Table of Contents

ipfixreceiver2: IPFIX/NetflowV9 collector

Introduction

ipfixreceiver2 is an IPFIX/NetflowV9 collector with the following functionality

Installation and Upgrading

CentOS

  1. Add the VAS Experts repository
    rpm --import http://vasexperts.ru/centos/RPM-GPG-KEY-vasexperts.ru
    rpm -Uvh http://vasexperts.ru/centos/6/x86_64/vasexperts-repo-1-0.noarch.rpm
  2. Add the EPEL repository
  3. Install the ipfixreceiver2:
    yum install -y ipfixreceiver2
  4. In order to upgrade ipfixreceiver2 issue the following command:
    yum update -y ipfixreceiver2

ipfixreceiver2 files

CentOS 6

CentOS 7

ipfixreceiver2 startup options

ipfixreceiver2 utility has the following startup options:

usage: ipfixreceiver2 <-f config file> [options]
here
--daemon                    start the program as a daemon process.
--umask=mask                set umask (octal value, 027 is the default one).
--pidfile=path              set path to a pid file.
-h, --help                  display a brief description.
-fFILE, --config-file=FILE  set path to the configuration file.
-v, --version               display program version.

Configuration

Configuration options are specified in the .ini file.

Section [connect]

The section is used to specify the parameters for receiving ipfix data.

Section [dump]

The section is used to specify the parameters of data dump received.

Section [InfoModel]

This section specifies an xml file describing the type of data within the received ipfix flow.

Section [Template]

The section is responsible for the data sequence order within the received ipfix flow and, if necessary, for the received data filtering by the given identifier.

Section [ExportModel]

This section specifies the order and format of the received data to be exported.

Output_formatDescription
decode_unsignedDecode as unsinged
decode_signedDecode as signed
decodeipv4Decode as IPv4 address
decodeipv6Decode as IPv6 address
decode_stringDecode as string
decode_secondsDecode as date and time in seconds. The default output format is '%Y-%m-%d %H:%M:%S'. You can specify date/time format on your own.
decode_millisecondsDecode as date and time in milliseconds. The default output format is '%Y-%m-%d %H:%M:%S'. You can specify date/time format on your own.
decodehostDecode as host name
decodepathDecode as url
decoderefererDecode as referer

Section [stats]

The section specifies the export options for sending ipfixreceiver2 statistics (metrics and events) to the telegraf agent.

Section [export]

:!: When using the udp protocol, you should make sure that one ipfix record does not exceed the size of the MTU.

Section [logging]

The section specifies the logging parameters.

:!: For more information about logging parameters please follow the Class FileChannel link.

Configuration examples

Receiving of ipfix data

The /etc/rcollector/ipfixreceiver_*.ini files provide configuration examples for receiving various ipfix data flows. Before starting the program, you should to change the configuration file to meet your requirements.

Exporting of ipfix data

To export the data received by ipfix, you need to make changes to the configuration file by adding the [export] section and specifying the destination addresses. For example, to send ipfix data to an ipfix collector having the 10.0.0.5:1501 address using the tcp protocol, the configuration item within [export] section will look like this:

[export]
to = 10.0.0.5/1501/tcp

If you need to specify multiple ipfix collectors, you can specify comma-separated list of ipfix collectors. For example:

[export]
to = 10.0.0.5/1501/tcp, 192.168.1.200/1501/tcp