farrokhi/nfdump
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

IPFIX time stamps - Fix elements #21,#22 offset calculation

Browse Source
This commit is contained in:
Peter Haag 2018-01-01 12:57:27 +01:00
parent 31137a3f5b
commit 2a829dfbf9
3 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog
View File

@ -1,3 +1,6 @@
2018-01-01
- IPFIX time stamps - Fix elements #21,#22 offset calculation, but timestamps not yet evaluated. (#160)
2017-12-31 2017-12-31
- IPFIX sampling - sampling algorithm no longer required for tag #34 - IPFIX sampling - sampling algorithm no longer required for tag #34
- IPFIX sampling add tags #305 and #304 - set them identical to #34, #35 - IPFIX sampling add tags #305 and #304 - set them identical to #34, #35

15
bin/ipfix.c
View File

@ -665,13 +665,24 @@ size_t size_required;
PushSequence( table, IPFIX_flowEndDeltaMicroseconds, &offset, &table->flow_end); PushSequence( table, IPFIX_flowEndDeltaMicroseconds, &offset, &table->flow_end);
offset = BYTE_OFFSET_first + 8; offset = BYTE_OFFSET_first + 8;
table->delta_time = 1; table->delta_time = 1;
dbg_printf("Time stamp: flow start/end delta microseconds\n"); dbg_printf("Time stamp: flow start/end delta microseconds: %u/%u\n",
IPFIX_flowStartDeltaMicroseconds, IPFIX_flowEndDeltaMicroseconds);
} else if ( cache.lookup_info[IPFIX_flowStartMilliseconds].found ) { } else if ( cache.lookup_info[IPFIX_flowStartMilliseconds].found ) {
PushSequence( table, IPFIX_flowStartMilliseconds, &offset, &table->flow_start); PushSequence( table, IPFIX_flowStartMilliseconds, &offset, &table->flow_start);
offset = BYTE_OFFSET_first + 4; offset = BYTE_OFFSET_first + 4;
PushSequence( table, IPFIX_flowEndMilliseconds, &offset, &table->flow_end); PushSequence( table, IPFIX_flowEndMilliseconds, &offset, &table->flow_end);
offset = BYTE_OFFSET_first + 8; offset = BYTE_OFFSET_first + 8;
dbg_printf("Time stamp: flow start/end absolute milliseconds\n"); dbg_printf("Time stamp: flow start/end absolute milliseconds: %u/%u\n",
IPFIX_flowStartMilliseconds, IPFIX_flowEndMilliseconds);
} else if ( cache.lookup_info[IPFIX_flowStartSysUpTime].found ) {
PushSequence( table, IPFIX_flowStartSysUpTime, &offset, &table->flow_start);
offset = BYTE_OFFSET_first + 4;
PushSequence( table, IPFIX_flowEndSysUpTime, &offset, &table->flow_end);
offset = BYTE_OFFSET_first + 8;
dbg_printf("Time stamp: flow start/end relative milliseconds: %u/%u\n",
IPFIX_flowStartSysUpTime, IPFIX_flowEndSysUpTime);
} else {
dbg_printf("Time stamp: No known format found\n");
} }
offset +=1; // Skip netflow v9 fwd status offset +=1; // Skip netflow v9 fwd status
PushSequence( table, IPFIX_tcpControlBits, &offset, NULL); PushSequence( table, IPFIX_tcpControlBits, &offset, NULL);

1
bin/netflow_v9.c
View File

@ -544,6 +544,7 @@ int index;
index++; index++;
} }
#ifdef DEVEL #ifdef DEVEL
index--;
printf("=> known type: %u(%s), at index: %i, length: %u not supported\n", printf("=> known type: %u(%s), at index: %i, length: %u not supported\n",
Type, v9_element_map[index].name, index, Length); Type, v9_element_map[index].name, index, Length);