Closed ddraveh closed 5 years ago
Strangely reveflowStartMilliSeconds appears in a lot of the examples, yet does not appear in the code base anywhere.
10:06 $ grep -r -i flowStartMilliSeconds * | grep rev
configs/offlineprinter.xml: <ieName>revflowStartMilliSeconds</ieName>
configs/interop/simple_linux.xml: <ieName>revflowStartMilliSeconds</ieName>
configs/interop/simple_freebsd.xml: <ieName>revflowStartMilliSeconds</ieName>
configs/interop/csnet_udp_export.xml: <ieName>revflowStartMilliSeconds</ieName>
configs/interop/simple_sctp_export_linux.xml: <ieName>revflowStartMilliSeconds</ieName>
configs/interop/simple_udp_export_linux.xml: <ieName>revflowStartMilliSeconds</ieName>
configs/mongo/mongow.xml: <ieName>revflowStartMilliSeconds</ieName>
configs/sctp_exporter.xml: <ieName>revflowStartMilliSeconds</ieName>
configs/db/dbwriter.xml: <ieName>revflowStartMilliSeconds</ieName>
configs/analysis/autofocus_vermont.xml: <ieName>revflowStartMilliSeconds</ieName>
configs/analysis/rbsworm_vermont.xml: <ieName>revflowStartMilliSeconds</ieName>
configs/analysis/autofocus_eval.xml: <ieName>revflowStartMilliSeconds</ieName>
configs/oracle/oxewriter.xml: <ieName>revflowStartMilliSeconds</ieName>
configs/example.xml: <ieName>revflowStartMilliSeconds</ieName>
configs/example.xml: <ieName>revflowStartMilliSeconds</ieName>
src/modules/ipfix/Connection.cpp: fi = record->templateInfo->getFieldInfo(IPFIX_TYPEID_flowStartMilliseconds, IPFIX_PEN_reverse);
src/modules/ipfix/database/IpfixDbWriterSQL.cpp: { CN_revFirstSwitched, IPFIX_TYPEID_flowStartMilliseconds, "", IPFIX_PEN_reverse, 0}, // default value is invalid/not used for this entry
src/modules/ipfix/database/IpfixDbWriterSQL.cpp: // look for alternative (revFlowStartMilliseconds/1000)
src/modules/ipfix/database/IpfixDbWriterSQL.cpp: if(dataTemplateInfo->fieldInfo[k].type == InformationElement::IeInfo(IPFIX_TYPEID_flowStartMilliseconds, IPFIX_PEN_reverse)) {
src/modules/ipfix/database/IpfixDbWriterMongo.cpp: {CN_revFirstSwitchedMillis, 0, IPFIX_TYPEID_flowStartMilliseconds, IPFIX_PEN_reverse},
src/modules/ipfix/database/IpfixDbWriterMongo.cpp: // look for alternative (revFlowStartMilliseconds/1000)
src/modules/ipfix/database/IpfixDbWriterMongo.cpp: if(dataTemplateInfo.fieldInfo[k].type == InformationElement::IeInfo(IPFIX_TYPEID_flowStartMilliseconds, IPFIX_PEN_reverse)) {
src/modules/ipfix/IpfixCsExporter.cpp: uint64_t revtimestart = retrieveTime(record, IPFIX_TYPEID_flowStartNanoseconds, IPFIX_TYPEID_flowStartMilliseconds,
8da0d26785987749c4cce97d1724ed0e83f7060e appears to have removed this:
- { IPFIX_TYPEID_flowStartMilliSeconds, IPFIX_LENGTH_flowStartMilliSeconds, IPFIX_PEN_reverse, "revFlowStartMilliSeconds" },
from src/common/ipfixlolib/ipfix_names.c
but unlike most other fields which were added to src/common/ipfixlolib/ipfix_iana.c the revFlow... fields do appear to have been added anywhere.
Perhaps @ogasser, who made this change can comment? Are these field missing and need added somewhere? Or is there nolonger support for them, and all the config example need updated?
Yes, this was removed as part of the automatic IPFIX IE generation from IANA sources.
This should be integrated again into the code, but instead of using the rev
prefix I suggest to use a reverse attribute: <ieName reverse="true">flowStartMilliSeconds</ieName>
.
@evintila will have a look at implementing this. After the implementation is done, we should also update the example config files and the wiki.
Or maybe even better:
<nonFlowKey>
<ieName>flowStartMilliSeconds</ieName>
<reverse>true</reverse>
</nonFlowKey>
Hey,
I still can't seem to get revflowStartMilliSeconds, even with the solutions provided by the last two comments by @ogasser. Wireshark doesn't show these two fields, not even in the templates. Any help please?
The last two comments discuss how a solution for this could be implemented. That implementation has not yet been done. For the moment there are no rev... element supported, so any modules that require these to operate will not function. For example biflowAggregation is not possible without them, so <biflowAggregation>1</biflowAggregation>
would need removed from configs/example.xml. <trwPortscanDetector>
also requires biflows so it will also not work, so should probably be removed from configs/example.xml
Hi, I was trying to use VERMONT on Ubuntu 14.04. Following the instruction, building and installation passed without errors but trying to run with the default example generate some exceptions, for example:
Removing the 'problematic' elements names from example.xml, I finally got this error, which I was not able to overcome:
Please advise, Many thanks,
Danny