invalid source as

[thezoggy]

IANA has also reserved, for Private Use, a contiguous block of 94,967,295 Autonomous System numbers from the "32-bit Autonomous System Numbers" registry, namely 4200000000 - 4294967294 inclusive.

nfdump -V
nfdump: Version: 1.7.2-de9811c Options: ZSTD Date: 2023-06-18 16:06:33 +0200

was looking at some data and saw this erroneous src as:

Date first seen                 Duration Proto            Src AS    Flows(%)     Packets(%)       Bytes(%)         pps      bps   bpp
2023-07-09 10:49:04.834     00:10:23.187 any                   0     6044(22.2)    3.2 G(17.5)  148.1 G(20.9)    5.1 M    1.9 G    46
2023-07-09 10:53:55.613     00:00:41.400 any               18403     6010(22.1)    2.1 G(11.8)   80.6 G(11.4)   51.9 M   15.6 G    37
2023-07-09 03:27:51.296     07:32:04.224 any          4294967295     3853(14.2)    3.1 G(17.0)   94.6 G(13.4)   114425   27.9 M    30
2023-07-09 10:49:34.926     00:10:09.124 any               12400     1070( 3.9)   26.7 M( 0.1)    5.9 G( 0.8)    43759   77.0 M   219

sadly i do not have the data anymore because of limited retention. I'm running some queries on newer data to try and replicate. but wanted to toss it up here in case you had an idea what it might be

[phaag]

Can you explain, what's wrong with the output and why it's an nfdump issue?

[thezoggy]

The asn reported in the output is not a valid asn? 4294967295

[phaag]

Well, it’s a private and valid AS. Why do you think it’s an nfdump issue? You did not explain the setup and the command line you used as well why you thing, this could be a bug.

[phaag]

It's 0xFFFFFFFF the max value for a 32bit ASN number.

[thezoggy]

it was just looking at traffic towards a prefix with nfsen, but topN towards dst asn

nfdump -M /data/nfsen/profiles-data/live/<routers>:<routers+>  -T  -R 2023/07/09/nfcapd.202307090000:2023/07/09/nfcapd.202307090030 -n 10 -s dstas/flows 'proto udp and dst net 185.230.60.0/22'

and as noted sadly I do not have the nfcapd data to pull out to verify more info to dig into.

mainly just bringing it up in case others see it or you've seen of it before as I've personally never seen it show up exepct that I know we drop bogon asn on ingress (which of course wouldnt matter for netflow ingress)

    policy-statement bogon-asn-in {
        term drop-bogon-asns {
            from {
                as-path-group bogon-asns;
            }
            then reject;
        }
    }

    as-path-group bogon-asns {
        as-path reserved0 ".* 0 .*";
        as-path as_trans ".* 23456 .*";
        as-path reserved1 ".* [64496-131071] .*";
        as-path reserved2 ".* [4200000000-4294967295] .*";
    }

Just looking at network wide for dst as gt 4200000000 for earlier time bucket I do see quite a few flows..

... -r 2023/07/30/nfcapd.202307300835 -o 'fmt:%ts %ra - %pr %sas -> %das %fl' -c 50000 'dst as gt 4200000000'
Date first seen                Router IP   Proto Src AS    Dst AS Flows
2023-07-30 08:34:47.680      129.250.1.2 - TCP    16509 -> 4294967295     1
2023-07-30 08:34:47.936      129.250.1.2 - TCP    20940 -> 4294967295     1
2023-07-30 08:34:49.216      129.250.1.2 - TCP    16509 -> 4294967295     1
2023-07-30 08:34:49.984      129.250.1.2 - TCP   208136 -> 4294967295     1
2023-07-30 08:34:52.800      129.250.1.2 - TCP    39572 -> 4294967295     1
2023-07-30 08:34:48.448      129.250.1.2 - TCP    20940 -> 4294967295     1
2023-07-30 08:34:54.080      129.250.1.2 - UDP    12353 -> 4294967295     1
2023-07-30 08:34:43.072      129.250.1.2 - TCP    20940 -> 4294967295     1
2023-07-30 08:35:00.224      129.250.1.2 - TCP    20940 -> 4294967295     1
2023-07-30 08:35:01.760      129.250.1.2 - UDP    24309 -> 4294967295     1
2023-07-30 08:35:05.344      129.250.1.2 - TCP    16509 -> 4294967295     1
2023-07-30 08:35:06.368      129.250.1.2 - TCP    16509 -> 4294967295     1
2023-07-30 08:35:08.672      129.250.1.2 - TCP    16509 -> 4294967295     1
...
2023-07-30 08:39:08.032      129.250.1.2 - ICMP6  16509 -> 4294967295     1
2023-07-30 08:39:05.216      129.250.1.2 - UDP     4812 -> 4294967295     1
2023-07-30 08:39:09.568      129.250.1.2 - TCP    16509 -> 4294967295     1
2023-07-30 08:39:10.080      129.250.1.2 - TCP    20940 -> 4294967295     1
2023-07-30 08:39:09.824      129.250.1.2 - TCP    20940 -> 4294967295     1
2023-07-30 08:39:10.336      129.250.1.2 - TCP     1136 -> 4294967295     1
2023-07-30 08:39:14.176      129.250.1.2 - TCP    16509 -> 4294967295     1
2023-07-30 08:39:13.408      129.250.1.2 - TCP      174 -> 4294967295     1
2023-07-30 08:39:16.992      129.250.1.2 - TCP    20940 -> 4294967295     1
2023-07-30 08:39:18.272      129.250.1.2 - TCP    16509 -> 4294967295     1
2023-07-30 08:38:56.000      129.250.1.2 - TCP    20940 -> 4294967295     1
2023-07-30 08:39:16.224      129.250.1.2 - TCP    20940 -> 4294967295     1
2023-07-30 08:39:10.848      129.250.1.2 - TCP    20940 -> 4294967295     1
...

looking at another time bucket, seeing some odd ones

-r 2023/07/30/nfcapd.202307302035 -o 'fmt:%ts %ra - %pr %sas -> %das %fl' -c 5000 'dst as gt 4200000000'
Date first seen                Router IP   Proto Src AS    Dst AS Flows
2023-07-30 20:34:52.544    129.250.0.190 - UDP   4294967295 -> 4294967295     1
2023-07-30 20:35:11.232    129.250.0.190 - UDP   4294967295 -> 4294967295     1
2023-07-30 20:37:10.016     129.250.1.11 - UDP   4294967295 -> 4294967295     1
2023-07-30 20:37:11.552     129.250.1.11 - UDP   4294967295 -> 4294967295     1
2023-07-30 20:37:01.312     129.250.0.54 - ICMP  136907 -> 4294967295     1
2023-07-30 20:34:49.984      129.250.1.2 - TCP    20940 -> 4294967295     1
2023-07-30 20:34:49.216      129.250.1.2 - TCP    16509 -> 4294967295     1
2023-07-30 20:34:48.192      129.250.1.2 - TCP    20940 -> 4294967295     1
...

I will run some tcpdump and capture flows to fact check if what nfsen is seeing is actually correct

[thezoggy]

looking around it looks like its only some v6<>v6 traffic that shows up this way.

taking packet capture of netflow coming in, I see the same thing there as well

even in the pcap i see stuff from this asn v6 to other v6 just fine as well as other src asn v6<>v6 with it. tomorrow will take some pcaps from the vendor itself to see from there

ok it looks like its traffic that goes to v6 customer that doesnt use bgp, just v6 na/nd setup so there is no actual dst asn... so guessing the value is just used a placeholder or something.

[phaag]

ok - I see then, it's a general question and not a bug of nfdump :) I guess you have to check that with your router vendor unless someone else has an answer. Please add general questions to the discussion board and not to the issue section, as this is meant to deal with nfdump issues. I will move this to the discussion board.