# README
go-ipfix
go-ipfix is a library for working with IPFIX messages. It supports encoding and decoding of IPFIX messages using a io.Reader-style interface. It complies with RFC 7011, as well as supporting most other major IPFIX RFCs:
- RFC 5103: Bidirectional Flow Export Using IP Flow Information Export (IPFIX)
- RFC 5610: Exporting Type Information for IP Flow Information Export (IPFIX) Information Elements
- RFC 5655: Specification of the IP Flow Information Export (IPFIX) File Format
- RFC 6313: Export of Structured Data in IP Flow Information Export (IPFIX)
Getting started
- API documentation and examples are available via pkg.go.dev
- The ./addons directory contains an implementation of a
ipfix.FieldCacheandipfix.TemplateCachethat usesetcdfor state management
Contributing
This is a one-person project with (currently) no practical deployment. If you'd like to adopt go-ipfix, require any features or want to fix any bugs (of which there are probably quite a few remaining), feel free to fork the repository and open a pull request, I promise to do my best to ensure your efforts make it to the library.
# Packages
No description provided by the author
# Functions
DataTypeFromNumber looks up the default constructor for each of the currently known IPFIX abstract data types (both in RFC 7011 and RFC 6313) by their IANA-assigned identifier.
No description provided by the author
LookupConstructor is an accessor to the private internal, but global map of currently known IPFIX abstract data types.
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
NewDecoder creates a new Decoder for a given template cache and field manager.
No description provided by the author
NewBasicTemplateCache creates a new in-memory template cache that lives for the lifetime of the caller.
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
NewIANAFieldManager is a utility for creating field managers with initialized IANA fields quickly, e.g.
NewIPFIXFileReader creates a new reader from a file-like reader.
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
NewUnassignedFieldBuilder may be used to quickly create a FieldBuilder from only an ID.
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
ReadFull consumes an entire io.Reader of a file containing IPFIX File Format messages and returns those messages as byte slices sliced up in a wrapping slice.
No description provided by the author
No description provided by the author
This is taken from Kubernetes' controller-runtime/log package, except for not exposing any types, which appears unnecessary, but the implementation of delegated logging is kinda neat.
SupportedTypes returns a slice containing all currently known DataType constructors.
No description provided by the author
# Constants
IPFIX is the id denoting a template set.
IPFIXOptions is the id denoting an options template set.
The Kind* constants are used for unmarshalling of JSON records to denote the specific type into which the elements of a set should be unmarshalled in.
The Kind* constants are used for unmarshalling of JSON records to denote the specific type into which the elements of a set should be unmarshalled in.
The Kind* constants are used for unmarshalling of JSON records to denote the specific type into which the elements of a set should be unmarshalled in.
NFv9 is the NFv9 template id, kept for completeness and compatibility, the module does not actually support Netflow 9 decoding out of the box.
NFv9Options is the NFv9 options template id, kept for completeness and compatibility, the module does not actually support Netflow 9 decoding out of the box.
ReversePEN is the private enterprise number designated for signaling bidirectional flow information contained in the record.
The "allOf" structured data type semantic specifies that all of the list elements from the structured data are actual properties of the Data Record.
The "exactlyOneOf" structured data type semantic specifies that only a single element from the structured data is an actual property of the Data Record.
The "noneOf" structured data type semantic specifies that none of the elements are actual properties of the Data Record.
The "oneOrMoreOf" structured data type semantic specifies that one or more elements from the list in the structured data are actual properties of the Data Record.
The "ordered" structured data type semantic specifies that elements from the list in the structured data are ordered.
For example, a mediator that wants to translate IPFIX [RFC5101] into the export of structured data according to the specifications in this document doesn't know what the semantic is; it can only guess, as the IPFIX specifications [RFC5101] does not contain any semantic.
VariableLength is the constant used for denoting a field being variable-length encoded in template records before the length is known.
# Variables
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
ErrIllegalDataTypeEncoding is used in Decode of certain data types that explicitly define illegal formats such as boolean (1 and 2 encoding true and false and all other values being illegal) or strings only allowing utf8 sequences.
No description provided by the author
ErrTemplateNotFound is the base error used for indicating missing templates in caches.
No description provided by the author
ErrUnknownFlowId is used for indicating usage of a set ID unassigned in IPFIX, which is specifically the interval [5, 255], which is reserved.
No description provided by the author
ErrUnknownVersion indicates an illegal version number for IPFIX in the header of the message.
No description provided by the author
NonReversibleFields is the lookup map for fields that are _not_ reversible as per RFC 5103.
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
UDP packet size is globally limited by the packet header length field of 2^16-1.
No description provided by the author
No description provided by the author
# Structs
BasicList implements the basicList abstract data type as per RFC 6313.
Boolean is the cannonic boolean data type in RFC 7011 describing boolean values.
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
Decoder is instantiated with a fieldManager and a templateManager such that it can decode IPFIX packets into Records containing fields and additionally learn new fields and templates.
No description provided by the author
EphemeralCache is the most basic of in-memory caches.
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
# Interfaces
No description provided by the author
No description provided by the author
Field defines the interface for both types of IPFIX fields, either fixed-length or variable-length fields.
FieldCache is the interface that all, both ephemeral and persistent field caches need to implement.
No description provided by the author
TemplateCache stores templates observed in an IPFIX/Netflow stream of flow packets
Caches have to implement a function to - add a template defined by its version and observation domain ID, - retrieve a template by its version, its observation domain ID, and its ID, and - get all templates currently stored in the cache as a map
Caches do not have to perform active expiry, for this, use TemplateCacheWithTimeout.
TemplateCacheDriver is the interface to be provided by TemplateCaches that have side effects, such as persistent caches that write to files.
CachesWithTimeout is the interface to be implemented by caches that periodically expire templates which is according to the IPFIX spec (but seemingly never implemented in any of the FOSS collectors).
# Type aliases
DataTypeConstructor is a type capturing the 0-adic constructor function for a new DataType.
ListSemantic is the type capturing the IANA-assigned list semantics as defined by RFC 6313.
No description provided by the author