SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsipfix-receiver

ipfix-receiver

General & other

View repository

Updated 10-15 17:21

About this skill

IPFIX/NetFlow Receiver Skill

Receive and query IPFIX and NetFlow flow records from network devices via UDP.

Skill ID

ipfix-receiver

Description

This skill enables NetClaw to receive IPFIX (RFC 7011) and NetFlow (v5/v9) flow records from network devices and query the collected data. It provides visibility into network traffic patterns, bandwidth usage, and communication flows.

When to Use

  • Monitoring network traffic volumes and patterns
  • Identifying top bandwidth consumers (top talkers)
  • Investigating network communication between hosts
  • Analyzing protocol distribution across the network
  • Troubleshooting connectivity by examining flow data
  • Capacity planning based on traffic trends

Required MCP Server

ipfix-mcp

Available Tools

Tool Purpose
ipfix_start_receiver Start listening for flow exports
ipfix_stop_receiver Stop the receiver
ipfix_get_status Check receiver status and statistics
ipfix_query_flows Search flows with filters
ipfix_get_flow Get full details of a specific flow
ipfix_top_talkers Identify highest bandwidth consumers
ipfix_get_templates List cached flow templates

Example Workflows

Start Monitoring

1. Use ipfix_start_receiver with port 2055
2. Configure network devices to export flows to this port
3. Use ipfix_get_status to verify flows are being received

Identify Bandwidth Hogs

1. Use ipfix_top_talkers to see highest traffic sources/destinations
2. Filter by time range if investigating specific period
3. Use ipfix_query_flows with src_ip to drill into specific host

Investigate Host Communication

1. Use ipfix_query_flows with src_ip or dst_ip filter
2. Add protocol filter (6=TCP, 17=UDP) for specific traffic
3. Use min_bytes filter to focus on significant flows

Protocol Analysis

1. Use ipfix_top_talkers to see protocol breakdown
2. Query specific protocols with ipfix_query_flows
3. Analyze port usage patterns

Sample Prompts

  • "Start the flow receiver on port 2055"
  • "Show me the top 10 bandwidth consumers"
  • "Find all TCP flows from 192.168.1.100"
  • "What's the total traffic volume in the last hour?"
  • "Show me flows to port 443 with more than 1MB"
  • "What templates have been received from exporters?"

Configuration

The ipfix-mcp server is configured via environment variables:

  • IPFIX_PORT: UDP listening port (default: 2055)
  • IPFIX_BIND_ADDRESS: Bind address (default: 0.0.0.0)
  • IPFIX_RETENTION_HOURS: Flow retention (default: 24)
  • IPFIX_RATE_LIMIT: Max flows/second (default: 10000)
  • IPFIX_DEDUP_WINDOW: Dedup window in seconds (default: 5)

Limitations

  • In-memory storage only (data lost on restart)
  • Template caching expires after 30 minutes
  • Single instance per port
  • No flow aggregation or rollup
  • UDP only (no SCTP support)
  • GAIT logging sampled at 1% to reduce overhead

Related Skills

  • syslog-receiver - Syslog message collection
  • snmptrap-receiver - SNMP trap collection
  • gnmi-telemetry - Streaming telemetry

Failure Behavior

  • On a tool error (timeout, unreachable host, malformed response), report the failure and its error message directly to the user rather than fabricating or guessing at results.
  • For a confirmed read-only call, check connectivity and retry once if appropriate. For any call that changes state or sends a message, a timeout does not prove the action failed: inspect current state or delivery status before retrying, preserve the required approval/change gates, and do not repeat an action whose outcome is unknown.