Hi Jake,
Good length is fixed. About the inconsistencies i'm very willing to
support you with those. If you want to have a closer look at those
see nf9_init_template() in src/nfprobe_plugin/netflow9.c (which
handles both NetFlow v9 and IPFIX). Alternatively, feel free to send
over privately your current configs and a capture in pcap format of
the IPFIX emitted by nfprobe plugin.
Couple of comments on this round of things you pointed out:
* input and output interfaces have been fixed, code is in the CVS;
in general you can expect more of this occurrences to be there as
there is a single root cause: field lenghts were ported to IPFIX
from NetFlow v9.
* IP version and IPv4 source address being inconsistent: i can't
verify/reproduce this in lab. If i run the IPFIX export through
tshark i get the following (which looks OK to me):
[ .. ]
Set 3
FlowSet Id: (Data) (1024)
FlowSet Length: 132
Flow 1
[Duration: 1.626000000 seconds]
StartTime: 0.137000000 seconds
EndTime: 1.763000000 seconds
Octets: 4280
Packets: 7
IPVersion: 04
InputInt: 0
OutputInt: 100
Direction: Ingress (0)
SrcAddr: XX.XX.158.133 (XX.XX.158.133)
DstAddr: XX.XXX.159.164 (XX.XXX.159.164)
BGPNextHop: 0.0.0.0 (0.0.0.0)
SrcMask: 24
DstMask: 24
SrcPort: 22
DstPort: 41589
IP ToS: 0x00
TCP Flags: 0x18
Protocol: 6
SrcAS: 0
DstAS: 0
[ .. ]
I'd need a way to reproduce your issue.
Cheers,
Paolo
On Thu, Jun 05, 2014 at 06:07:37PM +0200, jake wrote:
> Hi Paolo,
>
> thanks a lot!
> I get the correct length of octetDeltaCount now.
>
> After taking a closer look at the template advertisements I think
> there're still a few inconsistences (either in my collector or your
> exporter :)
>
> Here's an example with edited IP address:
>
> Data Record (first 32B)
> [0 50 182 16 0 50 96 26 0 0 0 0 0 0 22 229 0 0 0 0 0 0 0 28 4 0
> 0 0 0 0 192 168]
>
> Template Field Specifiers
> id: 21 length: 4
> id: 1 length: 8
> id: 60 length: 1 <-- ipVersion is 0 in Data Record
> id: 14 length: 2 <-- egressInterface should be 4B
> id: 8 length: 4 <-- sourceIPv4Address
> id: 7 length: 2
> id: 5 length: 1
> id: 4 length: 1
> id: 1025 length: 15
> id: 22 length: 4
> id: 2 length: 8
> id: 10 length: 2 <-- ingressInterface should be 4B
> id: 61 length: 1
> id: 12 length: 4
> id: 11 length: 2
>
> What looks strange to me:
> 1) egressInterface and ingressInterface are 2B (should be 4B)
> 2) ipVersion is 0 in Data Record
> 2) sourceIPv4Address doesn't match the advertized offset
>
> Can you point me to the LOC where the template is built?
> I couldn't find it by glancing over the source.
>
> Best,
> Jake
>
> On Thu, Jun 05, 2014 at 07:08:34AM +0000, Paolo Lucente wrote:
> >Hi,
> >
> >Thanks for reporting this. Issue should be fixed now in the
> >code in the CVS (tests good to me). Can you verify it seems
> >to work allright to you too?
> >
> >Cheers,
> >Paolo
> >
> >On Wed, Jun 04, 2014 at 12:00:33PM +0200, [email protected] wrote:
> >>Hi,
> >>
> >>I'm using pmacct as an IPFIX-exporter.
> >>It seems in the Template the octetDeltaCount is advertized as 32 bits
> >>whereas the actual length in the Data Set is 64 bits.
> >>According to RFC [1] the octetDeltaCount is 64 bits long.
> >>
> >>Can anyone confirm the error (or even fix it)?
> >>
> >>Best,
> >>Jake
> >>
> >>[1] RFC5102, 5.10.1
> >>~
> >>
> >>_______________________________________________
> >>pmacct-discussion mailing list
> >>http://www.pmacct.net/#mailinglists
> >
> >_______________________________________________
> >pmacct-discussion mailing list
> >http://www.pmacct.net/#mailinglists
>
> _______________________________________________
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
