Closed ilmarh closed 7 years ago
i've finaly managed to use your library to show v9 udp stream. here is derived collector with PduBuffer vars overide:
import socketserver import ipfix.v9pdu import ipfix.ie
import argparse
ap = argparse.ArgumentParser(description="Dump IPFIX files collected over UDP") ap.add_argument('--spec', metavar='specfile', help='iespec file to read') args = ap.parse_args()
ipfix.ie.use_iana_default() ipfix.ie.use_5103_default() if args.spec: ipfix.ie.use_specfile(args.spec)
msgcount = 0 templates = {} accepted_tids = set() def dummy1(o,b) : pass
class CollectorDictHandler(socketserver.DatagramRequestHandler):
def handle(self):
global msgcount
msgcount = msgcount + 1
reccount = 0
print ("connection from "+str(self.client_address))
r = ipfix.v9pdu.from_stream(self.rfile)
try:
r.templates = templates[str(self.client_address)]
except KeyError as e:
templates[str(self.client_address)] = {}
r.templates = templates[str(self.client_address)]
r.accepted_tids = accepted_tids
r.unknown_data_set_hook = dummy1
for rec in r.namedict_iterator():
print("--- record %u in message %u from %s---" %
(reccount, msgcount, str(self.client_address)))
reccount += 1
for key in rec:
print(" %30s => %s" % (key, str(rec[key])))
print("reccount = "+str(reccount))
ss = socketserver.UDPServer(("", 9995), CollectorDictHandler) ss.serve_forever()
Couldn't make collector_test.py work until line 27 change:
I suppose it's just an old example, because sources have new usage description.
btw, just want to ask if it is possible to parse netflow with this library. i thought, that it should, but saw version != 10 condition, and now confused. thank you