Netify Netify logo Contact Us
Products Resources Documentation Blog Sign In

Netify Core Processor Plugin

The Netify DPI Core Processor plugin is the telemetry engine at the center of the agent pipeline. It takes flow intelligence generated by detection, classification, and protocol analysis, then converts it into structured event records that downstream systems can consume reliably.

In practice, this plugin separates packet inspection from telemetry delivery. You can keep capture and DPI behavior stable while independently choosing output format, compression, and destination sinks for integration with SIEMs, data lakes, or custom analytics workflows.

License

The Netify Core Processor Plugin is open-source software. It can be licensed under the GPLv3 or a commercial license. Please contact us for details.

Installation

Netify plugins are distributed through the same packaging workflow as the Netify Agent, allowing for a consistent installation experience using standard package manager syntax. While pre-compiled binaries are readily available for x86_64 architectures via our public mirrors, support for ARM, MIPS, and other specialized architectures is available upon request. Please contact us for details.

Step 1 - Select your installation target:

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
curl -fsSL https://download.netify.ai/5/debian/apt-gpg-key-netify.asc | sudo apt-key add -
echo 'deb http://download.netify.ai/5/debian/12/ /' | sudo tee /etc/apt/sources.list.d/netify.list > /dev/null

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
sudo apt update
sudo apt install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
curl -fsSL https://download.netify.ai/5/debian/apt-gpg-key-netify.asc | sudo apt-key add -
echo 'deb http://download.netify.ai/5/debian/11/ /' | sudo tee /etc/apt/sources.list.d/netify.list > /dev/null

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
sudo apt update
sudo apt install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
curl -fsSL https://download.netify.ai/5/debian/apt-gpg-key-netify.asc | sudo apt-key add -
echo 'deb http://download.netify.ai/5/debian/10/ /' | sudo tee /etc/apt/sources.list.d/netify.list > /dev/null

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
sudo apt update
sudo apt install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
curl -fsSL https://download.netify.ai/5/ubuntu/apt-gpg-key-netify.asc | sudo apt-key add -
echo 'deb http://download.netify.ai/5/ubuntu/noble/ /' | sudo tee /etc/apt/sources.list.d/netify.list > /dev/null

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
sudo apt update
sudo apt install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
curl -fsSL https://download.netify.ai/5/ubuntu/apt-gpg-key-netify.asc | sudo apt-key add -
echo 'deb http://download.netify.ai/5/ubuntu/jammy/ /' | sudo tee /etc/apt/sources.list.d/netify.list > /dev/null

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
sudo apt update
sudo apt install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
curl -fsSL https://download.netify.ai/5/ubuntu/apt-gpg-key-netify.asc | sudo apt-key add -
echo 'deb http://download.netify.ai/5/ubuntu/focal/ /' | sudo tee /etc/apt/sources.list.d/netify.list > /dev/null

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
sudo apt update
sudo apt install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
wget https://download.netify.ai/5/openwrt/key-build.pub -O /etc/opkg/keys/b18c240cb821dad2
echo 'src/gz netify https://download.netify.ai/5/openwrt/24.10/x86' >> /etc/opkg/customfeeds.conf

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
opkg update
opkg install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
wget https://download.netify.ai/5/openwrt/key-build.pub -O /etc/opkg/keys/b18c240cb821dad2
echo 'src/gz netify https://download.netify.ai/5/openwrt/23.05/x86' >> /etc/opkg/customfeeds.conf

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
opkg update
opkg install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
wget https://download.netify.ai/5/openwrt/key-build.pub -O /etc/opkg/keys/b18c240cb821dad2
echo 'src/gz netify https://download.netify.ai/5/openwrt/22.03/x86' >> /etc/opkg/customfeeds.conf

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
opkg update
opkg install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
wget https://download.netify.ai/5/openwrt/key-build.pub -O /etc/opkg/keys/b18c240cb821dad2
echo 'src/gz netify https://download.netify.ai/5/openwrt/21.02/x86' >> /etc/opkg/customfeeds.conf

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
opkg update
opkg install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
wget https://download.netify.ai/5/openwrt/key-build.pub -O /etc/opkg/keys/b18c240cb821dad2
echo 'src/gz netify https://download.netify.ai/5/openwrt/19.07/x86' >> /etc/opkg/customfeeds.conf

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
opkg update
opkg install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
sudo rpm --import https://download.netify.ai/5/opensuse/15.5/stable/RPM-GPG-KEY-netify
sudo curl https://download.netify.ai/5/opensuse/netify.repo -o /etc/zypp/repos.d/repo-netify.repo

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
sudo zypper update
sudo zypper install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
sudo rpm --import https://download.netify.ai/5/almalinux/9/stable/RPM-GPG-KEY-netify
sudo curl https://download.netify.ai/5/almalinux/9/netify.repo -o /etc/yum.repos.d/netify.repo

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
sudo apt update
sudo apt install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
sudo rpm --import https://download.netify.ai/5/almalinux/8/stable/RPM-GPG-KEY-netify
sudo curl https://download.netify.ai/5/almalinux/8/netify.repo -o /etc/yum.repos.d/netify.repo

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
sudo apt update
sudo apt install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
sudo rpm --import http://download.netify.ai/5/rockylinux/9/stable/RPM-GPG-KEY-netify
sudo curl https://download.netify.ai/5/rockylinux/9/netify.repo -o /etc/yum.repos.d/netify.repo

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
sudo yum update
sudo yum install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
sudo rpm --import http://download.netify.ai/5/rockylinux/8/stable/RPM-GPG-KEY-netify
sudo curl https://download.netify.ai/5/rockylinux/8/netify.repo -o /etc/yum.repos.d/netify.repo

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
sudo yum update
sudo yum install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
mkdir -p /usr/local/etc/pkg/fingerprints/Netify/trusted
curl https://download.netify.ai/5/opnsense/fingerprint -o /usr/local/etc/pkg/fingerprints/Netify/trusted/fingerprint
cat << EOF >  /usr/local/etc/pkg/repos/Netify.conf
Netify: {
  fingerprints: "/usr/local/etc/pkg/fingerprints/Netify",
  url: "https://download.netify.ai/5/opnsense/25.7",
  signature_type: "fingerprints",
  mirror_type: "http",
  priority: 11,
  enabled: yes
}
EOF

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
pkg update
pkg install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
mkdir -p /usr/local/etc/pkg/fingerprints/Netify/trusted
curl https://download.netify.ai/5/opnsense/fingerprint -o /usr/local/etc/pkg/fingerprints/Netify/trusted/fingerprint
cat << EOF >  /usr/local/etc/pkg/repos/Netify.conf
Netify: {
  fingerprints: "/usr/local/etc/pkg/fingerprints/Netify",
  url: "https://download.netify.ai/5/opnsense/24.7",
  signature_type: "fingerprints",
  mirror_type: "http",
  priority: 11,
  enabled: yes
}
EOF

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
pkg update
pkg install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
mkdir -p /usr/local/etc/pkg/fingerprints/Netify/trusted
curl https://download.netify.ai/5/freebsd/fingerprint -o /usr/local/etc/pkg/fingerprints/Netify/trusted/fingerprint
cat << EOF >  /usr/local/etc/pkg/repos/Netify.conf
Netify: {
  fingerprints: "/usr/local/etc/pkg/fingerprints/Netify",
  url: "https://download.netify.ai/5/freebsd/15.0",
  signature_type: "fingerprints",
  mirror_type: "http",
  priority: 11,
  enabled: yes
}
EOF

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
pkg update
pkg install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
mkdir -p /usr/local/etc/pkg/fingerprints/Netify/trusted
curl https://download.netify.ai/5/freebsd/fingerprint -o /usr/local/etc/pkg/fingerprints/Netify/trusted/fingerprint
cat << EOF >  /usr/local/etc/pkg/repos/Netify.conf
Netify: {
  fingerprints: "/usr/local/etc/pkg/fingerprints/Netify",
  url: "https://download.netify.ai/5/freebsd/14.0",
  signature_type: "fingerprints",
  mirror_type: "http",
  priority: 11,
  enabled: yes
}
EOF

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
pkg update
pkg install netify-proc-core

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
mkdir -p /usr/local/etc/pkg/fingerprints/Netify/trusted
curl https://download.netify.ai/5/freebsd/fingerprint -o /usr/local/etc/pkg/fingerprints/Netify/trusted/fingerprint
cat << EOF >  /usr/local/etc/pkg/repos/Netify.conf
Netify: {
  fingerprints: "/usr/local/etc/pkg/fingerprints/Netify",
  url: "https://download.netify.ai/5/freebsd/14.0",
  signature_type: "fingerprints",
  mirror_type: "http",
  priority: 11,
  enabled: yes
}
EOF

Step 3 - Install Netify Core Processor:

Terminal - Netify
× 
pkg update
pkg install netify-proc-core

Setup

All plugins are disabled by default, and the Netify Core Processor plugin is no different. Use the --enable-plugin and --disable-plugin parameters to enable/disable the plugin:

Terminal - Netify
× 
netifyd --enable-plugin proc-core
netifyd --disable-plugin proc-core

Alternatively, you can edit /etc/netifyd/plugins.d/10-netify-proc-core.conf and set enable to yes.

Terminal - Netify
× 
[proc-core]
enable = yes
plugin_library = /usr/lib64/libnetify-proc-core.so.0.0.0
conf_filename = ${path_state_persistent}/netify-proc-core.json

Main Configuration

Once the plugin has been enabled, it can be configured using the JSON configuration file specified in the plugin loader configuration. Let's look at a configuration sample to review the syntax and parts of the file.

format

string

Default payload format.

Options
json, msgpack

compressor

string

Default compression policy.

Options
none, gz

sinks

object

An object array of Netify Sink objects

Reference
See Sink Configuration section below

Example Core Plugin Configuration

{
    "format": "json",
    "compressor": "none",
    "sinks": {
        "sink-log": {
            "stats": {
                "enable": true,
                "types": [ "stream-stats" ]
            }
        }
    }
}

Sink Configuration

We need to send our telemetry to a configured output using a Sink Plugin: log, socket, message queue, etc. This sink configuration is highly flexible, but it can also be easy to misconfigure if the relationships between components are not clear. Let's get started.

Sink Tag - First Level Key

The Core Processor’s sinks object determines which sinks (outputs) receive the telemetry data and how the data should be sent to each one. A single processor can send data to multiple sinks, but in this example it is configured to send to only one.

The sink tag is the first-level key under the sinks property. This key must match the section name defined by the corresponding plugin loader. In our example, the sink tag is sink-log , which must exactly match the loader section name sink-log as shown below:

Sinks Configuration - Overview

"sinks": {
    "sink-log": {
        "stats": {
            "enable": true,
            "types": [ ... ],
            ... other properties ...
        }
    }
}
Terminal - Netify
× 
$ cat /etc/netifyd/plugins.d/10-netify-sink-log.conf
[sink-log]
enable = yes
plugin_library = /usr/lib64/libnetify-sink-log.so.0.0.0
conf_filename = ${path_state_persistent}/netify-sink-log.json

Here we can see that the section name [sink-log] matches the sink tag used in the Core configuration. The presence of this configuration file indicates that the plugin has been installed, and the enable = yes setting confirms that it is currently enabled. The loader configuration also specifies the sink’s runtime configuration file through the conf_filename property.

This mapping is critical: if the names do not match, the processor will not be able to deliver data to the sink.

The Channel - Second Level Key

The second-level key in JSON configuration is the channel. Sink output channels provide a way to separate different types of telemetry into different output targets. For example, you can send:

  • aggregator data to /tmp/netify-aggregate-x
  • interface statistics to /tmp/netify-interface-stats-x
  • intelligence detections to /tmp/netify-intelligence-x

This channel must be configured in the target sink configuration as shown.

Refer to the relevant Sink Plugin configuration for channel configuration details.

Sink Log Config: /etc/netifyd/netify-sink-log.json

{
    "overwrite": false,
    "log_path": "/tmp",
    "channels": {
        "stats": {
            "overwrite": true,
            "log_path": "/tmp",
            "log_name": "netify-stats-"
        }
    }
}

Channel Properties

{sink-tag}.{channel}.enable

boolean

Flag to enable/disable the channel.

{sink-tag}.{channel}.types

array

Telemetry type - see telemetry section.

Options
stream-flows, stream-stats

{sink-tag}.{channel}.format

string

The aggregator processor data format - overrides default.

Options
json, msgpack

{sink-tag}.{channel}.compressor

string

The compression policy - overrides default.

Options
none, gz

Example Sinks Configuration

{
    ...
    "sinks": {
        "sink-log": {
            "stats": {
                "enable": true,
                "types": [ "stream-flows" ],
                "format": "json",
                "compressor": "none"
            }
        }
    }
}

Telemetry

There are seven telemetry data types available from the two driver types in the Core plugin, detailed below. The examples provided in the next section show how to direct your selected telemetry to your configured outputs.

Flow Telemetry

The stream-flows telemetry type provides details about the lifecycle of a flow, along with statistics and metrics.

Flows
Flow metadata and lifecycle information.
Flow Stats
Bandwidth stats and KPIs analyzed over a configurable time interval.
Flow Purge
Details on a flow at the end of its lifecycle.

Network and Performance Telemetry

The stream-stats telemetry type provides details about agent performance, network endpoints, and interface information.

Agent Status
Netify agent memory, CPU performance, flow counts, and other metrics.
Endpoints
Network IP and MAC mapping for devices discovered on the network.
Interfaces
Network interface MACs, IPs, role and capture type.
Interface Stats
Network interface performance data.

Examples

Typically, only one or two Sink Plugins targets are enabled in a production environment, but this configuration example provides a broad range of targets.

The sink naming conventions, channels, and state of the plugin all need to be aligned. The Netify Agent will refuse to start if something is not properly configured.

sink-http

The Sink HTTP plugin is configured to receive the stream-stats network and performance telemetry in JSON with compression enabled. The data will be posted to the HTTP endpoint every 15 seconds (configurable).

sink-log

The Sink Log plugin is configured to log the stream-stats network and performance telemetry every 15 seconds. This falls back to the default format (JSON) configured in the top-level format property.

sink-socket

The Sink Socket plugin is configured to receive both the stream-flows and stream-stats telemetry on a WebSocket. The stream-flows will arrive as flows are detected, while the stream-stats data will be pushed every 15 seconds. This entry is disabled.

sink-mqtt

The Sink MQTT plugin is configured to receive both the stream-flows and stream-stats telemetry on different channels. In the case of MQTT, this means the two streams will appear on two different topics. The MessagePack format is used instead of JSON.

Complex Sink Log Configuration

{
   "format": "json",
   "compressor": "none",
   "sinks": {
      "sink-http": {
         "stats": {
            "enable": true,
            "types": [ "stream-stats" ],
            "format": "json",
            "compressor": "gz"
         }
      },
      "sink-log": {
         "default": {
            "enable": true,
            "types": [ "stream-stats" ]
         }
      },
      "sink-socket": {
         "websocket": {
            "enable": false,
            "types": [ "stream-flows", "stream-stats" ]
         }
      },
      "sink-mqtt": {
         "flows": {
            "enable": true,
            "types": [ "stream-flows" ],
            "format": "msgpack"
         },
         "stats": {
            "enable": true,
            "types": [ "stream-stats" ],
            "format": "msgpack"
         }
      }
   }
}