Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

warning: variable ‘length’ set but not used > [-Wunused-but-set-variable] #62

Closed
gabalino opened this issue Mar 16, 2017 · 3 comments

Comments

@gabalino
Copy link

I have a task to save IP_SRC_ADDR, IP_DST_ADDR, postNATSourceIPv4Address and postNATDestinationIPv4Address. These fields are present in tcpdump. In the output of nfdump these NAT addresses are missing. Please help to solve this problem.

nfcapd: Version: 1.6.15
nfcapd -e -z -w -t 60 -l /netflow/test -b 10.0.0.118 -p 9995 -E -T all -B
200000
Process_ipfix: [0] Add template 258

After start of nfcapd errors appear

Process_ipfix: [0] option template length error: size left 20 too small for
5 scopes length and 1 options length
Flow Record:
  Flags        =              0x06 FLOW, Unsampled
  export sysid =                 2
  size         =                68
  first        =                 0 [1970-01-01 03:00:00]
  last         =                 0 [1970-01-01 03:00:00]
  msec_first   =                 0
  msec_last    =                 0
  src addr     =    10.0.176.236
  dst addr     =     54.194.31.135
  src port     =             56428
  dst port     =                80
  fwd status   =                 0
  tcp flags    =              0x00 ......
  proto        =                 6 TCP
  (src)tos     =                 0
  (in)packets  =                 0
  (in)bytes    =                 0
  ip router    =       X.X.X.X
  received at  =     1489584299366 [2017-03-15 16:24:59.366]

tcpdump output

Set 1 [id=2] (Data Template): 258
    FlowSet Id: Data Template (V10 [IPFIX]) (2)
    FlowSet Length: 52
    Template (Id = 258, Count = 11)
        Template Id: 258
        Field Count: 11
        Field (1/11): observationTimeMilliseconds
        Field (2/11): IP_SRC_ADDR
        Field (3/11): IP_DST_ADDR
        Field (4/11): postNATSourceIPv4Address
        Field (5/11): postNATDestinationIPv4Address
        Field (6/11): L4_SRC_PORT
        Field (7/11): L4_DST_PORT
        Field (8/11): postNAPTSourceTransportPort
        Field (9/11): postNAPTDestinationTransportPort
        Field (10/11): PROTOCOL
        Field (11/11): natEvent
Flow 1
    Observation Time Milliseconds: Mar  6, 2017 15:50:01.892000000 RTZ 2
(зима)
    SrcAddr: 10.0.166.44
    DstAddr: 104.157.28.150
    Post NAT Source IPv4 Address: X.X.X.X
    Post NAT Destination IPv4 Address: 104.157.28.150
    SrcPort: 17043
    DstPort: 22675
    Post NAPT Source Transport Port: 17043
    Post NAPT Destination Transport Port: 22675
    Protocol: UDP (17)
    Nat Event: 2

nfdump -r nfcapd.201703151624 -o "fmt:%nsa:%nsp => %nda:%ndp" -c 10

   X-late Src IP XsPort       X-late Dst IP XdPort
         0.0.0.0:     0 =>          0.0.0.0:     0
         0.0.0.0:     0 =>          0.0.0.0:     0

when compile i got this warnings? is it normal?

./configure --enable-nsel --enable-nfprofile && make && make install

scanner.c:1889:17: warning: ‘yyunput’ defined but not used [-Wunused-function]
     static void yyunput (int c, register char * yy_bp )
                 ^
scanner.c:1930:16: warning: ‘input’ defined but not used [-Wunused-function]
     static int input  (void)
                ^
nfcapd.c: In function ‘main’:
nfcapd.c:761:18: warning: variable ‘filter’ set but not used [-Wunused-but-set-variable]
 char *bindhost, *filter, *datadir, pidstr[32], *launch_process;
                  ^
netflow_v9.c: In function ‘Process_v9’:
netflow_v9.c:2028:28: warning: variable ‘option_flowset’ set but not used [-Wunused-but-set-variable]
 option_template_flowset_t *option_flowset;
                            ^
ipfix.c: In function ‘Process_ipfix_templates’:
ipfix.c:884:10: warning: variable ‘id’ set but not used [-Wunused-but-set-variable]
 uint32_t id, count;
          ^
ipfix.c: In function ‘Process_ipfix_template_withdraw’:
ipfix.c:1068:16: warning: variable ‘count’ set but not used [-Wunused-but-set-variable]
   uint32_t id, count;
                ^
ipfix.c: In function ‘Process_ipfix_option_templates’:
ipfix.c:1146:16: warning: variable ‘length’ set but not used [-Wunused-but-set-variable]
   uint16_t id, length;
                ^
ipfix.c:1145:12: warning: variable ‘enterprise_value’ set but not used [-Wunused-but-set-variable]
   uint32_t enterprise_value;
            ^
ipfix.c:1179:16: warning: variable ‘length’ set but not used [-Wunused-but-set-variable]
   uint16_t id, length;
                ^
ipfix.c:1178:12: warning: variable ‘enterprise_value’ set but not used [-Wunused-but-set-variable]
   uint32_t enterprise_value;
            ^
ipfix.c:1101:69: warning: variable ‘found_std_sampling’ set but not used [-Wunused-but-set-variable]
 uint16_t offset_std_sampler_interval, offset_std_sampler_algorithm, found_std_sampling;
                                                                     ^
ipfix.c:1101:39: warning: variable ‘offset_std_sampler_algorithm’ set but not used [-Wunused-but-set-variable]
 uint16_t offset_std_sampler_interval, offset_std_sampler_algorithm, found_std_sampling;
                                       ^
ipfix.c:1101:10: warning: variable ‘offset_std_sampler_interval’ set but not used [-Wunused-but-set-variable]
 uint16_t offset_std_sampler_interval, offset_std_sampler_algorithm, found_std_sampling;
          ^
ipfix.c:1100:75: warning: variable ‘found_sampler’ set but not used [-Wunused-but-set-variable]
 uint16_t offset_sampler_id, offset_sampler_mode, offset_sampler_interval, found_sampler;
                                                                           ^
ipfix.c:1100:50: warning: variable ‘offset_sampler_interval’ set but not used [-Wunused-but-set-variable]
 uint16_t offset_sampler_id, offset_sampler_mode, offset_sampler_interval, found_sampler;
                                                  ^
ipfix.c:1100:29: warning: variable ‘offset_sampler_mode’ set but not used [-Wunused-but-set-variable]
 uint16_t offset_sampler_id, offset_sampler_mode, offset_sampler_interval, found_sampler;
                             ^
ipfix.c:1100:10: warning: variable ‘offset_sampler_id’ set but not used [-Wunused-but-set-variable]
 uint16_t offset_sampler_id, offset_sampler_mode, offset_sampler_interval, found_sampler;
          ^
ipfix.c:1099:54: warning: variable ‘sampler_id_length’ set but not used [-Wunused-but-set-variable]
 uint16_t id, field_count, scope_field_count, offset, sampler_id_length;
                                                      ^
ipfix.c:1099:46: warning: variable ‘offset’ set but not used [-Wunused-but-set-variable]
 uint16_t id, field_count, scope_field_count, offset, sampler_id_length;
                                              ^
ipfix.c:1099:10: warning: variable ‘id’ set but not used [-Wunused-but-set-variable]
 uint16_t id, field_count, scope_field_count, offset, sampler_id_length;
          ^
ipfix.c: In function ‘Process_IPFIX’:
ipfix.c:1623:24: warning: variable ‘ObservationDomain’ set but not used [-Wunused-but-set-variable]
 uint32_t   ExportTime, ObservationDomain, Sequence, flowset_length;
                        ^
ipfix.c:1623:12: warning: variable ‘ExportTime’ set but not used [-Wunused-but-set-variable]
 uint32_t   ExportTime, ObservationDomain, Sequence, flowset_length;
            ^
nfreplay.c: In function ‘FlushBuffer’:
nfreplay.c:148:3: warning: implicit declaration of function ‘__fpurge’ [-Wimplicit-function-declaration]
   FPURGE(stdin);
   ^
netflow_v9.c: In function ‘Process_v9’:
netflow_v9.c:2028:28: warning: variable ‘option_flowset’ set but not used [-Wunused-but-set-variable]
 option_template_flowset_t *option_flowset;
                            ^
ipfix.c: In function ‘Process_ipfix_templates’:
ipfix.c:884:10: warning: variable ‘id’ set but not used [-Wunused-but-set-variable]
 uint32_t id, count;
          ^
ipfix.c: In function ‘Process_ipfix_template_withdraw’:
ipfix.c:1068:16: warning: variable ‘count’ set but not used [-Wunused-but-set-variable]
   uint32_t id, count;
                ^
ipfix.c: In function ‘Process_ipfix_option_templates’:
ipfix.c:1146:16: warning: variable ‘length’ set but not used [-Wunused-but-set-variable]
   uint16_t id, length;
                ^
ipfix.c:1145:12: warning: variable ‘enterprise_value’ set but not used [-Wunused-but-set-variable]
   uint32_t enterprise_value;
            ^
ipfix.c:1179:16: warning: variable ‘length’ set but not used [-Wunused-but-set-variable]
   uint16_t id, length;
                ^
ipfix.c:1178:12: warning: variable ‘enterprise_value’ set but not used [-Wunused-but-set-variable]
   uint32_t enterprise_value;
            ^
ipfix.c:1101:69: warning: variable ‘found_std_sampling’ set but not used [-Wunused-but-set-variable]
 uint16_t offset_std_sampler_interval, offset_std_sampler_algorithm, found_std_sampling;
                                                                     ^
ipfix.c:1101:39: warning: variable ‘offset_std_sampler_algorithm’ set but not used [-Wunused-but-set-variable]
 uint16_t offset_std_sampler_interval, offset_std_sampler_algorithm, found_std_sampling;
                                       ^
ipfix.c:1101:10: warning: variable ‘offset_std_sampler_interval’ set but not used [-Wunused-but-set-variable]
 uint16_t offset_std_sampler_interval, offset_std_sampler_algorithm, found_std_sampling;
          ^
ipfix.c:1100:75: warning: variable ‘found_sampler’ set but not used [-Wunused-but-set-variable]
 uint16_t offset_sampler_id, offset_sampler_mode, offset_sampler_interval, found_sampler;
                                                                           ^
ipfix.c:1100:50: warning: variable ‘offset_sampler_interval’ set but not used [-Wunused-but-set-variable]
 uint16_t offset_sampler_id, offset_sampler_mode, offset_sampler_interval, found_sampler;
                                                  ^
ipfix.c:1100:29: warning: variable ‘offset_sampler_mode’ set but not used [-Wunused-but-set-variable]
 uint16_t offset_sampler_id, offset_sampler_mode, offset_sampler_interval, found_sampler;
                             ^
ipfix.c:1100:10: warning: variable ‘offset_sampler_id’ set but not used [-Wunused-but-set-variable]
 uint16_t offset_sampler_id, offset_sampler_mode, offset_sampler_interval, found_sampler;
          ^
ipfix.c:1099:54: warning: variable ‘sampler_id_length’ set but not used [-Wunused-but-set-variable]
 uint16_t id, field_count, scope_field_count, offset, sampler_id_length;
                                                      ^
ipfix.c:1099:46: warning: variable ‘offset’ set but not used [-Wunused-but-set-variable]
 uint16_t id, field_count, scope_field_count, offset, sampler_id_length;
                                              ^
ipfix.c:1099:10: warning: variable ‘id’ set but not used [-Wunused-but-set-variable]
 uint16_t id, field_count, scope_field_count, offset, sampler_id_length;
          ^
ipfix.c: In function ‘Process_IPFIX’:
ipfix.c:1623:24: warning: variable ‘ObservationDomain’ set but not used [-Wunused-but-set-variable]
 uint32_t   ExportTime, ObservationDomain, Sequence, flowset_length;
                        ^
ipfix.c:1623:12: warning: variable ‘ExportTime’ set but not used [-Wunused-but-set-variable]
 uint32_t   ExportTime, ObservationDomain, Sequence, flowset_length;
            ^
nfexpire.c: In function ‘main’:
nfexpire.c:215:8: warning: variable ‘maxsize_string’ set but not used [-Wunused-but-set-variable]
 char  *maxsize_string, *lifetime_string, *datadir;
        ^
nfexpire.c:213:10: warning: variable ‘err’ set but not used [-Wunused-but-set-variable]
 int   c, err, maxsize_set, maxlife_set;
          ^
profile.c: In function ‘CloseChannels’:
profile.c:369:10: warning: variable ‘update_ok’ set but not used [-Wunused-but-set-variable]
 int ret, update_ok;
@sdemchuk
Copy link

sdemchuk commented May 10, 2017

I have same issue with IPFIX NAT events logging:

  • template in IPFIX flow is present
  • tshark or tcpdump correctly decode IPFIX
  • nfcapd/nfdump missed some fields (postNATSourceIPv4Address, postNAPTSourceTransportPort, observationTimeMilliseconds)

ipfix.pcap.zip - pcap of IPFIX flow
nfcapd.201705101355.zip - result of nfcapd

#/usr/local/bin/nfcapd -w -p 4739 -T all -E -l /home/sork

Add extension: 2 byte input/output interface index
Add extension: 4 byte input/output interface index
Add extension: 2 byte src/dst AS number
Add extension: 4 byte src/dst AS number
Add extension: dst tos, direction, src/dst mask
Add extension: IPv4 next hop
Add extension: IPv6 next hop
Add extension: IPv4 BGP next IP
Add extension: IPv6 BGP next IP
Add extension: src/dst vlan id
Add extension: 4 byte output packets
Add extension: 8 byte output packets
Add extension: 4 byte output bytes
Add extension: 8 byte output bytes
Add extension: 4 byte aggregated flows
Add extension: 8 byte aggregated flows
Add extension: in src/out dst mac address
Add extension: in dst/out src mac address
Add extension: MPLS Labels
Add extension: IPv4 router IP addr
Add extension: IPv6 router IP addr
Add extension: router ID
Add extension: BGP adjacent prev/next AS
Add extension: time packet received
Add extension: NSEL Common block
Add extension: NSEL xlate ports
Add extension: NSEL xlate IPv4 addr
Add extension: NSEL xlate IPv6 addr
Add extension: NSEL ACL ingress/egress acl ID
Add extension: NSEL username
Add extension: NSEL max username
Add extension: nprobe/nfpcapd latency
Add extension: NEL Common block
Add extension: Compat NEL IPv4
Add extension: NAT Port Block Allocation
Bound to IPv4 host/IP: any, Port: 4739
Startup.
Init IPFIX: Max number of IPFIX tags: 62
Process_ipfix: New exporter: SysID: 1, Observation domain 1 from: 172.16.0.32

Process_ipfix: [1] Add template 256
Process_ipfix: [1] Add template 257

Flow Record:
  Flags        =              0x06 FLOW, Unsampled
  export sysid =                 1
  size         =                68
  first        =                 0 [1970-01-01 03:00:00]
  last         =                 0 [1970-01-01 03:00:00]
  msec_first   =                 0
  msec_last    =                 0
  src addr     =        10.10.1.21
  dst addr     =           0.0.0.0
  src port     =             53968
  dst port     =                 0
  fwd status   =                 0
  tcp flags    =              0x00 ......
  proto        =                17 UDP
  (src)tos     =                 0
  (in)packets  =                 0
  (in)bytes    =                 0
  ip router    =       172.16.0.32
  received at  =     1494413621059 [2017-05-10 13:53:41.059]


Flow Record:
  Flags        =              0x06 FLOW, Unsampled
  export sysid =                 1
  size         =                68
  first        =                 0 [1970-01-01 03:00:00]
  last         =                 0 [1970-01-01 03:00:00]
  msec_first   =                 0
  msec_last    =                 0
  src addr     =        10.10.1.21
  dst addr     =           0.0.0.0
  src port     =             63390
  dst port     =                 0
  fwd status   =                 0
  tcp flags    =              0x00 ......
  proto        =                17 UDP
  (src)tos     =                 0
  (in)packets  =                 0
  (in)bytes    =                 0
  ip router    =       172.16.0.32
  received at  =     1494413621059 [2017-05-10 13:53:41.059]


Flow Record:
  Flags        =              0x06 FLOW, Unsampled
  export sysid =                 1
  size         =                68
  first        =                 0 [1970-01-01 03:00:00]
  last         =                 0 [1970-01-01 03:00:00]
  msec_first   =                 0
  msec_last    =                 0
  src addr     =        10.10.1.21
  dst addr     =           0.0.0.0
  src port     =              7070
  dst port     =                 0
  fwd status   =                 0
  tcp flags    =              0x00 ......
  proto        =                17 UDP
  (src)tos     =                 0
  (in)packets  =                 0
  (in)bytes    =                 0
  ip router    =       172.16.0.32
  received at  =     1494413621059 [2017-05-10 13:53:41.059]


Flow Record:
  Flags        =              0x06 FLOW, Unsampled
  export sysid =                 1
  size         =                68
  first        =                 0 [1970-01-01 03:00:00]
  last         =                 0 [1970-01-01 03:00:00]
  msec_first   =                 0
  msec_last    =                 0
  src addr     =        10.10.1.21
  dst addr     =           0.0.0.0
  src port     =             53989
  dst port     =                 0
  fwd status   =                 0
  tcp flags    =              0x00 ......
  proto        =                17 UDP
  (src)tos     =                 0
  (in)packets  =                 0
  (in)bytes    =                 0
  ip router    =       172.16.0.32
  received at  =     1494413621059 [2017-05-10 13:53:41.059]

^CFile Block Header:
  NumBlocks     =           7
  Size          =         336
  id             =           2

Ident: 'none' Flows: 4, Packets: 0, Bytes: 0, Sequence Errors: 0, Bad Packets: 0
Total ignored packets: 0
Terminating nfcapd.

# tshark -r ipfix.pcap -V

Frame 1: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0
User Datagram Protocol, Src Port: ipfix (4739), Dst Port: ipfix (4739)
    Source port: ipfix (4739)
    Destination port: ipfix (4739)
    Length: 64
    Checksum: 0x2f55 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
Cisco NetFlow/IPFIX
    Version: 10
    Length: 56
    Timestamp: May 10, 2017 13:53:29.000000000 EEST
        ExportTime: 1494413609
    FlowSequence: 531
    Observation Domain Id: 1
    Set 1
        FlowSet Id: Data Template (V10 [IPFIX]) (2)
        FlowSet Length: 40
        Template (Id = 256, Count = 8)
            Template Id: 256
            Field Count: 8
            Field (1/8): observationTimeMilliseconds
                0... .... .... .... = Pen provided: No
                .000 0001 0100 0011 = Type: observationTimeMilliseconds (323)
                Length: 8
            Field (2/8): natEvent
                0... .... .... .... = Pen provided: No
                .000 0000 1110 0110 = Type: natEvent (230)
                Length: 1
            Field (3/8): IP_SRC_ADDR
                0... .... .... .... = Pen provided: No
                .000 0000 0000 1000 = Type: IP_SRC_ADDR (8)
                Length: 4
            Field (4/8): postNATSourceIPv4Address
                0... .... .... .... = Pen provided: No
                .000 0000 1110 0001 = Type: postNATSourceIPv4Address (225)
                Length: 4
            Field (5/8): PROTOCOL
                0... .... .... .... = Pen provided: No
                .000 0000 0000 0100 = Type: PROTOCOL (4)
                Length: 1
            Field (6/8): L4_SRC_PORT
                0... .... .... .... = Pen provided: No
                .000 0000 0000 0111 = Type: L4_SRC_PORT (7)
                Length: 2
            Field (7/8): postNAPTSourceTransportPort
                0... .... .... .... = Pen provided: No
                .000 0000 1110 0011 = Type: postNAPTSourceTransportPort (227)
                Length: 2
            Field (8/8): ingressVRFID
                0... .... .... .... = Pen provided: No
                .000 0000 1110 1010 = Type: ingressVRFID (234)
                Length: 4

Frame 2: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) on interface 0
User Datagram Protocol, Src Port: ipfix (4739), Dst Port: ipfix (4739)
    Source port: ipfix (4739)
    Destination port: ipfix (4739)
    Length: 44
    Checksum: 0x3157 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
Cisco NetFlow/IPFIX
    Version: 10
    Length: 36
    Timestamp: May 10, 2017 13:53:34.000000000 EEST
        ExportTime: 1494413614
    FlowSequence: 531
    Observation Domain Id: 1
    Set 1
        FlowSet Id: Data Template (V10 [IPFIX]) (2)
        FlowSet Length: 20
        Template (Id = 257, Count = 3)
            Template Id: 257
            Field Count: 3
            Field (1/3): observationTimeMilliseconds
                0... .... .... .... = Pen provided: No
                .000 0001 0100 0011 = Type: observationTimeMilliseconds (323)
                Length: 8
            Field (2/3): natEvent
                0... .... .... .... = Pen provided: No
                .000 0000 1110 0110 = Type: natEvent (230)
                Length: 1
            Field (3/3): Unknown(283)
                0... .... .... .... = Pen provided: No
                .000 0001 0001 1011 = Type: Unknown (283)
                Length: 4

Frame 3: 166 bytes on wire (1328 bits), 166 bytes captured (1328 bits) on interface 0
User Datagram Protocol, Src Port: ipfix (4739), Dst Port: ipfix (4739)
    Source port: ipfix (4739)
    Destination port: ipfix (4739)
    Length: 132
    Checksum: 0xd7b1 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
Cisco NetFlow/IPFIX
    Version: 10
    Length: 124
    Timestamp: May 10, 2017 13:53:40.000000000 EEST
        ExportTime: 1494413620
    FlowSequence: 531
    Observation Domain Id: 1
    Set 1
        FlowSet Id: (Data) (256)
        FlowSet Length: 108
        Flow 1
            Observation Time Milliseconds: May 10, 2017 13:53:41.545000000 EEST
            Nat Event: 5
            SrcAddr: 10.10.1.21 (10.10.1.21)
            Post NAT Source IPv4 Address: 31.134.121.0 (31.134.121.0)
            Protocol: 17
            SrcPort: 53968
            Post NAPT Source Transport Port: 15601
            Ingress VRFID: 0
        Flow 2
            Observation Time Milliseconds: May 10, 2017 13:53:41.545000000 EEST
            Nat Event: 4
            SrcAddr: 10.10.1.21 (10.10.1.21)
            Post NAT Source IPv4 Address: 31.134.121.0 (31.134.121.0)
            Protocol: 17
            SrcPort: 63390
            Post NAPT Source Transport Port: 44837
            Ingress VRFID: 0
        Flow 3
            Observation Time Milliseconds: May 10, 2017 13:53:42.056000000 EEST
            Nat Event: 5
            SrcAddr: 10.10.1.21 (10.10.1.21)
            Post NAT Source IPv4 Address: 31.134.121.0 (31.134.121.0)
            Protocol: 17
            SrcPort: 7070
            Post NAPT Source Transport Port: 49517
            Ingress VRFID: 0
        Flow 4
            Observation Time Milliseconds: May 10, 2017 13:53:42.056000000 EEST
            Nat Event: 4
            SrcAddr: 10.10.1.21 (10.10.1.21)
            Post NAT Source IPv4 Address: 31.134.121.0 (31.134.121.0)
            Protocol: 17
            SrcPort: 53989
            Post NAPT Source Transport Port: 38464
            Ingress VRFID: 0

@bbayles
Copy link

bbayles commented May 10, 2017

@sdemchuk, you may want to check out the SiLK tools; I've found them to be more compatible with IPSEC when I had this problem with nfdump.

(apologies in advance; I don't mean to be rude in pointing someone to another project)

@phaag
Copy link
Owner

phaag commented Nov 5, 2017

@gabalino the message

Process_ipfix: [0] option template length error: size left 20 too small for 5 scopes length and 1 options length

obviously means, that your exporter sends corrupted messages. I would need to have more information about this device and a pcap would help.

Most compile warnings have been fixed.

@sdemchuk
I don't consider your issue the same. As of now, nfdump does not support events sent in IPFIX packets. This might be supported in future. In any case I would need the device you are using.

@phaag phaag closed this as completed Nov 5, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants