Skip to content

Commit c5b0e0f

Browse files
Zainullin DamirZainullin Damir
Zainullin Damir
authored and
Zainullin Damir
committed
++
1 parent f439840 commit c5b0e0f

File tree

5 files changed

+70
-70
lines changed

5 files changed

+70
-70
lines changed

‎src/plugins/process/basicPlus/README.md‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -4,24 +4,24 @@ The **BasicPlus** plugin extends flow records with additional basic network info
44

55
## Features
66

7-
- Extends standard flow export data with additional fields.
8-
- Extracts and exports key network-level fields for both directions of a flow.
7+
- Extends standard flow export data with additional fields.
8+
- Extracts and exports key network-level fields for both directions of a flow.
99

1010
## Output Fields
1111

12-
| Field Name | Data Type | Description |
13-
|---------------|-----------|-------------|
14-
| `IP_TTL` | `uint8_t` | IP time-to-live (source → destination) |
15-
| `IP_TTL_REV` | `uint8_t` | IP time-to-live (destination → source) |
16-
| `IP_FLG` | `uint8_t` | IP flags (source → destination) |
17-
| `IP_FLG_REV` | `uint8_t` | IP flags (destination → source) |
18-
| `TCP_WIN` | `uint16_t`| TCP window size (source → destination) |
19-
| `TCP_WIN_REV` | `uint16_t`| TCP window size (destination → source) |
20-
| `TCP_OPT` | `uint64_t`| TCP options (source → destination) |
21-
| `TCP_OPT_REV` | `uint64_t`| TCP options (destination → source) |
22-
| `TCP_MSS` | `uint32_t`| TCP maximum segment size (source → destination) |
23-
| `TCP_MSS_REV` | `uint32_t`| TCP maximum segment size (destination → source) |
24-
| `TCP_SYN_SIZE`| `uint16_t`| TCP SYN packet size (only one per bidirectional flow) |
12+
| Field Name | Data Type | Description |
13+
| -------------- | ---------- | ----------------------------------------------------- |
14+
| `IP_TTL` | `uint8_t` | IP time-to-live (source → destination) |
15+
| `IP_TTL_REV` | `uint8_t` | IP time-to-live (destination → source) |
16+
| `IP_FLG` | `uint8_t` | IP flags (source → destination) |
17+
| `IP_FLG_REV` | `uint8_t` | IP flags (destination → source) |
18+
| `TCP_WIN` | `uint16_t` | TCP window size (source → destination) |
19+
| `TCP_WIN_REV` | `uint16_t` | TCP window size (destination → source) |
20+
| `TCP_OPT` | `uint64_t` | TCP options (source → destination) |
21+
| `TCP_OPT_REV` | `uint64_t` | TCP options (destination → source) |
22+
| `TCP_MSS` | `uint32_t` | TCP maximum segment size (source → destination) |
23+
| `TCP_MSS_REV` | `uint32_t` | TCP maximum segment size (destination → source) |
24+
| `TCP_SYN_SIZE` | `uint16_t` | TCP SYN packet size (only one per bidirectional flow) |
2525

2626
## Usage
2727

@@ -38,4 +38,4 @@ process_plugins:
3838
3939
You can also enable the plugin directly from the command line:
4040
41-
```ipfixprobe -p basicplus ...```
41+
`ipfixprobe -p basicplus ...`

‎src/plugins/process/bstats/README.md‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,20 +5,20 @@ The **BurstStats Plugin** extends flow records with burst packet statistics to p
55
## Features
66

77
- Consider packet to be a part of burst if it arrives within short time interval after previous packet.
8-
- Extracts and exports burst statistics from network flows.
8+
- Extracts and exports burst statistics from network flows.
99

1010
## Output Fields
1111

12-
| Field Name | Data Type | Description |
13-
|-----------------|-----------|-------------------------------------------------------------|
14-
| `SBI_BRST_PACKETS`| `uint32_t` | Array of packet counts in each burst (source → destination) |
15-
| `SBI_BRST_BYTES` | `uint32_t` | Array of bytes in each burst (source → destination) |
16-
| `SBI_BRST_TIME_START` | `Timestamp` | Array of burst start times (source → destination) |
17-
| `SBI_BRST_TIME_STOP` | `Timestamp` | Array of burst end times (source → destination) |
18-
| `DBI_BRST_PACKETS`| `uint32_t` | Array of packets in each burst (destination → source) |
19-
| `DBI_BRST_BYTES` | `uint32_t` | Array of bytes in each burst (destination → source) |
20-
| `DBI_BRST_TIME_START` | `Timestamp` | Array of burst start times (destination → source) |
21-
| `DBI_BRST_TIME_STOP` | `Timestamp` | Array of burst end times (destination → source) |
12+
| Field Name | Data Type | Description |
13+
| --------------------- | ----------- | ----------------------------------------------------------- |
14+
| `SBI_BRST_PACKETS` | `uint32_t` | Array of packet counts in each burst (source → destination) |
15+
| `SBI_BRST_BYTES` | `uint32_t` | Array of bytes in each burst (source → destination) |
16+
| `SBI_BRST_TIME_START` | `Timestamp` | Array of burst start times (source → destination) |
17+
| `SBI_BRST_TIME_STOP` | `Timestamp` | Array of burst end times (source → destination) |
18+
| `DBI_BRST_PACKETS` | `uint32_t` | Array of packets in each burst (destination → source) |
19+
| `DBI_BRST_BYTES` | `uint32_t` | Array of bytes in each burst (destination → source) |
20+
| `DBI_BRST_TIME_START` | `Timestamp` | Array of burst start times (destination → source) |
21+
| `DBI_BRST_TIME_STOP` | `Timestamp` | Array of burst end times (destination → source) |
2222

2323
## Usage
2424

@@ -35,4 +35,4 @@ process_plugins:
3535
3636
You can also enable the plugin directly from the command line:
3737
38-
```ipfixprobe -p bstats ...```
38+
`ipfixprobe -p bstats ...`

‎src/plugins/process/dns/README.md‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -9,19 +9,19 @@ The **DNS Plugin** extends flow records with DNS query and response information.
99

1010
## Output Fields
1111

12-
| Field Name | Data Type | Description |
13-
|-----------------|-----------|----------------------------------------|
14-
| `DNS_ID`| `uint16_t` | Unique identifier of the processed DNS query |
15-
| `DNS_ANSWERS`| `uint16_t` | Number of answers in the processed DNS response |
16-
| `DNS_RCODE`| `uint8_t` | Response code of the processed DNS response |
17-
| `DNS_QTYPE`| `uint16_t` | Type of the DNS query |
18-
| `DNS_CLASS`| `uint16_t` | Class of the DNS query |
19-
| `DNS_NAME`| `string` | Domain name in the DNS query |
20-
| `DNS_RR_TTL`| `uint32_t` | Time-to-live of the first DNS response |
21-
| `DNS_RLENGTH`| `uint16_t` | Length of the first DNS response |
22-
| `DNS_RDATA`| `bytes` | Data of the first DNS response |
23-
| `DNS_PSIZE`| `uint16_t` | Length of the first DNS additional record from response |
24-
| `DNS_DO`| `uint8_t` | DNSSEC OK flag of the first DNS additional record from response |
12+
| Field Name | Data Type | Description |
13+
| ------------- | ---------- | --------------------------------------------------------------- |
14+
| `DNS_ID` | `uint16_t` | Unique identifier of the processed DNS query |
15+
| `DNS_ANSWERS` | `uint16_t` | Number of answers in the processed DNS response |
16+
| `DNS_RCODE` | `uint8_t` | Response code of the processed DNS response |
17+
| `DNS_QTYPE` | `uint16_t` | Type of the DNS query |
18+
| `DNS_CLASS` | `uint16_t` | Class of the DNS query |
19+
| `DNS_NAME` | `string` | Domain name in the DNS query |
20+
| `DNS_RR_TTL` | `uint32_t` | Time-to-live of the first DNS response |
21+
| `DNS_RLENGTH` | `uint16_t` | Length of the first DNS response |
22+
| `DNS_RDATA` | `bytes` | Data of the first DNS response |
23+
| `DNS_PSIZE` | `uint16_t` | Length of the first DNS additional record from response |
24+
| `DNS_DO` | `uint8_t` | DNSSEC OK flag of the first DNS additional record from response |
2525

2626
## Usage
2727

@@ -38,4 +38,4 @@ process_plugins:
3838
3939
You can also enable the plugin directly from the command line:
4040
41-
```ipfixprobe -p dns ...```
41+
`ipfixprobe -p dns ...`

‎src/plugins/process/dnssd/README.md‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,17 @@ The **DNSSD Plugin** extends flow records with DNS-SD (DNS Service Discovery) qu
88

99
## Parameters
1010

11-
| Long name | Short name | Type | Default | Description |
12-
|-----------|------------|--------|---------|-------------------------------------------------------------|
13-
| `txt` | `t` | `Path to file` | **Disabled** | If no file provided, processes all DNSSD TXT records. If a file is provided, only processes TXT records listed in the file. Whitelist format is `service.domain,txt_key1,txt_key2,...` |
11+
| Long name | Short name | Type | Default | Description |
12+
| -------------------------------------------------------------------------------------------------------------------------------- | ---------- | -------------- | ------------ | ----------------------------------------------------- |
13+
| `txt` | `t` | `Path to file` | **Disabled** | If no file provided, processes all DNSSD TXT records. |
14+
| If a file is provided, only processes TXT records listed in the file. Whitelist format is `service.domain,txt_key1,txt_key2,...` |
1415

1516
## Output Fields
1617

17-
| Field Name | Data Type | Description |
18-
|-----------------|-----------|----------------------------------------|
19-
| `DNSSD_QUERIES`| `string` | Concatenated list of requested services |
20-
| `DNSSD_RESPONSES`| `string` | Concatenated list of processed DNS responses: name, src port, cpu, operating system, TXT record content |
18+
| Field Name | Data Type | Description |
19+
| ----------------- | --------- | ------------------------------------------------------------------------------------------------------- |
20+
| `DNSSD_QUERIES` | `string` | Concatenated list of requested services |
21+
| `DNSSD_RESPONSES` | `string` | Concatenated list of processed DNS responses: name, src port, cpu, operating system, TXT record content |
2122

2223
## Usage
2324

@@ -34,6 +35,6 @@ process_plugins:
3435
3536
You can also enable the plugin directly from the command line:
3637
37-
```ipfixprobe -p dnssd ...```
38-
```ipfixprobe -p "dnssd;txt" ...```
39-
```ipfixprobe -p "dnssd;txt=<path_to_file>" ...```
38+
`ipfixprobe -p dnssd ...`
39+
`ipfixprobe -p "dnssd;txt" ...`
40+
`ipfixprobe -p "dnssd;txt=<path_to_file>" ...`

‎src/plugins/process/nettisa/README.md‎

Lines changed: 17 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -8,21 +8,21 @@ This plugin analyzes network data as time series, enabling more comprehensive an
88

99
## Output Fields
1010

11-
| Field Name | Data Type | Description |
12-
|-----------------|-----------|----------------------------------------|
13-
| `NTS_MEAN` | `float` | Mean packet length over the flow duration. |
14-
| `NTS_MIN` | `uint16_t` | Minimum packet length over the flow duration. |
15-
| `NTS_MAX` | `uint16_t` | Maximum packet length over the flow duration. |
16-
| `NTS_STDEV` | `float` | Standard deviation of packet lengths over the flow duration. |
17-
| `NTS_KURTOSIS` | `float` | Kurtosis of packet lengths over the flow duration. |
18-
| `NTS_ROOT_MEAN_SQUARE` | `float` | Root mean square of packet lengths over the flow duration. |
19-
| `NTS_AVERAGE_DISPERSION` | `float` | Average dispersion of packet lengths over the flow duration. |
20-
| `NTS_MEAN_SCALED_TIME` | `float` | Mean of packet lengths scaled by time over the flow duration. |
21-
| `NTS_MEAN_DIFFTIMES` | `float` | Mean of time differences between packets over the flow duration. |
22-
| `NTS_MIN_DIFFTIMES` | `float` | Minimum of time differences between packets over the flow duration. |
23-
| `NTS_MAX_DIFFTIMES` | `float` | Maximum of time differences between packets over the flow duration. |
24-
| `NTS_TIME_DISTRIBUTION` | `float` | Sum of deviations from mean interpacket arrival times. |
25-
| `NTS_SWITCHING_RATIO` | `float` | Ratio of packets when payload length changed in comparison to previous packet. |
11+
| Field Name | Data Type | Description |
12+
| ------------------------ | ---------- | ------------------------------------------------------------------------------ |
13+
| `NTS_MEAN` | `float` | Mean packet length over the flow duration. |
14+
| `NTS_MIN` | `uint16_t` | Minimum packet length over the flow duration. |
15+
| `NTS_MAX` | `uint16_t` | Maximum packet length over the flow duration. |
16+
| `NTS_STDEV` | `float` | Standard deviation of packet lengths over the flow duration. |
17+
| `NTS_KURTOSIS` | `float` | Kurtosis of packet lengths over the flow duration. |
18+
| `NTS_ROOT_MEAN_SQUARE` | `float` | Root mean square of packet lengths over the flow duration. |
19+
| `NTS_AVERAGE_DISPERSION` | `float` | Average dispersion of packet lengths over the flow duration. |
20+
| `NTS_MEAN_SCALED_TIME` | `float` | Mean of packet lengths scaled by time over the flow duration. |
21+
| `NTS_MEAN_DIFFTIMES` | `float` | Mean of time differences between packets over the flow duration. |
22+
| `NTS_MIN_DIFFTIMES` | `float` | Minimum of time differences between packets over the flow duration. |
23+
| `NTS_MAX_DIFFTIMES` | `float` | Maximum of time differences between packets over the flow duration. |
24+
| `NTS_TIME_DISTRIBUTION` | `float` | Sum of deviations from mean interpacket arrival times. |
25+
| `NTS_SWITCHING_RATIO` | `float` | Ratio of packets when payload length changed in comparison to previous packet. |
2626

2727
## Usage
2828

@@ -32,12 +32,11 @@ Add the plugin to your ipfixprobe YAML configuration:
3232

3333
```yaml
3434
process_plugins:
35-
- nettisa
35+
- nettisa
3636
```
3737
3838
### CLI Usage
3939
4040
You can also enable the plugin directly from the command line:
4141
42-
```ipfixprobe -p nettisa ...```
43-
42+
`ipfixprobe -p nettisa ...`

0 commit comments

Comments
 (0)