ipfix

Documentation

Overview

Package ipfix decodes IPFIX packets

Index

• Variables
• func Interpret(b *[]byte, t FieldType) interface{}
• func RPC(m MemCache, config *RPCConfig)
• func RPCServer(mCache MemCache, config *RPCConfig) error
• type Data
• type DecodedField
• type Decoder
  • func NewDecoder(raddr net.IP, b []byte) *Decoder
  • func (d *Decoder) Decode(mem MemCache) (*Message, error)
• type Discovery
• type ElementKey
• type FieldType
• type IANAInfoModel
• type IRPC
  • func NewRPC(mCache MemCache) *IRPC
  • func (r *IRPC) Get(req RPCRequest, resp *TemplateRecord) error
• type InfoElementEntry
• type MemCache
  • func GetCache(cacheFile string) MemCache
  • func (m MemCache) Dump(cacheFile string) error
• type Message
  • func (m *Message) JSONMarshal(b *bytes.Buffer) ([]byte, error)
• type MessageHeader
• type RPCClient
  • func NewRPCClient(r string) (*RPCClient, error)
  • func (c *RPCClient) Get(req RPCRequest) (*TemplateRecord, error)
• type RPCConfig
• type RPCRequest
• type SetHeader
• type TemplateFieldSpecifier
• type TemplateHeader
• type TemplateRecord
• type TemplatesShard

Variables

var FieldTypes = map[string]FieldType{
	"unsigned8":            Uint8,
	"unsigned16":           Uint16,
	"unsigned32":           Uint32,
	"unsigned64":           Uint64,
	"signed8":              Int8,
	"signed16":             Int16,
	"signed32":             Int32,
	"signed64":             Int64,
	"float32":              Float32,
	"float64":              Float64,
	"boolean":              Boolean,
	"macAddress":           MacAddress,
	"octetArray":           OctetArray,
	"string":               String,
	"dateTimeSeconds":      DateTimeSeconds,
	"dateTimeMilliseconds": DateTimeMilliseconds,
	"dateTimeMicroseconds": DateTimeMicroseconds,
	"dateTimeNanoseconds":  DateTimeNanoseconds,
	"ipv4Address":          Ipv4Address,
	"ipv6Address":          Ipv6Address,
}

FieldTypes represents data types

var InfoModel = IANAInfoModel{}/* 402 elements not displayed */

InfoModel maps element to name and type based on the field id and enterprise id

Functions

func Interpret

func Interpret(b *[]byte, t FieldType) interface{}

Interpret read data fields based on the type - big endian

func RPC

func RPC(m MemCache, config *RPCConfig)

RPC handles RPC with discovery

func RPCServer

func RPCServer(mCache MemCache, config *RPCConfig) error

RPCServer runs the RPC server

Types

type Data

type Data struct {
	Template  TemplateRecord
	Timestamp int64
}

Data represents template records and updated timestamp

type DecodedField

type DecodedField struct {
	ID    uint16
	Value interface{}
}

DecodedField represents a decoded field

type Decoder

type Decoder struct {
	// contains filtered or unexported fields
}

Decoder represents IPFIX payload and remote address

func NewDecoder

func NewDecoder(raddr net.IP, b []byte) *Decoder

NewDecoder constructs a decoder

func (*Decoder) Decode

func (d *Decoder) Decode(mem MemCache) (*Message, error)

Decode decodes the IPFIX raw data

type Discovery

type Discovery struct {
	// contains filtered or unexported fields
}

Discovery represents vflow discovery

type ElementKey

type ElementKey struct {
	EnterpriseNo uint32
	ElementID    uint16
}

ElementKey represents field specifier format ids

type FieldType

type FieldType int

FieldType is IPFIX Abstract Data Types RFC5102#section-3.1

const (
	// Unknown data type
	Unknown FieldType = iota

	// Uint8 represents a non-negative integer value in the
	// range of 0 to 255.
	Uint8

	// Uint16 represents a non-negative integer value in the
	// range of 0 to 65535.
	Uint16

	// Uint32 represents a non-negative integer value in the
	// range of 0 to 4294967295.
	Uint32

	// Uint64 represents a non-negative integer value in the
	// range of 0 to 18446744073709551615.
	Uint64

	// Int8 represents an integer value in the range of -128
	// to 127.
	Int8

	// Int16 represents an integer value in the range of
	// -32768 to 32767.
	Int16

	// Int32 represents an integer value in the range of
	// -2147483648 to 2147483647.
	Int32

	// Int64 represents an integer value in the range of
	// -9223372036854775808 to 9223372036854775807.
	Int64

	// Float32 corresponds to an IEEE single-precision 32-bit
	// floating point type as defined in [IEEE.754.1985].
	Float32

	// Float64 corresponds to an IEEE double-precision 64-bit
	// floating point type as defined in [IEEE.754.1985].
	Float64

	// Boolean represents a binary value.  The only allowed
	// values are "true" and "false".
	Boolean

	// MacAddress represents a string of 6 octets.
	MacAddress

	// OctetArray represents a finite-length string of octets.
	OctetArray

	// String represents a finite-length string of valid
	String

	// DateTimeSeconds represents a time value in units of
	// seconds based on coordinated universal time (UTC).
	DateTimeSeconds

	// DateTimeMilliseconds represents a time value in units of
	// milliseconds based on coordinated universal time (UTC).
	DateTimeMilliseconds

	// DateTimeMicroseconds represents a time value in units of
	// microseconds based on coordinated universal time (UTC).
	DateTimeMicroseconds

	// DateTimeNanoseconds represents a time value in units of
	// nanoseconds based on coordinated universal time (UTC).
	DateTimeNanoseconds

	// Ipv4Address represents a value of an IPv4 address.
	Ipv4Address

	// Ipv6Address represents a value of an IPv6 address.
	Ipv6Address
)

type IANAInfoModel

type IANAInfoModel map[ElementKey]InfoElementEntry

IANAInfoModel represents IPFIX field's name, identification and type

type IRPC

type IRPC struct {
	// contains filtered or unexported fields
}

IRPC represents IPFIX RPC

func NewRPC

func NewRPC(mCache MemCache) *IRPC

NewRPC constructs RPC

func (*IRPC) Get

func (r *IRPC) Get(req RPCRequest, resp *TemplateRecord) error

Get retrieves a request from mCache

type InfoElementEntry

type InfoElementEntry struct {
	FieldID uint16
	Name    string
	Type    FieldType
}

InfoElementEntry represents standard name and type for a field - RFC5102

type MemCache

type MemCache []*TemplatesShard

MemCache represents templates shards

func GetCache

func GetCache(cacheFile string) MemCache

GetCache tries to load saved templates otherwise it constructs new empty shards

func (MemCache) Dump

func (m MemCache) Dump(cacheFile string) error

Dump saves the current templates to hard disk

type Message

type Message struct {
	AgentID  string
	Header   MessageHeader
	DataSets [][]DecodedField
}

Message represents IPFIX decoded data

func (*Message) JSONMarshal

func (m *Message) JSONMarshal(b *bytes.Buffer) ([]byte, error)

JSONMarshal encodes IPFIX message

type MessageHeader

type MessageHeader struct {
	Version    uint16 // Version of IPFIX to which this Message conforms
	Length     uint16 // Total length of the IPFIX Message, measured in octets
	ExportTime uint32 // Time at which the IPFIX Message Header leaves the Exporter
	SequenceNo uint32 // Incremental sequence counter modulo 2^32
	DomainID   uint32 // A 32-bit id that is locally unique to the Exporting Process
}

MessageHeader represents IPFIX message header

type RPCClient

type RPCClient struct {
	// contains filtered or unexported fields
}

RPCClient represents RPC client

func NewRPCClient

func NewRPCClient(r string) (*RPCClient, error)

NewRPCClient initializes a new client connection

func (*RPCClient) Get

func (c *RPCClient) Get(req RPCRequest) (*TemplateRecord, error)

Get tries to get a request from remote server

type RPCConfig

type RPCConfig struct {
	Enabled bool
	Port    int
	Addr    net.IP
	Logger  *log.Logger
}

RPCConfig represents RPC config

type RPCRequest

type RPCRequest struct {
	ID uint16
	IP net.IP
}

RPCRequest represents RPC request

type SetHeader

type SetHeader struct {
	SetID  uint16
	Length uint16
}

SetHeader represents set header fields

type TemplateFieldSpecifier

type TemplateFieldSpecifier struct {
	ElementID    uint16
	Length       uint16
	EnterpriseNo uint32
}

TemplateFieldSpecifier represents field properties

type TemplateHeader

type TemplateHeader struct {
	TemplateID      uint16
	FieldCount      uint16
	ScopeFieldCount uint16
}

TemplateHeader represents template fields

type TemplateRecord

type TemplateRecord struct {
	TemplateID           uint16
	FieldCount           uint16
	FieldSpecifiers      []TemplateFieldSpecifier
	ScopeFieldCount      uint16
	ScopeFieldSpecifiers []TemplateFieldSpecifier
}

TemplateRecord represents template records

type TemplatesShard

type TemplatesShard struct {
	Templates map[uint32]Data
	sync.RWMutex
}

TemplatesShard represents a shard