Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IPFIX Template decoding does not handle Enterprise-Specific Information Elements #125

Open
rafal-prasal opened this issue Jan 5, 2024 · 0 comments

Comments

@rafal-prasal
Copy link

According to IPFIX RFC, when field highest bit is set to 1 then the field is considered Enterprise.
In such case just after that filed there are additional 4 bytes with value Enterprise Number an id in the field interpretation for the lookup table.

Due to that when hitting records with Enterprise-Specific Information Elements will get corrupted.

link to RFC
https://datatracker.ietf.org/doc/html/rfc7011#page-64

link to faulty function:

func DecodeTemplateSet(payload *bytes.Buffer) ([]TemplateRecord, error) {

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant