softflowd Network Monitor

The project is organized into include/softflow/ for public headers and src/ for implementations. Building the project produces two primary executables: softflowd_cpp (the daemon) and softflowctl_cpp (the control client).

Core Headers (include/softflow/)

• softflowd.hpp: Contains all core public types including Flow, FlowKey, FlowTable<Backend>, FlowTableRuntime, PacketParser, PcapHandle, ByteWriter, ExportDestination, and TransportKind.
• daemon.hpp: Provides PidFile, daemonize(), and SignalPipe.
• softflowctl.hpp: Defines the control protocol and ControlClient.
• netflow1.hpp, netflow5.hpp, netflow9.hpp: NetFlow protocol implementations.
• ipfix.hpp: IPFIX implementation, including support for MPLS, RFC 5103 biflow, and absolute time formats.
• psamp.hpp: PSAMP implementation and PsampReceiver (used for -R receive-mode).

Source Files (src/)

• softflowd.cpp: Contains the main() function, core implementations, the live-capture event loop, the control-socket server, and the PSAMP receive socket.
• daemon.cpp: Daemonization logic.
• softflowctl.cpp: Control protocol implementation and the softflowctl_cpp main entry point.
• Protocol-specific implementations: netflow1.cpp, netflow5.cpp, netflow9.cpp, ipfix.cpp, and psamp.cpp.

The FlowTable manages the collection of flows. You can choose between two backends depending on your performance and ordering requirements:

1. Hash Backend (FlowIndexBackend::Hash): Uses std::unordered_map. Provides average $O(1)$ complexity. Best for high-performance flow tracking.
2. Tree Backend (FlowIndexBackend::Tree): Uses std::map (typically a Red-Black tree). Closest to the original softflowd implementation. Provides $O(\log n)$ complexity.

Compile-time selection

Use templates to select the backend with zero runtime overhead:

softflow::FlowTable<softflow::FlowIndexBackend::Tree> table(65536);

Runtime selection

Use FlowTableRuntime to switch backends at runtime (e.g., via command-line arguments):

softflow::FlowTableRuntime table(softflow::FlowIndexBackend::Tree, 65536);

In the softflowd_cpp executable, you can switch the backend using the --backend flag:

softflowd_cpp --backend=hash ...
softflowd_cpp --backend=tree ...

Use differential testing to compare the NetFlow/IPFIX packets generated by both versions. This involves feeding the same pcap file to both daemons and capturing their UDP output.

Steps:

1. Prepare a pcap file with diverse traffic (TCP, UDP, ICMP, IPv4, IPv6, etc.).
2. Run both daemons in offline mode using the -r option to read the pcap, and direct them to different local ports.
3. Capture the output using tcpdump.
4. Compare the resulting pcap files using tshark or a script to ensure fields like IP addresses, ports, packet counts, and byte counts match.

Note: You may need to mask dynamic fields like system boot time, real-time timestamps, or randomized sequence numbers during comparison.

# softflowd (C) execution and capture
softflowd -r test.pcap -n 127.0.0.1:9991 -d &
tcpdump -i lo -w output_c.pcap udp port 9991 &

# rsoftflowd (Rust) execution and capture
rsoftflowd -r test.pcap -n 127.0.0.1:9992 -d &
tcpdump -i lo -w output_rust.pcap udp port 9992 &

The softflowd_cpp executable implements the exact same single-letter option grammar as the original softflowd(8). This ensures compatibility with existing deployment scripts and init files.

Common usage patterns include:

• Live capture: Use -i to specify an interface and -n to specify export destinations.
• Pcap processing: Use -r to read from a file (prints statistics on exit).
• Daemonization: By default, it runs as a daemon. Use -d to run in the foreground.
• Control: Specify pidfiles with -p and control sockets with -c to allow management via softflowctl_cpp.

# Live capture on eth0, exporting to a specific host:port
softflowd_cpp -i eth0 -n 10.1.0.2:4432 -m 65536 -t udp=1m30s

# Load-balance across multiple destinations
softflowd_cpp -i eth0 -l -n 10.1.0.2:4432,10.1.0.3:4432

# Read from a pcap file
softflowd_cpp -r path/to/capture.pcap

# Run in foreground with a custom control socket
softflowd_cpp -i eth0 -d -c /tmp/sf.ctl