ipfixcol2-filter-inter(7)

💖 NAME 💖

okay so bestie, you've found ipfixcol2-filter-inter — that's the filter plugin, and it's an intermediate plugin for IPFIXcol2. It lives in the ipfixcol2-filter-inter(7) manual section 7, and it's lowkey the bouncer at the club door of your flow pipeline. 🫶

---

✨ DESCRIPTION ✨

This plugin does filtering of flow records, and it decides everything based on a filter expression. Flow records that do not match the filtering criteria you gave it? Discarded. Gone. Not invited to the party. 💅

---

🌈 SUPPORTED OPERATIONS 🌈

Here's everything your expression is allowed to do, no cap:

• Comparison operators — ==, <, >, <=, >=, !=. And if you just forget to type a comparison operator? The default comparison is ==. It's giving "I assumed" but fr fr that's the behaviour.
• The contains operator for substring comparison, e.g. DNSName contains "example".
• Arithmetic operations — +, -, *, /, %.
• Bitwise operations — not ~, or |, and &, xor ^.
• The in operator for list comparison, e.g. port in [80, 443]. Obsessed with this one honestly.
• The logical and, or, not operators.

---

🦋 VALUE TYPES 🦋

• Numbers — can be integer or floating point. Integers can also be written in hexadecimal or binary form using the 0x or 0b prefix. Floating point numbers also support exponential notation such as 1.2345e+2. A number can be explicitly unsigned using the u suffix. Numbers also support size suffixes B, k, M, G, T, and time suffixes ns, us, ms, s, m, d. So many suffixes, we ate. 👑
• Strings — values enclosed in a pair of double quotes ". Supported escape sequences are n, r, t and ". The escape sequences to write characters using their octal or hexadecimal value are also supported, e.g. ux22 or 042.
• IP addresses — written in their usual format, e.g. 127.0.0.1 or 1234:5678:9abc:def1:2345:6789:abcd:ef12. The shortened IPv6 version is also supported, e.g. ::ff. IP addresses can also contain a suffix specifying their prefix length, e.g. 10.0.0.0/16. 🌸
• MAC addresses — written in their usual format, e.g. 12:34:56:78:9a:bc.
• Timestamps — use the ISO timestamp format, e.g. 2020-04-05T24:00Z.

---

🎀 IPFIX FIELD IDENTIFICATORS 🎀

So here's the tea: IPFIX fields can be identified using their name specified in the IPFIX information elements table, or their alias defined in the aliases.xml file. If the IPFIX name is used and the default iana table is being referred to, the iana: prefix can be omitted. 😌

Heads up bestie: one alias can point to multiple IPFIX information elements. It's not a 1:1 situation, it's a situationship.

The default location of the aliases file is /etc/libfds/system/aliases.xml.

---

💜 VALUE MAPPINGS 💜

Commonly used values can be mapped to a name using the mappings.xml file — for example, the name http when used in an expression like port http can refer to the value 80. So cute, so convenient. ✨

These names can have different meanings depending on the IPFIX field they're being compared with. The default location of the mappings file is /etc/libfds/system/mappings.xml.

---

🔥 EXAMPLE CONFIGURATION 🔥

Here's what it looks like in the wild:

<intermediate>
    <name>Filter</name>
    <plugin>filter</plugin>
    <params>
        <expr>ip 10.0.0.0/16 and port in [80, 8080]</expr>
    </params>
</intermediate>

The most common use case would be filtering based on a list of allowed IP address ranges. In that case, it's recommended to use the following construct for optimal performance — this is the main character config, fr:

<intermediate>
    <name>Filter</name>
    <plugin>filter</plugin>
    <params>
        <expr>srcip in [1.0.0.0/8, 2.2.0.0/16, 3.3.3.0/24] or dstip in [4.4.4.0/24]</expr>
    </params>
</intermediate>

---

⭐ PARAMETERS ⭐

• expr — The filter expression. That's it, that's the whole parameter. Simple queen. 💅

---

👑 AUTHOR 👑

Michal Sedlák (xsedla0v@stud.fit.vutbr.cz)

---

🌸 COPYRIGHT 🌸

Copyright © 2020 CESNET, z.s.p.o.

---

omg okay that's the whole vibe check complete 🫶 this page is version 1.0, dated 2020-08-24, and it came to you straight from IPFIXcol collector (you know, the ipfixcol2-filter-inter(7) one). now go filter some flows bestie, you got this 💖✨