ipfixcol2-forwarder-output(7)

✨ NAME ✨

ipfixcol2-forwarder-output — the Forwarder, aka an output plugin for the IPFIXcol collector 💅 (it's a section 7 page in the ipfixcol2-forwarder-output manual, bestie, if you were wondering where to find it)

---

💖 DESCRIPTION 💖

Okay so listen. This plugin takes all the incoming flow records and forwards them, in IPFIX form, to other collectors — and it can do it in various modes. Girl math? No. Girl networking. 🦋

It's lowkey the perfect lil' setup for two very different vibes:

• broadcasting messages to multiple collectors (think: one main collector and one backup collector, so nobody's ever left on read 🙈)
• distributing messages across multiple collectors (think: load balancing, sharing the workload so nobody's doing all the heavy lifting ✨)

---

🎀 EXAMPLE CONFIGURATION 🎀

Here's the look, bestie. Copy it, love it, adjust it:

<output>
    <name>Forwarder</name>
    <plugin>forwarder</plugin>
    <params>
        <mode>roundrobin</mode>
        <protocol>tcp</protocol>
        <hosts>
            <host>
                <name>Subcollector 1</name>
                <address>192.168.1.2</address>
                <port>4739</port>
            </host>
            <host>
                <name>Subcollector 2</name>
                <address>192.168.1.3</address>
                <port>4739</port>
            </host>
            <host>
                <name>Subcollector 3</name>
                <address>localhost</address>
                <port>4739</port>
            </host>
        </hosts>
    </params>
</output>

---

🌸 PARAMETERS 🌸

Here's where you set the vibe check for your forwarder, one knob at a time 👑

• mode — the flow distribution mode, aka how do we hand out these records. RoundRobin means each record gets delivered to one of the hosts, and All means each record gets delivered to all the hosts. No in-between, pick a lane. [values: RoundRobin/All]
• protocol — the transport protocol to use, periodt. [values: TCP/UDP]
• templatesResendSecs — send those templates again every N seconds (UDP only, babe — TCP doesn't need this). [value: number of seconds, default: 600, 0 = never]
• templatesResendPkts — send those templates again every N packets (again, UDP only). [value: number of packets, default: 5000, 0 = never]
• reconnectSecs — if the connection drops, attempt to reconnect every N seconds (TCP only). [value: number of seconds, default: 10, 0 = don't wait]
• premadeConnections — keep N connections open with each host so there's no delay in connecting the moment a connection is actually needed. Pre-connecting is the main character move, ngl. [value: number of connections, default: 5]
• hosts — the receiving hosts. The whole roster. 🌈
  • host — one single host in that roster.
    • name — optional identification of the host, so you can tell your babies apart. [value: string, default: <address>:<port>]
    • address — the address of the host. [value: IPv4/IPv6 address or a hostname]
    • port — the port to connect to. [value: port number]

---

💀 KNOWN LIMITATIONS 💀

Okay this one matters, so pay attention bestie. The export time of IPFIX messages is set to the current time when forwarding. That can legit cause issues with data fields that use deltaTime relative to the export time. Not me warning you in advance 😭 — it's giving "read the fine print or perish."

---

👑 AUTHOR 👑

Michal Sedlak (xsedla0v@stud.fit.vutbr.cz) — iconic behavior, honestly.

---

💜 COPYRIGHT 💜

Copyright © 2021 CESNET, z.s.p.o.

---

And that's the whole page, bestie 🫶 — this was version 1.0, dated 2021-01-28, from the ipfixcol2-forwarder-output(7) era. Go forward those flows, slay, and don't forget who told you about the deltaTime thing 💅✨🍓