search

bitkeks / python-netflow-v9-softflowd

PyPI "netflow" package. NetFlow v9 parser, collector and analyzer implemented in Python 3. Developed and tested with softflowd
https://bitkeks.eu/blog/2016/08/collecting-netflow-v9-on-openwrt.html
MIT License
108 stars 55 forks source link

Analyzer error #17

Open hoangvu304 opened 4 years ago

hoangvu304 commented 4 years ago

Hi @bitkeks , Thank for your app. I try it today, capture some packet from a ASR 1002 router netflow v9 export. But when I analyzer .gz file, it's show error: (p3venv) [vuht@dashboard python-netflow-v9-softflowd]$ python analyzer.py -f 1581912445.gz Traceback (most recent call last): File "analyzer.py", line 215, in for flow in sorted(flows, key=lambda x: x["FIRST_SWITCHED"]): File "analyzer.py", line 215, in for flow in sorted(flows, key=lambda x: x["FIRST_SWITCHED"]): KeyError: 'FIRST_SWITCHED'

bitkeks commented 4 years ago

Hi @hoangvu304, sorry for the long delay! Do you still have your capture file? I'd be interested in seeing, which fields are actually contained in your exports. You could try to add a print(flows[0]) in line 242 https://github.com/bitkeks/python-netflow-v9-softflowd/blob/f8c5717002c431fbda9189713d038d2d9be7ccac/analyzer.py#L241-L243 This might reveal the fields. Sadly, the docs on the ASR 1002 do not state which fields are exported, but maybe we can figure out if there's another field that has the same effect (timestamp). Or did you use "Flexible Netflow"? This seems to be an newer, extended NetFlow v9 implementation by Cisco which is configured differently.