Skip to content

Fixed issue for V5+V7 flowsets #50

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 17, 2024
Merged

Fixed issue for V5+V7 flowsets #50

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7a790be
Fixed issue for V5+V7 flowsets
Apr 17, 2024
7272349
Removed dbg
Apr 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[package]
name = "netflow_parser"
description = "Parser for Netflow Cisco V5, V7, V9, IPFIX"
version = "0.2.6"
version = "0.2.7"
edition = "2021"
author = "[email protected]"
license = "MIT OR Apache-2.0"
Expand Down
3 changes: 3 additions & 0 deletions RELEASES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
# 0.2.7
* Added support for multiple flowsets for V5, V7.

# 0.2.6
* Re-added static and variable versions as public.

Expand Down
1 change: 1 addition & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@

| Version | Supported |
| ------- | ------------------ |
| 0.2.7 | :white_check_mark: |
| 0.2.6 | :white_check_mark: |
| 0.2.5 | :white_check_mark: |
| 0.2.4 | :white_check_mark: |
Expand Down
54 changes: 27 additions & 27 deletions src/snapshots/netflow_parser__tests__tests__it_parses_v5.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ expression: "NetflowParser::default().parse_bytes(&packet)"
- V5:
header:
version: 5
count: 512
count: 1
sys_up_time:
secs: 50332
nanos: 672000000
Expand All @@ -16,29 +16,29 @@ expression: "NetflowParser::default().parse_bytes(&packet)"
engine_id: 7
sampling_interval: 2057
body:
src_addr: 0.1.2.3
dst_addr: 4.5.6.7
next_hop: 8.9.0.1
input: 515
output: 1029
d_pkts: 101124105
d_octets: 66051
first:
secs: 67438
nanos: 87000000
last:
secs: 134807
nanos: 553000000
src_port: 515
dst_port: 1029
pad1: 6
tcp_flags: 7
protocol_number: 8
protocol_type: Egp
tos: 9
src_as: 1
dst_as: 515
src_mask: 4
dst_mask: 5
pad2: 1543

set:
- src_addr: 0.1.2.3
dst_addr: 4.5.6.7
next_hop: 8.9.0.1
input: 515
output: 1029
d_pkts: 101124105
d_octets: 66051
first:
secs: 67438
nanos: 87000000
last:
secs: 134807
nanos: 553000000
src_port: 515
dst_port: 1029
pad1: 6
tcp_flags: 7
protocol_number: 8
protocol_type: Egp
tos: 9
src_as: 1
dst_as: 515
src_mask: 4
dst_mask: 5
pad2: 1543
56 changes: 28 additions & 28 deletions src/snapshots/netflow_parser__tests__tests__it_parses_v7.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ expression: "NetflowParser::default().parse_bytes(&packet)"
- V7:
header:
version: 7
count: 512
count: 1
sys_up_time:
secs: 50332
nanos: 672000000
Expand All @@ -14,30 +14,30 @@ expression: "NetflowParser::default().parse_bytes(&packet)"
flow_sequence: 33752069
reserved: 101124105
body:
src_addr: 0.1.2.3
dst_addr: 4.5.6.7
next_hop: 8.9.0.1
input: 515
output: 1029
d_pkts: 101124105
d_octets: 66051
first:
secs: 67438
nanos: 87000000
last:
secs: 134807
nanos: 553000000
src_port: 515
dst_port: 1029
flags_fields_valid: 6
tcp_flags: 7
protocol_number: 8
protocol_type: Egp
tos: 9
src_as: 1
dst_as: 515
src_mask: 4
dst_mask: 5
flags_fields_invalid: 1543
router_src: 8.9.0.1

set:
- src_addr: 0.1.2.3
dst_addr: 4.5.6.7
next_hop: 8.9.0.1
input: 515
output: 1029
d_pkts: 101124105
d_octets: 66051
first:
secs: 67438
nanos: 87000000
last:
secs: 134807
nanos: 553000000
src_port: 515
dst_port: 1029
flags_fields_valid: 6
tcp_flags: 7
protocol_number: 8
protocol_type: Egp
tos: 9
src_as: 1
dst_as: 515
src_mask: 4
dst_mask: 5
flags_fields_invalid: 1543
router_src: 8.9.0.1
8 changes: 8 additions & 0 deletions src/static_versions/v5.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ pub struct V5 {
/// V5 Header
pub header: Header,
/// V5 Body
#[nom(Parse = "{ |i| Body::parse(i, header.count) }")]
pub body: Body,
}

Expand Down Expand Up @@ -60,7 +61,14 @@ pub struct Header {
}

#[derive(Debug, PartialEq, Eq, Clone, Serialize, Nom)]
#[nom(ExtraArgs(count: u16))]
pub struct Body {
#[nom(Count = "count")]
set: Vec<FlowSet>,
}

#[derive(Debug, PartialEq, Eq, Clone, Serialize, Nom)]
pub struct FlowSet {
/// Source IP address
#[nom(Map = "Ipv4Addr::from", Parse = "be_u32")]
pub src_addr: Ipv4Addr,
Expand Down
10 changes: 9 additions & 1 deletion src/static_versions/v7.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ pub struct V7 {
/// V7 Header
pub header: Header,
/// V7 Body
#[nom(Parse = "{ |i| Body::parse(i, header.count) }")]
pub body: Body,
}

Expand Down Expand Up @@ -55,8 +56,15 @@ pub struct Header {
pub reserved: u32,
}

#[derive(Debug, PartialEq, Eq, Clone, Nom, Serialize)]
#[derive(Debug, PartialEq, Eq, Clone, Serialize, Nom)]
#[nom(ExtraArgs(count: u16))]
pub struct Body {
#[nom(Count = "count")]
set: Vec<FlowSet>,
}

#[derive(Debug, PartialEq, Eq, Clone, Nom, Serialize)]
pub struct FlowSet {
/// Source IP address; in case of destination-only flows, set to zero.
#[nom(Map = "Ipv4Addr::from", Parse = "be_u32")]
pub src_addr: Ipv4Addr,
Expand Down
4 changes: 2 additions & 2 deletions src/tests.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ mod tests {
#[cfg(not(feature = "unix_timestamp"))]
fn it_parses_v5() {
let packet = [
0, 5, 2, 0, 3, 0, 4, 0, 5, 0, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3,
0, 5, 0, 1, 3, 0, 4, 0, 5, 0, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3,
4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1,
2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7,
];
Expand Down Expand Up @@ -68,7 +68,7 @@ mod tests {
#[cfg(not(feature = "unix_timestamp"))]
fn it_parses_v7() {
let packet = [
0, 7, 2, 0, 3, 0, 4, 0, 5, 0, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3,
0, 7, 0, 1, 3, 0, 4, 0, 5, 0, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3,
4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1,
2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1,
];
Expand Down