CERT NetSA Security Suite
Monitoring for Large-Scale Networks

# fixbuf

Documentation

- Main Page
- Related Pages
- Data Structures
- Files

Exporter Usage

How-To Export IPFIX: Each fixbuf application must have a single fbInfoModel_t instance that represents the Information Elements that the application understands.

The fbInfoModelAlloc() call allocates a new Information Model with the IANA-managed information elements (current as of the fixbuf release date) preloaded. Additional vendor-specific information elements may be added with fbInfoModelAddElement() and fbInfoModelAddElementArray().

To create an Exporter, first create an fbSession_t attached to the application's fbInfoModel_t to hold the Exporter's Transport Session state using fbSessionAlloc(). If exporting via the Spread protocol, create an fbSpreadParams_t and set its session to your newly defined session, group names (a null terminated array), and Spread daemon name.

Then create an fbExporter_t to encapsulate the connection to the Collecting Process or the file on disk, using the fbExporterAllocFP(), fbExporterAllocFile(), fbExporterAllocNet(), fbExporterAllocBuffer(), or fbExporterAllocSpread() calls.

With an fbSession_t and an fbExporter_t available, create a buffer for writing via fBufAllocForExport().

Create and populate templates for addition to this session using the fbTemplate calls, then add them to the session via fbSessionAddTemplate().

If exporting via Spread, before calling fbSessionAddTemplate(), set the group that should receive this template with the fBufSetSpreadExportGroup() call. If more than 1 group should receive the template, use the fbSessionAddTemplatesMulticast() which will call fBufSetSpreadExportGroup() on the given group(s) multicast the template to the given group(s). For Spread, do not use fbSessionAddTemplate() to send to multiple groups.

Once the templates have been added to the session, use fbSessionExportTemplates() to add the templates to the buffer and then set the internal and external template IDs with fBufSetInternalTemplate() and fBufSetExportTemplate(). You can then use fBufAppend() to write records into IPFIX Messages and Messages to the output stream.

Note that Templates use internal reference counting, so they may be added to multiple sessions, or to the same session using multiple template IDs or multiple domains, or as both an internal and an external template on the same session.

By default, fBufAppend() will emit an IPFIX Message to the output stream when the end of the message buffer is reached on write. The fBufSetAutomaticMode() call can be used to modify this behavior, causing fBufAppend() to return FB_ERROR_EOM when at end of message. Use this if your application requires manual control of message export. In this case, fBufEmit() will emit a Message to the output stream. If using Spread, call fBufSetSpreadExportGroup() to set the groups to export to on the buffer before calling fBufAppend().