diff --git a/Cargo.toml b/Cargo.toml index 2e107698..d386c4d4 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,7 +1,7 @@ [package] name = "netflow_parser" description = "Parser for Netflow Cisco V5, V7, V9, IPFIX" -version = "0.5.8" +version = "0.5.9" edition = "2024" authors = ["michael.mileusnich@gmail.com"] license = "MIT OR Apache-2.0" diff --git a/RELEASES.md b/RELEASES.md index 0846aed1..6b084cb8 100644 --- a/RELEASES.md +++ b/RELEASES.md @@ -1,3 +1,15 @@ +# 0.5.9 +* IPFIX now supports multiple Templates in a flow +* Fixed bug with parsing IPFix fields that would omit some data. +* New IPFix FlowSetBody type added called NoTemplate and Empty. +* NoTemplate returns data that allows you to cache flows that do not have a template for later parsing. +* Correctly handling different Enterprise Field Types. +* Added Netscaler PEN Types. +* Added NAT PEN Types. +* Added YAF PEN Types. +* Added VMWARE PEN Types. +* Re-added Enterprise Field Type for Unknown Enterprise Types. + # 0.5.8 * V9 Found and fixed divide by 0 issue. * IPFix Protocol Identifier now parsers as ProtocolIdentifier Field Type and not UnsignedDataNumber. diff --git a/src/netflow_common.rs b/src/netflow_common.rs index d61ec39e..aa39830f 100644 --- a/src/netflow_common.rs +++ b/src/netflow_common.rs @@ -5,7 +5,7 @@ use crate::NetflowPacket; use crate::protocol::ProtocolTypes; use crate::static_versions::{v5::V5, v7::V7}; use crate::variable_versions::data_number::FieldValue; -use crate::variable_versions::ipfix_lookup::IPFixField; +use crate::variable_versions::ipfix_lookup::{IANAIPFixField, IPFixField}; use crate::variable_versions::v9_lookup::V9Field; use crate::variable_versions::{ ipfix::{FlowSetBody as IPFixFlowSetBody, IPFix}, @@ -125,7 +125,7 @@ impl From<&V9> for NetflowCommon { if let V9FlowSetBody::Data(data) = &flowset.body { for data_field in &data.fields { let value_map: BTreeMap = - data_field.values().cloned().collect(); + data_field.clone().into_iter().collect(); flowsets.push(NetflowCommonFlowSet { src_addr: value_map .get(&V9Field::Ipv4SrcAddr) @@ -184,43 +184,50 @@ impl From<&IPFix> for NetflowCommon { if let IPFixFlowSetBody::Data(data) = &flowset.body { for data_field in &data.fields { let value_map: BTreeMap = - data_field.values().cloned().collect(); + data_field.clone().into_iter().collect(); flowsets.push(NetflowCommonFlowSet { src_addr: value_map - .get(&IPFixField::SourceIpv4address) - .or_else(|| value_map.get(&IPFixField::SourceIpv6address)) + .get(&IPFixField::IANA(IANAIPFixField::SourceIpv4address)) + .or_else(|| { + value_map + .get(&IPFixField::IANA(IANAIPFixField::SourceIpv6address)) + }) .and_then(|v| v.try_into().ok()), dst_addr: value_map - .get(&IPFixField::DestinationIpv4address) - .or_else(|| value_map.get(&IPFixField::DestinationIpv6address)) + .get(&IPFixField::IANA(IANAIPFixField::DestinationIpv4address)) + .or_else(|| { + value_map.get(&IPFixField::IANA( + IANAIPFixField::DestinationIpv6address, + )) + }) .and_then(|v| v.try_into().ok()), src_port: value_map - .get(&IPFixField::SourceTransportPort) + .get(&IPFixField::IANA(IANAIPFixField::SourceTransportPort)) .and_then(|v| v.try_into().ok()), dst_port: value_map - .get(&IPFixField::DestinationTransportPort) + .get(&IPFixField::IANA(IANAIPFixField::DestinationTransportPort)) .and_then(|v| v.try_into().ok()), protocol_number: value_map - .get(&IPFixField::ProtocolIdentifier) + .get(&IPFixField::IANA(IANAIPFixField::ProtocolIdentifier)) .and_then(|v| v.try_into().ok()), - protocol_type: value_map.get(&IPFixField::ProtocolIdentifier).and_then( - |v| { + protocol_type: value_map + .get(&IPFixField::IANA(IANAIPFixField::ProtocolIdentifier)) + .and_then(|v| { v.try_into() .ok() .map(|proto: u8| ProtocolTypes::from(proto)) - }, - ), + }), first_seen: value_map - .get(&IPFixField::FlowStartSysUpTime) + .get(&IPFixField::IANA(IANAIPFixField::FlowStartSysUpTime)) .and_then(|v| v.try_into().ok()), last_seen: value_map - .get(&IPFixField::FlowEndSysUpTime) + .get(&IPFixField::IANA(IANAIPFixField::FlowEndSysUpTime)) .and_then(|v| v.try_into().ok()), src_mac: value_map - .get(&IPFixField::SourceMacaddress) + .get(&IPFixField::IANA(IANAIPFixField::SourceMacaddress)) .and_then(|v| v.try_into().ok()), dst_mac: value_map - .get(&IPFixField::DestinationMacaddress) + .get(&IPFixField::IANA(IANAIPFixField::DestinationMacaddress)) .and_then(|v| v.try_into().ok()), }); } @@ -237,8 +244,6 @@ impl From<&IPFix> for NetflowCommon { #[cfg(test)] mod common_tests { - - use std::collections::BTreeMap; use std::net::{IpAddr, Ipv4Addr}; use crate::netflow_common::NetflowCommon; @@ -249,7 +254,7 @@ mod common_tests { Data as IPFixData, FlowSet as IPFixFlowSet, FlowSetBody as IPFixFlowSetBody, FlowSetHeader as IPFixFlowSetHeader, Header as IPFixHeader, IPFix, }; - use crate::variable_versions::ipfix_lookup::IPFixField; + use crate::variable_versions::ipfix_lookup::{IANAIPFixField, IPFixField}; use crate::variable_versions::v9::{ Data as V9Data, FlowSet as V9FlowSet, FlowSetBody as V9FlowSetBody, FlowSetHeader as V9FlowSetHeader, Header as V9Header, V9, @@ -402,66 +407,39 @@ mod common_tests { }, body: V9FlowSetBody::Data(V9Data { padding: vec![], - fields: vec![BTreeMap::from([ + fields: vec![Vec::from([ ( - 0, - ( - V9Field::Ipv4SrcAddr, - FieldValue::Ip4Addr(Ipv4Addr::new(192, 168, 1, 1)), - ), + V9Field::Ipv4SrcAddr, + FieldValue::Ip4Addr(Ipv4Addr::new(192, 168, 1, 1)), ), ( - 1, - ( - V9Field::Ipv4DstAddr, - FieldValue::Ip4Addr(Ipv4Addr::new(192, 168, 1, 2)), - ), + V9Field::Ipv4DstAddr, + FieldValue::Ip4Addr(Ipv4Addr::new(192, 168, 1, 2)), ), ( - 2, - ( - V9Field::L4SrcPort, - FieldValue::DataNumber(DataNumber::U16(1234)), - ), + V9Field::L4SrcPort, + FieldValue::DataNumber(DataNumber::U16(1234)), ), ( - 3, - ( - V9Field::L4DstPort, - FieldValue::DataNumber(DataNumber::U16(80)), - ), + V9Field::L4DstPort, + FieldValue::DataNumber(DataNumber::U16(80)), ), + (V9Field::Protocol, FieldValue::DataNumber(DataNumber::U8(6))), ( - 4, - (V9Field::Protocol, FieldValue::DataNumber(DataNumber::U8(6))), + V9Field::FirstSwitched, + FieldValue::DataNumber(DataNumber::U32(100)), ), ( - 5, - ( - V9Field::FirstSwitched, - FieldValue::DataNumber(DataNumber::U32(100)), - ), + V9Field::LastSwitched, + FieldValue::DataNumber(DataNumber::U32(200)), ), ( - 6, - ( - V9Field::LastSwitched, - FieldValue::DataNumber(DataNumber::U32(200)), - ), + V9Field::InSrcMac, + FieldValue::MacAddr("00:00:00:00:00:01".to_string()), ), ( - 7, - ( - V9Field::InSrcMac, - FieldValue::MacAddr("00:00:00:00:00:01".to_string()), - ), - ), - ( - 8, - ( - V9Field::InDstMac, - FieldValue::MacAddr("00:00:00:00:00:02".to_string()), - ), + V9Field::InDstMac, + FieldValue::MacAddr("00:00:00:00:00:02".to_string()), ), ])], }), @@ -511,70 +489,42 @@ mod common_tests { length: 0, }, body: IPFixFlowSetBody::Data(IPFixData { - padding: vec![], - fields: vec![BTreeMap::from([ + fields: vec![Vec::from([ ( - 0, - ( - IPFixField::SourceIpv4address, - FieldValue::Ip4Addr(Ipv4Addr::new(192, 168, 1, 1)), - ), + IPFixField::IANA(IANAIPFixField::SourceIpv4address), + FieldValue::Ip4Addr(Ipv4Addr::new(192, 168, 1, 1)), ), ( - 1, - ( - IPFixField::DestinationIpv4address, - FieldValue::Ip4Addr(Ipv4Addr::new(192, 168, 1, 2)), - ), + IPFixField::IANA(IANAIPFixField::DestinationIpv4address), + FieldValue::Ip4Addr(Ipv4Addr::new(192, 168, 1, 2)), ), ( - 2, - ( - IPFixField::SourceTransportPort, - FieldValue::DataNumber(DataNumber::U16(1234)), - ), + IPFixField::IANA(IANAIPFixField::SourceTransportPort), + FieldValue::DataNumber(DataNumber::U16(1234)), ), ( - 3, - ( - IPFixField::DestinationTransportPort, - FieldValue::DataNumber(DataNumber::U16(80)), - ), + IPFixField::IANA(IANAIPFixField::DestinationTransportPort), + FieldValue::DataNumber(DataNumber::U16(80)), ), ( - 4, - ( - IPFixField::ProtocolIdentifier, - FieldValue::DataNumber(DataNumber::U8(6)), - ), + IPFixField::IANA(IANAIPFixField::ProtocolIdentifier), + FieldValue::DataNumber(DataNumber::U8(6)), ), ( - 5, - ( - IPFixField::FlowStartSysUpTime, - FieldValue::DataNumber(DataNumber::U32(100)), - ), + IPFixField::IANA(IANAIPFixField::FlowStartSysUpTime), + FieldValue::DataNumber(DataNumber::U32(100)), ), ( - 6, - ( - IPFixField::FlowEndSysUpTime, - FieldValue::DataNumber(DataNumber::U32(200)), - ), + IPFixField::IANA(IANAIPFixField::FlowEndSysUpTime), + FieldValue::DataNumber(DataNumber::U32(200)), ), ( - 7, - ( - IPFixField::SourceMacaddress, - FieldValue::MacAddr("00:00:00:00:00:01".to_string()), - ), + IPFixField::IANA(IANAIPFixField::SourceMacaddress), + FieldValue::MacAddr("00:00:00:00:00:01".to_string()), ), ( - 8, - ( - IPFixField::DestinationMacaddress, - FieldValue::MacAddr("00:00:00:00:00:02".to_string()), - ), + IPFixField::IANA(IANAIPFixField::DestinationMacaddress), + FieldValue::MacAddr("00:00:00:00:00:02".to_string()), ), ])], }), diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_0_length_fields_ipfix.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_0_length_fields_ipfix.snap index 02b51621..739ceb88 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_0_length_fields_ipfix.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_0_length_fields_ipfix.snap @@ -19,26 +19,26 @@ expression: "NetflowParser::default().parse_bytes(&packet)" field_count: 3 fields: - field_type_number: 8 - field_type: SourceIpv4address field_length: 4 + field_type: + IANA: SourceIpv4address - field_type_number: 12 - field_type: DestinationIpv4address field_length: 4 + field_type: + IANA: DestinationIpv4address - field_type_number: 65 - field_type: AssignedforNetFlowv9compatibility field_length: 0 + field_type: + IANA: AssignedforNetFlowv9compatibility - header: header_id: 256 length: 12 body: Data: fields: - - 0: - - SourceIpv4address + - - - IANA: SourceIpv4address - Ip4Addr: 1.2.3.4 - - 1: - - DestinationIpv4address + - - IANA: DestinationIpv4address - Ip4Addr: 1.2.3.4 - - 2: - - AssignedforNetFlowv9compatibility + - - IANA: AssignedforNetFlowv9compatibility - Vec: [] diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix.snap index b241f121..a4c2494a 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix.snap @@ -19,35 +19,32 @@ expression: "NetflowParser::default().parse_bytes(&packet)" field_count: 3 fields: - field_type_number: 8 - field_type: SourceIpv4address field_length: 4 + field_type: + IANA: SourceIpv4address - field_type_number: 12 - field_type: DestinationIpv4address field_length: 4 + field_type: + IANA: DestinationIpv4address - field_type_number: 2 - field_type: PacketDeltaCount field_length: 4 + field_type: + IANA: PacketDeltaCount - header: header_id: 256 length: 28 body: Data: fields: - - 0: - - SourceIpv4address + - - - IANA: SourceIpv4address - Ip4Addr: 1.2.3.4 - - 1: - - DestinationIpv4address + - - IANA: DestinationIpv4address - Ip4Addr: 1.2.3.3 - - 2: - - PacketDeltaCount + - - IANA: PacketDeltaCount - DataNumber: 16909058 - - 0: - - SourceIpv4address + - - - IANA: SourceIpv4address - Ip4Addr: 0.2.0.2 - - 1: - - DestinationIpv4address + - - IANA: DestinationIpv4address - Ip4Addr: 0.1.2.3 - - 2: - - PacketDeltaCount + - - IANA: PacketDeltaCount - DataNumber: 67438087 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_data_cached_template.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_data_cached_template.snap index 94e2db70..b60b16b9 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_data_cached_template.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_data_cached_template.snap @@ -16,9 +16,7 @@ expression: parser.parse_bytes(&packet) body: Data: fields: - - 0: - - PacketDeltaCount + - - - IANA: PacketDeltaCount - DataNumber: 8 - - 1: - - SourceIpv4address + - - IANA: SourceIpv4address - Ip4Addr: 0.0.1.1 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_enterprise_bit_in_non_options_template.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_enterprise_bit_in_non_options_template.snap index be05551e..25193dea 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_enterprise_bit_in_non_options_template.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_enterprise_bit_in_non_options_template.snap @@ -19,11 +19,12 @@ expression: "NetflowParser::default().parse_bytes(&packet)" field_count: 2 fields: - field_type_number: 103 - field_type: Layer2packetSectionSize field_length: 65535 enterprise_number: 407732327 - - field_type_number: 32767 field_type: - Unknown: 32767 + Enterprise: 103 + - field_type_number: 32767 field_length: 0 enterprise_number: 407732544 + field_type: + Enterprise: 32767 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_enterprise_bit_template_and_data.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_enterprise_bit_template_and_data.snap index 2d90680f..9a51b52b 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_enterprise_bit_template_and_data.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_enterprise_bit_template_and_data.snap @@ -19,140 +19,177 @@ expression: result field_count: 34 fields: - field_type_number: 12236 - field_type: CiscoClientIpv4Address field_length: 4 enterprise_number: 9 + field_type: + Cisco: CiscoClientIpv4Address - field_type_number: 12237 - field_type: CiscoServerIpv4Address field_length: 4 enterprise_number: 9 + field_type: + Cisco: CiscoServerIpv4Address - field_type_number: 12240 - field_type: CiscoClientL4Port field_length: 2 enterprise_number: 9 + field_type: + Cisco: + Unknown: 12240 - field_type_number: 12241 - field_type: CiscoServerL4Port field_length: 2 enterprise_number: 9 + field_type: + Cisco: + Unknown: 12241 - field_type_number: 234 - field_type: IngressVrfid field_length: 4 + field_type: + IANA: IngressVrfid - field_type_number: 10 - field_type: IngressInterface field_length: 4 + field_type: + IANA: IngressInterface - field_type_number: 239 - field_type: BiflowDirection field_length: 1 + field_type: + IANA: BiflowDirection - field_type_number: 12242 - field_type: CiscoConnectionId field_length: 4 enterprise_number: 9 + field_type: + Cisco: + Unknown: 12242 - field_type_number: 95 - field_type: ApplicationId field_length: 4 + field_type: + IANA: ApplicationId - field_type_number: 14 - field_type: EgressInterface field_length: 4 + field_type: + IANA: EgressInterface - field_type_number: 48 - field_type: SamplerId field_length: 1 + field_type: + IANA: SamplerId - field_type_number: 9252 - field_type: CiscoServicesWaasSegment field_length: 1 enterprise_number: 9 + field_type: + Cisco: CiscoServicesWaasSegment - field_type_number: 9253 - field_type: CiscoServicesWaasPassthroughReason field_length: 1 enterprise_number: 9 + field_type: + Cisco: CiscoServicesWaasPassthroughReason - field_type_number: 9357 - field_type: CiscoAppHttpUriStatistics field_length: 65535 enterprise_number: 9 + field_type: + Cisco: CiscoAppHttpUriStatistics - field_type_number: 12235 - field_type: CiscoAppHttpHost field_length: 65535 enterprise_number: 9 + field_type: + Cisco: CiscoAppHttpHost - field_type_number: 22 - field_type: FlowStartSysUpTime field_length: 4 + field_type: + IANA: FlowStartSysUpTime - field_type_number: 21 - field_type: FlowEndSysUpTime field_length: 4 + field_type: + IANA: FlowEndSysUpTime - field_type_number: 278 - field_type: NewConnectionDeltaCount field_length: 4 + field_type: + IANA: NewConnectionDeltaCount - field_type_number: 232 - field_type: ResponderOctets field_length: 8 + field_type: + IANA: ResponderOctets - field_type_number: 299 - field_type: ResponderPackets field_length: 8 + field_type: + IANA: ResponderPackets - field_type_number: 231 - field_type: InitiatorOctets field_length: 8 + field_type: + IANA: InitiatorOctets - field_type_number: 298 - field_type: InitiatorPackets field_length: 8 - - field_type_number: 9303 field_type: - Unknown: 9303 + IANA: InitiatorPackets + - field_type_number: 9303 field_length: 4 enterprise_number: 9 - - field_type_number: 9292 field_type: - Unknown: 9292 + Cisco: + Unknown: 9303 + - field_type_number: 9292 field_length: 4 enterprise_number: 9 - - field_type_number: 9300 field_type: - Unknown: 9300 + Cisco: + Unknown: 9292 + - field_type_number: 9300 field_length: 4 enterprise_number: 9 - - field_type_number: 9319 field_type: - Unknown: 9319 + Cisco: + Unknown: 9300 + - field_type_number: 9319 field_length: 4 enterprise_number: 9 - - field_type_number: 9316 field_type: - Unknown: 9316 + Cisco: + Unknown: 9319 + - field_type_number: 9316 field_length: 4 enterprise_number: 9 - - field_type_number: 9268 field_type: - Unknown: 9268 + Cisco: + Unknown: 9316 + - field_type_number: 9268 field_length: 4 enterprise_number: 9 - - field_type_number: 9313 field_type: - Unknown: 9313 + Cisco: + Unknown: 9268 + - field_type_number: 9313 field_length: 4 enterprise_number: 9 - - field_type_number: 9306 field_type: - Unknown: 9306 + Cisco: + Unknown: 9313 + - field_type_number: 9306 field_length: 4 enterprise_number: 9 - - field_type_number: 9307 field_type: - Unknown: 9307 + Cisco: + Unknown: 9306 + - field_type_number: 9307 field_length: 4 enterprise_number: 9 - - field_type_number: 9309 field_type: - Unknown: 9309 + Cisco: + Unknown: 9307 + - field_type_number: 9309 field_length: 4 enterprise_number: 9 - - field_type_number: 9273 field_type: - Unknown: 9273 + Cisco: + Unknown: 9309 + - field_type_number: 9273 field_length: 4 enterprise_number: 9 - - field_type_number: 9272 field_type: - Unknown: 9272 + Cisco: + Unknown: 9273 + - field_type_number: 9272 field_length: 4 enterprise_number: 9 + field_type: + Cisco: + Unknown: 9272 - IPFix: header: version: 10 @@ -167,153 +204,142 @@ expression: result body: Data: fields: - - 0: - - CiscoClientIpv4Address + - - - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.209.101.66 - - 1: - - CiscoServerIpv4Address + - - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.0.0.241 - - 2: - - CiscoClientL4Port - - DataNumber: 49376 - - 3: - - CiscoServerL4Port - - DataNumber: 80 - - 4: - - IngressVrfid + - - Cisco: + Unknown: 12240 + - Vec: + - 192 + - 224 + - - Cisco: + Unknown: 12241 + - Vec: + - 0 + - 80 + - - IANA: IngressVrfid - DataNumber: 0 - - 5: - - IngressInterface + - - IANA: IngressInterface - DataNumber: 13 - - 6: - - BiflowDirection + - - IANA: BiflowDirection - DataNumber: 1 - - 7: - - CiscoConnectionId - - DataNumber: 2378383328 - - 8: - - ApplicationId + - - Cisco: + Unknown: 12242 + - Vec: + - 141 + - 195 + - 63 + - 224 + - - IANA: ApplicationId - ApplicationId: classification_engine_id: 3 selector_id: 80 - - 9: - - EgressInterface + - - IANA: EgressInterface - DataNumber: 10 - - 10: - - SamplerId + - - IANA: SamplerId - DataNumber: 9 - - 11: - - CiscoServicesWaasSegment + - - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - - 12: - - CiscoServicesWaasPassthroughReason + - - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - - 13: - - CiscoAppHttpUriStatistics + - - Cisco: CiscoAppHttpUriStatistics - String: "/DocLib1\u0000\u0000\u0001" - - 14: - - CiscoAppHttpHost + - - Cisco: CiscoAppHttpHost - String: "\u0003\u0000\u0000P4\u0002portal.medsigroup.ru" - - 15: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 564191867 - - 16: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 564303806 - - 17: - - NewConnectionDeltaCount + - - IANA: NewConnectionDeltaCount - DataNumber: 1 - - 18: - - ResponderOctets + - - IANA: ResponderOctets - DataNumber: 0 - - 19: - - ResponderPackets + - - IANA: ResponderPackets - DataNumber: 0 - - 20: - - InitiatorOctets + - - IANA: InitiatorOctets - DataNumber: 6208 - - 21: - - InitiatorPackets + - - IANA: InitiatorPackets - DataNumber: 15 - - 22: - - Unknown: 9303 + - - Cisco: + Unknown: 9303 - Vec: - 0 - 0 - 0 - 0 - - 23: - - Unknown: 9292 + - - Cisco: + Unknown: 9292 - Vec: - 0 - 0 - 0 - 0 - - 24: - - Unknown: 9300 + - - Cisco: + Unknown: 9300 - Vec: - 0 - 0 - 0 - 0 - - 25: - - Unknown: 9319 + - - Cisco: + Unknown: 9319 - Vec: - 0 - 0 - 0 - 0 - - 26: - - Unknown: 9316 + - - Cisco: + Unknown: 9316 - Vec: - 0 - 0 - 0 - 0 - - 27: - - Unknown: 9268 + - - Cisco: + Unknown: 9268 - Vec: - 0 - 0 - 0 - 0 - - 28: - - Unknown: 9313 + - - Cisco: + Unknown: 9313 - Vec: - 0 - 0 - 0 - 0 - - 29: - - Unknown: 9306 + - - Cisco: + Unknown: 9306 - Vec: - 0 - 0 - 0 - 0 - - 30: - - Unknown: 9307 + - - Cisco: + Unknown: 9307 - Vec: - 0 - 0 - 0 - 0 - - 31: - - Unknown: 9309 + - - Cisco: + Unknown: 9309 - Vec: - 0 - 0 - 0 - 0 - - 32: - - Unknown: 9273 + - - Cisco: + Unknown: 9273 - Vec: - 0 - 0 - 0 - 0 - - 33: - - Unknown: 9272 + - - Cisco: + Unknown: 9272 - Vec: - 0 - 0 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_mixed_enteprise_and_non_enterprise_fields.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_mixed_enteprise_and_non_enterprise_fields.snap index ac7a3599..f976a78d 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_mixed_enteprise_and_non_enterprise_fields.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_mixed_enteprise_and_non_enterprise_fields.snap @@ -19,76 +19,99 @@ expression: result field_count: 22 fields: - field_type_number: 12236 - field_type: CiscoClientIpv4Address field_length: 4 enterprise_number: 9 + field_type: + Cisco: CiscoClientIpv4Address - field_type_number: 12237 - field_type: CiscoServerIpv4Address field_length: 4 enterprise_number: 9 + field_type: + Cisco: CiscoServerIpv4Address - field_type_number: 4 - field_type: ProtocolIdentifier field_length: 1 + field_type: + IANA: ProtocolIdentifier - field_type_number: 195 - field_type: IpDiffServCodePoint field_length: 1 + field_type: + IANA: IpDiffServCodePoint - field_type_number: 192 - field_type: IpTtl field_length: 1 + field_type: + IANA: IpTtl - field_type_number: 12241 - field_type: CiscoServerL4Port field_length: 2 enterprise_number: 9 + field_type: + Cisco: + Unknown: 12241 - field_type_number: 234 - field_type: IngressVrfid field_length: 4 + field_type: + IANA: IngressVrfid - field_type_number: 95 - field_type: ApplicationId field_length: 4 + field_type: + IANA: ApplicationId - field_type_number: 58 - field_type: VlanId field_length: 2 + field_type: + IANA: VlanId - field_type_number: 10 - field_type: IngressInterface field_length: 4 + field_type: + IANA: IngressInterface - field_type_number: 239 - field_type: BiflowDirection field_length: 1 + field_type: + IANA: BiflowDirection - field_type_number: 9252 - field_type: CiscoServicesWaasSegment field_length: 1 enterprise_number: 9 + field_type: + Cisco: CiscoServicesWaasSegment - field_type_number: 14 - field_type: EgressInterface field_length: 4 + field_type: + IANA: EgressInterface - field_type_number: 9253 - field_type: CiscoServicesWaasPassthroughReason field_length: 1 enterprise_number: 9 + field_type: + Cisco: CiscoServicesWaasPassthroughReason - field_type_number: 22 - field_type: FlowStartSysUpTime field_length: 4 + field_type: + IANA: FlowStartSysUpTime - field_type_number: 21 - field_type: FlowEndSysUpTime field_length: 4 + field_type: + IANA: FlowEndSysUpTime - field_type_number: 278 - field_type: NewConnectionDeltaCount field_length: 4 + field_type: + IANA: NewConnectionDeltaCount - field_type_number: 279 - field_type: ConnectionSumDurationSeconds field_length: 8 + field_type: + IANA: ConnectionSumDurationSeconds - field_type_number: 232 - field_type: ResponderOctets field_length: 8 + field_type: + IANA: ResponderOctets - field_type_number: 299 - field_type: ResponderPackets field_length: 8 + field_type: + IANA: ResponderPackets - field_type_number: 231 - field_type: InitiatorOctets field_length: 8 + field_type: + IANA: InitiatorOctets - field_type_number: 298 - field_type: InitiatorPackets field_length: 8 + field_type: + IANA: InitiatorPackets - IPFix: header: version: 10 @@ -103,1091 +126,787 @@ expression: result body: Data: fields: - - 0: - - CiscoClientIpv4Address + - - - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.101.255.1 - - 1: - - CiscoServerIpv4Address + - - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.10.28.57 - - 2: - - ProtocolIdentifier + - - IANA: ProtocolIdentifier - ProtocolType: Udp - - 3: - - IpDiffServCodePoint + - - IANA: IpDiffServCodePoint - DataNumber: 0 - - 4: - - IpTtl + - - IANA: IpTtl - DataNumber: 255 - - 5: - - CiscoServerL4Port - - DataNumber: 2055 - - 6: - - IngressVrfid - - DataNumber: 0 - - 7: - - ApplicationId + - - Cisco: + Unknown: 12241 + - Vec: + - 8 + - 7 + - - IANA: IngressVrfid + - DataNumber: 0 + - - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 606 - - 8: - - VlanId + - - IANA: VlanId - DataNumber: 0 - - 9: - - IngressInterface + - - IANA: IngressInterface - DataNumber: 0 - - 10: - - BiflowDirection + - - IANA: BiflowDirection - DataNumber: 1 - - 11: - - CiscoServicesWaasSegment + - - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - - 12: - - EgressInterface + - - IANA: EgressInterface - DataNumber: 20 - - 13: - - CiscoServicesWaasPassthroughReason + - - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - - 14: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 4019387228 - - 15: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 4019440532 - - 16: - - NewConnectionDeltaCount + - - IANA: NewConnectionDeltaCount - DataNumber: 0 - - 17: - - ConnectionSumDurationSeconds + - - IANA: ConnectionSumDurationSeconds - DataNumber: 53 - - 18: - - ResponderOctets + - - IANA: ResponderOctets - DataNumber: 0 - - 19: - - ResponderPackets + - - IANA: ResponderPackets - DataNumber: 0 - - 20: - - InitiatorOctets + - - IANA: InitiatorOctets - DataNumber: 192505 - - 21: - - InitiatorPackets + - - IANA: InitiatorPackets - DataNumber: 155 - - 0: - - CiscoClientIpv4Address + - - - Cisco: CiscoClientIpv4Address - Ip4Addr: 172.31.255.1 - - 1: - - CiscoServerIpv4Address + - - Cisco: CiscoServerIpv4Address - Ip4Addr: 172.31.255.1 - - 2: - - ProtocolIdentifier + - - IANA: ProtocolIdentifier - ProtocolType: Udp - - 3: - - IpDiffServCodePoint + - - IANA: IpDiffServCodePoint - DataNumber: 0 - - 4: - - IpTtl + - - IANA: IpTtl - DataNumber: 254 - - 5: - - CiscoServerL4Port - - DataNumber: 3785 - - 6: - - IngressVrfid - - DataNumber: 0 - - 7: - - ApplicationId + - - Cisco: + Unknown: 12241 + - Vec: + - 14 + - 201 + - - IANA: IngressVrfid + - DataNumber: 0 + - - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - - 8: - - VlanId + - - IANA: VlanId - DataNumber: 0 - - 9: - - IngressInterface + - - IANA: IngressInterface - DataNumber: 1 - - 10: - - BiflowDirection + - - IANA: BiflowDirection - DataNumber: 1 - - 11: - - CiscoServicesWaasSegment + - - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - - 12: - - EgressInterface + - - IANA: EgressInterface - DataNumber: 1 - - 13: - - CiscoServicesWaasPassthroughReason + - - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - - 14: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 4019387232 - - 15: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 4019446788 - - 16: - - NewConnectionDeltaCount + - - IANA: NewConnectionDeltaCount - DataNumber: 0 - - 17: - - ConnectionSumDurationSeconds + - - IANA: ConnectionSumDurationSeconds - DataNumber: 120 - - 18: - - ResponderOctets + - - IANA: ResponderOctets - DataNumber: 0 - - 19: - - ResponderPackets + - - IANA: ResponderPackets - DataNumber: 0 - - 20: - - InitiatorOctets + - - IANA: InitiatorOctets - DataNumber: 2208 - - 21: - - InitiatorPackets + - - IANA: InitiatorPackets - DataNumber: 184 - - 0: - - CiscoClientIpv4Address + - - - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.208.22.118 - - 1: - - CiscoServerIpv4Address + - - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.101.22.251 - - 2: - - ProtocolIdentifier + - - IANA: ProtocolIdentifier - ProtocolType: Udp - - 3: - - IpDiffServCodePoint + - - IANA: IpDiffServCodePoint - DataNumber: 4 - - 4: - - IpTtl + - - IANA: IpTtl - DataNumber: 61 - - 5: - - CiscoServerL4Port - - DataNumber: 17654 - - 6: - - IngressVrfid - - DataNumber: 0 - - 7: - - ApplicationId + - - Cisco: + Unknown: 12241 + - Vec: + - 68 + - 246 + - - IANA: IngressVrfid + - DataNumber: 0 + - - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - - 8: - - VlanId + - - IANA: VlanId - DataNumber: 0 - - 9: - - IngressInterface + - - IANA: IngressInterface - DataNumber: 1 - - 10: - - BiflowDirection + - - IANA: BiflowDirection - DataNumber: 1 - - 11: - - CiscoServicesWaasSegment + - - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - - 12: - - EgressInterface + - - IANA: EgressInterface - DataNumber: 4 - - 13: - - CiscoServicesWaasPassthroughReason + - - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - - 14: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 4019387236 - - 15: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 4019437108 - - 16: - - NewConnectionDeltaCount + - - IANA: NewConnectionDeltaCount - DataNumber: 0 - - 17: - - ConnectionSumDurationSeconds + - - IANA: ConnectionSumDurationSeconds - DataNumber: 59 - - 18: - - ResponderOctets + - - IANA: ResponderOctets - DataNumber: 0 - - 19: - - ResponderPackets + - - IANA: ResponderPackets - DataNumber: 0 - - 20: - - InitiatorOctets + - - IANA: InitiatorOctets - DataNumber: 96 - - 21: - - InitiatorPackets + - - IANA: InitiatorPackets - DataNumber: 6 - - 0: - - CiscoClientIpv4Address + - - - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.0.151.220 - - 1: - - CiscoServerIpv4Address + - - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.101.151.95 - - 2: - - ProtocolIdentifier + - - IANA: ProtocolIdentifier - ProtocolType: Udp - - 3: - - IpDiffServCodePoint + - - IANA: IpDiffServCodePoint - DataNumber: 0 - - 4: - - IpTtl + - - IANA: IpTtl - DataNumber: 60 - - 5: - - CiscoServerL4Port - - DataNumber: 57339 - - 6: - - IngressVrfid - - DataNumber: 0 - - 7: - - ApplicationId + - - Cisco: + Unknown: 12241 + - Vec: + - 223 + - 251 + - - IANA: IngressVrfid + - DataNumber: 0 + - - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - - 8: - - VlanId + - - IANA: VlanId - DataNumber: 0 - - 9: - - IngressInterface + - - IANA: IngressInterface - DataNumber: 1 - - 10: - - BiflowDirection + - - IANA: BiflowDirection - DataNumber: 1 - - 11: - - CiscoServicesWaasSegment + - - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - - 12: - - EgressInterface + - - IANA: EgressInterface - DataNumber: 4 - - 13: - - CiscoServicesWaasPassthroughReason + - - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - - 14: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 4019387306 - - 15: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 4019447034 - - 16: - - NewConnectionDeltaCount + - - IANA: NewConnectionDeltaCount - DataNumber: 0 - - 17: - - ConnectionSumDurationSeconds + - - IANA: ConnectionSumDurationSeconds - DataNumber: 59 - - 18: - - ResponderOctets + - - IANA: ResponderOctets - DataNumber: 0 - - 19: - - ResponderPackets + - - IANA: ResponderPackets - DataNumber: 0 - - 20: - - InitiatorOctets + - - IANA: InitiatorOctets - DataNumber: 15264 - - 21: - - InitiatorPackets + - - IANA: InitiatorPackets - DataNumber: 24 - - 0: - - CiscoClientIpv4Address + - - - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.101.22.251 - - 1: - - CiscoServerIpv4Address + - - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.25.22.18 - - 2: - - ProtocolIdentifier + - - IANA: ProtocolIdentifier - ProtocolType: Udp - - 3: - - IpDiffServCodePoint + - - IANA: IpDiffServCodePoint - DataNumber: 0 - - 4: - - IpTtl + - - IANA: IpTtl - DataNumber: 126 - - 5: - - CiscoServerL4Port - - DataNumber: 5001 - - 6: - - IngressVrfid - - DataNumber: 0 - - 7: - - ApplicationId + - - Cisco: + Unknown: 12241 + - Vec: + - 19 + - 137 + - - IANA: IngressVrfid + - DataNumber: 0 + - - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - - 8: - - VlanId + - - IANA: VlanId - DataNumber: 0 - - 9: - - IngressInterface + - - IANA: IngressInterface - DataNumber: 4 - - 10: - - BiflowDirection + - - IANA: BiflowDirection - DataNumber: 1 - - 11: - - CiscoServicesWaasSegment + - - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - - 12: - - EgressInterface + - - IANA: EgressInterface - DataNumber: 20 - - 13: - - CiscoServicesWaasPassthroughReason + - - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - - 14: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 4019387310 - - 15: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 4019446976 - - 16: - - NewConnectionDeltaCount + - - IANA: NewConnectionDeltaCount - DataNumber: 0 - - 17: - - ConnectionSumDurationSeconds + - - IANA: ConnectionSumDurationSeconds - DataNumber: 59 - - 18: - - ResponderOctets + - - IANA: ResponderOctets - DataNumber: 0 - - 19: - - ResponderPackets + - - IANA: ResponderPackets - DataNumber: 0 - - 20: - - InitiatorOctets + - - IANA: InitiatorOctets - DataNumber: 5872 - - 21: - - InitiatorPackets + - - IANA: InitiatorPackets - DataNumber: 367 - - 0: - - CiscoClientIpv4Address + - - - Cisco: CiscoClientIpv4Address - Ip4Addr: 224.0.0.5 - - 1: - - CiscoServerIpv4Address + - - Cisco: CiscoServerIpv4Address - Ip4Addr: 172.31.255.1 - - 2: - - ProtocolIdentifier + - - IANA: ProtocolIdentifier - ProtocolType: Ospfigp - - 3: - - IpDiffServCodePoint + - - IANA: IpDiffServCodePoint - DataNumber: 0 - - 4: - - IpTtl + - - IANA: IpTtl - DataNumber: 1 - - 5: - - CiscoServerL4Port - - DataNumber: 0 - - 6: - - IngressVrfid - - DataNumber: 0 - - 7: - - ApplicationId + - - Cisco: + Unknown: 12241 + - Vec: + - 0 + - 0 + - - IANA: IngressVrfid + - DataNumber: 0 + - - IANA: ApplicationId - ApplicationId: classification_engine_id: 1 selector_id: 89 - - 8: - - VlanId + - - IANA: VlanId - DataNumber: 0 - - 9: - - IngressInterface + - - IANA: IngressInterface - DataNumber: 1 - - 10: - - BiflowDirection + - - IANA: BiflowDirection - DataNumber: 2 - - 11: - - CiscoServicesWaasSegment + - - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - - 12: - - EgressInterface + - - IANA: EgressInterface - DataNumber: 0 - - 13: - - CiscoServicesWaasPassthroughReason + - - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - - 14: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 4019387360 - - 15: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 4019444662 - - 16: - - NewConnectionDeltaCount + - - IANA: NewConnectionDeltaCount - DataNumber: 0 - - 17: - - ConnectionSumDurationSeconds + - - IANA: ConnectionSumDurationSeconds - DataNumber: 80 - - 18: - - ResponderOctets + - - IANA: ResponderOctets - DataNumber: 0 - - 19: - - ResponderPackets + - - IANA: ResponderPackets - DataNumber: 23 - - 20: - - InitiatorOctets + - - IANA: InitiatorOctets - DataNumber: 0 - - 21: - - InitiatorPackets + - - IANA: InitiatorPackets - DataNumber: 0 - - 0: - - CiscoClientIpv4Address + - - - Cisco: CiscoClientIpv4Address - Ip4Addr: 172.31.254.101 - - 1: - - CiscoServerIpv4Address + - - Cisco: CiscoServerIpv4Address - Ip4Addr: 172.31.254.101 - - 2: - - ProtocolIdentifier + - - IANA: ProtocolIdentifier - ProtocolType: Udp - - 3: - - IpDiffServCodePoint + - - IANA: IpDiffServCodePoint - DataNumber: 48 - - 4: - - IpTtl + - - IANA: IpTtl - DataNumber: 255 - - 5: - - CiscoServerL4Port - - DataNumber: 3785 - - 6: - - IngressVrfid - - DataNumber: 0 - - 7: - - ApplicationId + - - Cisco: + Unknown: 12241 + - Vec: + - 14 + - 201 + - - IANA: IngressVrfid + - DataNumber: 0 + - - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - - 8: - - VlanId + - - IANA: VlanId - DataNumber: 0 - - 9: - - IngressInterface + - - IANA: IngressInterface - DataNumber: 0 - - 10: - - BiflowDirection + - - IANA: BiflowDirection - DataNumber: 1 - - 11: - - CiscoServicesWaasSegment + - - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - - 12: - - EgressInterface + - - IANA: EgressInterface - DataNumber: 1 - - 13: - - CiscoServicesWaasPassthroughReason + - - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - - 14: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 4019387474 - - 15: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 4019447040 - - 16: - - NewConnectionDeltaCount + - - IANA: NewConnectionDeltaCount - DataNumber: 0 - - 17: - - ConnectionSumDurationSeconds + - - IANA: ConnectionSumDurationSeconds - DataNumber: 60 - - 18: - - ResponderOctets + - - IANA: ResponderOctets - DataNumber: 0 - - 19: - - ResponderPackets + - - IANA: ResponderPackets - DataNumber: 0 - - 20: - - InitiatorOctets + - - IANA: InitiatorOctets - DataNumber: 3816 - - 21: - - InitiatorPackets + - - IANA: InitiatorPackets - DataNumber: 318 - - 0: - - CiscoClientIpv4Address + - - - Cisco: CiscoClientIpv4Address - Ip4Addr: 224.0.0.5 - - 1: - - CiscoServerIpv4Address + - - Cisco: CiscoServerIpv4Address - Ip4Addr: 172.31.250.252 - - 2: - - ProtocolIdentifier + - - IANA: ProtocolIdentifier - ProtocolType: Ospfigp - - 3: - - IpDiffServCodePoint + - - IANA: IpDiffServCodePoint - DataNumber: 48 - - 4: - - IpTtl + - - IANA: IpTtl - DataNumber: 1 - - 5: - - CiscoServerL4Port - - DataNumber: 0 - - 6: - - IngressVrfid - - DataNumber: 0 - - 7: - - ApplicationId + - - Cisco: + Unknown: 12241 + - Vec: + - 0 + - 0 + - - IANA: IngressVrfid + - DataNumber: 0 + - - IANA: ApplicationId - ApplicationId: classification_engine_id: 1 selector_id: 89 - - 8: - - VlanId + - - IANA: VlanId - DataNumber: 290 - - 9: - - IngressInterface + - - IANA: IngressInterface - DataNumber: 20 - - 10: - - BiflowDirection + - - IANA: BiflowDirection - DataNumber: 2 - - 11: - - CiscoServicesWaasSegment + - - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - - 12: - - EgressInterface + - - IANA: EgressInterface - DataNumber: 0 - - 13: - - CiscoServicesWaasPassthroughReason + - - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - - 14: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 4019387484 - - 15: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 4019444636 - - 16: - - NewConnectionDeltaCount + - - IANA: NewConnectionDeltaCount - DataNumber: 0 - - 17: - - ConnectionSumDurationSeconds + - - IANA: ConnectionSumDurationSeconds - DataNumber: 0 - - 18: - - ResponderOctets + - - IANA: ResponderOctets - DataNumber: 0 - - 19: - - ResponderPackets + - - IANA: ResponderPackets - DataNumber: 7 - - 20: - - InitiatorOctets + - - IANA: InitiatorOctets - DataNumber: 0 - - 21: - - InitiatorPackets + - - IANA: InitiatorPackets - DataNumber: 0 - - 0: - - CiscoClientIpv4Address + - - - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.208.22.13 - - 1: - - CiscoServerIpv4Address + - - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.101.22.251 - - 2: - - ProtocolIdentifier + - - IANA: ProtocolIdentifier - ProtocolType: Udp - - 3: - - IpDiffServCodePoint + - - IANA: IpDiffServCodePoint - DataNumber: 4 - - 4: - - IpTtl + - - IANA: IpTtl - DataNumber: 61 - - 5: - - CiscoServerL4Port - - DataNumber: 17654 - - 6: - - IngressVrfid - - DataNumber: 0 - - 7: - - ApplicationId + - - Cisco: + Unknown: 12241 + - Vec: + - 68 + - 246 + - - IANA: IngressVrfid + - DataNumber: 0 + - - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - - 8: - - VlanId + - - IANA: VlanId - DataNumber: 0 - - 9: - - IngressInterface + - - IANA: IngressInterface - DataNumber: 1 - - 10: - - BiflowDirection + - - IANA: BiflowDirection - DataNumber: 1 - - 11: - - CiscoServicesWaasSegment + - - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - - 12: - - EgressInterface + - - IANA: EgressInterface - DataNumber: 4 - - 13: - - CiscoServicesWaasPassthroughReason + - - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - - 14: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 4019387486 - - 15: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 4019437338 - - 16: - - NewConnectionDeltaCount + - - IANA: NewConnectionDeltaCount - DataNumber: 0 - - 17: - - ConnectionSumDurationSeconds + - - IANA: ConnectionSumDurationSeconds - DataNumber: 50 - - 18: - - ResponderOctets + - - IANA: ResponderOctets - DataNumber: 0 - - 19: - - ResponderPackets + - - IANA: ResponderPackets - DataNumber: 0 - - 20: - - InitiatorOctets + - - IANA: InitiatorOctets - DataNumber: 740 - - 21: - - InitiatorPackets + - - IANA: InitiatorPackets - DataNumber: 65 - - 0: - - CiscoClientIpv4Address + - - - Cisco: CiscoClientIpv4Address - Ip4Addr: 224.0.0.5 - - 1: - - CiscoServerIpv4Address + - - Cisco: CiscoServerIpv4Address - Ip4Addr: 172.31.254.27 - - 2: - - ProtocolIdentifier + - - IANA: ProtocolIdentifier - ProtocolType: Ospfigp - - 3: - - IpDiffServCodePoint + - - IANA: IpDiffServCodePoint - DataNumber: 48 - - 4: - - IpTtl + - - IANA: IpTtl - DataNumber: 1 - - 5: - - CiscoServerL4Port - - DataNumber: 0 - - 6: - - IngressVrfid - - DataNumber: 0 - - 7: - - ApplicationId + - - Cisco: + Unknown: 12241 + - Vec: + - 0 + - 0 + - - IANA: IngressVrfid + - DataNumber: 0 + - - IANA: ApplicationId - ApplicationId: classification_engine_id: 1 selector_id: 89 - - 8: - - VlanId + - - IANA: VlanId - DataNumber: 0 - - 9: - - IngressInterface + - - IANA: IngressInterface - DataNumber: 1 - - 10: - - BiflowDirection + - - IANA: BiflowDirection - DataNumber: 2 - - 11: - - CiscoServicesWaasSegment + - - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - - 12: - - EgressInterface + - - IANA: EgressInterface - DataNumber: 0 - - 13: - - CiscoServicesWaasPassthroughReason + - - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - - 14: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 4019387494 - - 15: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 4019443438 - - 16: - - NewConnectionDeltaCount + - - IANA: NewConnectionDeltaCount - DataNumber: 0 - - 17: - - ConnectionSumDurationSeconds + - - IANA: ConnectionSumDurationSeconds - DataNumber: 0 - - 18: - - ResponderOctets + - - IANA: ResponderOctets - DataNumber: 0 - - 19: - - ResponderPackets + - - IANA: ResponderPackets - DataNumber: 7 - - 20: - - InitiatorOctets + - - IANA: InitiatorOctets - DataNumber: 0 - - 21: - - InitiatorPackets + - - IANA: InitiatorPackets - DataNumber: 0 - - 0: - - CiscoClientIpv4Address + - - - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.100.102.116 - - 1: - - CiscoServerIpv4Address + - - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.205.151.9 - - 2: - - ProtocolIdentifier + - - IANA: ProtocolIdentifier - ProtocolType: Udp - - 3: - - IpDiffServCodePoint + - - IANA: IpDiffServCodePoint - DataNumber: 0 - - 4: - - IpTtl + - - IANA: IpTtl - DataNumber: 125 - - 5: - - CiscoServerL4Port - - DataNumber: 3389 - - 6: - - IngressVrfid - - DataNumber: 0 - - 7: - - ApplicationId + - - Cisco: + Unknown: 12241 + - Vec: + - 13 + - 61 + - - IANA: IngressVrfid + - DataNumber: 0 + - - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - - 8: - - VlanId + - - IANA: VlanId - DataNumber: 290 - - 9: - - IngressInterface + - - IANA: IngressInterface - DataNumber: 20 - - 10: - - BiflowDirection + - - IANA: BiflowDirection - DataNumber: 2 - - 11: - - CiscoServicesWaasSegment + - - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - - 12: - - EgressInterface + - - IANA: EgressInterface - DataNumber: 17 - - 13: - - CiscoServicesWaasPassthroughReason + - - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - - 14: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 4019387564 - - 15: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 4019438730 - - 16: - - NewConnectionDeltaCount + - - IANA: NewConnectionDeltaCount - DataNumber: 0 - - 17: - - ConnectionSumDurationSeconds + - - IANA: ConnectionSumDurationSeconds - DataNumber: 239 - - 18: - - ResponderOctets + - - IANA: ResponderOctets - DataNumber: 225 - - 19: - - ResponderPackets + - - IANA: ResponderPackets - DataNumber: 8 - - 20: - - InitiatorOctets + - - IANA: InitiatorOctets - DataNumber: 96 - - 21: - - InitiatorPackets + - - IANA: InitiatorPackets - DataNumber: 8 - - 0: - - CiscoClientIpv4Address + - - - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.208.22.124 - - 1: - - CiscoServerIpv4Address + - - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.101.22.251 - - 2: - - ProtocolIdentifier + - - IANA: ProtocolIdentifier - ProtocolType: Udp - - 3: - - IpDiffServCodePoint + - - IANA: IpDiffServCodePoint - DataNumber: 4 - - 4: - - IpTtl + - - IANA: IpTtl - DataNumber: 61 - - 5: - - CiscoServerL4Port - - DataNumber: 17654 - - 6: - - IngressVrfid - - DataNumber: 0 - - 7: - - ApplicationId + - - Cisco: + Unknown: 12241 + - Vec: + - 68 + - 246 + - - IANA: IngressVrfid + - DataNumber: 0 + - - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - - 8: - - VlanId + - - IANA: VlanId - DataNumber: 0 - - 9: - - IngressInterface + - - IANA: IngressInterface - DataNumber: 1 - - 10: - - BiflowDirection + - - IANA: BiflowDirection - DataNumber: 1 - - 11: - - CiscoServicesWaasSegment + - - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - - 12: - - EgressInterface + - - IANA: EgressInterface - DataNumber: 4 - - 13: - - CiscoServicesWaasPassthroughReason + - - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - - 14: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 4019387592 - - 15: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 4019437466 - - 16: - - NewConnectionDeltaCount + - - IANA: NewConnectionDeltaCount - DataNumber: 0 - - 17: - - ConnectionSumDurationSeconds + - - IANA: ConnectionSumDurationSeconds - DataNumber: 59 - - 18: - - ResponderOctets + - - IANA: ResponderOctets - DataNumber: 0 - - 19: - - ResponderPackets + - - IANA: ResponderPackets - DataNumber: 0 - - 20: - - InitiatorOctets + - - IANA: InitiatorOctets - DataNumber: 96 - - 21: - - InitiatorPackets + - - IANA: InitiatorPackets - DataNumber: 6 - - 0: - - CiscoClientIpv4Address + - - - Cisco: CiscoClientIpv4Address - Ip4Addr: 172.31.254.101 - - 1: - - CiscoServerIpv4Address + - - Cisco: CiscoServerIpv4Address - Ip4Addr: 172.31.254.1 - - 2: - - ProtocolIdentifier + - - IANA: ProtocolIdentifier - ProtocolType: Udp - - 3: - - IpDiffServCodePoint + - - IANA: IpDiffServCodePoint - DataNumber: 48 - - 4: - - IpTtl + - - IANA: IpTtl - DataNumber: 255 - - 5: - - CiscoServerL4Port - - DataNumber: 3784 - - 6: - - IngressVrfid - - DataNumber: 0 - - 7: - - ApplicationId + - - Cisco: + Unknown: 12241 + - Vec: + - 14 + - 200 + - - IANA: IngressVrfid + - DataNumber: 0 + - - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - - 8: - - VlanId + - - IANA: VlanId - DataNumber: 0 - - 9: - - IngressInterface + - - IANA: IngressInterface - DataNumber: 0 - - 10: - - BiflowDirection + - - IANA: BiflowDirection - DataNumber: 1 - - 11: - - CiscoServicesWaasSegment + - - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - - 12: - - EgressInterface + - - IANA: EgressInterface - DataNumber: 1 - - 13: - - CiscoServicesWaasPassthroughReason + - - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - - 14: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 4019387628 - - 15: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 4019445566 - - 16: - - NewConnectionDeltaCount + - - IANA: NewConnectionDeltaCount - DataNumber: 0 - - 17: - - ConnectionSumDurationSeconds + - - IANA: ConnectionSumDurationSeconds - DataNumber: 60 - - 18: - - ResponderOctets + - - IANA: ResponderOctets - DataNumber: 0 - - 19: - - ResponderPackets + - - IANA: ResponderPackets - DataNumber: 0 - - 20: - - InitiatorOctets + - - IANA: InitiatorOctets - DataNumber: 552 - - 21: - - InitiatorPackets + - - IANA: InitiatorPackets - DataNumber: 23 - - 0: - - CiscoClientIpv4Address + - - - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.1.22.47 - - 1: - - CiscoServerIpv4Address + - - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.101.22.251 - - 2: - - ProtocolIdentifier + - - IANA: ProtocolIdentifier - ProtocolType: Udp - - 3: - - IpDiffServCodePoint + - - IANA: IpDiffServCodePoint - DataNumber: 8 - - 4: - - IpTtl + - - IANA: IpTtl - DataNumber: 61 - - 5: - - CiscoServerL4Port - - DataNumber: 17654 - - 6: - - IngressVrfid - - DataNumber: 0 - - 7: - - ApplicationId + - - Cisco: + Unknown: 12241 + - Vec: + - 68 + - 246 + - - IANA: IngressVrfid + - DataNumber: 0 + - - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - - 8: - - VlanId + - - IANA: VlanId - DataNumber: 0 - - 9: - - IngressInterface + - - IANA: IngressInterface - DataNumber: 1 - - 10: - - BiflowDirection + - - IANA: BiflowDirection - DataNumber: 1 - - 11: - - CiscoServicesWaasSegment + - - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - - 12: - - EgressInterface + - - IANA: EgressInterface - DataNumber: 4 - - 13: - - CiscoServicesWaasPassthroughReason + - - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - - 14: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 4019387640 - - 15: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 4019437582 - - 16: - - NewConnectionDeltaCount + - - IANA: NewConnectionDeltaCount - DataNumber: 0 - - 17: - - ConnectionSumDurationSeconds + - - IANA: ConnectionSumDurationSeconds - DataNumber: 50 - - 18: - - ResponderOctets + - - IANA: ResponderOctets - DataNumber: 0 - - 19: - - ResponderPackets + - - IANA: ResponderPackets - DataNumber: 0 - - 20: - - InitiatorOctets + - - IANA: InitiatorOctets - DataNumber: 772 - - 21: - - InitiatorPackets + - - IANA: InitiatorPackets - DataNumber: 67 - - 0: - - CiscoClientIpv4Address + - - - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.101.10.12 - - 1: - - CiscoServerIpv4Address + - - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.0.151.179 - - 2: - - ProtocolIdentifier + - - IANA: ProtocolIdentifier - ProtocolType: Icmp - - 3: - - IpDiffServCodePoint + - - IANA: IpDiffServCodePoint - DataNumber: 0 - - 4: - - IpTtl + - - IANA: IpTtl - DataNumber: 60 - - 5: - - CiscoServerL4Port - - DataNumber: 0 - - 6: - - IngressVrfid - - DataNumber: 0 - - 7: - - ApplicationId + - - Cisco: + Unknown: 12241 + - Vec: + - 0 + - 0 + - - IANA: IngressVrfid + - DataNumber: 0 + - - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 479 - - 8: - - VlanId + - - IANA: VlanId - DataNumber: 0 - - 9: - - IngressInterface + - - IANA: IngressInterface - DataNumber: 1 - - 10: - - BiflowDirection + - - IANA: BiflowDirection - DataNumber: 2 - - 11: - - CiscoServicesWaasSegment + - - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - - 12: - - EgressInterface + - - IANA: EgressInterface - DataNumber: 4 - - 13: - - CiscoServicesWaasPassthroughReason + - - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - - 14: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 4019387662 - - 15: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 4019446322 - - 16: - - NewConnectionDeltaCount + - - IANA: NewConnectionDeltaCount - DataNumber: 0 - - 17: - - ConnectionSumDurationSeconds + - - IANA: ConnectionSumDurationSeconds - DataNumber: 0 - - 18: - - ResponderOctets + - - IANA: ResponderOctets - DataNumber: 0 - - 19: - - ResponderPackets + - - IANA: ResponderPackets - DataNumber: 19 - - 20: - - InitiatorOctets + - - IANA: InitiatorOctets - DataNumber: 0 - - 21: - - InitiatorPackets + - - IANA: InitiatorPackets - DataNumber: 0 - - 0: - - CiscoClientIpv4Address + - - - Cisco: CiscoClientIpv4Address - Ip4Addr: 172.31.255.1 - - 1: - - CiscoServerIpv4Address + - - Cisco: CiscoServerIpv4Address - Ip4Addr: 172.31.254.101 - - 2: - - ProtocolIdentifier + - - IANA: ProtocolIdentifier - ProtocolType: Udp - - 3: - - IpDiffServCodePoint + - - IANA: IpDiffServCodePoint - DataNumber: 0 - - 4: - - IpTtl + - - IANA: IpTtl - DataNumber: 255 - - 5: - - CiscoServerL4Port - - DataNumber: 3784 - - 6: - - IngressVrfid - - DataNumber: 0 - - 7: - - ApplicationId + - - Cisco: + Unknown: 12241 + - Vec: + - 14 + - 200 + - - IANA: IngressVrfid + - DataNumber: 0 + - - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - - 8: - - VlanId + - - IANA: VlanId - DataNumber: 0 - - 9: - - IngressInterface + - - IANA: IngressInterface - DataNumber: 1 - - 10: - - BiflowDirection + - - IANA: BiflowDirection - DataNumber: 1 - - 11: - - CiscoServicesWaasSegment + - - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - - 12: - - EgressInterface + - - IANA: EgressInterface - DataNumber: 0 - - 13: - - CiscoServicesWaasPassthroughReason + - - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - - 14: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 4019387700 - - 15: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 4019446700 - - 16: - - NewConnectionDeltaCount + - - IANA: NewConnectionDeltaCount - DataNumber: 0 - - 17: - - ConnectionSumDurationSeconds + - - IANA: ConnectionSumDurationSeconds - DataNumber: 59 - - 18: - - ResponderOctets + - - IANA: ResponderOctets - DataNumber: 0 - - 19: - - ResponderPackets + - - IANA: ResponderPackets - DataNumber: 0 - - 20: - - InitiatorOctets + - - IANA: InitiatorOctets - DataNumber: 1632 - - 21: - - InitiatorPackets + - - IANA: InitiatorPackets - DataNumber: 68 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_multiple_flow_records.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_multiple_flow_records.snap new file mode 100644 index 00000000..c72c4277 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_multiple_flow_records.snap @@ -0,0 +1,564 @@ +--- +source: src/tests.rs +expression: "parser.parse_bytes(&hex::decode(hex2).unwrap())" +--- +- IPFix: + header: + version: 10 + length: 1217 + export_time: 1412166683 + sequence_number: 127681 + observation_domain_id: 0 + flowsets: + - header: + header_id: 277 + length: 29 + body: + Data: + fields: + - - - IANA: ObservationPointId + - DataNumber: 8731347 + - - IANA: ExportingProcessId + - DataNumber: 0 + - - Netscaler: NetscalerLicenseType + - DataNumber: 1 + - - Netscaler: NetscalerMaxLicenseCount + - DataNumber: 5 + - - Netscaler: NetscalerCurrentLicenseConsumed + - DataNumber: 0 + - header: + header_id: 258 + length: 433 + body: + Data: + fields: + - - - IANA: ObservationPointId + - DataNumber: 8731347 + - - IANA: ExportingProcessId + - DataNumber: 0 + - - IANA: FlowId + - DataNumber: 2040953 + - - Netscaler: NetscalerTransactionId + - DataNumber: 94120 + - - Netscaler: NetscalerConnectionId + - DataNumber: 2040953 + - - IANA: IpVersion + - DataNumber: 4 + - - IANA: ProtocolIdentifier + - ProtocolType: Tcp + - - IANA: PaddingOctets + - String: "\u0000\u0000" + - - IANA: SourceIpv4address + - Ip4Addr: 172.18.129.61 + - - IANA: DestinationIpv4address + - Ip4Addr: 172.18.159.99 + - - IANA: SourceTransportPort + - DataNumber: 51612 + - - IANA: DestinationTransportPort + - DataNumber: 443 + - - IANA: PacketDeltaCount + - DataNumber: 3 + - - IANA: OctetDeltaCount + - DataNumber: 817 + - - IANA: TcpControlBits + - DataNumber: 24 + - - Netscaler: NetscalerFlowFlags + - DataNumber: 84025344 + - - IANA: FlowStartMicroseconds + - Duration: + secs: 15552744373216 + nanos: 838403000 + - - IANA: FlowEndMicroseconds + - Duration: + secs: 15552744373216 + nanos: 849399000 + - - IANA: IngressInterface + - DataNumber: 1 + - - IANA: EgressInterface + - DataNumber: 2147483651 + - - Netscaler: NetscalerAppNameAppId + - DataNumber: 9510 + - - Netscaler: NetscalerAppUnitNameAppId + - DataNumber: 0 + - - Netscaler: NetscalerHttpResForwFB + - DataNumber: 0 + - - Netscaler: NetscalerHttpResForwLB + - DataNumber: 0 + - - Netscaler: NetscalerConnectionChainID + - Vec: + - 0 + - 80 + - 86 + - 0 + - 215 + - 43 + - 33 + - 84 + - 27 + - 244 + - 43 + - 84 + - 247 + - 173 + - 11 + - 0 + - - Netscaler: NetscalerConnectionChainHopCount + - DataNumber: 1 + - - Netscaler: NetscalerHttpReqUrl + - String: "/vpn/index.html\u0000" + - - Netscaler: NetscalerHttpReqCookie + - String: "\u0000" + - - Netscaler: NetscalerHttpReqReferer + - String: "\u0000" + - - Netscaler: NetscalerHttpReqMethod + - String: "GET\u0000" + - - Netscaler: NetscalerHttpReqHost + - String: "int-app-netscaler-10-1-ext.lab2.net\u0000" + - - Netscaler: NetscalerHttpReqUserAgent + - String: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0\u0000" + - - Netscaler: NetscalerHttpContentType + - String: "\u0000" + - - Netscaler: NetscalerHttpReqAuthorization + - String: "\u0000" + - - Netscaler: NetscalerHttpReqVia + - String: "\u0000" + - - Netscaler: NetscalerHttpReqXForwardedFor + - String: "\u0000" + - - Netscaler: NetscalerAaaUsername + - String: "\u0000" + - - - IANA: ObservationPointId + - DataNumber: 8731347 + - - IANA: ExportingProcessId + - DataNumber: 0 + - - IANA: FlowId + - DataNumber: 2040953 + - - Netscaler: NetscalerTransactionId + - DataNumber: 94120 + - - Netscaler: NetscalerConnectionId + - DataNumber: 2040953 + - - IANA: IpVersion + - DataNumber: 4 + - - IANA: ProtocolIdentifier + - ProtocolType: Tcp + - - IANA: PaddingOctets + - String: "\u0000\u0000" + - - IANA: SourceIpv4address + - Ip4Addr: 172.18.129.61 + - - IANA: DestinationIpv4address + - Ip4Addr: 172.18.159.99 + - - IANA: SourceTransportPort + - DataNumber: 51612 + - - IANA: DestinationTransportPort + - DataNumber: 443 + - - IANA: PacketDeltaCount + - DataNumber: 1 + - - IANA: OctetDeltaCount + - DataNumber: 40 + - - IANA: TcpControlBits + - DataNumber: 16 + - - Netscaler: NetscalerFlowFlags + - DataNumber: 84025344 + - - IANA: FlowStartMicroseconds + - Duration: + secs: 15552744373216 + nanos: 853386000 + - - IANA: FlowEndMicroseconds + - Duration: + secs: 15552744373216 + nanos: 853386000 + - - IANA: IngressInterface + - DataNumber: 1 + - - IANA: EgressInterface + - DataNumber: 2147483651 + - - Netscaler: NetscalerAppNameAppId + - DataNumber: 9510 + - - Netscaler: NetscalerAppUnitNameAppId + - DataNumber: 0 + - - Netscaler: NetscalerHttpResForwFB + - DataNumber: 0 + - - Netscaler: NetscalerHttpResForwLB + - DataNumber: 0 + - - Netscaler: NetscalerConnectionChainID + - Vec: + - 0 + - 80 + - 86 + - 0 + - 215 + - 43 + - 33 + - 84 + - 27 + - 244 + - 43 + - 84 + - 247 + - 173 + - 11 + - 0 + - - Netscaler: NetscalerConnectionChainHopCount + - DataNumber: 1 + - - Netscaler: NetscalerHttpReqUrl + - String: "\u0000" + - - Netscaler: NetscalerHttpReqCookie + - String: "\u0000" + - - Netscaler: NetscalerHttpReqReferer + - String: "\u0000" + - - Netscaler: NetscalerHttpReqMethod + - String: "\u0000" + - - Netscaler: NetscalerHttpReqHost + - String: "\u0000" + - - Netscaler: NetscalerHttpReqUserAgent + - String: "\u0000" + - - Netscaler: NetscalerHttpContentType + - String: "\u0000" + - - Netscaler: NetscalerHttpReqAuthorization + - String: "\u0000" + - - Netscaler: NetscalerHttpReqVia + - String: "\u0000" + - - Netscaler: NetscalerHttpReqXForwardedFor + - String: "\u0000" + - - Netscaler: NetscalerAaaUsername + - String: "\u0000" + - header: + header_id: 257 + length: 118 + body: + Data: + fields: + - - - IANA: ObservationPointId + - DataNumber: 8731347 + - - IANA: ExportingProcessId + - DataNumber: 0 + - - IANA: FlowId + - DataNumber: 2040954 + - - Netscaler: NetscalerTransactionId + - DataNumber: 94120 + - - Netscaler: NetscalerConnectionId + - DataNumber: 2040953 + - - IANA: IpVersion + - DataNumber: 4 + - - IANA: ProtocolIdentifier + - ProtocolType: Tcp + - - IANA: PaddingOctets + - String: "\u0000\u0000" + - - IANA: SourceIpv4address + - Ip4Addr: 172.18.159.99 + - - IANA: DestinationIpv4address + - Ip4Addr: 172.18.129.61 + - - IANA: SourceTransportPort + - DataNumber: 443 + - - IANA: DestinationTransportPort + - DataNumber: 51612 + - - IANA: PacketDeltaCount + - DataNumber: 7 + - - IANA: OctetDeltaCount + - DataNumber: 6917 + - - IANA: TcpControlBits + - DataNumber: 24 + - - Netscaler: NetscalerFlowFlags + - DataNumber: 1090527232 + - - IANA: FlowStartMicroseconds + - Duration: + secs: 15552744373216 + nanos: 838403000 + - - IANA: FlowEndMicroseconds + - Duration: + secs: 15552744373216 + nanos: 850391000 + - - Netscaler: NetscalerRoundTripTime + - DataNumber: 3 + - - IANA: EgressInterface + - DataNumber: 1 + - - IANA: IngressInterface + - DataNumber: 2147483651 + - - Netscaler: NetscalerAppNameAppId + - DataNumber: 9510 + - - Netscaler: NetscalerConnectionChainID + - Vec: + - 0 + - 80 + - 86 + - 0 + - 215 + - 43 + - 33 + - 84 + - 27 + - 244 + - 43 + - 84 + - 247 + - 173 + - 11 + - 0 + - - Netscaler: NetscalerConnectionChainHopCount + - DataNumber: 1 + - header: + header_id: 258 + length: 503 + body: + Data: + fields: + - - - IANA: ObservationPointId + - DataNumber: 8731347 + - - IANA: ExportingProcessId + - DataNumber: 0 + - - IANA: FlowId + - DataNumber: 2040953 + - - Netscaler: NetscalerTransactionId + - DataNumber: 94121 + - - Netscaler: NetscalerConnectionId + - DataNumber: 2040953 + - - IANA: IpVersion + - DataNumber: 4 + - - IANA: ProtocolIdentifier + - ProtocolType: Tcp + - - IANA: PaddingOctets + - String: "\u0000\u0000" + - - IANA: SourceIpv4address + - Ip4Addr: 172.18.129.61 + - - IANA: DestinationIpv4address + - Ip4Addr: 172.18.159.99 + - - IANA: SourceTransportPort + - DataNumber: 51612 + - - IANA: DestinationTransportPort + - DataNumber: 443 + - - IANA: PacketDeltaCount + - DataNumber: 1 + - - IANA: OctetDeltaCount + - DataNumber: 482 + - - IANA: TcpControlBits + - DataNumber: 24 + - - Netscaler: NetscalerFlowFlags + - DataNumber: 84025344 + - - IANA: FlowStartMicroseconds + - Duration: + secs: 15552744373216 + nanos: 884381000 + - - IANA: FlowEndMicroseconds + - Duration: + secs: 15552744373216 + nanos: 884381000 + - - IANA: IngressInterface + - DataNumber: 1 + - - IANA: EgressInterface + - DataNumber: 2147483651 + - - Netscaler: NetscalerAppNameAppId + - DataNumber: 9510 + - - Netscaler: NetscalerAppUnitNameAppId + - DataNumber: 0 + - - Netscaler: NetscalerHttpResForwFB + - DataNumber: 0 + - - Netscaler: NetscalerHttpResForwLB + - DataNumber: 0 + - - Netscaler: NetscalerConnectionChainID + - Vec: + - 0 + - 80 + - 86 + - 0 + - 215 + - 43 + - 33 + - 84 + - 27 + - 244 + - 43 + - 84 + - 157 + - 54 + - 12 + - 0 + - - Netscaler: NetscalerConnectionChainHopCount + - DataNumber: 1 + - - Netscaler: NetscalerHttpReqUrl + - String: "/vpn/images/caxtonstyle.css\u0000" + - - Netscaler: NetscalerHttpReqCookie + - String: "\u0000" + - - Netscaler: NetscalerHttpReqReferer + - String: "https://int-app-netscaler-10-1-ext.lab2.net/vpn/index.html\u0000" + - - Netscaler: NetscalerHttpReqMethod + - String: "GET\u0000" + - - Netscaler: NetscalerHttpReqHost + - String: "int-app-netscaler-10-1-ext.lab2.net\u0000" + - - Netscaler: NetscalerHttpReqUserAgent + - String: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0\u0000" + - - Netscaler: NetscalerHttpContentType + - String: "\u0000" + - - Netscaler: NetscalerHttpReqAuthorization + - String: "\u0000" + - - Netscaler: NetscalerHttpReqVia + - String: "\u0000" + - - Netscaler: NetscalerHttpReqXForwardedFor + - String: "\u0000" + - - Netscaler: NetscalerAaaUsername + - String: "\u0000" + - - - IANA: ObservationPointId + - DataNumber: 8731347 + - - IANA: ExportingProcessId + - DataNumber: 0 + - - IANA: FlowId + - DataNumber: 2040953 + - - Netscaler: NetscalerTransactionId + - DataNumber: 94121 + - - Netscaler: NetscalerConnectionId + - DataNumber: 2040953 + - - IANA: IpVersion + - DataNumber: 4 + - - IANA: ProtocolIdentifier + - ProtocolType: Tcp + - - IANA: PaddingOctets + - String: "\u0000\u0000" + - - IANA: SourceIpv4address + - Ip4Addr: 172.18.129.61 + - - IANA: DestinationIpv4address + - Ip4Addr: 172.18.159.99 + - - IANA: SourceTransportPort + - DataNumber: 51612 + - - IANA: DestinationTransportPort + - DataNumber: 443 + - - IANA: PacketDeltaCount + - DataNumber: 3 + - - IANA: OctetDeltaCount + - DataNumber: 120 + - - IANA: TcpControlBits + - DataNumber: 16 + - - Netscaler: NetscalerFlowFlags + - DataNumber: 84025344 + - - IANA: FlowStartMicroseconds + - Duration: + secs: 15552744373216 + nanos: 886381000 + - - IANA: FlowEndMicroseconds + - Duration: + secs: 15552744373216 + nanos: 889368000 + - - IANA: IngressInterface + - DataNumber: 1 + - - IANA: EgressInterface + - DataNumber: 2147483651 + - - Netscaler: NetscalerAppNameAppId + - DataNumber: 9510 + - - Netscaler: NetscalerAppUnitNameAppId + - DataNumber: 0 + - - Netscaler: NetscalerHttpResForwFB + - DataNumber: 0 + - - Netscaler: NetscalerHttpResForwLB + - DataNumber: 0 + - - Netscaler: NetscalerConnectionChainID + - Vec: + - 0 + - 80 + - 86 + - 0 + - 215 + - 43 + - 33 + - 84 + - 27 + - 244 + - 43 + - 84 + - 157 + - 54 + - 12 + - 0 + - - Netscaler: NetscalerConnectionChainHopCount + - DataNumber: 1 + - - Netscaler: NetscalerHttpReqUrl + - String: "\u0000" + - - Netscaler: NetscalerHttpReqCookie + - String: "\u0000" + - - Netscaler: NetscalerHttpReqReferer + - String: "\u0000" + - - Netscaler: NetscalerHttpReqMethod + - String: "\u0000" + - - Netscaler: NetscalerHttpReqHost + - String: "\u0000" + - - Netscaler: NetscalerHttpReqUserAgent + - String: "\u0000" + - - Netscaler: NetscalerHttpContentType + - String: "\u0000" + - - Netscaler: NetscalerHttpReqAuthorization + - String: "\u0000" + - - Netscaler: NetscalerHttpReqVia + - String: "\u0000" + - - Netscaler: NetscalerHttpReqXForwardedFor + - String: "\u0000" + - - Netscaler: NetscalerAaaUsername + - String: "\u0000" + - header: + header_id: 257 + length: 118 + body: + Data: + fields: + - - - IANA: ObservationPointId + - DataNumber: 8731347 + - - IANA: ExportingProcessId + - DataNumber: 0 + - - IANA: FlowId + - DataNumber: 2040954 + - - Netscaler: NetscalerTransactionId + - DataNumber: 94121 + - - Netscaler: NetscalerConnectionId + - DataNumber: 2040953 + - - IANA: IpVersion + - DataNumber: 4 + - - IANA: ProtocolIdentifier + - ProtocolType: Tcp + - - IANA: PaddingOctets + - String: "\u0000\u0000" + - - IANA: SourceIpv4address + - Ip4Addr: 172.18.159.99 + - - IANA: DestinationIpv4address + - Ip4Addr: 172.18.129.61 + - - IANA: SourceTransportPort + - DataNumber: 443 + - - IANA: DestinationTransportPort + - DataNumber: 51612 + - - IANA: PacketDeltaCount + - DataNumber: 15 + - - IANA: OctetDeltaCount + - DataNumber: 21968 + - - IANA: TcpControlBits + - DataNumber: 24 + - - Netscaler: NetscalerFlowFlags + - DataNumber: 1093672960 + - - IANA: FlowStartMicroseconds + - Duration: + secs: 15552744373216 + nanos: 884381000 + - - IANA: FlowEndMicroseconds + - Duration: + secs: 15552744373216 + nanos: 886381000 + - - Netscaler: NetscalerRoundTripTime + - DataNumber: 2 + - - IANA: EgressInterface + - DataNumber: 1 + - - IANA: IngressInterface + - DataNumber: 2147483651 + - - Netscaler: NetscalerAppNameAppId + - DataNumber: 9510 + - - Netscaler: NetscalerConnectionChainID + - Vec: + - 0 + - 80 + - 86 + - 0 + - 215 + - 43 + - 33 + - 84 + - 27 + - 244 + - 43 + - 84 + - 157 + - 54 + - 12 + - 0 + - - Netscaler: NetscalerConnectionChainHopCount + - DataNumber: 1 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_multiple_templates.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_multiple_templates.snap new file mode 100644 index 00000000..79cd698e --- /dev/null +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_multiple_templates.snap @@ -0,0 +1,1125 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&packet)" +--- +- IPFix: + header: + version: 10 + length: 1460 + export_time: 1412166671 + sequence_number: 127681 + observation_domain_id: 0 + flowsets: + - header: + header_id: 2 + length: 1444 + body: + Templates: + - template_id: 256 + field_count: 23 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 8 + field_length: 4 + field_type: + IANA: SourceIpv4address + - field_type_number: 12 + field_length: 4 + field_type: + IANA: DestinationIpv4address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 192 + field_length: 16 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainID + - field_type_number: 193 + field_length: 1 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainHopCount + - template_id: 257 + field_count: 24 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 8 + field_length: 4 + field_type: + IANA: SourceIpv4address + - field_type_number: 12 + field_length: 4 + field_type: + IANA: DestinationIpv4address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 128 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerRoundTripTime + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 192 + field_length: 16 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainID + - field_type_number: 193 + field_length: 1 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainHopCount + - template_id: 258 + field_count: 37 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 8 + field_length: 4 + field_type: + IANA: SourceIpv4address + - field_type_number: 12 + field_length: 4 + field_type: + IANA: DestinationIpv4address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 171 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppUnitNameAppId + - field_type_number: 158 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResForwFB + - field_type_number: 170 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResForwLB + - field_type_number: 192 + field_length: 16 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainID + - field_type_number: 193 + field_length: 1 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainHopCount + - field_type_number: 130 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqUrl + - field_type_number: 131 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqCookie + - field_type_number: 140 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqReferer + - field_type_number: 141 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqMethod + - field_type_number: 142 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqHost + - field_type_number: 143 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqUserAgent + - field_type_number: 183 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpContentType + - field_type_number: 185 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqAuthorization + - field_type_number: 186 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqVia + - field_type_number: 190 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqXForwardedFor + - field_type_number: 205 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAaaUsername + - template_id: 259 + field_count: 23 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 27 + field_length: 16 + field_type: + IANA: SourceIpv6address + - field_type_number: 28 + field_length: 16 + field_type: + IANA: DestinationIpv6address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 192 + field_length: 16 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainID + - field_type_number: 193 + field_length: 1 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainHopCount + - template_id: 260 + field_count: 24 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 27 + field_length: 16 + field_type: + IANA: SourceIpv6address + - field_type_number: 28 + field_length: 16 + field_type: + IANA: DestinationIpv6address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 128 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerRoundTripTime + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 192 + field_length: 16 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainID + - field_type_number: 193 + field_length: 1 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainHopCount + - template_id: 261 + field_count: 37 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 27 + field_length: 16 + field_type: + IANA: SourceIpv6address + - field_type_number: 28 + field_length: 16 + field_type: + IANA: DestinationIpv6address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 171 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppUnitNameAppId + - field_type_number: 158 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResForwFB + - field_type_number: 170 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResForwLB + - field_type_number: 192 + field_length: 16 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainID + - field_type_number: 193 + field_length: 1 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainHopCount + - field_type_number: 130 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqUrl + - field_type_number: 131 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqCookie + - field_type_number: 140 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqReferer + - field_type_number: 141 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqMethod + - field_type_number: 142 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqHost + - field_type_number: 143 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqUserAgent + - field_type_number: 183 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpContentType + - field_type_number: 185 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqAuthorization + - field_type_number: 186 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqVia + - field_type_number: 190 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqXForwardedFor + - field_type_number: 205 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAaaUsername + - template_id: 262 + field_count: 38 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 8 + field_length: 4 + field_type: + IANA: SourceIpv4address + - field_type_number: 12 + field_length: 4 + field_type: + IANA: DestinationIpv4address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 144 + field_length: 2 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpRspStatus + - field_type_number: 145 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpRspLen + - field_type_number: 146 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerServerTTFB + - field_type_number: 147 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerServerTTLB + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 161 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerMainPageId + - field_type_number: 162 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerMainPageCoreId + - field_type_number: 153 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqRcvFB + - field_type_number: 156 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqForwFB + - field_type_number: 157 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResRcvFB + - field_type_number: 159 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqRcvLB + - field_type_number: 160 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqForwLB + - field_type_number: 169 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResRcvLB + - field_type_number: 182 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerClientRTT + - field_type_number: 183 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpContentType + - field_type_number: 187 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResLocation + - field_type_number: 188 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResSetCookie + - field_type_number: 189 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResSetCookie2 + - template_id: 263 + field_count: 38 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 27 + field_length: 16 + field_type: + IANA: SourceIpv6address + - field_type_number: 28 + field_length: 16 + field_type: + IANA: DestinationIpv6address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 144 + field_length: 2 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpRspStatus + - field_type_number: 145 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpRspLen + - field_type_number: 146 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerServerTTFB + - field_type_number: 147 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerServerTTLB + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 161 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerMainPageId + - field_type_number: 162 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerMainPageCoreId + - field_type_number: 153 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqRcvFB + - field_type_number: 156 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqForwFB + - field_type_number: 157 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResRcvFB + - field_type_number: 159 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqRcvLB + - field_type_number: 160 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqForwLB + - field_type_number: 169 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResRcvLB + - field_type_number: 182 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerClientRTT + - field_type_number: 183 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpContentType + - field_type_number: 187 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResLocation + - field_type_number: 188 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResSetCookie + - field_type_number: 189 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResSetCookie2 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_options_template.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_options_template.snap index 58b51351..befef5a4 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_options_template.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_options_template.snap @@ -20,12 +20,15 @@ expression: "NetflowParser::default().parse_bytes(&packet)" scope_field_count: 1 fields: - field_type_number: 123 - field_type: AssignedforNetFlowv9compatibility field_length: 4 enterprise_number: 2 + field_type: + Enterprise: 123 - field_type_number: 41 - field_type: ExportedMessageTotalCount field_length: 2 + field_type: + IANA: ExportedMessageTotalCount - field_type_number: 42 - field_type: ExportedFlowRecordTotalCount field_length: 2 + field_type: + IANA: ExportedFlowRecordTotalCount diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_options_template_with_data.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_options_template_with_data.snap index efc9c8e1..2a802f4a 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_options_template_with_data.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_options_template_with_data.snap @@ -20,44 +20,41 @@ expression: "NetflowParser::default().parse_bytes(&packet)" scope_field_count: 1 fields: - field_type_number: 123 - field_type: AssignedforNetFlowv9compatibility field_length: 4 enterprise_number: 2 + field_type: + Enterprise: 123 - field_type_number: 41 - field_type: ExportedMessageTotalCount field_length: 2 + field_type: + IANA: ExportedMessageTotalCount - field_type_number: 42 - field_type: ExportedFlowRecordTotalCount field_length: 2 + field_type: + IANA: ExportedFlowRecordTotalCount - header: header_id: 260 length: 20 body: OptionsData: fields: - - 0: - - AssignedforNetFlowv9compatibility + - - - Enterprise: 123 - Vec: - 0 - 0 - 0 - 1 - - 1: - - ExportedMessageTotalCount + - - IANA: ExportedMessageTotalCount - DataNumber: 276 - - 2: - - ExportedFlowRecordTotalCount + - - IANA: ExportedFlowRecordTotalCount - DataNumber: 5140 - - 0: - - AssignedforNetFlowv9compatibility + - - - Enterprise: 123 - Vec: - 0 - 0 - 0 - 2 - - 1: - - ExportedMessageTotalCount + - - IANA: ExportedMessageTotalCount - DataNumber: 5140 - - 2: - - ExportedFlowRecordTotalCount + - - IANA: ExportedFlowRecordTotalCount - DataNumber: 7710 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_scappy_example.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_scappy_example.snap index ef8e7113..5f2bac62 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_scappy_example.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_scappy_example.snap @@ -19,74 +19,97 @@ expression: result field_count: 23 fields: - field_type_number: 8 - field_type: SourceIpv4address field_length: 4 + field_type: + IANA: SourceIpv4address - field_type_number: 12 - field_type: DestinationIpv4address field_length: 4 + field_type: + IANA: DestinationIpv4address - field_type_number: 5 - field_type: IpClassOfService field_length: 1 + field_type: + IANA: IpClassOfService - field_type_number: 4 - field_type: ProtocolIdentifier field_length: 1 + field_type: + IANA: ProtocolIdentifier - field_type_number: 7 - field_type: SourceTransportPort field_length: 2 + field_type: + IANA: SourceTransportPort - field_type_number: 11 - field_type: DestinationTransportPort field_length: 2 + field_type: + IANA: DestinationTransportPort - field_type_number: 32 - field_type: IcmpTypeCodeIpv4 field_length: 2 + field_type: + IANA: IcmpTypeCodeIpv4 - field_type_number: 10 - field_type: IngressInterface field_length: 4 + field_type: + IANA: IngressInterface - field_type_number: 16 - field_type: BgpSourceAsNumber field_length: 4 + field_type: + IANA: BgpSourceAsNumber - field_type_number: 17 - field_type: BgpDestinationAsNumber field_length: 4 + field_type: + IANA: BgpDestinationAsNumber - field_type_number: 18 - field_type: BgpNextHopIpv4address field_length: 4 + field_type: + IANA: BgpNextHopIpv4address - field_type_number: 14 - field_type: EgressInterface field_length: 4 + field_type: + IANA: EgressInterface - field_type_number: 1 - field_type: OctetDeltaCount field_length: 4 + field_type: + IANA: OctetDeltaCount - field_type_number: 2 - field_type: PacketDeltaCount field_length: 4 + field_type: + IANA: PacketDeltaCount - field_type_number: 22 - field_type: FlowStartSysUpTime field_length: 4 + field_type: + IANA: FlowStartSysUpTime - field_type_number: 21 - field_type: FlowEndSysUpTime field_length: 4 + field_type: + IANA: FlowEndSysUpTime - field_type_number: 15 - field_type: IpNextHopIpv4address field_length: 4 + field_type: + IANA: IpNextHopIpv4address - field_type_number: 9 - field_type: SourceIpv4prefixLength field_length: 1 + field_type: + IANA: SourceIpv4prefixLength - field_type_number: 13 - field_type: DestinationIpv4prefixLength field_length: 1 + field_type: + IANA: DestinationIpv4prefixLength - field_type_number: 6 - field_type: TcpControlBits field_length: 1 + field_type: + IANA: TcpControlBits - field_type_number: 60 - field_type: IpVersion field_length: 1 + field_type: + IANA: IpVersion - field_type_number: 152 - field_type: FlowStartMilliseconds field_length: 8 + field_type: + IANA: FlowStartMilliseconds - field_type_number: 153 - field_type: FlowEndMilliseconds field_length: 8 + field_type: + IANA: FlowEndMilliseconds - IPFix: header: version: 10 @@ -101,76 +124,53 @@ expression: result body: Data: fields: - - 0: - - SourceIpv4address + - - - IANA: SourceIpv4address - Ip4Addr: 70.1.115.1 - - 1: - - DestinationIpv4address + - - IANA: DestinationIpv4address - Ip4Addr: 50.0.71.1 - - 2: - - IpClassOfService + - - IANA: IpClassOfService - DataNumber: 0 - - 3: - - ProtocolIdentifier + - - IANA: ProtocolIdentifier - ProtocolType: Anydistributedprotocol - - 4: - - SourceTransportPort + - - IANA: SourceTransportPort - DataNumber: 0 - - 5: - - DestinationTransportPort + - - IANA: DestinationTransportPort - DataNumber: 0 - - 6: - - IcmpTypeCodeIpv4 + - - IANA: IcmpTypeCodeIpv4 - DataNumber: 0 - - 7: - - IngressInterface + - - IANA: IngressInterface - DataNumber: 827 - - 8: - - BgpSourceAsNumber + - - IANA: BgpSourceAsNumber - DataNumber: 2 - - 9: - - BgpDestinationAsNumber + - - IANA: BgpDestinationAsNumber - DataNumber: 3 - - 10: - - BgpNextHopIpv4address + - - IANA: BgpNextHopIpv4address - Ip4Addr: 204.42.110.101 - - 11: - - EgressInterface + - - IANA: EgressInterface - DataNumber: 854 - - 12: - - OctetDeltaCount + - - IANA: OctetDeltaCount - DataNumber: 1312 - - 13: - - PacketDeltaCount + - - IANA: PacketDeltaCount - DataNumber: 9 - - 14: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 3019441902 - - 15: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 3019616060 - - 16: - - IpNextHopIpv4address + - - IANA: IpNextHopIpv4address - Ip4Addr: 204.42.110.189 - - 17: - - SourceIpv4prefixLength + - - IANA: SourceIpv4prefixLength - DataNumber: 24 - - 18: - - DestinationIpv4prefixLength + - - IANA: DestinationIpv4prefixLength - DataNumber: 24 - - 19: - - TcpControlBits + - - IANA: TcpControlBits - DataNumber: 0 - - 20: - - IpVersion + - - IANA: IpVersion - DataNumber: 4 - - 21: - - FlowStartMilliseconds + - - IANA: FlowStartMilliseconds - Duration: secs: 1480449931 nanos: 519000000 - - 22: - - FlowEndMilliseconds + - - IANA: FlowEndMilliseconds - Duration: secs: 1480450105 nanos: 677000000 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_scappy_example_options_template.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_scappy_example_options_template.snap index 4539183a..c48f0868 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_scappy_example_options_template.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_scappy_example_options_template.snap @@ -20,11 +20,14 @@ expression: result scope_field_count: 1 fields: - field_type_number: 5 - field_type: IpClassOfService field_length: 2 + field_type: + IANA: IpClassOfService - field_type_number: 36 - field_type: FlowActiveTimeout field_length: 2 + field_type: + IANA: FlowActiveTimeout - field_type_number: 37 - field_type: FlowIdleTimeout field_length: 2 + field_type: + IANA: FlowIdleTimeout diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_template_of_first_flowset_unknown.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_template_of_first_flowset_unknown.snap new file mode 100644 index 00000000..a8c5c08b --- /dev/null +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_template_of_first_flowset_unknown.snap @@ -0,0 +1,578 @@ +--- +source: src/tests.rs +expression: "parser.parse_bytes(&hex::decode(hex2).unwrap())" +--- +- IPFix: + header: + version: 10 + length: 1217 + export_time: 1412166683 + sequence_number: 127681 + observation_domain_id: 0 + flowsets: + - header: + header_id: 277 + length: 29 + body: + NoTemplate: + - 0 + - 133 + - 58 + - 211 + - 0 + - 0 + - 0 + - 0 + - 1 + - 0 + - 0 + - 0 + - 0 + - 0 + - 0 + - 0 + - 5 + - 0 + - 0 + - 0 + - 0 + - 0 + - 0 + - 0 + - 0 + - header: + header_id: 258 + length: 433 + body: + Data: + fields: + - - - IANA: ObservationPointId + - DataNumber: 8731347 + - - IANA: ExportingProcessId + - DataNumber: 0 + - - IANA: FlowId + - DataNumber: 2040953 + - - Netscaler: NetscalerTransactionId + - DataNumber: 94120 + - - Netscaler: NetscalerConnectionId + - DataNumber: 2040953 + - - IANA: IpVersion + - DataNumber: 4 + - - IANA: ProtocolIdentifier + - ProtocolType: Tcp + - - IANA: PaddingOctets + - String: "\u0000\u0000" + - - IANA: SourceIpv4address + - Ip4Addr: 172.18.129.61 + - - IANA: DestinationIpv4address + - Ip4Addr: 172.18.159.99 + - - IANA: SourceTransportPort + - DataNumber: 51612 + - - IANA: DestinationTransportPort + - DataNumber: 443 + - - IANA: PacketDeltaCount + - DataNumber: 3 + - - IANA: OctetDeltaCount + - DataNumber: 817 + - - IANA: TcpControlBits + - DataNumber: 24 + - - Netscaler: NetscalerFlowFlags + - DataNumber: 84025344 + - - IANA: FlowStartMicroseconds + - Duration: + secs: 15552744373216 + nanos: 838403000 + - - IANA: FlowEndMicroseconds + - Duration: + secs: 15552744373216 + nanos: 849399000 + - - IANA: IngressInterface + - DataNumber: 1 + - - IANA: EgressInterface + - DataNumber: 2147483651 + - - Netscaler: NetscalerAppNameAppId + - DataNumber: 9510 + - - Netscaler: NetscalerAppUnitNameAppId + - DataNumber: 0 + - - Netscaler: NetscalerHttpResForwFB + - DataNumber: 0 + - - Netscaler: NetscalerHttpResForwLB + - DataNumber: 0 + - - Netscaler: NetscalerConnectionChainID + - Vec: + - 0 + - 80 + - 86 + - 0 + - 215 + - 43 + - 33 + - 84 + - 27 + - 244 + - 43 + - 84 + - 247 + - 173 + - 11 + - 0 + - - Netscaler: NetscalerConnectionChainHopCount + - DataNumber: 1 + - - Netscaler: NetscalerHttpReqUrl + - String: "/vpn/index.html\u0000" + - - Netscaler: NetscalerHttpReqCookie + - String: "\u0000" + - - Netscaler: NetscalerHttpReqReferer + - String: "\u0000" + - - Netscaler: NetscalerHttpReqMethod + - String: "GET\u0000" + - - Netscaler: NetscalerHttpReqHost + - String: "int-app-netscaler-10-1-ext.lab2.net\u0000" + - - Netscaler: NetscalerHttpReqUserAgent + - String: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0\u0000" + - - Netscaler: NetscalerHttpContentType + - String: "\u0000" + - - Netscaler: NetscalerHttpReqAuthorization + - String: "\u0000" + - - Netscaler: NetscalerHttpReqVia + - String: "\u0000" + - - Netscaler: NetscalerHttpReqXForwardedFor + - String: "\u0000" + - - Netscaler: NetscalerAaaUsername + - String: "\u0000" + - - - IANA: ObservationPointId + - DataNumber: 8731347 + - - IANA: ExportingProcessId + - DataNumber: 0 + - - IANA: FlowId + - DataNumber: 2040953 + - - Netscaler: NetscalerTransactionId + - DataNumber: 94120 + - - Netscaler: NetscalerConnectionId + - DataNumber: 2040953 + - - IANA: IpVersion + - DataNumber: 4 + - - IANA: ProtocolIdentifier + - ProtocolType: Tcp + - - IANA: PaddingOctets + - String: "\u0000\u0000" + - - IANA: SourceIpv4address + - Ip4Addr: 172.18.129.61 + - - IANA: DestinationIpv4address + - Ip4Addr: 172.18.159.99 + - - IANA: SourceTransportPort + - DataNumber: 51612 + - - IANA: DestinationTransportPort + - DataNumber: 443 + - - IANA: PacketDeltaCount + - DataNumber: 1 + - - IANA: OctetDeltaCount + - DataNumber: 40 + - - IANA: TcpControlBits + - DataNumber: 16 + - - Netscaler: NetscalerFlowFlags + - DataNumber: 84025344 + - - IANA: FlowStartMicroseconds + - Duration: + secs: 15552744373216 + nanos: 853386000 + - - IANA: FlowEndMicroseconds + - Duration: + secs: 15552744373216 + nanos: 853386000 + - - IANA: IngressInterface + - DataNumber: 1 + - - IANA: EgressInterface + - DataNumber: 2147483651 + - - Netscaler: NetscalerAppNameAppId + - DataNumber: 9510 + - - Netscaler: NetscalerAppUnitNameAppId + - DataNumber: 0 + - - Netscaler: NetscalerHttpResForwFB + - DataNumber: 0 + - - Netscaler: NetscalerHttpResForwLB + - DataNumber: 0 + - - Netscaler: NetscalerConnectionChainID + - Vec: + - 0 + - 80 + - 86 + - 0 + - 215 + - 43 + - 33 + - 84 + - 27 + - 244 + - 43 + - 84 + - 247 + - 173 + - 11 + - 0 + - - Netscaler: NetscalerConnectionChainHopCount + - DataNumber: 1 + - - Netscaler: NetscalerHttpReqUrl + - String: "\u0000" + - - Netscaler: NetscalerHttpReqCookie + - String: "\u0000" + - - Netscaler: NetscalerHttpReqReferer + - String: "\u0000" + - - Netscaler: NetscalerHttpReqMethod + - String: "\u0000" + - - Netscaler: NetscalerHttpReqHost + - String: "\u0000" + - - Netscaler: NetscalerHttpReqUserAgent + - String: "\u0000" + - - Netscaler: NetscalerHttpContentType + - String: "\u0000" + - - Netscaler: NetscalerHttpReqAuthorization + - String: "\u0000" + - - Netscaler: NetscalerHttpReqVia + - String: "\u0000" + - - Netscaler: NetscalerHttpReqXForwardedFor + - String: "\u0000" + - - Netscaler: NetscalerAaaUsername + - String: "\u0000" + - header: + header_id: 257 + length: 118 + body: + Data: + fields: + - - - IANA: ObservationPointId + - DataNumber: 8731347 + - - IANA: ExportingProcessId + - DataNumber: 0 + - - IANA: FlowId + - DataNumber: 2040954 + - - Netscaler: NetscalerTransactionId + - DataNumber: 94120 + - - Netscaler: NetscalerConnectionId + - DataNumber: 2040953 + - - IANA: IpVersion + - DataNumber: 4 + - - IANA: ProtocolIdentifier + - ProtocolType: Tcp + - - IANA: PaddingOctets + - String: "\u0000\u0000" + - - IANA: SourceIpv4address + - Ip4Addr: 172.18.159.99 + - - IANA: DestinationIpv4address + - Ip4Addr: 172.18.129.61 + - - IANA: SourceTransportPort + - DataNumber: 443 + - - IANA: DestinationTransportPort + - DataNumber: 51612 + - - IANA: PacketDeltaCount + - DataNumber: 7 + - - IANA: OctetDeltaCount + - DataNumber: 6917 + - - IANA: TcpControlBits + - DataNumber: 24 + - - Netscaler: NetscalerFlowFlags + - DataNumber: 1090527232 + - - IANA: FlowStartMicroseconds + - Duration: + secs: 15552744373216 + nanos: 838403000 + - - IANA: FlowEndMicroseconds + - Duration: + secs: 15552744373216 + nanos: 850391000 + - - Netscaler: NetscalerRoundTripTime + - DataNumber: 3 + - - IANA: EgressInterface + - DataNumber: 1 + - - IANA: IngressInterface + - DataNumber: 2147483651 + - - Netscaler: NetscalerAppNameAppId + - DataNumber: 9510 + - - Netscaler: NetscalerConnectionChainID + - Vec: + - 0 + - 80 + - 86 + - 0 + - 215 + - 43 + - 33 + - 84 + - 27 + - 244 + - 43 + - 84 + - 247 + - 173 + - 11 + - 0 + - - Netscaler: NetscalerConnectionChainHopCount + - DataNumber: 1 + - header: + header_id: 258 + length: 503 + body: + Data: + fields: + - - - IANA: ObservationPointId + - DataNumber: 8731347 + - - IANA: ExportingProcessId + - DataNumber: 0 + - - IANA: FlowId + - DataNumber: 2040953 + - - Netscaler: NetscalerTransactionId + - DataNumber: 94121 + - - Netscaler: NetscalerConnectionId + - DataNumber: 2040953 + - - IANA: IpVersion + - DataNumber: 4 + - - IANA: ProtocolIdentifier + - ProtocolType: Tcp + - - IANA: PaddingOctets + - String: "\u0000\u0000" + - - IANA: SourceIpv4address + - Ip4Addr: 172.18.129.61 + - - IANA: DestinationIpv4address + - Ip4Addr: 172.18.159.99 + - - IANA: SourceTransportPort + - DataNumber: 51612 + - - IANA: DestinationTransportPort + - DataNumber: 443 + - - IANA: PacketDeltaCount + - DataNumber: 1 + - - IANA: OctetDeltaCount + - DataNumber: 482 + - - IANA: TcpControlBits + - DataNumber: 24 + - - Netscaler: NetscalerFlowFlags + - DataNumber: 84025344 + - - IANA: FlowStartMicroseconds + - Duration: + secs: 15552744373216 + nanos: 884381000 + - - IANA: FlowEndMicroseconds + - Duration: + secs: 15552744373216 + nanos: 884381000 + - - IANA: IngressInterface + - DataNumber: 1 + - - IANA: EgressInterface + - DataNumber: 2147483651 + - - Netscaler: NetscalerAppNameAppId + - DataNumber: 9510 + - - Netscaler: NetscalerAppUnitNameAppId + - DataNumber: 0 + - - Netscaler: NetscalerHttpResForwFB + - DataNumber: 0 + - - Netscaler: NetscalerHttpResForwLB + - DataNumber: 0 + - - Netscaler: NetscalerConnectionChainID + - Vec: + - 0 + - 80 + - 86 + - 0 + - 215 + - 43 + - 33 + - 84 + - 27 + - 244 + - 43 + - 84 + - 157 + - 54 + - 12 + - 0 + - - Netscaler: NetscalerConnectionChainHopCount + - DataNumber: 1 + - - Netscaler: NetscalerHttpReqUrl + - String: "/vpn/images/caxtonstyle.css\u0000" + - - Netscaler: NetscalerHttpReqCookie + - String: "\u0000" + - - Netscaler: NetscalerHttpReqReferer + - String: "https://int-app-netscaler-10-1-ext.lab2.net/vpn/index.html\u0000" + - - Netscaler: NetscalerHttpReqMethod + - String: "GET\u0000" + - - Netscaler: NetscalerHttpReqHost + - String: "int-app-netscaler-10-1-ext.lab2.net\u0000" + - - Netscaler: NetscalerHttpReqUserAgent + - String: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0\u0000" + - - Netscaler: NetscalerHttpContentType + - String: "\u0000" + - - Netscaler: NetscalerHttpReqAuthorization + - String: "\u0000" + - - Netscaler: NetscalerHttpReqVia + - String: "\u0000" + - - Netscaler: NetscalerHttpReqXForwardedFor + - String: "\u0000" + - - Netscaler: NetscalerAaaUsername + - String: "\u0000" + - - - IANA: ObservationPointId + - DataNumber: 8731347 + - - IANA: ExportingProcessId + - DataNumber: 0 + - - IANA: FlowId + - DataNumber: 2040953 + - - Netscaler: NetscalerTransactionId + - DataNumber: 94121 + - - Netscaler: NetscalerConnectionId + - DataNumber: 2040953 + - - IANA: IpVersion + - DataNumber: 4 + - - IANA: ProtocolIdentifier + - ProtocolType: Tcp + - - IANA: PaddingOctets + - String: "\u0000\u0000" + - - IANA: SourceIpv4address + - Ip4Addr: 172.18.129.61 + - - IANA: DestinationIpv4address + - Ip4Addr: 172.18.159.99 + - - IANA: SourceTransportPort + - DataNumber: 51612 + - - IANA: DestinationTransportPort + - DataNumber: 443 + - - IANA: PacketDeltaCount + - DataNumber: 3 + - - IANA: OctetDeltaCount + - DataNumber: 120 + - - IANA: TcpControlBits + - DataNumber: 16 + - - Netscaler: NetscalerFlowFlags + - DataNumber: 84025344 + - - IANA: FlowStartMicroseconds + - Duration: + secs: 15552744373216 + nanos: 886381000 + - - IANA: FlowEndMicroseconds + - Duration: + secs: 15552744373216 + nanos: 889368000 + - - IANA: IngressInterface + - DataNumber: 1 + - - IANA: EgressInterface + - DataNumber: 2147483651 + - - Netscaler: NetscalerAppNameAppId + - DataNumber: 9510 + - - Netscaler: NetscalerAppUnitNameAppId + - DataNumber: 0 + - - Netscaler: NetscalerHttpResForwFB + - DataNumber: 0 + - - Netscaler: NetscalerHttpResForwLB + - DataNumber: 0 + - - Netscaler: NetscalerConnectionChainID + - Vec: + - 0 + - 80 + - 86 + - 0 + - 215 + - 43 + - 33 + - 84 + - 27 + - 244 + - 43 + - 84 + - 157 + - 54 + - 12 + - 0 + - - Netscaler: NetscalerConnectionChainHopCount + - DataNumber: 1 + - - Netscaler: NetscalerHttpReqUrl + - String: "\u0000" + - - Netscaler: NetscalerHttpReqCookie + - String: "\u0000" + - - Netscaler: NetscalerHttpReqReferer + - String: "\u0000" + - - Netscaler: NetscalerHttpReqMethod + - String: "\u0000" + - - Netscaler: NetscalerHttpReqHost + - String: "\u0000" + - - Netscaler: NetscalerHttpReqUserAgent + - String: "\u0000" + - - Netscaler: NetscalerHttpContentType + - String: "\u0000" + - - Netscaler: NetscalerHttpReqAuthorization + - String: "\u0000" + - - Netscaler: NetscalerHttpReqVia + - String: "\u0000" + - - Netscaler: NetscalerHttpReqXForwardedFor + - String: "\u0000" + - - Netscaler: NetscalerAaaUsername + - String: "\u0000" + - header: + header_id: 257 + length: 118 + body: + Data: + fields: + - - - IANA: ObservationPointId + - DataNumber: 8731347 + - - IANA: ExportingProcessId + - DataNumber: 0 + - - IANA: FlowId + - DataNumber: 2040954 + - - Netscaler: NetscalerTransactionId + - DataNumber: 94121 + - - Netscaler: NetscalerConnectionId + - DataNumber: 2040953 + - - IANA: IpVersion + - DataNumber: 4 + - - IANA: ProtocolIdentifier + - ProtocolType: Tcp + - - IANA: PaddingOctets + - String: "\u0000\u0000" + - - IANA: SourceIpv4address + - Ip4Addr: 172.18.159.99 + - - IANA: DestinationIpv4address + - Ip4Addr: 172.18.129.61 + - - IANA: SourceTransportPort + - DataNumber: 443 + - - IANA: DestinationTransportPort + - DataNumber: 51612 + - - IANA: PacketDeltaCount + - DataNumber: 15 + - - IANA: OctetDeltaCount + - DataNumber: 21968 + - - IANA: TcpControlBits + - DataNumber: 24 + - - Netscaler: NetscalerFlowFlags + - DataNumber: 1093672960 + - - IANA: FlowStartMicroseconds + - Duration: + secs: 15552744373216 + nanos: 884381000 + - - IANA: FlowEndMicroseconds + - Duration: + secs: 15552744373216 + nanos: 886381000 + - - Netscaler: NetscalerRoundTripTime + - DataNumber: 2 + - - IANA: EgressInterface + - DataNumber: 1 + - - IANA: IngressInterface + - DataNumber: 2147483651 + - - Netscaler: NetscalerAppNameAppId + - DataNumber: 9510 + - - Netscaler: NetscalerConnectionChainID + - Vec: + - 0 + - 80 + - 86 + - 0 + - 215 + - 43 + - 33 + - 84 + - 27 + - 244 + - 43 + - 84 + - 157 + - 54 + - 12 + - 0 + - - Netscaler: NetscalerConnectionChainHopCount + - DataNumber: 1 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_with_no_template_fields.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_with_no_template_fields.snap index 3909f69b..3539c83f 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_with_no_template_fields.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_with_no_template_fields.snap @@ -9,4 +9,8 @@ expression: parser.parse_bytes(&packet) export_time: 1 sequence_number: 1 observation_domain_id: 0 - flowsets: [] + flowsets: + - header: + header_id: 258 + length: 10 + body: Empty diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_with_v9_options_template_packet.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_with_v9_options_template_packet.snap index 88550ca7..701e8670 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_with_v9_options_template_packet.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_with_v9_options_template_packet.snap @@ -43,62 +43,62 @@ expression: "NetflowParser::default().parse_bytes(&packet)" field_count: 9 fields: - field_type_number: 8 - field_type: SourceIpv4address field_length: 4 + field_type: + IANA: SourceIpv4address - field_type_number: 12 - field_type: DestinationIpv4address field_length: 4 + field_type: + IANA: DestinationIpv4address - field_type_number: 7 - field_type: SourceTransportPort field_length: 2 + field_type: + IANA: SourceTransportPort - field_type_number: 11 - field_type: DestinationTransportPort field_length: 2 + field_type: + IANA: DestinationTransportPort - field_type_number: 4 - field_type: ProtocolIdentifier field_length: 1 + field_type: + IANA: ProtocolIdentifier - field_type_number: 2 - field_type: PacketDeltaCount field_length: 4 + field_type: + IANA: PacketDeltaCount - field_type_number: 1 - field_type: OctetDeltaCount field_length: 4 + field_type: + IANA: OctetDeltaCount - field_type_number: 22 - field_type: FlowStartSysUpTime field_length: 4 + field_type: + IANA: FlowStartSysUpTime - field_type_number: 21 - field_type: FlowEndSysUpTime field_length: 4 + field_type: + IANA: FlowEndSysUpTime - header: header_id: 258 length: 33 body: Data: fields: - - 0: - - SourceIpv4address + - - - IANA: SourceIpv4address - Ip4Addr: 70.70.1.1 - - 1: - - DestinationIpv4address + - - IANA: DestinationIpv4address - Ip4Addr: 120.120.1.1 - - 2: - - SourceTransportPort + - - IANA: SourceTransportPort - DataNumber: 12345 - - 3: - - DestinationTransportPort + - - IANA: DestinationTransportPort - DataNumber: 32777 - - 4: - - ProtocolIdentifier + - - IANA: ProtocolIdentifier - ProtocolType: Tcp - - 5: - - PacketDeltaCount + - - IANA: PacketDeltaCount - DataNumber: 100 - - 6: - - OctetDeltaCount + - - IANA: OctetDeltaCount - DataNumber: 125000000 - - 7: - - FlowStartSysUpTime + - - IANA: FlowStartSysUpTime - DataNumber: 1744871721 - - 8: - - FlowEndSysUpTime + - - IANA: FlowEndSysUpTime - DataNumber: 1744871721 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_multiple_packets.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_multiple_packets.snap index 74478e07..f97854c1 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_multiple_packets.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_multiple_packets.snap @@ -32,11 +32,9 @@ expression: "NetflowParser::default().parse_bytes(&all)" body: Data: fields: - - 0: - - InBytes + - - - InBytes - DataNumber: 151126788 - 1: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 9.9.9.8 - V5: header: @@ -133,11 +131,9 @@ expression: "NetflowParser::default().parse_bytes(&all)" body: Data: fields: - - 0: - - InBytes + - - - InBytes - DataNumber: 151126788 - 1: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 9.9.9.8 - IPFix: header: @@ -156,37 +152,34 @@ expression: "NetflowParser::default().parse_bytes(&all)" field_count: 3 fields: - field_type_number: 8 - field_type: SourceIpv4address field_length: 4 + field_type: + IANA: SourceIpv4address - field_type_number: 12 - field_type: DestinationIpv4address field_length: 4 + field_type: + IANA: DestinationIpv4address - field_type_number: 2 - field_type: PacketDeltaCount field_length: 4 + field_type: + IANA: PacketDeltaCount - header: header_id: 256 length: 28 body: Data: fields: - - 0: - - SourceIpv4address + - - - IANA: SourceIpv4address - Ip4Addr: 1.2.3.4 - - 1: - - DestinationIpv4address + - - IANA: DestinationIpv4address - Ip4Addr: 1.2.3.3 - - 2: - - PacketDeltaCount + - - IANA: PacketDeltaCount - DataNumber: 16909058 - - 0: - - SourceIpv4address + - - - IANA: SourceIpv4address - Ip4Addr: 0.2.0.2 - - 1: - - DestinationIpv4address + - - IANA: DestinationIpv4address - Ip4Addr: 0.1.2.3 - - 2: - - PacketDeltaCount + - - IANA: PacketDeltaCount - DataNumber: 67438087 - V5: header: diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9.snap index 0be72acb..5394c888 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9.snap @@ -32,9 +32,7 @@ expression: "NetflowParser::default().parse_bytes(&packet)" body: Data: fields: - - 0: - - InBytes + - - - InBytes - DataNumber: 151126788 - 1: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 9.9.9.8 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_data_cached_template.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_data_cached_template.snap index aa80997b..165675e4 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_data_cached_template.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_data_cached_template.snap @@ -17,9 +17,7 @@ expression: parser.parse_bytes(&packet) body: Data: fields: - - 0: - - InBytes + - - - InBytes - DataNumber: 151126788 - 1: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 9.9.9.8 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_ipv6flowlabel.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_ipv6flowlabel.snap index 49a23e3a..50b12ad5 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_ipv6flowlabel.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_ipv6flowlabel.snap @@ -287,135 +287,101 @@ expression: "NetflowParser::default().parse_bytes(&packets)" body: Data: fields: - - 0: - - Ipv4SrcAddr + - - - Ipv4SrcAddr - Ip4Addr: 192.168.18.10 - 1: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 141.24.12.2 - 2: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 0.0.0.0 - 3: - - L4SrcPort + - - L4SrcPort - DataNumber: 49856 - 4: - - L4DstPort + - - L4DstPort - DataNumber: 53 - 5: - - InputSnmp + - - InputSnmp - DataNumber: 2 - 6: - - OutputSnmp + - - OutputSnmp - DataNumber: 0 - 7: - - Unknown + - - Unknown - Vec: - 0 - 0 - 0 - 0 - 8: - - Unknown + - - Unknown - Vec: - 0 - 0 - 0 - 0 - 9: - - InPkts + - - InPkts - DataNumber: 1 - 10: - - InBytes + - - InBytes - DataNumber: 82 - 11: - - FirstSwitched + - - FirstSwitched - Duration: secs: 10690 nanos: 167000000 - 12: - - LastSwitched + - - LastSwitched - Duration: secs: 10690 nanos: 167000000 - 13: - - Protocol + - - Protocol - ProtocolType: Udp - 14: - - SrcTos + - - SrcTos - DataNumber: 0 - 15: - - Unknown + - - Unknown - Vec: - 8 - 0 - 16: - - Direction + - - Direction - DataNumber: 1 - - 0: - - Ipv4SrcAddr + - - - Ipv4SrcAddr - Ip4Addr: 192.168.18.10 - 1: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 141.24.12.2 - 2: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 0.0.0.0 - 3: - - L4SrcPort + - - L4SrcPort - DataNumber: 40483 - 4: - - L4DstPort + - - L4DstPort - DataNumber: 53 - 5: - - InputSnmp + - - InputSnmp - DataNumber: 2 - 6: - - OutputSnmp + - - OutputSnmp - DataNumber: 0 - 7: - - Unknown + - - Unknown - Vec: - 0 - 0 - 0 - 0 - 8: - - Unknown + - - Unknown - Vec: - 0 - 0 - 0 - 0 - 9: - - InPkts + - - InPkts - DataNumber: 1 - 10: - - InBytes + - - InBytes - DataNumber: 82 - 11: - - FirstSwitched + - - FirstSwitched - Duration: secs: 10688 nanos: 891000000 - 12: - - LastSwitched + - - LastSwitched - Duration: secs: 10688 nanos: 891000000 - 13: - - Protocol + - - Protocol - ProtocolType: Udp - 14: - - SrcTos + - - SrcTos - DataNumber: 0 - 15: - - Unknown + - - Unknown - Vec: - 8 - 0 - 16: - - Direction + - - Direction - DataNumber: 1 - header: flowset_id: 262 @@ -423,77 +389,57 @@ expression: "NetflowParser::default().parse_bytes(&packets)" body: Data: fields: - - 0: - - Ipv6SrcAddr + - - - Ipv6SrcAddr - Ip6Addr: "fd01:8::2a20:235f:1f7b:9379" - 1: - - Ipv6DstAddr + - - Ipv6DstAddr - Ip6Addr: "fd00::b2f2:8ff:fe20:1180" - 2: - - Ipv6NextHop + - - Ipv6NextHop - Ip6Addr: "::" - 3: - - Ipv6FlowLabel + - - Ipv6FlowLabel - DataNumber: 128630 - 4: - - L4SrcPort + - - L4SrcPort - DataNumber: 58037 - 5: - - L4DstPort + - - L4DstPort - DataNumber: 53 - 6: - - TcpFlags + - - TcpFlags - DataNumber: 0 - 7: - - InputSnmp + - - InputSnmp - DataNumber: 2 - 8: - - OutputSnmp + - - OutputSnmp - DataNumber: 0 - 9: - - Unknown + - - Unknown - Vec: - 0 - 0 - 0 - 0 - 10: - - Unknown + - - Unknown - Vec: - 0 - 0 - 0 - 0 - 11: - - InPkts + - - InPkts - DataNumber: 1 - 12: - - InBytes + - - InBytes - DataNumber: 102 - 13: - - FirstSwitched + - - FirstSwitched - Duration: secs: 10688 nanos: 891000000 - 14: - - LastSwitched + - - LastSwitched - Duration: secs: 10688 nanos: 891000000 - 15: - - Protocol + - - Protocol - ProtocolType: Udp - 16: - - SrcTos + - - SrcTos - DataNumber: 0 - 17: - - InDstMac + - - InDstMac - MacAddr: "10:90:27:E0:43:6D" - 18: - - Unknown + - - Unknown - Vec: - 134 - 221 - 19: - - Direction + - - Direction - DataNumber: 1 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_many_flows.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_many_flows.snap index f95f125c..c9d7043d 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_many_flows.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_many_flows.snap @@ -32,15 +32,11 @@ expression: "NetflowParser::default().parse_bytes(&packet)" body: Data: fields: - - 0: - - InBytes + - - - InBytes - DataNumber: 151126788 - 1: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 9.9.9.8 - - 0: - - InBytes + - - - InBytes - DataNumber: 151126788 - 1: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 9.9.9.8 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_template_and_data_packet.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_template_and_data_packet.snap index 39323a56..f83877e6 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_template_and_data_packet.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_template_and_data_packet.snap @@ -278,164 +278,116 @@ expression: "NetflowParser::default().parse_bytes(&packet)" body: Data: fields: - - 0: - - Ipv6SrcAddr + - - - Ipv6SrcAddr - Ip6Addr: "2003:d1:ef3b:2200:fe34:97ff:feb7:686e" - 1: - - Ipv6DstAddr + - - Ipv6DstAddr - Ip6Addr: "2606:4700:3032::6815:5338" - 2: - - FirstSwitched + - - FirstSwitched - Duration: secs: 5 nanos: 637000000 - 3: - - LastSwitched + - - LastSwitched - Duration: secs: 42 nanos: 8000000 - 4: - - InBytes + - - InBytes - DataNumber: 1215 - 5: - - InPkts + - - InPkts - DataNumber: 9 - 6: - - InputSnmp + - - InputSnmp - DataNumber: 0 - 7: - - OutputSnmp + - - OutputSnmp - DataNumber: 0 - 8: - - Direction + - - Direction - DataNumber: 0 - 9: - - Unknown + - - Unknown - Vec: - 3 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 58068 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 443 - 12: - - Protocol + - - Protocol - ProtocolType: Tcp - 13: - - TcpFlags + - - TcpFlags - DataNumber: 25 - 14: - - IpProtocolVersion + - - IpProtocolVersion - DataNumber: 6 - 15: - - SrcTos + - - SrcTos - DataNumber: 0 - - 0: - - Ipv6SrcAddr + - - - Ipv6SrcAddr - Ip6Addr: "2606:4700:3032::6815:5338" - 1: - - Ipv6DstAddr + - - Ipv6DstAddr - Ip6Addr: "2003:d1:ef3b:2200:fe34:97ff:feb7:686e" - 2: - - FirstSwitched + - - FirstSwitched - Duration: secs: 5 nanos: 637000000 - 3: - - LastSwitched + - - LastSwitched - Duration: secs: 42 nanos: 8000000 - 4: - - InBytes + - - InBytes - DataNumber: 180 - 5: - - InPkts + - - InPkts - DataNumber: 3 - 6: - - InputSnmp + - - InputSnmp - DataNumber: 0 - 7: - - OutputSnmp + - - OutputSnmp - DataNumber: 0 - 8: - - Direction + - - Direction - DataNumber: 1 - 9: - - Unknown + - - Unknown - Vec: - 3 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 443 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 58068 - 12: - - Protocol + - - Protocol - ProtocolType: Tcp - 13: - - TcpFlags + - - TcpFlags - DataNumber: 4 - 14: - - IpProtocolVersion + - - IpProtocolVersion - DataNumber: 6 - 15: - - SrcTos + - - SrcTos - DataNumber: 0 - - 0: - - Ipv6SrcAddr + - - - Ipv6SrcAddr - Ip6Addr: "::1" - 1: - - Ipv6DstAddr + - - Ipv6DstAddr - Ip6Addr: "::1" - 2: - - FirstSwitched + - - FirstSwitched - Duration: secs: 20 nanos: 268000000 - 3: - - LastSwitched + - - LastSwitched - Duration: secs: 20 nanos: 268000000 - 4: - - InBytes + - - InBytes - DataNumber: 60 - 5: - - InPkts + - - InPkts - DataNumber: 1 - 6: - - InputSnmp + - - InputSnmp - DataNumber: 0 - 7: - - OutputSnmp + - - OutputSnmp - DataNumber: 0 - 8: - - Direction + - - Direction - DataNumber: 0 - 9: - - Unknown + - - Unknown - Vec: - 3 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 8081 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 43754 - 12: - - Protocol + - - Protocol - ProtocolType: Tcp - 13: - - TcpFlags + - - TcpFlags - DataNumber: 20 - 14: - - IpProtocolVersion + - - IpProtocolVersion - DataNumber: 6 - 15: - - SrcTos + - - SrcTos - DataNumber: 0 - header: flowset_id: 1024 @@ -443,321 +395,225 @@ expression: "NetflowParser::default().parse_bytes(&packet)" body: Data: fields: - - 0: - - Ipv4SrcAddr + - - - Ipv4SrcAddr - Ip4Addr: 157.240.251.61 - 1: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 192.168.1.215 - 2: - - FirstSwitched + - - FirstSwitched - Duration: secs: 25 nanos: 352000000 - 3: - - LastSwitched + - - LastSwitched - Duration: secs: 30 nanos: 421000000 - 4: - - InBytes + - - InBytes - DataNumber: 2930 - 5: - - InPkts + - - InPkts - DataNumber: 24 - 6: - - InputSnmp + - - InputSnmp - DataNumber: 0 - 7: - - OutputSnmp + - - OutputSnmp - DataNumber: 0 - 8: - - Direction + - - Direction - DataNumber: 0 - 9: - - Unknown + - - Unknown - Vec: - 3 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 5222 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 44112 - 12: - - Protocol + - - Protocol - ProtocolType: Tcp - 13: - - TcpFlags + - - TcpFlags - DataNumber: 26 - 14: - - IpProtocolVersion + - - IpProtocolVersion - DataNumber: 4 - 15: - - SrcTos + - - SrcTos - DataNumber: 0 - - 0: - - Ipv4SrcAddr + - - - Ipv4SrcAddr - Ip4Addr: 192.168.1.215 - 1: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 157.240.251.61 - 2: - - FirstSwitched + - - FirstSwitched - Duration: secs: 25 nanos: 352000000 - 3: - - LastSwitched + - - LastSwitched - Duration: secs: 30 nanos: 421000000 - 4: - - InBytes + - - InBytes - DataNumber: 3639 - 5: - - InPkts + - - InPkts - DataNumber: 33 - 6: - - InputSnmp + - - InputSnmp - DataNumber: 0 - 7: - - OutputSnmp + - - OutputSnmp - DataNumber: 0 - 8: - - Direction + - - Direction - DataNumber: 1 - 9: - - Unknown + - - Unknown - Vec: - 3 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 44112 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 5222 - 12: - - Protocol + - - Protocol - ProtocolType: Tcp - 13: - - TcpFlags + - - TcpFlags - DataNumber: 30 - 14: - - IpProtocolVersion + - - IpProtocolVersion - DataNumber: 4 - 15: - - SrcTos + - - SrcTos - DataNumber: 0 - - 0: - - Ipv4SrcAddr + - - - Ipv4SrcAddr - Ip4Addr: 93.209.14.73 - 1: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 157.240.251.61 - 2: - - FirstSwitched + - - FirstSwitched - Duration: secs: 25 nanos: 352000000 - 3: - - LastSwitched + - - LastSwitched - Duration: secs: 30 nanos: 422000000 - 4: - - InBytes + - - InBytes - DataNumber: 1213 - 5: - - InPkts + - - InPkts - DataNumber: 11 - 6: - - InputSnmp + - - InputSnmp - DataNumber: 0 - 7: - - OutputSnmp + - - OutputSnmp - DataNumber: 0 - 8: - - Direction + - - Direction - DataNumber: 0 - 9: - - Unknown + - - Unknown - Vec: - 3 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 44112 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 5222 - 12: - - Protocol + - - Protocol - ProtocolType: Tcp - 13: - - TcpFlags + - - TcpFlags - DataNumber: 30 - 14: - - IpProtocolVersion + - - IpProtocolVersion - DataNumber: 4 - 15: - - SrcTos + - - SrcTos - DataNumber: 0 - - 0: - - Ipv4SrcAddr + - - - Ipv4SrcAddr - Ip4Addr: 157.240.251.61 - 1: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 93.209.14.73 - 2: - - FirstSwitched + - - FirstSwitched - Duration: secs: 25 nanos: 352000000 - 3: - - LastSwitched + - - LastSwitched - Duration: secs: 30 nanos: 422000000 - 4: - - InBytes + - - InBytes - DataNumber: 1465 - 5: - - InPkts + - - InPkts - DataNumber: 12 - 6: - - InputSnmp + - - InputSnmp - DataNumber: 0 - 7: - - OutputSnmp + - - OutputSnmp - DataNumber: 0 - 8: - - Direction + - - Direction - DataNumber: 1 - 9: - - Unknown + - - Unknown - Vec: - 3 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 5222 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 44112 - 12: - - Protocol + - - Protocol - ProtocolType: Tcp - 13: - - TcpFlags + - - TcpFlags - DataNumber: 26 - 14: - - IpProtocolVersion + - - IpProtocolVersion - DataNumber: 4 - 15: - - SrcTos + - - SrcTos - DataNumber: 0 - - 0: - - Ipv4SrcAddr + - - - Ipv4SrcAddr - Ip4Addr: 192.168.1.37 - 1: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 198.252.206.25 - 2: - - FirstSwitched + - - FirstSwitched - Duration: secs: 43 nanos: 288000000 - 3: - - LastSwitched + - - LastSwitched - Duration: secs: 43 nanos: 469000000 - 4: - - InBytes + - - InBytes - DataNumber: 635 - 5: - - InPkts + - - InPkts - DataNumber: 9 - 6: - - InputSnmp + - - InputSnmp - DataNumber: 0 - 7: - - OutputSnmp + - - OutputSnmp - DataNumber: 0 - 8: - - Direction + - - Direction - DataNumber: 0 - 9: - - Unknown + - - Unknown - Vec: - 3 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 41796 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 443 - 12: - - Protocol + - - Protocol - ProtocolType: Tcp - 13: - - TcpFlags + - - TcpFlags - DataNumber: 25 - 14: - - IpProtocolVersion + - - IpProtocolVersion - DataNumber: 4 - 15: - - SrcTos + - - SrcTos - DataNumber: 0 - - 0: - - Ipv4SrcAddr + - - - Ipv4SrcAddr - Ip4Addr: 198.252.206.25 - 1: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 192.168.1.37 - 2: - - FirstSwitched + - - FirstSwitched - Duration: secs: 43 nanos: 288000000 - 3: - - LastSwitched + - - LastSwitched - Duration: secs: 43 nanos: 469000000 - 4: - - InBytes + - - InBytes - DataNumber: 264 - 5: - - InPkts + - - InPkts - DataNumber: 6 - 6: - - InputSnmp + - - InputSnmp - DataNumber: 0 - 7: - - OutputSnmp + - - OutputSnmp - DataNumber: 0 - 8: - - Direction + - - Direction - DataNumber: 1 - 9: - - Unknown + - - Unknown - Vec: - 3 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 443 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 41796 - 12: - - Protocol + - - Protocol - ProtocolType: Tcp - 13: - - TcpFlags + - - TcpFlags - DataNumber: 21 - 14: - - IpProtocolVersion + - - IpProtocolVersion - DataNumber: 4 - 15: - - SrcTos + - - SrcTos - DataNumber: 0 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_with_multiple_options_data.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_with_multiple_options_data.snap index 969ab707..5a6e7b14 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_with_multiple_options_data.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_v9_with_multiple_options_data.snap @@ -190,685 +190,475 @@ expression: "NetflowParser::default().parse_bytes(&packet)" body: Data: fields: - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 22469 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.87 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.103 - 8: - - Protocol + - - Protocol - ProtocolType: Tcp - 9: - - SrcTos + - - SrcTos - DataNumber: 160 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 3768 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 4793 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 54 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.36 - 15: - - DstMask + - - DstMask - DataNumber: 28 - 16: - - SrcMask + - - SrcMask - DataNumber: 5 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 22 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 192 - 20: - - SrcAs + - - SrcAs - DataNumber: 23 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 11511 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.42 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.190 - 8: - - Protocol + - - Protocol - ProtocolType: Udp - 9: - - SrcTos + - - SrcTos - DataNumber: 192 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 52628 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 20901 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 242 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.9 - 15: - - DstMask + - - DstMask - DataNumber: 7 - 16: - - SrcMask + - - SrcMask - DataNumber: 9 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 17 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 94 - 20: - - SrcAs + - - SrcAs - DataNumber: 119 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 50221 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.98 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.10 - 8: - - Protocol + - - Protocol - ProtocolType: Icmp - 9: - - SrcTos + - - SrcTos - DataNumber: 0 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 28924 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 37242 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 183 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.85 - 15: - - DstMask + - - DstMask - DataNumber: 12 - 16: - - SrcMask + - - SrcMask - DataNumber: 22 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 17 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 69 - 20: - - SrcAs + - - SrcAs - DataNumber: 182 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 17000 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.29 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.217 - 8: - - Protocol + - - Protocol - ProtocolType: Tcp - 9: - - SrcTos + - - SrcTos - DataNumber: 16 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 54019 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 31892 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 135 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.54 - 15: - - DstMask + - - DstMask - DataNumber: 18 - 16: - - SrcMask + - - SrcMask - DataNumber: 20 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 24 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 3 - 20: - - SrcAs + - - SrcAs - DataNumber: 3 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 3836 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.9 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.62 - 8: - - Protocol + - - Protocol - ProtocolType: Icmp - 9: - - SrcTos + - - SrcTos - DataNumber: 160 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 24247 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 57095 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 35 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.40 - 15: - - DstMask + - - DstMask - DataNumber: 21 - 16: - - SrcMask + - - SrcMask - DataNumber: 29 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 4 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 46 - 20: - - SrcAs + - - SrcAs - DataNumber: 62 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 62314 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.46 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.149 - 8: - - Protocol + - - Protocol - ProtocolType: Udp - 9: - - SrcTos + - - SrcTos - DataNumber: 160 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 17989 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 51448 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 95 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.89 - 15: - - DstMask + - - DstMask - DataNumber: 4 - 16: - - SrcMask + - - SrcMask - DataNumber: 12 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 27 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 193 - 20: - - SrcAs + - - SrcAs - DataNumber: 20 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 14336 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.45 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.145 - 8: - - Protocol + - - Protocol - ProtocolType: Udp - 9: - - SrcTos + - - SrcTos - DataNumber: 160 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 31952 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 34224 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 139 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.62 - 15: - - DstMask + - - DstMask - DataNumber: 19 - 16: - - SrcMask + - - SrcMask - DataNumber: 28 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 16 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 70 - 20: - - SrcAs + - - SrcAs - DataNumber: 184 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 18757 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.27 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.196 - 8: - - Protocol + - - Protocol - ProtocolType: Icmp - 9: - - SrcTos + - - SrcTos - DataNumber: 160 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 30703 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 35045 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 154 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.69 - 15: - - DstMask + - - DstMask - DataNumber: 29 - 16: - - SrcMask + - - SrcMask - DataNumber: 2 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 16 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 62 - 20: - - SrcAs + - - SrcAs - DataNumber: 163 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 33913 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.58 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.183 - 8: - - Protocol + - - Protocol - ProtocolType: Udp - 9: - - SrcTos + - - SrcTos - DataNumber: 192 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 47159 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 51444 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 95 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.89 - 15: - - DstMask + - - DstMask - DataNumber: 4 - 16: - - SrcMask + - - SrcMask - DataNumber: 12 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 27 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 194 - 20: - - SrcAs + - - SrcAs - DataNumber: 6 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 7454 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.17 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.122 - 8: - - Protocol + - - Protocol - ProtocolType: Tcp - 9: - - SrcTos + - - SrcTos - DataNumber: 16 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 45231 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 54318 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 122 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.56 - 15: - - DstMask + - - DstMask - DataNumber: 17 - 16: - - SrcMask + - - SrcMask - DataNumber: 21 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 17 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 76 - 20: - - SrcAs + - - SrcAs - DataNumber: 127 - header: flowset_id: 256 @@ -876,685 +666,475 @@ expression: "NetflowParser::default().parse_bytes(&packet)" body: Data: fields: - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 68548 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.17 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.126 - 8: - - Protocol + - - Protocol - ProtocolType: Tcp - 9: - - SrcTos + - - SrcTos - DataNumber: 16 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 35973 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 38493 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 184 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.79 - 15: - - DstMask + - - DstMask - DataNumber: 10 - 16: - - SrcMask + - - SrcMask - DataNumber: 28 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 16 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 66 - 20: - - SrcAs + - - SrcAs - DataNumber: 198 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 2470 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.4 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.25 - 8: - - Protocol + - - Protocol - ProtocolType: Icmp - 9: - - SrcTos + - - SrcTos - DataNumber: 192 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 36432 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 37072 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 178 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.84 - 15: - - DstMask + - - DstMask - DataNumber: 14 - 16: - - SrcMask + - - SrcMask - DataNumber: 17 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 2 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 142 - 20: - - SrcAs + - - SrcAs - DataNumber: 175 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 29252 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.64 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.229 - 8: - - Protocol + - - Protocol - ProtocolType: Icmp - 9: - - SrcTos + - - SrcTos - DataNumber: 192 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 33344 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 33832 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 143 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.57 - 15: - - DstMask + - - DstMask - DataNumber: 21 - 16: - - SrcMask + - - SrcMask - DataNumber: 26 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 26 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 107 - 20: - - SrcAs + - - SrcAs - DataNumber: 120 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 50925 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.100 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.2 - 8: - - Protocol + - - Protocol - ProtocolType: Icmp - 9: - - SrcTos + - - SrcTos - DataNumber: 0 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 2362 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 6644 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 42 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.50 - 15: - - DstMask + - - DstMask - DataNumber: 15 - 16: - - SrcMask + - - SrcMask - DataNumber: 15 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 2 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 102 - 20: - - SrcAs + - - SrcAs - DataNumber: 106 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 41046 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.61 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.175 - 8: - - Protocol + - - Protocol - ProtocolType: Udp - 9: - - SrcTos + - - SrcTos - DataNumber: 0 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 12773 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 21100 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 247 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.11 - 15: - - DstMask + - - DstMask - DataNumber: 5 - 16: - - SrcMask + - - SrcMask - DataNumber: 15 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 2 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 103 - 20: - - SrcAs + - - SrcAs - DataNumber: 110 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 44693 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.75 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.193 - 8: - - Protocol + - - Protocol - ProtocolType: Icmp - 9: - - SrcTos + - - SrcTos - DataNumber: 160 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 23774 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 58643 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 41 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.48 - 15: - - DstMask + - - DstMask - DataNumber: 17 - 16: - - SrcMask + - - SrcMask - DataNumber: 17 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 27 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 172 - 20: - - SrcAs + - - SrcAs - DataNumber: 85 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 54633 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.86 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.106 - 8: - - Protocol + - - Protocol - ProtocolType: Udp - 9: - - SrcTos + - - SrcTos - DataNumber: 160 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 17988 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 51476 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 95 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.88 - 15: - - DstMask + - - DstMask - DataNumber: 4 - 16: - - SrcMask + - - SrcMask - DataNumber: 12 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 27 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 190 - 20: - - SrcAs + - - SrcAs - DataNumber: 17 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 17657 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.31 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.208 - 8: - - Protocol + - - Protocol - ProtocolType: Tcp - 9: - - SrcTos + - - SrcTos - DataNumber: 16 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 47983 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 49960 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 79 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.82 - 15: - - DstMask + - - DstMask - DataNumber: 13 - 16: - - SrcMask + - - SrcMask - DataNumber: 18 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 27 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 152 - 20: - - SrcAs + - - SrcAs - DataNumber: 51 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 59060 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.30 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.222 - 8: - - Protocol + - - Protocol - ProtocolType: Tcp - 9: - - SrcTos + - - SrcTos - DataNumber: 16 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 60658 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 12666 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 83 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.96 - 15: - - DstMask + - - DstMask - DataNumber: 3 - 16: - - SrcMask + - - SrcMask - DataNumber: 4 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 26 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 146 - 20: - - SrcAs + - - SrcAs - DataNumber: 161 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 26110 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.98 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.11 - 8: - - Protocol + - - Protocol - ProtocolType: Icmp - 9: - - SrcTos + - - SrcTos - DataNumber: 0 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 26239 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 43420 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 253 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.3 - 15: - - DstMask + - - DstMask - DataNumber: 1 - 16: - - SrcMask + - - SrcMask - DataNumber: 3 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 16 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 90 - 20: - - SrcAs + - - SrcAs - DataNumber: 116 - header: flowset_id: 256 @@ -1562,685 +1142,475 @@ expression: "NetflowParser::default().parse_bytes(&packet)" body: Data: fields: - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 56498 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.78 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.76 - 8: - - Protocol + - - Protocol - ProtocolType: Udp - 9: - - SrcTos + - - SrcTos - DataNumber: 192 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 44126 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 62559 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 27 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.18 - 15: - - DstMask + - - DstMask - DataNumber: 14 - 16: - - SrcMask + - - SrcMask - DataNumber: 18 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 27 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 194 - 20: - - SrcAs + - - SrcAs - DataNumber: 19 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 13191 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.49 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.132 - 8: - - Protocol + - - Protocol - ProtocolType: Tcp - 9: - - SrcTos + - - SrcTos - DataNumber: 16 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 48550 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 49043 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 67 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.77 - 15: - - DstMask + - - DstMask - DataNumber: 9 - 16: - - SrcMask + - - SrcMask - DataNumber: 25 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 26 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 104 - 20: - - SrcAs + - - SrcAs - DataNumber: 112 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 43491 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.70 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.214 - 8: - - Protocol + - - Protocol - ProtocolType: Tcp - 9: - - SrcTos + - - SrcTos - DataNumber: 16 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 37816 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 48033 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 199 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.29 - 15: - - DstMask + - - DstMask - DataNumber: 26 - 16: - - SrcMask + - - SrcMask - DataNumber: 12 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 27 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 157 - 20: - - SrcAs + - - SrcAs - DataNumber: 71 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 70685 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.22 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.88 - 8: - - Protocol + - - Protocol - ProtocolType: Udp - 9: - - SrcTos + - - SrcTos - DataNumber: 0 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 18684 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 55554 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 109 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.72 - 15: - - DstMask + - - DstMask - DataNumber: 26 - 16: - - SrcMask + - - SrcMask - DataNumber: 12 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 27 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 161 - 20: - - SrcAs + - - SrcAs - DataNumber: 69 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 73882 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.4 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.25 - 8: - - Protocol + - - Protocol - ProtocolType: Icmp - 9: - - SrcTos + - - SrcTos - DataNumber: 192 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 35379 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 39960 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 167 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.91 - 15: - - DstMask + - - DstMask - DataNumber: 6 - 16: - - SrcMask + - - SrcMask - DataNumber: 9 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 17 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 78 - 20: - - SrcAs + - - SrcAs - DataNumber: 136 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 73548 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.11 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.45 - 8: - - Protocol + - - Protocol - ProtocolType: Tcp - 9: - - SrcTos + - - SrcTos - DataNumber: 16 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 43210 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 64423 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 2 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.3 - 15: - - DstMask + - - DstMask - DataNumber: 1 - 16: - - SrcMask + - - SrcMask - DataNumber: 3 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 16 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 82 - 20: - - SrcAs + - - SrcAs - DataNumber: 147 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 61275 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.34 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.250 - 8: - - Protocol + - - Protocol - ProtocolType: Icmp - 9: - - SrcTos + - - SrcTos - DataNumber: 0 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 15333 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 19513 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 212 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.50 - 15: - - DstMask + - - DstMask - DataNumber: 16 - 16: - - SrcMask + - - SrcMask - DataNumber: 16 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 2 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 130 - 20: - - SrcAs + - - SrcAs - DataNumber: 185 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 18094 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.27 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.205 - 8: - - Protocol + - - Protocol - ProtocolType: Tcp - 9: - - SrcTos + - - SrcTos - DataNumber: 160 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 3850 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 4881 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 55 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.35 - 15: - - DstMask + - - DstMask - DataNumber: 28 - 16: - - SrcMask + - - SrcMask - DataNumber: 7 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 22 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 167 - 20: - - SrcAs + - - SrcAs - DataNumber: 99 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 38963 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.54 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.136 - 8: - - Protocol + - - Protocol - ProtocolType: Tcp - 9: - - SrcTos + - - SrcTos - DataNumber: 16 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 64029 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 1348 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 13 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.9 - 15: - - DstMask + - - DstMask - DataNumber: 7 - 16: - - SrcMask + - - SrcMask - DataNumber: 9 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 17 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 95 - 20: - - SrcAs + - - SrcAs - DataNumber: 108 - - 0: - - LastSwitched + - - - LastSwitched - Duration: secs: 3488219 nanos: 376000000 - 1: - - FirstSwitched + - - FirstSwitched - Duration: secs: 3488219 nanos: 284000000 - 2: - - InBytes + - - InBytes - DataNumber: 2003 - 3: - - InPkts + - - InPkts - DataNumber: 47659 - 4: - - InputSnmp + - - InputSnmp - DataNumber: 4 - 5: - - OutputSnmp + - - OutputSnmp - DataNumber: 2 - 6: - - Ipv4SrcAddr + - - Ipv4SrcAddr - Ip4Addr: 10.0.0.63 - 7: - - Ipv4DstAddr + - - Ipv4DstAddr - Ip4Addr: 12.0.0.223 - 8: - - Protocol + - - Protocol - ProtocolType: Icmp - 9: - - SrcTos + - - SrcTos - DataNumber: 192 - 10: - - L4SrcPort + - - L4SrcPort - DataNumber: 42544 - 11: - - L4DstPort + - - L4DstPort - DataNumber: 59214 - 12: - - FlowSamplerId + - - FlowSamplerId - DataNumber: 0 - 13: - - Vendor + - - Vendor - Vec: - 58 - 14: - - Ipv4NextHop + - - Ipv4NextHop - Ip4Addr: 10.0.0.32 - 15: - - DstMask + - - DstMask - DataNumber: 25 - 16: - - SrcMask + - - SrcMask - DataNumber: 13 - 17: - - TcpFlags + - - TcpFlags - DataNumber: 2 - 18: - - Direction + - - Direction - DataNumber: 0 - 19: - - DstAs + - - DstAs - DataNumber: 139 - 20: - - SrcAs + - - SrcAs - DataNumber: 168 - header: flowset_id: 257 diff --git a/src/tests.rs b/src/tests.rs index 0a012296..264075c3 100644 --- a/src/tests.rs +++ b/src/tests.rs @@ -4,6 +4,7 @@ mod base_tests { use crate::variable_versions::ipfix::{ Template as IPFixTemplate, TemplateField as IPFixTemplateField, }; + use crate::variable_versions::ipfix_lookup::{IANAIPFixField, IPFixField}; use crate::variable_versions::v9::{ Template as V9Template, TemplateField as V9TemplateField, }; @@ -334,15 +335,13 @@ mod base_tests { let fields = vec![ IPFixTemplateField { field_type_number: 2, - field_type: - crate::variable_versions::ipfix_lookup::IPFixField::PacketDeltaCount, + field_type: IPFixField::IANA(IANAIPFixField::PacketDeltaCount), field_length: 2, enterprise_number: None, }, IPFixTemplateField { field_type_number: 8, - field_type: - crate::variable_versions::ipfix_lookup::IPFixField::SourceIpv4address, + field_type: IPFixField::IANA(IANAIPFixField::SourceIpv4address), field_length: 4, enterprise_number: None, }, @@ -519,4 +518,36 @@ mod base_tests { .first() .unwrap(); } + + #[test] + fn it_parses_ipfix_multiple_templates() { + let hex = r#"000a05b4542bf40f0001f2c100000000000205a401000017008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80c000100000173f80c100010000173f01010018008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008808000040000173f000e0004000a0004809700040000173f80c000100000173f80c100010000173f01020025008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80ab00040000173f809e00080000173f80aa00080000173f80c000100000173f80c100010000173f8082ffff0000173f8083ffff0000173f808cffff0000173f808dffff0000173f808effff0000173f808fffff0000173f80b7ffff0000173f80b9ffff0000173f80baffff0000173f80beffff0000173f80cdffff0000173f01030017008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80c000100000173f80c100010000173f01040018008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008808000040000173f000e0004000a0004809700040000173f80c000100000173f80c100010000173f01050025008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80ab00040000173f809e00080000173f80aa00080000173f80c000100000173f80c100010000173f8082ffff0000173f8083ffff0000173f808cffff0000173f808dffff0000173f808effff0000173f808fffff0000173f80b7ffff0000173f80b9ffff0000173f80baffff0000173f80beffff0000173f80cdffff0000173f01060026008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809000020000173f809100080000173f809200080000173f809300080000173f809700040000173f80a100040000173f80a200040000173f809900080000173f809c00080000173f809d00080000173f809f00080000173f80a000080000173f80a900080000173f80b600040000173f80b7ffff0000173f80bbffff0000173f80bcffff0000173f80bdffff0000173f01070026008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809000020000173f809100080000173f809200080000173f809300080000173f809700040000173f80a100040000173f80a200040000173f809900080000173f809c00080000173f809d00080000173f809f00080000173f80a000080000173f80a900080000173f80b600040000173f80b7ffff0000173f80bbffff0000173f80bcffff0000173f80bdffff0000173f"#; + let packet = hex::decode(hex).unwrap(); + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packet)); + } + + #[test] + fn it_parses_ipfix_multiple_flow_records() { + let hex0: &'static str = r#"000a058c542bf40f0001f2c1000000000002057c010a000400900004808100040000173f80a8ffff0000173f80a3ffff0000173f010b000400900004808100040000173f80a4ffff0000173f80a5ffff0000173f010d0019008a00040090000400940008808100040000173f808500040000173f003c0001003d0001000400010006000100080004000c000400070002000b00020002000800010008808400080000173f009a0008009b0008000a0004000e0004809700040000173f80ae00010000173f80ad00010000173f00d2000280b2ffff0000173f010e001d008a00040090000400940008808100040000173f808500040000173f003c0001003d0001000400010006000100080004000c000400070002000b00020002000800010008808400080000173f009a0008009b0008000a0004000e0004809700040000173f809200080000173f809300080000173f80ae00010000173f00d2000100d2000280b400080000173f80b500080000173f80b3ffff0000173f010f001a008a00040090000400940008808500040000173f003c00010004000100d2000200080004000c000400070002000b000280c800100000173f80f700040000173f80f800100000173f80f900080000173f80d100040000173f80cb00040000173f80ca00020000173f80d000020000173f80c000100000173f80c100010000173f80c9ffff0000173f80ccffff0000173f80faffff0000173f80cfffff0000173f80d2ffff0000173f01100020008a00040090000400940008808500040000173f003c00010004000100d2000280c800100000173f80f700040000173f80f800100000173f80f900080000173f80d600010000173f80d700040000173f80d800040000173f80d900040000173f80db00020000173f80dc00020000173f80dd00040000173f80de00040000173f80f300040000173f80f400040000173f80fe00040000173f80ff00040000173f810000040000173f810100040000173f810200040000173f810300040000173f810400040000173f810500020000173f810600020000173f810700020000173f810800020000173f01110017008a00040090000400940008808500040000173f003c00010004000100d2000280c800100000173f80f700040000173f80f800100000173f80f900080000173f80df00040000173f80e000040000173f80e100040000173f80e200040000173f80e300040000173f80e400040000173f80e500040000173f80e600040000173f80e700040000173f80e800040000173f80e900040000173f80ea00040000173f01120016008a00040090000400940008808500040000173f003c00010004000100d2000200080004000c000400070002000b000280c800100000173f80f700040000173f80f800100000173f80f900080000173f80eb00020000173f80ec00040000173f80ed00020000173f80ef00040000173f80f500040000173f80eeffff0000173f80f6ffff0000173f0113000e008a00040090000400940008808500040000173f003c00010004000100d2000280c800100000173f80f700040000173f80f800100000173f80f900080000173f80f000020000173f80f500040000173f80f100040000173f0114000c008a00040090000400940008808500040000173f003c00010004000100d2000280c800100000173f80f700040000173f80f800100000173f80f900080000173f80f200040000173f01150005008a00040090000480fb00010000173f80fc00080000173f80fd00080000173f01160018008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80c000100000173f80c100010000173f80cdffff0000173f"#; + let hex1: &'static str = r#"000a05b4542bf40f0001f2c100000000000205a401000017008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80c000100000173f80c100010000173f01010018008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008808000040000173f000e0004000a0004809700040000173f80c000100000173f80c100010000173f01020025008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80ab00040000173f809e00080000173f80aa00080000173f80c000100000173f80c100010000173f8082ffff0000173f8083ffff0000173f808cffff0000173f808dffff0000173f808effff0000173f808fffff0000173f80b7ffff0000173f80b9ffff0000173f80baffff0000173f80beffff0000173f80cdffff0000173f01030017008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80c000100000173f80c100010000173f01040018008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008808000040000173f000e0004000a0004809700040000173f80c000100000173f80c100010000173f01050025008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80ab00040000173f809e00080000173f80aa00080000173f80c000100000173f80c100010000173f8082ffff0000173f8083ffff0000173f808cffff0000173f808dffff0000173f808effff0000173f808fffff0000173f80b7ffff0000173f80b9ffff0000173f80baffff0000173f80beffff0000173f80cdffff0000173f01060026008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809000020000173f809100080000173f809200080000173f809300080000173f809700040000173f80a100040000173f80a200040000173f809900080000173f809c00080000173f809d00080000173f809f00080000173f80a000080000173f80a900080000173f80b600040000173f80b7ffff0000173f80bbffff0000173f80bcffff0000173f80bdffff0000173f01070026008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809000020000173f809100080000173f809200080000173f809300080000173f809700040000173f80a100040000173f80a200040000173f809900080000173f809c00080000173f809d00080000173f809f00080000173f80a000080000173f80a900080000173f80b600040000173f80b7ffff0000173f80bbffff0000173f80bcffff0000173f80bdffff0000173f"#; + let hex2 = r#"000a04c1542bf41b0001f2c1000000000115001d00853ad3000000000100000000000000050000000000000000010201b100853ad30000000000000000001f247900016fa8001f247904060000ac12813dac129f63c99c01bb00000000000000030000000000000331180000000005022000d7d6729b000b8303d7d6729b000badf7000000018000000300002526000000000000000000000000000000000000000000505600d72b21541bf42b54f7ad0b0001102f76706e2f696e6465782e68746d6c0001000100044745540024696e742d6170702d6e65747363616c65722d31302d312d6578742e6c6162322e6e657400494d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b20574f5736343b2072763a33322e3029204765636b6f2f32303130303130312046697265666f782f33322e30000100010001000100010000853ad30000000000000000001f247900016fa8001f247904060000ac12813dac129f63c99c01bb00000000000000010000000000000028100000000005022000d7d6729b000bbd8ad7d6729b000bbd8a000000018000000300002526000000000000000000000000000000000000000000505600d72b21541bf42b54f7ad0b0001010001000100010001000100010001000100010001000101007600853ad30000000000000000001f247a00016fa8001f247904060000ac129f63ac12813d01bbc99c00000000000000070000000000001b05180000000041002000d7d6729b000b8303d7d6729b000bb1d70000000300000001800000030000252600505600d72b21541bf42b54f7ad0b0001010201f700853ad30000000000000000001f247900016fa9001f247904060000ac12813dac129f63c99c01bb000000000000000100000000000001e2180000000005022000d7d6729b000c369dd7d6729b000c369d000000018000000300002526000000000000000000000000000000000000000000505600d72b21541bf42b549d360c00011c2f76706e2f696d616765732f636178746f6e7374796c652e6373730001003b68747470733a2f2f696e742d6170702d6e65747363616c65722d31302d312d6578742e6c6162322e6e65742f76706e2f696e6465782e68746d6c00044745540024696e742d6170702d6e65747363616c65722d31302d312d6578742e6c6162322e6e657400494d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b20574f5736343b2072763a33322e3029204765636b6f2f32303130303130312046697265666f782f33322e30000100010001000100010000853ad30000000000000000001f247900016fa9001f247904060000ac12813dac129f63c99c01bb00000000000000030000000000000078100000000005022000d7d6729b000c3e6dd7d6729b000c4a18000000018000000300002526000000000000000000000000000000000000000000505600d72b21541bf42b549d360c0001010001000100010001000100010001000100010001000101007600853ad30000000000000000001f247a00016fa9001f247904060000ac129f63ac12813d01bbc99c000000000000000f00000000000055d0180000000041302000d7d6729b000c369dd7d6729b000c3e6d0000000200000001800000030000252600505600d72b21541bf42b549d360c0001"#; + + let mut parser = NetflowParser::default(); + + parser.parse_bytes(&hex::decode(hex0).unwrap()); + parser.parse_bytes(&hex::decode(hex1).unwrap()); + + assert_yaml_snapshot!(parser.parse_bytes(&hex::decode(hex2).unwrap())); + } + + #[test] + fn it_parses_ipfix_template_of_first_flowset_unknown() { + let hex1: &'static str = r#"000a05b4542bf40f0001f2c100000000000205a401000017008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80c000100000173f80c100010000173f01010018008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008808000040000173f000e0004000a0004809700040000173f80c000100000173f80c100010000173f01020025008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80ab00040000173f809e00080000173f80aa00080000173f80c000100000173f80c100010000173f8082ffff0000173f8083ffff0000173f808cffff0000173f808dffff0000173f808effff0000173f808fffff0000173f80b7ffff0000173f80b9ffff0000173f80baffff0000173f80beffff0000173f80cdffff0000173f01030017008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80c000100000173f80c100010000173f01040018008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008808000040000173f000e0004000a0004809700040000173f80c000100000173f80c100010000173f01050025008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80ab00040000173f809e00080000173f80aa00080000173f80c000100000173f80c100010000173f8082ffff0000173f8083ffff0000173f808cffff0000173f808dffff0000173f808effff0000173f808fffff0000173f80b7ffff0000173f80b9ffff0000173f80baffff0000173f80beffff0000173f80cdffff0000173f01060026008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809000020000173f809100080000173f809200080000173f809300080000173f809700040000173f80a100040000173f80a200040000173f809900080000173f809c00080000173f809d00080000173f809f00080000173f80a000080000173f80a900080000173f80b600040000173f80b7ffff0000173f80bbffff0000173f80bcffff0000173f80bdffff0000173f01070026008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809000020000173f809100080000173f809200080000173f809300080000173f809700040000173f80a100040000173f80a200040000173f809900080000173f809c00080000173f809d00080000173f809f00080000173f80a000080000173f80a900080000173f80b600040000173f80b7ffff0000173f80bbffff0000173f80bcffff0000173f80bdffff0000173f"#; + let hex2 = r#"000a04c1542bf41b0001f2c1000000000115001d00853ad3000000000100000000000000050000000000000000010201b100853ad30000000000000000001f247900016fa8001f247904060000ac12813dac129f63c99c01bb00000000000000030000000000000331180000000005022000d7d6729b000b8303d7d6729b000badf7000000018000000300002526000000000000000000000000000000000000000000505600d72b21541bf42b54f7ad0b0001102f76706e2f696e6465782e68746d6c0001000100044745540024696e742d6170702d6e65747363616c65722d31302d312d6578742e6c6162322e6e657400494d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b20574f5736343b2072763a33322e3029204765636b6f2f32303130303130312046697265666f782f33322e30000100010001000100010000853ad30000000000000000001f247900016fa8001f247904060000ac12813dac129f63c99c01bb00000000000000010000000000000028100000000005022000d7d6729b000bbd8ad7d6729b000bbd8a000000018000000300002526000000000000000000000000000000000000000000505600d72b21541bf42b54f7ad0b0001010001000100010001000100010001000100010001000101007600853ad30000000000000000001f247a00016fa8001f247904060000ac129f63ac12813d01bbc99c00000000000000070000000000001b05180000000041002000d7d6729b000b8303d7d6729b000bb1d70000000300000001800000030000252600505600d72b21541bf42b54f7ad0b0001010201f700853ad30000000000000000001f247900016fa9001f247904060000ac12813dac129f63c99c01bb000000000000000100000000000001e2180000000005022000d7d6729b000c369dd7d6729b000c369d000000018000000300002526000000000000000000000000000000000000000000505600d72b21541bf42b549d360c00011c2f76706e2f696d616765732f636178746f6e7374796c652e6373730001003b68747470733a2f2f696e742d6170702d6e65747363616c65722d31302d312d6578742e6c6162322e6e65742f76706e2f696e6465782e68746d6c00044745540024696e742d6170702d6e65747363616c65722d31302d312d6578742e6c6162322e6e657400494d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b20574f5736343b2072763a33322e3029204765636b6f2f32303130303130312046697265666f782f33322e30000100010001000100010000853ad30000000000000000001f247900016fa9001f247904060000ac12813dac129f63c99c01bb00000000000000030000000000000078100000000005022000d7d6729b000c3e6dd7d6729b000c4a18000000018000000300002526000000000000000000000000000000000000000000505600d72b21541bf42b549d360c0001010001000100010001000100010001000100010001000101007600853ad30000000000000000001f247a00016fa9001f247904060000ac129f63ac12813d01bbc99c000000000000000f00000000000055d0180000000041302000d7d6729b000c369dd7d6729b000c3e6d0000000200000001800000030000252600505600d72b21541bf42b549d360c0001"#; + + let mut parser = NetflowParser::default(); + + parser.parse_bytes(&hex::decode(hex1).unwrap()); + assert_yaml_snapshot!(parser.parse_bytes(&hex::decode(hex2).unwrap())); + } } diff --git a/src/variable_versions/ipfix.rs b/src/variable_versions/ipfix.rs index 4ce92d30..67e772ec 100644 --- a/src/variable_versions/ipfix.rs +++ b/src/variable_versions/ipfix.rs @@ -34,7 +34,8 @@ const DATA_TEMPLATE_IPFIX_ID: u16 = 2; const OPTIONS_TEMPLATE_IPFIX_ID: u16 = 3; type TemplateId = u16; -type IPFixFieldPair = (IPFixField, FieldValue); +pub type IPFixFieldPair = (IPFixField, FieldValue); +pub type IpFixFlowRecord = Vec; #[derive(Debug, Default, PartialEq, Clone, Serialize)] pub struct IPFixParser { @@ -81,13 +82,18 @@ pub struct IPFix { #[derive(Debug, PartialEq, Clone, Serialize)] pub enum FlowSetBody { Template(Template), + Templates(Vec