Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Cisco ASA netflow handling #5729

Merged
merged 2 commits into from Mar 21, 2019
Merged

Fix Cisco ASA netflow handling #5729

merged 2 commits into from Mar 21, 2019

Conversation

@mpfz0r
Copy link
Member

@mpfz0r mpfz0r commented Feb 27, 2019

Don't try to parse ASA acl ids.
Improve parsing of strings:
Empty strings are received as a byte array full of zeros.
Properly convert them to empty Strings.

At some point Cisco decided to stop including packet and byte counters
in their netflow data. toMessageString expected them to always be
there and would trigger an NPE.
Try to fallback on Ciscos flow delta counters, so we have at least
something meaningful in the message field.
Fixes #5715

mpfz0r added 2 commits Feb 27, 2019
Don't try to parse ASA acl ids.
Improve parsing of strings:
Empty strings are received as a byte array full of zeros.
Properly convert them to empty Strings.

Add a test pcap for ASA netflow data.
At some point Cisco decided to stop including packet and byte counters
in their netflow data. `toMessageString` expected them to always be
there and would trigger an NPE.
Try to fallback on Ciscos flow delta counters, so we have at least
something meaningful in the message field.

Fixes #5715
@mpfz0r mpfz0r requested a review from kroepke Mar 4, 2019
@mpfz0r mpfz0r removed the request for review from kroepke Mar 15, 2019
@dennisoelkers dennisoelkers self-assigned this Mar 21, 2019
@dennisoelkers dennisoelkers merged commit 74640ab into master Mar 21, 2019
4 checks passed
@dennisoelkers dennisoelkers deleted the issue-5715 branch Mar 21, 2019
mpfz0r added a commit that referenced this issue Mar 21, 2019
* Fix more Cisco ASA netflow parsing issues

Don't try to parse ASA acl ids.
Improve parsing of strings:
Empty strings are received as a byte array full of zeros.
Properly convert them to empty Strings.

Add a test pcap for ASA netflow data.

* Handle ASA netflow data without byte and packet counters

At some point Cisco decided to stop including packet and byte counters
in their netflow data. `toMessageString` expected them to always be
there and would trigger an NPE.
Try to fallback on Ciscos flow delta counters, so we have at least
something meaningful in the message field.

Fixes #5715

(cherry picked from commit 74640ab)
dennisoelkers added a commit that referenced this issue Mar 21, 2019
* Fix more Cisco ASA netflow parsing issues

Don't try to parse ASA acl ids.
Improve parsing of strings:
Empty strings are received as a byte array full of zeros.
Properly convert them to empty Strings.

Add a test pcap for ASA netflow data.

* Handle ASA netflow data without byte and packet counters

At some point Cisco decided to stop including packet and byte counters
in their netflow data. `toMessageString` expected them to always be
there and would trigger an NPE.
Try to fallback on Ciscos flow delta counters, so we have at least
something meaningful in the message field.

Fixes #5715

(cherry picked from commit 74640ab)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

2 participants