ipfix_node

Ipfix deserializer in Node.js.

This module is still in development mode.

Its purpose is to deserialize ipfix NetFlows exported from software like "softflowd", and return them as entity data.

Installation

npm install ipfix_node

Usage

var IpfixDeserializer = require('ipfix_node')();

IpfixDeserializer.deserialize(data)
    .then(function(deserializedData) {
        // Do something with deserialized data (JSON format)
    })
    .catch(function(err) {
        // Catch errors ...
    });

"data" parameter is the Buffer data collected from a netflow exporting software.

The library is using internal Maps for storing Template Records and Option Template Records. Take a look at the options below to disable the internal storage so you can use your own storing mechanism.

Options

useInternalStorage

Should the library not use the default internal storage strategy then set this to false. Default: true.

When setting this field to false you must provide a function via templateProvider option.

If you dont want to switch to your own storage strategy then you can access the internal storage at any time by using the Storage property.

var IpfixDeserializer = require('ipfix_node')();
var storage = IpfixDeserializer.Storage;

templateProvider

Callback function to provide the decoder with the required template which is needed to deserialize the Data Record portion found inside the binary buffer. Used together with useInternalStorage:false option.

You should always return the templates inside this function in the same format they are given to you in the onNewTemplate callback function.

Function arguments: templateId (the id of the template which is needed by the deserializer)

onNewTemplate

Callback function which gets called whenever there are new Templates (Template Records/Option Template Records) found in the binary buffer.

!!! Its important that you define a custom callback function for this option and store the new templates found if you are using useInternalStorage:false option, since they are going to be needed in the following flow exports for deserializing the DataRecords and the deserializer will expect you to provide them inside templateProvider callback.

Function arguments: template, templateType

• template format :

{
  "templateId": 1024,
  "numberFields": 16,
  "setId": 2,
  "sizeInBytes": 72,
  "FieldSpecifiers": 
   [ 
     { "fieldId": 8, "fieldLength": 4 },
     { "fieldId": 12, "fieldLength": 4 },
     { "fieldId": 1, "fieldLength": 4 },
     { "fieldId": 2, "fieldLength": 4 },
     { "fieldId": 10, "fieldLength": 4 },
     { "fieldId": 14, "fieldLength": 4 },
     { "fieldId": 7, "fieldLength": 2 },
     { "fieldId": 11, "fieldLength": 2 },
     { "fieldId": 4, "fieldLength": 1 },
     { "fieldId": 6, "fieldLength": 1 },
     { "fieldId": 60, "fieldLength": 1 },
     { "fieldId": 5, "fieldLength": 1 },
     { "fieldId": 32, "fieldLength": 2 },
     { "fieldId": 58, "fieldLength": 2 },
     { "fieldId": 22, "fieldLength": 4 },
     { "fieldId": 21, "fieldLength": 4 } 
  ]
}

• templateType (string) can be "DataTemplate" or "OptionsTemplate" so you can

parseDataValues

Boolean option which tells the deserializer whether it should detect and parse values inside Data Records automatically or it should return raw UINT data instead.

Default: true