ipfix

package
v0.0.0-...-8c13bb0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 3, 2024 License: MIT Imports: 14 Imported by: 30

Documentation

Overview

Package ipfix implements a decoder for the IP Flow Information Export (IPFIX) protocol.

About

Internet Protocol Flow Information Export (IPFIX) is an IETF protocol, as well as the name of the IETF working group defining the protocol. It was created based on the need for a common, universal standard of export for Internet Protocol flow information from routers, probes and other devices that are used by mediation systems, accounting/billing systems and network management systems to facilitate services such as measurement, accounting and billing.

The IPFIX standard defines how IP flow information is to be formatted and transferred from an exporter to a collector.

Index

Constants

View Source 
const (
	// Version word in the Message Header
	Version uint16 = 0x000a
	// EnterpriseBit used in the Field Specifier
	EnterpriseBit uint16 = 0x8000
	// VariableLength used in the Field Specifier
	VariableLength uint16 = 0xffff
)

Variables

This section is empty.

Functions

func Dump 

func Dump(m *Message)

Types

type DataRecord 

type DataRecord struct {
	TemplateID   uint16
	OptionScopes Fields
	Fields       Fields
}

func (*DataRecord) Unmarshal 

func (dr *DataRecord) Unmarshal(r io.Reader, template session.Template, t *Translate) error

type DataSet 

type DataSet struct {
	Header  SetHeader
	Bytes   []byte
	Records []DataRecord
}

func (*DataSet) Unmarshal 

func (ds *DataSet) Unmarshal(r io.Reader, template session.Template, t *Translate) error

type Decoder 

type Decoder struct {
	io.Reader
	session.Session
	*Translate
}

Decoder can decode multiple IPFIX messages from a stream.

func NewDecoder 

func NewDecoder(r io.Reader, s session.Session) *Decoder

func (*Decoder) Decode 

func (d *Decoder) Decode(data []byte) (*Message, error)

Decode decodes a single message from a buffer of bytes.

func (*Decoder) Next 

func (d *Decoder) Next() (*Message, error)

Next decodes the next message from the stream. Note that if there is an exception, depending on where the exception originated from, the decoder results can no longer be trusted and the stream should be reset.

type Field 

type Field struct {
	Bytes      []byte
	Translated *TranslatedField
}

func (*Field) Unmarshal 

func (f *Field) Unmarshal(r io.Reader, fs session.TemplateFieldSpecifier) error

type FieldSpecifier 

type FieldSpecifier struct {
	InformationElementID uint16
	Length               uint16
	EnterpriseNumber     uint32
	EnterpriseBitSet     bool
}

FieldSpecifier is a Field Specifier (RFC 7011 section 3.2)

func (FieldSpecifier) GetLength 

func (this FieldSpecifier) GetLength() uint16

func (FieldSpecifier) GetType 

func (this FieldSpecifier) GetType() uint16

func (FieldSpecifier) IsEnterprise 

func (fs FieldSpecifier) IsEnterprise() bool

IsEnterprise checks if the Enterprise bit (RFC RFC 7011 section 3.2) is set.

func (FieldSpecifier) IsVariableLength 

func (fs FieldSpecifier) IsVariableLength() bool

IsVariableLength ...

func (FieldSpecifier) Len 

func (fs FieldSpecifier) Len() int

func (*FieldSpecifier) String 

func (fs *FieldSpecifier) String() string

func (*FieldSpecifier) Unmarshal 

func (fs *FieldSpecifier) Unmarshal(r io.Reader) error

type FieldSpecifiers 

type FieldSpecifiers []FieldSpecifier

func (FieldSpecifiers) Len 

func (fs FieldSpecifiers) Len() int

func (FieldSpecifiers) String 

func (fs FieldSpecifiers) String() string

func (*FieldSpecifiers) Unmarshal 

func (fs *FieldSpecifiers) Unmarshal(r io.Reader) error

type Fields 

type Fields []Field

func (Fields) Len 

func (fs Fields) Len() int

type Message 

type Message struct {
	Header              MessageHeader
	TemplateSets        []TemplateSet
	OptionsTemplateSets []OptionsTemplateSet
	DataSets            []DataSet
	OptionsDataSets     []DataSet
}

Message consists of a Message Header, followed by zero or more Sets. The Sets can be any of these three possible types: Data Set, Template Set, or Options Template Set.

The format of the Message on the wire is: 

+----------------------------------------------------+
| Message Header                                     |
+----------------------------------------------------+
| Set                                                |
+----------------------------------------------------+
| Set                                                |
+----------------------------------------------------+
...
+----------------------------------------------------+
| Set                                                |
+----------------------------------------------------+

func Read 

func Read(r io.Reader, s session.Session, t *Translate) (*Message, error)

Read a single IPFIX message from the provided reader and decode all the sets.

func (*Message) UnmarshalSets 

func (m *Message) UnmarshalSets(r io.Reader, s session.Session, t *Translate) error

UnmarshalSets will, based on the Message length, unmarshal all sets in the message.

type MessageHeader 

type MessageHeader struct {
	Version             uint16
	Length              uint16
	ExportTime          uint32
	SequenceNumber      uint32
	ObservationDomainID uint32
}

MessageHeader is a Message Header (RFC 7011 section 3.1)

The format of the Message Header on the wire is: 

0                   1                   2                   3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|       Version Number          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                           Export Time                         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                       Sequence Number                         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Observation Domain ID                      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

func (*MessageHeader) Len 

func (h *MessageHeader) Len() int

Len returns the length of the Message Header in bytes.

func (*MessageHeader) String 

func (h *MessageHeader) String() string

func (*MessageHeader) Unmarshal 

func (h *MessageHeader) Unmarshal(r io.Reader) error

Unmarshal a message header from a reader.

type OptionsTemplateRecord 

type OptionsTemplateRecord struct {
	// Each Options Template Record is given a unique Template ID in the
	// range 256 to 65535.
	TemplateID uint16

	// Number of all fields in this Options Template Record, including
	// the Scope Fields.
	FieldCount uint16
	Fields     FieldSpecifiers

	// Number of scope fields in this Options Template Record. The Scope
	// Fields are normal Fields, except that they are interpreted as
	// scope at the Collector. A scope field count of N specifies that
	// the first N Field Specifiers in the Template Record are Scope
	// Fields. The Scope Field Count MUST NOT be zero.
	ScopeFieldCount uint16
	ScopeFields     FieldSpecifiers
}

OptionsTemplateRecord contains any combination of IANA-assigned and/or enterprise-specific Information Element identifiers (RFC 7011 section 3.4.2.2)

func (OptionsTemplateRecord) GetFields 

func (this OptionsTemplateRecord) GetFields() []session.TemplateFieldSpecifier

func (OptionsTemplateRecord) GetScopeFields 

func (this OptionsTemplateRecord) GetScopeFields() []session.TemplateFieldSpecifier

func (OptionsTemplateRecord) ID 

func (this OptionsTemplateRecord) ID() uint16

func (OptionsTemplateRecord) Size 

func (this OptionsTemplateRecord) Size() int

func (OptionsTemplateRecord) String 

func (otr OptionsTemplateRecord) String() string

func (*OptionsTemplateRecord) Unmarshal 

func (otr *OptionsTemplateRecord) Unmarshal(r io.Reader) error

type OptionsTemplateSet 

type OptionsTemplateSet struct {
	Header  SetHeader
	Records []OptionsTemplateRecord
}

func (OptionsTemplateSet) String 

func (ots OptionsTemplateSet) String() string

func (*OptionsTemplateSet) UnmarshalRecords 

func (ots *OptionsTemplateSet) UnmarshalRecords(r io.Reader) error

type Session 

type Session struct {
	// contains filtered or unexported fields
}

func NewSession 

func NewSession() *Session

type SetHeader 

type SetHeader struct {
	// Identifies the Set. A value of 2 is reserved for Template Sets.
	// A value of 3 is reserved for Options Template Sets. Values from 4
	// to 255 are reserved for future use. Values 256 and above are used
	// for Data Sets. The Set ID values of 0 and 1 are not used, for
	// historical reasons [RFC3954].
	ID uint16
	// Total length of the Set, in octets, including the Set Header, all
	// records, and the optional padding. Because an individual Set MAY
	// contain multiple records, the Length value MUST be used to
	// determine the position of the next Set.
	Length uint16
}

SetHeader is a Set Header common to all three Set types (RFC 7011 section 3.3.2)

func (*SetHeader) Bytes 

func (h *SetHeader) Bytes() []byte

func (SetHeader) Len 

func (h SetHeader) Len() int

func (SetHeader) String 

func (h SetHeader) String() string

func (*SetHeader) Unmarshal 

func (h *SetHeader) Unmarshal(r io.Reader) error

type TemplateRecord 

type TemplateRecord struct {
	// Each Template Record is given a unique Template ID in the range
	// 256 to 65535.  This uniqueness is local to the Transport Session
	// and Observation Domain that generated the Template ID.  Since
	// Template IDs are used as Set IDs in the Sets they describe (see
	// RFC 7011 3.4.3), values 0-255 are reserved for special Set types
	// (e.g., Template Sets themselves), and Templates and Options
	// Templates (see RFC 7011 3.4.2) cannot share Template IDs within a
	// Transport Session and Observation Domain.  There are no
	// constraints regarding the order of the Template ID allocation.  As
	// Exporting Processes are free to allocate Template IDs as they see
	// fit, Collecting Processes MUST NOT assume incremental Template
	// IDs, or anything about the contents of a Template based on its
	// Template ID alone.
	TemplateID uint16
	// Number of fields in this Template Record.
	FieldCount uint16
	Fields     FieldSpecifiers
}

TemplateRecord contains any combination of IANA-assigned and/or enterprise-specific Information Element identifiers (RFC 7011 section 3.4.1)

func (TemplateRecord) Bytes 

func (tr TemplateRecord) Bytes() []byte

func (TemplateRecord) GetFields 

func (this TemplateRecord) GetFields() []session.TemplateFieldSpecifier

func (TemplateRecord) ID 

func (tr TemplateRecord) ID() uint16

func (TemplateRecord) Len 

func (tr TemplateRecord) Len() int

func (TemplateRecord) Size 

func (tr TemplateRecord) Size() int

func (TemplateRecord) String 

func (tr TemplateRecord) String() string

func (*TemplateRecord) Unmarshal 

func (tr *TemplateRecord) Unmarshal(r io.Reader) error

type TemplateSet 

type TemplateSet struct {
	Header  SetHeader
	Records []TemplateRecord
}

TemplateSet

func (TemplateSet) Bytes 

func (ts TemplateSet) Bytes() []byte

func (TemplateSet) Len 

func (ts TemplateSet) Len() int

func (TemplateSet) String 

func (ts TemplateSet) String() string

func (*TemplateSet) UnmarshalRecords 

func (ts *TemplateSet) UnmarshalRecords(r io.Reader) error

type Translate 

type Translate struct {
	*translate.Translate
}

func NewTranslate 

func NewTranslate(s session.Session) *Translate

func (*Translate) Record 

func (t *Translate) Record(dr *DataRecord, tm session.Template) error

type TranslatedField 

type TranslatedField struct {
	Name                 string
	InformationElementID uint16
	EnterpriseNumber     uint32
	Value                interface{}
	Bytes                []byte
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.