config.conf

[DEFAULT]
fbitdump_bin    = /usr/local/bin/fbitdump
fbitdump_config = /home/hendriksl/fbitdump.xml
fbitdump_data   = /mnt/data/fbit_ipfix/4/%%Y/%%m/%%d/ic%%Y%%m%%d%%H%%M00 
query_output = fmt:%%pkt:%%byt:%%fl
plot_width = 300


[all]
query_filter = 

[tcp]
query_filter = %%proto tcp

[udp]
query_filter = %%proto udp

[icmp6]
query_filter = %%proto IPv6-ICMP

[frag6]
query_filter = %%proto IPv6-FRAG

[ehCnt1]
query_filter = %%v6ehCnt 1

[ehCnt1NotEsp]
query_filter = %%v6ehCnt > 0 and not %%v6ehUpperProto IPSEC-ESP

[ehCntMany]
query_filter = %%v6ehCnt > 1

[upperTcp]
query_filter = %%v6ehCnt > 0 and %%v6ehUpperProto TCP

[upperUdp]
query_filter = %%v6ehCnt > 0 and %%v6ehUpperProto UDP

[upperIcmp6]
query_filter = %%v6ehCnt > 0 and %%v6ehUpperProto IPv6-ICMP

[upperIpsecEsp]
query_filter = %%v6ehCnt > 0 and %%v6ehUpperProto IPSEC-ESP

[synOnly]
query_filter = %%proto TCP and %%flg 0x2

[synOnlyEh]
query_filter = %%v6ehCnt > 0 and %%v6ehUpperProto TCP and %%flg 0x2

[teredo]
query_filter = %%proto UDP and %%port 3544 and not %%port 53

[noNxt]
query_filter = %%proto IPv6-NoNxt

[smb]
query_filter = %%proto TCP and %%port 445

[ptb]
query_filter = %%icmptype 512

[ehPtb]
query_filter = %%icmptype 512 and %%v6ehCnt > 0

[dstUn]
query_filter = %%icmptype 256

[ehDstUn]
query_filter = %%icmptype 256 and %%v6ehCnt > 0

[icmpProb]
query_filter = %%icmptype <= 1024

[ehIcmpProb]
query_filter = %%icmptype <= 1024 and %%v6ehCnt > 0

[tlsHS3]
query_filter = %%tlsHS > 3000

[tlsHS6]
query_filter = %%tlsHS > 6000

[fragDNS]
query_filter = %%proto IPv6-FRAG and %%v6ehUpperProto UDP and (%%v6ehUpperDport 53 or %%v6ehUpperSport 53)