vflow icon indicating copy to clipboard operation
vflow copied to clipboard

Use the length as specified by the template instead of the ipfix.elements

Open lwsbox opened this issue 7 years ago • 0 comments

I modify the ipfix.elements for netflow, one definition as follow: 10:

  • unsigned16
  • input_snmp

Definition in RFC 3954: Input interface index. INPUT_SNMP 10 N By default N is 2, but higher values can be used

After test, i found that the input_snmp is 0 (should be 3). After debug, found that the flow simulator send 4bytes in input_snmp , After review netflow.rb, I found the comments as follows:

Small bit of fixup for:

    # - skip or string field types where the length is dynamic
# - uint(8|16|24|32|64} where we use the length as specified by the
#   template instead of the YAML (e.g. ipv6_flow_label is 3 bytes in
#   the YAML and Cisco doc, but Cisco ASR9k sends 4 bytes).
#   Another usecase is supporting reduced-size encoding as per RFC7011 6.2
# - application_id where we use the length as specified by the 

template and map it to custom types for handling.

copy from https://github.com/logstash-plugins/logstash-codec-netflow/blob/master/lib/logstash/codecs/netflow.rb

Maybe we should do that: uint(8|16|24|32|64} where we use the length as specified by the template instead of the YAML (e.g. ipv6_flow_label is 3 bytes in

lwsbox avatar Dec 12 '18 08:12 lwsbox