cisco / joy

A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.
Other
1.3k stars 329 forks source link

Missing octet count processing in ipfix #279

Open mjtooley opened 5 years ago

mjtooley commented 5 years ago

It looks likes the code is missing the code to process the number of octets in an ipfix low record. I looked through ipfix.c and I can’t find anyplace where it processes this element in an ipfix flow record.

I stumbled across this as I was trying to use joy to process a pcp file of an ipfix capture. I ran joy with the option ‘ipfix_collector_port=2055 and then used as input a pcap file. It processed my ipfix flow records but in the json output the ‘bytes_out’ is zero in all the records.

Pretty sure this isn’t how it was intended to work.