search

snabbco / snabb

Snabb: Simple and fast packet networking
Apache License 2.0
2.98k stars 301 forks source link

Ipfix tls template #1505

Closed alexandergall closed 1 year ago

alexandergall commented 1 year ago

The v4_HTTPS and v6_HTTPS templates extract the TLS Server Name Indication (SNI) from the Client Hello handshake message. Due to lack of a standardised IPFIX element, the name is stored in a proprietary string field with PEN 39499 to be compatible with the Progress/Flowmon netflow collector. The field is using a fixed width of 64 bytes and the actual length of the name is stored in a separate element.

alexandergall commented 1 year ago

I'm going to clean up the code and create a new PR.