search

netsampler / goflow2

High performance sFlow/IPFIX/NetFlow Collector
BSD 3-Clause "New" or "Revised" License
487 stars 112 forks source link

add string to hexa renderer to parse Ipfix ovs field virtual_obs_id #275

Closed limbo127 closed 10 months ago

limbo127 commented 10 months ago

Hello, I don't know if it the right code, but this permit de parse an ipFix field from openvswitch, send as "hexa string". Regards, Nicolas

limbo127 commented 10 months ago

Hello, to be more specific : https://manpages.debian.org/testing/openvswitch-common/ovs-vswitchd.conf.db.5.en.html#other_config~263 this string seems to be send as hexa encode, goflow2 output as sample form : {"type":"IPFIX","time_received_ns":"2024-01-10T08:07:36.141871548Z","sequence_num":8679,"sampling_rate":0,"flow_direction":1,"sampler_address":"fcf0:873a:7ee0:5f83:177d:f856:e959:ed45","time_flow_start_ns":1704874139760000000,"time_flow_end_ns":1704874139760000000,"bytes":75200,"packets":400,"src_addr":"172.10.15.20","src_net":"0.0.0.0/0","dst_addr":"18.169.222.153","dst_net":"0.0.0.0/0","etype":"IPv4","proto":"UDP","src_port":34297,"dst_port":443,"in_if":8,"out_if":2,"src_mac":"04:d4:c4:6a:8b:c2","dst_mac":"00:0c:29:c5:e8:2d","icmp_name":"unknown","vlan_id":0,"src_vlan":0,"virtual_obs_id":"746573742d3031"}

with my PR en set hexa as renderer, i can obtain a right conversion : {"type":"IPFIX","time_received_ns":"2024-01-10T08:06:52.134866643Z","sequence_num":312,"sampling_rate":0,"flow_direction":1,"sampler_address":"fcf0:873a:7ee0:5f83:177d:f856:e959:ed45","time_flow_start_ns":1704874095753000000,"time_flow_end_ns":1704874095753000000,"bytes":0,"packets":400,"src_addr":"","src_net":"invalid Prefix","dst_addr":"","dst_net":"invalid Prefix","etype":"","proto":"","src_port":0,"dst_port":0,"in_if":10,"out_if":11,"src_mac":"02:ed:f2:97:09:8d","dst_mac":"01:80:c2:00:00:02","icmp_name":"unknown","vlan_id":0,"src_vlan":0,"virtual_obs_id":"test-01"}

the raw producer : {"pen-provided":true,"type":898,"pen":6876,"value":"dGVzdC0wMQ=="}, for this field

Nicolas

lspgn commented 10 months ago

I made #277 as I found a mistake in my code. Bytes in protobuf should not have been converted to hexa in the first place. Also this names the renderer as string which is more appropriate. Also adds a test.