CERT NetSA Security Suite
Monitoring for Large-Scale Networks

# fixbuf

Documentation

- Main Page
- Related Pages
- Data Structures
- Files

RFC 5610

What is RFC 5610?

RFC 5610 provides a mechanism to export full type information for Information Elements from the IPFIX Information Model. Libfixbuf version 1.4 and later provides API functions to create IPFIX Option Template/Records that can encode the full set of properties for the definition of an Information Element in order for a Collecting Process to be able to know how to decode data that contains enterprise -specific Information Elements.

# RFC 5610 Exporters

To create a new enterprise-specific Information Element, the Exporting Process should define a new information element using the FB_IE_INIT_FULL macro to provide the name, private enterprise number, id, length, description, data type, and units of the information element. The Information Elements should then be added to the Information Model using fbInfoModelAddElement() or fbInfoModelAddElementArray().

An options template can then be created using fbInfoElementAllocTypeTemplate(). This creates an option template that contains all of the necessary properties to define an Information Element:

-informationElementRangeBegin -informationElementRangeEnd -privateEnterpriseNumber -informationElementUnits -informationElementId -informationElementDataType -informationElementSemantics -paddingOctets -informationElementName -informationElementDescription

Then the template can be added to the session using fbSessionAddTemplate(). Create the exporter and fbuf as described above for the necessary mode of transport. In order to use the above template, set the internal template to the to the options template created above using the template id that was returned by fbSessionAddTemplate() using fBufSetInternalTemplate(). Use fBufSetExportTemplate() to set the external template on the fBuf, then use fbInfoElementWriteOptionsRecord() with the enterprise-specific Information Element. For Example:

fbInfoElementWriteOptionsRecord(fbuf, fbInfoModelGetElementByName(infoModel, "myNewElement"), tid, err);

The Options Record will automatically be appended to the fbuf and will be sent upon calling fBufEmit().

# RFC 5610 - Collector Usage

In order to collect the above Options records, the collecting process can manually define the above Options Template and provide a template callback function to collect and add each element to the Information Model using fbInfoElementAddOptRecElement() and fbInfoModelTypeInfoRecord().

OR - the collector can simply use fBufSetAutomaticInsert() after creating an fBuf to automatically insert any information elements into the Information Model. Use the FB_IE_UNITS() and FB_IE_SEMANTIC() macros to query the flags field for the appropriate field.