search

CESNET / ipfixcol

IPFIXcol is an implementation of an IPFIX (RFC 7011) collector
Other
64 stars 37 forks source link

Last template before options template not parsed properly #15

Closed ghost closed 9 years ago

ghost commented 9 years ago

We currently have a trace (basically the same one as for issue #14) that contains NetFlow v9 datagrams. Some of those datagrams feature four template records (ID: 257-260), followed by an options template (ID: 261). However, when running IPFIXcol in high-verbosity mode (-v 3), I see the following output:

DEBUG: ipfix_message: [97] Processing data.
WARNING: preprocessor: [97] Template ID 256 already exists. Rewriting.
DEBUG: template manager: Creating new template 257
WARNING: preprocessor: [97] Template ID 257 already exists. Rewriting.
DEBUG: template manager: Creating new template 258
WARNING: preprocessor: [97] Template ID 258 already exists. Rewriting.
DEBUG: template manager: Creating new template 259
WARNING: preprocessor: [97] Template ID 1 is reserved and not valid for data set!
WARNING: preprocessor: [97] Cannot parse template set, skipping to next set
WARNING: preprocessor: [97] Options template ID 259 already exists. Rewriting.
DEBUG: template manager: Creating new template 261

As you can see, the last template record (with ID '260') is not parsed properly; IPFIXcol reports ID '1' and skips further processing. I've prepared a short trace for you that triggers the behavior. Please contact me at kirc&secdorks.net to get the trace.

ghost commented 9 years ago

More debugging has revealed that this issue is closely related to #16. I'll therefore close this ticket and add more information to #16.