Deb package can be installed without libatomic1 library, which is in fact always needed.

Moreover, the dependencies of the deb package should probably change depending in the build options.

Hello,
I've been trying to compile IPFIXProbe project on the RPi4 and RPi CM4 but it seems to be not supported as it's returning the "Bus error". According to several sources, including https://forums.raspberrypi.com/viewtopic.php?f=33&t=102400, it seems to have the issue with hard-floating ABI but when I try to set the CFLAGS to "-mcpu=cortex-a72 -mfloat-abi=soft -mfpu=crypto-neon-fp-armv8" it breaks the compilation entirely. Is this project going to support ARM/RPi4?

Thanks a lot for your answer,
Michal

MTU is always set to RTE_ETHER_MAX_LEN = 1518. There should be a command line parameter to change this value.

https://github.com/CESNET/ipfixprobe/blob/master/input/dpdk/dpdkDevice.cpp#L140C45-L140C62

I get multiple flows with the same 5-tuples (IPs, ports, protocol) and same times.

ipfixprobe is running as follows:

/usr/bin/ipfixprobe -i 'dpdk;p=0;q=1;e=ipfixprobe-eal --lcores (0-7)@(1,3,5,7,9,11,13,15,17,19,21,23) -a 0000:d8:00.0 --file-prefix=11263' -s 'cache;size=20;active=300;inactive=60;split' -p basicplus -p dns -p http -p tls -p quic -p passivedns -o ipfix;host=target-host;port=target-port;id=216;dir=216;

Observe the following:

The IP addresses for combinations of ports in the screenshot are the same. I'm quite certain that it is impossible to export that much traffic in a single millisecond.

Setup

OS: Ubuntu 22.04 LTS
Compilation as deb package using make deb with modified dh_auto_configure in debian/rules

Full configure params:

 ./configure --build=x86_64-linux-gnu --prefix=/usr --includedir=\${prefix}/include --mandir=\${prefix}/share/man --infodir=\${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=\${prefix}/lib/x86_64-linux-gnu --libexecdir=\${prefix}/lib/x86_64-linux-gnu --disable-maintainer-mode --disable-d
ependency-tracking --with-pcap --with-quic --with-msects --with-dpdk --enable-debug 

Some fields are missing in the README list of plugins.

Additionally, I'd suggest to split README and describe plugins in a separate file from the global README (which is too long now).

I use IPFIX output with dir=59. However, the exporter sends 30779 instead.

Looking at it bitwise, the difference is

30779: 0b01111000 00111011
59:    0b00000000 00111011

So it seems that the first byte is not zeroed out properly.

As a side note, why is the input interface field called dir?

Setup

OS: Ubuntu 22.04 LTS
Compilation as deb package using make deb with modified dh_auto_configure in debian/rules

Full configure params:

 ./configure --build=x86_64-linux-gnu --prefix=/usr --includedir=\${prefix}/include --mandir=\${prefix}/share/man --infodir=\${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=\${prefix}/lib/x86_64-linux-gnu --libexecdir=\${prefix}/lib/x86_64-linux-gnu --disable-maintainer-mode --disable-d
ependency-tracking --with-pcap --with-quic --with-msects --with-dpdk --enable-debug 

I'm running the ipfixprobe as follows:

/usr/bin/ipfixprobe -i 'dpdk;p=0;q=1;e=ipfixprobe-eal --lcores (0-7)@(1,3,5,7,9,11,13,15,17,19,21,23) -a 0000:d8:00.0 --file-prefix=11263' -s 'cache;size=20;active=300;inactive=60;split' -p basicplus -p dns -p http -p tls -p quic -p passivedns -o 'ipfix;host=target-host;port=4739;id=216;dir=216;'

There are quite a lot of segfaults:

Dec 16 13:45:50 hostname kernel: ipfixprobe[10853]: segfault at 0 ip 00007f07c71aa279 sp 00007ffea2cf58a0 error 4 in librte_eal.so.22.0[7f07c7185000+30000]
Dec 16 13:47:53 hostname kernel: ipfixprobe[10868]: segfault at 0 ip 00007f31d396e279 sp 00007ffff8642790 error 4 in librte_eal.so.22.0[7f31d3949000+30000]
Dec 19 13:45:45 hostname kernel: ipfixprobe[6696]: segfault at f300000002 ip 000056240332bfcc sp 00007f32be5f79b0 error 4 in ipfixprobe[56240330f000+56000]
Dec 19 14:47:33 hostname kernel: ipfixprobe[7357]: segfault at f900000002 ip 000055728698587c sp 00007f0eb98259b0 error 4 in ipfixprobe[557286960000+53000]
Dec 19 15:47:57 hostname kernel: ipfixprobe[8298]: segfault at 0 ip 000055a4e9a1287c sp 00007fb6cc24f9b0 error 4 in ipfixprobe[55a4e99ed000+53000]
Dec 19 15:51:16 hostname kernel: ipfixprobe[8367]: segfault at 0 ip 000055d40f68a87c sp 00007f152205d9b0 error 4 in ipfixprobe[55d40f665000+53000]
Dec 19 16:04:16 hostname kernel: ipfixprobe[8456]: segfault at 0 ip 00007f6a4e83a279 sp 00007ffc3aad4b20 error 4 in librte_eal.so.22.0[7f6a4e815000+30000]
Dec 19 21:05:33 hostname kernel: ipfixprobe[9904]: segfault at 0 ip 000055d719e2c4ec sp 00007f2897e3d9c0 error 4 in ipfixprobe[55d719e10000+52000]
Dec 19 21:24:52 hostname kernel: ipfixprobe[9983]: segfault at f800000002 ip 0000561085d574ec sp 00007f85266529c0 error 4 in ipfixprobe[561085d3b000+52000]
Dec 19 22:24:11 hostname kernel: ipfixprobe[10017]: segfault at f400000002 ip 0000557276e594ec sp 00007ff00fe699c0 error 4 in ipfixprobe[557276e3d000+52000]
Dec 20 00:19:32 hostname kernel: ipfixprobe[10079]: segfault at 0 ip 00005559c69c84ec sp 00007fb8562fd9c0 error 4 in ipfixprobe[5559c69ac000+52000]
Dec 20 01:14:10 hostname kernel: ipfixprobe[10306]: segfault at f400000002 ip 000055a1321244ec sp 00007f0ea50de9c0 error 4 in ipfixprobe[55a132108000+52000]

The monitored link utilization is 100k-200k pkt/s.

Setup

OS: Ubuntu 22.04 LTS
Compilation as deb package using make deb with modified dh_auto_configure in debian/rules

Full configure params:

 ./configure --build=x86_64-linux-gnu --prefix=/usr --includedir=\${prefix}/include --mandir=\${prefix}/share/man --infodir=\${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=\${prefix}/lib/x86_64-linux-gnu --libexecdir=\${prefix}/lib/x86_64-linux-gnu --disable-maintainer-mode --disable-d
ependency-tracking --with-pcap --with-quic --with-msects --with-dpdk --enable-debug 

I've exported almost an hour of traffic, quite low number of packets to keep it manageable (15453 packets in 2862 flows).

ipfixprobe was running as follows:

/usr/bin/ipfixprobe -i 'dpdk;p=0;q=1;e=ipfixprobe-eal --lcores (0-7)@(1,3,5,7,9,11,13,15,17,19,21,23) -a 0000:d8:00.0 --file-prefix=11263' -s 'cache;size=20;active=300;inactive=60;split' -p basicplus -p dns -p http -p tls -p quic -p passivedns -o ipfix;host=target-host;port=target-port;id=216;dir=216;

I've looked at how late the flows are exported. For active timeout, it is fine, the difference between flow end and export time is less than two seconds.

However, for inactive timeout, I get anything from 73 seconds (which is fine, minimum is 60) to 2375 seconds, which is totally unacceptable. My guess is that the flow cache maintenance algorithm just does not find these flows in time.

Setup

OS: Ubuntu 22.04 LTS
Compilation as deb package using make deb with modified dh_auto_configure in debian/rules

Full configure params:

 ./configure --build=x86_64-linux-gnu --prefix=/usr --includedir=\${prefix}/include --mandir=\${prefix}/share/man --infodir=\${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=\${prefix}/lib/x86_64-linux-gnu --libexecdir=\${prefix}/lib/x86_64-linux-gnu --disable-maintainer-mode --disable-d
ependency-tracking --with-pcap --with-quic --with-msects --with-dpdk --enable-debug 

I'm running ipfixprobe with DPDK input as follows:

/usr/bin/ipfixprobe -i 'dpdk;p=0;q=1;e=-c 0x01 -a 0000:3b:00.1'

In journalctl, I see

Dec 20 09:48:55 hostname -c[11346]: EAL: VFIO support initialized                                                      
Dec 20 09:48:55 hostname -c[11346]: EAL: Probe PCI driver: mlx5_pci (15b3:1017) device: 0000:3b:00.1 (socket 0)        
Dec 20 09:48:56 hostname -c[11346]: TELEMETRY: No legacy callbacks, legacy socket not created

So the first parameter -c is used as an application name. I've also confirmed, that it is being ignored, i.e. has no effect.

Setup

OS: Ubuntu 22.04 LTS
Compilation as deb package using make deb with modified dh_auto_configure in debian/rules

Full configure params:

 ./configure --build=x86_64-linux-gnu --prefix=/usr --includedir=\${prefix}/include --mandir=\${prefix}/share/man --infodir=\${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=\${prefix}/lib/x86_64-linux-gnu --libexecdir=\${prefix}/lib/x86_64-linux-gnu --disable-maintainer-mode --disable-d
ependency-tracking --with-pcap --with-quic --with-msects --with-dpdk --enable-debug 

Could you please tell me where I can download some plugins, e.g. http, dns etc. I would also highly appreciate instructions how to import plugins into ipfixprobe.

Thank you very much.

I have two NICs and I need to run two ipfixprobe processes to monitor the traffic. When I start as follows

ipfixprobe  --input 'dpdk;port=0;eal=ipfixprobe-eal -c 0x1 -a 0000:d8:00.0;q=1'

ipfixprobe  --input 'dpdk;port=0;eal=ipfixprobe-eal -c 0x2 -a 0000:3b:00.0 --file-prefix aaa;q=1'

both processes end up on first CPU, which is a great problem while actively polling for traffic - each process shows only 50% CPU usage, the packet reading often stalls in one or the other.

Possible solution

I've come up with the following workaround:

Comment out the call to set_thread_affinity function: https://github.com/CESNET/ipfixprobe/blob/master/input/dpdk.cpp#L330

Run with eal set as follows:

/usr/bin/ipfixprobe -i 'dpdk;p=0;q=1;e=ipfixprobe-eal --lcores (0-7)@(0,2,4,6,8,10,12,14,16,18,20,22) -a 0000:3b:00.0'
/usr/bin/ipfixprobe -i 'dpdk;p=0;q=1;e=ipfixprobe-eal --lcores (0-7)@(1,3,5,7,9,11,13,15,17,19,21,23) -a 0000:d8:00.0 --file-prefix=aaa'

The list of cores is set to the appropriate CPU by checking /sys/class/net/$ifc/device/local_cpulist.

Setup

OS: Ubuntu 22.04 LTS
Compilation as deb package using make deb with modified dh_auto_configure in debian/rules

Full configure params:

 ./configure --build=x86_64-linux-gnu --prefix=/usr --includedir=\${prefix}/include --mandir=\${prefix}/share/man --infodir=\${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=\${prefix}/lib/x86_64-linux-gnu --libexecdir=\${prefix}/lib/x86_64-linux-gnu --disable-maintainer-mode --disable-d
ependency-tracking --with-pcap --with-quic --with-msects --with-dpdk --enable-debug 

I have accidentally triggered a segfault while trying to convert a PCAP file to UniRec format.
This was the command:

$ ipfixprobe -i 'pcap;file=./test1/2023-08-24-out_wan.pcap' -p pstats -p phists -o "unirec;i=f:test1.trapcap:w;p=pstats,phists"
ERROR: trap_ctx_vset_data_fmt: Uninitialized libtrap context or bad parameters.
Segmentation fault (core dumped)

There are two output plugin groups - pstats, phists - but only one output file - test1.trapcap.

Hello,

the current NDP input module only supports timestamps in Hanic firmware format, which is no longer being developed.

Unfortunately, new firmwares for FPGA cards based on the NDK platform (especially NDK-APP-NIC for the metering infrastructure) use a different metadata format, which causes the current software to use invalid timestamps for individual packets and thus flows. The format is also newly flexible and the card can use a different format (from the defined set) even for each individual packet depending on the configuration and firmware application.

The input module should read the DeviceTree on startup. Find and process the "cesnet,ofm,ndp-header-rx" components in it, which contain the "header_id" and name/size/position of the individual metadata items. Then, when reading packets from the NIC, it should use the NDP function to find out for each individual packet what specific header it received and extract the timestamp accordingly.

For backward compatibility reasons, the old fixed format should be used when older firmware (i.e. Hanic) is detected.

Lukas

I see quite a lot of flows with end time before the start time.

ipfixprobe is running as follows

/usr/bin/ipfixprobe -i 'dpdk;p=0;q=1;e=ipfixprobe-eal --lcores (0-7)@(1,3,5,7,9,11,13,15,17,19,21,23) -a 0000:d8:00.0 --file-prefix=11263' -s 'cache;size=20;active=300;inactive=60;split' -p basicplus -p dns -p http -p tls -p quic -p passivedns -o ipfix;host=target-host;port=target-port;id=216;dir=216;

What i get is:

It is all part of the same connection (the IP addresses are the same for all shown flows).

Setup

OS: Ubuntu 22.04 LTS
Compilation as deb package using make deb with modified dh_auto_configure in debian/rules

Full configure params:

 ./configure --build=x86_64-linux-gnu --prefix=/usr --includedir=\${prefix}/include --mandir=\${prefix}/share/man --infodir=\${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=\${prefix}/lib/x86_64-linux-gnu --libexecdir=\${prefix}/lib/x86_64-linux-gnu --disable-maintainer-mode --disable-d
ependency-tracking --with-pcap --with-quic --with-msects --with-dpdk --enable-debug 

Hi all,

It seems while adding the " --with-nemea" build option, this error is thrown across version v4, v4.4, v4.5 and v4.6:
Is something missing or is anyone else seeing this issue?
`
user@user-virtual-machine:~/ipfixprobe-4.6.0$ ./configure --with-pcap --with-nemea
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a race-free mkdir -p... /usr/bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking whether make supports nested variables... (cached) yes
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking how to print strings... printf
checking whether make supports the include directive... yes (GNU style)
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether the compiler supports GNU C... yes
checking whether gcc accepts -g... yes
checking for gcc option to enable C11 features... none needed
checking whether gcc understands -c and -o together... yes
checking dependency style of gcc... gcc3
checking for a sed that does not truncate output... /usr/bin/sed
checking for grep that handles long lines and -e... /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking for fgrep... /usr/bin/grep -F
checking for ld used by gcc... /usr/bin/ld
checking if the linker (/usr/bin/ld) is GNU ld... yes
checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B
checking the name lister (/usr/bin/nm -B) interface... BSD nm
checking whether ln -s works... yes
checking the maximum length of command line arguments... 1572864
checking how to convert x86_64-pc-linux-gnu file names to x86_64-pc-linux-gnu format... func_convert_file_noop
checking how to convert x86_64-pc-linux-gnu file names to toolchain format... func_convert_file_noop
checking for /usr/bin/ld option to reload object files... -r
checking for objdump... objdump
checking how to recognize dependent libraries... pass_all
checking for dlltool... no
checking how to associate runtime and link libraries... printf %s\n
checking for ar... ar
checking for archiver @file support... @
checking for strip... strip
checking for ranlib... ranlib
checking command to parse /usr/bin/nm -B output from gcc object... ok
checking for sysroot... no
checking for a working dd... /usr/bin/dd
checking how to truncate binary pipes... /usr/bin/dd bs=4096 count=1
checking for mt... mt
checking if mt is a manifest tool... no
checking for stdio.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for strings.h... yes
checking for sys/stat.h... yes
checking for sys/types.h... yes
checking for unistd.h... yes
checking for dlfcn.h... yes
checking for objdir... .libs
checking if gcc supports -fno-rtti -fno-exceptions... no
checking for gcc option to produce PIC... -fPIC -DPIC
checking if gcc PIC flag -fPIC -DPIC works... yes
checking if gcc static flag -static works... yes
checking if gcc supports -c -o file.o... yes
checking if gcc supports -c -o file.o... (cached) yes
checking whether the gcc linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes
checking whether -lc should be explicitly linked in... no
checking dynamic linker characteristics... GNU/Linux ld.so
checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... yes
checking whether to build static libraries... yes
checking for g++... g++
checking whether the compiler supports GNU C++... yes
checking whether g++ accepts -g... yes
checking for g++ option to enable C++11 features... none needed
checking dependency style of g++... gcc3
checking how to run the C++ preprocessor... g++ -E
checking for ld used by g++... /usr/bin/ld -m elf_x86_64
checking if the linker (/usr/bin/ld -m elf_x86_64) is GNU ld... yes
checking whether the g++ linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes
checking for g++ option to produce PIC... -fPIC -DPIC
checking if g++ PIC flag -fPIC -DPIC works... yes
checking if g++ static flag -static works... yes
checking if g++ supports -c -o file.o... yes
checking if g++ supports -c -o file.o... (cached) yes
checking whether the g++ linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes
checking dynamic linker characteristics... (cached) GNU/Linux ld.so
checking how to hardcode library paths into programs... immediate
checking how to run the C preprocessor... gcc -E
checking for rpmbuild... no
checking for debuild... no
checking for arpa/inet.h... yes
checking for inttypes.h... (cached) yes
checking for netdb.h... yes
checking for netinet/in.h... yes
checking for stddef.h... yes
checking for stdint.h... (cached) yes
checking for stdlib.h... (cached) yes
checking for string.h... (cached) yes
checking for sys/socket.h... yes
checking for sys/time.h... yes
checking for unistd.h... (cached) yes
checking for _Bool... yes
checking for stdbool.h that conforms to C99... yes
checking for inline... inline
checking for int32_t... yes
checking for int8_t... yes
checking for size_t... yes
checking for ssize_t... yes
checking for uint16_t... yes
checking for uint32_t... yes
checking for uint64_t... yes
checking for uint8_t... yes
checking whether byte ordering is bigendian... no
checking for __atomic_store in -latomic... yes
checking for EVP_PKEY_CTX_new_id in -lcrypto... yes
checking for linux/if_packet.h... yes
checking for net/ethernet.h... yes
checking for net/if.h... yes
checking for ifaddrs.h... yes
checking for struct tpacket3_hdr... yes
checking for pcap.h... yes
checking for pcap_open_live in -lpcap... yes
checking for pkg-config... /usr/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
checking for libtrap... yes
checking for trap2man.sh... /usr/bin/nemea/trap2man.sh
checking for ur_processor.sh... /usr/bin/nemea/ur_processor.sh
checking for unirec... no
checking for unirec in parent directory... checking for unirec/unirec.h... yes
checking for unirec/inline.h... yes
checking for unirec/ipaddr_cpp.h... no
no
checking for unirec/ipaddr.h... yes
checking for unirec/links.h... yes
checking for unirec/ur_time.h... yes
checking for unirec/ur_values.h... yes
checking for ur_create_template in -lunirec... yes
checking for error_at_line... yes
checking for working strtod... yes
checking for gettimeofday... yes
checking for inet_ntoa... yes
checking for memset... yes
checking for socket... yes
checking for strchr... yes
checking for strerror... yes
checking for strncasecmp... yes
checking for strstr... yes
checking for strtol... yes
checking for strtoul... yes
checking for strtoull... yes
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating ipfixprobe.spec
config.status: creating ipfixprobe.bash
config.status: creating input/nfbCInterface/Makefile
config.status: creating init/Makefile
config.status: creating tests/Makefile
config.status: creating tests/functional/Makefile
config.status: creating tests/unit/Makefile
config.status: creating config.h
config.status: executing depfiles commands
config.status: executing libtool commands

ipfixprobe 4.6.0

Configuration Options Summary:

ASM.(32 bit only)......:
Static binary..........:

Documentation............:

UniRec processor.........: /usr/bin/nemea/ur_processor.sh
trap2man.sh..............: /usr/bin/nemea/trap2man.sh
Compilation..............: make (or gmake)
CPPFLAGS...............: -I/usr/local/include -DNDEBUG=1
CFLAGS.................: -Wall -g -O3
CXXFLAGS...............: -Wall -g -O3
LDFLAGS................:
LIBS...................: -L/usr/local/lib -lssl -lcrypto -lrt -ltrap -lpcap -lcrypto
Enforced NEMEA (for copr): no
FlexProbe Data Interface.: no
DPDK Interface...........: no

Installation.............: make install (as root if needed, with 'su' or 'sudo')
prefix.................: /usr/local

user@user-virtual-machine:~/ipfixprobe-4.6.0$ make
/usr/bin/nemea/ur_processor.sh -i ./ -o ./
make all-recursive
make[1]: Entering directory '/home/user/ipfixprobe-4.6.0'
Making all in .
make[2]: Entering directory '/home/user/ipfixprobe-4.6.0'
CXX input/ipfixprobe-benchmark.o
CXX input/ipfixprobe-parser.o
CXX input/ipfixprobe-raw.o
CXX input/ipfixprobe-pcap.o
CXX storage/ipfixprobe-cache.o
CC storage/ipfixprobe-xxhash.o
CXX output/ipfixprobe-ipfix.o
CXX output/ipfixprobe-text.o
CXX output/ipfixprobe-ipfix-basiclist.o
CXX output/ipfixprobe-unirec.o
CC ipfixprobe-fields.o
CXX process/ipfixprobe-http.o
In file included from ./fields.h:5,
from process/http.hpp:55,
from process/http.cpp:54:
process/http.hpp: In member function ‘virtual void ipxp::RecordExtHTTP::fill_unirec(ur_template_t*, void*)’:
process/http.hpp:119:36: error: ‘F_HTTP_REQUEST_METHOD’ was not declared in this scope
119 | ur_set_string(tmplt, record, F_HTTP_REQUEST_METHOD, method);
| ^~~~~~~~~~~~~~~~~~~~~
process/http.hpp:120:36: error: ‘F_HTTP_REQUEST_HOST’ was not declared in this scope
120 | ur_set_string(tmplt, record, F_HTTP_REQUEST_HOST, host);
| ^~~~~~~~~~~~~~~~~~~
process/http.hpp:121:36: error: ‘F_HTTP_REQUEST_URL’ was not declared in this scope; did you mean ‘SIP_REQUEST_URI’?
121 | ur_set_string(tmplt, record, F_HTTP_REQUEST_URL, uri);
| ^~~~~~~~~~~~~~~~~~
process/http.hpp:122:36: error: ‘F_HTTP_REQUEST_AGENT’ was not declared in this scope
122 | ur_set_string(tmplt, record, F_HTTP_REQUEST_AGENT, user_agent);
| ^~~~~~~~~~~~~~~~~~~~
process/http.hpp:123:36: error: ‘F_HTTP_REQUEST_REFERER’ was not declared in this scope
123 | ur_set_string(tmplt, record, F_HTTP_REQUEST_REFERER, referer);
| ^~~~~~~~~~~~~~~~~~~~~~
process/http.hpp:124:36: error: ‘F_HTTP_RESPONSE_CONTENT_TYPE’ was not declared in this scope
124 | ur_set_string(tmplt, record, F_HTTP_RESPONSE_CONTENT_TYPE, content_type);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
process/http.hpp:125:29: error: ‘F_HTTP_RESPONSE_STATUS_CODE_T’ was not declared in this scope
125 | ur_set(tmplt, record, F_HTTP_RESPONSE_STATUS_CODE, code);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
process/http.hpp:125:7: error: expected primary-expression before ‘)’ token
125 | ur_set(tmplt, record, F_HTTP_RESPONSE_STATUS_CODE, code);
| ^~~~~~
process/http.hpp:125:29: error: ‘F_HTTP_RESPONSE_STATUS_CODE’ was not declared in this scope
125 | ur_set(tmplt, record, F_HTTP_RESPONSE_STATUS_CODE, code);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
make[2]: *** [Makefile:1980: process/ipfixprobe-http.o] Error 1
make[2]: Leaving directory '/home/user/ipfixprobe-4.6.0'
make[1]: *** [Makefile:2573: all-recursive] Error 1
make[1]: Leaving directory '/home/user/ipfixprobe-4.6.0'
make: *** [Makefile:927: all] Error 2
`

There is a difference between number of parsed packets and number of output packets. I'd expect these numbers to differ at most by the number of dropped packets, but it is not the case. What is the reason of this difference?

ipfixprobed[11664]: Input stats:                                                            
ipfixprobed[11664]:   #   packets    parsed           bytes   dropped     qtime status      
ipfixprobed[11664]:   0     15879     15879         1484197         0  40003445     ok      
ipfixprobed[11664]: Output stats:                                                           
ipfixprobed[11664]:   #   biflows   packets           bytes   dropped status                
ipfixprobed[11664]:   0      2862     15453         1267570         0     ok  

One cannot run two processes as follows:

/usr/bin/ipfixprobe -i 'dpdk;p=0;q=1;e=ipfixprobe-eal --lcores (0-7)@(0,2,4,6,8,10,12,14,16,18,20,22) -a 0000:3b:00.0'
/usr/bin/ipfixprobe -i 'dpdk;p=0;q=1;e=ipfixprobe-eal --lcores (0-7)@(1,3,5,7,9,11,13,15,17,19,21,23) -a 0000:d8:00.0'

The second process gives this output:

EAL: Detected CPU lcores: 24
EAL: Detected NUMA nodes: 2
EAL: Detected shared linkage of DPDK
EAL: Cannot create lock on '/var/run/dpdk/rte/config'. Is another primary process running?
EAL: FATAL: Cannot init config
EAL: Cannot init config
EAL: Error - exiting with code: 1
  Cause: Cannot initialize RTE_EAL: Success

This problem should be noted in the documentation.

Possible solution

I've enhanced my local ipfixprobed script to include --file-prefix=$$ when setting up DPDK parameters. If there are no other uses for the --file-prefix, maybe the process itself could do it so that the user does not need to concern with this issue? Of course, it needs to be documented in any case.

Setup

OS: Ubuntu 22.04 LTS
Compilation as deb package using make deb with modified dh_auto_configure in debian/rules

Full configure params:

 ./configure --build=x86_64-linux-gnu --prefix=/usr --includedir=\${prefix}/include --mandir=\${prefix}/share/man --infodir=\${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=\${prefix}/lib/x86_64-linux-gnu --libexecdir=\${prefix}/lib/x86_64-linux-gnu --disable-maintainer-mode --disable-d
ependency-tracking --with-pcap --with-quic --with-msects --with-dpdk --enable-debug 

I expect active timeout to always be less then that set limit. It is not the case.

ipfixprobe is running as follows:

/usr/bin/ipfixprobe -i 'dpdk;p=0;q=1;e=ipfixprobe-eal --lcores (0-7)@(1,3,5,7,9,11,13,15,17,19,21,23) -a 0000:d8:00.0 --file-prefix=11263' -s 'cache;size=20;active=300;inactive=60;split' -p basicplus -p dns -p http -p tls -p quic -p passivedns -o ipfix;host=target-host;port=target-port;id=216;dir=216;

I expect all flows to be at most 300 seconds long. However, I get a lot of flows of duration between 300 and 360 seconds (but not more, expect for those mentioned in #122) . Therefore, I guess that when a packet is encountered after active timeout, it is incorrectly added to the flow before the flow is exported. I suggest that the flow is exported first and the new packets becomes the first packet of the new flow.

Setup

OS: Ubuntu 22.04 LTS
Compilation as deb package using make deb with modified dh_auto_configure in debian/rules

Full configure params:

 ./configure --build=x86_64-linux-gnu --prefix=/usr --includedir=\${prefix}/include --mandir=\${prefix}/share/man --infodir=\${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=\${prefix}/lib/x86_64-linux-gnu --libexecdir=\${prefix}/lib/x86_64-linux-gnu --disable-maintainer-mode --disable-d
ependency-tracking --with-pcap --with-quic --with-msects --with-dpdk --enable-debug 

Hello,
I've been trying to send the unirec data to the UDP netflow output and I tried to investigate the code but unfortunately I cannot find the way. Please let me explain the scenario I would like to do:

• I'm having a mirrored traffic on ens192
• I would like to use use multiple plugins from the ipfixprobe project to get the unirec data, let's say http, idpcontent and smtp plugin at once to be able to extract data from the mirrored traffic
• those unirec data should be then send using the ipfix format to IP address of 172.16.10.10

How could I do that? I have tried the following syntax but it does not work:
ipfixprobe -i 'raw;ifc=ens192' -p http -p idpcontent -p smtp -o 'unirec;i=b:,u:http:timeout=WAIT;p=http,(pstats,phists,idpcontent)'
I don't know how to define the output how to send unirec data using ipfix. Could you please help me?

Also, I am seeing a probable bug in the README.md. There's line:

# Capture from a COMBO card using ndp plugin, sends ipfix data to 127.0.0.1:4739 using TCP by default
./ipfixprobe -i 'ndp;dev=/dev/nfb0:0' -i 'ndp;dev=/dev/nfb0:1' -i 'ndp;dev=/dev/nfb0:2'

However there is no definition to send IPFIX data to 127.0.0.1:4739 over the TCP connection so I guess the comment is misleading. Could you please clarify whether am I reading/understanding it wrong?

Thanks a lot,
Michal