Fixbuf is used for building IPFIX collecting and exporting processes. It is a compliant implementation of the IPFIX Protocol as defined in the "Specification of the IPFIX Protocol for the Exchange of Flow Information" (RFC 7011). The CERT NetSA Security Suite supports two fixbuf APIs:
- libfixbuf implements the IPFIX Protocol as a C library.
- pyfixbuf implements the IPFIX protocol as a Python library.
Fixbuf's Role in the CERT NetSA Security Suite
libfixbuf is a vital but largely invisible part of the CERT NetSA Security Suite. As a library, it is the foundation upon which the IPFIX-processing tools in the are built.
However, libfixbuf also provides two command-line tools that convert binary IPFIX to text:
- ipfix2json converts IPFIX to JSON. It is new in v3.0.0.
- ipfixDump prints IPFIX as (largely human-readable) text, and can also provide information about an IPFIX file. Its primary use is to assist in debugging other IPFIX tools. It was added in v2.3.0; previously it was bundled with YAF.
Recommended Uses of Fixbuf
The fixbuf APIs are used to write applications, often called mediators, that collect and export IPFIX. Mediators are useful in modifying, filtering, or adding to the contents of a message before forwarding to another IPFIX collection point. They also can convert IPFIX to another format (text, database, JSON, et cetera).
