Tutorial: Plugins Overview

Global Plugins

protoStats Overall statistics about protocols [Tutorial]

Basic Plugins

basicFlow Overall flow information [Tutorial]
basicStats Basic statistics [Tutorial]
connStat Connection statistics [Tutorial]
macRecorder MAC addresses and manufacturers [Tutorial]
portClassifier Classification based on port numbers [Tutorial]

Layer 2 Plugins

arpDecode Address Resolution Protocol (ARP)
cdpDecode Cisco Discovery Protocol (CDP)
lldpDecode Link Layer Discovery Protocol (LLDP)
stpDecode Spanning Tree Protocol (STP)

Layer 3/4 Plugins

sctpDecode Stream Control Transmission Protocol (SCTP) [Tutorial]
tcpFlags IP and TCP flags [Tutorial]
tcpStates TCP connection tracker [Tutorial]

Layer 7 Plugins

dhcpDecode Dynamic Host Configuration Protocol (DHCP)
dnsDecode Domain Name System (DNS)
ftpDecode File Transfer Protocol (FTP)
httpSniffer HyperText Transfer Protocol (HTTP)
icmpDecode Internet Control Message Protocol (ICMP)
igmpDecode Internet Group Management Protocol (IGMP)
ircDecode Internet Relay Chat (IRC)
modbus Modbus
ntpDecode Network Time Protocol (NTP)
ospfDecode Open Shortest Path First (OSPF)
popDecode Post Office Protocol (POP)
radiusDecode Remote Authentication Dial-In User Service (RADIUS)
smbDecode Server Message Block (SMB)
smtpDecode Simple Mail Transfer Protocol (SMTP)
snmpDecode Simple Network Management Protocol (SNMP)
sshDecode Secure Shell (SSH)
sslDecode SSL/TLS, OpenVPN
stunDecode STUN, TURN, NAT-PMP
syslogDecode Syslog
telnetDecode Telnet
tftpDecode Trivial File Transfer Protocol (TFTP)
vrrpDecode Virtual Router Redundancy Protocol (VRRP)

Applications Plugins

pwX Password extractor
regex_pcre Perl Compatible Regular Expressions (PCRE) [Tutorial]
voipDetector Voice over IP (VoIP)

Math Plugins

descriptiveStats Descriptive statistics [Tutorial]
entropy Entropy
nFrstPkts Statistics over the first N packets [Tutorial]
pktSIATHisto Histograms of packet size and inter-arrival times [Tutorial]
wavelet Wavelet

Classifier Plugins

fnameLabel Classification based on filename
geoip Classification based on IP address location [Tutorial]
nDPI Classification based on content analysis [Tutorial]
p0f OS Classification based on content analysis (SSL) [Tutorial]
tp0f OS Classification based on content analysis [Tutorial]

Output (Sink) Plugins

binSink Binary output into a flow file
findexer Produce a binary index mapping flow index and packets [Tutorial]
jsonSink Produce a JSON file
mongoSink Output into a MongoDB database [Tutorial]
mysqlSink Output into a MySQL database [Tutorial]
netflowSink Netflow output format for existing Cisco tools [Tutorial]
pcapd Store packets from specific flows in pcap files [Tutorial]
psqlSink Output into a PostgreSQL database [Tutorial]
socketSink Binary output into a TCP/UDP socket [Tutorial]
sqliteSink Output into a SQLite database [Tutorial]
txtSink Text output into a flow file