CERT NetSA Security Suite
Monitoring for Large-Scale Networks

# fixbuf

Documentation
Getting started with libfixbuf

Include fixbuf/public.h in order to use the public fixbuf API.

This documentation uses IPFIX terminology as defined in RFC 7011, "Specification of the IPFIX Protocol for the Exchange of Flow Information"

The following sections provide information on specific libfixbuf usage:

- Exporter Usage How-To Export IPFIX
- IPFIX File Collectors How-To Read IPFIX Files
- Network Collectors How-To Listen Over the Network Using TCP (Recommended)
- UDP Collectors How-To Collect IPFIX over UDP
- NetFlow v9 Collectors How-To Use libfixbuf as a NetFlow v9 Collector
- sFlow Collectors How-To Use libfixbuf to Collect sFlow v5
- Spread Collectors How-To Use the Spread Protocol
- Connection-less Collector How-To Use libfixbuf with a Data Buffer
- Lists in IPFIX How-To Handle BasicLists, SubTemplateLists, & SubTemplateMultiLists
- RFC 5610 How-To Export and Read Enterprise Element Definitions
- Complete Programs Complete Programs that Use libfixbuf

# Data Types

public.h defines the data types and routines required to support IPFIX Exporting Process and IPFIX Collecting Process creation. Each data type is manipulated primarily by routines named "fb" followed by the type name (e.g., "Session", "Collector") followed by a description of the routine's action. The routines operating on the fBuf_t IPFIX Message buffer type are named beginning with "fBuf".

The fBuf_t opaque type implements a transcoding IPFIX Message buffer for both export and collection, and is the "core" interface to the fixbuf library.

The fbInfoModel_t opaque type implements an IPFIX Information Model, including both IANA managed Information Elements and vendor-specific Information Elements. The fbTemplate_t opaque type implements an IPFIX Template or an IPFIX Options Template. Both are defined in terms of Information Elements, represented by the fbInfoElement_t public type. An fBuf_t message buffer maintains internal Templates, which represent records within the fixbuf application client, and external Templates, which represent records as they appear on the wire, for use during transcoding. For a Spread Exporter, Templates are managed per group. For a Spread Collector, Templates are managed per Session.

The state of an IPFIX Transport Session, including IPFIX Message Sequence Number tracking and the internal and external Templates in use within the Session, are maintained by the fbSession_t opaque type.

An Exporting Process' connection to its corresponding Collecting Process is encapsulated by the fbExporter_t opaque type. Exporters may be created to connect via the network using one of the supported IPFIX transport protocols, or to write to IPFIX Files specified by name or by open ANSI C file pointer.

A Collecting Process' connection to a corresponding Exporting Process is encapsulated by the fbCollector_t opaque type. The passive connection used to listen for connections from Exporting Processes is managed by the fbListener_t opaque type; Collectors can be made to read from IPFIX Files specified directly by name or by open ANSI C file pointer, as well.

Network addresses are specified for Exporters, Collectors, and Listeners using the fbConnSpec_t and fbTransport_t public types.

This file also defines the GError error codes used by all the fixbuf types and routines within the FB_ERROR_DOMAIN domain.