calmh / ipfix

IPFIX parser package for Go
MIT License
48 stars 26 forks source link

support reverse pen (RFC 5103) #1

Closed georgmu closed 9 years ago

georgmu commented 9 years ago

This tiny addition allows parsing bidirectional flow exports as described in RFC 5103:

Example (using ipfixcat): Before:

...
       {
            "name": "octetTotalCount",
            "field": 85,
            "value": 0
        },
        {
            "name": "",
            "enterprise": 29305,
            "field": 85,
            "raw": [ 0, 0, 0, 0, 0, 0, 54,36 ]
        },
...

After:

...
       {
            "name": "octetTotalCount",
            "field": 85,
            "value": 0
        },
        {
            "name": "octetTotalCountReverse",
            "enterprise": 29305,
            "field": 85,
            "value": 13860
        },
...
calmh commented 9 years ago

Thanks for bringing this to my attention! I decided to implement it slightly differently, by adding them directly to the built in dictionary instead, hope that's OK.

georgmu commented 9 years ago

Sure, your one looks better ;)

Thank you!

georgmu commented 9 years ago

One more thing: The biflow direction field (239) is a standard field, not a field of the ReversePEN.

calmh commented 9 years ago

Of course it is. :/ I missed that.

calmh commented 9 years ago

I fixed that now. Once builtin-dict is based on the XML I expect it shouldn't need to be added manually any more.