CERT NetSA Security Suite
Monitoring for Large-Scale Networks

# fixbuf

Documentation
Spread Collectors

How-To Use the Spread Protocol

The instructions for using Spread in libfixbuf are similar to the setup for reading from IPFIX files. As described above in the Exporters section, the first step is to create an fbInfoModel_t and fbSession_t. Next, create the internal template(s) and add it to the fbSession_t. Define an fbSpreadParams_t and set the session, groups to subscribe to, and Spread Daemon name. Example usage:

fbSpreadParams_t spread;
char *groups[25];
groups[0] = strdup("group1");
groups[1] = '\0';
spread.daemon = "daemon1"
spread.groups = groups;
spread.session = session;
collector = fbCollectorAllocSpread(0, &spread, &err);

Then create an fbCollector_t to connect and listen to the Spread Daemon using fbCollectorAllocSpread().

With an fbSession_t and fbCollector_t available, create a buffer for writing via fBufAllocForCollection(). Set the internal template ID with fBufSetInternalTemplate(), and use fBufNext() to read records from IPFIX Messages published to the group your collector is subscribing to.

To view all the Spread Groups that were sent the incoming record, call fbCollectorGetSpreadReturnGroups() on the collector.