IPFIX parser package for Go
Go
Switch branches/tags
Clone or download
Permalink
Failed to load latest commit information.
etc generate builtin dictionary from ipfix.xml Mar 12, 2015
.gitignore generate builtin dictionary from ipfix.xml Mar 12, 2015
Jenkinsfile Add Jenkinsfile Jun 7, 2017
LICENSE
README.md Build badge Jun 14, 2017
benchmark_test.go Reduce allocations in interpretInto path Mar 29, 2017
build.sh Refactor and simplify API Feb 25, 2015
builtin-dictionary.go generate builtin dictionary from ipfix.xml Mar 12, 2015
debug.go Add IPFIXDEBUG envvar Sep 2, 2015
doc.go
examples_test.go Cleanups Mar 4, 2015
interpreter.go Added support for template ID aliasing Jun 27, 2017
interpreter_test.go Handle reduced-size encoded integers (fixes #12) Jun 7, 2017
parser.go Export & load templates (#20) Feb 19, 2018
parser_fuzz.go Use new gcfg import path Feb 3, 2016
parser_test.go Fix error check for Go 1.10 Feb 11, 2018
read.go Don't panic on corrupt header lengths Aug 25, 2015
rfc5103.go generate builtin dictionary from ipfix.xml Mar 12, 2015
rfc5103_test.go Correct biflowDirection field Mar 12, 2015
slice.go Minor refactoring Jul 14, 2015
slice_test.go Minor refactoring Jul 14, 2015

README.md

ipfix

Package ipfix implements an IPFIX (RFC 5101) parser and interpreter.

Build & Test API Documentation MIT License

Input data from an io.Reader or a []byte is parsed and chunked into messages. Template management and the standard IPFIX types are implemented so a fully parsed data set can be produced. Vendor fields can be added at runtime.

Example

To read an IPFIX stream, create a Session and then use ParseBuffer to parse data coming from a single UDP packet or similar.

var conn net.PacketConn // from somewhere
buf := make([]byte, 65507) // maximum UDP payload length
s := ipfix.NewSession()
for {
    n, _, err := conn.ReadFrom(buf)
    // handle err
    msg, err := s.ParseBuffer(buf[:n])
    // handle msg and err
}

To interpret records for correct data types and field names, use an interpreter:

i := ipfix.NewInterpreter(s)
var fieldList []ipfix.InterpretedField
for _, rec := range msg.DataRecords {
    fieldList = i.InterpretInto(rec, fieldList[:cap(fieldList)])
    // handle the field list
}

To add a vendor field to the dictionary so that it will be resolved by Interpret, create a DictionaryEntry and call AddDictionaryEntry.

e := ipfix.DictionaryEntry{
    Name: "someVendorField",
    FieldId: 42,
    EnterpriseId: 123456,
    Type: ipfix.Int32
}
i.AddDictionaryEntry(e)

License

The MIT license.

Usage

See the documentation.