Netflow: index out of range [Huawei]

[naude-r]

we are receiving netflow v9 flows from a huawei device. vflow immediately errors out:

panic: runtime error: index out of range

goroutine 66 [running]:
github.com/VerizonDigital/vflow/ipfix.Interpret(0xc4202ceb20, 0xf, 0xc4202ceac0, 0xc420126918)
        /root/go/src/github.com/VerizonDigital/vflow/ipfix/interpret.go:67 +0x63c
github.com/VerizonDigital/vflow/netflow/v9.(*Decoder).decodeData(0xc4202ceeb0, 0x160523, 0xc4203b6000, 0x16, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
        /root/go/src/github.com/VerizonDigital/vflow/netflow/v9/decoder.go:345 +0x1f3
github.com/VerizonDigital/vflow/netflow/v9.(*Decoder).decodeSet(0xc4202ceeb0, 0xc4203702c0, 0x20, 0x2a, 0xc4202d6140, 0x0, 0x0)
        /root/go/src/github.com/VerizonDigital/vflow/netflow/v9/decoder.go:463 +0x422
github.com/VerizonDigital/vflow/netflow/v9.(*Decoder).Decode(0xc4202ceeb0, 0xc4203702c0, 0x20, 0x2a, 0x1, 0xb7c620, 0xc4202de000)
        /root/go/src/github.com/VerizonDigital/vflow/netflow/v9/decoder.go:399 +0x156
main.(*NetflowV9).netflowV9Worker(0xc420121b60, 0xc4203400c0)
        /root/go/src/github.com/VerizonDigital/vflow/vflow/netflow_v9.go:204 +0x394
main.(*NetflowV9).run.func1(0xc420121b60)
        /root/go/src/github.com/VerizonDigital/vflow/vflow/netflow_v9.go:107 +0x89
created by main.(*NetflowV9).run
        /root/go/src/github.com/VerizonDigital/vflow/vflow/netflow_v9.go:108 +0x180

can send a pcap file in a private mail if you prefer.

we are running the binary downloaded from the release page on redhat 7.2

[mehrdadrad]

Please send me your pcap (you can find my email at my github profile)
If your device support IPFIX, can you try it and see how it works?

[naude-r]

pcap has been send.

the huawei device only supports netflow v9 and netstream. unfortunately IPFIX is not an option.

[mehrdadrad]

Looks Huawei supports netstream protocol which "it much likes netflow". I think that's why the data is not as it must be and causes out of index issue. did you configure "ip netstream" ?

[naude-r]

have asked the admin. his response is below:

No, there seems to be two types of netflow exprts - one is FW session logs with (which we cant configure the version of, and Huawei calim to be version 9)
the other is a global config for all FW traffic
(which  is what    ip netstream export version 9   refers to)

in short: we are not sure....which is probably related to the issue.

looks like we will have to investigate other options for now.

thank you for the time / effort.

[mehrdadrad]

@naude-r the issue just fixed. if you get a chance to try again please let me know

[naude-r]

@mehrdadrad Thank you. Will try again.