Configuring Clickstream, Meta data, DNS export in IPFIX [Документация VAS Experts]
Документация VAS Experts Документация VAS Experts-mobile
in

Settings

  • Show page
  • Old revisions
  • Export to PDF
  • Fold/unfold all
  • Backlinks
  • Show page
  • Old revisions
  • Export to PDF
  • Fold/unfold all
  • Backlinks

    • Differences

    This shows you the differences between two versions of the page.

    Link to this comparison view

    Both sides previous revisionPrevious revision
    en:dpi:dpi_options:opt_li:li_ipfix [2025/06/26 07:25] – [Metadata Export Setting] elena.krasnobryzhen:dpi:dpi_options:opt_li:li_ipfix [2025/06/26 07:26] (current) – [IPFIX metadata export template formats] elena.krasnobryzh
    Line 168: Line 168:
     |  2017  |  -  |  raw  |  43823  |MPLS Labels| |  2017  |  -  |  raw  |  43823  |MPLS Labels|
     **Notes:** \\ **Notes:** \\
    -IP_SRC --- IP SOURCE\\ +**IP_SRC** — IP SOURCE\\ 
    -IP_DST --- IP DESTINATION\\ +**IP_DST** — IP DESTINATION\\ 
    -GATEWAYS --- comma separated list of gateways (IP or hostname)+**GATEWAYS** — comma separated list of gateways (IP or hostname)
      
     ^  FTP Metadata Export Template IPFIX Format  ^^^^^^ ^  FTP Metadata Export Template IPFIX Format  ^^^^^^
    Line 190: Line 190:
     |  2017  |  -  |  raw  |  43823  |MPLS Labels| |  2017  |  -  |  raw  |  43823  |MPLS Labels|
      
    -**Note:** the MODE field contains the FTP connection type 0 --- active, 1 --- passive+**Note:** the MODE field contains the FTP connection type 0 — active, 1 — passive
      
     ^  Messenger Metadata Export Template IPFIX Format (XMPP)  ^^^^^^ ^  Messenger Metadata Export Template IPFIX Format (XMPP)  ^^^^^^
    Line 212: Line 212:
     |  2017  |  -  |  raw  |  43823  |MPLS Labels| |  2017  |  -  |  raw  |  43823  |MPLS Labels|
      
    -**Note:** the IM_PROTOCOL field contains the type of protocol used: 0 --- ICQ, 7 --- XMPP, 106 --- ZELLO+**Note:** the IM_PROTOCOL field contains the type of protocol used: 0 — ICQ, 7 — XMPP, 106 — ZELLO
      
     ^  IPFIX format of mail protocol metadata export template (POP, IMAP, SMTP)  ^^^^^^ ^  IPFIX format of mail protocol metadata export template (POP, IMAP, SMTP)  ^^^^^^
    Line 237: Line 237:
     |  2017  |  -  |  raw  |  43823  | MPLS Labels | |  2017  |  -  |  raw  |  43823  | MPLS Labels |
      
    -**Note:** the EVENT field indicates the event type 1 --- send, 2 --- receive, \\ +**Note:** the EVENT field indicates the event type 1 — send, 2 — receive, \\ 
    -ATTACHMENT sign of an attachment, mail_protocol = 0 --- smtp, 1 --- pop3, 2 --- imap+ATTACHMENT sign of an attachment, mail_protocol = 0 — smtp, 1 — pop3, 2 — imap
      
     ^  The raw unparsed metadata export template IPFIX format  ^^^^^^ ^  The raw unparsed metadata export template IPFIX format  ^^^^^^
    Line 263: Line 263:
     |  2017  |  -  |  raw  |  43823  |MPLS Labels| |  2017  |  -  |  raw  |  43823  |MPLS Labels|
     **Note:** **Note:**
    -  * **//FLW_DIR//** --- direction of packet on interfaces : 0 : subs --> inet, 1 : inet --> subs \\ +  * **''FLW_DIR''** — direction of packet on interfaces : 0 : subs → inet, 1 : inet → subs \\ 
    -  * **//DIR_DATA//** --- direction of the packet by session: for TCP 0 : client --> server, 1 : server --> client, for UDP --- from whom the first packet was recorded, he is considered the client\\ +  * **''DIR_DATA''** — direction of the packet by session: for TCP 0 : client → server, 1 : server → client, for UDP — from whom the first packet was recorded, he is considered the client\\ 
    -  * **//VDPI_PROTO//** --- protocol that defined dpi\\ +  * **''VDPI_PROTO''** — protocol that defined DPI\\ 
    -  * **//META_PROTO//** --- internal protocol identifier (3 --- SIP, 4 --- FTP, 5 --- SMTP, 6 --- POP3, 7 --- IMAP, 8 --- XMPP, 9 --- ICQ, 10 --- RSS, 11 --- NNTP, 12 --- H323, 13 --- ZELLO)\\ +  * **''META_PROTO''** — internal protocol identifier (3 — SIP, 4 — FTP, 5 — SMTP, 6 — POP3, 7 — IMAP, 8 — XMPP, 9 — ICQ, 10 — RSS, 11 — NNTP, 12 — H323, 13 — ZELLO)\\ 
    -  * **//RAW_DATA//** --- raw data+  * **''RAW_DATA''** — raw data
      
     Aggregating ''raw_data'', ''clickstream'', ''http_reply'' and ''ssl_reply'' with session data requires additional processing or executing a database query with the ''session_id'' key, or support in the ''rcollector'' utility. Aggregating ''raw_data'', ''clickstream'', ''http_reply'' and ''ssl_reply'' with session data requires additional processing or executing a database query with the ''session_id'' key, or support in the ''rcollector'' utility.