@@ -11,7 +11,7 @@ nav_order: 4
11
11
12
12
The flow-based aggregation consists of aggregating packets into flows based on a shared set of characteristics
13
13
(flow key, e.g., source IP address, destination IP address, transport protocol, source port, destination port,
14
- VLAN identifier). A flow cache maintains each flow entry until its termination (e.g., active timeout, inactive timeout).
14
+ VLAN identifier, tunnel Identifier ). A flow cache maintains each flow entry until its termination (e.g., active timeout, inactive timeout).
15
15
While the entry is present in the flow cache, basic counters, and several metrics are updated.
16
16
If two pairs generate flows on both directions, the flow cache uses a bidirectional flow definition, adding counters
17
17
and metrics for both directions.
@@ -52,7 +52,7 @@ my_streamer = NFStreamer(source="facebook.pcap",
52
52
### NFStreamer attributes
53
53
54
54
| ` source ` | ` [default=None] ` | Packet capture source. Pcap file path or network interface name. |
55
- | ` decode_tunnels ` | ` [default=True] ` | Enable/Disable GTP/TZSP tunnels decoding. |
55
+ | ` decode_tunnels ` | ` [default=True] ` | Enable/Disable GTP/CAPWAP/ TZSP tunnels decoding. |
56
56
| ` bpf_filter ` | ` [default=None] ` | Specify a [ BPF filter] [ bpf ] filter for filtering selected traffic. |
57
57
| ` promiscuous_mode ` | ` [default=True] ` | Enable/Disable promiscuous capture mode. |
58
58
| ` snapshot_length ` | ` [default=1536] ` | Control packet slicing size (truncation) in bytes. |
@@ -130,6 +130,10 @@ In the following we detail each implemented feature.
130
130
| ` dst2src_packets ` | ` int ` | Flow dst2src packets accumulator. |
131
131
| ` dst2src_bytes ` | ` int ` | Flow dst2src bytes accumulator (depends on accounting_mode). |
132
132
133
+ #### Tunnel Decoding Features (decode_tunnels=True)
134
+
135
+ | ` tunnel_id ` | ` int ` | Tunnel identifier (O: No Tunnel, 1: GTP, 2: CAPWAP, 3: TZSP). |
136
+
133
137
#### NFlow Layer-7 Visibility Features (n_dissections>0)
134
138
135
139
| ` application_name ` | ` str ` | nDPI detected application name. |
@@ -296,6 +300,7 @@ information are exposed in an NFPacket (Network Flow Packet) which contains the
296
300
| ` psh ` | ` bool ` | TCP PSH Flag present. |
297
301
| ` rst ` | ` bool ` | TCP RST Flag present. |
298
302
| ` fin ` | ` bool ` | TCP FIN Flag present. |
303
+ | ` tunnel_id ` | ` int ` | Tunnel identifier (O: No Tunnel, 1: GTP, 2: CAPWAP, 3: TZSP). |
299
304
300
305
### NFPlugins Examples
301
306
0 commit comments