Tutorial: Plugins Overview

Global Plugins

protoStats Overall statistics about protocols

Basic Plugins

basicFlow Overall flow information
basicStats Basic statistics
connStat Connection statistics
macRecorder MAC addresses and manufacturers
portClassifier Classification based on port numbers

Layer 2 Plugins

arpDecode Address Resolution Protocol (ARP)
cdpDecode Cisco Discovery Protocol (CDP)
lldpDecode Link Layer Discovery Protocol (LLDP)
stpDecode Spanning Tree Protocol (STP)

Layer 3/4 Plugins

sctpDecode Stream Control Transmission Protocol (SCTP) [Tutorial]
tcpFlags IP and TCP flags [Tutorial]
tcpStates TCP connection tracker

Layer 7 Plugins

dhcpDecode Dynamic Host Configuration Protocol (DHCP)
dnsDecode Domain Name System (DNS)
ftpDecode File Transfer Protocol (FTP)
httpSniffer HyperText Transfer Protocol (HTTP)
icmpDecode Internet Control Message Protocol (ICMP)
igmpDecode Internet Group Management Protocol (IGMP)
ircDecode Internet Relay Chat (IRC)
modbus Modbus
ntpDecode Network Time Protocol (NTP)
ospfDecode Open Shortest Path First (OSPF)
popDecode Post Office Protocol (POP)
radiusDecode Remote Authentication Dial-In User Service (RADIUS)
smbDecode Server Message Block (SMB)
smtpDecode Simple Mail Transfer Protocol (SMTP)
snmpDecode Simple Network Management Protocol (SNMP)
sshDecode Secure Shell (SSH)
sslDecode SSL/TLS, OpenVPN
stunDecode STUN, TURN, NAT-PMP
syslogDecode Syslog
telnetDecode Telnet
tftpDecode Trivial File Transfer Protocol (TFTP)
vrrpDecode Virtual Router Redundancy Protocol (VRRP)

Applications Plugins

pwX Password extractor
regex_pcre Perl Compatible Regular Expressions (PCRE)
voipDetector Voice over IP (VoIP)

Math Plugins

descriptiveStats Descriptive statistics
entropy Entropy
nFrstPkts Statistics over the first N packets
pktSIATHisto Histograms of packet size and inter-arrival times
wavelet Wavelet

Classifier Plugins

fnameLabel Classification based on filename
geoip Classification based on IP address location [Tutorial]
nDPI Classification based on content analysis [Tutorial]
p0f OS Classification based on content analysis (SSL) [Tutorial]
tp0f OS Classification based on content analysis [Tutorial]

Output (Sink) Plugins

binSink Binary output into a flow file
findexer Produces a binary index mapping flow index and packets [Tutorial]
jsonSink Produces a JSON file
mongoSink Output into a MongoDB database [Tutorial]
mysqlSink Output into a MySQL database [Tutorial]
netflowSink Netflow output format for existing Cisco tools [Tutorial]
pcapd Stores packets from specific flows in pcap files [Tutorial]
psqlSink Output into a PostgreSQL database [Tutorial]
socketSink Binary output into a TCP/UDP socket [Tutorial]
sqliteSink Output into a SQLite database [Tutorial]
txtSink Text output into a flow file