ipfixcol2-a...zation-inter(7)

✨ NAME ✨

ok so bestie, say hi to ipfixcol2-anonymization-inter — it's an anonymization intermediate plugin, and yeah it's a whole vibe 🎀

---

💖 DESCRIPTION 💖

This plugin does IPv4/IPv6 address anonymization on all flow records, no exceptions, periodt. There are exactly two methods you can throw at those IP addresses: CryptoPAN and address truncation. pick your fighter 💅

Now, how does it know which fields to mess with? It looks at the type of an Information Element linked to each field. So any record field that has a known corresponding Information Element and type gets anonymized automatically — zero manual labor, we love to see it 😌✨ Enterprise-specific Information Elements are supported too, so don't stress.

---

🌸 EXAMPLE CONFIGURATION 🌸

here's what it looks like in the wild, copy-paste energy:

<intermediate>
    <name>Flow anonymization</name>
    <plugin>anonymization</plugin>
    <params>
        <type>CryptoPAn</type>
        <key>0123456789abcdefghijklmnopqrstuv</key>
    </params>
</intermediate>

---

🦋 PARAMETERS 🦋

• type — which anonymization method are we using, bestie? The string is case insensitive, so live your truth.
  • CryptoPAn — the cryptography-based sanitization method, and it's prefix-preserving. What does that mean? The mapping from original IP addresses to anonymized IP addresses is one-to-one, and if two original IP addresses share a k-bit prefix, their anonymized mappings will also share a k-bit prefix. iconic behaviour honestly. BUT 👀 be aware that this cryptography method is very demanding and can limit throughput of the collector. it's giving expensive.
  • Truncation — this one keeps the top part and erases the bottom part of an IP address. Compared to CryptoPAn it is considerably faster, however the mapping from original to anonymized IP address is many-to-one (yeah, not reversible like that). For example the IPv4 address "1.2.3.4" is mapped to the address "1.2.0.0". rip to those last two octets 🪦
• key — optional cryptography key for CryptoPAn anonymization. The length of the string must be exactly 32 bytes, no more no less, don't try it. If the key is not specified, a random one is generated during the initialization. surprise key 🎁

---

💜 NOTES 💜

Usually all common IP addresses are automatically anonymized, easy. However — if an IPFIX field is not getting anonymized, make sure that the particular Information Element is defined among the other definitions provided by the libfds library (<https://github.com/CESNET/libfds/>). Especially with Enterprise-Specific Information Elements, there's a real chance the definitions are just… missing 🙈. Check the documentation of the library, it'll help you easily add extra definitions in just a few steps. you got this 🫶

---

👑 AUTHOR 👑

Lukáš Huták (lukas.hutak@cesnet.cz), Petr Velan (petr.velan@cesnet.cz)

🌈 COPYRIGHT 🌈

Copyright © 2018 CESNET, z.s.p.o.

---

and that's the whole page bestie 💖 this was IPFIXcol collector — wait no, it's part of the ipfixcol2-anonymization-inter(7) manual, version 2.0, dated 2018-09-20. slay, go anonymize responsibly ✨