libfixbuf - IPFIX Message Format Implementation

0.4.1

Introduction

libfixbuf aims to be a compliant implementation of the IPFIX protocol message format, from which fully compliant IPFIX Collecting Processes and IPFIX Exporting Processes may be built. In addition of the IPFIX Protocol, libfixbuf supports efficient persistent storage of IPFIX data using the method outlined in IETF informational draft-trammell-ipfix-file-00.

libfixbuf's API consists of three main modules. writer.h defines FixWriter, which writes IPFIX messages. reader.h defines FixReader, which reads IPFIX messages. template.h defines FixTemplate, which implements IPFIX templates. ie.h defines the FixIE information element type used by FixTemplate, and the information element registry used by FixReader and FixWriter.

Downloading

libfixbuf is distributed from http://aircert.sourceforge.net/fixbuf

Download libfixbuf 0.4.1 from sourceforge.net

Building

libfixbuf uses a reasonably standard autotools-based build system. The customary build procedure (./configure && make && make install) should work in most environments.

Issues

libfixbuf 0.4.1 is alpha quality software. While it has been tested for interoperability against other IPFIX implementations, it has not been heavily tested outside the scope of the application suite it was written for.

libfixbuf differs from IETF standards track draft-ietf-ipfix-protocol-19 and informational draft-boschi-ipfix-implementation-guidelines-01 in the following important ways:

While libfixbuf will read records containing multiple information elements of the same type, only the last information element of any given type will be available to the transcoder and copied to the application. The same caveat applies to writers; all but the last information element of any given type will be zeroed on transcode. This will be fixed in a future release, but should not require changes to any API other than the private transcoder interface.

SCTP is not supported. Future releases of libfixbuf will support SCTP via the sockets API as in Stevens et. al. UNIX Network Programming, Volume One, Third Edition; in reality this translates to SCTP being supported only on certain Linuxes. No plans exist to support any of the various SCTP userland implementations. The nature of IPFIX's use of SCTP streams will require incompatible low-level I/O API changes; these should not affect applications unless they use their own low-level I/O routines for fixbuf.

Other IPFIX protocol features (e.g., duplicate detection via sequence numbers) are not yet implemented; any of these features specific to the on-the-wire implementation of IPFIX without impacting the message format are unlikely to be addressed directly in libfixbuf.

Copyright

libfixbuf was developed at the CERT Network Situational Awareness Group by Brian Trammell <bht@cert.org> for use in the NAF tools.