Skip to content

Current status of support for Cisco High-Speed Logging (HSL) #93

Open
@jorritfolmer

Description

@jorritfolmer

I've created a new "cisco-hsl" branch to add support for Cisco HSL.

However, I'm running into a structural issue:

  • In template 284 both l4_src_port and l4_dest_port occur twice. This leads to a duplicate field definition error in the BinData library we use to process Netflow. This leads to dropping of the rest of the packet, which contains other templates. This leads to the inability to decode 50% of the netflow data. This may very well be a bug on Cisco's side, unfortunately we can't gracefully handle it, at all.

Currently only these flowset_id's are properly decoded:

  • 258
  • 261
  • 262

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions