Skip to content
This repository has been archived by the owner on Nov 27, 2018. It is now read-only.

Commit

Permalink
Update README
Browse files Browse the repository at this point in the history
  • Loading branch information
calmh committed Jul 24, 2013
1 parent 3cc580d commit 4fb6a8a
Showing 1 changed file with 10 additions and 13 deletions.
23 changes: 10 additions & 13 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,10 @@ github.com/calmh/ipfix package.
Installation
------------

Make sure you have Go 1.1 installed. See http://golang.org/doc/install.
Grab a binary release from https://github.com/calmh/ipfixcat/releases.

You can also build from source. Make sure you have Go 1.1 installed. See
http://golang.org/doc/install.

$ go install github.com/calmh/ipfixcat

Expand All @@ -24,34 +27,28 @@ display as `F[vendor,field]` with a byte array as value. A custom
dictionary can be loaded to support vendor fields; see
`procera-fields.ini` included.

Until a template set has been received all datasets will display without
elements (because they can't be interpreted). If the session is over
TCP, template sets should be sent before any data sets. For UDP data,
template sets will be sent periodically.

Examples
--------

Parse a UDP IPFIX stream. Note the empty data sets prior to having
received templates.
Parse a UDP IPFIX stream. Note that it might take a while to start
displaying datasets, because we need to receive the periodically sent
template sets first in order to be able to parse them.

$ socat udp-recv:4739 stdout | ipfixcat
{"elements":null,"exportTime":1374494095,"templateId":49836}
{"elements":null,"exportTime":1374494100,"templateId":49836}
{"elements":{"F[15397.12]":[0,0,0,0],"F[15397.18]":[],"F[15397.1]":[66,105,116,84,111,114,114,101,110,116,32,75,82,...
{"elements":{"F[15397.12]":[0,0,0,0],"F[15397.18]":[],"F[15397.1]":[68,114,111,112,98,111,120,32,76,65,78,32,115,12...
...

Use a custom dictionary to interpret vendor fields.

$ socat udp-recv:4739 stdout | ipfixcat -dict $GOPATH/src/github.com/calmh/ipfixcat/procera-fields.ini
$ socat udp-recv:4739 stdout | ipfixcat -dict procera-fields.ini
{"elements":{"destinationIPv4Address":"172.16.32.15","proceraExternalRtt":47,"proceraIncomingOctets":146,"proeraOut...
{"elements":{"destinationIPv4Address":"172.16.32.15","proceraExternalRtt":3,"proceraIncomingOctets":140,"proceraOut...
{"elements":{"destinationIPv4Address":"172.16.32.15","proceraExternalRtt":4,"proceraIncomingOctets":642,"proceraOut...
...

Don't attempt to use netcat (`nc`). Almost all distributed versions are
broken and truncate UDP packets at 1024 bytes.
Don't attempt to use netcat (`nc`) for reading UDP streams. Almost all
distributed versions are broken and truncate UDP packets at 1024 bytes.

License
-------
Expand Down

0 comments on commit 4fb6a8a

Please sign in to comment.