the plugin to your ipfixprobe YAML configuration:
3737

3838
```yaml
3939
process_plugins:
40-
- mqtt
40+
- mqtt
4141
```
4242
4343
### CLI Usage
4444
4545
You can also enable the plugin directly from the command line:
4646
47-
```ipfixprobe -p mqtt ...```
48-
```ipfixprobe -p "mqtt;tc=<topic_count>" ...```
47+
`ipfixprobe -p mqtt ...`
48+
`ipfixprobe -p "mqtt;tc=<topic_count>" ...`

‎src/plugins/process/netbios/README.md‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ This plugin provides in-depth analysis of NetBIOS traffic by capturing and expor
99

1010
## Output Fields
1111

12-
| Field Name | Data Type | Description |
13-
|-----------------|-----------|-------------------------------------------------------------|
14-
| `NB_NAME` | `string` | NetBIOS name extracted from the packet |
15-
| `NB_SUFFIX` | `char` | NetBIOS suffix extracted from the packet |
12+
| Field Name | Data Type | Description |
13+
| ----------- | --------- | ---------------------------------------- |
14+
| `NB_NAME` | `string` | NetBIOS name extracted from the packet |
15+
| `NB_SUFFIX` | `char` | NetBIOS suffix extracted from the packet |
1616

1717
## Usage
1818

@@ -29,5 +29,4 @@ process_plugins:
2929
3030
You can also enable the plugin directly from the command line:
3131
32-
```ipfixprobe -p netbios ...```
33-
32+
`ipfixprobe -p netbios ...`

‎src/plugins/process/ntp/README.md‎

Lines changed: 17 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -10,24 +10,21 @@ Plugin extract and export various data from NTP packets.
1010

1111
## Output Fields
1212

13-
NTP_LEAP = 0,
14-
15-
NTP_VERSION,
16-
NTP_MODE,
17-
NTP_STRATUM,
18-
NTP_POLL,
19-
NTP_PRECISION,
20-
NTP_DELAY,
21-
NTP_DISPERSION,
22-
NTP_REF_ID,
23-
NTP_REF,
24-
NTP_ORIG,
25-
NTP_RECV,
26-
NTP_SENT
27-
28-
| Field Name | Data Type | Description |
29-
| ---------- | --------- | --------------- |
30-
| `NTP_LEAP` | `uint8_t` | Leap indicator. |
13+
| Field Name | Data Type | Description |
14+
| ---------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
15+
| `NTP_LEAP` | `uint8_t` | Leap from Network Time header. |
16+
| `NTP_MODE` | `uint8_t` | Mode from Network Time header. |
17+
| `NTP_VERSION` | `uint8_t` | Version from Network Time header. |
18+
| `NTP_STRATUM` | `uint8_t` | Stratum used to identify the distance from the reference clock. |
19+
| `NTP_POLL` | `int8_t` | The poll interval in seconds (as a power of 2) indicating how often the client queries the server. |
20+
| `NTP_PRECISION` | `int8_t` | The precision of the local clock, i.e., the smallest distinguishable time interval, usually expressed as a negative power of 2 in seconds. |
21+
| `NTP_DELAY` | `uint32_t` | The round-trip network delay between the client and the NTP server, measured in milliseconds or seconds. |
22+
| `NTP_DISPERSION` | `uint32_t` | The estimated error or uncertainty of the server's time relative to the true time, increases over time since last update. |
23+
| `NTP_REF_ID` | `string` | Identifier of the reference clock or server the NTP server is synchronized to as a string. |
24+
| `NTP_REF` | `string` | Timestamp of the last time the server clock was set or corrected as a string. |
25+
| `NTP_ORIG` | `string` | Timestamp sent by the client in the request packet as a string. |
26+
| `NTP_RECV` | `string` | Timestamp when the request was received by the server as a string. |
27+
| `NTP_SENT` | `string` | Timestamp when the response was sent by the server as a string. |
3128

3229
## Usage
3330

@@ -37,13 +34,11 @@ Add the plugin to your ipfixprobe YAML configuration:
3734

3835
```yaml
3936
process_plugins:
40-
- nettisa
37+
- ntp
4138
```
4239
4340
### CLI Usage
4441
4542
You can also enable the plugin directly from the command line:
4643
47-
```
48-
ipfixprobe -p nettisa ...
49-
```
44+
`ipfixprobe -p ntp ...`

‎src/plugins/process/osquery/README.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# OSQuery Plugin
2+
3+
Plugin for querying operating system about the flows.
4+
5+
## Features
6+
7+
- Uses osqueryi to query the operating system and exports relevant information.
8+
9+
## Output Fields
10+
11+
| Field Name | Data Type | Description |
12+
| -------------------------- | ---------- | ----------------------------------------- |
13+
| `OSQUERY_PROGRAM_NAME` | `string` | Name of the program generating the flow. |
14+
| `OSQUERY_USERNAME` | `string` | Username of the user running the program. |
15+
| `OSQUERY_OS_NAME` | `string` | Operating system name. |
16+
| `OSQUERY_OS_MAJOR` | `uint16_t` | Operating system major version. |
17+
| `OSQUERY_OS_MINOR` | `uint16_t` | Operating system minor version. |
18+
| `OSQUERY_OS_BUILD` | `string` | Operating system build. |
19+
| `OSQUERY_OS_PLATFORM` | `string` | Operating system platform. |
20+
| `OSQUERY_OS_PLATFORM_LIKE` | `string` | Windows/Linux/Darwin. |
21+
| `OSQUERY_OS_ARCH` | `string` | Operating system architecture. |
22+
| `OSQUERY_KERNEL_VERSION` | `string` | Operating system kernel version. |
23+
| `OSQUERY_SYSTEM_HOSTNAME` | `string` | System hostname. |
24+
25+
## Usage
26+
27+
### YAML Configuration
28+
29+
Add the plugin to your ipfixprobe YAML configuration:
30+
31+
```yaml
32+
process_plugins:
33+
- osquery
34+
```
35+
36+
### CLI Usage
37+
38+
You can also enable the plugin directly from the command line:
39+
40+
`ipfixprobe -p osquery ...`

0 commit comments

Comments
 (0)