From 59116ebedb43b0c2a74ebe543f4c284d6a809767 Mon Sep 17 00:00:00 2001 From: mikemiles-dev Date: Sat, 25 Apr 2026 10:27:40 -0500 Subject: [PATCH 1/2] fix: Restore tests --- RELEASES.md | 13 + ...stored_legacy_tests__it_creates_error.snap | 8 + ...d_legacy_tests__it_doesnt_allow_ipfix.snap | 5 + ...ored_legacy_tests__it_doesnt_allow_v5.snap | 5 + ...ored_legacy_tests__it_doesnt_allow_v7.snap | 5 + ...ored_legacy_tests__it_doesnt_allow_v9.snap | 5 + ...ests__it_parses_0_length_fields_ipfix.snap | 12 + ...estored_legacy_tests__it_parses_ipfix.snap | 52 + ...tests__it_parses_ipfix_and_re_exports.snap | 68 + ..._it_parses_ipfix_data_cached_template.snap | 23 + ...nterprise_bit_in_non_options_template.snap | 12 + ...pfix_enterprise_bit_template_and_data.snap | 351 +++ ...d_enteprise_and_non_enterprise_fields.snap | 1167 ++++++++ ...it_parses_ipfix_multiple_flow_records.snap | 739 +++++ ...s__it_parses_ipfix_multiple_templates.snap | 1125 ++++++++ ...sts__it_parses_ipfix_options_template.snap | 36 + ...rses_ipfix_options_template_with_data.snap | 70 + ...tests__it_parses_ipfix_scappy_example.snap | 200 ++ ...ipfix_scappy_example_options_template.snap | 33 + ..._parses_ipfix_with_no_template_fields.snap | 16 + ...ipfix_with_v9_options_template_packet.snap | 12 + ...acy_tests__it_parses_multiple_packets.snap | 220 ++ ...cy_tests__it_parses_v5_and_re_exports.snap | 76 + ...legacy_tests__it_parses_v5_incomplete.snap | 8 + ...cy_tests__it_parses_v7_and_re_exports.snap | 80 + ...__restored_legacy_tests__it_parses_v9.snap | 39 + ...cy_tests__it_parses_v9_and_re_exports.snap | 52 + ...ts__it_parses_v9_data_cached_template.snap | 24 + ...acy_tests__it_parses_v9_ipv6flowlabel.snap | 492 ++++ ...legacy_tests__it_parses_v9_many_flows.snap | 44 + ...ed_legacy_tests__it_parses_v9_no_data.snap | 34 + ..._tests__it_parses_v9_options_template.snap | 50 + ...it_parses_v9_template_and_data_packet.snap | 771 ++++++ ..._parses_v9_with_multiple_options_data.snap | 2462 +++++++++++++++++ ...en_parsing_v9_with_no_template_fields.snap | 8 + src/tests.rs | 491 ++++ 36 files changed, 8808 insertions(+) create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_creates_error.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_doesnt_allow_ipfix.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_doesnt_allow_v5.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_doesnt_allow_v7.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_doesnt_allow_v9.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_0_length_fields_ipfix.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_and_re_exports.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_data_cached_template.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_enterprise_bit_in_non_options_template.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_enterprise_bit_template_and_data.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_mixed_enteprise_and_non_enterprise_fields.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_multiple_flow_records.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_multiple_templates.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_options_template.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_options_template_with_data.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_scappy_example.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_scappy_example_options_template.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_with_no_template_fields.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_with_v9_options_template_packet.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_multiple_packets.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v5_and_re_exports.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v5_incomplete.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v7_and_re_exports.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_and_re_exports.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_data_cached_template.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_ipv6flowlabel.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_many_flows.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_no_data.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_options_template.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_template_and_data_packet.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_with_multiple_options_data.snap create mode 100644 src/snapshots/netflow_parser__tests__restored_legacy_tests__it_raises_error_when_parsing_v9_with_no_template_fields.snap diff --git a/RELEASES.md b/RELEASES.md index 1adb6f26..9c51da9a 100644 --- a/RELEASES.md +++ b/RELEASES.md @@ -1,3 +1,16 @@ +# 1.0.3 + +## Tests + +* **Restored 34 snapshot-based parser tests** in a new `restored_legacy_tests` module in `src/tests.rs`. These tests had been deleted in PR #210 ("further template validation"), leaving 33 orphaned `.snap` files that were swept up later in PR #262. Coverage included real-world v9/IPFIX captures (`it_parses_v9_ipv6flowlabel`, `it_parses_v9_template_and_data_packet`, `it_parses_ipfix_scappy_example`, mixed-enterprise field templates, multi-template IPFIX, etc.), version-filter checks (`it_doesnt_allow_v5/v7/v9/ipfix`), and re-export round-trip tests (`it_parses_*_and_re_exports`). +* Tests adapted to current APIs: `TemplateWithTtl::new(...)` → `TemplateWithTtl::new_without_ttl(Arc::new(...))` (cache now stores Arc-wrapped templates); `with_allowed_versions(&[])` is rejected by the builder, so version-filter tests now allow only the *other* versions to verify filtering. +* Snapshot count restored from 14 → 48. + +## Dependencies + +* Bumped `lru` from 0.16 to 0.17. +* Bumped `etherparse` from 0.19 to 0.20. + # 1.0.2 ## Performance diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_creates_error.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_creates_error.snap new file mode 100644 index 00000000..d8baf508 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_creates_error.snap @@ -0,0 +1,8 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&packet)" +--- +packets: [] +error: + Partial: + message: "V9 parse error: Parsing requires 4 bytes/chars" diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_doesnt_allow_ipfix.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_doesnt_allow_ipfix.snap new file mode 100644 index 00000000..f06675f1 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_doesnt_allow_ipfix.snap @@ -0,0 +1,5 @@ +--- +source: src/tests.rs +expression: parser.parse_bytes(&packet).packets +--- +[] diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_doesnt_allow_v5.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_doesnt_allow_v5.snap new file mode 100644 index 00000000..f06675f1 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_doesnt_allow_v5.snap @@ -0,0 +1,5 @@ +--- +source: src/tests.rs +expression: parser.parse_bytes(&packet).packets +--- +[] diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_doesnt_allow_v7.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_doesnt_allow_v7.snap new file mode 100644 index 00000000..f06675f1 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_doesnt_allow_v7.snap @@ -0,0 +1,5 @@ +--- +source: src/tests.rs +expression: parser.parse_bytes(&packet).packets +--- +[] diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_doesnt_allow_v9.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_doesnt_allow_v9.snap new file mode 100644 index 00000000..f06675f1 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_doesnt_allow_v9.snap @@ -0,0 +1,5 @@ +--- +source: src/tests.rs +expression: parser.parse_bytes(&packet).packets +--- +[] diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_0_length_fields_ipfix.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_0_length_fields_ipfix.snap new file mode 100644 index 00000000..46236edc --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_0_length_fields_ipfix.snap @@ -0,0 +1,12 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&packet).packets" +--- +- IPFix: + header: + version: 10 + length: 48 + export_time: 16909060 + sequence_number: 0 + observation_domain_id: 16909060 + flowsets: [] diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix.snap new file mode 100644 index 00000000..08a08ff3 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix.snap @@ -0,0 +1,52 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&packet).packets" +--- +- IPFix: + header: + version: 10 + length: 64 + export_time: 16909060 + sequence_number: 0 + observation_domain_id: 16909060 + flowsets: + - header: + header_id: 2 + length: 20 + body: + Template: + template_id: 256 + field_count: 3 + fields: + - field_type_number: 8 + field_length: 4 + field_type: + IANA: SourceIpv4address + - field_type_number: 12 + field_length: 4 + field_type: + IANA: DestinationIpv4address + - field_type_number: 2 + field_length: 4 + field_type: + IANA: PacketDeltaCount + - header: + header_id: 256 + length: 28 + body: + Data: + fields: + - - - IANA: SourceIpv4address + - Ip4Addr: 1.2.3.4 + - - IANA: DestinationIpv4address + - Ip4Addr: 1.2.3.3 + - - IANA: PacketDeltaCount + - DataNumber: + U32: 16909058 + - - - IANA: SourceIpv4address + - Ip4Addr: 0.2.0.2 + - - IANA: DestinationIpv4address + - Ip4Addr: 0.1.2.3 + - - IANA: PacketDeltaCount + - DataNumber: + U32: 67438087 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_and_re_exports.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_and_re_exports.snap new file mode 100644 index 00000000..d6aae6ee --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_and_re_exports.snap @@ -0,0 +1,68 @@ +--- +source: src/tests.rs +expression: ipfix.to_be_bytes().unwrap() +--- +- 0 +- 10 +- 0 +- 64 +- 1 +- 2 +- 3 +- 4 +- 0 +- 0 +- 0 +- 0 +- 1 +- 2 +- 3 +- 4 +- 0 +- 2 +- 0 +- 20 +- 1 +- 0 +- 0 +- 3 +- 0 +- 8 +- 0 +- 4 +- 0 +- 12 +- 0 +- 4 +- 0 +- 2 +- 0 +- 4 +- 1 +- 0 +- 0 +- 28 +- 1 +- 2 +- 3 +- 4 +- 1 +- 2 +- 3 +- 3 +- 1 +- 2 +- 3 +- 2 +- 0 +- 2 +- 0 +- 2 +- 0 +- 1 +- 2 +- 3 +- 4 +- 5 +- 6 +- 7 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_data_cached_template.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_data_cached_template.snap new file mode 100644 index 00000000..1c9e7dc9 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_data_cached_template.snap @@ -0,0 +1,23 @@ +--- +source: src/tests.rs +expression: parser.parse_bytes(&packet).packets +--- +- IPFix: + header: + version: 10 + length: 26 + export_time: 1 + sequence_number: 1 + observation_domain_id: 0 + flowsets: + - header: + header_id: 258 + length: 10 + body: + Data: + fields: + - - - IANA: PacketDeltaCount + - DataNumber: + U16: 8 + - - IANA: SourceIpv4address + - Ip4Addr: 0.0.1.1 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_enterprise_bit_in_non_options_template.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_enterprise_bit_in_non_options_template.snap new file mode 100644 index 00000000..88d62f3f --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_enterprise_bit_in_non_options_template.snap @@ -0,0 +1,12 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&packet).packets" +--- +- IPFix: + header: + version: 10 + length: 42 + export_time: 1670052913 + sequence_number: 0 + observation_domain_id: 0 + flowsets: [] diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_enterprise_bit_template_and_data.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_enterprise_bit_template_and_data.snap new file mode 100644 index 00000000..0cedf3a1 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_enterprise_bit_template_and_data.snap @@ -0,0 +1,351 @@ +--- +source: src/tests.rs +expression: result +--- +- IPFix: + header: + version: 10 + length: 244 + export_time: 1530614917 + sequence_number: 34503 + observation_domain_id: 768 + flowsets: + - header: + header_id: 2 + length: 228 + body: + Template: + template_id: 268 + field_count: 34 + fields: + - field_type_number: 12236 + field_length: 4 + enterprise_number: 9 + field_type: + Cisco: CiscoClientIpv4Address + - field_type_number: 12237 + field_length: 4 + enterprise_number: 9 + field_type: + Cisco: CiscoServerIpv4Address + - field_type_number: 12240 + field_length: 2 + enterprise_number: 9 + field_type: + Cisco: CiscoClientL4Port + - field_type_number: 12241 + field_length: 2 + enterprise_number: 9 + field_type: + Cisco: CiscoServerL4Port + - field_type_number: 234 + field_length: 4 + field_type: + IANA: IngressVrfid + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 239 + field_length: 1 + field_type: + IANA: BiflowDirection + - field_type_number: 12242 + field_length: 4 + enterprise_number: 9 + field_type: + Cisco: CiscoConnectionId + - field_type_number: 95 + field_length: 4 + field_type: + IANA: ApplicationId + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 48 + field_length: 1 + field_type: + IANA: SamplerId + - field_type_number: 9252 + field_length: 1 + enterprise_number: 9 + field_type: + Cisco: CiscoServicesWaasSegment + - field_type_number: 9253 + field_length: 1 + enterprise_number: 9 + field_type: + Cisco: CiscoServicesWaasPassthroughReason + - field_type_number: 9357 + field_length: 65535 + enterprise_number: 9 + field_type: + Cisco: CiscoAppHttpUriStatistics + - field_type_number: 12235 + field_length: 65535 + enterprise_number: 9 + field_type: + Cisco: CiscoAppHttpHost + - field_type_number: 22 + field_length: 4 + field_type: + IANA: FlowStartSysUpTime + - field_type_number: 21 + field_length: 4 + field_type: + IANA: FlowEndSysUpTime + - field_type_number: 278 + field_length: 4 + field_type: + IANA: NewConnectionDeltaCount + - field_type_number: 232 + field_length: 8 + field_type: + IANA: ResponderOctets + - field_type_number: 299 + field_length: 8 + field_type: + IANA: ResponderPackets + - field_type_number: 231 + field_length: 8 + field_type: + IANA: InitiatorOctets + - field_type_number: 298 + field_length: 8 + field_type: + IANA: InitiatorPackets + - field_type_number: 9303 + field_length: 4 + enterprise_number: 9 + field_type: + Cisco: + Unknown: 9303 + - field_type_number: 9292 + field_length: 4 + enterprise_number: 9 + field_type: + Cisco: + Unknown: 9292 + - field_type_number: 9300 + field_length: 4 + enterprise_number: 9 + field_type: + Cisco: + Unknown: 9300 + - field_type_number: 9319 + field_length: 4 + enterprise_number: 9 + field_type: + Cisco: + Unknown: 9319 + - field_type_number: 9316 + field_length: 4 + enterprise_number: 9 + field_type: + Cisco: + Unknown: 9316 + - field_type_number: 9268 + field_length: 4 + enterprise_number: 9 + field_type: + Cisco: + Unknown: 9268 + - field_type_number: 9313 + field_length: 4 + enterprise_number: 9 + field_type: + Cisco: + Unknown: 9313 + - field_type_number: 9306 + field_length: 4 + enterprise_number: 9 + field_type: + Cisco: + Unknown: 9306 + - field_type_number: 9307 + field_length: 4 + enterprise_number: 9 + field_type: + Cisco: + Unknown: 9307 + - field_type_number: 9309 + field_length: 4 + enterprise_number: 9 + field_type: + Cisco: + Unknown: 9309 + - field_type_number: 9273 + field_length: 4 + enterprise_number: 9 + field_type: + Cisco: + Unknown: 9273 + - field_type_number: 9272 + field_length: 4 + enterprise_number: 9 + field_type: + Cisco: + Unknown: 9272 +- IPFix: + header: + version: 10 + length: 188 + export_time: 1530614908 + sequence_number: 34502 + observation_domain_id: 768 + flowsets: + - header: + header_id: 268 + length: 172 + body: + Data: + fields: + - - - Cisco: CiscoClientIpv4Address + - Ip4Addr: 10.209.101.66 + - - Cisco: CiscoServerIpv4Address + - Ip4Addr: 10.0.0.241 + - - Cisco: CiscoClientL4Port + - DataNumber: + U16: 49376 + - - Cisco: CiscoServerL4Port + - DataNumber: + U16: 80 + - - IANA: IngressVrfid + - DataNumber: + U32: 0 + - - IANA: IngressInterface + - DataNumber: + U32: 13 + - - IANA: BiflowDirection + - DataNumber: + U8: 1 + - - Cisco: CiscoConnectionId + - DataNumber: + U32: 2378383328 + - - IANA: ApplicationId + - ApplicationId: + classification_engine_id: 3 + selector_id: + U24: 80 + - - IANA: EgressInterface + - DataNumber: + U32: 10 + - - IANA: SamplerId + - DataNumber: + U8: 9 + - - Cisco: CiscoServicesWaasSegment + - DataNumber: + U8: 16 + - - Cisco: CiscoServicesWaasPassthroughReason + - DataNumber: + U8: 0 + - - Cisco: CiscoAppHttpUriStatistics + - String: /DocLib1 + - - Cisco: CiscoAppHttpHost + - String: P4portal.medsigroup.ru + - - IANA: FlowStartSysUpTime + - DataNumber: + U32: 564191867 + - - IANA: FlowEndSysUpTime + - DataNumber: + U32: 564303806 + - - IANA: NewConnectionDeltaCount + - DataNumber: + U32: 1 + - - IANA: ResponderOctets + - DataNumber: + U64: 0 + - - IANA: ResponderPackets + - DataNumber: + U64: 0 + - - IANA: InitiatorOctets + - DataNumber: + U64: 6208 + - - IANA: InitiatorPackets + - DataNumber: + U64: 15 + - - Cisco: + Unknown: 9303 + - Vec: + - 0 + - 0 + - 0 + - 0 + - - Cisco: + Unknown: 9292 + - Vec: + - 0 + - 0 + - 0 + - 0 + - - Cisco: + Unknown: 9300 + - Vec: + - 0 + - 0 + - 0 + - 0 + - - Cisco: + Unknown: 9319 + - Vec: + - 0 + - 0 + - 0 + - 0 + - - Cisco: + Unknown: 9316 + - Vec: + - 0 + - 0 + - 0 + - 0 + - - Cisco: + Unknown: 9268 + - Vec: + - 0 + - 0 + - 0 + - 0 + - - Cisco: + Unknown: 9313 + - Vec: + - 0 + - 0 + - 0 + - 0 + - - Cisco: + Unknown: 9306 + - Vec: + - 0 + - 0 + - 0 + - 0 + - - Cisco: + Unknown: 9307 + - Vec: + - 0 + - 0 + - 0 + - 0 + - - Cisco: + Unknown: 9309 + - Vec: + - 0 + - 0 + - 0 + - 0 + - - Cisco: + Unknown: 9273 + - Vec: + - 0 + - 0 + - 0 + - 0 + - - Cisco: + Unknown: 9272 + - Vec: + - 0 + - 0 + - 0 + - 0 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_mixed_enteprise_and_non_enterprise_fields.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_mixed_enteprise_and_non_enterprise_fields.snap new file mode 100644 index 00000000..6d8d8ec1 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_mixed_enteprise_and_non_enterprise_fields.snap @@ -0,0 +1,1167 @@ +--- +source: src/tests.rs +expression: result +--- +- IPFix: + header: + version: 10 + length: 132 + export_time: 1530614934 + sequence_number: 6200673 + observation_domain_id: 1024 + flowsets: + - header: + header_id: 2 + length: 116 + body: + Template: + template_id: 264 + field_count: 22 + fields: + - field_type_number: 12236 + field_length: 4 + enterprise_number: 9 + field_type: + Cisco: CiscoClientIpv4Address + - field_type_number: 12237 + field_length: 4 + enterprise_number: 9 + field_type: + Cisco: CiscoServerIpv4Address + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 195 + field_length: 1 + field_type: + IANA: IpDiffServCodePoint + - field_type_number: 192 + field_length: 1 + field_type: + IANA: IpTtl + - field_type_number: 12241 + field_length: 2 + enterprise_number: 9 + field_type: + Cisco: CiscoServerL4Port + - field_type_number: 234 + field_length: 4 + field_type: + IANA: IngressVrfid + - field_type_number: 95 + field_length: 4 + field_type: + IANA: ApplicationId + - field_type_number: 58 + field_length: 2 + field_type: + IANA: VlanId + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 239 + field_length: 1 + field_type: + IANA: BiflowDirection + - field_type_number: 9252 + field_length: 1 + enterprise_number: 9 + field_type: + Cisco: CiscoServicesWaasSegment + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 9253 + field_length: 1 + enterprise_number: 9 + field_type: + Cisco: CiscoServicesWaasPassthroughReason + - field_type_number: 22 + field_length: 4 + field_type: + IANA: FlowStartSysUpTime + - field_type_number: 21 + field_length: 4 + field_type: + IANA: FlowEndSysUpTime + - field_type_number: 278 + field_length: 4 + field_type: + IANA: NewConnectionDeltaCount + - field_type_number: 279 + field_length: 8 + field_type: + IANA: ConnectionSumDurationSeconds + - field_type_number: 232 + field_length: 8 + field_type: + IANA: ResponderOctets + - field_type_number: 299 + field_length: 8 + field_type: + IANA: ResponderPackets + - field_type_number: 231 + field_length: 8 + field_type: + IANA: InitiatorOctets + - field_type_number: 298 + field_length: 8 + field_type: + IANA: InitiatorPackets +- IPFix: + header: + version: 10 + length: 1396 + export_time: 1530614820 + sequence_number: 6199655 + observation_domain_id: 1024 + flowsets: + - header: + header_id: 264 + length: 1380 + body: + Data: + fields: + - - - Cisco: CiscoClientIpv4Address + - Ip4Addr: 10.101.255.1 + - - Cisco: CiscoServerIpv4Address + - Ip4Addr: 10.10.28.57 + - - IANA: ProtocolIdentifier + - ProtocolType: Udp + - - IANA: IpDiffServCodePoint + - DataNumber: + U8: 0 + - - IANA: IpTtl + - DataNumber: + U8: 255 + - - Cisco: CiscoServerL4Port + - DataNumber: + U16: 2055 + - - IANA: IngressVrfid + - DataNumber: + U32: 0 + - - IANA: ApplicationId + - ApplicationId: + classification_engine_id: 13 + selector_id: + U24: 606 + - - IANA: VlanId + - DataNumber: + U16: 0 + - - IANA: IngressInterface + - DataNumber: + U32: 0 + - - IANA: BiflowDirection + - DataNumber: + U8: 1 + - - Cisco: CiscoServicesWaasSegment + - DataNumber: + U8: 16 + - - IANA: EgressInterface + - DataNumber: + U32: 20 + - - Cisco: CiscoServicesWaasPassthroughReason + - DataNumber: + U8: 0 + - - IANA: FlowStartSysUpTime + - DataNumber: + U32: 4019387228 + - - IANA: FlowEndSysUpTime + - DataNumber: + U32: 4019440532 + - - IANA: NewConnectionDeltaCount + - DataNumber: + U32: 0 + - - IANA: ConnectionSumDurationSeconds + - DataNumber: + U64: 53 + - - IANA: ResponderOctets + - DataNumber: + U64: 0 + - - IANA: ResponderPackets + - DataNumber: + U64: 0 + - - IANA: InitiatorOctets + - DataNumber: + U64: 192505 + - - IANA: InitiatorPackets + - DataNumber: + U64: 155 + - - - Cisco: CiscoClientIpv4Address + - Ip4Addr: 172.31.255.1 + - - Cisco: CiscoServerIpv4Address + - Ip4Addr: 172.31.255.1 + - - IANA: ProtocolIdentifier + - ProtocolType: Udp + - - IANA: IpDiffServCodePoint + - DataNumber: + U8: 0 + - - IANA: IpTtl + - DataNumber: + U8: 254 + - - Cisco: CiscoServerL4Port + - DataNumber: + U16: 3785 + - - IANA: IngressVrfid + - DataNumber: + U32: 0 + - - IANA: ApplicationId + - ApplicationId: + classification_engine_id: 13 + selector_id: + U24: 1 + - - IANA: VlanId + - DataNumber: + U16: 0 + - - IANA: IngressInterface + - DataNumber: + U32: 1 + - - IANA: BiflowDirection + - DataNumber: + U8: 1 + - - Cisco: CiscoServicesWaasSegment + - DataNumber: + U8: 16 + - - IANA: EgressInterface + - DataNumber: + U32: 1 + - - Cisco: CiscoServicesWaasPassthroughReason + - DataNumber: + U8: 0 + - - IANA: FlowStartSysUpTime + - DataNumber: + U32: 4019387232 + - - IANA: FlowEndSysUpTime + - DataNumber: + U32: 4019446788 + - - IANA: NewConnectionDeltaCount + - DataNumber: + U32: 0 + - - IANA: ConnectionSumDurationSeconds + - DataNumber: + U64: 120 + - - IANA: ResponderOctets + - DataNumber: + U64: 0 + - - IANA: ResponderPackets + - DataNumber: + U64: 0 + - - IANA: InitiatorOctets + - DataNumber: + U64: 2208 + - - IANA: InitiatorPackets + - DataNumber: + U64: 184 + - - - Cisco: CiscoClientIpv4Address + - Ip4Addr: 10.208.22.118 + - - Cisco: CiscoServerIpv4Address + - Ip4Addr: 10.101.22.251 + - - IANA: ProtocolIdentifier + - ProtocolType: Udp + - - IANA: IpDiffServCodePoint + - DataNumber: + U8: 4 + - - IANA: IpTtl + - DataNumber: + U8: 61 + - - Cisco: CiscoServerL4Port + - DataNumber: + U16: 17654 + - - IANA: IngressVrfid + - DataNumber: + U32: 0 + - - IANA: ApplicationId + - ApplicationId: + classification_engine_id: 13 + selector_id: + U24: 1 + - - IANA: VlanId + - DataNumber: + U16: 0 + - - IANA: IngressInterface + - DataNumber: + U32: 1 + - - IANA: BiflowDirection + - DataNumber: + U8: 1 + - - Cisco: CiscoServicesWaasSegment + - DataNumber: + U8: 16 + - - IANA: EgressInterface + - DataNumber: + U32: 4 + - - Cisco: CiscoServicesWaasPassthroughReason + - DataNumber: + U8: 0 + - - IANA: FlowStartSysUpTime + - DataNumber: + U32: 4019387236 + - - IANA: FlowEndSysUpTime + - DataNumber: + U32: 4019437108 + - - IANA: NewConnectionDeltaCount + - DataNumber: + U32: 0 + - - IANA: ConnectionSumDurationSeconds + - DataNumber: + U64: 59 + - - IANA: ResponderOctets + - DataNumber: + U64: 0 + - - IANA: ResponderPackets + - DataNumber: + U64: 0 + - - IANA: InitiatorOctets + - DataNumber: + U64: 96 + - - IANA: InitiatorPackets + - DataNumber: + U64: 6 + - - - Cisco: CiscoClientIpv4Address + - Ip4Addr: 10.0.151.220 + - - Cisco: CiscoServerIpv4Address + - Ip4Addr: 10.101.151.95 + - - IANA: ProtocolIdentifier + - ProtocolType: Udp + - - IANA: IpDiffServCodePoint + - DataNumber: + U8: 0 + - - IANA: IpTtl + - DataNumber: + U8: 60 + - - Cisco: CiscoServerL4Port + - DataNumber: + U16: 57339 + - - IANA: IngressVrfid + - DataNumber: + U32: 0 + - - IANA: ApplicationId + - ApplicationId: + classification_engine_id: 13 + selector_id: + U24: 1 + - - IANA: VlanId + - DataNumber: + U16: 0 + - - IANA: IngressInterface + - DataNumber: + U32: 1 + - - IANA: BiflowDirection + - DataNumber: + U8: 1 + - - Cisco: CiscoServicesWaasSegment + - DataNumber: + U8: 16 + - - IANA: EgressInterface + - DataNumber: + U32: 4 + - - Cisco: CiscoServicesWaasPassthroughReason + - DataNumber: + U8: 0 + - - IANA: FlowStartSysUpTime + - DataNumber: + U32: 4019387306 + - - IANA: FlowEndSysUpTime + - DataNumber: + U32: 4019447034 + - - IANA: NewConnectionDeltaCount + - DataNumber: + U32: 0 + - - IANA: ConnectionSumDurationSeconds + - DataNumber: + U64: 59 + - - IANA: ResponderOctets + - DataNumber: + U64: 0 + - - IANA: ResponderPackets + - DataNumber: + U64: 0 + - - IANA: InitiatorOctets + - DataNumber: + U64: 15264 + - - IANA: InitiatorPackets + - DataNumber: + U64: 24 + - - - Cisco: CiscoClientIpv4Address + - Ip4Addr: 10.101.22.251 + - - Cisco: CiscoServerIpv4Address + - Ip4Addr: 10.25.22.18 + - - IANA: ProtocolIdentifier + - ProtocolType: Udp + - - IANA: IpDiffServCodePoint + - DataNumber: + U8: 0 + - - IANA: IpTtl + - DataNumber: + U8: 126 + - - Cisco: CiscoServerL4Port + - DataNumber: + U16: 5001 + - - IANA: IngressVrfid + - DataNumber: + U32: 0 + - - IANA: ApplicationId + - ApplicationId: + classification_engine_id: 13 + selector_id: + U24: 1 + - - IANA: VlanId + - DataNumber: + U16: 0 + - - IANA: IngressInterface + - DataNumber: + U32: 4 + - - IANA: BiflowDirection + - DataNumber: + U8: 1 + - - Cisco: CiscoServicesWaasSegment + - DataNumber: + U8: 16 + - - IANA: EgressInterface + - DataNumber: + U32: 20 + - - Cisco: CiscoServicesWaasPassthroughReason + - DataNumber: + U8: 0 + - - IANA: FlowStartSysUpTime + - DataNumber: + U32: 4019387310 + - - IANA: FlowEndSysUpTime + - DataNumber: + U32: 4019446976 + - - IANA: NewConnectionDeltaCount + - DataNumber: + U32: 0 + - - IANA: ConnectionSumDurationSeconds + - DataNumber: + U64: 59 + - - IANA: ResponderOctets + - DataNumber: + U64: 0 + - - IANA: ResponderPackets + - DataNumber: + U64: 0 + - - IANA: InitiatorOctets + - DataNumber: + U64: 5872 + - - IANA: InitiatorPackets + - DataNumber: + U64: 367 + - - - Cisco: CiscoClientIpv4Address + - Ip4Addr: 224.0.0.5 + - - Cisco: CiscoServerIpv4Address + - Ip4Addr: 172.31.255.1 + - - IANA: ProtocolIdentifier + - ProtocolType: Ospfigp + - - IANA: IpDiffServCodePoint + - DataNumber: + U8: 0 + - - IANA: IpTtl + - DataNumber: + U8: 1 + - - Cisco: CiscoServerL4Port + - DataNumber: + U16: 0 + - - IANA: IngressVrfid + - DataNumber: + U32: 0 + - - IANA: ApplicationId + - ApplicationId: + classification_engine_id: 1 + selector_id: + U24: 89 + - - IANA: VlanId + - DataNumber: + U16: 0 + - - IANA: IngressInterface + - DataNumber: + U32: 1 + - - IANA: BiflowDirection + - DataNumber: + U8: 2 + - - Cisco: CiscoServicesWaasSegment + - DataNumber: + U8: 16 + - - IANA: EgressInterface + - DataNumber: + U32: 0 + - - Cisco: CiscoServicesWaasPassthroughReason + - DataNumber: + U8: 0 + - - IANA: FlowStartSysUpTime + - DataNumber: + U32: 4019387360 + - - IANA: FlowEndSysUpTime + - DataNumber: + U32: 4019444662 + - - IANA: NewConnectionDeltaCount + - DataNumber: + U32: 0 + - - IANA: ConnectionSumDurationSeconds + - DataNumber: + U64: 80 + - - IANA: ResponderOctets + - DataNumber: + U64: 0 + - - IANA: ResponderPackets + - DataNumber: + U64: 23 + - - IANA: InitiatorOctets + - DataNumber: + U64: 0 + - - IANA: InitiatorPackets + - DataNumber: + U64: 0 + - - - Cisco: CiscoClientIpv4Address + - Ip4Addr: 172.31.254.101 + - - Cisco: CiscoServerIpv4Address + - Ip4Addr: 172.31.254.101 + - - IANA: ProtocolIdentifier + - ProtocolType: Udp + - - IANA: IpDiffServCodePoint + - DataNumber: + U8: 48 + - - IANA: IpTtl + - DataNumber: + U8: 255 + - - Cisco: CiscoServerL4Port + - DataNumber: + U16: 3785 + - - IANA: IngressVrfid + - DataNumber: + U32: 0 + - - IANA: ApplicationId + - ApplicationId: + classification_engine_id: 13 + selector_id: + U24: 1 + - - IANA: VlanId + - DataNumber: + U16: 0 + - - IANA: IngressInterface + - DataNumber: + U32: 0 + - - IANA: BiflowDirection + - DataNumber: + U8: 1 + - - Cisco: CiscoServicesWaasSegment + - DataNumber: + U8: 16 + - - IANA: EgressInterface + - DataNumber: + U32: 1 + - - Cisco: CiscoServicesWaasPassthroughReason + - DataNumber: + U8: 0 + - - IANA: FlowStartSysUpTime + - DataNumber: + U32: 4019387474 + - - IANA: FlowEndSysUpTime + - DataNumber: + U32: 4019447040 + - - IANA: NewConnectionDeltaCount + - DataNumber: + U32: 0 + - - IANA: ConnectionSumDurationSeconds + - DataNumber: + U64: 60 + - - IANA: ResponderOctets + - DataNumber: + U64: 0 + - - IANA: ResponderPackets + - DataNumber: + U64: 0 + - - IANA: InitiatorOctets + - DataNumber: + U64: 3816 + - - IANA: InitiatorPackets + - DataNumber: + U64: 318 + - - - Cisco: CiscoClientIpv4Address + - Ip4Addr: 224.0.0.5 + - - Cisco: CiscoServerIpv4Address + - Ip4Addr: 172.31.250.252 + - - IANA: ProtocolIdentifier + - ProtocolType: Ospfigp + - - IANA: IpDiffServCodePoint + - DataNumber: + U8: 48 + - - IANA: IpTtl + - DataNumber: + U8: 1 + - - Cisco: CiscoServerL4Port + - DataNumber: + U16: 0 + - - IANA: IngressVrfid + - DataNumber: + U32: 0 + - - IANA: ApplicationId + - ApplicationId: + classification_engine_id: 1 + selector_id: + U24: 89 + - - IANA: VlanId + - DataNumber: + U16: 290 + - - IANA: IngressInterface + - DataNumber: + U32: 20 + - - IANA: BiflowDirection + - DataNumber: + U8: 2 + - - Cisco: CiscoServicesWaasSegment + - DataNumber: + U8: 16 + - - IANA: EgressInterface + - DataNumber: + U32: 0 + - - Cisco: CiscoServicesWaasPassthroughReason + - DataNumber: + U8: 0 + - - IANA: FlowStartSysUpTime + - DataNumber: + U32: 4019387484 + - - IANA: FlowEndSysUpTime + - DataNumber: + U32: 4019444636 + - - IANA: NewConnectionDeltaCount + - DataNumber: + U32: 0 + - - IANA: ConnectionSumDurationSeconds + - DataNumber: + U64: 0 + - - IANA: ResponderOctets + - DataNumber: + U64: 0 + - - IANA: ResponderPackets + - DataNumber: + U64: 7 + - - IANA: InitiatorOctets + - DataNumber: + U64: 0 + - - IANA: InitiatorPackets + - DataNumber: + U64: 0 + - - - Cisco: CiscoClientIpv4Address + - Ip4Addr: 10.208.22.13 + - - Cisco: CiscoServerIpv4Address + - Ip4Addr: 10.101.22.251 + - - IANA: ProtocolIdentifier + - ProtocolType: Udp + - - IANA: IpDiffServCodePoint + - DataNumber: + U8: 4 + - - IANA: IpTtl + - DataNumber: + U8: 61 + - - Cisco: CiscoServerL4Port + - DataNumber: + U16: 17654 + - - IANA: IngressVrfid + - DataNumber: + U32: 0 + - - IANA: ApplicationId + - ApplicationId: + classification_engine_id: 13 + selector_id: + U24: 1 + - - IANA: VlanId + - DataNumber: + U16: 0 + - - IANA: IngressInterface + - DataNumber: + U32: 1 + - - IANA: BiflowDirection + - DataNumber: + U8: 1 + - - Cisco: CiscoServicesWaasSegment + - DataNumber: + U8: 16 + - - IANA: EgressInterface + - DataNumber: + U32: 4 + - - Cisco: CiscoServicesWaasPassthroughReason + - DataNumber: + U8: 0 + - - IANA: FlowStartSysUpTime + - DataNumber: + U32: 4019387486 + - - IANA: FlowEndSysUpTime + - DataNumber: + U32: 4019437338 + - - IANA: NewConnectionDeltaCount + - DataNumber: + U32: 0 + - - IANA: ConnectionSumDurationSeconds + - DataNumber: + U64: 50 + - - IANA: ResponderOctets + - DataNumber: + U64: 0 + - - IANA: ResponderPackets + - DataNumber: + U64: 0 + - - IANA: InitiatorOctets + - DataNumber: + U64: 740 + - - IANA: InitiatorPackets + - DataNumber: + U64: 65 + - - - Cisco: CiscoClientIpv4Address + - Ip4Addr: 224.0.0.5 + - - Cisco: CiscoServerIpv4Address + - Ip4Addr: 172.31.254.27 + - - IANA: ProtocolIdentifier + - ProtocolType: Ospfigp + - - IANA: IpDiffServCodePoint + - DataNumber: + U8: 48 + - - IANA: IpTtl + - DataNumber: + U8: 1 + - - Cisco: CiscoServerL4Port + - DataNumber: + U16: 0 + - - IANA: IngressVrfid + - DataNumber: + U32: 0 + - - IANA: ApplicationId + - ApplicationId: + classification_engine_id: 1 + selector_id: + U24: 89 + - - IANA: VlanId + - DataNumber: + U16: 0 + - - IANA: IngressInterface + - DataNumber: + U32: 1 + - - IANA: BiflowDirection + - DataNumber: + U8: 2 + - - Cisco: CiscoServicesWaasSegment + - DataNumber: + U8: 16 + - - IANA: EgressInterface + - DataNumber: + U32: 0 + - - Cisco: CiscoServicesWaasPassthroughReason + - DataNumber: + U8: 0 + - - IANA: FlowStartSysUpTime + - DataNumber: + U32: 4019387494 + - - IANA: FlowEndSysUpTime + - DataNumber: + U32: 4019443438 + - - IANA: NewConnectionDeltaCount + - DataNumber: + U32: 0 + - - IANA: ConnectionSumDurationSeconds + - DataNumber: + U64: 0 + - - IANA: ResponderOctets + - DataNumber: + U64: 0 + - - IANA: ResponderPackets + - DataNumber: + U64: 7 + - - IANA: InitiatorOctets + - DataNumber: + U64: 0 + - - IANA: InitiatorPackets + - DataNumber: + U64: 0 + - - - Cisco: CiscoClientIpv4Address + - Ip4Addr: 10.100.102.116 + - - Cisco: CiscoServerIpv4Address + - Ip4Addr: 10.205.151.9 + - - IANA: ProtocolIdentifier + - ProtocolType: Udp + - - IANA: IpDiffServCodePoint + - DataNumber: + U8: 0 + - - IANA: IpTtl + - DataNumber: + U8: 125 + - - Cisco: CiscoServerL4Port + - DataNumber: + U16: 3389 + - - IANA: IngressVrfid + - DataNumber: + U32: 0 + - - IANA: ApplicationId + - ApplicationId: + classification_engine_id: 13 + selector_id: + U24: 1 + - - IANA: VlanId + - DataNumber: + U16: 290 + - - IANA: IngressInterface + - DataNumber: + U32: 20 + - - IANA: BiflowDirection + - DataNumber: + U8: 2 + - - Cisco: CiscoServicesWaasSegment + - DataNumber: + U8: 16 + - - IANA: EgressInterface + - DataNumber: + U32: 17 + - - Cisco: CiscoServicesWaasPassthroughReason + - DataNumber: + U8: 0 + - - IANA: FlowStartSysUpTime + - DataNumber: + U32: 4019387564 + - - IANA: FlowEndSysUpTime + - DataNumber: + U32: 4019438730 + - - IANA: NewConnectionDeltaCount + - DataNumber: + U32: 0 + - - IANA: ConnectionSumDurationSeconds + - DataNumber: + U64: 239 + - - IANA: ResponderOctets + - DataNumber: + U64: 225 + - - IANA: ResponderPackets + - DataNumber: + U64: 8 + - - IANA: InitiatorOctets + - DataNumber: + U64: 96 + - - IANA: InitiatorPackets + - DataNumber: + U64: 8 + - - - Cisco: CiscoClientIpv4Address + - Ip4Addr: 10.208.22.124 + - - Cisco: CiscoServerIpv4Address + - Ip4Addr: 10.101.22.251 + - - IANA: ProtocolIdentifier + - ProtocolType: Udp + - - IANA: IpDiffServCodePoint + - DataNumber: + U8: 4 + - - IANA: IpTtl + - DataNumber: + U8: 61 + - - Cisco: CiscoServerL4Port + - DataNumber: + U16: 17654 + - - IANA: IngressVrfid + - DataNumber: + U32: 0 + - - IANA: ApplicationId + - ApplicationId: + classification_engine_id: 13 + selector_id: + U24: 1 + - - IANA: VlanId + - DataNumber: + U16: 0 + - - IANA: IngressInterface + - DataNumber: + U32: 1 + - - IANA: BiflowDirection + - DataNumber: + U8: 1 + - - Cisco: CiscoServicesWaasSegment + - DataNumber: + U8: 16 + - - IANA: EgressInterface + - DataNumber: + U32: 4 + - - Cisco: CiscoServicesWaasPassthroughReason + - DataNumber: + U8: 0 + - - IANA: FlowStartSysUpTime + - DataNumber: + U32: 4019387592 + - - IANA: FlowEndSysUpTime + - DataNumber: + U32: 4019437466 + - - IANA: NewConnectionDeltaCount + - DataNumber: + U32: 0 + - - IANA: ConnectionSumDurationSeconds + - DataNumber: + U64: 59 + - - IANA: ResponderOctets + - DataNumber: + U64: 0 + - - IANA: ResponderPackets + - DataNumber: + U64: 0 + - - IANA: InitiatorOctets + - DataNumber: + U64: 96 + - - IANA: InitiatorPackets + - DataNumber: + U64: 6 + - - - Cisco: CiscoClientIpv4Address + - Ip4Addr: 172.31.254.101 + - - Cisco: CiscoServerIpv4Address + - Ip4Addr: 172.31.254.1 + - - IANA: ProtocolIdentifier + - ProtocolType: Udp + - - IANA: IpDiffServCodePoint + - DataNumber: + U8: 48 + - - IANA: IpTtl + - DataNumber: + U8: 255 + - - Cisco: CiscoServerL4Port + - DataNumber: + U16: 3784 + - - IANA: IngressVrfid + - DataNumber: + U32: 0 + - - IANA: ApplicationId + - ApplicationId: + classification_engine_id: 13 + selector_id: + U24: 1 + - - IANA: VlanId + - DataNumber: + U16: 0 + - - IANA: IngressInterface + - DataNumber: + U32: 0 + - - IANA: BiflowDirection + - DataNumber: + U8: 1 + - - Cisco: CiscoServicesWaasSegment + - DataNumber: + U8: 16 + - - IANA: EgressInterface + - DataNumber: + U32: 1 + - - Cisco: CiscoServicesWaasPassthroughReason + - DataNumber: + U8: 0 + - - IANA: FlowStartSysUpTime + - DataNumber: + U32: 4019387628 + - - IANA: FlowEndSysUpTime + - DataNumber: + U32: 4019445566 + - - IANA: NewConnectionDeltaCount + - DataNumber: + U32: 0 + - - IANA: ConnectionSumDurationSeconds + - DataNumber: + U64: 60 + - - IANA: ResponderOctets + - DataNumber: + U64: 0 + - - IANA: ResponderPackets + - DataNumber: + U64: 0 + - - IANA: InitiatorOctets + - DataNumber: + U64: 552 + - - IANA: InitiatorPackets + - DataNumber: + U64: 23 + - - - Cisco: CiscoClientIpv4Address + - Ip4Addr: 10.1.22.47 + - - Cisco: CiscoServerIpv4Address + - Ip4Addr: 10.101.22.251 + - - IANA: ProtocolIdentifier + - ProtocolType: Udp + - - IANA: IpDiffServCodePoint + - DataNumber: + U8: 8 + - - IANA: IpTtl + - DataNumber: + U8: 61 + - - Cisco: CiscoServerL4Port + - DataNumber: + U16: 17654 + - - IANA: IngressVrfid + - DataNumber: + U32: 0 + - - IANA: ApplicationId + - ApplicationId: + classification_engine_id: 13 + selector_id: + U24: 1 + - - IANA: VlanId + - DataNumber: + U16: 0 + - - IANA: IngressInterface + - DataNumber: + U32: 1 + - - IANA: BiflowDirection + - DataNumber: + U8: 1 + - - Cisco: CiscoServicesWaasSegment + - DataNumber: + U8: 16 + - - IANA: EgressInterface + - DataNumber: + U32: 4 + - - Cisco: CiscoServicesWaasPassthroughReason + - DataNumber: + U8: 0 + - - IANA: FlowStartSysUpTime + - DataNumber: + U32: 4019387640 + - - IANA: FlowEndSysUpTime + - DataNumber: + U32: 4019437582 + - - IANA: NewConnectionDeltaCount + - DataNumber: + U32: 0 + - - IANA: ConnectionSumDurationSeconds + - DataNumber: + U64: 50 + - - IANA: ResponderOctets + - DataNumber: + U64: 0 + - - IANA: ResponderPackets + - DataNumber: + U64: 0 + - - IANA: InitiatorOctets + - DataNumber: + U64: 772 + - - IANA: InitiatorPackets + - DataNumber: + U64: 67 + - - - Cisco: CiscoClientIpv4Address + - Ip4Addr: 10.101.10.12 + - - Cisco: CiscoServerIpv4Address + - Ip4Addr: 10.0.151.179 + - - IANA: ProtocolIdentifier + - ProtocolType: Icmp + - - IANA: IpDiffServCodePoint + - DataNumber: + U8: 0 + - - IANA: IpTtl + - DataNumber: + U8: 60 + - - Cisco: CiscoServerL4Port + - DataNumber: + U16: 0 + - - IANA: IngressVrfid + - DataNumber: + U32: 0 + - - IANA: ApplicationId + - ApplicationId: + classification_engine_id: 13 + selector_id: + U24: 479 + - - IANA: VlanId + - DataNumber: + U16: 0 + - - IANA: IngressInterface + - DataNumber: + U32: 1 + - - IANA: BiflowDirection + - DataNumber: + U8: 2 + - - Cisco: CiscoServicesWaasSegment + - DataNumber: + U8: 16 + - - IANA: EgressInterface + - DataNumber: + U32: 4 + - - Cisco: CiscoServicesWaasPassthroughReason + - DataNumber: + U8: 0 + - - IANA: FlowStartSysUpTime + - DataNumber: + U32: 4019387662 + - - IANA: FlowEndSysUpTime + - DataNumber: + U32: 4019446322 + - - IANA: NewConnectionDeltaCount + - DataNumber: + U32: 0 + - - IANA: ConnectionSumDurationSeconds + - DataNumber: + U64: 0 + - - IANA: ResponderOctets + - DataNumber: + U64: 0 + - - IANA: ResponderPackets + - DataNumber: + U64: 19 + - - IANA: InitiatorOctets + - DataNumber: + U64: 0 + - - IANA: InitiatorPackets + - DataNumber: + U64: 0 + - - - Cisco: CiscoClientIpv4Address + - Ip4Addr: 172.31.255.1 + - - Cisco: CiscoServerIpv4Address + - Ip4Addr: 172.31.254.101 + - - IANA: ProtocolIdentifier + - ProtocolType: Udp + - - IANA: IpDiffServCodePoint + - DataNumber: + U8: 0 + - - IANA: IpTtl + - DataNumber: + U8: 255 + - - Cisco: CiscoServerL4Port + - DataNumber: + U16: 3784 + - - IANA: IngressVrfid + - DataNumber: + U32: 0 + - - IANA: ApplicationId + - ApplicationId: + classification_engine_id: 13 + selector_id: + U24: 1 + - - IANA: VlanId + - DataNumber: + U16: 0 + - - IANA: IngressInterface + - DataNumber: + U32: 1 + - - IANA: BiflowDirection + - DataNumber: + U8: 1 + - - Cisco: CiscoServicesWaasSegment + - DataNumber: + U8: 16 + - - IANA: EgressInterface + - DataNumber: + U32: 0 + - - Cisco: CiscoServicesWaasPassthroughReason + - DataNumber: + U8: 0 + - - IANA: FlowStartSysUpTime + - DataNumber: + U32: 4019387700 + - - IANA: FlowEndSysUpTime + - DataNumber: + U32: 4019446700 + - - IANA: NewConnectionDeltaCount + - DataNumber: + U32: 0 + - - IANA: ConnectionSumDurationSeconds + - DataNumber: + U64: 59 + - - IANA: ResponderOctets + - DataNumber: + U64: 0 + - - IANA: ResponderPackets + - DataNumber: + U64: 0 + - - IANA: InitiatorOctets + - DataNumber: + U64: 1632 + - - IANA: InitiatorPackets + - DataNumber: + U64: 68 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_multiple_flow_records.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_multiple_flow_records.snap new file mode 100644 index 00000000..b94fca67 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_multiple_flow_records.snap @@ -0,0 +1,739 @@ +--- +source: src/tests.rs +expression: "parser.parse_bytes(&hex::decode(hex2).unwrap()).packets" +--- +- IPFix: + header: + version: 10 + length: 1217 + export_time: 1412166683 + sequence_number: 127681 + observation_domain_id: 0 + flowsets: + - header: + header_id: 277 + length: 29 + body: + Data: + fields: + - - - IANA: ObservationPointId + - DataNumber: + U32: 8731347 + - - IANA: ExportingProcessId + - DataNumber: + U32: 0 + - - Netscaler: NetscalerLicenseType + - DataNumber: + U8: 1 + - - Netscaler: NetscalerMaxLicenseCount + - DataNumber: + U64: 5 + - - Netscaler: NetscalerCurrentLicenseConsumed + - DataNumber: + U64: 0 + - header: + header_id: 258 + length: 433 + body: + Data: + fields: + - - - IANA: ObservationPointId + - DataNumber: + U32: 8731347 + - - IANA: ExportingProcessId + - DataNumber: + U32: 0 + - - IANA: FlowId + - DataNumber: + U64: 2040953 + - - Netscaler: NetscalerTransactionId + - DataNumber: + U32: 94120 + - - Netscaler: NetscalerConnectionId + - DataNumber: + U32: 2040953 + - - IANA: IpVersion + - DataNumber: + U8: 4 + - - IANA: ProtocolIdentifier + - ProtocolType: Tcp + - - IANA: PaddingOctets + - Vec: + - 0 + - 0 + - - IANA: SourceIpv4address + - Ip4Addr: 172.18.129.61 + - - IANA: DestinationIpv4address + - Ip4Addr: 172.18.159.99 + - - IANA: SourceTransportPort + - DataNumber: + U16: 51612 + - - IANA: DestinationTransportPort + - DataNumber: + U16: 443 + - - IANA: PacketDeltaCount + - DataNumber: + U64: 3 + - - IANA: OctetDeltaCount + - DataNumber: + U64: 817 + - - IANA: TcpControlBits + - TcpControlBits: + fin: false + syn: false + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Netscaler: NetscalerFlowFlags + - DataNumber: + U64: 84025344 + - - IANA: FlowStartMicroseconds + - Duration: + secs: 3621155483 + nanos: 175000 + - - IANA: FlowEndMicroseconds + - Duration: + secs: 3621155483 + nanos: 178000 + - - IANA: IngressInterface + - DataNumber: + U32: 1 + - - IANA: EgressInterface + - DataNumber: + U32: 2147483651 + - - Netscaler: NetscalerAppNameAppId + - DataNumber: + U32: 9510 + - - Netscaler: NetscalerAppUnitNameAppId + - DataNumber: + U32: 0 + - - Netscaler: NetscalerHttpResForwFB + - DataNumber: + U64: 0 + - - Netscaler: NetscalerHttpResForwLB + - DataNumber: + U64: 0 + - - Netscaler: NetscalerConnectionChainID + - Vec: + - 0 + - 80 + - 86 + - 0 + - 215 + - 43 + - 33 + - 84 + - 27 + - 244 + - 43 + - 84 + - 247 + - 173 + - 11 + - 0 + - - Netscaler: NetscalerConnectionChainHopCount + - DataNumber: + U8: 1 + - - Netscaler: NetscalerHttpReqUrl + - String: /vpn/index.html + - - Netscaler: NetscalerHttpReqCookie + - String: "" + - - Netscaler: NetscalerHttpReqReferer + - String: "" + - - Netscaler: NetscalerHttpReqMethod + - String: GET + - - Netscaler: NetscalerHttpReqHost + - String: int-app-netscaler-10-1-ext.lab2.net + - - Netscaler: NetscalerHttpReqUserAgent + - String: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0" + - - Netscaler: NetscalerHttpContentType + - String: "" + - - Netscaler: NetscalerHttpReqAuthorization + - String: "" + - - Netscaler: NetscalerHttpReqVia + - String: "" + - - Netscaler: NetscalerHttpReqXForwardedFor + - String: "" + - - Netscaler: NetscalerAaaUsername + - String: "" + - - - IANA: ObservationPointId + - DataNumber: + U32: 8731347 + - - IANA: ExportingProcessId + - DataNumber: + U32: 0 + - - IANA: FlowId + - DataNumber: + U64: 2040953 + - - Netscaler: NetscalerTransactionId + - DataNumber: + U32: 94120 + - - Netscaler: NetscalerConnectionId + - DataNumber: + U32: 2040953 + - - IANA: IpVersion + - DataNumber: + U8: 4 + - - IANA: ProtocolIdentifier + - ProtocolType: Tcp + - - IANA: PaddingOctets + - Vec: + - 0 + - 0 + - - IANA: SourceIpv4address + - Ip4Addr: 172.18.129.61 + - - IANA: DestinationIpv4address + - Ip4Addr: 172.18.159.99 + - - IANA: SourceTransportPort + - DataNumber: + U16: 51612 + - - IANA: DestinationTransportPort + - DataNumber: + U16: 443 + - - IANA: PacketDeltaCount + - DataNumber: + U64: 1 + - - IANA: OctetDeltaCount + - DataNumber: + U64: 40 + - - IANA: TcpControlBits + - TcpControlBits: + fin: false + syn: false + rst: false + psh: false + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Netscaler: NetscalerFlowFlags + - DataNumber: + U64: 84025344 + - - IANA: FlowStartMicroseconds + - Duration: + secs: 3621155483 + nanos: 179000 + - - IANA: FlowEndMicroseconds + - Duration: + secs: 3621155483 + nanos: 179000 + - - IANA: IngressInterface + - DataNumber: + U32: 1 + - - IANA: EgressInterface + - DataNumber: + U32: 2147483651 + - - Netscaler: NetscalerAppNameAppId + - DataNumber: + U32: 9510 + - - Netscaler: NetscalerAppUnitNameAppId + - DataNumber: + U32: 0 + - - Netscaler: NetscalerHttpResForwFB + - DataNumber: + U64: 0 + - - Netscaler: NetscalerHttpResForwLB + - DataNumber: + U64: 0 + - - Netscaler: NetscalerConnectionChainID + - Vec: + - 0 + - 80 + - 86 + - 0 + - 215 + - 43 + - 33 + - 84 + - 27 + - 244 + - 43 + - 84 + - 247 + - 173 + - 11 + - 0 + - - Netscaler: NetscalerConnectionChainHopCount + - DataNumber: + U8: 1 + - - Netscaler: NetscalerHttpReqUrl + - String: "" + - - Netscaler: NetscalerHttpReqCookie + - String: "" + - - Netscaler: NetscalerHttpReqReferer + - String: "" + - - Netscaler: NetscalerHttpReqMethod + - String: "" + - - Netscaler: NetscalerHttpReqHost + - String: "" + - - Netscaler: NetscalerHttpReqUserAgent + - String: "" + - - Netscaler: NetscalerHttpContentType + - String: "" + - - Netscaler: NetscalerHttpReqAuthorization + - String: "" + - - Netscaler: NetscalerHttpReqVia + - String: "" + - - Netscaler: NetscalerHttpReqXForwardedFor + - String: "" + - - Netscaler: NetscalerAaaUsername + - String: "" + - header: + header_id: 257 + length: 118 + body: + Data: + fields: + - - - IANA: ObservationPointId + - DataNumber: + U32: 8731347 + - - IANA: ExportingProcessId + - DataNumber: + U32: 0 + - - IANA: FlowId + - DataNumber: + U64: 2040954 + - - Netscaler: NetscalerTransactionId + - DataNumber: + U32: 94120 + - - Netscaler: NetscalerConnectionId + - DataNumber: + U32: 2040953 + - - IANA: IpVersion + - DataNumber: + U8: 4 + - - IANA: ProtocolIdentifier + - ProtocolType: Tcp + - - IANA: PaddingOctets + - Vec: + - 0 + - 0 + - - IANA: SourceIpv4address + - Ip4Addr: 172.18.159.99 + - - IANA: DestinationIpv4address + - Ip4Addr: 172.18.129.61 + - - IANA: SourceTransportPort + - DataNumber: + U16: 443 + - - IANA: DestinationTransportPort + - DataNumber: + U16: 51612 + - - IANA: PacketDeltaCount + - DataNumber: + U64: 7 + - - IANA: OctetDeltaCount + - DataNumber: + U64: 6917 + - - IANA: TcpControlBits + - TcpControlBits: + fin: false + syn: false + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Netscaler: NetscalerFlowFlags + - DataNumber: + U64: 1090527232 + - - IANA: FlowStartMicroseconds + - Duration: + secs: 3621155483 + nanos: 175000 + - - IANA: FlowEndMicroseconds + - Duration: + secs: 3621155483 + nanos: 178000 + - - Netscaler: NetscalerRoundTripTime + - DataNumber: + U32: 3 + - - IANA: EgressInterface + - DataNumber: + U32: 1 + - - IANA: IngressInterface + - DataNumber: + U32: 2147483651 + - - Netscaler: NetscalerAppNameAppId + - DataNumber: + U32: 9510 + - - Netscaler: NetscalerConnectionChainID + - Vec: + - 0 + - 80 + - 86 + - 0 + - 215 + - 43 + - 33 + - 84 + - 27 + - 244 + - 43 + - 84 + - 247 + - 173 + - 11 + - 0 + - - Netscaler: NetscalerConnectionChainHopCount + - DataNumber: + U8: 1 + - header: + header_id: 258 + length: 503 + body: + Data: + fields: + - - - IANA: ObservationPointId + - DataNumber: + U32: 8731347 + - - IANA: ExportingProcessId + - DataNumber: + U32: 0 + - - IANA: FlowId + - DataNumber: + U64: 2040953 + - - Netscaler: NetscalerTransactionId + - DataNumber: + U32: 94121 + - - Netscaler: NetscalerConnectionId + - DataNumber: + U32: 2040953 + - - IANA: IpVersion + - DataNumber: + U8: 4 + - - IANA: ProtocolIdentifier + - ProtocolType: Tcp + - - IANA: PaddingOctets + - Vec: + - 0 + - 0 + - - IANA: SourceIpv4address + - Ip4Addr: 172.18.129.61 + - - IANA: DestinationIpv4address + - Ip4Addr: 172.18.159.99 + - - IANA: SourceTransportPort + - DataNumber: + U16: 51612 + - - IANA: DestinationTransportPort + - DataNumber: + U16: 443 + - - IANA: PacketDeltaCount + - DataNumber: + U64: 1 + - - IANA: OctetDeltaCount + - DataNumber: + U64: 482 + - - IANA: TcpControlBits + - TcpControlBits: + fin: false + syn: false + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Netscaler: NetscalerFlowFlags + - DataNumber: + U64: 84025344 + - - IANA: FlowStartMicroseconds + - Duration: + secs: 3621155483 + nanos: 186000 + - - IANA: FlowEndMicroseconds + - Duration: + secs: 3621155483 + nanos: 186000 + - - IANA: IngressInterface + - DataNumber: + U32: 1 + - - IANA: EgressInterface + - DataNumber: + U32: 2147483651 + - - Netscaler: NetscalerAppNameAppId + - DataNumber: + U32: 9510 + - - Netscaler: NetscalerAppUnitNameAppId + - DataNumber: + U32: 0 + - - Netscaler: NetscalerHttpResForwFB + - DataNumber: + U64: 0 + - - Netscaler: NetscalerHttpResForwLB + - DataNumber: + U64: 0 + - - Netscaler: NetscalerConnectionChainID + - Vec: + - 0 + - 80 + - 86 + - 0 + - 215 + - 43 + - 33 + - 84 + - 27 + - 244 + - 43 + - 84 + - 157 + - 54 + - 12 + - 0 + - - Netscaler: NetscalerConnectionChainHopCount + - DataNumber: + U8: 1 + - - Netscaler: NetscalerHttpReqUrl + - String: /vpn/images/caxtonstyle.css + - - Netscaler: NetscalerHttpReqCookie + - String: "" + - - Netscaler: NetscalerHttpReqReferer + - String: "https://int-app-netscaler-10-1-ext.lab2.net/vpn/index.html" + - - Netscaler: NetscalerHttpReqMethod + - String: GET + - - Netscaler: NetscalerHttpReqHost + - String: int-app-netscaler-10-1-ext.lab2.net + - - Netscaler: NetscalerHttpReqUserAgent + - String: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0" + - - Netscaler: NetscalerHttpContentType + - String: "" + - - Netscaler: NetscalerHttpReqAuthorization + - String: "" + - - Netscaler: NetscalerHttpReqVia + - String: "" + - - Netscaler: NetscalerHttpReqXForwardedFor + - String: "" + - - Netscaler: NetscalerAaaUsername + - String: "" + - - - IANA: ObservationPointId + - DataNumber: + U32: 8731347 + - - IANA: ExportingProcessId + - DataNumber: + U32: 0 + - - IANA: FlowId + - DataNumber: + U64: 2040953 + - - Netscaler: NetscalerTransactionId + - DataNumber: + U32: 94121 + - - Netscaler: NetscalerConnectionId + - DataNumber: + U32: 2040953 + - - IANA: IpVersion + - DataNumber: + U8: 4 + - - IANA: ProtocolIdentifier + - ProtocolType: Tcp + - - IANA: PaddingOctets + - Vec: + - 0 + - 0 + - - IANA: SourceIpv4address + - Ip4Addr: 172.18.129.61 + - - IANA: DestinationIpv4address + - Ip4Addr: 172.18.159.99 + - - IANA: SourceTransportPort + - DataNumber: + U16: 51612 + - - IANA: DestinationTransportPort + - DataNumber: + U16: 443 + - - IANA: PacketDeltaCount + - DataNumber: + U64: 3 + - - IANA: OctetDeltaCount + - DataNumber: + U64: 120 + - - IANA: TcpControlBits + - TcpControlBits: + fin: false + syn: false + rst: false + psh: false + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Netscaler: NetscalerFlowFlags + - DataNumber: + U64: 84025344 + - - IANA: FlowStartMicroseconds + - Duration: + secs: 3621155483 + nanos: 186000 + - - IANA: FlowEndMicroseconds + - Duration: + secs: 3621155483 + nanos: 187000 + - - IANA: IngressInterface + - DataNumber: + U32: 1 + - - IANA: EgressInterface + - DataNumber: + U32: 2147483651 + - - Netscaler: NetscalerAppNameAppId + - DataNumber: + U32: 9510 + - - Netscaler: NetscalerAppUnitNameAppId + - DataNumber: + U32: 0 + - - Netscaler: NetscalerHttpResForwFB + - DataNumber: + U64: 0 + - - Netscaler: NetscalerHttpResForwLB + - DataNumber: + U64: 0 + - - Netscaler: NetscalerConnectionChainID + - Vec: + - 0 + - 80 + - 86 + - 0 + - 215 + - 43 + - 33 + - 84 + - 27 + - 244 + - 43 + - 84 + - 157 + - 54 + - 12 + - 0 + - - Netscaler: NetscalerConnectionChainHopCount + - DataNumber: + U8: 1 + - - Netscaler: NetscalerHttpReqUrl + - String: "" + - - Netscaler: NetscalerHttpReqCookie + - String: "" + - - Netscaler: NetscalerHttpReqReferer + - String: "" + - - Netscaler: NetscalerHttpReqMethod + - String: "" + - - Netscaler: NetscalerHttpReqHost + - String: "" + - - Netscaler: NetscalerHttpReqUserAgent + - String: "" + - - Netscaler: NetscalerHttpContentType + - String: "" + - - Netscaler: NetscalerHttpReqAuthorization + - String: "" + - - Netscaler: NetscalerHttpReqVia + - String: "" + - - Netscaler: NetscalerHttpReqXForwardedFor + - String: "" + - - Netscaler: NetscalerAaaUsername + - String: "" + - header: + header_id: 257 + length: 118 + body: + Data: + fields: + - - - IANA: ObservationPointId + - DataNumber: + U32: 8731347 + - - IANA: ExportingProcessId + - DataNumber: + U32: 0 + - - IANA: FlowId + - DataNumber: + U64: 2040954 + - - Netscaler: NetscalerTransactionId + - DataNumber: + U32: 94121 + - - Netscaler: NetscalerConnectionId + - DataNumber: + U32: 2040953 + - - IANA: IpVersion + - DataNumber: + U8: 4 + - - IANA: ProtocolIdentifier + - ProtocolType: Tcp + - - IANA: PaddingOctets + - Vec: + - 0 + - 0 + - - IANA: SourceIpv4address + - Ip4Addr: 172.18.159.99 + - - IANA: DestinationIpv4address + - Ip4Addr: 172.18.129.61 + - - IANA: SourceTransportPort + - DataNumber: + U16: 443 + - - IANA: DestinationTransportPort + - DataNumber: + U16: 51612 + - - IANA: PacketDeltaCount + - DataNumber: + U64: 15 + - - IANA: OctetDeltaCount + - DataNumber: + U64: 21968 + - - IANA: TcpControlBits + - TcpControlBits: + fin: false + syn: false + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Netscaler: NetscalerFlowFlags + - DataNumber: + U64: 1093672960 + - - IANA: FlowStartMicroseconds + - Duration: + secs: 3621155483 + nanos: 186000 + - - IANA: FlowEndMicroseconds + - Duration: + secs: 3621155483 + nanos: 186000 + - - Netscaler: NetscalerRoundTripTime + - DataNumber: + U32: 2 + - - IANA: EgressInterface + - DataNumber: + U32: 1 + - - IANA: IngressInterface + - DataNumber: + U32: 2147483651 + - - Netscaler: NetscalerAppNameAppId + - DataNumber: + U32: 9510 + - - Netscaler: NetscalerConnectionChainID + - Vec: + - 0 + - 80 + - 86 + - 0 + - 215 + - 43 + - 33 + - 84 + - 27 + - 244 + - 43 + - 84 + - 157 + - 54 + - 12 + - 0 + - - Netscaler: NetscalerConnectionChainHopCount + - DataNumber: + U8: 1 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_multiple_templates.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_multiple_templates.snap new file mode 100644 index 00000000..3716e9ca --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_multiple_templates.snap @@ -0,0 +1,1125 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&packet).packets" +--- +- IPFix: + header: + version: 10 + length: 1460 + export_time: 1412166671 + sequence_number: 127681 + observation_domain_id: 0 + flowsets: + - header: + header_id: 2 + length: 1444 + body: + Templates: + - template_id: 256 + field_count: 23 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 8 + field_length: 4 + field_type: + IANA: SourceIpv4address + - field_type_number: 12 + field_length: 4 + field_type: + IANA: DestinationIpv4address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 192 + field_length: 16 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainID + - field_type_number: 193 + field_length: 1 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainHopCount + - template_id: 257 + field_count: 24 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 8 + field_length: 4 + field_type: + IANA: SourceIpv4address + - field_type_number: 12 + field_length: 4 + field_type: + IANA: DestinationIpv4address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 128 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerRoundTripTime + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 192 + field_length: 16 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainID + - field_type_number: 193 + field_length: 1 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainHopCount + - template_id: 258 + field_count: 37 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 8 + field_length: 4 + field_type: + IANA: SourceIpv4address + - field_type_number: 12 + field_length: 4 + field_type: + IANA: DestinationIpv4address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 171 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppUnitNameAppId + - field_type_number: 158 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResForwFB + - field_type_number: 170 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResForwLB + - field_type_number: 192 + field_length: 16 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainID + - field_type_number: 193 + field_length: 1 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainHopCount + - field_type_number: 130 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqUrl + - field_type_number: 131 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqCookie + - field_type_number: 140 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqReferer + - field_type_number: 141 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqMethod + - field_type_number: 142 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqHost + - field_type_number: 143 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqUserAgent + - field_type_number: 183 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpContentType + - field_type_number: 185 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqAuthorization + - field_type_number: 186 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqVia + - field_type_number: 190 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqXForwardedFor + - field_type_number: 205 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAaaUsername + - template_id: 259 + field_count: 23 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 27 + field_length: 16 + field_type: + IANA: SourceIpv6address + - field_type_number: 28 + field_length: 16 + field_type: + IANA: DestinationIpv6address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 192 + field_length: 16 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainID + - field_type_number: 193 + field_length: 1 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainHopCount + - template_id: 260 + field_count: 24 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 27 + field_length: 16 + field_type: + IANA: SourceIpv6address + - field_type_number: 28 + field_length: 16 + field_type: + IANA: DestinationIpv6address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 128 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerRoundTripTime + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 192 + field_length: 16 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainID + - field_type_number: 193 + field_length: 1 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainHopCount + - template_id: 261 + field_count: 37 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 27 + field_length: 16 + field_type: + IANA: SourceIpv6address + - field_type_number: 28 + field_length: 16 + field_type: + IANA: DestinationIpv6address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 171 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppUnitNameAppId + - field_type_number: 158 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResForwFB + - field_type_number: 170 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResForwLB + - field_type_number: 192 + field_length: 16 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainID + - field_type_number: 193 + field_length: 1 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionChainHopCount + - field_type_number: 130 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqUrl + - field_type_number: 131 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqCookie + - field_type_number: 140 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqReferer + - field_type_number: 141 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqMethod + - field_type_number: 142 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqHost + - field_type_number: 143 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqUserAgent + - field_type_number: 183 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpContentType + - field_type_number: 185 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqAuthorization + - field_type_number: 186 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqVia + - field_type_number: 190 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqXForwardedFor + - field_type_number: 205 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAaaUsername + - template_id: 262 + field_count: 38 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 8 + field_length: 4 + field_type: + IANA: SourceIpv4address + - field_type_number: 12 + field_length: 4 + field_type: + IANA: DestinationIpv4address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 144 + field_length: 2 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpRspStatus + - field_type_number: 145 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpRspLen + - field_type_number: 146 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerServerTTFB + - field_type_number: 147 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerServerTTLB + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 161 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerMainPageId + - field_type_number: 162 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerMainPageCoreId + - field_type_number: 153 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqRcvFB + - field_type_number: 156 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqForwFB + - field_type_number: 157 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResRcvFB + - field_type_number: 159 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqRcvLB + - field_type_number: 160 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqForwLB + - field_type_number: 169 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResRcvLB + - field_type_number: 182 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerClientRTT + - field_type_number: 183 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpContentType + - field_type_number: 187 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResLocation + - field_type_number: 188 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResSetCookie + - field_type_number: 189 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResSetCookie2 + - template_id: 263 + field_count: 38 + fields: + - field_type_number: 138 + field_length: 4 + field_type: + IANA: ObservationPointId + - field_type_number: 144 + field_length: 4 + field_type: + IANA: ExportingProcessId + - field_type_number: 148 + field_length: 8 + field_type: + IANA: FlowId + - field_type_number: 129 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerTransactionId + - field_type_number: 133 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerConnectionId + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 210 + field_length: 2 + field_type: + IANA: PaddingOctets + - field_type_number: 27 + field_length: 16 + field_type: + IANA: SourceIpv6address + - field_type_number: 28 + field_length: 16 + field_type: + IANA: DestinationIpv6address + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 2 + field_length: 8 + field_type: + IANA: PacketDeltaCount + - field_type_number: 1 + field_length: 8 + field_type: + IANA: OctetDeltaCount + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 132 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerFlowFlags + - field_type_number: 154 + field_length: 8 + field_type: + IANA: FlowStartMicroseconds + - field_type_number: 155 + field_length: 8 + field_type: + IANA: FlowEndMicroseconds + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 144 + field_length: 2 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpRspStatus + - field_type_number: 145 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpRspLen + - field_type_number: 146 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerServerTTFB + - field_type_number: 147 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerServerTTLB + - field_type_number: 151 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerAppNameAppId + - field_type_number: 161 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerMainPageId + - field_type_number: 162 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerMainPageCoreId + - field_type_number: 153 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqRcvFB + - field_type_number: 156 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqForwFB + - field_type_number: 157 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResRcvFB + - field_type_number: 159 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqRcvLB + - field_type_number: 160 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpReqForwLB + - field_type_number: 169 + field_length: 8 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResRcvLB + - field_type_number: 182 + field_length: 4 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerClientRTT + - field_type_number: 183 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpContentType + - field_type_number: 187 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResLocation + - field_type_number: 188 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResSetCookie + - field_type_number: 189 + field_length: 65535 + enterprise_number: 5951 + field_type: + Netscaler: NetscalerHttpResSetCookie2 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_options_template.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_options_template.snap new file mode 100644 index 00000000..1b21c159 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_options_template.snap @@ -0,0 +1,36 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&packet).packets" +--- +- IPFix: + header: + version: 10 + length: 44 + export_time: 0 + sequence_number: 1 + observation_domain_id: 2 + flowsets: + - header: + header_id: 3 + length: 28 + body: + OptionsTemplate: + template_id: 260 + field_count: 3 + scope_field_count: 1 + fields: + - field_type_number: 123 + field_length: 4 + enterprise_number: 2 + field_type: + Enterprise: + enterprise_number: 2 + field_number: 123 + - field_type_number: 41 + field_length: 2 + field_type: + IANA: ExportedMessageTotalCount + - field_type_number: 42 + field_length: 2 + field_type: + IANA: ExportedFlowRecordTotalCount diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_options_template_with_data.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_options_template_with_data.snap new file mode 100644 index 00000000..b1c4c058 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_options_template_with_data.snap @@ -0,0 +1,70 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&packet).packets" +--- +- IPFix: + header: + version: 10 + length: 64 + export_time: 0 + sequence_number: 1 + observation_domain_id: 2 + flowsets: + - header: + header_id: 3 + length: 28 + body: + OptionsTemplate: + template_id: 260 + field_count: 3 + scope_field_count: 1 + fields: + - field_type_number: 123 + field_length: 4 + enterprise_number: 2 + field_type: + Enterprise: + enterprise_number: 2 + field_number: 123 + - field_type_number: 41 + field_length: 2 + field_type: + IANA: ExportedMessageTotalCount + - field_type_number: 42 + field_length: 2 + field_type: + IANA: ExportedFlowRecordTotalCount + - header: + header_id: 260 + length: 20 + body: + OptionsData: + fields: + - - - Enterprise: + enterprise_number: 2 + field_number: 123 + - Vec: + - 0 + - 0 + - 0 + - 1 + - - IANA: ExportedMessageTotalCount + - DataNumber: + U16: 276 + - - IANA: ExportedFlowRecordTotalCount + - DataNumber: + U16: 5140 + - - - Enterprise: + enterprise_number: 2 + field_number: 123 + - Vec: + - 0 + - 0 + - 0 + - 2 + - - IANA: ExportedMessageTotalCount + - DataNumber: + U16: 5140 + - - IANA: ExportedFlowRecordTotalCount + - DataNumber: + U16: 7710 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_scappy_example.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_scappy_example.snap new file mode 100644 index 00000000..2c2e54b3 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_scappy_example.snap @@ -0,0 +1,200 @@ +--- +source: src/tests.rs +expression: result +--- +- IPFix: + header: + version: 10 + length: 116 + export_time: 1480450135 + sequence_number: 3791 + observation_domain_id: 0 + flowsets: + - header: + header_id: 2 + length: 100 + body: + Template: + template_id: 307 + field_count: 23 + fields: + - field_type_number: 8 + field_length: 4 + field_type: + IANA: SourceIpv4address + - field_type_number: 12 + field_length: 4 + field_type: + IANA: DestinationIpv4address + - field_type_number: 5 + field_length: 1 + field_type: + IANA: IpClassOfService + - field_type_number: 4 + field_length: 1 + field_type: + IANA: ProtocolIdentifier + - field_type_number: 7 + field_length: 2 + field_type: + IANA: SourceTransportPort + - field_type_number: 11 + field_length: 2 + field_type: + IANA: DestinationTransportPort + - field_type_number: 32 + field_length: 2 + field_type: + IANA: IcmpTypeCodeIpv4 + - field_type_number: 10 + field_length: 4 + field_type: + IANA: IngressInterface + - field_type_number: 16 + field_length: 4 + field_type: + IANA: BgpSourceAsNumber + - field_type_number: 17 + field_length: 4 + field_type: + IANA: BgpDestinationAsNumber + - field_type_number: 18 + field_length: 4 + field_type: + IANA: BgpNextHopIpv4address + - field_type_number: 14 + field_length: 4 + field_type: + IANA: EgressInterface + - field_type_number: 1 + field_length: 4 + field_type: + IANA: OctetDeltaCount + - field_type_number: 2 + field_length: 4 + field_type: + IANA: PacketDeltaCount + - field_type_number: 22 + field_length: 4 + field_type: + IANA: FlowStartSysUpTime + - field_type_number: 21 + field_length: 4 + field_type: + IANA: FlowEndSysUpTime + - field_type_number: 15 + field_length: 4 + field_type: + IANA: IpNextHopIpv4address + - field_type_number: 9 + field_length: 1 + field_type: + IANA: SourceIpv4prefixLength + - field_type_number: 13 + field_length: 1 + field_type: + IANA: DestinationIpv4prefixLength + - field_type_number: 6 + field_length: 1 + field_type: + IANA: TcpControlBits + - field_type_number: 60 + field_length: 1 + field_type: + IANA: IpVersion + - field_type_number: 152 + field_length: 8 + field_type: + IANA: FlowStartMilliseconds + - field_type_number: 153 + field_length: 8 + field_type: + IANA: FlowEndMilliseconds +- IPFix: + header: + version: 10 + length: 96 + export_time: 1480450137 + sequence_number: 3812 + observation_domain_id: 0 + flowsets: + - header: + header_id: 307 + length: 80 + body: + Data: + fields: + - - - IANA: SourceIpv4address + - Ip4Addr: 70.1.115.1 + - - IANA: DestinationIpv4address + - Ip4Addr: 50.0.71.1 + - - IANA: IpClassOfService + - DataNumber: + U8: 0 + - - IANA: ProtocolIdentifier + - ProtocolType: Anydistributedprotocol + - - IANA: SourceTransportPort + - DataNumber: + U16: 0 + - - IANA: DestinationTransportPort + - DataNumber: + U16: 0 + - - IANA: IcmpTypeCodeIpv4 + - DataNumber: + U16: 0 + - - IANA: IngressInterface + - DataNumber: + U32: 827 + - - IANA: BgpSourceAsNumber + - DataNumber: + U32: 2 + - - IANA: BgpDestinationAsNumber + - DataNumber: + U32: 3 + - - IANA: BgpNextHopIpv4address + - Ip4Addr: 204.42.110.101 + - - IANA: EgressInterface + - DataNumber: + U32: 854 + - - IANA: OctetDeltaCount + - DataNumber: + U32: 1312 + - - IANA: PacketDeltaCount + - DataNumber: + U32: 9 + - - IANA: FlowStartSysUpTime + - DataNumber: + U32: 3019441902 + - - IANA: FlowEndSysUpTime + - DataNumber: + U32: 3019616060 + - - IANA: IpNextHopIpv4address + - Ip4Addr: 204.42.110.189 + - - IANA: SourceIpv4prefixLength + - DataNumber: + U8: 24 + - - IANA: DestinationIpv4prefixLength + - DataNumber: + U8: 24 + - - IANA: TcpControlBits + - TcpControlBits: + fin: false + syn: false + rst: false + psh: false + ack: false + urg: false + ece: false + cwr: false + ns: false + - - IANA: IpVersion + - DataNumber: + U8: 4 + - - IANA: FlowStartMilliseconds + - Duration: + secs: 1480449931 + nanos: 519000000 + - - IANA: FlowEndMilliseconds + - Duration: + secs: 1480450105 + nanos: 677000000 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_scappy_example_options_template.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_scappy_example_options_template.snap new file mode 100644 index 00000000..c48f0868 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_scappy_example_options_template.snap @@ -0,0 +1,33 @@ +--- +source: src/tests.rs +expression: result +--- +- IPFix: + header: + version: 10 + length: 40 + export_time: 1480450135 + sequence_number: 3791 + observation_domain_id: 0 + flowsets: + - header: + header_id: 3 + length: 24 + body: + OptionsTemplate: + template_id: 308 + field_count: 3 + scope_field_count: 1 + fields: + - field_type_number: 5 + field_length: 2 + field_type: + IANA: IpClassOfService + - field_type_number: 36 + field_length: 2 + field_type: + IANA: FlowActiveTimeout + - field_type_number: 37 + field_length: 2 + field_type: + IANA: FlowIdleTimeout diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_with_no_template_fields.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_with_no_template_fields.snap new file mode 100644 index 00000000..dd4b739b --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_with_no_template_fields.snap @@ -0,0 +1,16 @@ +--- +source: src/tests.rs +expression: parser.parse_bytes(&packet).packets +--- +- IPFix: + header: + version: 10 + length: 26 + export_time: 1 + sequence_number: 1 + observation_domain_id: 0 + flowsets: + - header: + header_id: 258 + length: 10 + body: Empty diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_with_v9_options_template_packet.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_with_v9_options_template_packet.snap new file mode 100644 index 00000000..5bf7391d --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_ipfix_with_v9_options_template_packet.snap @@ -0,0 +1,12 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&packet).packets" +--- +- IPFix: + header: + version: 10 + length: 115 + export_time: 1744871721 + sequence_number: 100000 + observation_domain_id: 0 + flowsets: [] diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_multiple_packets.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_multiple_packets.snap new file mode 100644 index 00000000..3d913aa0 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_multiple_packets.snap @@ -0,0 +1,220 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&all).packets" +--- +- V9: + header: + version: 9 + count: 2 + sys_up_time: 2313 + unix_secs: 66051 + sequence_number: 1 + source_id: 1 + flowsets: + - header: + flowset_id: 0 + length: 16 + body: + Template: + templates: + - template_id: 258 + field_count: 2 + fields: + - field_type_number: 1 + field_type: InBytes + field_length: 4 + - field_type_number: 8 + field_type: Ipv4SrcAddr + field_length: 4 + - header: + flowset_id: 258 + length: 12 + body: + Data: + fields: + - - - InBytes + - DataNumber: + U32: 151126788 + - - Ipv4SrcAddr + - Ip4Addr: 9.9.9.8 +- V5: + header: + version: 5 + count: 1 + sys_up_time: 50332672 + unix_secs: 83887623 + unix_nsecs: 134807553 + flow_sequence: 33752069 + engine_type: 6 + engine_id: 7 + sampling_interval: 2057 + flowsets: + - src_addr: 0.1.2.3 + dst_addr: 4.5.6.7 + next_hop: 8.9.0.1 + input: 515 + output: 1029 + d_pkts: 101124105 + d_octets: 66051 + first: 67438087 + last: 134807553 + src_port: 515 + dst_port: 1029 + pad1: 6 + tcp_flags: 7 + protocol_number: 8 + protocol_type: Egp + tos: 9 + src_as: 1 + dst_as: 515 + src_mask: 4 + dst_mask: 5 + pad2: 1543 +- V7: + header: + version: 7 + count: 1 + sys_up_time: 50332672 + unix_secs: 83887623 + unix_nsecs: 134807553 + flow_sequence: 33752069 + reserved: 101124105 + flowsets: + - src_addr: 0.1.2.3 + dst_addr: 4.5.6.7 + next_hop: 8.9.0.1 + input: 515 + output: 1029 + d_pkts: 101124105 + d_octets: 66051 + first: 67438087 + last: 134807553 + src_port: 515 + dst_port: 1029 + flags_fields_valid: 6 + tcp_flags: 7 + protocol_number: 8 + protocol_type: Egp + tos: 9 + src_as: 1 + dst_as: 515 + src_mask: 4 + dst_mask: 5 + flags_fields_invalid: 1543 + router_src: 8.9.0.1 +- V9: + header: + version: 9 + count: 2 + sys_up_time: 2313 + unix_secs: 66051 + sequence_number: 1 + source_id: 1 + flowsets: + - header: + flowset_id: 0 + length: 16 + body: + Template: + templates: + - template_id: 258 + field_count: 2 + fields: + - field_type_number: 1 + field_type: InBytes + field_length: 4 + - field_type_number: 8 + field_type: Ipv4SrcAddr + field_length: 4 + - header: + flowset_id: 258 + length: 12 + body: + Data: + fields: + - - - InBytes + - DataNumber: + U32: 151126788 + - - Ipv4SrcAddr + - Ip4Addr: 9.9.9.8 +- IPFix: + header: + version: 10 + length: 64 + export_time: 16909060 + sequence_number: 0 + observation_domain_id: 16909060 + flowsets: + - header: + header_id: 2 + length: 20 + body: + Template: + template_id: 256 + field_count: 3 + fields: + - field_type_number: 8 + field_length: 4 + field_type: + IANA: SourceIpv4address + - field_type_number: 12 + field_length: 4 + field_type: + IANA: DestinationIpv4address + - field_type_number: 2 + field_length: 4 + field_type: + IANA: PacketDeltaCount + - header: + header_id: 256 + length: 28 + body: + Data: + fields: + - - - IANA: SourceIpv4address + - Ip4Addr: 1.2.3.4 + - - IANA: DestinationIpv4address + - Ip4Addr: 1.2.3.3 + - - IANA: PacketDeltaCount + - DataNumber: + U32: 16909058 + - - - IANA: SourceIpv4address + - Ip4Addr: 0.2.0.2 + - - IANA: DestinationIpv4address + - Ip4Addr: 0.1.2.3 + - - IANA: PacketDeltaCount + - DataNumber: + U32: 67438087 +- V5: + header: + version: 5 + count: 1 + sys_up_time: 50332672 + unix_secs: 83887623 + unix_nsecs: 134807553 + flow_sequence: 33752069 + engine_type: 6 + engine_id: 7 + sampling_interval: 2057 + flowsets: + - src_addr: 0.1.2.3 + dst_addr: 4.5.6.7 + next_hop: 8.9.0.1 + input: 515 + output: 1029 + d_pkts: 101124105 + d_octets: 66051 + first: 67438087 + last: 134807553 + src_port: 515 + dst_port: 1029 + pad1: 6 + tcp_flags: 7 + protocol_number: 8 + protocol_type: Egp + tos: 9 + src_as: 1 + dst_as: 515 + src_mask: 4 + dst_mask: 5 + pad2: 1543 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v5_and_re_exports.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v5_and_re_exports.snap new file mode 100644 index 00000000..9cb15ea6 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v5_and_re_exports.snap @@ -0,0 +1,76 @@ +--- +source: src/tests.rs +expression: v5.to_be_bytes() +--- +- 0 +- 5 +- 0 +- 1 +- 3 +- 0 +- 4 +- 0 +- 5 +- 0 +- 6 +- 7 +- 8 +- 9 +- 0 +- 1 +- 2 +- 3 +- 4 +- 5 +- 6 +- 7 +- 8 +- 9 +- 0 +- 1 +- 2 +- 3 +- 4 +- 5 +- 6 +- 7 +- 8 +- 9 +- 0 +- 1 +- 2 +- 3 +- 4 +- 5 +- 6 +- 7 +- 8 +- 9 +- 0 +- 1 +- 2 +- 3 +- 4 +- 5 +- 6 +- 7 +- 8 +- 9 +- 0 +- 1 +- 2 +- 3 +- 4 +- 5 +- 6 +- 7 +- 8 +- 9 +- 0 +- 1 +- 2 +- 3 +- 4 +- 5 +- 6 +- 7 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v5_incomplete.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v5_incomplete.snap new file mode 100644 index 00000000..fdf4f924 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v5_incomplete.snap @@ -0,0 +1,8 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&packet)" +--- +packets: [] +error: + Partial: + message: "V5 parse error: Parsing Error: Error { input: [0, 0, 1, 1, 1, 1], code: Eof }" diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v7_and_re_exports.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v7_and_re_exports.snap new file mode 100644 index 00000000..e9a70fcb --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v7_and_re_exports.snap @@ -0,0 +1,80 @@ +--- +source: src/tests.rs +expression: v7.to_be_bytes() +--- +- 0 +- 7 +- 0 +- 1 +- 3 +- 0 +- 4 +- 0 +- 5 +- 0 +- 6 +- 7 +- 8 +- 9 +- 0 +- 1 +- 2 +- 3 +- 4 +- 5 +- 6 +- 7 +- 8 +- 9 +- 0 +- 1 +- 2 +- 3 +- 4 +- 5 +- 6 +- 7 +- 8 +- 9 +- 0 +- 1 +- 2 +- 3 +- 4 +- 5 +- 6 +- 7 +- 8 +- 9 +- 0 +- 1 +- 2 +- 3 +- 4 +- 5 +- 6 +- 7 +- 8 +- 9 +- 0 +- 1 +- 2 +- 3 +- 4 +- 5 +- 6 +- 7 +- 8 +- 9 +- 0 +- 1 +- 2 +- 3 +- 4 +- 5 +- 6 +- 7 +- 8 +- 9 +- 0 +- 1 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9.snap new file mode 100644 index 00000000..c517dc0b --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9.snap @@ -0,0 +1,39 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&packet).packets" +--- +- V9: + header: + version: 9 + count: 2 + sys_up_time: 2313 + unix_secs: 66051 + sequence_number: 1 + source_id: 1 + flowsets: + - header: + flowset_id: 0 + length: 16 + body: + Template: + templates: + - template_id: 258 + field_count: 2 + fields: + - field_type_number: 1 + field_type: InBytes + field_length: 4 + - field_type_number: 8 + field_type: Ipv4SrcAddr + field_length: 4 + - header: + flowset_id: 258 + length: 12 + body: + Data: + fields: + - - - InBytes + - DataNumber: + U32: 151126788 + - - Ipv4SrcAddr + - Ip4Addr: 9.9.9.8 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_and_re_exports.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_and_re_exports.snap new file mode 100644 index 00000000..595370af --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_and_re_exports.snap @@ -0,0 +1,52 @@ +--- +source: src/tests.rs +expression: v9.to_be_bytes().unwrap() +--- +- 0 +- 9 +- 0 +- 2 +- 0 +- 0 +- 9 +- 9 +- 0 +- 1 +- 2 +- 3 +- 0 +- 0 +- 0 +- 1 +- 0 +- 0 +- 0 +- 1 +- 0 +- 0 +- 0 +- 16 +- 1 +- 2 +- 0 +- 2 +- 0 +- 1 +- 0 +- 4 +- 0 +- 8 +- 0 +- 4 +- 1 +- 2 +- 0 +- 12 +- 9 +- 2 +- 3 +- 4 +- 9 +- 9 +- 9 +- 8 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_data_cached_template.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_data_cached_template.snap new file mode 100644 index 00000000..036b2d10 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_data_cached_template.snap @@ -0,0 +1,24 @@ +--- +source: src/tests.rs +expression: parser.parse_bytes(&packet).packets +--- +- V9: + header: + version: 9 + count: 1 + sys_up_time: 2313 + unix_secs: 66051 + sequence_number: 1 + source_id: 1 + flowsets: + - header: + flowset_id: 258 + length: 12 + body: + Data: + fields: + - - - InBytes + - DataNumber: + U32: 151126788 + - - Ipv4SrcAddr + - Ip4Addr: 9.9.9.8 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_ipv6flowlabel.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_ipv6flowlabel.snap new file mode 100644 index 00000000..6ecf2fb2 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_ipv6flowlabel.snap @@ -0,0 +1,492 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&packets).packets" +--- +- V9: + header: + version: 9 + count: 4 + sys_up_time: 10624535 + unix_secs: 1717095238 + sequence_number: 341 + source_id: 8 + flowsets: + - header: + flowset_id: 0 + length: 76 + body: + Template: + templates: + - template_id: 258 + field_count: 17 + fields: + - field_type_number: 8 + field_type: Ipv4SrcAddr + field_length: 4 + - field_type_number: 12 + field_type: Ipv4DstAddr + field_length: 4 + - field_type_number: 15 + field_type: Ipv4NextHop + field_length: 4 + - field_type_number: 7 + field_type: L4SrcPort + field_length: 2 + - field_type_number: 11 + field_type: L4DstPort + field_length: 2 + - field_type_number: 10 + field_type: InputSnmp + field_length: 2 + - field_type_number: 14 + field_type: OutputSnmp + field_length: 2 + - field_type_number: 252 + field_type: + IanaAssigned: 252 + field_length: 4 + - field_type_number: 253 + field_type: + IanaAssigned: 253 + field_length: 4 + - field_type_number: 2 + field_type: InPkts + field_length: 4 + - field_type_number: 1 + field_type: InBytes + field_length: 4 + - field_type_number: 22 + field_type: FirstSwitched + field_length: 4 + - field_type_number: 21 + field_type: LastSwitched + field_length: 4 + - field_type_number: 4 + field_type: Protocol + field_length: 1 + - field_type_number: 5 + field_type: SrcTos + field_length: 1 + - field_type_number: 256 + field_type: + IanaAssigned: 256 + field_length: 2 + - field_type_number: 61 + field_type: Direction + field_length: 1 + - header: + flowset_id: 0 + length: 84 + body: + Template: + templates: + - template_id: 259 + field_count: 19 + fields: + - field_type_number: 8 + field_type: Ipv4SrcAddr + field_length: 4 + - field_type_number: 12 + field_type: Ipv4DstAddr + field_length: 4 + - field_type_number: 15 + field_type: Ipv4NextHop + field_length: 4 + - field_type_number: 7 + field_type: L4SrcPort + field_length: 2 + - field_type_number: 11 + field_type: L4DstPort + field_length: 2 + - field_type_number: 6 + field_type: TcpFlags + field_length: 1 + - field_type_number: 10 + field_type: InputSnmp + field_length: 2 + - field_type_number: 14 + field_type: OutputSnmp + field_length: 2 + - field_type_number: 252 + field_type: + IanaAssigned: 252 + field_length: 4 + - field_type_number: 253 + field_type: + IanaAssigned: 253 + field_length: 4 + - field_type_number: 2 + field_type: InPkts + field_length: 4 + - field_type_number: 1 + field_type: InBytes + field_length: 4 + - field_type_number: 22 + field_type: FirstSwitched + field_length: 4 + - field_type_number: 21 + field_type: LastSwitched + field_length: 4 + - field_type_number: 4 + field_type: Protocol + field_length: 1 + - field_type_number: 5 + field_type: SrcTos + field_length: 1 + - field_type_number: 209 + field_type: + IanaAssigned: 209 + field_length: 8 + - field_type_number: 256 + field_type: + IanaAssigned: 256 + field_length: 2 + - field_type_number: 61 + field_type: Direction + field_length: 1 + - header: + flowset_id: 0 + length: 84 + body: + Template: + templates: + - template_id: 261 + field_count: 19 + fields: + - field_type_number: 27 + field_type: Ipv6SrcAddr + field_length: 16 + - field_type_number: 28 + field_type: Ipv6DstAddr + field_length: 16 + - field_type_number: 62 + field_type: Ipv6NextHop + field_length: 16 + - field_type_number: 7 + field_type: L4SrcPort + field_length: 2 + - field_type_number: 11 + field_type: L4DstPort + field_length: 2 + - field_type_number: 6 + field_type: TcpFlags + field_length: 1 + - field_type_number: 10 + field_type: InputSnmp + field_length: 2 + - field_type_number: 14 + field_type: OutputSnmp + field_length: 2 + - field_type_number: 252 + field_type: + IanaAssigned: 252 + field_length: 4 + - field_type_number: 253 + field_type: + IanaAssigned: 253 + field_length: 4 + - field_type_number: 2 + field_type: InPkts + field_length: 4 + - field_type_number: 1 + field_type: InBytes + field_length: 4 + - field_type_number: 22 + field_type: FirstSwitched + field_length: 4 + - field_type_number: 21 + field_type: LastSwitched + field_length: 4 + - field_type_number: 4 + field_type: Protocol + field_length: 1 + - field_type_number: 5 + field_type: SrcTos + field_length: 1 + - field_type_number: 80 + field_type: InDstMac + field_length: 6 + - field_type_number: 256 + field_type: + IanaAssigned: 256 + field_length: 2 + - field_type_number: 61 + field_type: Direction + field_length: 1 + - header: + flowset_id: 0 + length: 88 + body: + Template: + templates: + - template_id: 262 + field_count: 20 + fields: + - field_type_number: 27 + field_type: Ipv6SrcAddr + field_length: 16 + - field_type_number: 28 + field_type: Ipv6DstAddr + field_length: 16 + - field_type_number: 62 + field_type: Ipv6NextHop + field_length: 16 + - field_type_number: 31 + field_type: Ipv6FlowLabel + field_length: 3 + - field_type_number: 7 + field_type: L4SrcPort + field_length: 2 + - field_type_number: 11 + field_type: L4DstPort + field_length: 2 + - field_type_number: 6 + field_type: TcpFlags + field_length: 1 + - field_type_number: 10 + field_type: InputSnmp + field_length: 2 + - field_type_number: 14 + field_type: OutputSnmp + field_length: 2 + - field_type_number: 252 + field_type: + IanaAssigned: 252 + field_length: 4 + - field_type_number: 253 + field_type: + IanaAssigned: 253 + field_length: 4 + - field_type_number: 2 + field_type: InPkts + field_length: 4 + - field_type_number: 1 + field_type: InBytes + field_length: 4 + - field_type_number: 22 + field_type: FirstSwitched + field_length: 4 + - field_type_number: 21 + field_type: LastSwitched + field_length: 4 + - field_type_number: 4 + field_type: Protocol + field_length: 1 + - field_type_number: 5 + field_type: SrcTos + field_length: 1 + - field_type_number: 80 + field_type: InDstMac + field_length: 6 + - field_type_number: 256 + field_type: + IanaAssigned: 256 + field_length: 2 + - field_type_number: 61 + field_type: Direction + field_length: 1 +- V9: + header: + version: 9 + count: 2 + sys_up_time: 10724622 + unix_secs: 1717095339 + sequence_number: 356 + source_id: 8 + flowsets: + - header: + flowset_id: 258 + length: 102 + body: + Data: + fields: + - - - Ipv4SrcAddr + - Ip4Addr: 192.168.18.10 + - - Ipv4DstAddr + - Ip4Addr: 141.24.12.2 + - - Ipv4NextHop + - Ip4Addr: 0.0.0.0 + - - L4SrcPort + - DataNumber: + U16: 49856 + - - L4DstPort + - DataNumber: + U16: 53 + - - InputSnmp + - DataNumber: + U16: 2 + - - OutputSnmp + - DataNumber: + U16: 0 + - - IanaAssigned: 252 + - Vec: + - 0 + - 0 + - 0 + - 0 + - - IanaAssigned: 253 + - Vec: + - 0 + - 0 + - 0 + - 0 + - - InPkts + - DataNumber: + U32: 1 + - - InBytes + - DataNumber: + U32: 82 + - - FirstSwitched + - Duration: + secs: 10690 + nanos: 167000000 + - - LastSwitched + - Duration: + secs: 10690 + nanos: 167000000 + - - Protocol + - ProtocolType: Udp + - - SrcTos + - DataNumber: + U8: 0 + - - IanaAssigned: 256 + - Vec: + - 8 + - 0 + - - Direction + - DataNumber: + U8: 1 + - - - Ipv4SrcAddr + - Ip4Addr: 192.168.18.10 + - - Ipv4DstAddr + - Ip4Addr: 141.24.12.2 + - - Ipv4NextHop + - Ip4Addr: 0.0.0.0 + - - L4SrcPort + - DataNumber: + U16: 40483 + - - L4DstPort + - DataNumber: + U16: 53 + - - InputSnmp + - DataNumber: + U16: 2 + - - OutputSnmp + - DataNumber: + U16: 0 + - - IanaAssigned: 252 + - Vec: + - 0 + - 0 + - 0 + - 0 + - - IanaAssigned: 253 + - Vec: + - 0 + - 0 + - 0 + - 0 + - - InPkts + - DataNumber: + U32: 1 + - - InBytes + - DataNumber: + U32: 82 + - - FirstSwitched + - Duration: + secs: 10688 + nanos: 891000000 + - - LastSwitched + - Duration: + secs: 10688 + nanos: 891000000 + - - Protocol + - ProtocolType: Udp + - - SrcTos + - DataNumber: + U8: 0 + - - IanaAssigned: 256 + - Vec: + - 8 + - 0 + - - Direction + - DataNumber: + U8: 1 + - header: + flowset_id: 262 + length: 99 + body: + Data: + fields: + - - - Ipv6SrcAddr + - Ip6Addr: "fd01:8::2a20:235f:1f7b:9379" + - - Ipv6DstAddr + - Ip6Addr: "fd00::b2f2:8ff:fe20:1180" + - - Ipv6NextHop + - Ip6Addr: "::" + - - Ipv6FlowLabel + - DataNumber: + U24: 128630 + - - L4SrcPort + - DataNumber: + U16: 58037 + - - L4DstPort + - DataNumber: + U16: 53 + - - TcpFlags + - TcpControlBits: + fin: false + syn: false + rst: false + psh: false + ack: false + urg: false + ece: false + cwr: false + ns: false + - - InputSnmp + - DataNumber: + U16: 2 + - - OutputSnmp + - DataNumber: + U16: 0 + - - IanaAssigned: 252 + - Vec: + - 0 + - 0 + - 0 + - 0 + - - IanaAssigned: 253 + - Vec: + - 0 + - 0 + - 0 + - 0 + - - InPkts + - DataNumber: + U32: 1 + - - InBytes + - DataNumber: + U32: 102 + - - FirstSwitched + - Duration: + secs: 10688 + nanos: 891000000 + - - LastSwitched + - Duration: + secs: 10688 + nanos: 891000000 + - - Protocol + - ProtocolType: Udp + - - SrcTos + - DataNumber: + U8: 0 + - - InDstMac + - MacAddr: "10:90:27:e0:43:6d" + - - IanaAssigned: 256 + - Vec: + - 134 + - 221 + - - Direction + - DataNumber: + U8: 1 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_many_flows.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_many_flows.snap new file mode 100644 index 00000000..5dc74ce5 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_many_flows.snap @@ -0,0 +1,44 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&packet).packets" +--- +- V9: + header: + version: 9 + count: 3 + sys_up_time: 2313 + unix_secs: 66051 + sequence_number: 1 + source_id: 1 + flowsets: + - header: + flowset_id: 0 + length: 16 + body: + Template: + templates: + - template_id: 258 + field_count: 2 + fields: + - field_type_number: 1 + field_type: InBytes + field_length: 4 + - field_type_number: 8 + field_type: Ipv4SrcAddr + field_length: 4 + - header: + flowset_id: 258 + length: 20 + body: + Data: + fields: + - - - InBytes + - DataNumber: + U32: 151126788 + - - Ipv4SrcAddr + - Ip4Addr: 9.9.9.8 + - - - InBytes + - DataNumber: + U32: 151126788 + - - Ipv4SrcAddr + - Ip4Addr: 9.9.9.8 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_no_data.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_no_data.snap new file mode 100644 index 00000000..dc1f98b0 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_no_data.snap @@ -0,0 +1,34 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&packet).packets" +--- +- V9: + header: + version: 9 + count: 2 + sys_up_time: 2313 + unix_secs: 66051 + sequence_number: 1 + source_id: 1 + flowsets: + - header: + flowset_id: 0 + length: 16 + body: + Template: + templates: + - template_id: 258 + field_count: 2 + fields: + - field_type_number: 1 + field_type: InBytes + field_length: 4 + - field_type_number: 8 + field_type: Ipv4SrcAddr + field_length: 4 + - header: + flowset_id: 258 + length: 4 + body: + Data: + fields: [] diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_options_template.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_options_template.snap new file mode 100644 index 00000000..5e8a7e25 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_options_template.snap @@ -0,0 +1,50 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&packet).packets" +--- +- V9: + header: + version: 9 + count: 2 + sys_up_time: 2313 + unix_secs: 66051 + sequence_number: 1 + source_id: 1 + flowsets: + - header: + flowset_id: 1 + length: 22 + body: + OptionsTemplate: + templates: + - template_id: 275 + options_scope_length: 4 + options_length: 8 + scope_fields: + - field_type_number: 2 + field_type: Interface + field_length: 2 + option_fields: + - field_type_number: 34 + field_type: SamplingInterval + field_length: 2 + - field_type_number: 36 + field_type: FlowActiveTimeout + field_length: 1 + - header: + flowset_id: 275 + length: 9 + body: + OptionsData: + fields: + - scope_fields: + - Interface: + - 0 + - 2 + options_fields: + - - SamplingInterval + - DataNumber: + U16: 100 + - - FlowActiveTimeout + - DataNumber: + U8: 1 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_template_and_data_packet.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_template_and_data_packet.snap new file mode 100644 index 00000000..94bf78df --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_template_and_data_packet.snap @@ -0,0 +1,771 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&packet).packets" +--- +- V9: + header: + version: 9 + count: 9 + sys_up_time: 52377 + unix_secs: 1715939544 + sequence_number: 1 + source_id: 0 + flowsets: + - header: + flowset_id: 0 + length: 72 + body: + Template: + templates: + - template_id: 1024 + field_count: 16 + fields: + - field_type_number: 8 + field_type: Ipv4SrcAddr + field_length: 4 + - field_type_number: 12 + field_type: Ipv4DstAddr + field_length: 4 + - field_type_number: 22 + field_type: FirstSwitched + field_length: 4 + - field_type_number: 21 + field_type: LastSwitched + field_length: 4 + - field_type_number: 1 + field_type: InBytes + field_length: 4 + - field_type_number: 2 + field_type: InPkts + field_length: 4 + - field_type_number: 10 + field_type: InputSnmp + field_length: 4 + - field_type_number: 14 + field_type: OutputSnmp + field_length: 4 + - field_type_number: 61 + field_type: Direction + field_length: 1 + - field_type_number: 136 + field_type: FlowEndReason + field_length: 1 + - field_type_number: 7 + field_type: L4SrcPort + field_length: 2 + - field_type_number: 11 + field_type: L4DstPort + field_length: 2 + - field_type_number: 4 + field_type: Protocol + field_length: 1 + - field_type_number: 6 + field_type: TcpFlags + field_length: 1 + - field_type_number: 60 + field_type: IpProtocolVersion + field_length: 1 + - field_type_number: 5 + field_type: SrcTos + field_length: 1 + - header: + flowset_id: 0 + length: 64 + body: + Template: + templates: + - template_id: 1025 + field_count: 14 + fields: + - field_type_number: 8 + field_type: Ipv4SrcAddr + field_length: 4 + - field_type_number: 12 + field_type: Ipv4DstAddr + field_length: 4 + - field_type_number: 22 + field_type: FirstSwitched + field_length: 4 + - field_type_number: 21 + field_type: LastSwitched + field_length: 4 + - field_type_number: 1 + field_type: InBytes + field_length: 4 + - field_type_number: 2 + field_type: InPkts + field_length: 4 + - field_type_number: 10 + field_type: InputSnmp + field_length: 4 + - field_type_number: 14 + field_type: OutputSnmp + field_length: 4 + - field_type_number: 61 + field_type: Direction + field_length: 1 + - field_type_number: 136 + field_type: FlowEndReason + field_length: 1 + - field_type_number: 32 + field_type: IcmpType + field_length: 2 + - field_type_number: 4 + field_type: Protocol + field_length: 1 + - field_type_number: 60 + field_type: IpProtocolVersion + field_length: 1 + - field_type_number: 5 + field_type: SrcTos + field_length: 1 + - header: + flowset_id: 0 + length: 72 + body: + Template: + templates: + - template_id: 2048 + field_count: 16 + fields: + - field_type_number: 27 + field_type: Ipv6SrcAddr + field_length: 16 + - field_type_number: 28 + field_type: Ipv6DstAddr + field_length: 16 + - field_type_number: 22 + field_type: FirstSwitched + field_length: 4 + - field_type_number: 21 + field_type: LastSwitched + field_length: 4 + - field_type_number: 1 + field_type: InBytes + field_length: 4 + - field_type_number: 2 + field_type: InPkts + field_length: 4 + - field_type_number: 10 + field_type: InputSnmp + field_length: 4 + - field_type_number: 14 + field_type: OutputSnmp + field_length: 4 + - field_type_number: 61 + field_type: Direction + field_length: 1 + - field_type_number: 136 + field_type: FlowEndReason + field_length: 1 + - field_type_number: 7 + field_type: L4SrcPort + field_length: 2 + - field_type_number: 11 + field_type: L4DstPort + field_length: 2 + - field_type_number: 4 + field_type: Protocol + field_length: 1 + - field_type_number: 6 + field_type: TcpFlags + field_length: 1 + - field_type_number: 60 + field_type: IpProtocolVersion + field_length: 1 + - field_type_number: 5 + field_type: SrcTos + field_length: 1 + - header: + flowset_id: 0 + length: 64 + body: + Template: + templates: + - template_id: 2049 + field_count: 14 + fields: + - field_type_number: 27 + field_type: Ipv6SrcAddr + field_length: 16 + - field_type_number: 28 + field_type: Ipv6DstAddr + field_length: 16 + - field_type_number: 22 + field_type: FirstSwitched + field_length: 4 + - field_type_number: 21 + field_type: LastSwitched + field_length: 4 + - field_type_number: 1 + field_type: InBytes + field_length: 4 + - field_type_number: 2 + field_type: InPkts + field_length: 4 + - field_type_number: 10 + field_type: InputSnmp + field_length: 4 + - field_type_number: 14 + field_type: OutputSnmp + field_length: 4 + - field_type_number: 61 + field_type: Direction + field_length: 1 + - field_type_number: 136 + field_type: FlowEndReason + field_length: 1 + - field_type_number: 139 + field_type: IcmpTypeCodeIpv6 + field_length: 2 + - field_type_number: 4 + field_type: Protocol + field_length: 1 + - field_type_number: 60 + field_type: IpProtocolVersion + field_length: 1 + - field_type_number: 5 + field_type: SrcTos + field_length: 1 + - header: + flowset_id: 1 + length: 26 + body: + OptionsTemplate: + templates: + - template_id: 256 + options_scope_length: 4 + options_length: 12 + scope_fields: + - field_type_number: 2 + field_type: Interface + field_length: 4 + option_fields: + - field_type_number: 34 + field_type: SamplingInterval + field_length: 4 + - field_type_number: 35 + field_type: SamplingAlgorithm + field_length: 1 + - field_type_number: 82 + field_type: IfName + field_length: 16 + - header: + flowset_id: 256 + length: 29 + body: + OptionsData: + fields: + - scope_fields: + - Interface: + - 0 + - 0 + - 0 + - 0 + options_fields: + - - SamplingInterval + - DataNumber: + U32: 1 + - - SamplingAlgorithm + - DataNumber: + U8: 1 + - - IfName + - String: any + - header: + flowset_id: 2048 + length: 205 + body: + Data: + fields: + - - - Ipv6SrcAddr + - Ip6Addr: "2003:d1:ef3b:2200:fe34:97ff:feb7:686e" + - - Ipv6DstAddr + - Ip6Addr: "2606:4700:3032::6815:5338" + - - FirstSwitched + - Duration: + secs: 5 + nanos: 637000000 + - - LastSwitched + - Duration: + secs: 42 + nanos: 8000000 + - - InBytes + - DataNumber: + U32: 1215 + - - InPkts + - DataNumber: + U32: 9 + - - InputSnmp + - DataNumber: + U32: 0 + - - OutputSnmp + - DataNumber: + U32: 0 + - - Direction + - DataNumber: + U8: 0 + - - FlowEndReason + - FlowEndReason: EndOfFlow + - - L4SrcPort + - DataNumber: + U16: 58068 + - - L4DstPort + - DataNumber: + U16: 443 + - - Protocol + - ProtocolType: Tcp + - - TcpFlags + - TcpControlBits: + fin: true + syn: false + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - IpProtocolVersion + - DataNumber: + U8: 6 + - - SrcTos + - DataNumber: + U8: 0 + - - - Ipv6SrcAddr + - Ip6Addr: "2606:4700:3032::6815:5338" + - - Ipv6DstAddr + - Ip6Addr: "2003:d1:ef3b:2200:fe34:97ff:feb7:686e" + - - FirstSwitched + - Duration: + secs: 5 + nanos: 637000000 + - - LastSwitched + - Duration: + secs: 42 + nanos: 8000000 + - - InBytes + - DataNumber: + U32: 180 + - - InPkts + - DataNumber: + U32: 3 + - - InputSnmp + - DataNumber: + U32: 0 + - - OutputSnmp + - DataNumber: + U32: 0 + - - Direction + - DataNumber: + U8: 1 + - - FlowEndReason + - FlowEndReason: EndOfFlow + - - L4SrcPort + - DataNumber: + U16: 443 + - - L4DstPort + - DataNumber: + U16: 58068 + - - Protocol + - ProtocolType: Tcp + - - TcpFlags + - TcpControlBits: + fin: false + syn: false + rst: true + psh: false + ack: false + urg: false + ece: false + cwr: false + ns: false + - - IpProtocolVersion + - DataNumber: + U8: 6 + - - SrcTos + - DataNumber: + U8: 0 + - - - Ipv6SrcAddr + - Ip6Addr: "::1" + - - Ipv6DstAddr + - Ip6Addr: "::1" + - - FirstSwitched + - Duration: + secs: 20 + nanos: 268000000 + - - LastSwitched + - Duration: + secs: 20 + nanos: 268000000 + - - InBytes + - DataNumber: + U32: 60 + - - InPkts + - DataNumber: + U32: 1 + - - InputSnmp + - DataNumber: + U32: 0 + - - OutputSnmp + - DataNumber: + U32: 0 + - - Direction + - DataNumber: + U8: 0 + - - FlowEndReason + - FlowEndReason: EndOfFlow + - - L4SrcPort + - DataNumber: + U16: 8081 + - - L4DstPort + - DataNumber: + U16: 43754 + - - Protocol + - ProtocolType: Tcp + - - TcpFlags + - TcpControlBits: + fin: false + syn: false + rst: true + psh: false + ack: true + urg: false + ece: false + cwr: false + ns: false + - - IpProtocolVersion + - DataNumber: + U8: 6 + - - SrcTos + - DataNumber: + U8: 0 + - header: + flowset_id: 1024 + length: 256 + body: + Data: + fields: + - - - Ipv4SrcAddr + - Ip4Addr: 157.240.251.61 + - - Ipv4DstAddr + - Ip4Addr: 192.168.1.215 + - - FirstSwitched + - Duration: + secs: 25 + nanos: 352000000 + - - LastSwitched + - Duration: + secs: 30 + nanos: 421000000 + - - InBytes + - DataNumber: + U32: 2930 + - - InPkts + - DataNumber: + U32: 24 + - - InputSnmp + - DataNumber: + U32: 0 + - - OutputSnmp + - DataNumber: + U32: 0 + - - Direction + - DataNumber: + U8: 0 + - - FlowEndReason + - FlowEndReason: EndOfFlow + - - L4SrcPort + - DataNumber: + U16: 5222 + - - L4DstPort + - DataNumber: + U16: 44112 + - - Protocol + - ProtocolType: Tcp + - - TcpFlags + - TcpControlBits: + fin: false + syn: true + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - IpProtocolVersion + - DataNumber: + U8: 4 + - - SrcTos + - DataNumber: + U8: 0 + - - - Ipv4SrcAddr + - Ip4Addr: 192.168.1.215 + - - Ipv4DstAddr + - Ip4Addr: 157.240.251.61 + - - FirstSwitched + - Duration: + secs: 25 + nanos: 352000000 + - - LastSwitched + - Duration: + secs: 30 + nanos: 421000000 + - - InBytes + - DataNumber: + U32: 3639 + - - InPkts + - DataNumber: + U32: 33 + - - InputSnmp + - DataNumber: + U32: 0 + - - OutputSnmp + - DataNumber: + U32: 0 + - - Direction + - DataNumber: + U8: 1 + - - FlowEndReason + - FlowEndReason: EndOfFlow + - - L4SrcPort + - DataNumber: + U16: 44112 + - - L4DstPort + - DataNumber: + U16: 5222 + - - Protocol + - ProtocolType: Tcp + - - TcpFlags + - TcpControlBits: + fin: false + syn: true + rst: true + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - IpProtocolVersion + - DataNumber: + U8: 4 + - - SrcTos + - DataNumber: + U8: 0 + - - - Ipv4SrcAddr + - Ip4Addr: 93.209.14.73 + - - Ipv4DstAddr + - Ip4Addr: 157.240.251.61 + - - FirstSwitched + - Duration: + secs: 25 + nanos: 352000000 + - - LastSwitched + - Duration: + secs: 30 + nanos: 422000000 + - - InBytes + - DataNumber: + U32: 1213 + - - InPkts + - DataNumber: + U32: 11 + - - InputSnmp + - DataNumber: + U32: 0 + - - OutputSnmp + - DataNumber: + U32: 0 + - - Direction + - DataNumber: + U8: 0 + - - FlowEndReason + - FlowEndReason: EndOfFlow + - - L4SrcPort + - DataNumber: + U16: 44112 + - - L4DstPort + - DataNumber: + U16: 5222 + - - Protocol + - ProtocolType: Tcp + - - TcpFlags + - TcpControlBits: + fin: false + syn: true + rst: true + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - IpProtocolVersion + - DataNumber: + U8: 4 + - - SrcTos + - DataNumber: + U8: 0 + - - - Ipv4SrcAddr + - Ip4Addr: 157.240.251.61 + - - Ipv4DstAddr + - Ip4Addr: 93.209.14.73 + - - FirstSwitched + - Duration: + secs: 25 + nanos: 352000000 + - - LastSwitched + - Duration: + secs: 30 + nanos: 422000000 + - - InBytes + - DataNumber: + U32: 1465 + - - InPkts + - DataNumber: + U32: 12 + - - InputSnmp + - DataNumber: + U32: 0 + - - OutputSnmp + - DataNumber: + U32: 0 + - - Direction + - DataNumber: + U8: 1 + - - FlowEndReason + - FlowEndReason: EndOfFlow + - - L4SrcPort + - DataNumber: + U16: 5222 + - - L4DstPort + - DataNumber: + U16: 44112 + - - Protocol + - ProtocolType: Tcp + - - TcpFlags + - TcpControlBits: + fin: false + syn: true + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - IpProtocolVersion + - DataNumber: + U8: 4 + - - SrcTos + - DataNumber: + U8: 0 + - - - Ipv4SrcAddr + - Ip4Addr: 192.168.1.37 + - - Ipv4DstAddr + - Ip4Addr: 198.252.206.25 + - - FirstSwitched + - Duration: + secs: 43 + nanos: 288000000 + - - LastSwitched + - Duration: + secs: 43 + nanos: 469000000 + - - InBytes + - DataNumber: + U32: 635 + - - InPkts + - DataNumber: + U32: 9 + - - InputSnmp + - DataNumber: + U32: 0 + - - OutputSnmp + - DataNumber: + U32: 0 + - - Direction + - DataNumber: + U8: 0 + - - FlowEndReason + - FlowEndReason: EndOfFlow + - - L4SrcPort + - DataNumber: + U16: 41796 + - - L4DstPort + - DataNumber: + U16: 443 + - - Protocol + - ProtocolType: Tcp + - - TcpFlags + - TcpControlBits: + fin: true + syn: false + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - IpProtocolVersion + - DataNumber: + U8: 4 + - - SrcTos + - DataNumber: + U8: 0 + - - - Ipv4SrcAddr + - Ip4Addr: 198.252.206.25 + - - Ipv4DstAddr + - Ip4Addr: 192.168.1.37 + - - FirstSwitched + - Duration: + secs: 43 + nanos: 288000000 + - - LastSwitched + - Duration: + secs: 43 + nanos: 469000000 + - - InBytes + - DataNumber: + U32: 264 + - - InPkts + - DataNumber: + U32: 6 + - - InputSnmp + - DataNumber: + U32: 0 + - - OutputSnmp + - DataNumber: + U32: 0 + - - Direction + - DataNumber: + U8: 1 + - - FlowEndReason + - FlowEndReason: EndOfFlow + - - L4SrcPort + - DataNumber: + U16: 443 + - - L4DstPort + - DataNumber: + U16: 41796 + - - Protocol + - ProtocolType: Tcp + - - TcpFlags + - TcpControlBits: + fin: true + syn: false + rst: true + psh: false + ack: true + urg: false + ece: false + cwr: false + ns: false + - - IpProtocolVersion + - DataNumber: + U8: 4 + - - SrcTos + - DataNumber: + U8: 0 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_with_multiple_options_data.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_with_multiple_options_data.snap new file mode 100644 index 00000000..3a586741 --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_parses_v9_with_multiple_options_data.snap @@ -0,0 +1,2462 @@ +--- +source: src/tests.rs +expression: "NetflowParser::default().parse_bytes(&packet).packets" +--- +- V9: + header: + version: 9 + count: 38 + sys_up_time: 3488214596 + unix_secs: 1263497914 + sequence_number: 21418958 + source_id: 0 + flowsets: + - header: + flowset_id: 0 + length: 92 + body: + Template: + templates: + - template_id: 256 + field_count: 21 + fields: + - field_type_number: 21 + field_type: LastSwitched + field_length: 4 + - field_type_number: 22 + field_type: FirstSwitched + field_length: 4 + - field_type_number: 1 + field_type: InBytes + field_length: 4 + - field_type_number: 2 + field_type: InPkts + field_length: 4 + - field_type_number: 10 + field_type: InputSnmp + field_length: 2 + - field_type_number: 14 + field_type: OutputSnmp + field_length: 2 + - field_type_number: 8 + field_type: Ipv4SrcAddr + field_length: 4 + - field_type_number: 12 + field_type: Ipv4DstAddr + field_length: 4 + - field_type_number: 4 + field_type: Protocol + field_length: 1 + - field_type_number: 5 + field_type: SrcTos + field_length: 1 + - field_type_number: 7 + field_type: L4SrcPort + field_length: 2 + - field_type_number: 11 + field_type: L4DstPort + field_length: 2 + - field_type_number: 48 + field_type: FlowSamplerId + field_length: 1 + - field_type_number: 51 + field_type: + IanaAssigned: 51 + field_length: 1 + - field_type_number: 15 + field_type: Ipv4NextHop + field_length: 4 + - field_type_number: 13 + field_type: DstMask + field_length: 1 + - field_type_number: 9 + field_type: SrcMask + field_length: 1 + - field_type_number: 6 + field_type: TcpFlags + field_length: 1 + - field_type_number: 61 + field_type: Direction + field_length: 1 + - field_type_number: 17 + field_type: DstAs + field_length: 2 + - field_type_number: 16 + field_type: SrcAs + field_length: 2 + - header: + flowset_id: 0 + length: 84 + body: + Template: + templates: + - template_id: 258 + field_count: 19 + fields: + - field_type_number: 21 + field_type: LastSwitched + field_length: 4 + - field_type_number: 22 + field_type: FirstSwitched + field_length: 4 + - field_type_number: 1 + field_type: InBytes + field_length: 4 + - field_type_number: 2 + field_type: InPkts + field_length: 4 + - field_type_number: 10 + field_type: InputSnmp + field_length: 2 + - field_type_number: 14 + field_type: OutputSnmp + field_length: 2 + - field_type_number: 8 + field_type: Ipv4SrcAddr + field_length: 4 + - field_type_number: 12 + field_type: Ipv4DstAddr + field_length: 4 + - field_type_number: 4 + field_type: Protocol + field_length: 1 + - field_type_number: 5 + field_type: SrcTos + field_length: 1 + - field_type_number: 7 + field_type: L4SrcPort + field_length: 2 + - field_type_number: 11 + field_type: L4DstPort + field_length: 2 + - field_type_number: 48 + field_type: FlowSamplerId + field_length: 1 + - field_type_number: 51 + field_type: + IanaAssigned: 51 + field_length: 1 + - field_type_number: 15 + field_type: Ipv4NextHop + field_length: 4 + - field_type_number: 13 + field_type: DstMask + field_length: 1 + - field_type_number: 9 + field_type: SrcMask + field_length: 1 + - field_type_number: 6 + field_type: TcpFlags + field_length: 1 + - field_type_number: 61 + field_type: Direction + field_length: 1 + - header: + flowset_id: 1 + length: 44 + body: + OptionsTemplate: + templates: + - template_id: 257 + options_scope_length: 20 + options_length: 12 + scope_fields: + - field_type_number: 1 + field_type: System + field_length: 4 + - field_type_number: 2 + field_type: Interface + field_length: 4 + - field_type_number: 3 + field_type: LineCard + field_length: 4 + - field_type_number: 4 + field_type: NetflowCache + field_length: 4 + - field_type_number: 5 + field_type: Template + field_length: 4 + option_fields: + - field_type_number: 42 + field_type: TotalFlowsExp + field_length: 4 + - field_type_number: 41 + field_type: TotalPktsExp + field_length: 4 + - field_type_number: 34 + field_type: SamplingInterval + field_length: 4 + - header: + flowset_id: 256 + length: 484 + body: + Data: + fields: + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 22469 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.87 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.103 + - - Protocol + - ProtocolType: Tcp + - - SrcTos + - DataNumber: + U8: 160 + - - L4SrcPort + - DataNumber: + U16: 3768 + - - L4DstPort + - DataNumber: + U16: 4793 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 54 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.36 + - - DstMask + - DataNumber: + U8: 28 + - - SrcMask + - DataNumber: + U8: 5 + - - TcpFlags + - TcpControlBits: + fin: false + syn: true + rst: true + psh: false + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 192 + - - SrcAs + - DataNumber: + U16: 23 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 11511 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.42 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.190 + - - Protocol + - ProtocolType: Udp + - - SrcTos + - DataNumber: + U8: 192 + - - L4SrcPort + - DataNumber: + U16: 52628 + - - L4DstPort + - DataNumber: + U16: 20901 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 242 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.9 + - - DstMask + - DataNumber: + U8: 7 + - - SrcMask + - DataNumber: + U8: 9 + - - TcpFlags + - TcpControlBits: + fin: true + syn: false + rst: false + psh: false + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 94 + - - SrcAs + - DataNumber: + U16: 119 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 50221 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.98 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.10 + - - Protocol + - ProtocolType: Icmp + - - SrcTos + - DataNumber: + U8: 0 + - - L4SrcPort + - DataNumber: + U16: 28924 + - - L4DstPort + - DataNumber: + U16: 37242 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 183 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.85 + - - DstMask + - DataNumber: + U8: 12 + - - SrcMask + - DataNumber: + U8: 22 + - - TcpFlags + - TcpControlBits: + fin: true + syn: false + rst: false + psh: false + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 69 + - - SrcAs + - DataNumber: + U16: 182 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 17000 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.29 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.217 + - - Protocol + - ProtocolType: Tcp + - - SrcTos + - DataNumber: + U8: 16 + - - L4SrcPort + - DataNumber: + U16: 54019 + - - L4DstPort + - DataNumber: + U16: 31892 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 135 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.54 + - - DstMask + - DataNumber: + U8: 18 + - - SrcMask + - DataNumber: + U8: 20 + - - TcpFlags + - TcpControlBits: + fin: false + syn: false + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 3 + - - SrcAs + - DataNumber: + U16: 3 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 3836 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.9 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.62 + - - Protocol + - ProtocolType: Icmp + - - SrcTos + - DataNumber: + U8: 160 + - - L4SrcPort + - DataNumber: + U16: 24247 + - - L4DstPort + - DataNumber: + U16: 57095 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 35 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.40 + - - DstMask + - DataNumber: + U8: 21 + - - SrcMask + - DataNumber: + U8: 29 + - - TcpFlags + - TcpControlBits: + fin: false + syn: false + rst: true + psh: false + ack: false + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 46 + - - SrcAs + - DataNumber: + U16: 62 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 62314 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.46 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.149 + - - Protocol + - ProtocolType: Udp + - - SrcTos + - DataNumber: + U8: 160 + - - L4SrcPort + - DataNumber: + U16: 17989 + - - L4DstPort + - DataNumber: + U16: 51448 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 95 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.89 + - - DstMask + - DataNumber: + U8: 4 + - - SrcMask + - DataNumber: + U8: 12 + - - TcpFlags + - TcpControlBits: + fin: true + syn: true + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 193 + - - SrcAs + - DataNumber: + U16: 20 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 14336 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.45 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.145 + - - Protocol + - ProtocolType: Udp + - - SrcTos + - DataNumber: + U8: 160 + - - L4SrcPort + - DataNumber: + U16: 31952 + - - L4DstPort + - DataNumber: + U16: 34224 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 139 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.62 + - - DstMask + - DataNumber: + U8: 19 + - - SrcMask + - DataNumber: + U8: 28 + - - TcpFlags + - TcpControlBits: + fin: false + syn: false + rst: false + psh: false + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 70 + - - SrcAs + - DataNumber: + U16: 184 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 18757 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.27 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.196 + - - Protocol + - ProtocolType: Icmp + - - SrcTos + - DataNumber: + U8: 160 + - - L4SrcPort + - DataNumber: + U16: 30703 + - - L4DstPort + - DataNumber: + U16: 35045 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 154 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.69 + - - DstMask + - DataNumber: + U8: 29 + - - SrcMask + - DataNumber: + U8: 2 + - - TcpFlags + - TcpControlBits: + fin: false + syn: false + rst: false + psh: false + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 62 + - - SrcAs + - DataNumber: + U16: 163 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 33913 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.58 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.183 + - - Protocol + - ProtocolType: Udp + - - SrcTos + - DataNumber: + U8: 192 + - - L4SrcPort + - DataNumber: + U16: 47159 + - - L4DstPort + - DataNumber: + U16: 51444 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 95 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.89 + - - DstMask + - DataNumber: + U8: 4 + - - SrcMask + - DataNumber: + U8: 12 + - - TcpFlags + - TcpControlBits: + fin: true + syn: true + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 194 + - - SrcAs + - DataNumber: + U16: 6 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 7454 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.17 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.122 + - - Protocol + - ProtocolType: Tcp + - - SrcTos + - DataNumber: + U8: 16 + - - L4SrcPort + - DataNumber: + U16: 45231 + - - L4DstPort + - DataNumber: + U16: 54318 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 122 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.56 + - - DstMask + - DataNumber: + U8: 17 + - - SrcMask + - DataNumber: + U8: 21 + - - TcpFlags + - TcpControlBits: + fin: true + syn: false + rst: false + psh: false + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 76 + - - SrcAs + - DataNumber: + U16: 127 + - header: + flowset_id: 256 + length: 484 + body: + Data: + fields: + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 68548 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.17 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.126 + - - Protocol + - ProtocolType: Tcp + - - SrcTos + - DataNumber: + U8: 16 + - - L4SrcPort + - DataNumber: + U16: 35973 + - - L4DstPort + - DataNumber: + U16: 38493 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 184 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.79 + - - DstMask + - DataNumber: + U8: 10 + - - SrcMask + - DataNumber: + U8: 28 + - - TcpFlags + - TcpControlBits: + fin: false + syn: false + rst: false + psh: false + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 66 + - - SrcAs + - DataNumber: + U16: 198 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 2470 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.4 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.25 + - - Protocol + - ProtocolType: Icmp + - - SrcTos + - DataNumber: + U8: 192 + - - L4SrcPort + - DataNumber: + U16: 36432 + - - L4DstPort + - DataNumber: + U16: 37072 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 178 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.84 + - - DstMask + - DataNumber: + U8: 14 + - - SrcMask + - DataNumber: + U8: 17 + - - TcpFlags + - TcpControlBits: + fin: false + syn: true + rst: false + psh: false + ack: false + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 142 + - - SrcAs + - DataNumber: + U16: 175 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 29252 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.64 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.229 + - - Protocol + - ProtocolType: Icmp + - - SrcTos + - DataNumber: + U8: 192 + - - L4SrcPort + - DataNumber: + U16: 33344 + - - L4DstPort + - DataNumber: + U16: 33832 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 143 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.57 + - - DstMask + - DataNumber: + U8: 21 + - - SrcMask + - DataNumber: + U8: 26 + - - TcpFlags + - TcpControlBits: + fin: false + syn: true + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 107 + - - SrcAs + - DataNumber: + U16: 120 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 50925 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.100 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.2 + - - Protocol + - ProtocolType: Icmp + - - SrcTos + - DataNumber: + U8: 0 + - - L4SrcPort + - DataNumber: + U16: 2362 + - - L4DstPort + - DataNumber: + U16: 6644 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 42 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.50 + - - DstMask + - DataNumber: + U8: 15 + - - SrcMask + - DataNumber: + U8: 15 + - - TcpFlags + - TcpControlBits: + fin: false + syn: true + rst: false + psh: false + ack: false + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 102 + - - SrcAs + - DataNumber: + U16: 106 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 41046 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.61 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.175 + - - Protocol + - ProtocolType: Udp + - - SrcTos + - DataNumber: + U8: 0 + - - L4SrcPort + - DataNumber: + U16: 12773 + - - L4DstPort + - DataNumber: + U16: 21100 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 247 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.11 + - - DstMask + - DataNumber: + U8: 5 + - - SrcMask + - DataNumber: + U8: 15 + - - TcpFlags + - TcpControlBits: + fin: false + syn: true + rst: false + psh: false + ack: false + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 103 + - - SrcAs + - DataNumber: + U16: 110 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 44693 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.75 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.193 + - - Protocol + - ProtocolType: Icmp + - - SrcTos + - DataNumber: + U8: 160 + - - L4SrcPort + - DataNumber: + U16: 23774 + - - L4DstPort + - DataNumber: + U16: 58643 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 41 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.48 + - - DstMask + - DataNumber: + U8: 17 + - - SrcMask + - DataNumber: + U8: 17 + - - TcpFlags + - TcpControlBits: + fin: true + syn: true + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 172 + - - SrcAs + - DataNumber: + U16: 85 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 54633 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.86 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.106 + - - Protocol + - ProtocolType: Udp + - - SrcTos + - DataNumber: + U8: 160 + - - L4SrcPort + - DataNumber: + U16: 17988 + - - L4DstPort + - DataNumber: + U16: 51476 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 95 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.88 + - - DstMask + - DataNumber: + U8: 4 + - - SrcMask + - DataNumber: + U8: 12 + - - TcpFlags + - TcpControlBits: + fin: true + syn: true + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 190 + - - SrcAs + - DataNumber: + U16: 17 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 17657 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.31 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.208 + - - Protocol + - ProtocolType: Tcp + - - SrcTos + - DataNumber: + U8: 16 + - - L4SrcPort + - DataNumber: + U16: 47983 + - - L4DstPort + - DataNumber: + U16: 49960 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 79 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.82 + - - DstMask + - DataNumber: + U8: 13 + - - SrcMask + - DataNumber: + U8: 18 + - - TcpFlags + - TcpControlBits: + fin: true + syn: true + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 152 + - - SrcAs + - DataNumber: + U16: 51 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 59060 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.30 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.222 + - - Protocol + - ProtocolType: Tcp + - - SrcTos + - DataNumber: + U8: 16 + - - L4SrcPort + - DataNumber: + U16: 60658 + - - L4DstPort + - DataNumber: + U16: 12666 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 83 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.96 + - - DstMask + - DataNumber: + U8: 3 + - - SrcMask + - DataNumber: + U8: 4 + - - TcpFlags + - TcpControlBits: + fin: false + syn: true + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 146 + - - SrcAs + - DataNumber: + U16: 161 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 26110 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.98 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.11 + - - Protocol + - ProtocolType: Icmp + - - SrcTos + - DataNumber: + U8: 0 + - - L4SrcPort + - DataNumber: + U16: 26239 + - - L4DstPort + - DataNumber: + U16: 43420 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 253 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.3 + - - DstMask + - DataNumber: + U8: 1 + - - SrcMask + - DataNumber: + U8: 3 + - - TcpFlags + - TcpControlBits: + fin: false + syn: false + rst: false + psh: false + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 90 + - - SrcAs + - DataNumber: + U16: 116 + - header: + flowset_id: 256 + length: 484 + body: + Data: + fields: + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 56498 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.78 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.76 + - - Protocol + - ProtocolType: Udp + - - SrcTos + - DataNumber: + U8: 192 + - - L4SrcPort + - DataNumber: + U16: 44126 + - - L4DstPort + - DataNumber: + U16: 62559 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 27 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.18 + - - DstMask + - DataNumber: + U8: 14 + - - SrcMask + - DataNumber: + U8: 18 + - - TcpFlags + - TcpControlBits: + fin: true + syn: true + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 194 + - - SrcAs + - DataNumber: + U16: 19 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 13191 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.49 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.132 + - - Protocol + - ProtocolType: Tcp + - - SrcTos + - DataNumber: + U8: 16 + - - L4SrcPort + - DataNumber: + U16: 48550 + - - L4DstPort + - DataNumber: + U16: 49043 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 67 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.77 + - - DstMask + - DataNumber: + U8: 9 + - - SrcMask + - DataNumber: + U8: 25 + - - TcpFlags + - TcpControlBits: + fin: false + syn: true + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 104 + - - SrcAs + - DataNumber: + U16: 112 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 43491 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.70 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.214 + - - Protocol + - ProtocolType: Tcp + - - SrcTos + - DataNumber: + U8: 16 + - - L4SrcPort + - DataNumber: + U16: 37816 + - - L4DstPort + - DataNumber: + U16: 48033 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 199 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.29 + - - DstMask + - DataNumber: + U8: 26 + - - SrcMask + - DataNumber: + U8: 12 + - - TcpFlags + - TcpControlBits: + fin: true + syn: true + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 157 + - - SrcAs + - DataNumber: + U16: 71 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 70685 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.22 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.88 + - - Protocol + - ProtocolType: Udp + - - SrcTos + - DataNumber: + U8: 0 + - - L4SrcPort + - DataNumber: + U16: 18684 + - - L4DstPort + - DataNumber: + U16: 55554 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 109 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.72 + - - DstMask + - DataNumber: + U8: 26 + - - SrcMask + - DataNumber: + U8: 12 + - - TcpFlags + - TcpControlBits: + fin: true + syn: true + rst: false + psh: true + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 161 + - - SrcAs + - DataNumber: + U16: 69 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 73882 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.4 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.25 + - - Protocol + - ProtocolType: Icmp + - - SrcTos + - DataNumber: + U8: 192 + - - L4SrcPort + - DataNumber: + U16: 35379 + - - L4DstPort + - DataNumber: + U16: 39960 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 167 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.91 + - - DstMask + - DataNumber: + U8: 6 + - - SrcMask + - DataNumber: + U8: 9 + - - TcpFlags + - TcpControlBits: + fin: true + syn: false + rst: false + psh: false + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 78 + - - SrcAs + - DataNumber: + U16: 136 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 73548 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.11 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.45 + - - Protocol + - ProtocolType: Tcp + - - SrcTos + - DataNumber: + U8: 16 + - - L4SrcPort + - DataNumber: + U16: 43210 + - - L4DstPort + - DataNumber: + U16: 64423 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 2 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.3 + - - DstMask + - DataNumber: + U8: 1 + - - SrcMask + - DataNumber: + U8: 3 + - - TcpFlags + - TcpControlBits: + fin: false + syn: false + rst: false + psh: false + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 82 + - - SrcAs + - DataNumber: + U16: 147 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 61275 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.34 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.250 + - - Protocol + - ProtocolType: Icmp + - - SrcTos + - DataNumber: + U8: 0 + - - L4SrcPort + - DataNumber: + U16: 15333 + - - L4DstPort + - DataNumber: + U16: 19513 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 212 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.50 + - - DstMask + - DataNumber: + U8: 16 + - - SrcMask + - DataNumber: + U8: 16 + - - TcpFlags + - TcpControlBits: + fin: false + syn: true + rst: false + psh: false + ack: false + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 130 + - - SrcAs + - DataNumber: + U16: 185 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 18094 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.27 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.205 + - - Protocol + - ProtocolType: Tcp + - - SrcTos + - DataNumber: + U8: 160 + - - L4SrcPort + - DataNumber: + U16: 3850 + - - L4DstPort + - DataNumber: + U16: 4881 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 55 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.35 + - - DstMask + - DataNumber: + U8: 28 + - - SrcMask + - DataNumber: + U8: 7 + - - TcpFlags + - TcpControlBits: + fin: false + syn: true + rst: true + psh: false + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 167 + - - SrcAs + - DataNumber: + U16: 99 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 38963 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.54 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.136 + - - Protocol + - ProtocolType: Tcp + - - SrcTos + - DataNumber: + U8: 16 + - - L4SrcPort + - DataNumber: + U16: 64029 + - - L4DstPort + - DataNumber: + U16: 1348 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 13 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.9 + - - DstMask + - DataNumber: + U8: 7 + - - SrcMask + - DataNumber: + U8: 9 + - - TcpFlags + - TcpControlBits: + fin: true + syn: false + rst: false + psh: false + ack: true + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 95 + - - SrcAs + - DataNumber: + U16: 108 + - - - LastSwitched + - Duration: + secs: 3488219 + nanos: 376000000 + - - FirstSwitched + - Duration: + secs: 3488219 + nanos: 284000000 + - - InBytes + - DataNumber: + U32: 2003 + - - InPkts + - DataNumber: + U32: 47659 + - - InputSnmp + - DataNumber: + U16: 4 + - - OutputSnmp + - DataNumber: + U16: 2 + - - Ipv4SrcAddr + - Ip4Addr: 10.0.0.63 + - - Ipv4DstAddr + - Ip4Addr: 12.0.0.223 + - - Protocol + - ProtocolType: Icmp + - - SrcTos + - DataNumber: + U8: 192 + - - L4SrcPort + - DataNumber: + U16: 42544 + - - L4DstPort + - DataNumber: + U16: 59214 + - - FlowSamplerId + - DataNumber: + U8: 0 + - - IanaAssigned: 51 + - Vec: + - 58 + - - Ipv4NextHop + - Ip4Addr: 10.0.0.32 + - - DstMask + - DataNumber: + U8: 25 + - - SrcMask + - DataNumber: + U8: 13 + - - TcpFlags + - TcpControlBits: + fin: false + syn: true + rst: false + psh: false + ack: false + urg: false + ece: false + cwr: false + ns: false + - - Direction + - DataNumber: + U8: 0 + - - DstAs + - DataNumber: + U16: 139 + - - SrcAs + - DataNumber: + U16: 168 + - header: + flowset_id: 257 + length: 164 + body: + OptionsData: + fields: + - scope_fields: + - System: + - 0 + - 0 + - 0 + - 100 + - Interface: + - 0 + - 0 + - 0 + - 200 + - LineCard: + - 0 + - 0 + - 1 + - 44 + - NetFlowCache: + - 0 + - 0 + - 1 + - 144 + - Template: + - 0 + - 0 + - 1 + - 244 + options_fields: + - - TotalFlowsExp + - DataNumber: + U32: 1013367971 + - - TotalPktsExp + - DataNumber: + U32: 33710346 + - - SamplingInterval + - DataNumber: + U32: 100 + - scope_fields: + - System: + - 0 + - 0 + - 0 + - 100 + - Interface: + - 0 + - 0 + - 0 + - 200 + - LineCard: + - 0 + - 0 + - 1 + - 44 + - NetFlowCache: + - 0 + - 0 + - 1 + - 144 + - Template: + - 0 + - 0 + - 1 + - 244 + options_fields: + - - TotalFlowsExp + - DataNumber: + U32: 1013367971 + - - TotalPktsExp + - DataNumber: + U32: 33710346 + - - SamplingInterval + - DataNumber: + U32: 100 + - scope_fields: + - System: + - 0 + - 0 + - 0 + - 100 + - Interface: + - 0 + - 0 + - 0 + - 200 + - LineCard: + - 0 + - 0 + - 1 + - 44 + - NetFlowCache: + - 0 + - 0 + - 1 + - 144 + - Template: + - 0 + - 0 + - 1 + - 244 + options_fields: + - - TotalFlowsExp + - DataNumber: + U32: 1013367971 + - - TotalPktsExp + - DataNumber: + U32: 33710346 + - - SamplingInterval + - DataNumber: + U32: 100 + - scope_fields: + - System: + - 0 + - 0 + - 0 + - 100 + - Interface: + - 0 + - 0 + - 0 + - 200 + - LineCard: + - 0 + - 0 + - 1 + - 44 + - NetFlowCache: + - 0 + - 0 + - 1 + - 144 + - Template: + - 0 + - 0 + - 1 + - 244 + options_fields: + - - TotalFlowsExp + - DataNumber: + U32: 1013367971 + - - TotalPktsExp + - DataNumber: + U32: 33710346 + - - SamplingInterval + - DataNumber: + U32: 100 + - scope_fields: + - System: + - 0 + - 0 + - 0 + - 100 + - Interface: + - 0 + - 0 + - 0 + - 200 + - LineCard: + - 0 + - 0 + - 1 + - 44 + - NetFlowCache: + - 0 + - 0 + - 1 + - 144 + - Template: + - 0 + - 0 + - 1 + - 244 + options_fields: + - - TotalFlowsExp + - DataNumber: + U32: 1013367971 + - - TotalPktsExp + - DataNumber: + U32: 33710346 + - - SamplingInterval + - DataNumber: + U32: 100 diff --git a/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_raises_error_when_parsing_v9_with_no_template_fields.snap b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_raises_error_when_parsing_v9_with_no_template_fields.snap new file mode 100644 index 00000000..a2f0893b --- /dev/null +++ b/src/snapshots/netflow_parser__tests__restored_legacy_tests__it_raises_error_when_parsing_v9_with_no_template_fields.snap @@ -0,0 +1,8 @@ +--- +source: src/tests.rs +expression: parser.parse_bytes(&packet) +--- +packets: [] +error: + Partial: + message: "V9 parse error: Parsing Error: Error { input: [1, 1], code: Verify }" diff --git a/src/tests.rs b/src/tests.rs index fc9c79e4..0d66a6cd 100644 --- a/src/tests.rs +++ b/src/tests.rs @@ -736,6 +736,497 @@ mod base_tests { } } +#[cfg(test)] +mod restored_legacy_tests { + use crate::variable_versions::ipfix::lookup::{IANAIPFixField, IPFixField}; + use crate::variable_versions::ipfix::{ + Template as IPFixTemplate, TemplateField as IPFixTemplateField, + }; + use crate::variable_versions::ttl::TemplateWithTtl; + use crate::variable_versions::v9::{ + Template as V9Template, TemplateField as V9TemplateField, + }; + use crate::{NetflowPacket, NetflowParser}; + + use insta::assert_yaml_snapshot; + use std::sync::Arc; + + #[test] + fn it_doesnt_allow_v5() { + let packet = [ + 0, 5, 0, 1, 3, 0, 4, 0, 5, 0, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, + 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, + 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, + ]; + let mut parser = NetflowParser::builder() + .with_allowed_versions(&[7, 9, 10]) + .build() + .unwrap(); + assert_yaml_snapshot!(parser.parse_bytes(&packet).packets); + } + + #[test] + fn it_parses_v5_incomplete() { + let packet = [0, 5, 0, 0, 1, 1, 1, 1]; + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packet)); + } + + #[test] + fn it_parses_v5_and_re_exports() { + let packet = [ + 0, 5, 0, 1, 3, 0, 4, 0, 5, 0, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, + 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, + 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, + ]; + if let NetflowPacket::V5(v5) = NetflowParser::default() + .parse_bytes(&packet) + .packets + .first() + .unwrap() + { + assert_yaml_snapshot!(v5.to_be_bytes()); + assert_eq!(v5.to_be_bytes(), packet); + } + } + + #[test] + fn it_creates_error() { + let packet = [0, 9, 10, 11]; + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packet)); + } + + #[test] + fn it_doesnt_allow_v7() { + let packet = [ + 0, 7, 0, 1, 3, 0, 4, 0, 5, 0, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, + 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, + 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, + ]; + let mut parser = NetflowParser::builder() + .with_allowed_versions(&[5, 9, 10]) + .build() + .unwrap(); + assert_yaml_snapshot!(parser.parse_bytes(&packet).packets); + } + + #[test] + fn it_parses_v7_and_re_exports() { + let packet = [ + 0, 7, 0, 1, 3, 0, 4, 0, 5, 0, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, + 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, + 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, + ]; + if let NetflowPacket::V7(v7) = NetflowParser::default() + .parse_bytes(&packet) + .packets + .first() + .unwrap() + { + assert_yaml_snapshot!(v7.to_be_bytes()); + assert_eq!(v7.to_be_bytes(), packet); + } + } + + #[test] + fn it_parses_v9() { + let packet = [ + 0, 9, 0, 2, 0, 0, 9, 9, 0, 1, 2, 3, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 16, 1, 2, 0, + 2, 0, 1, 0, 4, 0, 8, 0, 4, 1, 2, 0, 12, 9, 2, 3, 4, 9, 9, 9, 8, + ]; + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packet).packets); + } + + #[test] + fn it_doesnt_allow_v9() { + let packet = [ + 0, 9, 0, 2, 0, 0, 9, 9, 0, 1, 2, 3, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 16, 1, 2, 0, + 2, 0, 1, 0, 4, 0, 8, 0, 4, 1, 2, 0, 12, 9, 2, 3, 4, 9, 9, 9, 8, + ]; + let mut parser = NetflowParser::builder() + .with_allowed_versions(&[5, 7, 10]) + .build() + .unwrap(); + assert_yaml_snapshot!(parser.parse_bytes(&packet).packets); + } + + #[test] + fn it_parses_v9_ipv6flowlabel() { + let templates_hex = "0009000400a21e176658cb4600000155000000080000004c0102001100080004000c0004000f000400070002000b0002000a0002000e000200fc000400fd000400020004000100040016000400150004000400010005000101000002003d0001000000540103001300080004000c0004000f000400070002000b000200060001000a0002000e000200fc000400fd000400020004000100040016000400150004000400010005000100d1000801000002003d00010000005401050013001b0010001c0010003e001000070002000b000200060001000a0002000e000200fc000400fd00040002000400010004001600040015000400040001000500010050000601000002003d00010000005801060014001b0010001c0010003e0010001f000300070002000b000200060001000a0002000e000200fc000400fd00040002000400010004001600040015000400040001000500010050000601000002003d0001"; + let packets_hex = "0009000200a3a50e6658cbab000001640000000801020066c0a8120a8d180c0200000000c2c00035000200000000000000000000000000010000005200a31e7700a31e771100080001c0a8120a8d180c02000000009e230035000200000000000000000000000000010000005200a3197b00a3197b110008000101060063fd010008000000002a20235f1f7b9379fd00000000000000b2f208fffe2011800000000000000000000000000000000001f676e2b5003500000200000000000000000000000000010000006600a3197b00a3197b1100109027e0436d86dd01"; + let combined = format!("{}{}", templates_hex, packets_hex); + let packets = hex::decode(combined).unwrap(); + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packets).packets); + } + + #[test] + fn it_parses_v9_and_re_exports() { + let packet = [ + 0, 9, 0, 2, 0, 0, 9, 9, 0, 1, 2, 3, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 16, 1, 2, 0, + 2, 0, 1, 0, 4, 0, 8, 0, 4, 1, 2, 0, 12, 9, 2, 3, 4, 9, 9, 9, 8, + ]; + if let NetflowPacket::V9(v9) = NetflowParser::default() + .parse_bytes(&packet) + .packets + .first() + .unwrap() + { + assert_yaml_snapshot!(v9.to_be_bytes().unwrap()); + assert_eq!(v9.to_be_bytes().unwrap(), packet); + } + } + + #[test] + fn it_parses_v9_no_data() { + let packet = [ + 0, 9, 0, 2, 0, 0, 9, 9, 0, 1, 2, 3, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 16, 1, 2, 0, + 2, 0, 1, 0, 4, 0, 8, 0, 4, 1, 2, 0, 4, + ]; + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packet).packets); + } + + #[test] + fn it_parses_v9_template_and_data_packet() { + let hex = "000900090000cc99664728d80000000100000000000000480400001000080004000c000400160004001500040001000400020004000a0004000e0004003d00010088000100070002000b00020004000100060001003c000100050001000000400401000e00080004000c000400160004001500040001000400020004000a0004000e0004003d0001008800010020000200040001003c0001000500010000004808000010001b0010001c001000160004001500040001000400020004000a0004000e0004003d00010088000100070002000b00020004000100060001003c000100050001000000400801000e001b0010001c001000160004001500040001000400020004000a0004000e0004003d000100880001008b000200040001003c0001000500010001001a01000004000c000200040022000400230001005200100100001d000000000000000101616e7900000000000000000000000000080000cd200300d1ef3b2200fe3497fffeb7686e26064700303200000000000068155338000016050000a418000004bf0000000900000000000000000003e2d401bb0619060026064700303200000000000068155338200300d1ef3b2200fe3497fffeb7686e000016050000a418000000b4000000030000000000000000010301bbe2d406040600000000000000000000000000000000010000000000000000000000000000000100004f2c00004f2c0000003c00000001000000000000000000031f91aaea06140600000000040001009df0fb3dc0a801d700006308000076d500000b7200000018000000000000000000031466ac50061a0400c0a801d79df0fb3d00006308000076d500000e370000002100000000000000000103ac501466061e04005dd10e499df0fb3d00006308000076d6000004bd0000000b00000000000000000003ac501466061e04009df0fb3d5dd10e4900006308000076d6000005b90000000c000000000000000001031466ac50061a0400c0a80125c6fcce190000a9180000a9cd0000027b0000000900000000000000000003a34401bb06190400c6fcce19c0a801250000a9180000a9cd00000108000000060000000000000000010301bba34406150400"; + let packet = hex::decode(hex).unwrap(); + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packet).packets); + } + + #[test] + #[cfg(feature = "parse_unknown_fields")] + fn it_parses_multiple_packets() { + let v9_packet = [ + 0, 9, 0, 2, 0, 0, 9, 9, 0, 1, 2, 3, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 16, 1, 2, 0, + 2, 0, 1, 0, 4, 0, 8, 0, 4, 1, 2, 0, 12, 9, 2, 3, 4, 9, 9, 9, 8, + ]; + let v7_packet = [ + 0, 7, 0, 1, 3, 0, 4, 0, 5, 0, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, + 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, + 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, + ]; + let v5_packet = [ + 0, 5, 0, 1, 3, 0, 4, 0, 5, 0, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, + 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, + 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, + ]; + let ipfix_packet = [ + 0, 10, 0, 64, 1, 2, 3, 4, 0, 0, 0, 0, 1, 2, 3, 4, 0, 2, 0, 20, 1, 0, 0, 3, 0, 8, 0, + 4, 0, 12, 0, 4, 0, 2, 0, 4, 1, 0, 0, 28, 1, 2, 3, 4, 1, 2, 3, 3, 1, 2, 3, 2, 0, 2, + 0, 2, 0, 1, 2, 3, 4, 5, 6, 7, + ]; + let mut all = vec![]; + all.extend_from_slice(&v9_packet); + all.extend_from_slice(&v5_packet); + all.extend_from_slice(&v7_packet); + all.extend_from_slice(&v9_packet); + all.extend_from_slice(&ipfix_packet); + all.extend_from_slice(&v5_packet); + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&all).packets); + } + + #[test] + fn it_parses_v9_many_flows() { + let packet = [ + 0, 9, 0, 3, 0, 0, 9, 9, 0, 1, 2, 3, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 16, 1, 2, 0, + 2, 0, 1, 0, 4, 0, 8, 0, 4, 1, 2, 0, 20, 9, 2, 3, 4, 9, 9, 9, 8, 9, 2, 3, 4, 9, 9, + 9, 8, + ]; + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packet).packets); + } + + #[test] + fn it_parses_v9_options_template() { + let packet = [ + 0, 9, 0, 2, 0, 0, 9, 9, 0, 1, 2, 3, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 22, 1, 19, 0, + 4, 0, 8, 0, 2, 0, 2, 0, 34, 0, 2, 0, 36, 0, 1, 1, 19, 0, 9, 0, 2, 0, 100, 1, + ]; + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packet).packets); + } + + #[test] + fn it_parses_v9_data_cached_template() { + let packet = [ + 0, 9, 0, 1, 0, 0, 9, 9, 0, 1, 2, 3, 0, 0, 0, 1, 0, 0, 0, 1, 1, 2, 0, 12, 9, 2, 3, + 4, 9, 9, 9, 8, + ]; + let fields = vec![ + V9TemplateField { + field_type_number: 1, + field_type: crate::variable_versions::v9::lookup::V9Field::InBytes, + field_length: 4, + }, + V9TemplateField { + field_type_number: 8, + field_type: crate::variable_versions::v9::lookup::V9Field::Ipv4SrcAddr, + field_length: 4, + }, + ]; + let template = V9Template { + field_count: 2, + template_id: 258, + fields, + }; + let mut parser = NetflowParser::default(); + let wrapped = TemplateWithTtl::new_without_ttl(Arc::new(template)); + parser.v9_parser.templates.put(258, wrapped); + assert_yaml_snapshot!(parser.parse_bytes(&packet).packets); + } + + #[test] + fn it_parses_ipfix() { + let packet = [ + 0, 10, 0, 64, 1, 2, 3, 4, 0, 0, 0, 0, 1, 2, 3, 4, 0, 2, 0, 20, 1, 0, 0, 3, 0, 8, 0, + 4, 0, 12, 0, 4, 0, 2, 0, 4, 1, 0, 0, 28, 1, 2, 3, 4, 1, 2, 3, 3, 1, 2, 3, 2, 0, 2, + 0, 2, 0, 1, 2, 3, 4, 5, 6, 7, + ]; + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packet).packets); + } + + #[test] + fn it_doesnt_allow_ipfix() { + let packet = [ + 0, 10, 0, 64, 1, 2, 3, 4, 0, 0, 0, 0, 1, 2, 3, 4, 0, 2, 0, 20, 1, 0, 0, 3, 0, 8, 0, + 4, 0, 12, 0, 4, 0, 2, 0, 4, 1, 0, 0, 28, 1, 2, 3, 4, 1, 2, 3, 3, 1, 2, 3, 2, 0, 2, + 0, 2, 0, 1, 2, 3, 4, 5, 6, 7, + ]; + let mut parser = NetflowParser::builder() + .with_allowed_versions(&[5, 7, 9]) + .build() + .unwrap(); + assert_yaml_snapshot!(parser.parse_bytes(&packet).packets); + } + + #[test] + fn it_parses_ipfix_and_re_exports() { + let packet = [ + 0, 10, 0, 64, 1, 2, 3, 4, 0, 0, 0, 0, 1, 2, 3, 4, 0, 2, 0, 20, 1, 0, 0, 3, 0, 8, 0, + 4, 0, 12, 0, 4, 0, 2, 0, 4, 1, 0, 0, 28, 1, 2, 3, 4, 1, 2, 3, 3, 1, 2, 3, 2, 0, 2, + 0, 2, 0, 1, 2, 3, 4, 5, 6, 7, + ]; + if let NetflowPacket::IPFix(ipfix) = NetflowParser::default() + .parse_bytes(&packet) + .packets + .first() + .unwrap() + { + assert_yaml_snapshot!(ipfix.to_be_bytes().unwrap()); + assert_eq!(ipfix.to_be_bytes().unwrap(), packet); + } + } + + #[test] + fn it_parses_0_length_fields_ipfix() { + let packet = [ + 0, 10, 0, 48, 1, 2, 3, 4, 0, 0, 0, 0, 1, 2, 3, 4, 0, 2, 0, 20, 1, 0, 0, 3, 0, 8, 0, + 4, 0, 12, 0, 4, 0, 65, 0, 0, 1, 0, 0, 12, 1, 2, 3, 4, 1, 2, 3, 4, + ]; + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packet).packets); + } + + #[test] + fn it_parses_ipfix_data_cached_template() { + let packet = [ + 0, 10, 0, 26, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 2, 0, 10, 0, 8, 0, 0, 1, 1, + ]; + let fields = vec![ + IPFixTemplateField { + field_type_number: 2, + field_type: IPFixField::IANA(IANAIPFixField::PacketDeltaCount), + field_length: 2, + enterprise_number: None, + }, + IPFixTemplateField { + field_type_number: 8, + field_type: IPFixField::IANA(IANAIPFixField::SourceIpv4address), + field_length: 4, + enterprise_number: None, + }, + ]; + let template = IPFixTemplate { + field_count: 2, + template_id: 258, + fields, + }; + let mut parser = NetflowParser::default(); + let wrapped = TemplateWithTtl::new_without_ttl(Arc::new(template)); + parser.ipfix_parser.templates.put(258, wrapped); + assert_yaml_snapshot!(parser.parse_bytes(&packet).packets); + } + + #[test] + fn it_parses_ipfix_with_no_template_fields() { + let packet = [ + 0, 10, 0, 26, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 2, 0, 10, 0, 8, 0, 0, 1, 1, + ]; + let template = IPFixTemplate { + field_count: 2, + template_id: 258, + fields: vec![], + }; + let mut parser = NetflowParser::default(); + let wrapped = TemplateWithTtl::new_without_ttl(Arc::new(template)); + parser.ipfix_parser.templates.put(258, wrapped); + assert_yaml_snapshot!(parser.parse_bytes(&packet).packets); + } + + #[test] + fn it_raises_error_when_parsing_v9_with_no_template_fields() { + let packet = [ + 0, 9, 0, 26, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 2, 0, 10, 0, 8, 0, 0, 1, 1, + ]; + let template = V9Template { + field_count: 2, + template_id: 258, + fields: vec![], + }; + let mut parser = NetflowParser::default(); + let wrapped = TemplateWithTtl::new_without_ttl(Arc::new(template)); + parser.v9_parser.templates.put(258, wrapped); + assert_yaml_snapshot!(parser.parse_bytes(&packet)); + } + + #[test] + fn it_parses_v9_with_multiple_options_data() { + let hex = "00090026cfe9ee444b4f72ba0146d3ce000000000000005c0100001500150004001600040001000400020004000a0002000e000200080004000c0004000400010005000100070002000b00020030000100330001000f0004000d00010009000100060001003d00010011000200100002000000540102001300150004001600040001000400020004000a0002000e000200080004000c0004000400010005000100070002000b00020030000100330001000f0004000d00010009000100060001003d00010001002c01010014000c0001000400020004000300040004000400050004002a000400290004002200040000010001e4cfea00f0cfea0094000007d3000057c5000400020a0000570c00006706a00eb812b900360a0000241c05160000c00017cfea00f0cfea0094000007d300002cf7000400020a00002a0c0000be11c0cd9451a500f20a00000907091100005e0077cfea00f0cfea0094000007d30000c42d000400020a0000620c00000a010070fc917a00b70a0000550c161100004500b6cfea00f0cfea0094000007d300004268000400020a00001d0c0000d90610d3037c9400870a0000361214180000030003cfea00f0cfea0094000007d300000efc000400020a0000090c00003e01a05eb7df0700230a000028151d0400002e003ecfea00f0cfea0094000007d30000f36a000400020a00002e0c00009511a04645c8f8005f0a000059040c1b0000c10014cfea00f0cfea0094000007d300003800000400020a00002d0c00009111a07cd085b0008b0a00003e131c1000004600b8cfea00f0cfea0094000007d300004945000400020a00001b0c0000c401a077ef88e5009a0a0000451d021000003e00a3cfea00f0cfea0094000007d300008479000400020a00003a0c0000b711c0b837c8f4005f0a000059040c1b0000c20006cfea00f0cfea0094000007d300001d1e000400020a0000110c00007a0610b0afd42e007a0a00003811151100004c007f010001e4cfea00f0cfea0094000007d300010bc4000400020a0000110c00007e06108c85965d00b80a00004f0a1c1000004200c6cfea00f0cfea0094000007d3000009a6000400020a0000040c00001901c08e5090d000b20a0000540e110200008e00afcfea00f0cfea0094000007d300007244000400020a0000400c0000e501c082408428008f0a000039151a1a00006b0078cfea00f0cfea0094000007d30000c6ed000400020a0000640c0000020100093a19f4002a0a0000320f0f02000066006acfea00f0cfea0094000007d30000a056000400020a00003d0c0000af110031e5526c00f70a00000b050f02000067006ecfea00f0cfea0094000007d30000ae95000400020a00004b0c0000c101a05cdee51300290a00003011111b0000ac0055cfea00f0cfea0094000007d30000d569000400020a0000560c00006a11a04644c914005f0a000058040c1b0000be0011cfea00f0cfea0094000007d3000044f9000400020a00001f0c0000d00610bb6fc328004f0a0000520d121b0000980033cfea00f0cfea0094000007d30000e6b4000400020a00001e0c0000de0610ecf2317a00530a00006003041a00009200a1cfea00f0cfea0094000007d3000065fe000400020a0000620c00000b0100667fa99c00fd0a00000301031000005a0074010001e4cfea00f0cfea0094000007d30000dcb2000400020a00004e0c00004c11c0ac5ef45f001b0a0000120e121b0000c20013cfea00f0cfea0094000007d300003387000400020a0000310c0000840610bda6bf9300430a00004d09191a0000680070cfea00f0cfea0094000007d30000a9e3000400020a0000460c0000d6061093b8bba100c70a00001d1a0c1b00009d0047cfea00f0cfea0094000007d30001141d000400020a0000160c000058110048fcd902006d0a0000481a0c1b0000a10045cfea00f0cfea0094000007d30001209a000400020a0000040c00001901c08a339c1800a70a00005b06091100004e0088cfea00f0cfea0094000007d300011f4c000400020a00000b0c00002d0610a8cafba700020a0000030103100000520093cfea00f0cfea0094000007d30000ef5b000400020a0000220c0000fa01003be54c3900d40a00003210100200008200b9cfea00f0cfea0094000007d3000046ae000400020a00001b0c0000cd06a00f0a131100370a0000231c07160000a70063cfea00f0cfea0094000007d300009833000400020a0000360c0000880610fa1d0544000d0a00000907091100005f006ccfea00f0cfea0094000007d30000ba2b000400020a00003f0c0000df01c0a630e74e003a0a000020190d0200008b00a8010100a400000064000000c80000012c00000190000001f43c66c4a30202610a0000006400000064000000c80000012c00000190000001f43c66c4a30202610a0000006400000064000000c80000012c00000190000001f43c66c4a30202610a0000006400000064000000c80000012c00000190000001f43c66c4a30202610a0000006400000064000000c80000012c00000190000001f43c66c4a30202610a00000064"; + let packet = hex::decode(hex).unwrap(); + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packet).packets); + } + + #[test] + fn it_parses_ipfix_options_template() { + let packet = [ + 0, 10, 0, 44, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 2, 0, 3, 0, 28, 1, 4, 0, 3, 0, 1, + 128, 123, 0, 4, 0, 0, 0, 2, 0, 41, 0, 2, 0, 42, 0, 2, 0, 0, + ]; + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packet).packets); + } + + #[test] + fn it_parses_ipfix_options_template_with_data() { + let packet = [ + 0, 10, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 2, 0, 3, 0, 28, 1, 4, 0, 3, 0, 1, + 128, 123, 0, 4, 0, 0, 0, 2, 0, 41, 0, 2, 0, 42, 0, 2, 0, 0, 1, 4, 0, 20, 0, 0, 0, + 1, 1, 20, 20, 20, 0, 0, 0, 2, 20, 20, 30, 30, + ]; + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packet).packets); + } + + #[test] + fn it_parses_ipfix_enterprise_bit_in_non_options_template() { + let packet = [ + 0, 10, 0, 42, 99, 138, 252, 49, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 26, 1, 4, 0, 2, + 128, 103, 255, 255, 24, 77, 128, 103, 255, 255, 0, 0, 24, 77, 129, 64, 0, 4, 0, 0, + 24, 77, + ]; + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packet).packets); + } + + #[test] + fn it_parses_ipfix_enterprise_bit_template_and_data() { + let template_packet = [ + 0x00, 0x0a, 0x00, 0xf4, 0x5b, 0x3b, 0x54, 0x85, 0x00, 0x00, 0x86, 0xc7, 0x00, 0x00, + 0x03, 0x00, 0x00, 0x02, 0x00, 0xe4, 0x01, 0x0c, 0x00, 0x22, 0xaf, 0xcc, 0x00, 0x04, + 0x00, 0x00, 0x00, 0x09, 0xaf, 0xcd, 0x00, 0x04, 0x00, 0x00, 0x00, 0x09, 0xaf, 0xd0, + 0x00, 0x02, 0x00, 0x00, 0x00, 0x09, 0xaf, 0xd1, 0x00, 0x02, 0x00, 0x00, 0x00, 0x09, + 0x00, 0xea, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x04, 0x00, 0xef, 0x00, 0x01, 0xaf, 0xd2, + 0x00, 0x04, 0x00, 0x00, 0x00, 0x09, 0x00, 0x5f, 0x00, 0x04, 0x00, 0x0e, 0x00, 0x04, + 0x00, 0x30, 0x00, 0x01, 0xa4, 0x24, 0x00, 0x01, 0x00, 0x00, 0x00, 0x09, 0xa4, 0x25, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x09, 0xa4, 0x8d, 0xff, 0xff, 0x00, 0x00, 0x00, 0x09, + 0xaf, 0xcb, 0xff, 0xff, 0x00, 0x00, 0x00, 0x09, 0x00, 0x16, 0x00, 0x04, 0x00, 0x15, + 0x00, 0x04, 0x01, 0x16, 0x00, 0x04, 0x00, 0xe8, 0x00, 0x08, 0x01, 0x2b, 0x00, 0x08, + 0x00, 0xe7, 0x00, 0x08, 0x01, 0x2a, 0x00, 0x08, 0xa4, 0x57, 0x00, 0x04, 0x00, 0x00, + 0x00, 0x09, 0xa4, 0x4c, 0x00, 0x04, 0x00, 0x00, 0x00, 0x09, 0xa4, 0x54, 0x00, 0x04, + 0x00, 0x00, 0x00, 0x09, 0xa4, 0x67, 0x00, 0x04, 0x00, 0x00, 0x00, 0x09, 0xa4, 0x64, + 0x00, 0x04, 0x00, 0x00, 0x00, 0x09, 0xa4, 0x34, 0x00, 0x04, 0x00, 0x00, 0x00, 0x09, + 0xa4, 0x61, 0x00, 0x04, 0x00, 0x00, 0x00, 0x09, 0xa4, 0x5a, 0x00, 0x04, 0x00, 0x00, + 0x00, 0x09, 0xa4, 0x5b, 0x00, 0x04, 0x00, 0x00, 0x00, 0x09, 0xa4, 0x5d, 0x00, 0x04, + 0x00, 0x00, 0x00, 0x09, 0xa4, 0x39, 0x00, 0x04, 0x00, 0x00, 0x00, 0x09, 0xa4, 0x38, + 0x00, 0x04, 0x00, 0x00, 0x00, 0x09, + ]; + let data_packet = [ + 0x00, 0x0a, 0x00, 0xbc, 0x5b, 0x3b, 0x54, 0x7c, 0x00, 0x00, 0x86, 0xc6, 0x00, 0x00, + 0x03, 0x00, 0x01, 0x0c, 0x00, 0xac, 0x0a, 0xd1, 0x65, 0x42, 0x0a, 0x00, 0x00, 0xf1, + 0xc0, 0xe0, 0x00, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d, 0x01, 0x8d, + 0xc3, 0x3f, 0xe0, 0x03, 0x00, 0x00, 0x50, 0x00, 0x00, 0x00, 0x0a, 0x09, 0x10, 0x00, + 0x0b, 0x2f, 0x44, 0x6f, 0x63, 0x4c, 0x69, 0x62, 0x31, 0x00, 0x00, 0x01, 0x1a, 0x03, + 0x00, 0x00, 0x50, 0x34, 0x02, 0x70, 0x6f, 0x72, 0x74, 0x61, 0x6c, 0x2e, 0x6d, 0x65, + 0x64, 0x73, 0x69, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x2e, 0x72, 0x75, 0x21, 0xa0, 0xe2, + 0x7b, 0x21, 0xa2, 0x97, 0xbe, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x18, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + ]; + let mut parser = NetflowParser::default(); + let mut result = parser.parse_bytes(&template_packet).packets; + result.append(&mut parser.parse_bytes(&data_packet).packets); + assert_yaml_snapshot!(result); + } + + #[test] + fn it_parses_ipfix_scappy_example() { + let hex_template = "000a0074583de05700000ecf00000000000200640133001700080004000c0004000500010004000100070002000b000200200002000a0004001000040011000400120004000e000400010004000200040016000400150004000f000400090001000d000100060001003c00010098000800990008"; + let packet = hex::decode(hex_template).unwrap(); + let mut parser = NetflowParser::default(); + let mut result = parser.parse_bytes(&packet).packets; + let hex_data = "000a0060583de05900000ee400000000013300504601730132004701003d0000000000000000033b0000000200000003cc2a6e65000003560000052000000009b3f906eeb3fbaf3ccc2a6ebd1818000400000158b1b138ff00000158b1b3e14d"; + let packet = hex::decode(hex_data).unwrap(); + result.append(&mut parser.parse_bytes(&packet).packets); + assert_yaml_snapshot!(result); + } + + #[test] + fn it_parses_ipfix_scappy_example_options_template() { + let hex_template = + "000a0028583de05700000ecf00000000000300180134000300010005000200240002002500020000"; + let packet = hex::decode(hex_template).unwrap(); + let mut parser = NetflowParser::default(); + let result = parser.parse_bytes(&packet).packets; + assert_yaml_snapshot!(result); + } + + #[test] + fn it_parses_ipfix_with_v9_options_template_packet() { + let hex = "000a00736800a129000186a0000000000001000e04e8000100060022000404e80008000000010002002c0102000900080004000c000400070002000b00020004000100020004000100040016000400150004010200214646010178780101303980090600000064077359406800a1296800a129"; + let packet = hex::decode(hex).unwrap(); + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packet).packets); + } + + #[test] + fn it_parses_ipfix_mixed_enteprise_and_non_enterprise_fields() { + let hex_template = "000a00845b3b5496005e9d61000004000002007401080016afcc000400000009afcd0004000000090004000100c3000100c00001afd100020000000900ea0004005f0004003a0002000a000400ef0001a424000100000009000e0004a4250001000000090016000400150004011600040117000800e80008012b000800e70008012a0008"; + let packet = hex::decode(hex_template).unwrap(); + let mut parser = NetflowParser::default(); + let mut result = parser.parse_bytes(&packet).packets; + let hex_data = "000a05745b3b5424005e996700000400010805640a65ff010a0a1c391100ff0807000000000d00025e00000000000001100000001400ef92fb5cef93cb9400000000000000000000003500000000000000000000000000000000000000000002eff9000000000000009bac1fff01ac1fff011100fe0ec9000000000d00000100000000000101100000000100ef92fb60ef93e4040000000000000000000000780000000000000000000000000000000000000000000008a000000000000000b80ad016760a6516fb11043d44f6000000000d00000100000000000101100000000400ef92fb64ef93be3400000000000000000000003b00000000000000000000000000000000000000000000006000000000000000060a0097dc0a65975f11003cdffb000000000d00000100000000000101100000000400ef92fbaaef93e4fa00000000000000000000003b000000000000000000000000000000000000000000003ba000000000000000180a6516fb0a19161211007e1389000000000d00000100000000000401100000001400ef92fbaeef93e4c000000000000000000000003b0000000000000000000000000000000000000000000016f0000000000000016fe0000005ac1fff015900010000000000000100005900000000000102100000000000ef92fbe0ef93dbb60000000000000000000000500000000000000000000000000000001700000000000000000000000000000000ac1ffe65ac1ffe651130ff0ec9000000000d00000100000000000001100000000100ef92fc52ef93e50000000000000000000000003c000000000000000000000000000000000000000000000ee8000000000000013ee0000005ac1ffafc5930010000000000000100005901220000001402100000000000ef92fc5cef93db9c00000000000000000000000000000000000000000000000000000007000000000000000000000000000000000ad0160d0a6516fb11043d44f6000000000d00000100000000000101100000000400ef92fc5eef93bf1a0000000000000000000000320000000000000000000000000000000000000000000002e40000000000000041e0000005ac1ffe1b5930010000000000000100005900000000000102100000000000ef92fc66ef93d6ee00000000000000000000000000000000000000000000000000000007000000000000000000000000000000000a6466740acd970911007d0d3d000000000d00000101220000001402100000001100ef92fcacef93c48a0000000000000000000000ef00000000000000e10000000000000008000000000000006000000000000000080ad0167c0a6516fb11043d44f6000000000d00000100000000000101100000000400ef92fcc8ef93bf9a00000000000000000000003b0000000000000000000000000000000000000000000000600000000000000006ac1ffe65ac1ffe011130ff0ec8000000000d00000100000000000001100000000100ef92fcecef93df3e00000000000000000000003c00000000000000000000000000000000000000000000022800000000000000170a01162f0a6516fb11083d44f6000000000d00000100000000000101100000000400ef92fcf8ef93c00e00000000000000000000003200000000000000000000000000000000000000000000030400000000000000430a650a0c0a0097b301003c0000000000000d0001df00000000000102100000000400ef92fd0eef93e2320000000000000000000000000000000000000000000000000000001300000000000000000000000000000000ac1fff01ac1ffe651100ff0ec8000000000d00000100000000000101100000000000ef92fd34ef93e3ac00000000000000000000003b0000000000000000000000000000000000000000000006600000000000000044"; + let packet = hex::decode(hex_data).unwrap(); + result.append(&mut parser.parse_bytes(&packet).packets); + assert_yaml_snapshot!(result); + } + + #[test] + fn it_parses_ipfix_multiple_templates() { + let hex = "000a05b4542bf40f0001f2c100000000000205a401000017008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80c000100000173f80c100010000173f01010018008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008808000040000173f000e0004000a0004809700040000173f80c000100000173f80c100010000173f01020025008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80ab00040000173f809e00080000173f80aa00080000173f80c000100000173f80c100010000173f8082ffff0000173f8083ffff0000173f808cffff0000173f808dffff0000173f808effff0000173f808fffff0000173f80b7ffff0000173f80b9ffff0000173f80baffff0000173f80beffff0000173f80cdffff0000173f01030017008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80c000100000173f80c100010000173f01040018008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008808000040000173f000e0004000a0004809700040000173f80c000100000173f80c100010000173f01050025008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80ab00040000173f809e00080000173f80aa00080000173f80c000100000173f80c100010000173f8082ffff0000173f8083ffff0000173f808cffff0000173f808dffff0000173f808effff0000173f808fffff0000173f80b7ffff0000173f80b9ffff0000173f80baffff0000173f80beffff0000173f80cdffff0000173f01060026008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809000020000173f809100080000173f809200080000173f809300080000173f809700040000173f80a100040000173f80a200040000173f809900080000173f809c00080000173f809d00080000173f809f00080000173f80a000080000173f80a900080000173f80b600040000173f80b7ffff0000173f80bbffff0000173f80bcffff0000173f80bdffff0000173f01070026008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809000020000173f809100080000173f809200080000173f809300080000173f809700040000173f80a100040000173f80a200040000173f809900080000173f809c00080000173f809d00080000173f809f00080000173f80a000080000173f80a900080000173f80b600040000173f80b7ffff0000173f80bbffff0000173f80bcffff0000173f80bdffff0000173f"; + let packet = hex::decode(hex).unwrap(); + assert_yaml_snapshot!(NetflowParser::default().parse_bytes(&packet).packets); + } + + #[test] + fn it_parses_ipfix_multiple_flow_records() { + let hex0: &'static str = "000a058c542bf40f0001f2c1000000000002057c010a000400900004808100040000173f80a8ffff0000173f80a3ffff0000173f010b000400900004808100040000173f80a4ffff0000173f80a5ffff0000173f010d0019008a00040090000400940008808100040000173f808500040000173f003c0001003d0001000400010006000100080004000c000400070002000b00020002000800010008808400080000173f009a0008009b0008000a0004000e0004809700040000173f80ae00010000173f80ad00010000173f00d2000280b2ffff0000173f010e001d008a00040090000400940008808100040000173f808500040000173f003c0001003d0001000400010006000100080004000c000400070002000b00020002000800010008808400080000173f009a0008009b0008000a0004000e0004809700040000173f809200080000173f809300080000173f80ae00010000173f00d2000100d2000280b400080000173f80b500080000173f80b3ffff0000173f010f001a008a00040090000400940008808500040000173f003c00010004000100d2000200080004000c000400070002000b000280c800100000173f80f700040000173f80f800100000173f80f900080000173f80d100040000173f80cb00040000173f80ca00020000173f80d000020000173f80c000100000173f80c100010000173f80c9ffff0000173f80ccffff0000173f80faffff0000173f80cfffff0000173f80d2ffff0000173f01100020008a00040090000400940008808500040000173f003c00010004000100d2000280c800100000173f80f700040000173f80f800100000173f80f900080000173f80d600010000173f80d700040000173f80d800040000173f80d900040000173f80db00020000173f80dc00020000173f80dd00040000173f80de00040000173f80f300040000173f80f400040000173f80fe00040000173f80ff00040000173f810000040000173f810100040000173f810200040000173f810300040000173f810400040000173f810500020000173f810600020000173f810700020000173f810800020000173f01110017008a00040090000400940008808500040000173f003c00010004000100d2000280c800100000173f80f700040000173f80f800100000173f80f900080000173f80df00040000173f80e000040000173f80e100040000173f80e200040000173f80e300040000173f80e400040000173f80e500040000173f80e600040000173f80e700040000173f80e800040000173f80e900040000173f80ea00040000173f01120016008a00040090000400940008808500040000173f003c00010004000100d2000200080004000c000400070002000b000280c800100000173f80f700040000173f80f800100000173f80f900080000173f80eb00020000173f80ec00040000173f80ed00020000173f80ef00040000173f80f500040000173f80eeffff0000173f80f6ffff0000173f0113000e008a00040090000400940008808500040000173f003c00010004000100d2000280c800100000173f80f700040000173f80f800100000173f80f900080000173f80f000020000173f80f500040000173f80f100040000173f0114000c008a00040090000400940008808500040000173f003c00010004000100d2000280c800100000173f80f700040000173f80f800100000173f80f900080000173f80f200040000173f01150005008a00040090000480fb00010000173f80fc00080000173f80fd00080000173f01160018008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80c000100000173f80c100010000173f80cdffff0000173f"; + let hex1: &'static str = "000a05b4542bf40f0001f2c100000000000205a401000017008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80c000100000173f80c100010000173f01010018008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008808000040000173f000e0004000a0004809700040000173f80c000100000173f80c100010000173f01020025008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80ab00040000173f809e00080000173f80aa00080000173f80c000100000173f80c100010000173f8082ffff0000173f8083ffff0000173f808cffff0000173f808dffff0000173f808effff0000173f808fffff0000173f80b7ffff0000173f80b9ffff0000173f80baffff0000173f80beffff0000173f80cdffff0000173f01030017008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80c000100000173f80c100010000173f01040018008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008808000040000173f000e0004000a0004809700040000173f80c000100000173f80c100010000173f01050025008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809700040000173f80ab00040000173f809e00080000173f80aa00080000173f80c000100000173f80c100010000173f8082ffff0000173f8083ffff0000173f808cffff0000173f808dffff0000173f808effff0000173f808fffff0000173f80b7ffff0000173f80b9ffff0000173f80baffff0000173f80beffff0000173f80cdffff0000173f01060026008a00040090000400940008808100040000173f808500040000173f003c00010004000100d2000200080004000c000400070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809000020000173f809100080000173f809200080000173f809300080000173f809700040000173f80a100040000173f80a200040000173f809900080000173f809c00080000173f809d00080000173f809f00080000173f80a000080000173f80a900080000173f80b600040000173f80b7ffff0000173f80bbffff0000173f80bcffff0000173f80bdffff0000173f01070026008a00040090000400940008808100040000173f808500040000173f003c00010004000100d20002001b0010001c001000070002000b0002000200080001000800060001808400080000173f009a0008009b0008000a0004000e0004809000020000173f809100080000173f809200080000173f809300080000173f809700040000173f80a100040000173f80a200040000173f809900080000173f809c00080000173f809d00080000173f809f00080000173f80a000080000173f80a900080000173f80b600040000173f80b7ffff0000173f80bbffff0000173f80bcffff0000173f80bdffff0000173f"; + let hex2 = "000a04c1542bf41b0001f2c1000000000115001d00853ad3000000000100000000000000050000000000000000010201b100853ad30000000000000000001f247900016fa8001f247904060000ac12813dac129f63c99c01bb00000000000000030000000000000331180000000005022000d7d6729b000b8303d7d6729b000badf7000000018000000300002526000000000000000000000000000000000000000000505600d72b21541bf42b54f7ad0b0001102f76706e2f696e6465782e68746d6c0001000100044745540024696e742d6170702d6e65747363616c65722d31302d312d6578742e6c6162322e6e657400494d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b20574f5736343b2072763a33322e3029204765636b6f2f32303130303130312046697265666f782f33322e30000100010001000100010000853ad30000000000000000001f247900016fa8001f247904060000ac12813dac129f63c99c01bb00000000000000010000000000000028100000000005022000d7d6729b000bbd8ad7d6729b000bbd8a000000018000000300002526000000000000000000000000000000000000000000505600d72b21541bf42b54f7ad0b0001010001000100010001000100010001000100010001000101007600853ad30000000000000000001f247a00016fa8001f247904060000ac129f63ac12813d01bbc99c00000000000000070000000000001b05180000000041002000d7d6729b000b8303d7d6729b000bb1d70000000300000001800000030000252600505600d72b21541bf42b54f7ad0b0001010201f700853ad30000000000000000001f247900016fa9001f247904060000ac12813dac129f63c99c01bb000000000000000100000000000001e2180000000005022000d7d6729b000c369dd7d6729b000c369d000000018000000300002526000000000000000000000000000000000000000000505600d72b21541bf42b549d360c00011c2f76706e2f696d616765732f636178746f6e7374796c652e6373730001003b68747470733a2f2f696e742d6170702d6e65747363616c65722d31302d312d6578742e6c6162322e6e65742f76706e2f696e6465782e68746d6c00044745540024696e742d6170702d6e65747363616c65722d31302d312d6578742e6c6162322e6e657400494d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b20574f5736343b2072763a33322e3029204765636b6f2f32303130303130312046697265666f782f33322e30000100010001000100010000853ad30000000000000000001f247900016fa9001f247904060000ac12813dac129f63c99c01bb00000000000000030000000000000078100000000005022000d7d6729b000c3e6dd7d6729b000c4a18000000018000000300002526000000000000000000000000000000000000000000505600d72b21541bf42b549d360c0001010001000100010001000100010001000100010001000101007600853ad30000000000000000001f247a00016fa9001f247904060000ac129f63ac12813d01bbc99c000000000000000f00000000000055d0180000000041302000d7d6729b000c369dd7d6729b000c3e6d0000000200000001800000030000252600505600d72b21541bf42b549d360c0001"; + + let mut parser = NetflowParser::default(); + + let _ = parser.parse_bytes(&hex::decode(hex0).unwrap()); + let _ = parser.parse_bytes(&hex::decode(hex1).unwrap()); + + assert_yaml_snapshot!(parser.parse_bytes(&hex::decode(hex2).unwrap()).packets); + } +} + #[cfg(test)] mod malformed_packet_tests { use crate::NetflowParser; From d66f058b17862a74b5412e0e78060dd80397335f Mon Sep 17 00:00:00 2001 From: mikemiles-dev Date: Sat, 25 Apr 2026 10:34:04 -0500 Subject: [PATCH 2/2] fix: test --- src/tests.rs | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/tests.rs b/src/tests.rs index 0d66a6cd..2c4bdb3b 100644 --- a/src/tests.rs +++ b/src/tests.rs @@ -850,6 +850,7 @@ mod restored_legacy_tests { } #[test] + #[cfg(feature = "parse_unknown_fields")] fn it_parses_v9_ipv6flowlabel() { let templates_hex = "0009000400a21e176658cb4600000155000000080000004c0102001100080004000c0004000f000400070002000b0002000a0002000e000200fc000400fd000400020004000100040016000400150004000400010005000101000002003d0001000000540103001300080004000c0004000f000400070002000b000200060001000a0002000e000200fc000400fd000400020004000100040016000400150004000400010005000100d1000801000002003d00010000005401050013001b0010001c0010003e001000070002000b000200060001000a0002000e000200fc000400fd00040002000400010004001600040015000400040001000500010050000601000002003d00010000005801060014001b0010001c0010003e0010001f000300070002000b000200060001000a0002000e000200fc000400fd00040002000400010004001600040015000400040001000500010050000601000002003d0001"; let packets_hex = "0009000200a3a50e6658cbab000001640000000801020066c0a8120a8d180c0200000000c2c00035000200000000000000000000000000010000005200a31e7700a31e771100080001c0a8120a8d180c02000000009e230035000200000000000000000000000000010000005200a3197b00a3197b110008000101060063fd010008000000002a20235f1f7b9379fd00000000000000b2f208fffe2011800000000000000000000000000000000001f676e2b5003500000200000000000000000000000000010000006600a3197b00a3197b1100109027e0436d86dd01"; @@ -1085,6 +1086,7 @@ mod restored_legacy_tests { } #[test] + #[cfg(feature = "parse_unknown_fields")] fn it_parses_v9_with_multiple_options_data() { let hex = "00090026cfe9ee444b4f72ba0146d3ce000000000000005c0100001500150004001600040001000400020004000a0002000e000200080004000c0004000400010005000100070002000b00020030000100330001000f0004000d00010009000100060001003d00010011000200100002000000540102001300150004001600040001000400020004000a0002000e000200080004000c0004000400010005000100070002000b00020030000100330001000f0004000d00010009000100060001003d00010001002c01010014000c0001000400020004000300040004000400050004002a000400290004002200040000010001e4cfea00f0cfea0094000007d3000057c5000400020a0000570c00006706a00eb812b900360a0000241c05160000c00017cfea00f0cfea0094000007d300002cf7000400020a00002a0c0000be11c0cd9451a500f20a00000907091100005e0077cfea00f0cfea0094000007d30000c42d000400020a0000620c00000a010070fc917a00b70a0000550c161100004500b6cfea00f0cfea0094000007d300004268000400020a00001d0c0000d90610d3037c9400870a0000361214180000030003cfea00f0cfea0094000007d300000efc000400020a0000090c00003e01a05eb7df0700230a000028151d0400002e003ecfea00f0cfea0094000007d30000f36a000400020a00002e0c00009511a04645c8f8005f0a000059040c1b0000c10014cfea00f0cfea0094000007d300003800000400020a00002d0c00009111a07cd085b0008b0a00003e131c1000004600b8cfea00f0cfea0094000007d300004945000400020a00001b0c0000c401a077ef88e5009a0a0000451d021000003e00a3cfea00f0cfea0094000007d300008479000400020a00003a0c0000b711c0b837c8f4005f0a000059040c1b0000c20006cfea00f0cfea0094000007d300001d1e000400020a0000110c00007a0610b0afd42e007a0a00003811151100004c007f010001e4cfea00f0cfea0094000007d300010bc4000400020a0000110c00007e06108c85965d00b80a00004f0a1c1000004200c6cfea00f0cfea0094000007d3000009a6000400020a0000040c00001901c08e5090d000b20a0000540e110200008e00afcfea00f0cfea0094000007d300007244000400020a0000400c0000e501c082408428008f0a000039151a1a00006b0078cfea00f0cfea0094000007d30000c6ed000400020a0000640c0000020100093a19f4002a0a0000320f0f02000066006acfea00f0cfea0094000007d30000a056000400020a00003d0c0000af110031e5526c00f70a00000b050f02000067006ecfea00f0cfea0094000007d30000ae95000400020a00004b0c0000c101a05cdee51300290a00003011111b0000ac0055cfea00f0cfea0094000007d30000d569000400020a0000560c00006a11a04644c914005f0a000058040c1b0000be0011cfea00f0cfea0094000007d3000044f9000400020a00001f0c0000d00610bb6fc328004f0a0000520d121b0000980033cfea00f0cfea0094000007d30000e6b4000400020a00001e0c0000de0610ecf2317a00530a00006003041a00009200a1cfea00f0cfea0094000007d3000065fe000400020a0000620c00000b0100667fa99c00fd0a00000301031000005a0074010001e4cfea00f0cfea0094000007d30000dcb2000400020a00004e0c00004c11c0ac5ef45f001b0a0000120e121b0000c20013cfea00f0cfea0094000007d300003387000400020a0000310c0000840610bda6bf9300430a00004d09191a0000680070cfea00f0cfea0094000007d30000a9e3000400020a0000460c0000d6061093b8bba100c70a00001d1a0c1b00009d0047cfea00f0cfea0094000007d30001141d000400020a0000160c000058110048fcd902006d0a0000481a0c1b0000a10045cfea00f0cfea0094000007d30001209a000400020a0000040c00001901c08a339c1800a70a00005b06091100004e0088cfea00f0cfea0094000007d300011f4c000400020a00000b0c00002d0610a8cafba700020a0000030103100000520093cfea00f0cfea0094000007d30000ef5b000400020a0000220c0000fa01003be54c3900d40a00003210100200008200b9cfea00f0cfea0094000007d3000046ae000400020a00001b0c0000cd06a00f0a131100370a0000231c07160000a70063cfea00f0cfea0094000007d300009833000400020a0000360c0000880610fa1d0544000d0a00000907091100005f006ccfea00f0cfea0094000007d30000ba2b000400020a00003f0c0000df01c0a630e74e003a0a000020190d0200008b00a8010100a400000064000000c80000012c00000190000001f43c66c4a30202610a0000006400000064000000c80000012c00000190000001f43c66c4a30202610a0000006400000064000000c80000012c00000190000001f43c66c4a30202610a0000006400000064000000c80000012c00000190000001f43c66c4a30202610a0000006400000064000000c80000012c00000190000001f43c66c4a30202610a00000064"; let packet = hex::decode(hex).unwrap(); @@ -1101,6 +1103,7 @@ mod restored_legacy_tests { } #[test] + #[cfg(feature = "parse_unknown_fields")] fn it_parses_ipfix_options_template_with_data() { let packet = [ 0, 10, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 2, 0, 3, 0, 28, 1, 4, 0, 3, 0, 1, @@ -1121,6 +1124,7 @@ mod restored_legacy_tests { } #[test] + #[cfg(feature = "parse_unknown_fields")] fn it_parses_ipfix_enterprise_bit_template_and_data() { let template_packet = [ 0x00, 0x0a, 0x00, 0xf4, 0x5b, 0x3b, 0x54, 0x85, 0x00, 0x00, 0x86, 0xc7, 0x00, 0x00,