How to write IPFIXcol plugins

Writing plugins

There are 3 types of plugins that can be used by IPFIXcol. Collector provides simple API to each of them.

Input plugins

Input plugins pass data to the ipfixcol in a form of the IPFIX packet. The source of data is completely independent and any needed parsing or transformation to the IPFIX packet format is up to the input plugin. Generally we distinguish two kinds of sources - network and file. Together with the data also an information about data source is passed.

Each input plugin must provide these functions:

int input_init(char *params, void **config);

which is called at startup to initialize plugin. conf is used to store plugin configuration (it will be passed to plugin with each call of other functions). It can be any type, IPFIXcol does nothing with it,

int get_packet(void *config, struct input_info** info, char **packet, int *source_status);

that produces new IPFIX packet, stores it into packet and returns its length,

int input_close(void **conf);

to close plugin (free allocated memory etc.).

Intermediate plugins

Intermediate plugins processes IPFIX packets before it is passed to Output Manager and storage plugins. They can read packet and count statistics, modify some fields, drop packets etc.

Each intermediate plugin must provide these functions:

int intermediate_plugin_init(char *params, void *ip_config, uint32_t ip_id, struct ipfix_template_mgr *template_mgr, void **config);

which is called at startup to initialize plugin. conf is used to store plugin configuration (it will be passed to plugin with each call of other functions). It can be any type, IPFIXcol does nothing with it,

int intermediate_plugin_close(void *config);

to close plugin (free allocated memory etc.)

int intermediate_process_message(void *config, void *message);

to process one IPFIX packet. At the end of processing, one of these functions should be called:

int pass_message(void *config, struct ipfix_message *message);

to pass IPFIX packet to another intermediate plugin,

int drop_message(void *config, struct ipfix_message *message);

to drop IPFIX packet.

Storage plugins

These functions specifies a communication interface between ipficol core, namely a data manager handling specific Observation Domain ID, and storage plugins.

Each storage plugin must provide these functions:

int storage_init (char *params, void **config);

which is called at Data Manager's initialization. conf is used to store plugin configuration (it will be passed to plugin with each call of other functions). It can be any type, IPFIXcol does nothing with it,

int store_packet (void *config, const struct ipfix_message *ipfix_msg, const struct ipfix_template_mgr *template_mgr);

which stores IPFIX packet,

int store_now (const void *config);

that should immediately store all buffered packets (flush streams etc.),

int storage_close (void **config);

to close plugin (free allocated memory etc.).

Examples

You can look into dummy plugin of each type. It is typically the simplest implementation of that type of plugin.

Remember, that each plugin must use following definition to declare for which version of IPFIXcol API it was compiled.

/* API version constant */
IPFIXCOL_API_VERSION;

Using plugin

To use plugin, it must be added into IPFIXcol's internal configuration. You can use tool ipfixconf and specify plugin's type, name, thread name and path to shared object (.so) file.

For example:

ipfixconf add -p i -n myPlugin -t myPluginThread -s /path/to/plugin.so

Finally you must configure plugin in startup.xml in appropriate section:

• collectingProcess for input plugin
• intermediatePlugins for intermediate plugin
• exporting process - destination for storage plugin

See default startup configuration for more info.

Back to Top