libfixbuf - IPFIX Protocol Library

0.7.3

Introduction

libfixbuf aims to be a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (draft-ietf-ipfix-protocol, current revision -24, presently in the IETF RFC Editor queue). It supports the information model defined in "Information Model for IP Flow Information Export" (draft-ietf-ipfix-info, current revision -15, presently in the IETF RFC Editor Queue), extended as proposed by "Bidirectional Flow Export using IPFIX" (draft-ietf-ipfix-biflow, current revision -05, presently in the IETF RFC Editor Queue) to support information elements for representing biflows.

libfixbuf supports UDP, TCP, SCTP, and TLS over TCP as transport protocols. Support for DTLS over UDP and DTLS over SCTP is forthcoming. It also supports operation as an IPFIX File Writer or IPFIX File Reader as defined in "An IPFIX-Based File Format" (draft-trammell-ipfix-file, current revision -04).

libfixbuf's public API is defined in public.h; see the documentation of that file for general documentation on getting started with libfixbuf, as well as detailed documentation on the public API calls and data types.

Downloading

libfixbuf is distributed from http://tools.netsa.cert.org/fixbuf

Download libfixbuf 0.7.2

Building

libfixbuf uses a reasonably standard autotools-based build system. The customary build procedure (./configure && make && make install) should work in most environments.

libfixbuf requires glib-2.0 version 2.6.4 or later. If built against version 2.10 or later, it will automatically use the glib slab allocator for increased memory allocation performance. glib is available on most modern Linux distributions and BSD ports collections, or in source form from http://www.gtk.org.

libfixbuf automatically uses the getaddrinfo(3) facility and the accompanying dual IPv4/IPv6 stack support if present. getaddrinfo(3) must be present to export or collect flows over IPv6.

libfixbuf does not build with SCTP support by default. The --with-sctp option must be given to the libfixbuf ./configure script to include SCTP support. Also note that SCTP requires kernel support, and applications built against libfixbuf with libsctp may fail at runtime if that kernel support is not present.

libfixbuf does not build with TLS support by default. The --with-ssl option must be given to the libfixbuf ./configure script to include TLS support.

Issues

Note that while libfixbuf has been tested for interoperability against other IPFIX implementations, it has not been heavily tested outside the scope of the application suite it was written for. In addition, the API may change from release to release until version 1.0.0.

The following are known issues with libfixbuf as of version 0.7.2:

There is no support for DTLS over UDP or DTLS over SCTP transport.
There is no support for application-selectable SCTP stream assignment or SCTP partial reliability. Templates are sent reliably on stream 0, and data sets are sent reliably on stream 1.
UDP listener support is limited to a single remote Exporting Process; the first remote endpoint to connect to a UDP listener is the only one from which IPFIX Messages will be accepted for the listener's lifetime. This is an obvious security flaw and limits the usefulness of libfixbuf for implementing UDP collecting processes. A peer address based session demultiplexer is planned for a future release, but may require incompatible API changes.
There is no automatic support for periodic template retransmission or periodic template expiration as required when transporting IPFIX over UDP. Applications using libfixbuf to transport IPFIX messages over UDP must maintain these timeouts and manually manage the session.

Copyright

libfixbuf was developed at the CERT Network Situational Awareness Group by Brian Trammell <bht@cert.org> for use in the NAF and YAF tools.