Commit 8095365c authored by Jon Kåre Hellan's avatar Jon Kåre Hellan
Browse files

Started ipfixlib documentation


git-svn-id: file:///home/svn/mapi/trunk@359 8d5bb341-7cf1-0310-8cf6-ba355fef3186
parent dfcc868b
ipfixlib was based on Luca Deri's nprobe. The basis for ipfixlib is a
version from 2003.
Flow export is invoked like this:
funct_id = mapi_apply_function(fd,"FLOW_REPORT", "NETFLOW_V9", "SHMEM",
"", tbuf);
parameter 1: flow ID.
parameter 2: MAPI function: "FLOW_REPORT"
parameter 3: record type: "NETFLOW_V5" or "NETFLOW_V9"
parameter 4: transport: "SHMEM" or host:port, e.g. "127.0.0.1:2055"
parameter 5: key template: string, not yet in use.
paramter 6: record template string, NetFlow V9 only.
The record template for NetFlowV9 is selected by a format string,
e.g. "%PKTS %BYTES %TOS %IP_SRC_ADDR %IP_DST_ADDR".
Here are the supported templates:
%BYTES
%PKTS
%FLOWS
%PROT
%TOS
%TCP_FLAGS
%L4_SRC_PORT
%IP_SRC_ADDR
%SRC_MASK
%INPUT_SNMP
%L4_DST_PORT
%IP_DST_ADDR
%DST_MASK
%OUTPUT_SNMP
%IP_NEXT_HOP
%SRC_AS
%DST_AS
%BGP_NEXT_HOP
%MUL_DPKTS
%MUL_DOCTETS
%LAST_SWITCHED
%FIRST_SWITCHED
%OUT_BYTES
%OUT_PKTS (NOTE: difference v9/ipfix)
%MIN_PKT_LNGTH
%MAX_PKT_LNGTH
%IPV6_SRC_ADDR
%IPV6_DST_ADDR
%IPV6_SRC_MASK
%IPV6_DST_MASK
%FLOW_LABEL
%ICMP_TYPE
%IGMP_TYPE
%SAMPLING_INTERVAL (NOTE: not IPFIX)
%SAMPLING_ALGO (NOTE: not IPFIX)
%FLOW_ACTIVE_TIMEOUT
%FLOW_INACTIVE_TIMEOUT
%ENGINE_TYPE (NOTE: not IPFIX)
%ENGINE_ID (NOTE: not IPFIX)
%TOTAL_BYTES_EXP
%TOTAL_PKTS_EXP
%TOTAL_FLOWS_EXP
%MIN_TTL
%MAX_TTL
%IP_PROTOCOL_VERSION
%IPV6_OPTION_HEADERS
%EXPORTER_IPV4
%EXPORTER_IPV6
%FLOW_END_REASON
%TEMPLATE_ID
%FLOW_ID
%FLOW_START_SECONDS
%FLOW_END_SECONDS
%FLOW_START_MILLISECONDS
%FLOW_END_MILLISECONDS
%FLOW_START_MICROSECONDS
%FLOW_END_MICROSECONDS
%FLOW_START_NANOSECONDS
%FLOW_END_NANOSECONDS
%SYSINIT_MILLIS
%FLOW_DUR_MILLIS
%FLOW_DUR_MICROS
%NUM_FLOWS_OBSERVED
%NUM_IGNORED_PKT
%NUM_IGNORED_OCTETS
%NOTSENT_FLOWS
%NOTSENT_PKTS
%NOTSENT_OCTETS
%PKTLEN_IPV4
%PKTLEN_IPV6
%HDRLEN_IPV4
%IPV4_OPT
%TCP_OPT
%PADDING
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment