Skip to content

irino/goflowd

Repository files navigation

goflowd

Sumarry

goflowd is netflow probe like softflowd. It is written by golang. goflowd uses ietf-ipfix-psamp.yang standarized in RFC6728 data model for configuration. The yang model configuraiton is acheived by using openconfig/ygot.

Execution

./goflowd -c config.json

Configuration sample

Configuration file is json based. In following sample, the packets are read from enp0s3 interface and export flow to 192.168.1.1 port 4739. In this sample, FlowKeys are sourceIPv4Address, destinationIPv4Address, protocolIdentifier, sourceTransportPort, and destinationTransportPort.

If you want to use offline pcap file instead of online capture, you need to use offlineFile": "file name" instread of ifName": [ "interface name" ].

{
    "observationPoint": [
        {
            "name": "pcap",
            "observationDomainId": 1,
             "ifName": [ "enp0s3" ],
            "direction": "ingress",
            "selectionProcess": [
                "All"
            ]
        }
    ],
    "selectionProcess": [
        {   
            "name": "All",
            "selector": [
                {
                    "name": "Select all",
                    "selectAll": [
                        null
                    ]
                }
            ],
            "cache": "Flow cache"
        }
    ],
    "cache": [
        {
            "name": "Flow cache",
            "timeoutCache": {
                "maxFlows": 4096,
                "activeTimeout": 5000,
                "idleTimeout": 10000,
                "cacheLayout": {
                    "cacheField": [
                        {
                            "name": "Field 1",
                            "ieName": "sourceIPv4Address",
                            "isFlowKey": [
                                null
                            ]
                        },
                        {
                            "name": "Field 2",
                            "ieName": "destinationIPv4Address",
                            "isFlowKey": [
                                null
                            ]
                        },
                        {
                            "name": "Field 3",
                            "ieName": "protocolIdentifier",
                            "isFlowKey": [
                                null
                            ]
                        },
                        {
                            "name": "Field 4",
                            "ieName": "sourceTransportPort",
                            "isFlowKey": [
                                null
                            ]
                        },
                        {
                            "name": "Field 5",
                            "ieName": "destinationTransportPort",
                            "isFlowKey": [
                                null
                            ]
                        },
                        {
                            "name": "Field 6",
                            "ieName": "flowStartMilliseconds"
                        },
                        {
                            "name": "Field 7",
                            "ieName": "flowEndMilliseconds"
                        },
                        {
                            "name": "Field 8",
                            "ieName": "octetDeltaCount"
                        },
                        {
                            "name": "Field 9",
                            "ieName": "packetDeltaCount"
                        }
                    ]
                }
            },
            "exportingProcess": [
                "UDP"
            ]
        }
    ],
    "exportingProcess": [
        {
            "name": "UDP",
            "destination": [
                {
                    "name": "UDP",
                    "udpExporter": {
                        "ipfixVersion": 10,
                        "destinationPort": 4739,
                        "destinationIPAddress": "192.168.1.1"
                    }
                }
            ]
        }
    ]
}

Configurable Informaiton Elements for FlowKeys

Information Element ID Information Element Name
4 protocolIdentifier
5 ipClassOfService
7 sourceTransportPort
8 sourceIPv4Address
11 destinationTransportPort
12 destinationIPv4Address
27 sourceIPv6Address
28 destinationIPv6Address
31 flowLabelIPv6
32 icmpTypeCodeIPv4
54 fragmentIdentification
56 sourceMacAddress
57 postDestinationMacAddress
58 vlanId
60 ipVersion
139 icmpTypeCodeIPv6
176 icmpTypeIPv4
177 icmpCodeIPv4
178 icmpTypeIPv6
179 icmpCodeIPv6
180 udpSourcePort
181 udpDestinationPort
182 tcpSourcePort
183 tcpDestinationPort
193 nextHeaderIPv6
195 ipDiffServCodePoint
196 ipPrecedence

Configurable Informaiton Elements for Non-FlowKeys for collection

Information Element ID Information Element Name
1 octetDeltaCount
2 packetDeltaCount
6 tcpControlBits
21 flowEndSysUpTime
22 flowStartSysUpTime
150 flowStartSeconds
151 flowEndSeconds
152 flowStartMilliseconds
153 flowEndMilliseconds

Functionality comparison with softflowd

softflowd goflowd
Online packet capture supported supported
Reading pcap file supported(-r) supported
PSAMP collector supported(-R) TODO
NetFlow version 1 export supported(-v 1) TODO
NetFlow version 5 export supported(-v 5) supported
NetFlow version 7 export unsupported TODO
NetFlow version 8 export unsupported TODO
NetFlow version 9 export supported(-v 9) TODO
IPFIX export supported(-v 10) supported
IPv6 support(v9,IPFIX) supported(-6) supported
Bidirectioal flow export supported(-b) TODO
PSAMP export supported(-v PSAMP) TODO
ntopng direct injection supported(-v ntopng) TODO
Flow export on UDP supported(-P udp) supported
Flow export on TCP supported(-P tcp) supported
Flow export on SCTP supported(-P sctp) TODO
Configuration unsupported supported
FlowKey Configuration partially supported(-T) supported
Count-based sampling supported supported
Time-based sampling unsupported supported

Limiation of IPFIX export in goflowd

  • SCTP is mandatory in IPFIX (RFC7011), however go's net.Dial does not support SCTP. Hence, goflowd does not support SCTP export.
  • Every packets exported by goflowd contain Template Set.
  • Option Template has not implemented.

Releases

No releases published

Packages

No packages published

Languages