imostocky / ipfixcol

IPFIXcol is an implementation of an IPFIX (RFC 7011) collector

#IPFIXcol framework

Table of Contents

1. Framework description
2. IPFIXcol
3. Plugins
   • External input plugins
   • External intermediate plugins
   • External storage plugins
4. Built-in tools
5. External tools
   • fbitconvert
   • fbitdump
   • fbitexpire
   • fbitmerge
   • profilesdaemon
6. Howto build
7. Docker
8. RPM
9. FastBit
10. Contact us * Reporting bugs * Forum

## Framework description IPFIXcol framework is a set of:

• IPFIXcol - collector for capturing IPFIX NetFlow data
• input, intermediate and storage plugins for collector
• tools for data processing etc.

To generate data for the IPFIXcol, look at the list list of supported flow exporters.

## IPFIXcol Described in it's README

## Plugins IPFIX collector comes with several built-in plugins described at IPFIXcol's page.

There are also external plugins that are installed separately

### External input plugins

• nfdump - NFDUMP file reader

### External intermediate plugins

• geoip - adds country codes into the metadata structure
• profiler - fills metadata informations about profiles and channels
• profile_stats - counts statistic per profile and channel
• stats - counts statistics per ODID
• uid - fills user identity information

### External storage plugins

• fastbit - uses FastBit library to store and index data
• fastbit_compression - uses FastBit library to store and index data with optional compression support
• json - converts data into JSON format
• nfdump - stores data in NFDUMP file format
• postgres - stores data into PostgreSQL database
• statistics - uses RRD library to generate statistics for collected data
• unirec - stores data in UniRec format

## Built-in tools ###ipfixviewer and ipfixconf Destribed in IPFIXcol's README

## External tools

### fbitconvert Converts data from NFDUMP file format into FastBit. Uses IPFIXcol, nfdump input plugin and fastbit storage plugin.

More info in it's README

### fbitdump

Tool for manipulating IPFIX data in FastBit database format. It uses FastBit library to read and index data.

More info in it's README

### fbitexpire

Daemon for removing old data.

More info in it's README

### fbitmerge

Tool for merging FastBit data (saves free disk space, reduces number of files..)

More info in it's README

### profilesdaemon

Tool for profiles management and distribution

More info

## How to build Whole framework can be build at once with

autoreconf -i 

to generate configure script from configure.ac, Makefile.in from Makefile.am and install missing files.

./configure

to configure packages in subdirectories and generate Makefiles.

make

to build all projects.

Or you can build each part (collector, tool(s), extarnal plugin(s)) separately.

The projects that depend on ipfixcol headers check the reltive path to base/header directory to use headers. When project is separated from the structure, it needs to have the headers installed (ipfixcol-devel package).

## Docker

IPFIXcol can be used with Docker. See Docker howto.

## Ansible

IPFIXcol can also be installed using Ansible orchestration. See Ansible howto.

## RPM Each part of framework supports building rpm packages by running

make rpm

## FastBit Plugins and tools that uses FastBit file format need FasBit library installed. IPFIXcol framework uses it's own fork of FastBit library to keep compatibility.

IPFIXcol's FastBit library can be found here.

## Contact us ### Reporting bugs

If you find any bug you can report it into issue tracker here on GitHub.

### Contributing to IPFIXcol

We are open to contributions to IPFIXcol which improve the stability and functionality of the collector. To keep the code readable and consistent, please adhere to the coding style document.

### Forum

if you have some questions or if you just want to share your ideas about useful features etc., please use this forum.

Back to Top