Skip to main content
Version: 1.3.0

IPFix

Push

Synopsis​

Creates an IPFix collector that accepts flow data over UDP connections. Supports High-Volume collection with multiple worker processes and configurable buffer sizes.

For details, see Appendix.

Schema​

id: <numeric>
name: <string>
description: <string>
type: ipfix
tags: <string[]>
pipelines: <pipeline[]>
status: <boolean>
properties:
  address: <string>
  port: <numeric>
  reuse: <boolean>
  buffer_size: <numeric>

Configuration​

The following fields are used to define the device:

Device​

FieldRequiredDefaultDescription
idYUnique identifier
nameYDevice name
descriptionN-Optional description
typeYMust be ipfix
tagsN-Optional tags
pipelinesN-Optional pre-processor pipelines
statusNtrueEnable/disable the device

Connection​

FieldRequiredDefaultDescription
addressN"0.0.0.0"Listen address
portN4739Listen port
reuseNtrueEnable socket address reuse

Performance​

FieldRequiredDefaultDescription
buffer_sizeN9000Network read buffer size in bytes

Key Features​

The following are unique features that Director offers.

Multiple Workers​

When reuse is enabled, the collector automatically scales to use multiple workers based on available CPU cores. Each worker maintains its own UDP listener, processes flows independently, and writes to a dedicated queue file.

Flows​

The collector supports template management for NetFlow v9/IPFix, application identification, port-based protocol mapping, flow state tracking, and statistical aggregation.

Examples​

The following are commonly used configuration types.

Basic​

The minimum required configuration using defaults:

Create a simple IPFix collector...

devices:
  - id: 1
    name: basic_ipfix
    type: ipfix
    properties:
      port: 4739

High-Volume​

Performance can be enhanced for high volumes:

Optimizing for high message volumes...

devices:
  - id: 2
    name: performant_ipfix
    type: ipfix
    properties:
      address: "0.0.0.0"
      port: 4739
      reuse: true
      buffer_size: 32768
note

When reuse is enabled, the collector automatically scales up to use all available CPU cores.

Multiple Flows​

Multiple flow types can be collected through a single device:

Collecting multiple flow types...

devices:
  - id: 3
    name: multi_flow
    type: ipfix
    properties:
      address: "0.0.0.0"
      port: 4739
      reuse: true
      buffer_size: 16384
warning

Each flow type requires its own port. Ensure no port conflicts exist between different collectors.

Application Protocols​

The collector supports application-based identification, TCP port mapping, and UDP port mapping. The definition files for these respectively are placed in three locations under <vm_root>:

  • /user/definitions/app-definitions-{device-id}.csv (device-specific)
  • /user/definitions/app-definitions.csv (user-defined)
  • /package/definitions/app-definitions.csv (system defaults)
  • /user/definitions/tcp-definitions-{device-id}.csv (device-specific)
  • /user/definitions/tcp-definitions.csv (user-defined)
  • /package/definitions/tcp-definitions.csv (system defaults)
  • /user/definitions/udp-definitions-{device-id}.csv (device-specific)
  • /user/definitions/udp-definitions.csv (user-defined)
  • /package/definitions/udp-definitions.csv (system defaults):::warning

Definition files must be in CSV format with exactly two columns per row. :::

The contents of these files are:

app-definitions.csv:

SSH,Secure Shell
RDP,Remote Desktop
HTTP,Web Browsing
HTTPS,Secure Web

tcp-definitions.csv:

22,SSH
3389,RDP
80,HTTP
443,HTTPS

udp-definitions.csv:

53,DNS
67,DHCP
123,NTP
161,SNMP
note

The collector will fall back on the system defaults if the custom definition files are not found.

Using application identification...

devices:
  - id: 4
    name: app_aware_ipfix
    type: ipfix
    properties:
      port: 4739
      reuse: true
      buffer_size: 16384