Packages

package ipfix

The ipfix package provides classes and objects for reading and writing IPFIX data.

Class / Object Overview

(For a quick overview of the IPFIX format, see the end of this description.)

The Message trait describes the attributes of an IPFIX message, and the CollectedMessage class and object are implementations of that trait when reading data. (Record export does not create specific Message instance.)

The IpfixSet abstract class and object hold the attributes of a Set. The TemplateSet class may represent a Template Set or an Options Template Set.

The Template class and object are used to represent a Template Record or an Options Template Record.

The IEFieldSpecifier class and object represent a Field Specifier within an existing Template. To search for a field within a Template, the user of the ipfix package creates a FieldSpec (the companion object) and attempts to find it within a Template.

The Field Specifier uses the numeric Identifier to identify an Information Element, and an Element is represented by the InfoElement class and object. The InfoModel class and object represent the Information Model.

To describe the attributes of an InfoElement, several support classes are defined: DataTypes is an enumeration that describes the type of data that the element contains, and DataType is a class that extracts a Field Value with that DataType. IESemantics describes the data semantics of an Information Element (e.g., a counter, an identifier, a set of flags), and IEUnits describes its units.

The Data Set is represented by the RecordSet class and object.

A Data Record is represented by the Record abstract class. This class has three subclasses:

  1. The CollectedRecord class and object are its implementation when reading data. Its members are always referenced by numeric position.
  2. The ArrayRecord (I do not like this name) and object may be used to build a Record from Scala objects; its fields are also referenced by numeric position.
  3. ExportRecord is an abstract class that also supports building a Record from Scala objects. The user extends the class and uses the IPFIXExtract annotation to mark the members of the subclass that are to be used when writing the Record.

A user-defined class that extends Fillable trait may use the Record's fill() method to copy fields from a Record to the user's class. It also uses the IPFIXExtract annotation.

A Structured Data Field Value in a Data Record is represented by the ListElement abstract class. That abstract class has three abstract subclasses, and each of those has two concrete subclasses (one for reading and one for writing):

  1. The BasicList abstract class (object) has subclasses CollectedBasicList and ExportBasicList.
  2. The SubTemplateList abstract class (object) has subclasses CollectedSubTemplateList and ExportSubTemplateList.
  3. The SubTemplateMultiList abstract class (object) has subclasses CollectedSubTemplateMultiList and ExportSubTemplateMultiList.

Reading data

When reading data, a Record instance is returned by a RecordReader. The RecordReader uses a class that extends the MessageReader trait. The ipfix package includes two: ByteBufferMessageReader and StreamMessageReader.

A Session value represent an IPFIX session, which is part of a SessionGroup.

Writing data

For writing data, an instance of an ExportStream must be created using a Session and the destination FileChannel. The user adds Records or Templates to the ExportStream and they are written to the FileChannel.

Overview of IPFIX

An IPFIX stream is composed of Messages. Each Message has a 16-byte Message Header followed by one or more Sets. There are three types of Sets: A Data Set, a Template Set, and an Options Template Set.

Each Set has a 4-byte set header followed by one or more Records. A Data Set contains Data Records and a Template Set contains Template Records.

A Template Record describes the shape of the data that appears in a Data Record. A Template Record contains a 4-byte header followed by zero or more Field Specifiers. Each Field Specifier is either a 4-byte or an 8-byte value that describes a field in the Data Record.

A Field Specifier has two parts. The first is the numeric Information Element Identifier that is defined in an Information Model. The second is the number of octets the field occupies in the Data Record.

A Data Set contains one or more Data Records of the same type, where the type is determined by the Template Record that the Data Set Header refers to. Each Data Record contains one or more Field Values, where the order and length of the Field Values is given by the Template.

A Field Value in a Data Record may be a Structured Data. There are three types of Structured Data:

  1. A Basic List contains one or more instances of a Single Information Element.
  2. A SubTemplateList references a single Template ID, and it contains one or more Records that match that Template.
  3. The SubTemplateMultiList contains a series of Template IDs and Records that match that Template ID.

An IPFIX stream exists in a Transport Session, where a Transport Session is part of a Session Group. All Sessions in a Session Group use the same Transport Protocol, and only differ in the numeric Observation Domain that is part of the Message Header.

Linear Supertypes
AnyRef, Any
Ordering
  1. Alphabetic
  2. By Inheritance
Inherited
  1. ipfix
  2. AnyRef
  3. Any
  1. Hide All
  2. Show All
Visibility
  1. Public
  2. Protected

Package Members

  1. package datatype
  2. package testing
  3. package util

Type Members

  1. class ArrayRecord extends Record

    An ArrayRecord represents the data for an individual Record that is being built from instances of objects.

    An ArrayRecord represents the data for an individual Record that is being built from instances of objects. In the ArrayRecord class, fields are always accessed by position, where field i represents the data for InfoElement i in the Template.

    The ExportRecord class is similar to this class, except ExportRecord is abstract and allows the subclass to reference information elements by name.

    When creating a record from a buffer containing serialzed data, the CollectedRecord class should be used.

    An ArrayRecord is created from a Template. The value for each information element in the Record is initially set to its default value (0 for values and null for references). The update() method is used set the values.

    Example:

    1. val template = Template.newTemplate(Seq(
  IEFieldSpecifier(model, "sourceIPv4Address", 4),
  IEFieldSpecifier(model, "flowStartTimeMilliseconds", 8),
  IEFieldSpecifier(model, "packetTotalCount", 8)), session)
val rec = ArrayRecord(template)
rec(0) = org.cert.netsa.data.net.IPv4Address("10.1.2.3")
rec(1) = java.time.Instant.now()
rec(2) = 365
    See also

    The companion object for more details.

  2. sealed abstract class BasicList extends ListElement

    A class to represent the contents of an IPFIX BasicList structured data.

    A class to represent the contents of an IPFIX BasicList structured data.

    A BasicList contains a zero or more instances of a single IPFIX Information Element.

    Use the CollectedBasicList subclass when reading a BasicList, and the ExportBasicList subclass when generating a BasicList for writing.

    The companion object has factory methods that return a CollectedBasicList instance when reading a BasicList or a ExportBasicList instance when generating a BasicList for writing.

  3. final class BasicListFieldExtractor extends FieldExtractor[BasicList]

    Extracts a BasicList from a Record.

    Extracts a BasicList from a Record.

    Maintains a mapping from Template to field position to improve performance when extracting a BasicList from multiple Records that share the same Template.

  4. final case class ByteBufferMessageReader(buffer: ByteBuffer, sessionGroup: SessionGroup) extends MessageReader with Product with Serializable

    A ByteBufferMessageReader is used to get the next Message from a byte buffer.

    A ByteBufferMessageReader is used to get the next Message from a byte buffer.

    buffer

    The ByteBuffer to interpret as IPFIX messages.

    sessionGroup

    The SessionGroup that holds the InfoModel used to interpret data in the buffer.

  5. final class CollectedBasicList extends BasicList

    The CollectedBasicList class is used when reading a BasicList from a data stream.

    The CollectedBasicList class is used when reading a BasicList from a data stream. The class delays realizing the elements of this until they are requested.

    Use the methods in the BasicList companion object to create a CollectedBasicList instance.

    See also

    The BasicList companion object for a factory method.

  6. final class CollectedMessage extends Message with Iterable[IpfixSet]

    The CollectedMessage class interprets a ByteBuffer to provide an Iterator over the IpfixSets in the buffer.

    The CollectedMessage class interprets a ByteBuffer to provide an Iterator over the IpfixSets in the buffer.

    See also

    The companion object for more details

  7. final class CollectedRecord extends Record

    A CollectedRecord represents the data for an individual Record that has been created when a Template interprets a ByteBuffer.

    A CollectedRecord represents the data for an individual Record that has been created when a Template interprets a ByteBuffer.

    To create a Record from existing objects, use the ArrayRecord class or extend the ExportRecord abstract class.

    See also

    The companion object for more details

  8. final class CollectedSubTemplateList extends SubTemplateList

    The CollectedSubTemplateList class is used when reading a SubTemplateList from a data stream.

    The CollectedSubTemplateList class is used when reading a SubTemplateList from a data stream. The class delays realizing the elements of this until they are requested.

    Use the methods in the SubTemplateList companion object to create a CollectedSubTemplateList instance.

    See also

    The SubTemplateList companion object for a factory method.

  9. final class CollectedSubTemplateMultiList extends SubTemplateMultiList

    The CollectedSubTemplateMultiList class is used when reading a SubTemplateMultiList from a data stream.

    The CollectedSubTemplateMultiList class is used when reading a SubTemplateMultiList from a data stream. The class delays realizing the elements of this until they are requested.

    Use the methods in the SubTemplateMultiList companion object to create a CollectedSubTemplateMultiList instance.

    See also

    The SubTemplateMultiList companion object for a factory method.

  10. trait DataType extends AnyRef

    The DataType trait defines members that must exist on classes that provide an implementation of each possible DataTypes value, where those values represent an IPFIX Information Element Data Types as defined in RFC5102.

  11. sealed abstract class DataTypes extends ShortEnumEntry

    IPFIX Information Element Data Types as defined in RFC5102

    IPFIX Information Element Data Types as defined in RFC5102

    See also

    The companion object for a complete description and the list of values.

  12. final class DatagramSession extends Session with StrictLogging

    There are two types of Sessions: StreamSession and DatagramSession.

    There are two types of Sessions: StreamSession and DatagramSession.

    A DatagramSession implements template instantiation and template withdrawal handling as dictated by section 8.4 of RFC 7011.

    A DatagramSession is created by a SessionGroup with the streamSemantics parameter set to false.

  13. final case class DeepFieldExtractor[T] extends FieldExtractor[T] with Product with Serializable

    Extracts the specified field from a Record or a Sub-Record and casts the field to a type.

    Extracts the specified field from a Record or a Sub-Record and casts the field to a type.

    A simple string returns the named IE in the top-level record:

    val protoEx = DeepFieldExtractor[Short]("protocolIdentifier") val proto = protoEx.extractFrom(r.get) proto: Option[Short] = Some(6)

    One or more template names may preceed the named IE. Separate the sequence of template names and the IE by DeepFieldExtractor$.delim.

    val initialTcpEx = DeepFieldExtractor[Short]("yaf_tcp_rev/initialTCPFlags") val initialTcp = initialTcpEx.extractFrom(r.get) initialTcp: Option[Short] = Some(2)

    Prepend the DeepFieldExtractor$.deepPrefix to either a lone IE name or a template name and IE sequence to start searching for the path at any depth within the Record.

    val unionTcpEx = DeepFieldExtractor[Short]("* /unionTCPFlags") val unionTcp = unionTcpEx.extractFrom(r.get) unionTcp: Option[Short] = Some(28)

    To get a BasicList containing a specific IE from a Record, wrap the IE's name ieName as "basicList[ieName]" (see DeepFieldExtractor$.wrapAsBasicList). For these, the type parameter T should always be BasicList.

    val agentEx = DeepFieldExtractor[BasicList]("* /basicList[httpUserAgent]") val agent = agentEx.extractFrom(r.get) agent: Option[org.cert.netsa.io.ipfix.BasicList] = Some((BL ...))

    Use the BasicList's elements method to get the contents of the BasicList:

    val v = Vector.empty[String] ++ agent.get.elements

    Maintains a mapping from Template to field position to improve performance when extracting a field from multiple Records that share the same Template.

    T

    The type to cast the field to.

    See also

    SimpleFieldExtractor for a simplified version

  14. class EndOfFileException extends IPFIXException

    Signals that the end of file has been reached.

  15. class ExportBasicList extends BasicList

    The ExportBasicList class is used to incrementally build a BasicList and export it to a stream.

    The ExportBasicList class is used to incrementally build a BasicList and export it to a stream.

    Use the methods in the BasicList companion object to create an ExportBasicList instance.

    See also

    The BasicList companion object for factory methods.

  16. abstract class ExportRecord extends Record

    An ExportRecord represents the data for an individual Record that is being built from instances of objects.

    An ExportRecord represents the data for an individual Record that is being built from instances of objects. The ExportRecord class supports subclasses that use class members to represent the values for the information elements of a Template.

    When creating a record from a buffer containing serialzed data, the CollectedRecord class is used.

    The ArrayRecord class is similar this class, except ArrayRecord is concrete and fields are always accessed by numeric position. The ExportRecord class allows the caller to reference members by name or by position; the class may have default values for elements. The ExportRecord class forces the caller to provide a class member for each element in the Template whereas the elements of ArrayRecord are represented by an Array[Any].

    Example:

    1. The caller extends this class, adds members that represent the elements in the class, annotates those members with the IPFIXExtract class, and defines a corresponding template. The caller may then instantiate the class and reference members by name.

      class MyRec(template: Template) extends ExportRecord(template) {
  @IPFIXExtract(name = "sourceIPv4Address")
  var sip = org.cert.netsa.data.net.IPv4Address("0.0.0.0")
  @IPFIXExtract(name = "flowStartTimeMilliseconds")
  var stime = java.time.Instant.EPOCH
  @IPFIXExtract(name = "packetTotalCount")
  var packets: Long = 0L
  // may add other members
}
val template = Template(Seq(
  IEFieldSpecifier(model, "sourceIPv4Address", 4),
  IEFieldSpecifier(model, "flowStartTimeMilliseconds", 8),
  IEFieldSpecifier(model, "packetTotalCount", 8)))
val rec = new MyRec(template)
rec.sip = org.cert.netsa.data.net.IPv4Address("10.1.2.3")
rec.stime = java.time.Instant.now()
rec.packets = 365
  17. class ExportStream extends AnyRef

    ExportStream supports writing IPFIX templates and records to a file.

    ExportStream supports writing IPFIX templates and records to a file.

    The caller creates an ExportStream instance with an output channel and an associated Session. The caller may then add Templates or Records to the ExportStream, and the ExportStream writes the IPFIX data to the output file.

    Since the Session is part of the ExportStream's constructor, all IPFIX Messages in the stream use the same observation domain.

    By default, each exported IPFIX Message uses the current time as its timestamp. Set the makeTimestamp variable to change this behavior.

    By default, an ExportStream adds an options record to describe each Information Element that is not part of the standard information model, and ExportStream ignores any such options records in the input stream. Set the describeElements variable to false to change this behavor, and use elementDescriptionTID to view or set the template ID used by these records.

    By default, an ExportStream adds an options record to describe each Template it exports, and ExportStream ignores any such options records in the input stream. Set the describeTemplates variable to false to change this behavor, and use templateDescriptionTID to view or set the template ID used by these records.

    NOTE: When copying data from an IPFIX input stream, ExportStream may change the order in which templates and records appear---specifically, templates that appear after a record in the input may be written before that record. ExportStream is aware of the Meta-Data Options templates and records that describe Information Elements and Templates, and, when ExportStream is not creating and exporting those items itself, those templates and records are copied from the input and written to the output in the required order. The user may call flush() to ensure some items appear in the output before others. The authors of this package may need to consider providing some way for the users to know when to call flush(), such as adding a callback methods to be invoked when a new IpfixSet is read.

  18. class ExportStreamTemplatesFirst extends ExportStream

    ExportStreamTemplatesFirst extends the ExportStream class to ensure that Templates occur in the output stream before Records.

    ExportStreamTemplatesFirst extends the ExportStream class to ensure that Templates occur in the output stream before Records.

    Instances of this class only produce output when the close() method is called.

    Note: When template metadata or information element metadata is being written to the stream, those records may appear before some templates.

  19. final class ExportSubTemplateList extends SubTemplateList

    The ExportSubTemplateList class is used to incrementally build a SubTemplateList and export it to a stream.

    The ExportSubTemplateList class is used to incrementally build a SubTemplateList and export it to a stream.

    Use the methods in the SubTemplateList companion object to create an ExportSubTemplateList instance.

    See also

    The SubTemplateList companion object for factory methods.

  20. final class ExportSubTemplateMultiList extends SubTemplateMultiList

    The ExportSubTemplateMultiList class is used to incrementally build a SubTemplateMultiList and export it to a stream.

    The ExportSubTemplateMultiList class is used to incrementally build a SubTemplateMultiList and export it to a stream.

    Use the methods in the SubTemplateMultiList companion object to create an ExportSubTemplateMultiList instance.

    See also

    The SubTemplateMultiList companion object for factory methods.

  21. final case class Field(ie: InfoElement, value: Any, length: Int, position: Int) extends Product with Serializable

    A Field represents the value of an InfoElement in a Record as determined by the Record's Template.

    A Field represents the value of an InfoElement in a Record as determined by the Record's Template.

    ie

    The information element that describes this field,

    value

    The value of the field within a Record.

    length

    The length of the field as described by the IEFieldSpecifier that was used to contruct the Record's Template.

    position

    The position of this field within the Record, where 0 indicates the first field, 1 the second field, etc.

  22. trait FieldExtractor[T] extends AnyRef

    A FieldExtractor may be used to extract data from a Record.

    A FieldExtractor may be used to extract data from a Record. It may be used directly via the extractFrom method, or more commonly may be used as an operand to a Record, like rec(fieldExtractor).

    Extractors are meant to be more than a simple index into a record. Rather, they can retrieve any data based on a record, based on that record's template and values. Common uses of extractors are to extract data from a particular field regardless of the actual template being used, or to generate a computed value based on fields in a record, such as returning a string value for a field that is encoded as an integer.

    The type parameter T is a convenience feature. Implementations of FieldExtractor normally have to use rec(i) under the hood, which returns Any. As such, a cast will be made at some point, and a ClassCastException may be thrown if care is not taken. It is suggested that implementers of objects that implement FieldExtractor should include a constructor that takes the class type as an argument, and do type checking based on the record field type in order to throw an error during extractor construction rather than during use.

    T

    the type the extractor should return

    See also

    Record

  23. final class FieldSpec extends AnyRef

    A FieldSpec is used to locate an InfoElement within an existing Template.

    A FieldSpec is used to locate an InfoElement within an existing Template.

    See also

    The companion object for more details

    IEFieldSpecifier if you are attempting to include an Information Element in new a Template.

  24. trait Fillable extends AnyRef

    A class which mixes in the Fillable trait may be used as a target of a Record's fill() method.

    A class which mixes in the Fillable trait may be used as a target of a Record's fill() method.

    A class which mixes in Fillable must use the IPFIXExtract annotation to mark the variables that it wishes to be filled with the information element values from a Record. If a variable is marked but the corresponding element is not present in the record from which the object is being filled, the variables's value is left unchanged.

    The IPFIXExtract annotation defines two values that are used to create a FieldSpec that is used to specify which element in the Record is to used to fill the annotated variable. The two values are:

    • name is a String and must be specified: it is the name of the information element to use.
    • nth is an int that is optional: it specifies which name element to choose when multiple name elements are present on the record; the first name field is chosen when nth is not specified.

    It is important that the types of the variables in the Fillable object match the IPFIX data types of the referenced IPFIX fields. If they do not, a java.lang.ClassCastException will be thrown when the record is filled. See Record for a mapping from IPFIX data type to Java data type.

    Example:

    1. Here is a class whose sport and dport variables can be filled by a record's sourceTransportPort and destinationTransportPort elements:

      class Ports extends Fillable {
  @IPFIXExtract(name="sourceTransportPort")
  var sport: Int = _

  @IPFIXExtract(name="destinationTransportPort")
  var dport: Int = _
}
    See also

    IPFIXExtract

    Record

  25. final case class IEFieldSpecifier extends Product with Serializable

    A single IPFIX Information Element specification for inclusion of an Information Element when constructing a Template.

    A single IPFIX Information Element specification for inclusion of an Information Element when constructing a Template.

    Exceptions thrown

    IllegalFieldSpecifierException if length is negative or larger than VARLEN.

    See also

    The companion object for more details

    FieldSpec if you are attempting to locate an Information Element within an existing Template.

  26. sealed abstract class IESemantics extends ShortEnumEntry

    IPFIX Information Element Semantics as defined in RFC5610

    IPFIX Information Element Semantics as defined in RFC5610

    See also

    The companion object for a complete description and the list of values.

  27. sealed abstract class IEUnits extends ShortEnumEntry

    IPFIX Information Element Units as defined in RFC5610

    IPFIX Information Element Units as defined in RFC5610

    See also

    The companion object for a complete description and the list of values.

  28. abstract class IPFIXException extends Exception

    Signals that an exception has occurred during IPFIX processing.

  29. trait IPFIXExtract extends Annotation
    Annotations
    @Retention() @Target() @Inherited() @Documented()
  30. final case class IPFIXRuntimeException(message: String) extends RuntimeException with Product with Serializable
  31. final case class Identifier(elementId: Int, enterpriseId: Long = 0L) extends Ordered[Identifier] with Product with Serializable

    An Information Element Identifier provides a way to identify an Information Element of an Information Model.

    An Information Element Identifier provides a way to identify an Information Element of an Information Model. The Identifier is also used when creating a Field Specifier.

    An Identifier consists of two numbers: an Element ID and an optional Private Enterprise Number (PEN). An absent PEN is represented as a zero value. The valid range of the Element ID is 1 to 32767 (0x7fff) inclusive. The valid range of Enterprise ID is 1 to 4294967295 (0xffffffff).

    elementId

    The numeric identifier for the element.

    enterpriseId

    The PEN for the element.

    Exceptions thrown

    IllegalInfoElementAttributeException when both the elementId and enterpriseId are 0, when the elementId is negative or larger than 32767 (0x7fff), or when the enterpriseId is not representable as an unsigned 32-bit number.

  32. class IllegalBasicListException extends IllegalListException

    Signals that there are too few bytes for a BasicList or that the specifier in the list is invalid.

  33. class IllegalFieldSpecifierException extends IPFIXException
  34. class IllegalInfoElementAttributeException extends IPFIXException

    Signals that an attribute of an information element is invalid.

  35. class IllegalListException extends IPFIXException

    Signals an error processing a ListElement.

    Signals an error processing a ListElement. A parent class for more-specific list exceptions.

  36. class IllegalSetException extends IPFIXException

    Signals that an IpfixSet ID is invalid.

  37. class IllegalSubTemplateListException extends IllegalListException

    Signals that there are not enough bytes for the SubTemplateList or that the Template ID for the list is not available.

  38. class IllegalSubTemplateMultiListException extends IllegalListException

    Signals that there are not enough bytes for the SubTemplateMultiList or that a length specified within the list is too short.

  39. class IllegalTemplateRecordException extends IPFIXException

    Signals that a Template record is invalid.

  40. final case class InfoElement extends Product with Serializable

    Information in messages of the IPFIX protocol is modeled in terms of Information Elements of the IPFIX information model.

    Information in messages of the IPFIX protocol is modeled in terms of Information Elements of the IPFIX information model. The InfoElement class represents a single Information Element.

    Typically an InfoElement is created either by parsing an XML file that describes a set of Information Elements or by using the InfoElementBuilder class.

    Exceptions thrown

    InvalidInfoElementException if name's length is 0, if rangeMin is greater than rangeMax, or if the elementId and enterpriseId of the ident are both 0.

    See also

    The companion object for more details

  41. final class InfoElementBuilder extends AnyRef

    The InfoElementBuilder class is used to create new InfoElements.

    The InfoElementBuilder class is used to create new InfoElements.

    An empty builder may be created, or a builder may be created based on an existing InfoElement.

  42. final class InfoElementMetadata extends Fillable

    Extracts Information Element metadata from a Record.

    Extracts Information Element metadata from a Record.

    The extracted data fully describes an Information Element. The RecordReader uses that information to add the Information Element to the Information Model.

  43. final class InfoModel extends Serializable with LazyLogging

    The InfoModel class represents the IPFIX Information Model.

    The InfoModel class represents the IPFIX Information Model.

    The Information Model contains Information Elmenets.

    To use the standard IPFIX Information Model, the caller invokes the getStandardInfoModel() method on the companion object. If necessary, that function reads the standard model from an XML file. The caller is given an empty model that inherits from the standard model. This allows the caller to manipulate the information model without invalidating the standard model or disrupting other threads.

    See also

    The companion object for more details.

  44. final class InputStreamSession extends Callable[Option[Record]]

    An InputStreamSession takes a readable channel, a file path, or an input stream, creates a StreamMessageReader to read Messages from the stream, creates a RecordReader to parse the messages into Records, and wraps the RecordReader's call() method.

  45. class InvalidIPFIXMessageException extends IPFIXException

    Signals that an exception has occurred during IPFIX processing.

  46. class InvalidInfoElementException extends IPFIXException

    Signals that an information element is invalid.

  47. sealed abstract class IpfixSet extends AnyRef

    The IpfixSet class represents an IPFIX Set.

    The IpfixSet class represents an IPFIX Set. (The name is "IpfixSet" to avoid conflicts with the standard Scala Set).

    A Set is a generic term for a collection of records that have a similar structure. A Set consists of a 4-byte Set Header and one or more records.

    There are three types of Sets: (1)Data Sets contain IPFIX flow records and are represented by the RecordSet class. (2)Template Sets and (3)Option Template Sets contain templates (or schemas) that describe the representation of the data in Data Sets. They are represented by the TemplateSet class.

    To create a Set from IPFIX data stored in a ByteBuffer that was read as part of message, use

    val set = IpfixSet.fromBuffer(buffer, message)
    Since

    1.3.1 This class was previously called Set.

    See also

    The companion object for more details

  48. abstract class ListElement extends AnyRef

    An abstract class that represents an element in a Record that is a structured data; i.e., a BasicList, a SubTemplateList, or a SubTemplateMultiList.

  49. sealed abstract class ListSemantics extends ShortEnumEntry

    IPFIX Structured Data (List) Type Semantics as defined in RFC6313

    IPFIX Structured Data (List) Type Semantics as defined in RFC6313

    See also

    The companion object for a complete description and the list of values.

  50. trait Message extends AnyRef

    An IPFIX stream consists of Messages, which contain Sets (represented by the IpfixSet class).

    An IPFIX stream consists of Messages, which contain Sets (represented by the IpfixSet class). The Message trait exposes data that applies to all Sets and Records within that Message.

    A message is collected as part of a Session.

  51. trait MessageReader extends Iterator[CollectedMessage]

    An iterator over incoming Messages that includes additional members needed to interpret the Messages.

  52. class MessageTooLongException extends IPFIXException

    Signals an attempt to put more octets into a Message than the IPFIX protocol allows.

  53. class NoTemplateException extends IPFIXException

    Signals that a Session does not contain a Template.

  54. class OutOfTemplateIdsException extends IPFIXException

    Signals that all possible Template IDs have been used.

  55. abstract class Record extends AnyRef

    A Record instance represents an IPFIX data record.

    A Record instance represents an IPFIX data record. Each record contains a set of values which are described by the record's Template.

    Each IPFIX data type can be mapped to its Java data type as in the table below:

    • IPFIX data type ⟶ Scala data type
    • octetArray ⟶ Seq[Byte]1
    • unsigned8 ⟶ Int
    • unsigned16 ⟶ Int
    • unsigned32 ⟶ Long
    • unsigned64 ⟶ Long2
    • signed8 ⟶ Int
    • signed16 ⟶ Int
    • signed32 ⟶ Int
    • signed64 ⟶ Long
    • float32 ⟶ Float
    • float64 ⟶ Double
    • boolean ⟶ Boolean
    • macAddress ⟶ Seq[Byte]1,3
    • string ⟶ String
    • dateTimeSeconds ⟶ Instant
    • dateTimeMilliseconds ⟶ Instant
    • dateTimeMicroseconds ⟶ Instant
    • dateTimeNanoseconds ⟶ Instant
    • ipv4Address ⟶ IPv4Address
    • ipv6Address ⟶ IPv6Address
    • basicList ⟶ BasicList
    • subTemplateList ⟶ SubTemplateList
    • subTemplateMultiList ⟶ SubTemplateMultiList

    1 The Seq[Byte] returned for octetArray or macAddress is a read-only view on the underlying record data. If you want to save the data without keeping the full record data from being garbage collected, you should copy the Seq.

    2 Long is signed, so an unsigned64 with its high bit set will appear as negative.

    3 The Seq[Byte] returned for a macAddress will always be of length 6.

    A record's fields are described by a Template, which may be retrieved from the record using the #template value. Using the data from the template, the user can cast the record's objects to the appropriate Java type.

    Alternatively, a record's values can be retrieved in a typed manner using either a FieldExtractor, or a Fillable object. A FieldExtractor acts as a reference to a particular field in a record regardless of the current template of the record. A Fillable object is an object which contains fields that have been marked with the IPFIXExtract annotation. A record's fill() method can be used to "fill in" the object's fields from the record.

    See also

    FieldExtractor

    Fillable

    Template

  56. final case class RecordReader(msgReader: MessageReader) extends Iterator[Record] with Product with Serializable

    A RecordReader is an Iterator over the CollectedRecords found in Messages read from a MessageReader.

    A RecordReader is an Iterator over the CollectedRecords found in Messages read from a MessageReader.

    msgReader

    The object that provides Messages from which to read records

  57. final class RecordSet extends IpfixSet with Iterable[Record]

    A RecordSet represents an IpfixSet that contains one or more Data Records.

    A RecordSet represents an IpfixSet that contains one or more Data Records.

    To create a RecordSet from an input ByteBuffer, call IpfixSet.fromBuffer().

    To create a RecordSet for export, use RecordSet.empty() to create an empty RecordSet and then call addRecord() to add Records to it.

    See also

    The companion object for more details.

  58. sealed class Session extends StrictLogging

    A session contains information about a single IPFIX session, from a single observation Domain.

    A session contains information about a single IPFIX session, from a single observation Domain. Specifically, a session takes care of handling the template library that maps template IDs to templates, and it keeps track of message sequence numbers.

    The Session class's contructor is not accessible. Instead these classes must be used: The StreamSession is used when reading data from a file or from a TCP stream. The DatagramSession is used when reading data over UDP.

    See also

    The companion object for additional details.

  59. final case class SessionGroup(infoModel: InfoModel, transport: AnyRef, streamSessions: Boolean = true) extends Product with Serializable

    A SessionGroup maintains a set of Sessions for a single transport session.

    A SessionGroup maintains a set of Sessions for a single transport session. Put more carefully, it maintains a group of sessions that can be distinguished solely by an observation domain identifier.

    A SessionGroup is created to create either StreamSessions or DatagramSessions. A StreamSession is used when reading data from files or over TCP; it supports template withdrawal and re-use of a template ID raises an exception. A DatagramSession is used when reading data over UDP; it does not support template withdrawal and re-use of template IDs is permitted.

    transport is an object may be used to describe the transport, such as an InetSocketAddress for network transports or a Path for a file transport. It may be null. The SessionGroup does not use this parameter, and the caller may use it however it chooses.

    Creates a session group. Each new session in the group will be created using the given session factory.

    infoModel

    the information model

    transport

    an object that describes the transport of the transport session. It will be an InetSocketAddress for network transports, or a Path for a file transport. May be null.

    streamSessions

    true when the group is used to read data from a file or over TCP (creates a StreamSession), and false for reading data over UDP (creates a DatagramSession).

  60. class SessionMismatchException extends IPFIXException

    Signals that a ListElement may not be added to a Record or a sub-Record may not be added to a List because they have different Session objects.

  61. final class SimpleFieldExtractor[T] extends FieldExtractor[T]

    Extracts the specified field from a Record and casts the field to a type.

    Extracts the specified field from a Record and casts the field to a type. Does not descend into any structured data elements (lists) on the Record. To descend into sub-records of the Record, use the DeepFieldExtractor.

    Maintains a mapping from Template to field position to improve performance when extracting a field from multiple Records that share the same Template.

    T

    The type to cast the field to.

    See also

    DeepFieldExtractor

  62. final case class StreamMessageReader(channel: ReadableByteChannel, sessionGroup: SessionGroup) extends MessageReader with Product with Serializable

    The StreamMessageReader is used to get the next Message from a channel.

    The StreamMessageReader is used to get the next Message from a channel. An instance of this type is normally created by an InputStreamSession.

    channel

    The channel to read.

    sessionGroup

    The SessionGroup that holds the InfoModel used to interpret data read from the channel.

  63. final class StreamSession extends Session

    There are two types of Sessions: StreamSession and DatagramSession.

    There are two types of Sessions: StreamSession and DatagramSession.

    A StreamSession implements Template instantiation and Template withdrawal handling as dictated by sections 8 and 8.1 of RFC 7011. In particular, Session.TemplateInterferenceException is thrown when different templates use the same template id.

    A StreamSession is created by a SessionGroup with the streamSemantics parameter set to true.

    Exceptions thrown

    Session.TemplateInterferenceException when different templates use the same template id.

  64. sealed abstract class SubTemplateList extends ListElement

    A class to represent the contents of an IPFIX SubTemplateList structured data.

    A class to represent the contents of an IPFIX SubTemplateList structured data.

    A SubTemplateList contains a zero or more instances of Records that match a single IPFIX Template.

    The companion object has factory methods that return a CollectedSubTemplateList instance when reading a SubTemplateList or a ExportSubTemplateList instance when generating a SubTemplateList for writing.

  65. sealed abstract class SubTemplateMultiList extends ListElement

    A class to represent the contents of an IPFIX SubTemplateMultiList structured data.

    A class to represent the contents of an IPFIX SubTemplateMultiList structured data.

    A SubTemplateMultiList contains a zero or more instances of Records that match one or more IPFIX Templates.

    The companion object has factory methods that return a CollectedSubTemplateMultiList instance when reading a SubTemplateMultiList or a ExportSubTemplateMultiList instance when generating a SubTemplateMultiList for writing.

  66. final class Template extends AnyRef

    An IPFIX template that describes the data in a Record.

    An IPFIX template that describes the data in a Record.

    A template is composed of a sequence of information elements with associated lengths. (The IEFieldSpecifier class bundles the InfoElement and length into a single object.) An element's length in the template may be different than the "natural" length (reduced length encoding), and an element that supports variable-length values may have a fixed size.

    If a template has a non-zero scope, the template is an Options Template.

    When a Template is added to a Session it is given a unique ID within that Session. A Template may be added to multiple Sessions; there is not necessarily a relationship among the IDs given to a Template in the different Sessions.

    Since

    1.3.1 The description is set and fixed at Template creation.

  67. final case class TemplateElement(ie: InfoElement, octetLength: Int) extends Product with Serializable

    A class to represent an information element within a template where the element may have a specific length that is different than the default length.

  68. final class TemplateMetadata extends Fillable

    Extracts Template metadata from a Record.

    Extracts Template metadata from a Record.

    The extracted data includes the name and description of a Template which is referenced by its Template id. The RecordReader uses that information to update the Templates that it parses.

  69. final class TemplateSet extends IpfixSet with Iterable[Template]

    A TemplateSet represents a IpfixSet that contains one or more Templates or Option Templates.

    A TemplateSet represents a IpfixSet that contains one or more Templates or Option Templates.

    To create a TemplateSet from an input ByteBuffer, use IpfixSet.fromBuffer.

    To create a TemplateSet for export, use TemplateSet.empty to create an empty TemplateSet and then call TemplateSet.addTemplate to add Templates to it.

    See also

    The companion object for more details.

  70. class TruncatedReadException extends IPFIXException

    Signals that there is not enough data available to read the Message.

Value Members

  1. final val EXPORT_BUFFER_USABLE_LEN: Int

    Maximum number of bytes that can be written to a single IPFIX mesage not including the message header.

  2. final val IPFIX_VERSION: Int

    The IPFIX version identifier

  3. final val MAX_TEMPLATE_ID: Int

    Maximum valid template ID

  4. final val MIN_TEMPLATE_ID: Int

    Minimum valid template ID

  5. final val OPTIONS_TEMPLATE_SET_ID: Int

    Set identifier for options template sets

  6. final val TEMPLATE_SET_ID: Int

    Set identifier for template sets

  7. final val VARLEN: Int

    Element size that represents a variable-length element

  8. object ArrayRecord

    An ArrayRecord factory.

  9. object BasicList

    A BasicList factory and supporting classes.

  10. object BasicListFieldExtractor

    A BasicListFieldExtractor factory.

  11. object ByteBufferMessageReader extends Serializable
  12. object CollectedMessage

    A CollectedMessage factory.

  13. object CollectedRecord

    A CollectedRecord factory.

  14. case object DataTypes extends ShortEnum[DataTypes] with Product with Serializable

    IPFIX Information Element Data Types as defined in RFC5102

    IPFIX Information Element Data Types as defined in RFC5102

    A description of the abstract data type of an IPFIX Information Element as defined in Section 3.1 of RFC5102.

    See https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-information-element-data-types

    May be converted to and from Short values.

  15. object DeepFieldExtractor extends Serializable

    Holds constants and methods used by DeepFieldExtractor.

  16. object ExportBasicList

    Contains private methods to support the ExportBasicList class.

  17. object ExportStream

    An ExportStream factory.

  18. object ExportStreamTemplatesFirst

    An ExportStreamTemplatesFirst factory.

  19. object ExportSubTemplateList

    Contains private methods to support the ExportSubTemplateList class.

  20. object ExportSubTemplateMultiList

    Contains private definitions to support the ExportSubTemplateMultiList class.

  21. object FieldSpec

    A FieldSpec factory.

  22. object IEFieldSpecifier extends Serializable

    An IEFieldSpecifier factory.

  23. case object IESemantics extends ShortEnum[IESemantics] with Product with Serializable

    IPFIX Information Element Semantics as defined in RFC5610

    IPFIX Information Element Semantics as defined in RFC5610

    A description of the semantics of an IPFIX Information Element. These are taken from the data type semantics defined in Section 3.2 of the IPFIX Information Model (RFC5102); see that section for more information on the types described below. The special value 0x00 (default) is used to note that no semantics apply to the field; it cannot be manipulated by a Collecting Process or File Reader that does not understand it a priori.

    See https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-information-element-semantics

    May be converted to and from Short values.

  24. case object IEUnits extends ShortEnum[IEUnits] with Product with Serializable

    IPFIX Information Element Units as defined in RFC5610

    IPFIX Information Element Units as defined in RFC5610

    A description of the units of an IPFIX Information Element. These correspond to the units implicitly defined in the Information Element definitions in Section 5 of the IPFIX Information Model (RFC5102); see that section for more information on the types described below. The special value 0x00 (none) is used to note that the field is unitless.

    See https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-information-element-units

    May be converted to and from Short values.

  25. object Identifier extends Serializable

    A factory for Identifier instances.

  26. object InfoElement extends Serializable

    An InfoElement factory.

  27. object InfoElementBuilder

    An InfoElementBuilder factory.

  28. object InfoElementMetadata

    An InfoElementMetadata factory.

  29. object InfoModel extends StrictLogging with Serializable

    An InfoModel factory.

  30. object InfoModelRegistry

    Find and open an information model registry XML file, given the base name of the file.

    Find and open an information model registry XML file, given the base name of the file. This presumes that such files will exist as resources under /org/cert/netsa/io/ipfix/registries.

  31. object InputStreamSession

    A InputStreamSession factory.

  32. object IpfixSet

    An IpfixSet factory.

  33. case object ListSemantics extends ShortEnum[ListSemantics] with Product with Serializable

    IPFIX Structured Data (List) Type Semantics as defined in RFC6313

    IPFIX Structured Data (List) Type Semantics as defined in RFC6313

    Structured data type semantics are provided in order to express the relationship among multiple list elements in a Structured Data Information Element.

    See https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-structured-data-types-semantics

    May be converted to and from Short values.

  34. object Message

    Holds constants related to the Message trait.

  35. object Record

    A Record copier.

  36. object RecordSet

    A RecordSet factory.

  37. object Session

    Defines traits for classes that are used as callbacks on a Session.

  38. object SimpleFieldExtractor

    A SimpleFieldExtractor factory.

  39. object StreamMessageReader extends Serializable

    A StreamMessageReader factory.

  40. object SubTemplateList

    A SubTemplateList factory.

  41. object SubTemplateMultiList

    A SubTemplateMultiList factory.

  42. object Template

    A Template factory.

  43. object TemplateMetadata

    A TemplateMetadata factory.

  44. object TemplateSet

    A TemplateSet factory.

Inherited from AnyRef

Inherited from Any

Ungrouped