What's New in Super Mediator 2.0.

This page documents the new features and incompatible changes in Super Mediator 2.0.

Adaptability for Changes to YAF

Traditionally Super Mediator contained fixed template definitions that matched those in YAF. However, this meant changes to YAF also required changes to Super Mediator.

Super Mediator 2.0 largely uses the templates it receives as-is and passes them along to its export streams.

When looking for a particular templates (do to de-duplication, for example), Super Mediator 2.0 checks for particular elements instead of matching the entire template and makes use of the exhanced template metadata exported by YAF 3. This allows increased flexibility and should allow Super Mediator to handle moderate changes that YAF makes to its templates. (Major changes in YAF will still require changes to Super Mediator.)

New Configuration File Syntax

The configuration file has significant changes. Files from previous releases of Super Mediator must be updated to work with this release.

A new option --test-config has been added to allow testing the configuration file syntax.

Removed Several Command Line Options

Made changes to the command line parsing and eliminated several options. The configuration file is the preferred way to configure super_mediator.

In general, it is now an error to specify a value on the command line and in the configuration file.

Enhanced Statistics

Enhanced statistics for types of records read from a collector and written to an exporter.

Record and Template IDs Have Changed

Super Mediator processes data from YAF. Since YAF 3 has changed the structure and IDs of its templates, including the use of named lists, Super Mediator contains these changes when reading data from YAF 3.

Field Name Changes

Note that Super Mediator 2.0 has the same information element name changes as YAF 3.0.

The new names are used even if Super Mediator is processing IPFIX generated by YAF 2. The IPFIX input contains only numeric IDs for the elements. The mapping of IDs to names depends on the version of the software doing the mapping.


Super Mediator currently has the following limitations.

Delimited Text Export Is A Work-in-Progress

Exporting as delimited TEXT is lightly tested and contains bugs.

SiLK IPset Support Temporarily Disabled

SiLK IPset support is not available in this release. This will be re-enabled in a later release.

MySQL Support Temporarily Disabled

MySQL and MariaDB support is not available currently. This will be re-enabled in a later release.