feat(inputs.netflow): Add support for netflow v9 option packets (#15180)

influxdata · Apr 23, 2024 · 5c483dc · 5c483dc
1 parent 46dbab0
commit 5c483dc
Show file tree

Hide file tree

Showing 5 changed files with 39 additions and 1 deletion.
diff --git a/plugins/inputs/netflow/netflow_decoder.go b/plugins/inputs/netflow/netflow_decoder.go
@@ -577,6 +577,34 @@ func (d *netflowDecoder) Decode(srcIP net.IP, payload []byte) ([]telegraf.Metric
 			case netflow.TemplateFlowSet:
 			case netflow.NFv9OptionsTemplateFlowSet:
 			case netflow.OptionsDataFlowSet:
+				for _, record := range fs.Records {
+					tags := map[string]string{
+						"source":  src,
+						"version": "NetFlowV9",
+					}
+					fields := make(map[string]interface{})
+					for _, value := range record.ScopesValues {
+						decodedFields, err := d.decodeValueV9(value)
+						if err != nil {
+							d.Log.Errorf("decoding option record %+v failed: %v", record, err)
+							continue
+						}
+						for _, field := range decodedFields {
+							fields[field.Key] = field.Value
+						}
+					}
+					for _, value := range record.OptionsValues {
+						decodedFields, err := d.decodeValueV9(value)
+						if err != nil {
+							d.Log.Errorf("decoding option record %+v failed: %v", record, err)
+							continue
+						}
+						for _, field := range decodedFields {
+							fields[field.Key] = field.Value
+						}
+					}
+					metrics = append(metrics, metric.New("netflow_options", tags, fields, t))
+				}
 			case netflow.DataFlowSet:
 				for _, record := range fs.Records {
 					tags := map[string]string{

diff --git a/plugins/inputs/netflow/testcases/netflow_v9_options/expected.out b/plugins/inputs/netflow/testcases/netflow_v9_options/expected.out
@@ -0,0 +1,8 @@
+netflow_options,source=127.0.0.1,version=NetFlowV9 in_bytes=169952189u,in_snmp=1u,interface="Te0/0/0",interface_desc="TenGigabitEthernet0/0/0",out_snmp=1u 1713379378304536264
+netflow_options,source=127.0.0.1,version=NetFlowV9 in_bytes=169952189u,in_snmp=2u,interface="Te0/0/1",interface_desc="TenGigabitEthernet0/0/1",out_snmp=2u 1713379378304536264
+netflow_options,source=127.0.0.1,version=NetFlowV9 in_bytes=169952189u,in_snmp=3u,interface="Te0/0/2",interface_desc="TenGigabitEthernet0/0/2",out_snmp=3u 1713379378304536264
+netflow_options,source=127.0.0.1,version=NetFlowV9 in_bytes=169952189u,in_snmp=4u,interface="Te0/0/3",interface_desc="TenGigabitEthernet0/0/3",out_snmp=4u 1713379378304536264
+netflow_options,source=127.0.0.1,version=NetFlowV9 in_bytes=169952189u,in_snmp=5u,interface="Te0/0/4",interface_desc="TenGigabitEthernet0/0/4",out_snmp=5u 1713379378304536264
+netflow_options,source=127.0.0.1,version=NetFlowV9 in_bytes=169952189u,in_snmp=6u,interface="Te0/0/5",interface_desc="TenGigabitEthernet0/0/5",out_snmp=6u 1713379378304536264
+netflow_options,source=127.0.0.1,version=NetFlowV9 in_bytes=169952189u,in_snmp=7u,interface="Gi0",interface_desc="GigabitEthernet0",out_snmp=7u 1713379378304536264
+netflow_options,source=127.0.0.1,version=NetFlowV9 in_bytes=169952189u,in_snmp=10u,interface="Lo0",interface_desc="Loopback0",out_snmp=10u 1713379378304536264
diff --git a/plugins/inputs/netflow/testcases/netflow_v9_options/message.bin b/plugins/inputs/netflow/testcases/netflow_v9_options/message.bin
diff --git a/plugins/inputs/netflow/testcases/netflow_v9_options/telegraf.conf b/plugins/inputs/netflow/testcases/netflow_v9_options/telegraf.conf
@@ -0,0 +1,2 @@
+[[inputs.netflow]]
+  service_address = "udp://127.0.0.1:0"
diff --git a/plugins/inputs/netflow/type_conversion.go b/plugins/inputs/netflow/type_conversion.go
@@ -142,7 +142,7 @@ func decodeHex(b []byte) (interface{}, error) {
 }
 
 func decodeString(b []byte) (interface{}, error) {
-	return string(b), nil
+	return strings.TrimRight(string(b), "\x00"), nil
 }
 
 func decodeMAC(b []byte) (interface{}, error) {