IPFIX

Synopsis

Creates an IPFIX collector that accepts flow data over UDP connections. Supports high-volume collection with multiple worker processes. Also handles NetFlow v9 templates.

For details, see Appendix.

Schema

- id: <numeric>
  name: <string>
  description: <string>
  type: ipfix
  tags: <string[]>
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    address: <string>
    port: <numeric>
    workers: <numeric>
    reuse: <boolean>

Configuration

The following fields are used to define the device:

Device

Field	Required	Default	Description
`id`	Y		Unique identifier
`name`	Y		Device name
`description`	N	-	Optional description
`type`	Y		Must be `ipfix`
`tags`	N	-	Optional tags
`pipelines`	N	-	Optional pre-processor pipelines
`status`	N	`true`	Enable/disable the device

Connection

Field	Required	Default	Description
`address`	N	`"0.0.0.0"`	Listen address
`port`	N	`4739`	Listen port
`workers`	N	CPU count	Number of worker goroutines
`reuse`	N	`false`	Enable socket address reuse

Details

NetFlow, sFlow, and IPFIX devices share a common flow collection backend (backend/module/listener/flow/). The thin per-protocol controller sets the flow type and default port.

When reuse is enabled, the collector automatically scales to use multiple workers based on available CPU cores. Each worker maintains its own UDP listener, processes flows independently, and writes to a dedicated queue file.

The collector supports template management for NetFlow v9 and IPFIX, application identification, port-based protocol mapping, flow state tracking, and statistical aggregation.

Examples

The following are commonly used configuration types.

Basic

Creating a simple IPFIX collector on the default port...

devices:
  - id: 1
    name: basic_ipfix
    type: ipfix
    properties:
      port: 4739

High-Volume

Optimizing for high flow volumes using multiple workers...

devices:
  - id: 2
    name: performant_ipfix
    type: ipfix
    properties:
      address: "0.0.0.0"
      port: 4739
      reuse: true
      workers: 4

note

When reuse is enabled, the collector automatically scales up to use all available CPU cores.

Application Protocols

The collector supports application-based identification, TCP port mapping, and UDP port mapping. The definition files for these respectively are placed in three locations under <vm_root>:

/user/definitions/app-definitions-{device-id}.csv (device-specific)
/user/definitions/app-definitions.csv (user-defined)
/package/definitions/app-definitions.csv (system defaults)
/user/definitions/tcp-definitions-{device-id}.csv (device-specific)
/user/definitions/tcp-definitions.csv (user-defined)
/package/definitions/tcp-definitions.csv (system defaults)
/user/definitions/udp-definitions-{device-id}.csv (device-specific)
/user/definitions/udp-definitions.csv (user-defined)
/package/definitions/udp-definitions.csv (system defaults):::warning

Definition files must be in CSV format with exactly two columns per row. :::

The contents of these files are:

app-definitions.csv:

SSH,Secure Shell
RDP,Remote Desktop
HTTP,Web Browsing
HTTPS,Secure Web

tcp-definitions.csv:

22,SSH
3389,RDP
80,HTTP
443,HTTPS

udp-definitions.csv:

53,DNS
67,DHCP
123,NTP
161,SNMP

note

The collector will fall back on the system defaults if the custom definition files are not found.

IPFIX collector with application identification enabled...

devices:
  - id: 3
    name: app_aware_ipfix
    type: ipfix
    properties:
      port: 4739
      reuse: true

Synopsis​

Schema​

Configuration​

Device​

Connection​

Details​

Examples​

Basic​

High-Volume​

Application Protocols​