*Flow Analytics

Dependencies

• libraft [1]
• libpcap [2]
• libprotobuf & protoc [3]
• libgrpc [4]
• catch [5] (is automatically integrated when running cmake)
• cxxopts [6] (is automatically integrated when running cmake)
• gnuplot [7]

Build

• requires cmake >= 3.5 and gcc >= 6

mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release ..
make

Run Unit Tests

make test

Kernels

Kernel Name	Input	Output
CLFRFileReader	none	CLFR
CLFRFileWriter	CLFR	none
CLFRPrinter	CLFR	CLFR or none
FlowTable	Key, Packet	CLFR
GroupBy	T	U
LiveCapture	none	RawPacket
Map	T	U
Filter	T	T
PacketPrinter	Key, Packet	Key, Packet or none
PCAPFileReader	none	RawPacket
Printer	T	T or none
RawPacketParser	RawPacket	Key, Packet
TZSPReceiver	none	RawPacket
Zip	I1, I2,	O = std::pair<I1,I2>

Run Docker Container

Pull the image:

docker pull olivermichel/starflow_analytics

Get interactive shell:

docker run -v /home/ubuntu:/root/mnt -it olivermichel/starflow_analytics /bin/bash

Generate CLFR Files:

docker run -v /home/ubuntu:/root/mnt olivermichel/starflow_analytics \
    /root/starflow_analytics/build/pcap_flow_file_exporter \
    -v -e ip -i /root/mnt/caida2015_02_dirA_10m.pcap -o /root/mnt/caida2015_02_dirA_10m.clfr

Run an example application:

docker run -v /home/ubuntu:/root/mnt olivermichel/starflow_analytics \
    /root/starflow_analytics/build/passthrough -b -i /root/mnt/caida2015_02_dirA_10m.clfr

References

[1] https://github.com/RaftLib/RaftLib
[2] http://www.tcpdump.org
[3] https://github.com/google/protobuf
[4] https://github.com/grpc/grpc
[5] https://github.com/catchorg/Catch2
[6] https://github.com/jarro2783/cxxopts
[7] http://www.gnuplot.info