Basic Information

Input plugin for reading packets from a raw interface.

• Works by capturing sockets directly from the INC by bypassing the TCP stack.
• A simple but not very efficient way to quickly check small networks.
• Does NOT require any additional libraries.
• Good for sniffing specific packets, not for general network monitoring.

This plugin is installed by default. Recommended for small networks with a simple monitoring setup.

• i or ifc : Defines network interface name.
• b or blocks : Defines number of packet blocks.
• f or fanout : Enables packet fanout.
• p or pkts : Defines number of packets in block.
• l or list : Print list of available interfaces.

Read packets from the interface specified by the IFC value.

ipfixprobe -i 'raw;ifc=IFC;' -s 'cache'

Capture from IFC interface and scale packet processing using 2 instances of raw plugin, send flow to ifpfix collector using UDP.

ipfixprobe -i 'raw;ifc=IFC;f' -i 'raw;ifc=IFC;f' -o 'ipfix;u;host=collector.example.com;port=4739'

input_plugin:
  raw:
    interface: (name) # Network interface name to capture traffic from [required]
    blocks_count: (number) # Number of blocks in the circular buffer (must be a power of 2)
    packets_in_block: (number) # Number of packets per block (must be a power of 2)

Pcap (Packet Capture) provides an API for capturing network traffic. Ipfixprobe can use libpcap to quickly capture packets from an INC or a binary .pcap file format.

• Recommended option for monitoring small to medium networks (up to 1 Gbps).
• Exporting into .pcap file is NOT supported.
• If you encounter performance problems (many dropped packets ..), try limiting the number of process plugins or move to a faster input plugin (DPDK).

 
sudo dnf install ipfixprobe-input-pcap

dnf install libpcap libpcap-devel
cd build
cmake -DENABLE_INPUT_PCAP=ON ..
cd ..
make -j2
sudo make install

• f or file : Defines path to pcap file.
• i or ifc : Defines interface name.
• F or filter : Defines filter string.
• s or snaplen : Defines snapshot length in bytes (live capture only).
• l or list : Print list of available interfaces.

Process the pcap file and output to the terminal.

ipfixprobe -s cache -i "pcap;file=PATH_TO_PCAP_FILE" -o "text;m"

Read packets from the interface specified by the IFC value.

ipfixprobe -i 'pcap;i=IFC;' -s 'cache'

Capture from IFC interface using pcap plugin, split biflows into flows and prints them to console without mac addresses, telemetry data is exposed via the appFs library in /var/run/ipfixprobe directory.

ipfixprobe -i 'pcap;ifc=IFC' -s 'cache;split' -o 'text;m' -t /var/run/ipfixprobe

Read packets from a pcap file, enable 4 processing plugins, send L7 HTTP extended biflows to the unirec interface named http, and data from 3 other plugins to the stats interface.

 
ipfixprobe -i 'pcap;file=pcaps/http.pcap' -p http -p pstats -p idpcontent -p phists -o 'unirec;i=u:http:timeout=WAIT,u:stats:timeout=WAIT;p=http,(pstats,phists,idpcontent)'

input_plugin:
  pcap_file:
    file: (path)  # Path to the PCAP file to read from [required]
    bpf_filter: null  # Optional BPF filter (e.g., "port 80"), null = no filter
    
  # OR
  
  pcap_live:
    interface: (name)  # Network interface for live packet capture [required]
    bpf_filter: null  # Optional BPF filter (null = no filter)
    snap_length: (number)  # Maximum packet capture length

DPDK (Data Plane Development Kit) is an ultrafast way to capture packets.

• Very efficient setup suitable for high-speed networks (up to 400 Gbps).
• Works by bypassing the kernel layer, offloading TCP packet processing to user space.

sudo dnf install dpdk dpdk-devel dpdk-tools

    tar xJf dpdk-<version>.tar.xz
    cd dpdk-<version>

    meson setup <options> build
    cd build
    ninja
    meson install
    ldconfig

sudo dnf install ipfixprobe-dpdk

 
cd build
cmake -DENABLE_INPUT_DPDK=ON ..
cd ..
make -j
sudo make install

There are a few steps needed to set up DPDK correctly.

    uname -r

    ldd --version

echo 1024 > /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages

echo 1024 > /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages

default_hugepagesz=1G hugepagesz=1G hugepages=4

    mkdir /mnt/huge
    mount -t hugetlbfs pagesize=1GB /mnt/huge

    nodev /mnt/huge hugetlbfs pagesize=1GB 0 0

    dpdk-devbind.py --status

 
sudo modprobe vfio-pci

 
echo 1 > /sys/module/vfio/parameters/enable_unsafe_noiommu_mode

dpdk-devbind.py --bind=vfio-pci 04:00.1

dpdk-devbind.py --bind=vfio-pci eth1

ulimit -l <new_limit>

echo 512000 > /sys/module/vfio_iommu_type1/parameters/dma_entry_limit

• b or bsize : Size of the MBUF packet buffer. (Default: 64).
• p or port : DPDK port to be used as an input interface.
• m or mem : Size of the memory pool for received packets. (Default: 16384).
• q or queue : Number of RX queues. (Default: 1).
• e or eal : DPDK parameters.
• M or mtu : Input interface MTU. (Default: 1518).

Read packets using DPDK input interface and 1 DPDK queue, enable plugins for basic statistics, http and tls, output to IPFIX on a local machine DPDK EAL parameters are passed in e, eal parameters DPDK plugin configuration has to be specified in the first input interface. The following dpdk interfaces are given without parameters; their configuration is inherited from the first one. Example for the queue of 3 DPDK input plugins (q=3):

 
ipfixprobe -i 'dpdk;p=0;q=3;e=-c 0x1 -a <[domain:]bus:devid.func>' -i dpdk -i dpdk -p http -p bstats -p tls -o 'ipfix;h=127.0.0.1'

Same example for the multiport read from ports 0 and 1, note comma-separated ports:

 
ipfixprobe -i 'dpdk;p=0,1;q=3;e=-c 0x1 -a <[domain:]bus:devid.func>' -i dpdk -i dpdk -p http -p bstats -p tls -o 'ipfix;h=127.0.0.1'

  dpdk:
    allowed_nics: "0000:00:00.0,0000:00:00.1" # List of allowed NICs (PCI addresses) [required]
    burst_size: 64  # Number of packets processed in each burst (cycle)
    mempool_size: 8192  # Size of the memory pool (must be a power of 2)
    rx_queues: 1  # Number of RX (receive) queues
    workers_cpu_list: [0] # List of CPU cores assigned to RX queues (must match rx_queues)
    eal_opts: null  # EAL options (null = default options)
    mtu: null  # Maximum Transmission Unit (defaults to RTE_ETHER_MAX_LEN)

This plugin is installed with the DPDK input plugin.

• b or bsize : Size of the MBUF packet buffer. (Default: 64).
• r or ring : Name of the ring to read packets from. Need to be specified explicitly, thus no default provided.
• e or eal : DPDK eal.

Read packets using DPDK input interface as a secondary process with shared memory (DPDK rings) - in this case, 4 DPDK rings are used.

ipfixprobe -i 'dpdk-ring;r=rx_ipfixprobe_0;e= --proc-type=secondary' -i 'dpdk-ring;r=rx_ipfixprobe_1' -i 'dpdk-ring;r=rx_ipfixprobe_2' -i 'dpdk-ring;r=rx_ipfixprobe_3' -o 'text'

dpdk_ring:
    ring_name: ring0  # Name of the shared DPDK ring buffer [required]
    eal_opts: null  # EAL options (null = default options)
    burst_size: 64  # Number of packets processed in each burst (cycle)

Input plugin for reading packets directly from an FPGA-based NIC. Unless you are using Netcope (CESNET FPGA cards) hardware, this plugin is NOT the right option.

sudo dnf install epel-release
sudo dnf copr enable @CESNET/nfb-framework
sudo dnf install nfb-framework numactl-devel
sudo dnf install ipfixprobe-input-ndp

sudo dnf install epel-release
sudo dnf copr enable @CESNET/nfb-framework
sudo dnf install nfb-framework numactl-devel
cd build
cmake -DENABLE_INPUT_NFB=ON ..
cd ..
make -j
sudo make install

• d or dev : Path to a device file.
• I or id : Link identifier number.

Capture from a COMBO card using the NDP plugin sends IPFIX data to 127.0.0.1:4739 using TCP by default.

    ipfixprobe -i 'ndp;dev=/dev/nfb0:0' -i 'ndp;dev=/dev/nfb0:1' -i 'ndp;dev=/dev/nfb0:2' -o 'ipfix;h=127.0.0.1;p=4739'

input_plugin:
  ndp:
    device: PATH  # Device for packet capture (e.g., /dev/nfb0) [required]
    queues: "0-15"  # List of queue IDs (e.g., "0,1,2-3,7") [required]

Each plugin exports data either in Unirec (our in-house standard) or IPFIX (standard flow output). Each table consists of the following fields

• Unirec Field : name of the field in Unirec format
• IPFIX Field : name of the field in IPFIX (as used in Ipfixprobe)
• IANA Name : name of STANDARDIZED IPFIX fields
• Unirec Type (size) : data type of Unirec field and its size in bytes (8 bits)
• IPFIX Type (size) : data type of IPFIX field and its size in bytes (8 bits)
• PEN : Private Enterprise Number:
  • 0 represents an IANA standard field (with IANA Name)
  • >0 represents a custome field defined by third-party: see iana pen site for specific
• ID : Represents a unique ID for a specific PEN set of values: see iana site for IANA standard fields (with PEN = 0)
• Description : simple description of the field (Unirec and IPFIX)
• Direction : possible values:
  • src : field represents information about the source
  • dst : field represents information about the destination
  • src → dst : field represents information about communication from the source to the destination
  • dst → src : field represents information about communication from the destination to the source

For Unirec output plugin fields: Unirec Field, Unirec Type (size), Description, Direction are important.

For IPFIX output plugin fields: IPFIX Field, IANA Name, IPFIX Type (size), PEN, ID, Description, Direction are important.