--- title: How to use ipfixprobe heading: ipfixprobe usage ---
This guide expects ipfixprobe is already installed, see installation step. The following sections describe alternative ways how to run ipfixprobe.

Systemd service (recommended)

The ipfixprobe can be set up to be used as a daemon to continuously process incoming packets from the boot up:

Create your instance.conf configuration, and save it in /etc/ipfixprobe/
All settings are explained in the example file

To start the systemd service, use:

sudo systemctl start ipfixprobe@instance.service

"instance" serves as Your identifier of ipfixprobe instance, it must be equal in the name of the configuration file and in the systemctl command.

To enable the service at system startup, run:

sudo systemctl enable ipfixprobe@instance.service


Command line — starting manually

The simplest way to use ipfixprobe is to process PCAP file using PCAP plugin (need to be ./configured with --with-pcap)

./ipfixprobe -s cache -i "pcap;file=pcaps/http.pcap" -o "text;m"

{{ plugin.title | raw }}

{{ plugin.description | raw }}

The ipfixprobe consists of one input, zero or one output, one storage and zero or more process plugins.

{% for plugin in site.how %}

{{ plugin.title | raw }}

{{ plugin.description | raw }}

{% for option in plugin.options %}

{{ option.title }}

{{ option.description }}

{% if plugin.options %} Command line parameters used by {{ option.title }} plugin:
{% for parameter in option.parameters %} {{ parameter.name | raw }} : {{ parameter.description}}
{% endfor %}
{% endif %} {% for run in option.runs %}

{{ run.explanation }}

{{ run.code }}

{% endfor %} {% endfor %} {% endfor %}

One-time convertion of PCAP file to CSV

The ipfixprobe can be used to convert given PCAP file to the CSV containing flows from that file in the Unirec format.

Requirements:
  • Docker or Podman
  • bash
  • which, mktemp
This container performs the following tasks:
  1. Copies a pcap file and processing script into the container
  2. Runs the ipfixprobe tool to export flows
  3. Logs the results in CSV format

Build

The script builds the image automatically, but be sure that Dockerfile is in the same directory.
To build the manually image, navigate to the directory containing the Dockerfile and run:

docker build -t docker_ipfixprobe .

Run

Parameters:
  • process_script.sh Script for processing the pcap file inside the container
  • input_file.pcap Path to the input pcap file
  • output_file.csv Path to the output CSV file

bash ./ipfixprobe_wrapper.sh <process_script.sh> <input_file.pcap> <output_file.csv>

To process a file ../pcaps/mixed.pcap using a processing script process_script.sh and output the results to output.csv, use the following wrapper script:

bash ./ipfixprobe_wrapper.sh ./process_script.sh ../pcaps/mixed.pcap ./output.csv


OpenWrt / Turris

Create and save the configuration file to the /etc/config/ipfixprobe. Example of configuration file:

NEMEA ipfixprobe # Copyright (C) 2022-2023 CESNET # Available options for profiles, 'list' options can be used repeatedly: # list interfaces - list of NIC, e.g., eth0, enp0s1, ... # list plugins - list of plugin names, see 'ipfixprobe -h process' for help # ipfix_host - address of IPFIX collector # ipfix_port - port of IPFIX collector, default: 4739 # ipfix_udp - 1 to export to IPFIX collector via UDP, 0 via TCP # cache_size - size of flow cache as exponent of 2, default: 1024 # cache_line - size of flow cache line as exponent of 2, default: 4 # active_timeout - active timeout in seconds, default: 300 # inactive_timeout - inactive timeout in seconds, default: 30 # link - unsigned integer as identification of link/router # dir - unsigned integer as identification of direction/NIC # split_biflow - 1 to split biflow to uniflow, default: 0 to use biflow # ipfix_mtu - size of max transmission unit (MTU), default: 1452 # # respawn - enable respawn of crashed process # respawn_threshold - timeout in seconds for restarting a service after it closes # respawn_timeout - max time in seconds to wait for a process respawn to complete # respawn_retry - max number of attempts to respawn before giving up, 0 means newer stop trying to respawn # core - size of coredump, '0' - not generate, 'unlimited' - unlimited size # # enabled - 1 to enable start daemon instance for that profile, NOTE: if profile is directly specified for start script # (example: '/etc/init.d/ipfixprobe start wan profileX profileY lan'), this option is ignored config profile 'lan' option enabled '0' list interfaces 'br-lan' list plugins 'basicplus' list plugins 'dns' list plugins 'http' list plugins 'pstats' list plugins 'ovpn' list plugins 'wg' list plugins 'dnssd;txt' list plugins 'ssdp' list plugins 'tls' list plugins 'quic' option ipfix_host '127.0.0.1' option ipfix_port '4739' option ipfix_udp '1' option link '1' option dir '1'

Prepare the init script:

wget https://raw.githubusercontent.com/CESNET/Nemea-OpenWRT/master/net/ipfixprobe/files/init.d/ipfixprobe

sudo mv ipfixprobe /etc/init.d/ipfixprobe

To run the script manually use:

/etc/init.d/ipfixprobe start

To start the service at system startup:

/etc/init.d/ipfixprobe enable