Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to generate IPFIX data from the packets that are coming to my local system as part of experimentation. It seems ULogd is a good tool to do that. I am able to capture PCAP data. But there are very less documents available on ULogd2.x about IPFIX format data generation.(There are very few examples provided in ulogd.conf).

Can you provide me any links that describes about how to generate IPFIX data using ulogd2.x? 1) What are the options available? I saw there is polling interval configuration. But I have no idea how does it work?

2) If I set hash_enable = 0, and uncomment the polling_interval value, I'm getting an exception as NFCT plugin requires hash table, evne though I have specified hash_buckets and hash_max_entries. Could you help on this?

3) In general, I would like to know how NFCT plugin works in ulogd2.x. I sent mail to ulogd mailing list, but there are no replies.

Could you shed some light?

share|improve this question
I have a project to collect nf_conntrack_netlink data and aggregate it centrally, but if an efficient solution based on ulogd exists I'd love to hear about it! – Pierre Carrier Jul 6 '12 at 10:22
Could you briefly describe about your project? Any links you have to do that work? – Gomathivinayagam Jul 7 '12 at 2:03
Unfortunately it'd have to be more complete then go through a code review before I can publish it. I don't target any IPFIX support on the machines but would rather take care of that centrally as I want a minimal communication layer on the hosts that can adapt to different types of information. I'll do the deduplication given I'll see many connections multiple times (from both machines when within my infrastructure, through 1 firewall in some contexts, through 2 firewalls for many cross-DC connections), and IPFIX tooling can't be as precise as some information will be lost in the translation. – Pierre Carrier Jul 7 '12 at 12:58
[follow up] I would use libnetfilter_conntrack in 2 separate processes: 1. to grab all the events I'm interested into (multiple contexts to allow for complex filtering logic as their bsf usage is rather limited) and publish them on a zeromq socket, reencoded in msgpack (obviously with network endianness). 2. to periodically go through all connections and publish a snappy-compressed msgpacked list. That way I can have a good view of the current connections on a host even if the other process dies, or connections are started before it, and get traffic counters reasonably often. – Pierre Carrier Jul 7 '12 at 13:04

Without ulogd, if you have CPU cycles to spare and not too much traffic, you might want to look into fprobe.

They also have an fprobe-ulog fork which seems to do something very similar to your goal, but I've tried it or heard anything about it.

share|improve this answer
Thank you, fprobe-ulog seems to be giving NetFlow information. IPFIX is the standard version of NetFlow. I would like to go with IPFIX. – Gomathivinayagam Jul 8 '12 at 0:48
Duh. IPFIX is a superset of Netflow v9. – Pierre Carrier Jul 8 '12 at 1:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.