Implement byte and flow time conversions for ASA - Address #22 #23
Conversation
Convert fields relevant to flow time tracking and byte counts from Cisco ASA 9.2 v9 to fields understood by the Kibana queries. Testing: Initial test runs on several ASAs, needs wider testing across multiple versions, ASA/ASDM configs, etc. Todo: There's no *pkt* field in the ASA outputs, determine if metric can be exposed and collected. Write conversions if data exists.
|
This should address the critical issues in #22, but packet counters are still missing. |
ASA netflow icludes cardinality for the bytes and packets seen in flows, implement summations to generate the fields used in EF Kibana queries.
sempervictus
force-pushed
the
bugfix-asa_flow_time_and_byte_counts
branch
from
be86ecb
to
da42052
Compare
|
@robcowart: we've got this running in prod for a few days now, think it might be worthwhile to commit to master if you've no issues with the code since its one of the most widely used NF sources out there (revision tags work too if theres some concern about preserving prior behavior, though these changes havent affected our other collectors) |
|
The downside of simply adding these values together is that you loose the information related to how much traffic went in each direction. My tendency at the moment is to split such bidirectional flows into two unidirectional flows. I have in the past done this with the flow events from Packetbeat, and I find it to be a better path as the resulting data is more consistent across all sources. What are your thoughts? |
|
We are still keeping the cardinal values, unless I pushed the wrong branch, which are very useful. My inclination is to have both - aggregate byte counts for people who care about the duplex or logical session load, and the cardinal counts for people working on asymmetric flows.
I'm also not sure we can get the direction from all sources so an aggregate counter as the lowest common denominator might be safer.
|
|
This is honestly working really well for me at the moment, not sure if it will be included in the current iteration, but it is working great. |
|
Compatible changes have been made in commit c6d01da |
Convert fields relevant to flow time tracking and byte counts from
Cisco ASA 9.2 v9 to fields understood by the Kibana queries.
Testing:
Initial test runs on several ASAs, needs wider testing across
multiple versions, ASA/ASDM configs, etc.
Todo:
There's no pkt field in the ASA outputs, determine if metric
can be exposed and collected. Write conversions if data exists.