Add support for nfType 201.

Makes a simple vyos packet parsable. Since type > 127 are in ipfix and 128+129 already were in there I added 201 which vyos sends as well. Fixes #2.
delian · Jul 1, 2014 · 227c8d3 · 227c8d3
1 parent 65b7adf
commit 227c8d3
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 4 deletions.
diff --git a/netflowv9.js b/netflowv9.js
@@ -164,8 +164,11 @@ var nfTypes = {
     '96': { name: 'application_name', len: 4, decode: decString, compileRule: decStringRule },
     '98': { name: 'DiffServCodePoint', len: 1, decode: decNumber, compileRule: decNumRule },
     '99': { name: 'replication_factor', len: 4, decode: decNumber, compileRule: decNumRule },
+    //above 127 is in ipfix
     '128': { name: 'in_as', len: 4, decode: decNumber, compileRule: decNumRule },
-    '129': { name: 'out_as', len: 4, decode: decNumber, compileRule: decNumRule }
+    '129': { name: 'out_as', len: 4, decode: decNumber, compileRule: decNumRule },
+    //the following are taken from from http://www.iana.org/assignments/ipfix/ipfix.xhtml
+    '201': { name: 'mplsLabelStackLength', len: 4, decode: decNumber, compileRule: decNumRule } 
 };
 
 function nfPktDecode(msg,templates) {
@@ -221,7 +224,7 @@ function nfPktDecode(msg,templates) {
                 list.push({ type: buf.readUInt16BE(4+4*i), len: buf.readUInt16BE(6+4*i) });
                 len += buf.readUInt16BE(6+4*i);
             }
-
+            debug('compile template %s', tId);
             templates[tId] = { len: len, list: list , compiled: compileTemplate(list) };
             buf = buf.slice(4+cnt*4);
         }

diff --git a/test/test.decoding.js b/test/test.decoding.js
@@ -24,8 +24,29 @@ describe('NetFlowV9', function () {
             var templates = {};
             expect(buffer).to.have.length(VYOS_PACKET.length/2);
             var r = NetFlowV9.nfPktDecode(buffer, templates);
-            console.log('templates', templates);
-            console.log("asdf", r);
+            expect(templates).to.have.property('1024');
+            expect(templates).to.have.property('1025');
+            expect(templates).to.have.property('2048');
+            expect(templates).to.have.property('2049');
+            expect(r).to.have.property('header');
+            expect(r).to.have.property('flows');
+
+            var header = r.header;
+            expect(header).to.have.property('version', 9);
+            expect(header).to.have.property('count', 7);
+            expect(header).to.have.property('uptime', 152731);
+            expect(header).to.have.property('seconds', 1404209570);
+            expect(header).to.have.property('sequence', 1);
+            expect(header).to.have.property('sourceId', 0);
+
+            var flows = r.flows;
+            expect(flows).to.have.length(1);
+
+            var f1 = flows[0];
+            expect(f1).to.have.property('ipv4_src_addr', '10.100.0.84');
+            expect(f1).to.have.property('ipv4_dst_addr', '192.0.76.2');
+            expect(f1).to.have.property('in_pkts', 1);
+            //TODO:test everything
             done();
         });
     });