Collect IP flags cloudflare#54

sahejsingh · Jan 30, 2020 · bc899a2 · bc899a2
1 parent 1c015b5
commit bc899a2
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 3 deletions.
diff --git a/README.md b/README.md
@@ -175,7 +175,7 @@ You can find information on how they are populated from the original source:
 |IcmpCode|ICMP Code| |Included|ICMP_TYPE (32)|icmpCodeXXX (177, 179) icmpTypeCodeXXX (32, 139)|
 |IPv6FlowLabel|IPv6 Flow Label| |Included|IPV6_FLOW_LABEL (31)|flowLabelIPv6 (31)|
 |FragmentId|IP Fragment ID| |Included|IPV4_IDENT (54)|fragmentIdentification (54)|
-|FragmentOffset|IP Fragment Offset| |Included|FRAGMENT_OFFSET (88)|fragmentOffset (88)|
+|FragmentOffset|IP Fragment Offset| |Included|FRAGMENT_OFFSET (88)|fragmentOffset (88) and fragmentFlags (197)|
 |BiFlowDirection|BiFlow Identification| | | |biflowDirection (239)|
 |SrcAS|Source AS number|src_as|From ExtendedGateway|SRC_AS (16)|bgpSourceAsNumber (16)|
 |DstAS|Destination AS number|dst_as|From ExtendedGateway|DST_AS (17)|bgpDestinationAsNumber (17)|

diff --git a/producer/producer_nf.go b/producer/producer_nf.go
@@ -270,8 +270,13 @@ func ConvertNetFlowDataSet(version uint16, baseTime uint32, uptime uint32, recor
 		case netflow.NFV9_FIELD_IPV4_IDENT:
 			DecodeUNumber(v, &(flowMessage.FragmentId))
 		case netflow.NFV9_FIELD_FRAGMENT_OFFSET:
-			DecodeUNumber(v, &(flowMessage.FragmentOffset))
-
+			var fragOffset uint32
+			DecodeUNumber(v, &fragOffset)
+			flowMessage.FragmentOffset |= fragOffset
+		case netflow.IPFIX_FIELD_fragmentFlags:
+			var ipFlags uint32
+			DecodeUNumber(v, &ipFlags)
+			flowMessage.FragmentOffset |= ipFlags
 		case netflow.NFV9_FIELD_IPV6_FLOW_LABEL:
 			DecodeUNumber(v, &(flowMessage.IPv6FlowLabel))