From bf0c8e879f2f640fc22e0766aae84af19be4238a Mon Sep 17 00:00:00 2001 From: Sven Rebhan <36194019+srebhan@users.noreply.github.com> Date: Fri, 10 May 2024 17:15:30 -0400 Subject: [PATCH] feat(inputs.netflow): Add support for IPFIX option packets (#15314) --- plugins/inputs/netflow/netflow_decoder.go | 28 ++++ .../testcases/ipfix_example/expected.out | 2 + .../testcases/ipfix_options/expected.out | 126 ++++++++++++++++++ .../testcases/ipfix_options/message-001.bin | Bin 0 -> 1204 bytes .../testcases/ipfix_options/message-002.bin | Bin 0 -> 1182 bytes .../testcases/ipfix_options/message-003.bin | Bin 0 -> 1182 bytes .../testcases/ipfix_options/message-004.bin | Bin 0 -> 1182 bytes .../testcases/ipfix_options/message-005.bin | Bin 0 -> 1182 bytes .../testcases/ipfix_options/message-006.bin | Bin 0 -> 1182 bytes .../testcases/ipfix_options/message-007.bin | Bin 0 -> 1182 bytes .../testcases/ipfix_options/message-008.bin | Bin 0 -> 1182 bytes .../testcases/ipfix_options/message-009.bin | Bin 0 -> 1182 bytes .../testcases/ipfix_options/telegraf.conf | 2 + 13 files changed, 158 insertions(+) create mode 100644 plugins/inputs/netflow/testcases/ipfix_options/expected.out create mode 100644 plugins/inputs/netflow/testcases/ipfix_options/message-001.bin create mode 100644 plugins/inputs/netflow/testcases/ipfix_options/message-002.bin create mode 100644 plugins/inputs/netflow/testcases/ipfix_options/message-003.bin create mode 100644 plugins/inputs/netflow/testcases/ipfix_options/message-004.bin create mode 100644 plugins/inputs/netflow/testcases/ipfix_options/message-005.bin create mode 100644 plugins/inputs/netflow/testcases/ipfix_options/message-006.bin create mode 100644 plugins/inputs/netflow/testcases/ipfix_options/message-007.bin create mode 100644 plugins/inputs/netflow/testcases/ipfix_options/message-008.bin create mode 100644 plugins/inputs/netflow/testcases/ipfix_options/message-009.bin create mode 100644 plugins/inputs/netflow/testcases/ipfix_options/telegraf.conf diff --git a/plugins/inputs/netflow/netflow_decoder.go b/plugins/inputs/netflow/netflow_decoder.go index 80bcd7421d8ae..8285db76318f0 100644 --- a/plugins/inputs/netflow/netflow_decoder.go +++ b/plugins/inputs/netflow/netflow_decoder.go @@ -634,6 +634,34 @@ func (d *netflowDecoder) Decode(srcIP net.IP, payload []byte) ([]telegraf.Metric case netflow.TemplateFlowSet: case netflow.IPFIXOptionsTemplateFlowSet: case netflow.OptionsDataFlowSet: + for _, record := range fs.Records { + tags := map[string]string{ + "source": src, + "version": "IPFIX", + } + fields := make(map[string]interface{}) + for _, value := range record.ScopesValues { + decodedFields, err := d.decodeValueIPFIX(value) + if err != nil { + d.Log.Errorf("decoding option record %+v failed: %v", record, err) + continue + } + for _, field := range decodedFields { + fields[field.Key] = field.Value + } + } + for _, value := range record.OptionsValues { + decodedFields, err := d.decodeValueIPFIX(value) + if err != nil { + d.Log.Errorf("decoding option record %+v failed: %v", record, err) + continue + } + for _, field := range decodedFields { + fields[field.Key] = field.Value + } + } + metrics = append(metrics, metric.New("netflow_options", tags, fields, t)) + } case netflow.DataFlowSet: for _, record := range fs.Records { tags := map[string]string{ diff --git a/plugins/inputs/netflow/testcases/ipfix_example/expected.out b/plugins/inputs/netflow/testcases/ipfix_example/expected.out index 9e3694868f30e..faef835e6d174 100644 --- a/plugins/inputs/netflow/testcases/ipfix_example/expected.out +++ b/plugins/inputs/netflow/testcases/ipfix_example/expected.out @@ -27,3 +27,5 @@ netflow,source=127.0.0.1,version=IPFIX type_29305_86="0x00000009",flow_end_ms=16 netflow,source=127.0.0.1,version=IPFIX vlan_src=0u,type_29305_85="0x00001590",src="192.168.119.100",protocol="udp",dst_port=443u,type_29305_58="0x0000",type_29305_86="0x00000015",flow_start_ms=1666345514168u,src_tos="0x00",type_6871_rev_40="0x0000",dst="142.250.186.170",in_total_packets=17u,src_port=58246u,type_6871_21="0x00000012",flow_end_ms=1666345525871u,flow_end_reason="forced end",type_29305_5="0x00",type_6871_40="0x0000",in_total_bytes=3248u 1684917213508463452 netflow,source=127.0.0.1,version=IPFIX dst="140.82.121.3",flow_start_ms=1666345521019u,type_29305_86="0x000000d4",type_6871_40="0x0000",type_29305_85="0x0003e1d9",in_total_packets=125u,protocol="tcp",flow_end_reason="forced end",in_total_bytes=16640u,type_29305_58="0x0000",flow_end_ms=1666345525880u,type_6871_21="0x00000009",type_29305_5="0x00",dst_port=443u,src_tos="0x00",type_6871_rev_40="0x0000",vlan_src=0u,src="192.168.119.100",src_port=37792u 1684917213508608204 netflow,source=127.0.0.1,version=IPFIX type_6871_40="0x0001",src="192.168.119.100",vlan_src=0u,type_6871_rev_40="0x0000",type_29305_58="0x0000",src_port=50077u,flow_end_ms=1666345527739u,type_29305_5="0x00",flow_start_ms=1666345527739u,in_total_packets=2u,src_tos="0x00",flow_end_reason="forced end",type_6871_21="0x00000000",type_29305_86="0x00000002",dst_port=53u,in_total_bytes=120u,type_29305_85="0x000000a4",protocol="udp",dst="192.168.119.17" 1684917213508754156 +netflow_options,source=127.0.0.1,version=IPFIX dropped_packets_total=0u,event_time=1666725027u,exporter="192.168.119.100",exporting_pid=66602u,ignored_packet_total=22u,in_total_packets=1070u,notsent_packet_total=0u,observation_domain_id=0u,system_init_ms=1666725027000u,total_flows_exported=29u,type_6871_32868="0x00000000",type_6871_32869="0x00000000",type_6871_32870="0x00001d1f",type_6871_32871="0x00043278",type_6871_32872="0x00000004",type_6871_32873="0x0000001a" 1715165599875551764 +netflow_options,source=127.0.0.1,version=IPFIX event_time=1666725027u,exporting_pid=66602u,observation_domain_id=0u,padding="0x000000000000",type_6871_33318="0x00000000",type_6871_33319="0x0000",type_6871_33322="0x00d00500000001635834a3" 1715165599878686750 \ No newline at end of file diff --git a/plugins/inputs/netflow/testcases/ipfix_options/expected.out b/plugins/inputs/netflow/testcases/ipfix_options/expected.out new file mode 100644 index 0000000000000..0fc7aef95d514 --- /dev/null +++ b/plugins/inputs/netflow/testcases/ipfix_options/expected.out @@ -0,0 +1,126 @@ +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Third Party Connect Protocol",app_id="0x01000022",app_name="3pc" 1715165504617351694 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Active Networks",app_id="0x0100006b",app_name="an" 1715165504617351694 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="any host internal protocol",app_id="0x0100003d",app_name="any-host-internal" 1715165504617351694 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="ARGUS",app_id="0x0100000d",app_name="argus" 1715165504617351694 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="ARIS",app_id="0x01000068",app_name="aris" 1715165504617351694 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="AX.25 Frames",app_id="0x0100005d",app_name="ax25" 1715165504617351694 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="BBN RCC Monitoring",app_id="0x0100000a",app_name="bbnrccmon" 1715165504617351694 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="BNA",app_id="0x01000031",app_name="bna" 1715165504617351694 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Backroom SATNET Monitoring",app_id="0x0100004c",app_name="br-sat-mon" 1715165504617351694 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="CBT",app_id="0x01000007",app_name="cbt" 1715165504617351694 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="CFTP",app_id="0x0100003e",app_name="cftp" 1715165504617351694 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Chaos",app_id="0x01000010",app_name="chaos" 1715165504617351694 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Compaq Peer Protocol",app_id="0x0100006e",app_name="compaq-peer" 1715165504617351694 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Computer Protocol Heart Beat",app_id="0x01000049",app_name="cphb" 1715165504617351694 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Computer Protocol Network Executive",app_id="0x01000048",app_name="cpnx" 1715165504617776018 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Combat Radio Transport Protocol",app_id="0x0100007e",app_name="crtp" 1715165504617776018 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Combat Radio User Datagram",app_id="0x0100007f",app_name="crudp" 1715165504617776018 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Datagram Congestion Control Protocol",app_id="0x01000021",app_name="dccp" 1715165504617776018 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="DCN Measurement Subsystems",app_id="0x01000013",app_name="dcn-meas" 1715165504617776018 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Datagram Delivery Protocol",app_id="0x01000025",app_name="ddp" 1715165504617776018 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="D-II Data Exchange",app_id="0x01000074",app_name="ddx" 1715165504617776018 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Dissimilar Gateway Protocol",app_id="0x01000056",app_name="dgp" 1715165504617776018 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Dynamic Source Routing Protocol",app_id="0x01000030",app_name="dsr" 1715165504617776018 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Exterior Gateway Protocol",app_id="0x01000008",app_name="egp" 1715165504617776018 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Enhanced Interior Gateway Routing Protocol",app_id="0x01000058",app_name="eigrp" 1715165504617776018 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="EMCON",app_id="0x0100000e",app_name="emcon" 1715165504617776018 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Encapsulation Header",app_id="0x01000062",app_name="encap" 1715165504617776018 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Ethernet-within-IP Encapsulation",app_id="0x01000061",app_name="etherip" 1715165504617776018 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Fibre Channel",app_id="0x01000085",app_name="fc" 1715165504618074830 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="FIRE",app_id="0x0100007d",app_name="fire" 1715165504618074830 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Gateway-to-Gateway",app_id="0x01000003",app_name="ggp" 1715165504618074830 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="graphical Media Transfer Protocol ",app_id="0x01000064",app_name="gmtp" 1715165504618074830 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="General Routing Encapsulation",app_id="0x0100002f",app_name="gre" 1715165504618074830 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Host Identity Protocol",app_id="0x0100008b",app_name="hip" 1715165504618074830 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Host Monitoring",app_id="0x01000014",app_name="hmp" 1715165504618074830 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="DEPRECATED, traffic will not match",app_id="0x01000000",app_name="hopopt" 1715165504618074830 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Integrated Net Layer Security TUBA",app_id="0x01000034",app_name="i-nlsp" 1715165504618074830 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Interactive Agent Transfer Protocol",app_id="0x01000075",app_name="iatp" 1715165504618074830 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Internet Control Message Protocol",app_id="0x01000001",app_name="icmp" 1715165504618074830 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Inter-Domain Policy Routing Protocol",app_id="0x01000023",app_name="idpr" 1715165504618074830 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="IDPR Control Message Transport Proto",app_id="0x01000026",app_name="idpr-cmtp" 1715165504618074830 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Inter-Domain Routing Protocol",app_id="0x0100002d",app_name="idrp" 1715165504618074830 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Ipsilon Flow Management Protocol",app_id="0x01000065",app_name="ifmp" 1715165504618379393 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Cisco interior gateway ",app_id="0x01000009",app_name="igrp" 1715165504618379393 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="IL Transport Protocol",app_id="0x01000028",app_name="il" 1715165504618379393 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="IP Payload Compression Protocol",app_id="0x0100006c",app_name="ipcomp" 1715165504618379393 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Internet Packet Core Utility",app_id="0x01000047",app_name="ipcv" 1715165504618379393 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="IP in IP",app_id="0x01000004",app_name="ipinip" 1715165504618379393 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="IP-within-IP Encapsulation Protocol",app_id="0x0100005e",app_name="ipip" 1715165504618379393 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="IPLT",app_id="0x01000081",app_name="iplt" 1715165504618379393 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Internet Pluribus Packet Core",app_id="0x01000043",app_name="ippc" 1715165504618379393 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="DEPRECATED, traffic will not match",app_id="0x0100002c",app_name="ipv6-frag" 1715165504618379393 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="ICMP for IPv6",app_id="0x0100003a",app_name="ipv6-icmp" 1715165504618379393 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="DEPRECATED, traffic will not match",app_id="0x0100003b",app_name="ipv6-nonxt" 1715165504618379393 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="DEPRECATED, traffic will not match",app_id="0x0100003c",app_name="ipv6-opts" 1715165504618379393 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="DEPRECATED, traffic will not match",app_id="0x0100002b",app_name="ipv6-route" 1715165504618379393 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Ipv6 encapsulated",app_id="0x01000029",app_name="ipv6inip" 1715165504618664785 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="IPX in IP",app_id="0x0100006f",app_name="ipx-in-ip" 1715165504618664785 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Internet Reliable Transaction",app_id="0x0100001c",app_name="irtp" 1715165504618664785 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Intermediate System-to-Intermediate System (ISIS) over ",app_id="0x0100007c",app_name="isis" 1715165504618664785 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="ISO Transport Protocol Class 4",app_id="0x0100001d",app_name="iso-tp4" 1715165504618664785 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Layer 2 Tunneling Protocol",app_id="0x01000073",app_name="l2tp" 1715165504618664785 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Locus Address Resolution Protocol",app_id="0x0100005b",app_name="larp" 1715165504618664785 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Leaf-1",app_id="0x01000019",app_name="leaf-1" 1715165504618664785 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Leaf-2",app_id="0x0100001a",app_name="leaf-2" 1715165504618664785 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="MANET Protocols",app_id="0x0100008a",app_name="manet" 1715165504618664785 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="MERIT Internodal Protocol",app_id="0x01000020",app_name="merit-inp" 1715165504618664785 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="MFE Network Services Protocol",app_id="0x0100001f",app_name="mfe-nsp" 1715165504618664785 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Mobile Internetworking Control Pro.",app_id="0x0100005f",app_name="micp" 1715165504618664785 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="IP Mobility",app_id="0x01000037",app_name="mobile" 1715165504618664785 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="MPLS-in-IP",app_id="0x01000089",app_name="mpls-in-ip" 1715165504618966128 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Multicast Transport Protocol",app_id="0x0100005c",app_name="mtp" 1715165504618966128 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Multiplexing",app_id="0x01000012",app_name="mux" 1715165504618966128 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="NBMA Address Resolution Protocol",app_id="0x01000036",app_name="narp" 1715165504618966128 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Bulk Data Transfer Protocol",app_id="0x0100001e",app_name="netblt" 1715165504618966128 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="NSFNET-IGP",app_id="0x01000055",app_name="nsfnet-igp" 1715165504618966128 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Network Voice Protocol",app_id="0x0100000b",app_name="nvp-ii" 1715165504618966128 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Open Shortest Path First",app_id="0x01000059",app_name="ospf" 1715165504618966128 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="PGM Reliable Transport Protocol",app_id="0x01000071",app_name="pgm" 1715165504618966128 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Protocol Independent Multicast",app_id="0x01000067",app_name="pim" 1715165504618966128 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Private IP Encapsulation within IP",app_id="0x01000083",app_name="pipe" 1715165504618966128 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="PNNI over IP",app_id="0x01000066",app_name="pnni" 1715165504618966128 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Packet Radio Measurement",app_id="0x01000015",app_name="prm" 1715165504618966128 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Performance Transparency Protocol",app_id="0x0100007b",app_name="ptp" 1715165504618966128 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="PUP",app_id="0x0100000c",app_name="pup" 1715165504619268091 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Packet Video Protocol",app_id="0x0100004b",app_name="pvp" 1715165504619268091 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="QNX",app_id="0x0100006a",app_name="qnx" 1715165504619268091 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Reliable Data Protocol",app_id="0x0100001b",app_name="rdp" 1715165504619268091 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Resource Reservation Protocol",app_id="0x0100002e",app_name="rsvp" 1715165504619268091 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="RSVP-E2E-IGNORE",app_id="0x01000086",app_name="rsvp-e2e-ignore" 1715165504619268091 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="MIT Remote Virtual Disk Protocol",app_id="0x01000042",app_name="rvd" 1715165504619268091 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="SATNET and Backroom EXPAK",app_id="0x01000040",app_name="sat-expak" 1715165504619268091 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="SATNET Monitoring",app_id="0x01000045",app_name="sat-mon" 1715165504619268091 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Semaphore Communications Sec. Pro.",app_id="0x01000060",app_name="scc-sp" 1715165504619268091 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Schedule Transfer Protocol",app_id="0x01000076",app_name="schedule-transfer" 1715165504619268091 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="SCPS",app_id="0x01000069",app_name="scps" 1715165504619268091 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Stream Control Transmission Protocol",app_id="0x01000084",app_name="sctp" 1715165504619268091 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Source Demand Routing Protocol",app_id="0x0100002a",app_name="sdrp" 1715165504619268091 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="SECURE-VMTP",app_id="0x01000052",app_name="secure-vmtp" 1715165504619574503 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="SKIP",app_id="0x01000039",app_name="skip" 1715165504619574503 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="SM",app_id="0x0100007a",app_name="sm" 1715165504619574503 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Simple Message Protocol",app_id="0x01000079",app_name="smp" 1715165504619574503 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Sitara Networks Protocol",app_id="0x0100006d",app_name="snp" 1715165504619574503 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Sprite RPC Protocol",app_id="0x0100005a",app_name="sprite-rpc" 1715165504619574503 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Secure Packet Shield",app_id="0x01000082",app_name="sps" 1715165504619574503 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="SpectraLink Radio Protocol",app_id="0x01000077",app_name="srp" 1715165504619574503 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="SSCOPMCE",app_id="0x01000080",app_name="sscopmce" 1715165504619574503 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Stream",app_id="0x01000005",app_name="st" 1715165504619574503 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="SUN ND PROTOCOL-Temporary",app_id="0x0100004d",app_name="sun-nd" 1715165504619574503 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="IP with Encryption",app_id="0x01000035",app_name="swipe" 1715165504619574503 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="TCF",app_id="0x01000057",app_name="tcf" 1715165504619574503 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Transport Layer Security Protocol",app_id="0x01000038",app_name="tlsp" 1715165504619574503 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="TP++ Transport Protocol",app_id="0x01000027",app_name="tp++" 1715165504619894286 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Trunk-1",app_id="0x01000017",app_name="trunk-1" 1715165504619894286 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Trunk-2",app_id="0x01000018",app_name="trunk-2" 1715165504619894286 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="TTP",app_id="0x01000054",app_name="ttp" 1715165504619894286 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="UDPLite, Lightweight connectionless User Datagram Proto",app_id="0x01000088",app_name="udplite" 1715165504619894286 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="UTI",app_id="0x01000078",app_name="uti" 1715165504619894286 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="VISA Protocol",app_id="0x01000046",app_name="visa" 1715165504619894286 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="VMTP",app_id="0x01000051",app_name="vmtp" 1715165504619894286 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Virtual Router Redundancy Protocol",app_id="0x01000070",app_name="vrrp" 1715165504619894286 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="WIDEBAND EXPAK",app_id="0x0100004f",app_name="wb-expak" 1715165504619894286 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="WIDEBAND Monitoring",app_id="0x0100004e",app_name="wb-mon" 1715165504619894286 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Wang Span Network",app_id="0x0100004a",app_name="wsn" 1715165504619894286 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="Cross Net Debugger",app_id="0x0100000f",app_name="xnet" 1715165504619894286 +netflow_options,source=127.0.0.1,version=IPFIX app_desc="XEROX NS IDP",app_id="0x01000016",app_name="xns-idp" 1715165504619894286 \ No newline at end of file diff --git a/plugins/inputs/netflow/testcases/ipfix_options/message-001.bin b/plugins/inputs/netflow/testcases/ipfix_options/message-001.bin new file mode 100644 index 0000000000000000000000000000000000000000..9f769101a1581020ed93bedea99381c1f27dc735 GIT binary patch literal 1204 zcmbW1(MrQG6oyZ6Dhvd##LM7)1t&ug6xy=sKug&wcr!JP*;;0knq||ygm2*+_yj(b z*Pf{z)@AFk7j4g%lP^ChDO4+Oz2lGf^={)805)I^b}S3;7TiJw?qC;g;K;HnFBZVw zVaBj&{tDwn-IIVSJt3YHf-_A5CADPoVZM7tP&uGtRu*0yrjs!zKG#oD4TgoWB?T%^ zsF>KX9BMlenkzx`2*}Bllbn;RJR{&vz!p{gktu`IKD+8HiL+n`l`&O`$p}un^$+7T zWtTqJ>ZTQ)>-}1tG!;#`aY@r0WT>o0kx-1K^6yu2U7xf)k6cQTXsHs>Umz)BR31cv z7U56j`i_y8KvZ5t${tc}&&6~p8z?DL(s4q+5w4mRm76Tm#)UmMH1ZON%2U?UnW@cd zhJlHfFjQ`{m`c+p^%n4QrC>76=%bx+t_t1W7bgMoRnB%k7gM%a7Dsvg`#DvP@QBWQ Q zvzq_`3h18NuRFi_<_|k=jKUyQNiMx*)BV5}u4c1HKDFLh>8B6!~O4xMyk z-UXaG|HAVb$P)D{Y{ig3$T#V65_==$P$2IMr5(TX!iI_SxJ(cWsWd{qOJAxOa}9YP z$ZjT36keEJv|1(o5idN2_RygVhuA1a`R0XSCLqW1 mP!MnWdJaMgz!CLq8=6VUa|K8 literal 0 HcmV?d00001 diff --git a/plugins/inputs/netflow/testcases/ipfix_options/message-003.bin b/plugins/inputs/netflow/testcases/ipfix_options/message-003.bin new file mode 100644 index 0000000000000000000000000000000000000000..2819c35634c48ef5de53001cbf40b47c9dce8854 GIT binary patch literal 1182 zcmaiyu};G<5QZI57?^ngOGr#aEKF>rO-m$-s!~P<<2cDlsU102st$}yNIU}X0uRN^ zHMB)E*EUmp=lk;K{$CuoKGLi2ufxaaQwVVs1g-Z#h}TrpiFtbPP?p_!?9h%Q{dve!0?giNvtvdqk@G6$^+IWP$*Irhp{ zsqu2?9Xjm_xk;IO?8D^eRn3%NZ1fv<~G& zq0XB#R3Vj@5Za<*gvJ&PS%fB$cLwFHnv*s6Mo;}>5#xvJ_BP}c6z})~>6J!!HnN@3 zN}HZ@Oi~$u=9gI`E$Qnxi=HwwFjb{8v&ShyoP5Dz1X>7Ej|wqn+rcym*=*MyeE}cAhw%k`8_$kg zSnF=;Lie)C&&)Uf{DhqL-?Q=8$I*TINeDUa_4;o;LKI{xhxgXUTn^eAdaZ3qXTpeu zS}7AK_cmB*b*o`3Ao2tjK8j2rmzIJF%7gWEA%ZH!hVCKNG9u4l&pbAzb1zKptnai| z0|`N-1}AN7b;cZ0}mk$rGrAd)7!1Vb5bcm1m%@&S<%AR&woO9)FaLxiVB3YQmJgs$Zg`3g>l*j&b^ z^O)YDAu<8yWUTBrOI>()Eb`q@V+~skkppn+(J=F3(I}gw{5DOl=ILZWgBMu_l9r$~ zH8#+d2y)qIsFC9e39|K$STf@@!$;2edKB%Bis@~ literal 0 HcmV?d00001 diff --git a/plugins/inputs/netflow/testcases/ipfix_options/message-005.bin b/plugins/inputs/netflow/testcases/ipfix_options/message-005.bin new file mode 100644 index 0000000000000000000000000000000000000000..0b1a0d9d3f9ef8de0371be80af8d2444c59eebc5 GIT binary patch literal 1182 zcma)*!D<^Z5Qb$)d&nEKG<1&1VGA)Kf!s`RL14Sa>qDWGAn%UDP_48`vJ*p|AcsCe zA13dS*XTLpHEXk8nM4;!zh*woh+pFP=->SM|MQ36{TCs`$4=+yZ%2qTDwmgJsAR1% zB9;M6)4;cA{TxeCe4wfdMGZZw@D~3T2z_- z*wj^87hvpcu$k3xqm}p24zKeW>2){W_&}}r(k@IF#&GNAZi}t6qcbCaY2~7CIk4Hn zLod%Aa#<7fRxj4i_y(DgpERm@a^Ajia6oTIHWWsFu8`e^Tx}|3L~lnn6h=N3ik;F> zH=AK^)SqsItpy|{RbWPCvplKciLR(EjX^i|@%rP;3A1K7|dmly^ z?ydU+DY_+P=-+{5B5as+Qg}zXGtWpk)96 literal 0 HcmV?d00001 diff --git a/plugins/inputs/netflow/testcases/ipfix_options/message-006.bin b/plugins/inputs/netflow/testcases/ipfix_options/message-006.bin new file mode 100644 index 0000000000000000000000000000000000000000..98e26dbfcf4709169286b512953d17f3d1655c26 GIT binary patch literal 1182 zcmb7@u}54 zc-GV6jkx-ek(W*QzI-ZM$rXv zk&%0(T-0WMm>tN2s&e4HJOgiZ8_>`yr;OYs2tysZTOPK0B7dl$UK+2#t)k5sjQmNy zW@>_?4_@=ZQQkjK(&KNBXN#sbLF~HBAzT|bkrxI__>#f7%U{OZx(gKI)B?%DmFd*K5#WPYmbY!AG5vr<|kc6rW62`f0O%prVPSgiLj64Dl!$Tpl zaZ95PsjJkJeRBQf+=0Y&iFfBlHL|malNSbfB`Vkb?gwWM~Auvu(d~3|Sh!f}}{n zvzke>09{o^l}_VIZ<^xn9=a5U=f?HFXb?m$y+K3dyW!T+HqO#&U>SBTtybyIYbK0o ac%F#7Hi>p4cMpAtBgN1|RalIux%odsyO@Un literal 0 HcmV?d00001 diff --git a/plugins/inputs/netflow/testcases/ipfix_options/message-008.bin b/plugins/inputs/netflow/testcases/ipfix_options/message-008.bin new file mode 100644 index 0000000000000000000000000000000000000000..33427276628597de49e94b82a76835f3363fc566 GIT binary patch literal 1182 zcmb7?-AcnS6o50>6nu)jKraRLwstUF*V1$ff)^pnTmvfqsi}C0B=KE{%G(9JToQ+1~j}ajmNU^mtc&VI0y#H7fF0&}OkMnd7 zhgYb)hC=mST^YNZ{ma#rq4E_f|IsY=^8t#=1}blpgsIAulExB%KTDcg?X=M4fRUiG zg8Gosam(pKx}CNKoa#j7BN(fk46G6T23X5!mWHR=+Im#JgMq%Q+p+c~(3FcpI?6Um zmMd>!AEI&x_Q2pq3TOFT)dkJ?O6k*@MdcfS(54cye;6T*g-IHR(QiJmN96>ZKZ!Xj z`GE)KuV^VMW7yU~?fFY=xuA<%nr2C!gvmU}Wo5MGwmIU%5GpTWr_7(JF*Zx-PPq+@ yYGE7Wl&+7vx+p3ioLGBv^Kk0r0}z#0t_1Iu=a$!iqdGe0jkL6VRLV627ykq9d3Ff^ literal 0 HcmV?d00001 diff --git a/plugins/inputs/netflow/testcases/ipfix_options/message-009.bin b/plugins/inputs/netflow/testcases/ipfix_options/message-009.bin new file mode 100644 index 0000000000000000000000000000000000000000..0dc2574b012b290bc30b3c96a5d62c6942421105 GIT binary patch literal 1182 zcmbW0y;6ff5XUbw(Za^ckMcSTOrfP+lw<}?2qxsCvADpAHz9Y-u_X8gRz89c<3m}y z85}d@h*2pR_P77}&9MvQp#JuF_3^&<&^{uB?AL1b*BT*bkXRPh#^rmKMSaa=nkWs_ z(+X6eVk5T!Pfu)hql*2eoi|gdV(ci-D#ktek5sO&AL4W1`#wmy6DGezqzjXnWZ+;#f^ literal 0 HcmV?d00001 diff --git a/plugins/inputs/netflow/testcases/ipfix_options/telegraf.conf b/plugins/inputs/netflow/testcases/ipfix_options/telegraf.conf new file mode 100644 index 0000000000000..cfd23d3636307 --- /dev/null +++ b/plugins/inputs/netflow/testcases/ipfix_options/telegraf.conf @@ -0,0 +1,2 @@ +[[inputs.netflow]] + service_address = "udp://127.0.0.1:0"