From c46c0f33ea166d858751393fe3c81fb2a82583a3 Mon Sep 17 00:00:00 2001 From: mikemiles-dev Date: Tue, 1 Jul 2025 09:43:00 -0500 Subject: [PATCH 1/9] fix: # 0.5.9 * IPFIX now supports Multiple Templates * Re-added Enterprise Field Type for Unknown Enterprise Types. * Multiple IPFIX Types Cisco, IANA, Netscaler types --- Cargo.toml | 2 +- RELEASES.md | 6 + src/netflow_common.rs | 60 +- ...ests__it_parses_0_length_fields_ipfix.snap | 15 +- ...r__tests__base_tests__it_parses_ipfix.snap | 21 +- ..._it_parses_ipfix_data_cached_template.snap | 4 +- ...nterprise_bit_in_non_options_template.snap | 7 +- ...pfix_enterprise_bit_template_and_data.snap | 226 +- ...d_enteprise_and_non_enterprise_fields.snap | 851 ++--- ...s__it_parses_ipfix_multiple_templates.snap | 1125 +++++++ ...sts__it_parses_ipfix_options_template.snap | 9 +- ...rses_ipfix_options_template_with_data.snap | 21 +- ...tests__it_parses_ipfix_scappy_example.snap | 115 +- ...ipfix_scappy_example_options_template.snap | 9 +- ...ipfix_with_v9_options_template_packet.snap | 45 +- ...ase_tests__it_parses_multiple_packets.snap | 21 +- src/tests.rs | 14 +- src/variable_versions/ipfix.rs | 102 +- src/variable_versions/ipfix_lookup.rs | 2935 +++++++++++------ ...ests__it_tests_field_data_type_lookup.snap | 10 +- src/variable_versions/v9_lookup.rs | 210 +- 21 files changed, 4052 insertions(+), 1756 deletions(-) create mode 100644 src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_multiple_templates.snap diff --git a/Cargo.toml b/Cargo.toml index 2e107698..d386c4d4 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,7 +1,7 @@ [package] name = "netflow_parser" description = "Parser for Netflow Cisco V5, V7, V9, IPFIX" -version = "0.5.8" +version = "0.5.9" edition = "2024" authors = ["michael.mileusnich@gmail.com"] license = "MIT OR Apache-2.0" diff --git a/RELEASES.md b/RELEASES.md index 0846aed1..b4ecfb92 100644 --- a/RELEASES.md +++ b/RELEASES.md @@ -1,3 +1,9 @@ +# 0.5.9 +* IPFIX now supports Multiple Templates +* Correctly handling Different Enterprise Field Types. +* Added Netscaler PEN Types. +* Re-added Enterprise Field Type for Unknown Enterprise Types. + # 0.5.8 * V9 Found and fixed divide by 0 issue. * IPFix Protocol Identifier now parsers as ProtocolIdentifier Field Type and not UnsignedDataNumber. diff --git a/src/netflow_common.rs b/src/netflow_common.rs index d61ec39e..7d5f3ed2 100644 --- a/src/netflow_common.rs +++ b/src/netflow_common.rs @@ -5,7 +5,7 @@ use crate::NetflowPacket; use crate::protocol::ProtocolTypes; use crate::static_versions::{v5::V5, v7::V7}; use crate::variable_versions::data_number::FieldValue; -use crate::variable_versions::ipfix_lookup::IPFixField; +use crate::variable_versions::ipfix_lookup::{IANAIPFixField, IPFixField}; use crate::variable_versions::v9_lookup::V9Field; use crate::variable_versions::{ ipfix::{FlowSetBody as IPFixFlowSetBody, IPFix}, @@ -187,40 +187,47 @@ impl From<&IPFix> for NetflowCommon { data_field.values().cloned().collect(); flowsets.push(NetflowCommonFlowSet { src_addr: value_map - .get(&IPFixField::SourceIpv4address) - .or_else(|| value_map.get(&IPFixField::SourceIpv6address)) + .get(&IPFixField::IANA(IANAIPFixField::SourceIpv4address)) + .or_else(|| { + value_map + .get(&IPFixField::IANA(IANAIPFixField::SourceIpv6address)) + }) .and_then(|v| v.try_into().ok()), dst_addr: value_map - .get(&IPFixField::DestinationIpv4address) - .or_else(|| value_map.get(&IPFixField::DestinationIpv6address)) + .get(&IPFixField::IANA(IANAIPFixField::DestinationIpv4address)) + .or_else(|| { + value_map.get(&IPFixField::IANA( + IANAIPFixField::DestinationIpv6address, + )) + }) .and_then(|v| v.try_into().ok()), src_port: value_map - .get(&IPFixField::SourceTransportPort) + .get(&IPFixField::IANA(IANAIPFixField::SourceTransportPort)) .and_then(|v| v.try_into().ok()), dst_port: value_map - .get(&IPFixField::DestinationTransportPort) + .get(&IPFixField::IANA(IANAIPFixField::DestinationTransportPort)) .and_then(|v| v.try_into().ok()), protocol_number: value_map - .get(&IPFixField::ProtocolIdentifier) + .get(&IPFixField::IANA(IANAIPFixField::ProtocolIdentifier)) .and_then(|v| v.try_into().ok()), - protocol_type: value_map.get(&IPFixField::ProtocolIdentifier).and_then( - |v| { + protocol_type: value_map + .get(&IPFixField::IANA(IANAIPFixField::ProtocolIdentifier)) + .and_then(|v| { v.try_into() .ok() .map(|proto: u8| ProtocolTypes::from(proto)) - }, - ), + }), first_seen: value_map - .get(&IPFixField::FlowStartSysUpTime) + .get(&IPFixField::IANA(IANAIPFixField::FlowStartSysUpTime)) .and_then(|v| v.try_into().ok()), last_seen: value_map - .get(&IPFixField::FlowEndSysUpTime) + .get(&IPFixField::IANA(IANAIPFixField::FlowEndSysUpTime)) .and_then(|v| v.try_into().ok()), src_mac: value_map - .get(&IPFixField::SourceMacaddress) + .get(&IPFixField::IANA(IANAIPFixField::SourceMacaddress)) .and_then(|v| v.try_into().ok()), dst_mac: value_map - .get(&IPFixField::DestinationMacaddress) + .get(&IPFixField::IANA(IANAIPFixField::DestinationMacaddress)) .and_then(|v| v.try_into().ok()), }); } @@ -249,7 +256,7 @@ mod common_tests { Data as IPFixData, FlowSet as IPFixFlowSet, FlowSetBody as IPFixFlowSetBody, FlowSetHeader as IPFixFlowSetHeader, Header as IPFixHeader, IPFix, }; - use crate::variable_versions::ipfix_lookup::IPFixField; + use crate::variable_versions::ipfix_lookup::{IANAIPFixField, IPFixField}; use crate::variable_versions::v9::{ Data as V9Data, FlowSet as V9FlowSet, FlowSetBody as V9FlowSetBody, FlowSetHeader as V9FlowSetHeader, Header as V9Header, V9, @@ -511,68 +518,67 @@ mod common_tests { length: 0, }, body: IPFixFlowSetBody::Data(IPFixData { - padding: vec![], fields: vec![BTreeMap::from([ ( 0, ( - IPFixField::SourceIpv4address, + IPFixField::IANA(IANAIPFixField::SourceIpv4address), FieldValue::Ip4Addr(Ipv4Addr::new(192, 168, 1, 1)), ), ), ( 1, ( - IPFixField::DestinationIpv4address, + IPFixField::IANA(IANAIPFixField::DestinationIpv4address), FieldValue::Ip4Addr(Ipv4Addr::new(192, 168, 1, 2)), ), ), ( 2, ( - IPFixField::SourceTransportPort, + IPFixField::IANA(IANAIPFixField::SourceTransportPort), FieldValue::DataNumber(DataNumber::U16(1234)), ), ), ( 3, ( - IPFixField::DestinationTransportPort, + IPFixField::IANA(IANAIPFixField::DestinationTransportPort), FieldValue::DataNumber(DataNumber::U16(80)), ), ), ( 4, ( - IPFixField::ProtocolIdentifier, + IPFixField::IANA(IANAIPFixField::ProtocolIdentifier), FieldValue::DataNumber(DataNumber::U8(6)), ), ), ( 5, ( - IPFixField::FlowStartSysUpTime, + IPFixField::IANA(IANAIPFixField::FlowStartSysUpTime), FieldValue::DataNumber(DataNumber::U32(100)), ), ), ( 6, ( - IPFixField::FlowEndSysUpTime, + IPFixField::IANA(IANAIPFixField::FlowEndSysUpTime), FieldValue::DataNumber(DataNumber::U32(200)), ), ), ( 7, ( - IPFixField::SourceMacaddress, + IPFixField::IANA(IANAIPFixField::SourceMacaddress), FieldValue::MacAddr("00:00:00:00:00:01".to_string()), ), ), ( 8, ( - IPFixField::DestinationMacaddress, + IPFixField::IANA(IANAIPFixField::DestinationMacaddress), FieldValue::MacAddr("00:00:00:00:00:02".to_string()), ), ), diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_0_length_fields_ipfix.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_0_length_fields_ipfix.snap index 02b51621..2758292d 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_0_length_fields_ipfix.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_0_length_fields_ipfix.snap @@ -19,14 +19,17 @@ expression: "NetflowParser::default().parse_bytes(&packet)" field_count: 3 fields: - field_type_number: 8 - field_type: SourceIpv4address field_length: 4 + field_type: + IANA: SourceIpv4address - field_type_number: 12 - field_type: DestinationIpv4address field_length: 4 + field_type: + IANA: DestinationIpv4address - field_type_number: 65 - field_type: AssignedforNetFlowv9compatibility field_length: 0 + field_type: + IANA: AssignedforNetFlowv9compatibility - header: header_id: 256 length: 12 @@ -34,11 +37,11 @@ expression: "NetflowParser::default().parse_bytes(&packet)" Data: fields: - 0: - - SourceIpv4address + - IANA: SourceIpv4address - Ip4Addr: 1.2.3.4 - 1: - - DestinationIpv4address + - IANA: DestinationIpv4address - Ip4Addr: 1.2.3.4 - 2: - - AssignedforNetFlowv9compatibility + - IANA: AssignedforNetFlowv9compatibility - Vec: [] diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix.snap index b241f121..7349d283 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix.snap @@ -19,14 +19,17 @@ expression: "NetflowParser::default().parse_bytes(&packet)" field_count: 3 fields: - field_type_number: 8 - field_type: SourceIpv4address field_length: 4 + field_type: + IANA: SourceIpv4address - field_type_number: 12 - field_type: DestinationIpv4address field_length: 4 + field_type: + IANA: DestinationIpv4address - field_type_number: 2 - field_type: PacketDeltaCount field_length: 4 + field_type: + IANA: PacketDeltaCount - header: header_id: 256 length: 28 @@ -34,20 +37,20 @@ expression: "NetflowParser::default().parse_bytes(&packet)" Data: fields: - 0: - - SourceIpv4address + - IANA: SourceIpv4address - Ip4Addr: 1.2.3.4 - 1: - - DestinationIpv4address + - IANA: DestinationIpv4address - Ip4Addr: 1.2.3.3 - 2: - - PacketDeltaCount + - IANA: PacketDeltaCount - DataNumber: 16909058 - 0: - - SourceIpv4address + - IANA: SourceIpv4address - Ip4Addr: 0.2.0.2 - 1: - - DestinationIpv4address + - IANA: DestinationIpv4address - Ip4Addr: 0.1.2.3 - 2: - - PacketDeltaCount + - IANA: PacketDeltaCount - DataNumber: 67438087 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_data_cached_template.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_data_cached_template.snap index 94e2db70..64959993 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_data_cached_template.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_data_cached_template.snap @@ -17,8 +17,8 @@ expression: parser.parse_bytes(&packet) Data: fields: - 0: - - PacketDeltaCount + - IANA: PacketDeltaCount - DataNumber: 8 - 1: - - SourceIpv4address + - IANA: SourceIpv4address - Ip4Addr: 0.0.1.1 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_enterprise_bit_in_non_options_template.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_enterprise_bit_in_non_options_template.snap index be05551e..25193dea 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_enterprise_bit_in_non_options_template.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_enterprise_bit_in_non_options_template.snap @@ -19,11 +19,12 @@ expression: "NetflowParser::default().parse_bytes(&packet)" field_count: 2 fields: - field_type_number: 103 - field_type: Layer2packetSectionSize field_length: 65535 enterprise_number: 407732327 - - field_type_number: 32767 field_type: - Unknown: 32767 + Enterprise: 103 + - field_type_number: 32767 field_length: 0 enterprise_number: 407732544 + field_type: + Enterprise: 32767 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_enterprise_bit_template_and_data.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_enterprise_bit_template_and_data.snap index 2d90680f..834aada2 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_enterprise_bit_template_and_data.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_enterprise_bit_template_and_data.snap @@ -19,140 +19,177 @@ expression: result field_count: 34 fields: - field_type_number: 12236 - field_type: CiscoClientIpv4Address field_length: 4 enterprise_number: 9 + field_type: + Cisco: CiscoClientIpv4Address - field_type_number: 12237 - field_type: CiscoServerIpv4Address field_length: 4 enterprise_number: 9 + field_type: + Cisco: CiscoServerIpv4Address - field_type_number: 12240 - field_type: CiscoClientL4Port field_length: 2 enterprise_number: 9 + field_type: + Cisco: + Unknown: 12240 - field_type_number: 12241 - field_type: CiscoServerL4Port field_length: 2 enterprise_number: 9 + field_type: + Cisco: + Unknown: 12241 - field_type_number: 234 - field_type: IngressVrfid field_length: 4 + field_type: + IANA: IngressVrfid - field_type_number: 10 - field_type: IngressInterface field_length: 4 + field_type: + IANA: IngressInterface - field_type_number: 239 - field_type: BiflowDirection field_length: 1 + field_type: + IANA: BiflowDirection - field_type_number: 12242 - field_type: CiscoConnectionId field_length: 4 enterprise_number: 9 + field_type: + Cisco: + Unknown: 12242 - field_type_number: 95 - field_type: ApplicationId field_length: 4 + field_type: + IANA: ApplicationId - field_type_number: 14 - field_type: EgressInterface field_length: 4 + field_type: + IANA: EgressInterface - field_type_number: 48 - field_type: SamplerId field_length: 1 + field_type: + IANA: SamplerId - field_type_number: 9252 - field_type: CiscoServicesWaasSegment field_length: 1 enterprise_number: 9 + field_type: + Cisco: CiscoServicesWaasSegment - field_type_number: 9253 - field_type: CiscoServicesWaasPassthroughReason field_length: 1 enterprise_number: 9 + field_type: + Cisco: CiscoServicesWaasPassthroughReason - field_type_number: 9357 - field_type: CiscoAppHttpUriStatistics field_length: 65535 enterprise_number: 9 + field_type: + Cisco: CiscoAppHttpUriStatistics - field_type_number: 12235 - field_type: CiscoAppHttpHost field_length: 65535 enterprise_number: 9 + field_type: + Cisco: CiscoAppHttpHost - field_type_number: 22 - field_type: FlowStartSysUpTime field_length: 4 + field_type: + IANA: FlowStartSysUpTime - field_type_number: 21 - field_type: FlowEndSysUpTime field_length: 4 + field_type: + IANA: FlowEndSysUpTime - field_type_number: 278 - field_type: NewConnectionDeltaCount field_length: 4 + field_type: + IANA: NewConnectionDeltaCount - field_type_number: 232 - field_type: ResponderOctets field_length: 8 + field_type: + IANA: ResponderOctets - field_type_number: 299 - field_type: ResponderPackets field_length: 8 + field_type: + IANA: ResponderPackets - field_type_number: 231 - field_type: InitiatorOctets field_length: 8 + field_type: + IANA: InitiatorOctets - field_type_number: 298 - field_type: InitiatorPackets field_length: 8 - - field_type_number: 9303 field_type: - Unknown: 9303 + IANA: InitiatorPackets + - field_type_number: 9303 field_length: 4 enterprise_number: 9 - - field_type_number: 9292 field_type: - Unknown: 9292 + Cisco: + Unknown: 9303 + - field_type_number: 9292 field_length: 4 enterprise_number: 9 - - field_type_number: 9300 field_type: - Unknown: 9300 + Cisco: + Unknown: 9292 + - field_type_number: 9300 field_length: 4 enterprise_number: 9 - - field_type_number: 9319 field_type: - Unknown: 9319 + Cisco: + Unknown: 9300 + - field_type_number: 9319 field_length: 4 enterprise_number: 9 - - field_type_number: 9316 field_type: - Unknown: 9316 + Cisco: + Unknown: 9319 + - field_type_number: 9316 field_length: 4 enterprise_number: 9 - - field_type_number: 9268 field_type: - Unknown: 9268 + Cisco: + Unknown: 9316 + - field_type_number: 9268 field_length: 4 enterprise_number: 9 - - field_type_number: 9313 field_type: - Unknown: 9313 + Cisco: + Unknown: 9268 + - field_type_number: 9313 field_length: 4 enterprise_number: 9 - - field_type_number: 9306 field_type: - Unknown: 9306 + Cisco: + Unknown: 9313 + - field_type_number: 9306 field_length: 4 enterprise_number: 9 - - field_type_number: 9307 field_type: - Unknown: 9307 + Cisco: + Unknown: 9306 + - field_type_number: 9307 field_length: 4 enterprise_number: 9 - - field_type_number: 9309 field_type: - Unknown: 9309 + Cisco: + Unknown: 9307 + - field_type_number: 9309 field_length: 4 enterprise_number: 9 - - field_type_number: 9273 field_type: - Unknown: 9273 + Cisco: + Unknown: 9309 + - field_type_number: 9273 field_length: 4 enterprise_number: 9 - - field_type_number: 9272 field_type: - Unknown: 9272 + Cisco: + Unknown: 9273 + - field_type_number: 9272 field_length: 4 enterprise_number: 9 + field_type: + Cisco: + Unknown: 9272 - IPFix: header: version: 10 @@ -168,152 +205,175 @@ expression: result Data: fields: - 0: - - CiscoClientIpv4Address + - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.209.101.66 - 1: - - CiscoServerIpv4Address + - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.0.0.241 - 2: - - CiscoClientL4Port - - DataNumber: 49376 + - Cisco: + Unknown: 12240 + - Vec: + - 192 + - 224 - 3: - - CiscoServerL4Port - - DataNumber: 80 + - Cisco: + Unknown: 12241 + - Vec: + - 0 + - 80 - 4: - - IngressVrfid + - IANA: IngressVrfid - DataNumber: 0 - 5: - - IngressInterface + - IANA: IngressInterface - DataNumber: 13 - 6: - - BiflowDirection + - IANA: BiflowDirection - DataNumber: 1 - 7: - - CiscoConnectionId - - DataNumber: 2378383328 + - Cisco: + Unknown: 12242 + - Vec: + - 141 + - 195 + - 63 + - 224 - 8: - - ApplicationId + - IANA: ApplicationId - ApplicationId: classification_engine_id: 3 selector_id: 80 - 9: - - EgressInterface + - IANA: EgressInterface - DataNumber: 10 - 10: - - SamplerId + - IANA: SamplerId - DataNumber: 9 - 11: - - CiscoServicesWaasSegment + - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - 12: - - CiscoServicesWaasPassthroughReason + - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - 13: - - CiscoAppHttpUriStatistics + - Cisco: CiscoAppHttpUriStatistics - String: "/DocLib1\u0000\u0000\u0001" - 14: - - CiscoAppHttpHost + - Cisco: CiscoAppHttpHost - String: "\u0003\u0000\u0000P4\u0002portal.medsigroup.ru" - 15: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 564191867 - 16: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 564303806 - 17: - - NewConnectionDeltaCount + - IANA: NewConnectionDeltaCount - DataNumber: 1 - 18: - - ResponderOctets + - IANA: ResponderOctets - DataNumber: 0 - 19: - - ResponderPackets + - IANA: ResponderPackets - DataNumber: 0 - 20: - - InitiatorOctets + - IANA: InitiatorOctets - DataNumber: 6208 - 21: - - InitiatorPackets + - IANA: InitiatorPackets - DataNumber: 15 - 22: - - Unknown: 9303 + - Cisco: + Unknown: 9303 - Vec: - 0 - 0 - 0 - 0 - 23: - - Unknown: 9292 + - Cisco: + Unknown: 9292 - Vec: - 0 - 0 - 0 - 0 - 24: - - Unknown: 9300 + - Cisco: + Unknown: 9300 - Vec: - 0 - 0 - 0 - 0 - 25: - - Unknown: 9319 + - Cisco: + Unknown: 9319 - Vec: - 0 - 0 - 0 - 0 - 26: - - Unknown: 9316 + - Cisco: + Unknown: 9316 - Vec: - 0 - 0 - 0 - 0 - 27: - - Unknown: 9268 + - Cisco: + Unknown: 9268 - Vec: - 0 - 0 - 0 - 0 - 28: - - Unknown: 9313 + - Cisco: + Unknown: 9313 - Vec: - 0 - 0 - 0 - 0 - 29: - - Unknown: 9306 + - Cisco: + Unknown: 9306 - Vec: - 0 - 0 - 0 - 0 - 30: - - Unknown: 9307 + - Cisco: + Unknown: 9307 - Vec: - 0 - 0 - 0 - 0 - 31: - - Unknown: 9309 + - Cisco: + Unknown: 9309 - Vec: - 0 - 0 - 0 - 0 - 32: - - Unknown: 9273 + - Cisco: + Unknown: 9273 - Vec: - 0 - 0 - 0 - 0 - 33: - - Unknown: 9272 + - Cisco: + Unknown: 9272 - Vec: - 0 - 0 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_mixed_enteprise_and_non_enterprise_fields.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_mixed_enteprise_and_non_enterprise_fields.snap index ac7a3599..d9a7b398 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_mixed_enteprise_and_non_enterprise_fields.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_mixed_enteprise_and_non_enterprise_fields.snap @@ -19,76 +19,99 @@ expression: result field_count: 22 fields: - field_type_number: 12236 - field_type: CiscoClientIpv4Address field_length: 4 enterprise_number: 9 + field_type: + Cisco: CiscoClientIpv4Address - field_type_number: 12237 - field_type: CiscoServerIpv4Address field_length: 4 enterprise_number: 9 + field_type: + Cisco: CiscoServerIpv4Address - field_type_number: 4 - field_type: ProtocolIdentifier field_length: 1 + field_type: + IANA: ProtocolIdentifier - field_type_number: 195 - field_type: IpDiffServCodePoint field_length: 1 + field_type: + IANA: IpDiffServCodePoint - field_type_number: 192 - field_type: IpTtl field_length: 1 + field_type: + IANA: IpTtl - field_type_number: 12241 - field_type: CiscoServerL4Port field_length: 2 enterprise_number: 9 + field_type: + Cisco: + Unknown: 12241 - field_type_number: 234 - field_type: IngressVrfid field_length: 4 + field_type: + IANA: IngressVrfid - field_type_number: 95 - field_type: ApplicationId field_length: 4 + field_type: + IANA: ApplicationId - field_type_number: 58 - field_type: VlanId field_length: 2 + field_type: + IANA: VlanId - field_type_number: 10 - field_type: IngressInterface field_length: 4 + field_type: + IANA: IngressInterface - field_type_number: 239 - field_type: BiflowDirection field_length: 1 + field_type: + IANA: BiflowDirection - field_type_number: 9252 - field_type: CiscoServicesWaasSegment field_length: 1 enterprise_number: 9 + field_type: + Cisco: CiscoServicesWaasSegment - field_type_number: 14 - field_type: EgressInterface field_length: 4 + field_type: + IANA: EgressInterface - field_type_number: 9253 - field_type: CiscoServicesWaasPassthroughReason field_length: 1 enterprise_number: 9 + field_type: + Cisco: CiscoServicesWaasPassthroughReason - field_type_number: 22 - field_type: FlowStartSysUpTime field_length: 4 + field_type: + IANA: FlowStartSysUpTime - field_type_number: 21 - field_type: FlowEndSysUpTime field_length: 4 + field_type: + IANA: FlowEndSysUpTime - field_type_number: 278 - field_type: NewConnectionDeltaCount field_length: 4 + field_type: + IANA: NewConnectionDeltaCount - field_type_number: 279 - field_type: ConnectionSumDurationSeconds field_length: 8 + field_type: + IANA: ConnectionSumDurationSeconds - field_type_number: 232 - field_type: ResponderOctets field_length: 8 + field_type: + IANA: ResponderOctets - field_type_number: 299 - field_type: ResponderPackets field_length: 8 + field_type: + IANA: ResponderPackets - field_type_number: 231 - field_type: InitiatorOctets field_length: 8 + field_type: + IANA: InitiatorOctets - field_type_number: 298 - field_type: InitiatorPackets field_length: 8 + field_type: + IANA: InitiatorPackets - IPFix: header: version: 10 @@ -104,1090 +127,1138 @@ expression: result Data: fields: - 0: - - CiscoClientIpv4Address + - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.101.255.1 - 1: - - CiscoServerIpv4Address + - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.10.28.57 - 2: - - ProtocolIdentifier + - IANA: ProtocolIdentifier - ProtocolType: Udp - 3: - - IpDiffServCodePoint + - IANA: IpDiffServCodePoint - DataNumber: 0 - 4: - - IpTtl + - IANA: IpTtl - DataNumber: 255 - 5: - - CiscoServerL4Port - - DataNumber: 2055 + - Cisco: + Unknown: 12241 + - Vec: + - 8 + - 7 - 6: - - IngressVrfid + - IANA: IngressVrfid - DataNumber: 0 - 7: - - ApplicationId + - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 606 - 8: - - VlanId + - IANA: VlanId - DataNumber: 0 - 9: - - IngressInterface + - IANA: IngressInterface - DataNumber: 0 - 10: - - BiflowDirection + - IANA: BiflowDirection - DataNumber: 1 - 11: - - CiscoServicesWaasSegment + - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - 12: - - EgressInterface + - IANA: EgressInterface - DataNumber: 20 - 13: - - CiscoServicesWaasPassthroughReason + - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - 14: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 4019387228 - 15: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 4019440532 - 16: - - NewConnectionDeltaCount + - IANA: NewConnectionDeltaCount - DataNumber: 0 - 17: - - ConnectionSumDurationSeconds + - IANA: ConnectionSumDurationSeconds - DataNumber: 53 - 18: - - ResponderOctets + - IANA: ResponderOctets - DataNumber: 0 - 19: - - ResponderPackets + - IANA: ResponderPackets - DataNumber: 0 - 20: - - InitiatorOctets + - IANA: InitiatorOctets - DataNumber: 192505 - 21: - - InitiatorPackets + - IANA: InitiatorPackets - DataNumber: 155 - 0: - - CiscoClientIpv4Address + - Cisco: CiscoClientIpv4Address - Ip4Addr: 172.31.255.1 - 1: - - CiscoServerIpv4Address + - Cisco: CiscoServerIpv4Address - Ip4Addr: 172.31.255.1 - 2: - - ProtocolIdentifier + - IANA: ProtocolIdentifier - ProtocolType: Udp - 3: - - IpDiffServCodePoint + - IANA: IpDiffServCodePoint - DataNumber: 0 - 4: - - IpTtl + - IANA: IpTtl - DataNumber: 254 - 5: - - CiscoServerL4Port - - DataNumber: 3785 + - Cisco: + Unknown: 12241 + - Vec: + - 14 + - 201 - 6: - - IngressVrfid + - IANA: IngressVrfid - DataNumber: 0 - 7: - - ApplicationId + - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - 8: - - VlanId + - IANA: VlanId - DataNumber: 0 - 9: - - IngressInterface + - IANA: IngressInterface - DataNumber: 1 - 10: - - BiflowDirection + - IANA: BiflowDirection - DataNumber: 1 - 11: - - CiscoServicesWaasSegment + - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - 12: - - EgressInterface + - IANA: EgressInterface - DataNumber: 1 - 13: - - CiscoServicesWaasPassthroughReason + - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - 14: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 4019387232 - 15: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 4019446788 - 16: - - NewConnectionDeltaCount + - IANA: NewConnectionDeltaCount - DataNumber: 0 - 17: - - ConnectionSumDurationSeconds + - IANA: ConnectionSumDurationSeconds - DataNumber: 120 - 18: - - ResponderOctets + - IANA: ResponderOctets - DataNumber: 0 - 19: - - ResponderPackets + - IANA: ResponderPackets - DataNumber: 0 - 20: - - InitiatorOctets + - IANA: InitiatorOctets - DataNumber: 2208 - 21: - - InitiatorPackets + - IANA: InitiatorPackets - DataNumber: 184 - 0: - - CiscoClientIpv4Address + - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.208.22.118 - 1: - - CiscoServerIpv4Address + - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.101.22.251 - 2: - - ProtocolIdentifier + - IANA: ProtocolIdentifier - ProtocolType: Udp - 3: - - IpDiffServCodePoint + - IANA: IpDiffServCodePoint - DataNumber: 4 - 4: - - IpTtl + - IANA: IpTtl - DataNumber: 61 - 5: - - CiscoServerL4Port - - DataNumber: 17654 + - Cisco: + Unknown: 12241 + - Vec: + - 68 + - 246 - 6: - - IngressVrfid + - IANA: IngressVrfid - DataNumber: 0 - 7: - - ApplicationId + - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - 8: - - VlanId + - IANA: VlanId - DataNumber: 0 - 9: - - IngressInterface + - IANA: IngressInterface - DataNumber: 1 - 10: - - BiflowDirection + - IANA: BiflowDirection - DataNumber: 1 - 11: - - CiscoServicesWaasSegment + - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - 12: - - EgressInterface + - IANA: EgressInterface - DataNumber: 4 - 13: - - CiscoServicesWaasPassthroughReason + - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - 14: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 4019387236 - 15: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 4019437108 - 16: - - NewConnectionDeltaCount + - IANA: NewConnectionDeltaCount - DataNumber: 0 - 17: - - ConnectionSumDurationSeconds + - IANA: ConnectionSumDurationSeconds - DataNumber: 59 - 18: - - ResponderOctets + - IANA: ResponderOctets - DataNumber: 0 - 19: - - ResponderPackets + - IANA: ResponderPackets - DataNumber: 0 - 20: - - InitiatorOctets + - IANA: InitiatorOctets - DataNumber: 96 - 21: - - InitiatorPackets + - IANA: InitiatorPackets - DataNumber: 6 - 0: - - CiscoClientIpv4Address + - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.0.151.220 - 1: - - CiscoServerIpv4Address + - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.101.151.95 - 2: - - ProtocolIdentifier + - IANA: ProtocolIdentifier - ProtocolType: Udp - 3: - - IpDiffServCodePoint + - IANA: IpDiffServCodePoint - DataNumber: 0 - 4: - - IpTtl + - IANA: IpTtl - DataNumber: 60 - 5: - - CiscoServerL4Port - - DataNumber: 57339 + - Cisco: + Unknown: 12241 + - Vec: + - 223 + - 251 - 6: - - IngressVrfid + - IANA: IngressVrfid - DataNumber: 0 - 7: - - ApplicationId + - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - 8: - - VlanId + - IANA: VlanId - DataNumber: 0 - 9: - - IngressInterface + - IANA: IngressInterface - DataNumber: 1 - 10: - - BiflowDirection + - IANA: BiflowDirection - DataNumber: 1 - 11: - - CiscoServicesWaasSegment + - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - 12: - - EgressInterface + - IANA: EgressInterface - DataNumber: 4 - 13: - - CiscoServicesWaasPassthroughReason + - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - 14: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 4019387306 - 15: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 4019447034 - 16: - - NewConnectionDeltaCount + - IANA: NewConnectionDeltaCount - DataNumber: 0 - 17: - - ConnectionSumDurationSeconds + - IANA: ConnectionSumDurationSeconds - DataNumber: 59 - 18: - - ResponderOctets + - IANA: ResponderOctets - DataNumber: 0 - 19: - - ResponderPackets + - IANA: ResponderPackets - DataNumber: 0 - 20: - - InitiatorOctets + - IANA: InitiatorOctets - DataNumber: 15264 - 21: - - InitiatorPackets + - IANA: InitiatorPackets - DataNumber: 24 - 0: - - CiscoClientIpv4Address + - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.101.22.251 - 1: - - CiscoServerIpv4Address + - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.25.22.18 - 2: - - ProtocolIdentifier + - IANA: ProtocolIdentifier - ProtocolType: Udp - 3: - - IpDiffServCodePoint + - IANA: IpDiffServCodePoint - DataNumber: 0 - 4: - - IpTtl + - IANA: IpTtl - DataNumber: 126 - 5: - - CiscoServerL4Port - - DataNumber: 5001 + - Cisco: + Unknown: 12241 + - Vec: + - 19 + - 137 - 6: - - IngressVrfid + - IANA: IngressVrfid - DataNumber: 0 - 7: - - ApplicationId + - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - 8: - - VlanId + - IANA: VlanId - DataNumber: 0 - 9: - - IngressInterface + - IANA: IngressInterface - DataNumber: 4 - 10: - - BiflowDirection + - IANA: BiflowDirection - DataNumber: 1 - 11: - - CiscoServicesWaasSegment + - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - 12: - - EgressInterface + - IANA: EgressInterface - DataNumber: 20 - 13: - - CiscoServicesWaasPassthroughReason + - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - 14: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 4019387310 - 15: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 4019446976 - 16: - - NewConnectionDeltaCount + - IANA: NewConnectionDeltaCount - DataNumber: 0 - 17: - - ConnectionSumDurationSeconds + - IANA: ConnectionSumDurationSeconds - DataNumber: 59 - 18: - - ResponderOctets + - IANA: ResponderOctets - DataNumber: 0 - 19: - - ResponderPackets + - IANA: ResponderPackets - DataNumber: 0 - 20: - - InitiatorOctets + - IANA: InitiatorOctets - DataNumber: 5872 - 21: - - InitiatorPackets + - IANA: InitiatorPackets - DataNumber: 367 - 0: - - CiscoClientIpv4Address + - Cisco: CiscoClientIpv4Address - Ip4Addr: 224.0.0.5 - 1: - - CiscoServerIpv4Address + - Cisco: CiscoServerIpv4Address - Ip4Addr: 172.31.255.1 - 2: - - ProtocolIdentifier + - IANA: ProtocolIdentifier - ProtocolType: Ospfigp - 3: - - IpDiffServCodePoint + - IANA: IpDiffServCodePoint - DataNumber: 0 - 4: - - IpTtl + - IANA: IpTtl - DataNumber: 1 - 5: - - CiscoServerL4Port - - DataNumber: 0 + - Cisco: + Unknown: 12241 + - Vec: + - 0 + - 0 - 6: - - IngressVrfid + - IANA: IngressVrfid - DataNumber: 0 - 7: - - ApplicationId + - IANA: ApplicationId - ApplicationId: classification_engine_id: 1 selector_id: 89 - 8: - - VlanId + - IANA: VlanId - DataNumber: 0 - 9: - - IngressInterface + - IANA: IngressInterface - DataNumber: 1 - 10: - - BiflowDirection + - IANA: BiflowDirection - DataNumber: 2 - 11: - - CiscoServicesWaasSegment + - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - 12: - - EgressInterface + - IANA: EgressInterface - DataNumber: 0 - 13: - - CiscoServicesWaasPassthroughReason + - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - 14: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 4019387360 - 15: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 4019444662 - 16: - - NewConnectionDeltaCount + - IANA: NewConnectionDeltaCount - DataNumber: 0 - 17: - - ConnectionSumDurationSeconds + - IANA: ConnectionSumDurationSeconds - DataNumber: 80 - 18: - - ResponderOctets + - IANA: ResponderOctets - DataNumber: 0 - 19: - - ResponderPackets + - IANA: ResponderPackets - DataNumber: 23 - 20: - - InitiatorOctets + - IANA: InitiatorOctets - DataNumber: 0 - 21: - - InitiatorPackets + - IANA: InitiatorPackets - DataNumber: 0 - 0: - - CiscoClientIpv4Address + - Cisco: CiscoClientIpv4Address - Ip4Addr: 172.31.254.101 - 1: - - CiscoServerIpv4Address + - Cisco: CiscoServerIpv4Address - Ip4Addr: 172.31.254.101 - 2: - - ProtocolIdentifier + - IANA: ProtocolIdentifier - ProtocolType: Udp - 3: - - IpDiffServCodePoint + - IANA: IpDiffServCodePoint - DataNumber: 48 - 4: - - IpTtl + - IANA: IpTtl - DataNumber: 255 - 5: - - CiscoServerL4Port - - DataNumber: 3785 + - Cisco: + Unknown: 12241 + - Vec: + - 14 + - 201 - 6: - - IngressVrfid + - IANA: IngressVrfid - DataNumber: 0 - 7: - - ApplicationId + - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - 8: - - VlanId + - IANA: VlanId - DataNumber: 0 - 9: - - IngressInterface + - IANA: IngressInterface - DataNumber: 0 - 10: - - BiflowDirection + - IANA: BiflowDirection - DataNumber: 1 - 11: - - CiscoServicesWaasSegment + - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - 12: - - EgressInterface + - IANA: EgressInterface - DataNumber: 1 - 13: - - CiscoServicesWaasPassthroughReason + - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - 14: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 4019387474 - 15: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 4019447040 - 16: - - NewConnectionDeltaCount + - IANA: NewConnectionDeltaCount - DataNumber: 0 - 17: - - ConnectionSumDurationSeconds + - IANA: ConnectionSumDurationSeconds - DataNumber: 60 - 18: - - ResponderOctets + - IANA: ResponderOctets - DataNumber: 0 - 19: - - ResponderPackets + - IANA: ResponderPackets - DataNumber: 0 - 20: - - InitiatorOctets + - IANA: InitiatorOctets - DataNumber: 3816 - 21: - - InitiatorPackets + - IANA: InitiatorPackets - DataNumber: 318 - 0: - - CiscoClientIpv4Address + - Cisco: CiscoClientIpv4Address - Ip4Addr: 224.0.0.5 - 1: - - CiscoServerIpv4Address + - Cisco: CiscoServerIpv4Address - Ip4Addr: 172.31.250.252 - 2: - - ProtocolIdentifier + - IANA: ProtocolIdentifier - ProtocolType: Ospfigp - 3: - - IpDiffServCodePoint + - IANA: IpDiffServCodePoint - DataNumber: 48 - 4: - - IpTtl + - IANA: IpTtl - DataNumber: 1 - 5: - - CiscoServerL4Port - - DataNumber: 0 + - Cisco: + Unknown: 12241 + - Vec: + - 0 + - 0 - 6: - - IngressVrfid + - IANA: IngressVrfid - DataNumber: 0 - 7: - - ApplicationId + - IANA: ApplicationId - ApplicationId: classification_engine_id: 1 selector_id: 89 - 8: - - VlanId + - IANA: VlanId - DataNumber: 290 - 9: - - IngressInterface + - IANA: IngressInterface - DataNumber: 20 - 10: - - BiflowDirection + - IANA: BiflowDirection - DataNumber: 2 - 11: - - CiscoServicesWaasSegment + - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - 12: - - EgressInterface + - IANA: EgressInterface - DataNumber: 0 - 13: - - CiscoServicesWaasPassthroughReason + - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - 14: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 4019387484 - 15: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 4019444636 - 16: - - NewConnectionDeltaCount + - IANA: NewConnectionDeltaCount - DataNumber: 0 - 17: - - ConnectionSumDurationSeconds + - IANA: ConnectionSumDurationSeconds - DataNumber: 0 - 18: - - ResponderOctets + - IANA: ResponderOctets - DataNumber: 0 - 19: - - ResponderPackets + - IANA: ResponderPackets - DataNumber: 7 - 20: - - InitiatorOctets + - IANA: InitiatorOctets - DataNumber: 0 - 21: - - InitiatorPackets + - IANA: InitiatorPackets - DataNumber: 0 - 0: - - CiscoClientIpv4Address + - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.208.22.13 - 1: - - CiscoServerIpv4Address + - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.101.22.251 - 2: - - ProtocolIdentifier + - IANA: ProtocolIdentifier - ProtocolType: Udp - 3: - - IpDiffServCodePoint + - IANA: IpDiffServCodePoint - DataNumber: 4 - 4: - - IpTtl + - IANA: IpTtl - DataNumber: 61 - 5: - - CiscoServerL4Port - - DataNumber: 17654 + - Cisco: + Unknown: 12241 + - Vec: + - 68 + - 246 - 6: - - IngressVrfid + - IANA: IngressVrfid - DataNumber: 0 - 7: - - ApplicationId + - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - 8: - - VlanId + - IANA: VlanId - DataNumber: 0 - 9: - - IngressInterface + - IANA: IngressInterface - DataNumber: 1 - 10: - - BiflowDirection + - IANA: BiflowDirection - DataNumber: 1 - 11: - - CiscoServicesWaasSegment + - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - 12: - - EgressInterface + - IANA: EgressInterface - DataNumber: 4 - 13: - - CiscoServicesWaasPassthroughReason + - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - 14: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 4019387486 - 15: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 4019437338 - 16: - - NewConnectionDeltaCount + - IANA: NewConnectionDeltaCount - DataNumber: 0 - 17: - - ConnectionSumDurationSeconds + - IANA: ConnectionSumDurationSeconds - DataNumber: 50 - 18: - - ResponderOctets + - IANA: ResponderOctets - DataNumber: 0 - 19: - - ResponderPackets + - IANA: ResponderPackets - DataNumber: 0 - 20: - - InitiatorOctets + - IANA: InitiatorOctets - DataNumber: 740 - 21: - - InitiatorPackets + - IANA: InitiatorPackets - DataNumber: 65 - 0: - - CiscoClientIpv4Address + - Cisco: CiscoClientIpv4Address - Ip4Addr: 224.0.0.5 - 1: - - CiscoServerIpv4Address + - Cisco: CiscoServerIpv4Address - Ip4Addr: 172.31.254.27 - 2: - - ProtocolIdentifier + - IANA: ProtocolIdentifier - ProtocolType: Ospfigp - 3: - - IpDiffServCodePoint + - IANA: IpDiffServCodePoint - DataNumber: 48 - 4: - - IpTtl + - IANA: IpTtl - DataNumber: 1 - 5: - - CiscoServerL4Port - - DataNumber: 0 + - Cisco: + Unknown: 12241 + - Vec: + - 0 + - 0 - 6: - - IngressVrfid + - IANA: IngressVrfid - DataNumber: 0 - 7: - - ApplicationId + - IANA: ApplicationId - ApplicationId: classification_engine_id: 1 selector_id: 89 - 8: - - VlanId + - IANA: VlanId - DataNumber: 0 - 9: - - IngressInterface + - IANA: IngressInterface - DataNumber: 1 - 10: - - BiflowDirection + - IANA: BiflowDirection - DataNumber: 2 - 11: - - CiscoServicesWaasSegment + - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - 12: - - EgressInterface + - IANA: EgressInterface - DataNumber: 0 - 13: - - CiscoServicesWaasPassthroughReason + - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - 14: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 4019387494 - 15: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 4019443438 - 16: - - NewConnectionDeltaCount + - IANA: NewConnectionDeltaCount - DataNumber: 0 - 17: - - ConnectionSumDurationSeconds + - IANA: ConnectionSumDurationSeconds - DataNumber: 0 - 18: - - ResponderOctets + - IANA: ResponderOctets - DataNumber: 0 - 19: - - ResponderPackets + - IANA: ResponderPackets - DataNumber: 7 - 20: - - InitiatorOctets + - IANA: InitiatorOctets - DataNumber: 0 - 21: - - InitiatorPackets + - IANA: InitiatorPackets - DataNumber: 0 - 0: - - CiscoClientIpv4Address + - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.100.102.116 - 1: - - CiscoServerIpv4Address + - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.205.151.9 - 2: - - ProtocolIdentifier + - IANA: ProtocolIdentifier - ProtocolType: Udp - 3: - - IpDiffServCodePoint + - IANA: IpDiffServCodePoint - DataNumber: 0 - 4: - - IpTtl + - IANA: IpTtl - DataNumber: 125 - 5: - - CiscoServerL4Port - - DataNumber: 3389 + - Cisco: + Unknown: 12241 + - Vec: + - 13 + - 61 - 6: - - IngressVrfid + - IANA: IngressVrfid - DataNumber: 0 - 7: - - ApplicationId + - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - 8: - - VlanId + - IANA: VlanId - DataNumber: 290 - 9: - - IngressInterface + - IANA: IngressInterface - DataNumber: 20 - 10: - - BiflowDirection + - IANA: BiflowDirection - DataNumber: 2 - 11: - - CiscoServicesWaasSegment + - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - 12: - - EgressInterface + - IANA: EgressInterface - DataNumber: 17 - 13: - - CiscoServicesWaasPassthroughReason + - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - 14: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 4019387564 - 15: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 4019438730 - 16: - - NewConnectionDeltaCount + - IANA: NewConnectionDeltaCount - DataNumber: 0 - 17: - - ConnectionSumDurationSeconds + - IANA: ConnectionSumDurationSeconds - DataNumber: 239 - 18: - - ResponderOctets + - IANA: ResponderOctets - DataNumber: 225 - 19: - - ResponderPackets + - IANA: ResponderPackets - DataNumber: 8 - 20: - - InitiatorOctets + - IANA: InitiatorOctets - DataNumber: 96 - 21: - - InitiatorPackets + - IANA: InitiatorPackets - DataNumber: 8 - 0: - - CiscoClientIpv4Address + - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.208.22.124 - 1: - - CiscoServerIpv4Address + - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.101.22.251 - 2: - - ProtocolIdentifier + - IANA: ProtocolIdentifier - ProtocolType: Udp - 3: - - IpDiffServCodePoint + - IANA: IpDiffServCodePoint - DataNumber: 4 - 4: - - IpTtl + - IANA: IpTtl - DataNumber: 61 - 5: - - CiscoServerL4Port - - DataNumber: 17654 + - Cisco: + Unknown: 12241 + - Vec: + - 68 + - 246 - 6: - - IngressVrfid + - IANA: IngressVrfid - DataNumber: 0 - 7: - - ApplicationId + - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - 8: - - VlanId + - IANA: VlanId - DataNumber: 0 - 9: - - IngressInterface + - IANA: IngressInterface - DataNumber: 1 - 10: - - BiflowDirection + - IANA: BiflowDirection - DataNumber: 1 - 11: - - CiscoServicesWaasSegment + - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - 12: - - EgressInterface + - IANA: EgressInterface - DataNumber: 4 - 13: - - CiscoServicesWaasPassthroughReason + - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - 14: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 4019387592 - 15: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 4019437466 - 16: - - NewConnectionDeltaCount + - IANA: NewConnectionDeltaCount - DataNumber: 0 - 17: - - ConnectionSumDurationSeconds + - IANA: ConnectionSumDurationSeconds - DataNumber: 59 - 18: - - ResponderOctets + - IANA: ResponderOctets - DataNumber: 0 - 19: - - ResponderPackets + - IANA: ResponderPackets - DataNumber: 0 - 20: - - InitiatorOctets + - IANA: InitiatorOctets - DataNumber: 96 - 21: - - InitiatorPackets + - IANA: InitiatorPackets - DataNumber: 6 - 0: - - CiscoClientIpv4Address + - Cisco: CiscoClientIpv4Address - Ip4Addr: 172.31.254.101 - 1: - - CiscoServerIpv4Address + - Cisco: CiscoServerIpv4Address - Ip4Addr: 172.31.254.1 - 2: - - ProtocolIdentifier + - IANA: ProtocolIdentifier - ProtocolType: Udp - 3: - - IpDiffServCodePoint + - IANA: IpDiffServCodePoint - DataNumber: 48 - 4: - - IpTtl + - IANA: IpTtl - DataNumber: 255 - 5: - - CiscoServerL4Port - - DataNumber: 3784 + - Cisco: + Unknown: 12241 + - Vec: + - 14 + - 200 - 6: - - IngressVrfid + - IANA: IngressVrfid - DataNumber: 0 - 7: - - ApplicationId + - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - 8: - - VlanId + - IANA: VlanId - DataNumber: 0 - 9: - - IngressInterface + - IANA: IngressInterface - DataNumber: 0 - 10: - - BiflowDirection + - IANA: BiflowDirection - DataNumber: 1 - 11: - - CiscoServicesWaasSegment + - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - 12: - - EgressInterface + - IANA: EgressInterface - DataNumber: 1 - 13: - - CiscoServicesWaasPassthroughReason + - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - 14: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 4019387628 - 15: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 4019445566 - 16: - - NewConnectionDeltaCount + - IANA: NewConnectionDeltaCount - DataNumber: 0 - 17: - - ConnectionSumDurationSeconds + - IANA: ConnectionSumDurationSeconds - DataNumber: 60 - 18: - - ResponderOctets + - IANA: ResponderOctets - DataNumber: 0 - 19: - - ResponderPackets + - IANA: ResponderPackets - DataNumber: 0 - 20: - - InitiatorOctets + - IANA: InitiatorOctets - DataNumber: 552 - 21: - - InitiatorPackets + - IANA: InitiatorPackets - DataNumber: 23 - 0: - - CiscoClientIpv4Address + - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.1.22.47 - 1: - - CiscoServerIpv4Address + - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.101.22.251 - 2: - - ProtocolIdentifier + - IANA: ProtocolIdentifier - ProtocolType: Udp - 3: - - IpDiffServCodePoint + - IANA: IpDiffServCodePoint - DataNumber: 8 - 4: - - IpTtl + - IANA: IpTtl - DataNumber: 61 - 5: - - CiscoServerL4Port - - DataNumber: 17654 + - Cisco: + Unknown: 12241 + - Vec: + - 68 + - 246 - 6: - - IngressVrfid + - IANA: IngressVrfid - DataNumber: 0 - 7: - - ApplicationId + - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - 8: - - VlanId + - IANA: VlanId - DataNumber: 0 - 9: - - IngressInterface + - IANA: IngressInterface - DataNumber: 1 - 10: - - BiflowDirection + - IANA: BiflowDirection - DataNumber: 1 - 11: - - CiscoServicesWaasSegment + - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - 12: - - EgressInterface + - IANA: EgressInterface - DataNumber: 4 - 13: - - CiscoServicesWaasPassthroughReason + - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - 14: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 4019387640 - 15: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 4019437582 - 16: - - NewConnectionDeltaCount + - IANA: NewConnectionDeltaCount - DataNumber: 0 - 17: - - ConnectionSumDurationSeconds + - IANA: ConnectionSumDurationSeconds - DataNumber: 50 - 18: - - ResponderOctets + - IANA: ResponderOctets - DataNumber: 0 - 19: - - ResponderPackets + - IANA: ResponderPackets - DataNumber: 0 - 20: - - InitiatorOctets + - IANA: InitiatorOctets - DataNumber: 772 - 21: - - InitiatorPackets + - IANA: InitiatorPackets - DataNumber: 67 - 0: - - CiscoClientIpv4Address + - Cisco: CiscoClientIpv4Address - Ip4Addr: 10.101.10.12 - 1: - - CiscoServerIpv4Address + - Cisco: CiscoServerIpv4Address - Ip4Addr: 10.0.151.179 - 2: - - ProtocolIdentifier + - IANA: ProtocolIdentifier - ProtocolType: Icmp - 3: - - IpDiffServCodePoint + - IANA: IpDiffServCodePoint - DataNumber: 0 - 4: - - IpTtl + - IANA: IpTtl - DataNumber: 60 - 5: - - CiscoServerL4Port - - DataNumber: 0 + - Cisco: + Unknown: 12241 + - Vec: + - 0 + - 0 - 6: - - IngressVrfid + - IANA: IngressVrfid - DataNumber: 0 - 7: - - ApplicationId + - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 479 - 8: - - VlanId + - IANA: VlanId - DataNumber: 0 - 9: - - IngressInterface + - IANA: IngressInterface - DataNumber: 1 - 10: - - BiflowDirection + - IANA: BiflowDirection - DataNumber: 2 - 11: - - CiscoServicesWaasSegment + - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - 12: - - EgressInterface + - IANA: EgressInterface - DataNumber: 4 - 13: - - CiscoServicesWaasPassthroughReason + - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - 14: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 4019387662 - 15: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 4019446322 - 16: - - NewConnectionDeltaCount + - IANA: NewConnectionDeltaCount - DataNumber: 0 - 17: - - ConnectionSumDurationSeconds + - IANA: ConnectionSumDurationSeconds - DataNumber: 0 - 18: - - ResponderOctets + - IANA: ResponderOctets - DataNumber: 0 - 19: - - ResponderPackets + - IANA: ResponderPackets - DataNumber: 19 - 20: - - InitiatorOctets + - IANA: InitiatorOctets - DataNumber: 0 - 21: - - InitiatorPackets + - IANA: InitiatorPackets - DataNumber: 0 - 0: - - CiscoClientIpv4Address + - Cisco: CiscoClientIpv4Address - Ip4Addr: 172.31.255.1 - 1: - - CiscoServerIpv4Address + - Cisco: CiscoServerIpv4Address - Ip4Addr: 172.31.254.101 - 2: - - ProtocolIdentifier + - IANA: ProtocolIdentifier - ProtocolType: Udp - 3: - - IpDiffServCodePoint + - IANA: IpDiffServCodePoint - DataNumber: 0 - 4: - - IpTtl + - IANA: IpTtl - DataNumber: 255 - 5: - - CiscoServerL4Port - - DataNumber: 3784 + - Cisco: + Unknown: 12241 + - Vec: + - 14 + - 200 - 6: - - IngressVrfid + - IANA: IngressVrfid - DataNumber: 0 - 7: - - ApplicationId + - IANA: ApplicationId - ApplicationId: classification_engine_id: 13 selector_id: 1 - 8: - - VlanId + - IANA: VlanId - DataNumber: 0 - 9: - - IngressInterface + - IANA: IngressInterface - DataNumber: 1 - 10: - - BiflowDirection + - IANA: BiflowDirection - DataNumber: 1 - 11: - - CiscoServicesWaasSegment + - Cisco: CiscoServicesWaasSegment - DataNumber: 16 - 12: - - EgressInterface + - IANA: EgressInterface - DataNumber: 0 - 13: - - CiscoServicesWaasPassthroughReason + - Cisco: CiscoServicesWaasPassthroughReason - DataNumber: 0 - 14: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 4019387700 - 15: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 4019446700 - 16: - - NewConnectionDeltaCount + - IANA: NewConnectionDeltaCount - DataNumber: 0 - 17: - - ConnectionSumDurationSeconds + - IANA: ConnectionSumDurationSeconds - DataNumber: 59 - 18: - - ResponderOctets + - IANA: ResponderOctets - DataNumber: 0 - 19: - - ResponderPackets + - IANA: ResponderPackets - DataNumber: 0 - 20: - - InitiatorOctets + - IANA: InitiatorOctets - DataNumber: 1632 - 21: - - InitiatorPackets + - IANA: InitiatorPackets - DataNumber: 68 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_multiple_templates.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_multiple_templates.snap new file mode 100644 index 00000000..79cd698e --- /dev/null +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_multiple_templates.snap @@ -0,0 +1,1125 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&packet)" +--- +- IPFix: + header: + version: 10 + length: 1460 + export_time: 1412166671 + sequence_number: 127681 + observation_domain_id: 0 + flowsets: + - header: + header_id: 2 + length: 1444 + body: + Templates: + - template_id: 256 + field_count: 23 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 8 + field_length: 4 + field_type: + IANA: SourceIpv4address + - field_type_number: 12 + field_length: 4 + field_type: + IANA: DestinationIpv4address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 192 + field_length: 16 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainID + - field_type_number: 193 + field_length: 1 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainHopCount + - template_id: 257 + field_count: 24 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 8 + field_length: 4 + field_type: + IANA: SourceIpv4address + - field_type_number: 12 + field_length: 4 + field_type: + IANA: DestinationIpv4address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 128 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerRoundTripTime + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 192 + field_length: 16 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainID + - field_type_number: 193 + field_length: 1 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainHopCount + - template_id: 258 + field_count: 37 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 8 + field_length: 4 + field_type: + IANA: SourceIpv4address + - field_type_number: 12 + field_length: 4 + field_type: + IANA: DestinationIpv4address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 171 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppUnitNameAppId + - field_type_number: 158 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResForwFB + - field_type_number: 170 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResForwLB + - field_type_number: 192 + field_length: 16 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainID + - field_type_number: 193 + field_length: 1 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainHopCount + - field_type_number: 130 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqUrl + - field_type_number: 131 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqCookie + - field_type_number: 140 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqReferer + - field_type_number: 141 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqMethod + - field_type_number: 142 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqHost + - field_type_number: 143 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqUserAgent + - field_type_number: 183 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpContentType + - field_type_number: 185 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqAuthorization + - field_type_number: 186 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqVia + - field_type_number: 190 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqXForwardedFor + - field_type_number: 205 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAaaUsername + - template_id: 259 + field_count: 23 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 27 + field_length: 16 + field_type: + IANA: SourceIpv6address + - field_type_number: 28 + field_length: 16 + field_type: + IANA: DestinationIpv6address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 192 + field_length: 16 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainID + - field_type_number: 193 + field_length: 1 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainHopCount + - template_id: 260 + field_count: 24 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 27 + field_length: 16 + field_type: + IANA: SourceIpv6address + - field_type_number: 28 + field_length: 16 + field_type: + IANA: DestinationIpv6address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 128 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerRoundTripTime + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 192 + field_length: 16 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainID + - field_type_number: 193 + field_length: 1 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainHopCount + - template_id: 261 + field_count: 37 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 27 + field_length: 16 + field_type: + IANA: SourceIpv6address + - field_type_number: 28 + field_length: 16 + field_type: + IANA: DestinationIpv6address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 171 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppUnitNameAppId + - field_type_number: 158 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResForwFB + - field_type_number: 170 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResForwLB + - field_type_number: 192 + field_length: 16 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainID + - field_type_number: 193 + field_length: 1 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainHopCount + - field_type_number: 130 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqUrl + - field_type_number: 131 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqCookie + - field_type_number: 140 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqReferer + - field_type_number: 141 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqMethod + - field_type_number: 142 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqHost + - field_type_number: 143 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqUserAgent + - field_type_number: 183 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpContentType + - field_type_number: 185 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqAuthorization + - field_type_number: 186 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqVia + - field_type_number: 190 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqXForwardedFor + - field_type_number: 205 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAaaUsername + - template_id: 262 + field_count: 38 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 8 + field_length: 4 + field_type: + IANA: SourceIpv4address + - field_type_number: 12 + field_length: 4 + field_type: + IANA: DestinationIpv4address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 144 + field_length: 2 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpRspStatus + - field_type_number: 145 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpRspLen + - field_type_number: 146 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerServerTTFB + - field_type_number: 147 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerServerTTLB + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 161 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerMainPageId + - field_type_number: 162 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerMainPageCoreId + - field_type_number: 153 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqRcvFB + - field_type_number: 156 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqForwFB + - field_type_number: 157 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResRcvFB + - field_type_number: 159 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqRcvLB + - field_type_number: 160 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqForwLB + - field_type_number: 169 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResRcvLB + - field_type_number: 182 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerClientRTT + - field_type_number: 183 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpContentType + - field_type_number: 187 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResLocation + - field_type_number: 188 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResSetCookie + - field_type_number: 189 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResSetCookie2 + - template_id: 263 + field_count: 38 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 27 + field_length: 16 + field_type: + IANA: SourceIpv6address + - field_type_number: 28 + field_length: 16 + field_type: + IANA: DestinationIpv6address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 144 + field_length: 2 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpRspStatus + - field_type_number: 145 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpRspLen + - field_type_number: 146 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerServerTTFB + - field_type_number: 147 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerServerTTLB + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 161 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerMainPageId + - field_type_number: 162 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerMainPageCoreId + - field_type_number: 153 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqRcvFB + - field_type_number: 156 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqForwFB + - field_type_number: 157 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResRcvFB + - field_type_number: 159 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqRcvLB + - field_type_number: 160 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqForwLB + - field_type_number: 169 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResRcvLB + - field_type_number: 182 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerClientRTT + - field_type_number: 183 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpContentType + - field_type_number: 187 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResLocation + - field_type_number: 188 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResSetCookie + - field_type_number: 189 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResSetCookie2 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_options_template.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_options_template.snap index 58b51351..befef5a4 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_options_template.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_options_template.snap @@ -20,12 +20,15 @@ expression: "NetflowParser::default().parse_bytes(&packet)" scope_field_count: 1 fields: - field_type_number: 123 - field_type: AssignedforNetFlowv9compatibility field_length: 4 enterprise_number: 2 + field_type: + Enterprise: 123 - field_type_number: 41 - field_type: ExportedMessageTotalCount field_length: 2 + field_type: + IANA: ExportedMessageTotalCount - field_type_number: 42 - field_type: ExportedFlowRecordTotalCount field_length: 2 + field_type: + IANA: ExportedFlowRecordTotalCount diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_options_template_with_data.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_options_template_with_data.snap index efc9c8e1..21a68b1a 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_options_template_with_data.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_options_template_with_data.snap @@ -20,15 +20,18 @@ expression: "NetflowParser::default().parse_bytes(&packet)" scope_field_count: 1 fields: - field_type_number: 123 - field_type: AssignedforNetFlowv9compatibility field_length: 4 enterprise_number: 2 + field_type: + Enterprise: 123 - field_type_number: 41 - field_type: ExportedMessageTotalCount field_length: 2 + field_type: + IANA: ExportedMessageTotalCount - field_type_number: 42 - field_type: ExportedFlowRecordTotalCount field_length: 2 + field_type: + IANA: ExportedFlowRecordTotalCount - header: header_id: 260 length: 20 @@ -36,28 +39,28 @@ expression: "NetflowParser::default().parse_bytes(&packet)" OptionsData: fields: - 0: - - AssignedforNetFlowv9compatibility + - Enterprise: 123 - Vec: - 0 - 0 - 0 - 1 - 1: - - ExportedMessageTotalCount + - IANA: ExportedMessageTotalCount - DataNumber: 276 - 2: - - ExportedFlowRecordTotalCount + - IANA: ExportedFlowRecordTotalCount - DataNumber: 5140 - 0: - - AssignedforNetFlowv9compatibility + - Enterprise: 123 - Vec: - 0 - 0 - 0 - 2 - 1: - - ExportedMessageTotalCount + - IANA: ExportedMessageTotalCount - DataNumber: 5140 - 2: - - ExportedFlowRecordTotalCount + - IANA: ExportedFlowRecordTotalCount - DataNumber: 7710 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_scappy_example.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_scappy_example.snap index ef8e7113..550bb9f0 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_scappy_example.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_scappy_example.snap @@ -19,74 +19,97 @@ expression: result field_count: 23 fields: - field_type_number: 8 - field_type: SourceIpv4address field_length: 4 + field_type: + IANA: SourceIpv4address - field_type_number: 12 - field_type: DestinationIpv4address field_length: 4 + field_type: + IANA: DestinationIpv4address - field_type_number: 5 - field_type: IpClassOfService field_length: 1 + field_type: + IANA: IpClassOfService - field_type_number: 4 - field_type: ProtocolIdentifier field_length: 1 + field_type: + IANA: ProtocolIdentifier - field_type_number: 7 - field_type: SourceTransportPort field_length: 2 + field_type: + IANA: SourceTransportPort - field_type_number: 11 - field_type: DestinationTransportPort field_length: 2 + field_type: + IANA: DestinationTransportPort - field_type_number: 32 - field_type: IcmpTypeCodeIpv4 field_length: 2 + field_type: + IANA: IcmpTypeCodeIpv4 - field_type_number: 10 - field_type: IngressInterface field_length: 4 + field_type: + IANA: IngressInterface - field_type_number: 16 - field_type: BgpSourceAsNumber field_length: 4 + field_type: + IANA: BgpSourceAsNumber - field_type_number: 17 - field_type: BgpDestinationAsNumber field_length: 4 + field_type: + IANA: BgpDestinationAsNumber - field_type_number: 18 - field_type: BgpNextHopIpv4address field_length: 4 + field_type: + IANA: BgpNextHopIpv4address - field_type_number: 14 - field_type: EgressInterface field_length: 4 + field_type: + IANA: EgressInterface - field_type_number: 1 - field_type: OctetDeltaCount field_length: 4 + field_type: + IANA: OctetDeltaCount - field_type_number: 2 - field_type: PacketDeltaCount field_length: 4 + field_type: + IANA: PacketDeltaCount - field_type_number: 22 - field_type: FlowStartSysUpTime field_length: 4 + field_type: + IANA: FlowStartSysUpTime - field_type_number: 21 - field_type: FlowEndSysUpTime field_length: 4 + field_type: + IANA: FlowEndSysUpTime - field_type_number: 15 - field_type: IpNextHopIpv4address field_length: 4 + field_type: + IANA: IpNextHopIpv4address - field_type_number: 9 - field_type: SourceIpv4prefixLength field_length: 1 + field_type: + IANA: SourceIpv4prefixLength - field_type_number: 13 - field_type: DestinationIpv4prefixLength field_length: 1 + field_type: + IANA: DestinationIpv4prefixLength - field_type_number: 6 - field_type: TcpControlBits field_length: 1 + field_type: + IANA: TcpControlBits - field_type_number: 60 - field_type: IpVersion field_length: 1 + field_type: + IANA: IpVersion - field_type_number: 152 - field_type: FlowStartMilliseconds field_length: 8 + field_type: + IANA: FlowStartMilliseconds - field_type_number: 153 - field_type: FlowEndMilliseconds field_length: 8 + field_type: + IANA: FlowEndMilliseconds - IPFix: header: version: 10 @@ -102,75 +125,75 @@ expression: result Data: fields: - 0: - - SourceIpv4address + - IANA: SourceIpv4address - Ip4Addr: 70.1.115.1 - 1: - - DestinationIpv4address + - IANA: DestinationIpv4address - Ip4Addr: 50.0.71.1 - 2: - - IpClassOfService + - IANA: IpClassOfService - DataNumber: 0 - 3: - - ProtocolIdentifier + - IANA: ProtocolIdentifier - ProtocolType: Anydistributedprotocol - 4: - - SourceTransportPort + - IANA: SourceTransportPort - DataNumber: 0 - 5: - - DestinationTransportPort + - IANA: DestinationTransportPort - DataNumber: 0 - 6: - - IcmpTypeCodeIpv4 + - IANA: IcmpTypeCodeIpv4 - DataNumber: 0 - 7: - - IngressInterface + - IANA: IngressInterface - DataNumber: 827 - 8: - - BgpSourceAsNumber + - IANA: BgpSourceAsNumber - DataNumber: 2 - 9: - - BgpDestinationAsNumber + - IANA: BgpDestinationAsNumber - DataNumber: 3 - 10: - - BgpNextHopIpv4address + - IANA: BgpNextHopIpv4address - Ip4Addr: 204.42.110.101 - 11: - - EgressInterface + - IANA: EgressInterface - DataNumber: 854 - 12: - - OctetDeltaCount + - IANA: OctetDeltaCount - DataNumber: 1312 - 13: - - PacketDeltaCount + - IANA: PacketDeltaCount - DataNumber: 9 - 14: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 3019441902 - 15: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 3019616060 - 16: - - IpNextHopIpv4address + - IANA: IpNextHopIpv4address - Ip4Addr: 204.42.110.189 - 17: - - SourceIpv4prefixLength + - IANA: SourceIpv4prefixLength - DataNumber: 24 - 18: - - DestinationIpv4prefixLength + - IANA: DestinationIpv4prefixLength - DataNumber: 24 - 19: - - TcpControlBits + - IANA: TcpControlBits - DataNumber: 0 - 20: - - IpVersion + - IANA: IpVersion - DataNumber: 4 - 21: - - FlowStartMilliseconds + - IANA: FlowStartMilliseconds - Duration: secs: 1480449931 nanos: 519000000 - 22: - - FlowEndMilliseconds + - IANA: FlowEndMilliseconds - Duration: secs: 1480450105 nanos: 677000000 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_scappy_example_options_template.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_scappy_example_options_template.snap index 4539183a..c48f0868 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_scappy_example_options_template.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_scappy_example_options_template.snap @@ -20,11 +20,14 @@ expression: result scope_field_count: 1 fields: - field_type_number: 5 - field_type: IpClassOfService field_length: 2 + field_type: + IANA: IpClassOfService - field_type_number: 36 - field_type: FlowActiveTimeout field_length: 2 + field_type: + IANA: FlowActiveTimeout - field_type_number: 37 - field_type: FlowIdleTimeout field_length: 2 + field_type: + IANA: FlowIdleTimeout diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_with_v9_options_template_packet.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_with_v9_options_template_packet.snap index 88550ca7..be8f6ab7 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_with_v9_options_template_packet.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_ipfix_with_v9_options_template_packet.snap @@ -43,32 +43,41 @@ expression: "NetflowParser::default().parse_bytes(&packet)" field_count: 9 fields: - field_type_number: 8 - field_type: SourceIpv4address field_length: 4 + field_type: + IANA: SourceIpv4address - field_type_number: 12 - field_type: DestinationIpv4address field_length: 4 + field_type: + IANA: DestinationIpv4address - field_type_number: 7 - field_type: SourceTransportPort field_length: 2 + field_type: + IANA: SourceTransportPort - field_type_number: 11 - field_type: DestinationTransportPort field_length: 2 + field_type: + IANA: DestinationTransportPort - field_type_number: 4 - field_type: ProtocolIdentifier field_length: 1 + field_type: + IANA: ProtocolIdentifier - field_type_number: 2 - field_type: PacketDeltaCount field_length: 4 + field_type: + IANA: PacketDeltaCount - field_type_number: 1 - field_type: OctetDeltaCount field_length: 4 + field_type: + IANA: OctetDeltaCount - field_type_number: 22 - field_type: FlowStartSysUpTime field_length: 4 + field_type: + IANA: FlowStartSysUpTime - field_type_number: 21 - field_type: FlowEndSysUpTime field_length: 4 + field_type: + IANA: FlowEndSysUpTime - header: header_id: 258 length: 33 @@ -76,29 +85,29 @@ expression: "NetflowParser::default().parse_bytes(&packet)" Data: fields: - 0: - - SourceIpv4address + - IANA: SourceIpv4address - Ip4Addr: 70.70.1.1 - 1: - - DestinationIpv4address + - IANA: DestinationIpv4address - Ip4Addr: 120.120.1.1 - 2: - - SourceTransportPort + - IANA: SourceTransportPort - DataNumber: 12345 - 3: - - DestinationTransportPort + - IANA: DestinationTransportPort - DataNumber: 32777 - 4: - - ProtocolIdentifier + - IANA: ProtocolIdentifier - ProtocolType: Tcp - 5: - - PacketDeltaCount + - IANA: PacketDeltaCount - DataNumber: 100 - 6: - - OctetDeltaCount + - IANA: OctetDeltaCount - DataNumber: 125000000 - 7: - - FlowStartSysUpTime + - IANA: FlowStartSysUpTime - DataNumber: 1744871721 - 8: - - FlowEndSysUpTime + - IANA: FlowEndSysUpTime - DataNumber: 1744871721 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_multiple_packets.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_multiple_packets.snap index 74478e07..788d7dcb 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_multiple_packets.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_multiple_packets.snap @@ -156,14 +156,17 @@ expression: "NetflowParser::default().parse_bytes(&all)" field_count: 3 fields: - field_type_number: 8 - field_type: SourceIpv4address field_length: 4 + field_type: + IANA: SourceIpv4address - field_type_number: 12 - field_type: DestinationIpv4address field_length: 4 + field_type: + IANA: DestinationIpv4address - field_type_number: 2 - field_type: PacketDeltaCount field_length: 4 + field_type: + IANA: PacketDeltaCount - header: header_id: 256 length: 28 @@ -171,22 +174,22 @@ expression: "NetflowParser::default().parse_bytes(&all)" Data: fields: - 0: - - SourceIpv4address + - IANA: SourceIpv4address - Ip4Addr: 1.2.3.4 - 1: - - DestinationIpv4address + - IANA: DestinationIpv4address - Ip4Addr: 1.2.3.3 - 2: - - PacketDeltaCount + - IANA: PacketDeltaCount - DataNumber: 16909058 - 0: - - SourceIpv4address + - IANA: SourceIpv4address - Ip4Addr: 0.2.0.2 - 1: - - DestinationIpv4address + - IANA: DestinationIpv4address - Ip4Addr: 0.1.2.3 - 2: - - PacketDeltaCount + - IANA: PacketDeltaCount - DataNumber: 67438087 - V5: header: diff --git a/src/tests.rs b/src/tests.rs index 0a012296..9d92b334 100644 --- a/src/tests.rs +++ b/src/tests.rs @@ -4,6 +4,7 @@ mod base_tests { use crate::variable_versions::ipfix::{ Template as IPFixTemplate, TemplateField as IPFixTemplateField, }; + use crate::variable_versions::ipfix_lookup::{IANAIPFixField, IPFixField}; use crate::variable_versions::v9::{ Template as V9Template, TemplateField as V9TemplateField, }; @@ -334,15 +335,13 @@ mod base_tests { let fields = vec![ IPFixTemplateField { field_type_number: 2, - field_type: - crate::variable_versions::ipfix_lookup::IPFixField::PacketDeltaCount, + field_type: IPFixField::IANA(IANAIPFixField::PacketDeltaCount), field_length: 2, enterprise_number: None, }, IPFixTemplateField { field_type_number: 8, - field_type: - crate::variable_versions::ipfix_lookup::IPFixField::SourceIpv4address, + field_type: IPFixField::IANA(IANAIPFixField::SourceIpv4address), field_length: 4, enterprise_number: None, }, @@ -519,4 +518,11 @@ mod base_tests { .first() .unwrap(); } + + #[test] + fn it_parses_ipfix_multiple_templates() { + let hex = r#"000a05b4542bf40f0001f2c100000000000205a401000017008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80c000100000173f80c100010000173f01010018008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008808000040000173f000e0004000a0004809700040000173f80c000100000173f80c100010000173f01020025008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80ab00040000173f809e00080000173f80aa00080000173f80c000100000173f80c100010000173f8082ffff0000173f8083ffff0000173f808cffff0000173f808dffff0000173f808effff0000173f808fffff0000173f80b7ffff0000173f80b9ffff0000173f80baffff0000173f80beffff0000173f80cdffff0000173f01030017008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80c000100000173f80c100010000173f01040018008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008808000040000173f000e0004000a0004809700040000173f80c000100000173f80c100010000173f01050025008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80ab00040000173f809e00080000173f80aa00080000173f80c000100000173f80c100010000173f8082ffff0000173f8083ffff0000173f808cffff0000173f808dffff0000173f808effff0000173f808fffff0000173f80b7ffff0000173f80b9ffff0000173f80baffff0000173f80beffff0000173f80cdffff0000173f01060026008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809000020000173f809100080000173f809200080000173f809300080000173f809700040000173f80a100040000173f80a200040000173f809900080000173f809c00080000173f809d00080000173f809f00080000173f80a000080000173f80a900080000173f80b600040000173f80b7ffff0000173f80bbffff0000173f80bcffff0000173f80bdffff0000173f01070026008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809000020000173f809100080000173f809200080000173f809300080000173f809700040000173f80a100040000173f80a200040000173f809900080000173f809c00080000173f809d00080000173f809f00080000173f80a000080000173f80a900080000173f80b600040000173f80b7ffff0000173f80bbffff0000173f80bcffff0000173f80bdffff0000173f"#; + let packet = hex::decode(hex).unwrap(); + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packet)); + } } diff --git a/src/variable_versions/ipfix.rs b/src/variable_versions/ipfix.rs index 4ce92d30..d5b51987 100644 --- a/src/variable_versions/ipfix.rs +++ b/src/variable_versions/ipfix.rs @@ -81,8 +81,10 @@ pub struct IPFix { #[derive(Debug, PartialEq, Clone, Serialize)] pub enum FlowSetBody { Template(Template), + Templates(Vec