21 Commits

Author SHA1 Message Date
Louis c38607daf9 transport: mute errors when too verbose (#249) 2024-01-06 01:03:13 -08:00
Louis ff4ddca5d5 metrics: collect drops on receiver (#226) 2024-01-06 00:51:07 -08:00
Louis 1a5d58e3cf feat: handle panic (#254) 2023-12-09 11:56:30 -08:00
Louis b047aafe15 goflow2: allows using a single port for multiple protocols (sFlow, NetFlow, IPFIX) (#197) 2023-08-14 18:39:56 -07:00
Louis ae56e41786 refactor: v2 (#150) 2023-08-09 19:47:20 -07:00
Louis 69a6eaf99e templates: retrofit to avoid issue when upgrading dep (#160) 2023-04-20 20:05:33 -07:00
Louis c4c4ffb4e4 Refactor template as module (#49)
* Refactor template as module
* Abstraction to allow custom template storage (eg: file, redis, http...)
* Works similarly to Transport and Format
2023-04-15 20:52:32 -07:00
Louis 40e5ef08fd mapping: allow lists to be mapped (#149) 2023-03-28 21:55:21 -07:00
Louis 7801c6a273 nit: defer after error check (#127) 2022-10-08 08:55:53 -07:00
Louis d6caeaacdd Bugfix: fix closing of UDP routine (#118) 2022-08-24 20:38:56 -07:00
Ian fc42020d1b Silently drop 0 byte packets without processing as flow (#114)
Co-authored-by: Ian Pye <pye@kentik.com>
2022-08-17 20:01:02 -07:00
Louis 0020934574 Observation domain (#98)
* netflow: Add observation domain and point to message

The ObservationDomainID and ObservationPointID are two IPFIX fields that
identify the entity that is capturing flows and can be used to enrich
the context around a specific sample.

Parse these fields from the sample and add them to the FlowMessage.

Signed-off-by: Adrian Moreno <amorenoz@redhat.com>
Co-authored-by: Adrian Moreno <amorenoz@redhat.com>
2022-07-20 21:27:51 -07:00
Olivier Cazade 78f2ce561d Add logging of transport error 2022-06-13 17:36:28 +02:00
Vincent Bernat a5fc8ecfb6 Fix type for a counter when decoding a template flowset 2022-03-03 19:45:34 +01:00
Mario Macias 615b9f697c Avoid unnecessary memory allocations 2022-01-26 17:24:35 +01:00
lspgn 43cf8b58d9 Bugfix: decoding OptionsTemplateSet
* Was improperly decoding scope fields
* Start removing custom errors structures (will optimize template not found)
2021-11-13 15:49:27 -08:00
Vincent Bernat 0f5528170d utils: copy payload before accepting another UDP packet
In d1e1ace318 ("Allow Flow Routines to be cancellable (#40)"), the
payload was passed to another goroutine and erased by the next packet
to be received if the goroutine did not process it fast enough. Make
a copy before passing it to the goroutine to fix that.
2021-11-10 15:56:49 +01:00
Mario Macias d1e1ace318 Allow Flow Routines to be cancellable (#40)
* Allow Flow Routines to be cancellable
2021-10-31 16:42:07 -07:00
Louis 536b08812f Custom map flow fields (#36)
* adds dataframe link decoding
* can map NetFlow/IPFIX fields and bytes sections from sFlow/packets to any field inside the protobuf
* add CLI argument for loading a mapping yaml file
2021-09-23 20:41:17 -07:00
lspgn 04c8543306 Bugfix NetFlow/IPFIX producer
* Source and destination mac addresses are fed from `NFV9_FIELD_xx_yyy_MAC`
  Fixes a bug where the samples were missing either source or destination Mac.
  This is supposed to be linked to the sampling direction.
2021-06-09 18:08:55 -07:00
lspgn e4bacbc4bd init 2021-05-25 17:33:26 -07:00