fix: Added NetEvent and ObservationTimeMilliseconds for V9 and safet …

Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "netflow_parser"
 description = "Parser for Netflow Cisco V5, V7, V9, IPFIX"
-version = "0.6.2"
+version = "0.6.3"
 edition = "2024"
 authors = ["michael.mileusnich@gmail.com"]
 license = "MIT OR Apache-2.0"

RELEASES.md

@@ -1,3 +1,7 @@
+# 0.6.3
+* Ipfix dateTimeNanoseconds and dateTimeMicroseconds use the NTP 64 bit time format #15
+* Added NetEvent and ObservationTimeMilliseconds for V9.
+
 # 0.6.2
 * IPFix supports multiple V9 Options templates.
 * Found casting issues that could result in dataloss in the DataNumbers module.

src/variable_versions/data_number.rs

@@ -317,15 +317,20 @@ impl FieldValue {
             FieldDataType::DurationMicros => {
                 let (i, seconds) = u32::parse_be(remaining)?;
                 let (i, fraction) = u32::parse_be(i)?;
-                let dur = Duration::from_secs(seconds as u64)
-                    + Duration::from_micros((fraction as u64 * 1_000_000) >> 32);
+                let dur =
+                    Duration::from_secs(seconds as u64).saturating_add(Duration::from_micros(
+                        ((u64::from(fraction)).saturating_mul(1_000_000)) >> 32,
+                    ));
                 (i, FieldValue::Duration(dur))
             }
             FieldDataType::DurationNanos => {
                 let (i, seconds) = u32::parse_be(remaining)?;
                 let (i, fraction) = u32::parse_be(i)?;
-                let dur = Duration::from_secs(seconds as u64)
-                    + Duration::from_nanos((fraction as u64 * 1_000_000_000) >> 32);
+                let dur = Duration::from_secs(u64::from(seconds)).saturating_add(
+                    Duration::from_nanos(
+                        (u64::from(fraction).saturating_mul(1_000_000_000)) >> 32,
+                    ),
+                );
                 (i, FieldValue::Duration(dur))
             }
             FieldDataType::ProtocolType => {

src/variable_versions/snapshots/netflow_parser__variable_versions__v9_lookup__v9_lookup_tests__it_tests_field_data_type_lookup.snap

@@ -231,7 +231,7 @@ expression: fields
 - UnsignedDataNumber
 - UnsignedDataNumber
 - Unknown
-- Unknown
+- UnsignedDataNumber
 - Unknown
 - Unknown
 - Unknown

src/variable_versions/snapshots/netflow_parser__variable_versions__v9_lookup__v9_lookup_tests__it_tests_field_lookup.snap

@@ -231,7 +231,7 @@ expression: fields
 - PostNATTSourceTransportPort
 - PostNATTDestinationTransportPort
 - Unknown
-- Unknown
+- NatEvent
 - Unknown
 - Unknown
 - Unknown

src/variable_versions/v9_lookup.rs

@@ -137,8 +137,10 @@ pub enum V9Field {
     PostNATDestinationIPv4Address = 226,
     PostNATTSourceTransportPort = 227,
     PostNATTDestinationTransportPort = 228,
+    NatEvent = 230,
     PostNATSourceIpv6Address = 281,
     PostNATDestinationIpv6Address = 282,
+    ObservationTimeMilliseconds = 323,
     Vendor,
     Unknown,
 }
@@ -252,6 +254,8 @@ impl From<V9Field> for FieldDataType {
             V9Field::PostNATTDestinationTransportPort => FieldDataType::UnsignedDataNumber,
             V9Field::PostNATSourceIpv6Address => FieldDataType::Ip6Addr,
             V9Field::PostNATDestinationIpv6Address => FieldDataType::Ip6Addr,
+            V9Field::ObservationTimeMilliseconds => FieldDataType::DurationMillis,
+            V9Field::NatEvent => FieldDataType::UnsignedDataNumber,
             _ => FieldDataType::Unknown,
         }
     }
@@ -372,8 +376,10 @@ impl From<u16> for V9Field {
             226 => V9Field::PostNATDestinationIPv4Address,
             227 => V9Field::PostNATTSourceTransportPort,
             228 => V9Field::PostNATTDestinationTransportPort,
+            230 => V9Field::NatEvent,
             281 => V9Field::PostNATSourceIpv6Address,
             282 => V9Field::PostNATDestinationIpv6Address,
+            323 => V9Field::ObservationTimeMilliseconds,
             _ => V9Field::Unknown,
         }
     }