vflow
vflow copied to clipboard
Use the length as specified by the template instead of the ipfix.elements
I modify the ipfix.elements for netflow, one definition as follow: 10:
- unsigned16
- input_snmp
Definition in RFC 3954: Input interface index. INPUT_SNMP 10 N By default N is 2, but higher values can be used
After test, i found that the input_snmp is 0 (should be 3). After debug, found that the flow simulator send 4bytes in input_snmp , After review netflow.rb, I found the comments as follows:
Small bit of fixup for:
# - skip or string field types where the length is dynamic
# - uint(8|16|24|32|64} where we use the length as specified by the
# template instead of the YAML (e.g. ipv6_flow_label is 3 bytes in
# the YAML and Cisco doc, but Cisco ASR9k sends 4 bytes).
# Another usecase is supporting reduced-size encoding as per RFC7011 6.2
# - application_id where we use the length as specified by the
template and map it to custom types for handling.
copy from https://github.com/logstash-plugins/logstash-codec-netflow/blob/master/lib/logstash/codecs/netflow.rb
Maybe we should do that: uint(8|16|24|32|64} where we use the length as specified by the template instead of the YAML (e.g. ipv6_flow_label is 3 bytes in