search

Graylog2 / graylog-plugin-netflow

[DEPRECATED] Graylog NetFlow plugin
https://www.graylog.org/
Apache License 2.0
39 stars 17 forks source link

Netflow v9 Flows with no template present (yet) should be stored instead of discarded. #18

Closed dennisoelkers closed 6 years ago

dennisoelkers commented 6 years ago

Right now we are discarding flows when the associated template is not present (yet), while RFC3954 states that:

   If the Template Records have not been
   received at the time Flow Data Records (or Options Data Records) are
   received, the Collector SHOULD store the Flow Data Records (or
   Options Data Records) and decode them after the Template Records are
   received.  A Collector device MUST NOT assume that the Data FlowSet
   and the associated Template FlowSet (or Options Template FlowSet) are
   exported in the same Export Packet.

Temporary buffering of flows where the template is not present (yet) should be implemented and once the template was received, associated flows should be processed.