diff --git a/README.md b/README.md index 6b4dbec..b4108ad 100644 --- a/README.md +++ b/README.md @@ -175,7 +175,7 @@ You can find information on how they are populated from the original source: |IcmpCode|ICMP Code| |Included|ICMP_TYPE (32)|icmpCodeXXX (177, 179) icmpTypeCodeXXX (32, 139)| |IPv6FlowLabel|IPv6 Flow Label| |Included|IPV6_FLOW_LABEL (31)|flowLabelIPv6 (31)| |FragmentId|IP Fragment ID| |Included|IPV4_IDENT (54)|fragmentIdentification (54)| -|FragmentOffset|IP Fragment Offset| |Included|FRAGMENT_OFFSET (88)|fragmentOffset (88)| +|FragmentOffset|IP Fragment Offset| |Included|FRAGMENT_OFFSET (88)|fragmentOffset (88) and fragmentFlags (197)| |BiFlowDirection|BiFlow Identification| | | |biflowDirection (239)| |SrcAS|Source AS number|src_as|From ExtendedGateway|SRC_AS (16)|bgpSourceAsNumber (16)| |DstAS|Destination AS number|dst_as|From ExtendedGateway|DST_AS (17)|bgpDestinationAsNumber (17)| diff --git a/producer/producer_nf.go b/producer/producer_nf.go index 18c7ec8..06e7175 100644 --- a/producer/producer_nf.go +++ b/producer/producer_nf.go @@ -270,8 +270,13 @@ func ConvertNetFlowDataSet(version uint16, baseTime uint32, uptime uint32, recor case netflow.NFV9_FIELD_IPV4_IDENT: DecodeUNumber(v, &(flowMessage.FragmentId)) case netflow.NFV9_FIELD_FRAGMENT_OFFSET: - DecodeUNumber(v, &(flowMessage.FragmentOffset)) - + var fragOffset uint32 + DecodeUNumber(v, &fragOffset) + flowMessage.FragmentOffset |= fragOffset + case netflow.IPFIX_FIELD_fragmentFlags: + var ipFlags uint32 + DecodeUNumber(v, &ipFlags) + flowMessage.FragmentOffset |= ipFlags case netflow.NFV9_FIELD_IPV6_FLOW_LABEL: DecodeUNumber(v, &(flowMessage.IPv6FlowLabel))