The ipfixprobe can be set up to be used as a daemon to continuously process incoming packets from the boot up:
Create your instance.conf configuration, and save it in /etc/ipfixprobe/
All settings are explained in the example file
To start the systemd service, use:
sudo systemctl start ipfixprobe@instance.service
"instance" serves as Your identifier of ipfixprobe instance, it must be equal in the name of the configuration file and in the systemctl command.To enable the service at system startup, run:
sudo systemctl enable ipfixprobe@instance.service
The simplest way to use ipfixprobe is to process PCAP file using PCAP plugin (need to be ./configured with --with-pcap)
./ipfixprobe -s cache -i "pcap;file=pcaps/http.pcap" -o "text;m"
{{ plugin.description | raw }}
The ipfixprobe consists of one input, zero or one output, one storage and zero or more process plugins.
{% for plugin in site.how %}{{ plugin.description | raw }}
{{ option.description }}
{% if plugin.options %} Command line parameters used by {{ option.title }} plugin:{{ run.explanation }}
{{ run.code }}
{% endfor %} {% endfor %} {% endfor %}The ipfixprobe can be used to convert given PCAP file to the CSV containing flows from that file in the Unirec format.
Requirements:The script builds the image automatically, but be sure that Dockerfile is in the same directory.
To build the manually image, navigate to the directory containing the Dockerfile and run:
docker build -t docker_ipfixprobe .
bash ./ipfixprobe_wrapper.sh <process_script.sh> <input_file.pcap> <output_file.csv>
To process a file ../pcaps/mixed.pcap using a processing script process_script.sh and output the results to output.csv, use the following wrapper script:
bash ./ipfixprobe_wrapper.sh ./process_script.sh ../pcaps/mixed.pcap ./output.csv
Create and save the configuration file to the /etc/config/ipfixprobe. Example of configuration file:
NEMEA ipfixprobe # Copyright (C) 2022-2023 CESNET # Available options for profiles, 'list' options can be used repeatedly: # list interfaces - list of NIC, e.g., eth0, enp0s1, ... # list plugins - list of plugin names, see 'ipfixprobe -h process' for help # ipfix_host - address of IPFIX collector # ipfix_port - port of IPFIX collector, default: 4739 # ipfix_udp - 1 to export to IPFIX collector via UDP, 0 via TCP # cache_size - size of flow cache as exponent of 2, default: 1024 # cache_line - size of flow cache line as exponent of 2, default: 4 # active_timeout - active timeout in seconds, default: 300 # inactive_timeout - inactive timeout in seconds, default: 30 # link - unsigned integer as identification of link/router # dir - unsigned integer as identification of direction/NIC # split_biflow - 1 to split biflow to uniflow, default: 0 to use biflow # ipfix_mtu - size of max transmission unit (MTU), default: 1452 # # respawn - enable respawn of crashed process # respawn_threshold - timeout in seconds for restarting a service after it closes # respawn_timeout - max time in seconds to wait for a process respawn to complete # respawn_retry - max number of attempts to respawn before giving up, 0 means newer stop trying to respawn # core - size of coredump, '0' - not generate, 'unlimited' - unlimited size # # enabled - 1 to enable start daemon instance for that profile, NOTE: if profile is directly specified for start script # (example: '/etc/init.d/ipfixprobe start wan profileX profileY lan'), this option is ignored config profile 'lan' option enabled '0' list interfaces 'br-lan' list plugins 'basicplus' list plugins 'dns' list plugins 'http' list plugins 'pstats' list plugins 'ovpn' list plugins 'wg' list plugins 'dnssd;txt' list plugins 'ssdp' list plugins 'tls' list plugins 'quic' option ipfix_host '127.0.0.1' option ipfix_port '4739' option ipfix_udp '1' option link '1' option dir '1'
Prepare the init script:
wget https://raw.githubusercontent.com/CESNET/Nemea-OpenWRT/master/net/ipfixprobe/files/init.d/ipfixprobe
sudo mv ipfixprobe /etc/init.d/ipfixprobe
To run the script manually use:
/etc/init.d/ipfixprobe start
To start the service at system startup:
/etc/init.d/ipfixprobe enable