ipfixcol2-udp-input(7)

💖 ipfixcol2-udp-input — the UDP input plugin, bestie edition 💖

okay so first things first: this is a page from the IPFIXcol collector manual, section 7, and the star of the show is ipfixcol2-udp-input — the UDP (input plugin). yes, that's it, that's the whole NAME section, but make it cute: UDP (input plugin). 🦋

---

✨ DESCRIPTION ✨

So what does this plugin even do? It grabs IPFIX messages flying over the UDP transport protocol, coming from one or more exporters, and hands them straight into the collector. 🫶

You can run multiple instances of this plugin at the same time, no problem — but bestie, they must listen on different ports or different local IP addresses. No doubling up, it's giving main character only. 💅

Now the important lore: the connection between the exporter and the collector is unreliable, because, well… UDP. 🙈 And the IPFIX protocol itself is unidirectional — the collector can only receive. It can't talk back. It's a listener, not a chatter. 👑

And here's the thing about templates: different exporters measure different features of flows, so IPFIX defines templates that describe the structure of the flow records being transmitted. The collector uses those templates to actually interpret what it's receiving. 🧚

Over UDP, exporters regularly retransmit their templates. But — plot twist — if the collector starts after an exporter, it could miss all the templates. And if it misses them, it's literally unable to interpret records until the next retransmission. So yeah, it can take up to a few minutes for that first record to be successfully interpreted. How long exactly? Depends on the template retransmission interval of the exporter. ⏳

⚠️ Warning, and this one's serious: one of the most common causes of lost flow records over UDP is an undersized receive buffer on a system socket. The actual size of the buffer your OS gives you is limited by operating-system-level maximums. The plugin automatically bumps the default size up to the maximum size during startup — slay — but even so, that size is usually not optimal for monitoring a high-speed network or for receiving from multiple exporters. So it is recommended to increase the limits before you start the collector. 💀

For most Linux distributions you can just use a command like this one (the value is in bytes):

sysctl -w net.core.rmem_max=16777216

---

🌸 Example configuration 🌸

Here's what it looks like in the wild, no cap:

<input>
    <name>UDP input</name>
    <plugin>udp</plugin>
    <params>
        <localPort>4739</localPort>
        <localIPAddress></localIPAddress>
        <!-- Optional parameters -->
        <connectionTimeout>600</connectionTimeout>
        <templateLifeTime>1800</templateLifeTime>
        <optionsTemplateLifeTime>1800</optionsTemplateLifeTime>
    </params>
</input>

---

🎀 PARAMETERS 🎀

The mandatory ones (you literally have to)

• localPort — the local port the plugin listens on. [default: 4739]
• localIPAddress — the local IPv4/IPv6 address this UDP input plugin listens on. If you leave the element empty, the plugin binds to all available network interfaces. You can also repeat this element multiple times (one IP address per occurrence) to manually hand-pick multiple interfaces. [default: empty]

The optional ones (vibes only, if you want them)

• connectionTimeout — exporter connection timeout, in seconds. If no message arrives from an exporter for the specified time, that connection is considered closed and all resources associated with that exporter get yeeted — things like flow templates, etc. [default: 600]
• templateLifeTime, optionsTemplateLifeTime — (Options) Template lifetime in seconds for all UDP Transport Sessions terminating at this UDP socket. (Options) Templates that aren't received again within the configured lifetime become invalid. ✨ Pro tip from the source material: the lifetime of Templates and Options Templates should be at least three times higher than the same values configured on the corresponding exporter. [default: 1800]

---

💜 AUTHOR 💜

Lukáš Huták (lukas.hutak@cesnet.cz), Petr Velan (petr.velan@cesnet.cz) — icons, honestly. 👑

---

🌈 COPYRIGHT 🌈

Copyright © 2018 CESNET, z.s.p.o.

---

and that's the whole page, bestie — version 2.0, dated 2018-09-20, straight out of the ipfixcol2-udp-input(7) manual. go configure something iconic. periodt. 💅✨