Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow users to suppress/process empty IPFIX packets #207

Open
edmocosta opened this issue Jan 31, 2024 · 0 comments
Open

Allow users to suppress/process empty IPFIX packets #207

edmocosta opened this issue Jan 31, 2024 · 0 comments

Comments

@edmocosta
Copy link

It's not uncommon for a few Cisco IPFIX devices to send packets with flow length equals to 4, which essentially is the size of the Flow Set ID + Flow Set length frames, leaving the information/data somehow empty/malformed.

The current behavior is to ignore such packets and log the warning message - as reading them fails due to this record definition constraint, flooding the logs with invalid packet messages (Invalid netflow packet received (value '4' not as expected for obj.records[0].flowset_length)).

Allowing users to disable such warnings, or even processing the received empty events, using the flow set to fill the default properties, would be a nice addition to this codec.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant