ipfixreceiver2 is an IPFIX/NetflowV9 collector with the following functionality
rpm --import http://vasexperts.ru/centos/RPM-GPG-KEY-vasexperts.ru rpm -Uvh http://vasexperts.ru/centos/6/x86_64/vasexperts-repo-1-0.noarch.rpm
yum install -y ipfixreceiver2
yum update -y ipfixreceiver2
/etc/rcollector/xml/ipfix_raw.xml - ipfix data field types used in fullflow. /etc/rcollector/xml/ipfix_url.xml - ipfix data field types used in clickstream (http requests). /etc/rcollector/xml/ipfix_sip.xml - ipfix data field types used in SIP connections. /etc/rcollector/xml/ipfix_aaa.xml - ipfix data field types used in AAA events. /etc/rcollector/xml/ipfix_nat.xml - ipfix data field types used in NAT events.
/etc/rcollector/ipfixreceiver_raw.ini is responsible for ipfix data import and export for fullflow. /etc/rcollector/ipfixreceiver_raw_new.ini is responsible for ipfix data import and export for the VAS Experts DPI version 8.1 and higher. /etc/rcollector/ipfixreceiver_url.ini is responsible for ipfix data import and export for clickstream. /etc/rcollector/ipfixreceiver_sip.ini is responsible for ipfix data import and export for SIP connections. /etc/rcollector/ipfixreceiver_aaa.ini is responsible for ipfix data import and export for AAA events. /etc/rcollector/ipfixreceiver_nat.ini is responsible for ipfix data import and export for NAT events.
/usr/bin/ipfixreceiver2
/etc/init.d/ipfix_raw - ipfixreceiver2 startup script with corresponding /etc/rcollector/ipfixreceiver_raw.ini configuration file. /etc/init.d/ipfix_url - ipfixreceiver2 startup script with corresponding /etc/rcollector/ipfixreceiver_url.ini configuration file. /etc/init.d/ipfix_sip - ipfixreceiver2 startup script with corresponding /etc/rcollector/ipfixreceiver_sip.ini configuration file. /etc/init.d/ipfix_aaa - ipfixreceiver2 startup script with corresponding /etc/rcollector/ipfixreceiver_aaa.ini configuration file.
/usr/lib/systemd/system/ipfix_raw.service - systemd unit responsible for starting ipfixreceiver2 with corresponding /etc/rcollector/ipfixreceiver_raw.ini configuration file. /usr/lib/systemd/system/ipfix_url.service - systemd unit responsible for starting ipfixreceiver2 with corresponding /etc/rcollector/ipfixreceiver_url.ini configuration file. /usr/lib/systemd/system/ipfix_sip.service - systemd unit responsible for starting ipfixreceiver2 with corresponding /etc/rcollector/ipfixreceiver_sip.ini configuration file. /usr/lib/systemd/system/ipfix_aaa.service - systemd unit responsible for starting ipfixreceiver2 with corresponding /etc/rcollector/ipfixreceiver_aaa.ini configuration file.
ipfixreceiver2 utility has the following startup options:
usage: ipfixreceiver2 <-f config file> [options] here --daemon start the program as a daemon process. --umask=mask set umask (octal value, 027 is the default one). --pidfile=path set path to a pid file. -h, --help display a brief description. -fFILE, --config-file=FILE set path to the configuration file. -v, --version display program version.
Configuration options are specified in the .ini file.
The section is used to specify the parameters for receiving ipfix data.
The section is used to specify the parameters of data dump received.
This section specifies an xml file describing the type of data within the received ipfix flow.
The section is responsible for the data sequence order within the received ipfix flow and, if necessary, for the received data filtering by the given identifier.
This section specifies the order and format of the received data to be exported.
Output_format | Description |
---|---|
decode_unsigned | Decode as unsinged |
decode_signed | Decode as signed |
decodeipv4 | Decode as IPv4 address |
decodeipv6 | Decode as IPv6 address |
decode_string | Decode as string |
decode_seconds | Decode as date and time in seconds. The default output format is '%Y-%m-%d %H:%M:%S'. You can specify date/time format on your own. |
decode_milliseconds | Decode as date and time in milliseconds. The default output format is '%Y-%m-%d %H:%M:%S'. You can specify date/time format on your own. |
decodehost | Decode as host name |
decodepath | Decode as url |
decodereferer | Decode as referer |
The section specifies the export options for sending ipfixreceiver2 statistics (metrics and events) to the telegraf agent.
[export] to=10.0.0.2/9921/tcp, 10.0.0.3/3444/udp
When using the udp protocol, you should make sure that one ipfix record does not exceed the size of the MTU.
The section specifies the logging parameters.
For more information about logging parameters please follow the Class FileChannel link.
The /etc/rcollector/ipfixreceiver_*.ini files provide configuration examples for receiving various ipfix data flows. Before starting the program, you should to change the configuration file to meet your requirements.
To export the data received by ipfix, you need to make changes to the configuration file by adding the [export] section and specifying the destination addresses. For example, to send ipfix data to an ipfix collector having the 10.0.0.5:1501 address using the tcp protocol, the configuration item within [export] section will look like this:
[export] to = 10.0.0.5/1501/tcp
If you need to specify multiple ipfix collectors, you can specify comma-separated list of ipfix collectors. For example:
[export] to = 10.0.0.5/1501/tcp, 192.168.1.200/1501/tcp