diff --git a/src/snapshots/netflow_parser__tests__base_tests__can_read_v9_with_hex_data.snap b/src/snapshots/netflow_parser__tests__base_tests__can_read_v9_with_hex_data.snap index 9474140..e3732d8 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__can_read_v9_with_hex_data.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__can_read_v9_with_hex_data.snap @@ -2,4 +2,28 @@ source: src/tests.rs expression: v9 --- -[] +- V9: + header: + version: 9 + count: 1 + sys_up_time: 0 + unix_secs: 0 + sequence_number: 0 + source_id: 1 + flowsets: + - header: + flowset_id: 256 + length: 20 + body: + Data: + fields: + - - - InBytes + - DataNumber: + U32: 100 + - - InPkts + - DataNumber: + U32: 5 + - - Ipv4SrcAddr + - Ip4Addr: 192.168.0.1 + - - Ipv4DstAddr + - Ip4Addr: 192.168.0.2 diff --git a/src/snapshots/netflow_parser__tests__base_tests__can_read_v9_with_minimal_headers.snap b/src/snapshots/netflow_parser__tests__base_tests__can_read_v9_with_minimal_headers.snap index 9474140..0816f96 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__can_read_v9_with_minimal_headers.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__can_read_v9_with_minimal_headers.snap @@ -2,4 +2,24 @@ source: src/tests.rs expression: v9 --- -[] +- V9: + header: + version: 9 + count: 1 + sys_up_time: 0 + unix_secs: 0 + sequence_number: 0 + source_id: 1 + flowsets: + - header: + flowset_id: 0 + length: 12 + body: + Template: + templates: + - template_id: 256 + field_count: 1 + fields: + - field_type_number: 8 + field_type: Ipv4SrcAddr + field_length: 4 diff --git a/src/snapshots/netflow_parser__tests__base_tests__can_read_v9_with_options_template.snap b/src/snapshots/netflow_parser__tests__base_tests__can_read_v9_with_options_template.snap index 9474140..13cda8b 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__can_read_v9_with_options_template.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__can_read_v9_with_options_template.snap @@ -2,4 +2,29 @@ source: src/tests.rs expression: v9 --- -[] +- V9: + header: + version: 9 + count: 1 + sys_up_time: 0 + unix_secs: 0 + sequence_number: 0 + source_id: 1 + flowsets: + - header: + flowset_id: 1 + length: 20 + body: + OptionsTemplate: + templates: + - template_id: 256 + options_scope_length: 4 + options_length: 4 + scope_fields: + - field_type_number: 1 + field_type: System + field_length: 4 + option_fields: + - field_type_number: 41 + field_type: TotalPktsExp + field_length: 2 diff --git a/src/snapshots/netflow_parser__tests__base_tests__can_read_v9_with_options_template_and_template.snap b/src/snapshots/netflow_parser__tests__base_tests__can_read_v9_with_options_template_and_template.snap index c85db2a..5d45d35 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__can_read_v9_with_options_template_and_template.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__can_read_v9_with_options_template_and_template.snap @@ -2,4 +2,67 @@ source: src/tests.rs expression: results --- -[] +- V9: + header: + version: 9 + count: 1 + sys_up_time: 0 + unix_secs: 0 + sequence_number: 0 + source_id: 1 + flowsets: + - header: + flowset_id: 1 + length: 20 + body: + OptionsTemplate: + templates: + - template_id: 256 + options_scope_length: 4 + options_length: 4 + scope_fields: + - field_type_number: 1 + field_type: System + field_length: 4 + option_fields: + - field_type_number: 41 + field_type: TotalPktsExp + field_length: 2 +- V9: + header: + version: 9 + count: 1 + sys_up_time: 0 + unix_secs: 0 + sequence_number: 0 + source_id: 1 + flowsets: + - header: + flowset_id: 0 + length: 12 + body: + Template: + templates: + - template_id: 256 + field_count: 1 + fields: + - field_type_number: 8 + field_type: Ipv4SrcAddr + field_length: 4 +- V9: + header: + version: 9 + count: 1 + sys_up_time: 0 + unix_secs: 0 + sequence_number: 0 + source_id: 1 + flowsets: + - header: + flowset_id: 256 + length: 8 + body: + Data: + fields: + - - - Ipv4SrcAddr + - Ip4Addr: 192.168.0.1 diff --git a/src/snapshots/netflow_parser__tests__base_tests__it_parses_v7.snap b/src/snapshots/netflow_parser__tests__base_tests__it_parses_v7.snap index bdbcb68..81875fb 100644 --- a/src/snapshots/netflow_parser__tests__base_tests__it_parses_v7.snap +++ b/src/snapshots/netflow_parser__tests__base_tests__it_parses_v7.snap @@ -2,4 +2,35 @@ source: src/tests.rs expression: parsed --- -[] +- V7: + header: + version: 7 + count: 1 + sys_up_time: 50332672 + unix_secs: 83887623 + unix_nsecs: 134807553 + flow_sequence: 33752069 + reserved: 101124105 + flowsets: + - src_addr: 0.1.2.3 + dst_addr: 4.5.6.7 + next_hop: 8.9.0.1 + input: 515 + output: 1029 + d_pkts: 101124105 + d_octets: 66051 + first: 67438087 + last: 134807553 + src_port: 515 + dst_port: 1029 + flags_fields_valid: 6 + tcp_flags: 7 + protocol_number: 8 + protocol_type: Egp + tos: 9 + src_as: 1 + dst_as: 515 + src_mask: 4 + dst_mask: 5 + flags_fields_invalid: 1543 + router_src: 8.9.0.1 diff --git a/src/tests.rs b/src/tests.rs index 2c4bdb3..56d7840 100644 --- a/src/tests.rs +++ b/src/tests.rs @@ -54,7 +54,7 @@ mod base_tests { let packet = [ 0, 7, 0, 1, 3, 0, 4, 0, 5, 0, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, - 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, + 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, ]; let parsed = NetflowParser::default().parse_bytes(&packet).packets; assert_yaml_snapshot!(parsed); @@ -63,8 +63,9 @@ mod base_tests { // Verify that a NetFlow v9 packet with minimal template headers can be parsed #[test] fn can_read_v9_with_minimal_headers() { - let hex = - "0009000200000e1061db09bd000000010000000100080001000400080004000e000400080004"; + // Minimal valid v9 packet: 20-byte header + 12-byte template flowset + // (template_id=256, 1 field: Ipv4SrcAddr/4 bytes). + let hex = "00090001000000000000000000000000000000010000000c0100000100080004"; let mut parser = NetflowParser::builder() .with_cache_size(100) @@ -79,8 +80,10 @@ mod base_tests { // Verify that a NetFlow v9 options template is parsed correctly #[test] fn can_read_v9_with_options_template() { + // Options template: template_id=256, 1 scope field (System/4), 1 option + // field (ExportedMessageTotalCount/2), with 2 bytes of trailing padding. let hex = - "0009000100000000000000000000000100010020000100120004000100150004000200080004"; + "00090001000000000000000000000000000000010001001401000004000400010004002900020000"; let mut parser = NetflowParser::builder() .with_cache_size(100) @@ -95,12 +98,12 @@ mod base_tests { // Verify that combined v9 options template, data template, and data records parse together #[test] fn can_read_v9_with_options_template_and_template() { + // Three v9 messages in one buffer: options template, data template, + // and one data record using template 256. let hex_hex0 = - "0009000100000000000000000000000100010020000100120004000100150004000200080004"; - let hex_hex1 = - "0009000200000e1061db09bd000000010000000100080001000400080004000e000400080004"; - let hex_hex2 = - "0009000200000e1061db09bd000000010000000100010010010203040506070811121314"; + "00090001000000000000000000000000000000010001001401000004000400010004002900020000"; + let hex_hex1 = "00090001000000000000000000000000000000010000000c0100000100080004"; + let hex_hex2 = "000900010000000000000000000000000000000101000008c0a80001"; let combined = format!("{}{}{}", hex_hex0, hex_hex1, hex_hex2); @@ -139,8 +142,9 @@ mod base_tests { // Verify that v9 data records are parsed correctly after a template has been cached #[test] fn can_read_v9_with_hex_data() { - // Template - let hex = "0009000100000e1061db09bd000000010000000100000028010000080001000400020004000a00040004000400080004000c0004000700020015000400050001000600010016000400100004"; + // Template: template_id=256 with 4 fields (InBytes/4, InPkts/4, + // Ipv4SrcAddr/4, Ipv4DstAddr/4) — 16 bytes per data record. + let hex = "00090001000000000000000000000000000000010000001801000004000100040002000400080004000c0004"; let mut parser = NetflowParser::builder() .with_cache_size(100) @@ -150,8 +154,9 @@ mod base_tests { let packets = hex::decode(hex).unwrap(); let _ = parser.parse_bytes(&packets).packets; - // Data - let hex_data = "0009000100000e1061db09bd000000010000000101003000c0a80001c0a8000200010001000000010000000500000000000000000600110001c0a80001"; + // Data: one record matching template 256 (16 bytes). + let hex_data = + "0009000100000000000000000000000000000001010000140000006400000005c0a80001c0a80002"; let packets = hex::decode(hex_data).unwrap(); let v9 = parser.parse_bytes(&packets).packets;