Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[nfacctd] failed to parse Option Templates from Arista EOS device #764

Open
ThomasJLLN opened this issue Mar 6, 2024 · 2 comments
Open

[nfacctd] failed to parse Option Templates from Arista EOS device #764

ThomasJLLN opened this issue Mar 6, 2024 · 2 comments
Assignees
@paololucente
Labels
bug

Comments

@ThomasJLLN
Copy link

ThomasJLLN commented Mar 6, 2024 •
edited

Description

Hello 👋, I faced a parsing issue when nfacctd received IPFIX Options Templates 258, 256, 259, and 257 (in this order) by an Arista device running EOS version 4.30.5M. I encountered this problem when trying the Va. NetFlow daemon and accounting NetFlow v9/IPFIX options setup from the QUICKSTART file.

Here is the debug logs from nfacctd:

INFO ( default/core ): NetFlow Accounting Daemon, nfacctd 1.7.9-git (DAILY)
INFO ( default/core ): '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--disable-dependency-tracking' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--localstatedir=/var' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--enable-static' '--enable-jansson' '--enable-kafka' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection' 'LDFLAGS=-Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld' 'PKG_CONFIG_PATH=:/usr/lib64/pkgconfig:/usr/share/pkgconfig' 'CXXFLAGS=-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection' '--enable-l2' '--enable-traffic-bins' '--enable-bgp-bins' '--enable-bmp-bins' '--enable-st-bins'
INFO ( default/core ): Reading configuration file '/etc/pmacct/test_options.conf'.
INFO ( default/core ): [/etc/pmacct/primitives.lst] (re)loading map.
INFO ( default/core ): [/etc/pmacct/primitives.lst] map successfully (re)loaded.
DEBUG ( default/core ): Custom primitive 'vrf_id_ingress': type=ffff000000000001 off=0 len=4
DEBUG ( default/core ): Custom primitive 'vrf_id_egress': type=ffff000000000002 off=4 len=4
DEBUG ( default/core ): Custom primitive 'vrf_id_ingress': type=ffff000000000001 off=0 len=4
DEBUG ( default/core ): Custom primitive 'vrf_name': type=ffff000000000004 off=4 len=32
DEBUG ( default/core ): Custom primitive 'int_descr': type=ffff000000000008 off=0 len=64
DEBUG ( default/core ): Custom primitive 'sampler_id': type=ffff000000000020 off=0 len=2
DEBUG ( default/core ): Custom primitive 'sampler_interval': type=ffff000000000010 off=2 len=4
INFO ( data/print ): plugin_pipe_size=4096000 bytes plugin_buffer_size=352 bytes
INFO ( data/print ): ctrl channel: obtained=212992 bytes target=93088 bytes
INFO ( option_vrf/print ): plugin_pipe_size=4096000 bytes plugin_buffer_size=376 bytes
INFO ( option_vrf/print ): ctrl channel: obtained=212992 bytes target=87144 bytes
INFO ( data/print ): cache entries=16411 base cache memory=56322552 bytes
INFO ( option_if/print ): plugin_pipe_size=4096000 bytes plugin_buffer_size=408 bytes
INFO ( option_if/print ): ctrl channel: obtained=212992 bytes target=80312 bytes
INFO ( option_vrf/print ): cache entries=16411 base cache memory=56322552 bytes
INFO ( option_sampling/print ): plugin_pipe_size=4096000 bytes plugin_buffer_size=344 bytes
INFO ( option_sampling/print ): ctrl channel: obtained=212992 bytes target=95248 bytes
INFO ( option_if/print ): cache entries=16411 base cache memory=56322552 bytes
INFO ( default/core ): [/etc/pmacct/ipfix.map] (re)loading map.
INFO ( option_sampling/print ): cache entries=16411 base cache memory=56322552 bytes
INFO ( default/core ): [/etc/pmacct/ipfix.map] map successfully (re)loaded.
INFO ( default/core ): [/etc/pmacct/ipfix.map] (re)loading map.
INFO ( default/core ): [/etc/pmacct/ipfix.map] map successfully (re)loaded.
INFO ( default/core ): [/etc/pmacct/ipfix.map] (re)loading map.
INFO ( default/core ): [/etc/pmacct/ipfix.map] map successfully (re)loaded.
INFO ( default/core ): [/etc/pmacct/ipfix.map] (re)loading map.
INFO ( default/core ): [/etc/pmacct/ipfix.map] map successfully (re)loaded.
INFO ( default/core ): [/etc/pmacct/ipfix.map] (re)loading map.
INFO ( default/core ): [/etc/pmacct/ipfix.map] map successfully (re)loaded.
INFO ( default/core ): waiting for NetFlow/IPFIX data on interface=ens8f0 ip=0.0.0.0 port=2077/udp
DEBUG ( default/core ): Received NetFlow/IPFIX packet from [10.252.224.27:39458] version [10] seqno [79150]
DEBUG ( default/core ): Processing NetFlow/IPFIX flowset [2] from [10.252.224.27:39458] seqno [79150]
DEBUG ( default/core ): NfV10 agent : 10.252.224.27:1
DEBUG ( default/core ): NfV10 template type : flow
DEBUG ( default/core ): NfV10 template ID : 261
DEBUG ( default/core ): -------------------------------------------------------------
DEBUG ( default/core ): | pen | field type | offset | size |
DEBUG ( default/core ): | 0 | 234 [234 ] | 0 | 4 |
DEBUG ( default/core ): | 0 | 58 [58 ] | 4 | 2 |
DEBUG ( default/core ): | 0 | IPv4 src addr [8 ] | 6 | 4 |
DEBUG ( default/core ): | 0 | IPv4 dst addr [12 ] | 10 | 4 |
DEBUG ( default/core ): | 0 | L4 protocol [4 ] | 14 | 1 |
DEBUG ( default/core ): | 0 | L4 src port [7 ] | 15 | 2 |
DEBUG ( default/core ): | 0 | L4 dst port [11 ] | 17 | 2 |
DEBUG ( default/core ): | 0 | in src mac [56 ] | 19 | 6 |
DEBUG ( default/core ): | 0 | out dst mac [57 ] | 25 | 6 |
DEBUG ( default/core ): | 0 | in bytes [1 ] | 31 | 8 |
DEBUG ( default/core ): | 0 | in packets [2 ] | 39 | 8 |
DEBUG ( default/core ): | 0 | 152 [152 ] | 47 | 8 |
DEBUG ( default/core ): | 0 | 153 [153 ] | 55 | 8 |
DEBUG ( default/core ): | 0 | 136 [136 ] | 63 | 1 |
DEBUG ( default/core ): | 0 | tcp flags [6 ] | 64 | 2 |
DEBUG ( default/core ): | 0 | 368 [368 ] | 66 | 4 |
DEBUG ( default/core ): | 0 | input snmp [10 ] | 70 | 4 |
DEBUG ( default/core ): | 0 | 243 [243 ] | 74 | 2 |
DEBUG ( default/core ): | 0 | 245 [245 ] | 76 | 2 |
DEBUG ( default/core ): | 0 | 59 [59 ] | 78 | 2 |
DEBUG ( default/core ): | 0 | output snmp [14 ] | 80 | 4 |
DEBUG ( default/core ): | 0 | tos [5 ] | 84 | 1 |
DEBUG ( default/core ): | 0 | src as [16 ] | 85 | 4 |
DEBUG ( default/core ): | 0 | dst as [17 ] | 89 | 4 |
DEBUG ( default/core ): | 0 | direction [61 ] | 93 | 1 |
DEBUG ( default/core ): | 0 | BGP IPv4 next hop [18 ] | 94 | 4 |
DEBUG ( default/core ): | 0 | IPv4 next hop [15 ] | 98 | 4 |
DEBUG ( default/core ): | 0 | IPv4 src mask [9 ] | 102 | 1 |
DEBUG ( default/core ): | 0 | IPv4 dst mask [13 ] | 103 | 1 |
DEBUG ( default/core ): -------------------------------------------------------------
DEBUG ( default/core ): Netflow V9/IPFIX record size : 104
DEBUG ( default/core ):
DEBUG ( default/core ): NfV10 agent : 10.252.224.27:1
DEBUG ( default/core ): NfV10 template type : flow
DEBUG ( default/core ): NfV10 template ID : 262
DEBUG ( default/core ): -------------------------------------------------------------
DEBUG ( default/core ): | pen | field type | offset | size |
DEBUG ( default/core ): | 0 | 234 [234 ] | 0 | 4 |
DEBUG ( default/core ): | 0 | 58 [58 ] | 4 | 2 |
DEBUG ( default/core ): | 0 | IPv6 src addr [27 ] | 6 | 16 |
DEBUG ( default/core ): | 0 | IPv6 dst addr [28 ] | 22 | 16 |
DEBUG ( default/core ): | 0 | L4 protocol [4 ] | 38 | 1 |
DEBUG ( default/core ): | 0 | L4 src port [7 ] | 39 | 2 |
DEBUG ( default/core ): | 0 | L4 dst port [11 ] | 41 | 2 |
DEBUG ( default/core ): | 0 | in src mac [56 ] | 43 | 6 |
DEBUG ( default/core ): | 0 | out dst mac [57 ] | 49 | 6 |
DEBUG ( default/core ): | 0 | in bytes [1 ] | 55 | 8 |
DEBUG ( default/core ): | 0 | in packets [2 ] | 63 | 8 |
DEBUG ( default/core ): | 0 | 152 [152 ] | 71 | 8 |
DEBUG ( default/core ): | 0 | 153 [153 ] | 79 | 8 |
DEBUG ( default/core ): | 0 | 136 [136 ] | 87 | 1 |
DEBUG ( default/core ): | 0 | tcp flags [6 ] | 88 | 2 |
DEBUG ( default/core ): | 0 | 368 [368 ] | 90 | 4 |
DEBUG ( default/core ): | 0 | input snmp [10 ] | 94 | 4 |
DEBUG ( default/core ): | 0 | 243 [243 ] | 98 | 2 |
DEBUG ( default/core ): | 0 | 245 [245 ] | 100 | 2 |
DEBUG ( default/core ): | 0 | 59 [59 ] | 102 | 2 |
DEBUG ( default/core ): | 0 | output snmp [14 ] | 104 | 4 |
DEBUG ( default/core ): | 0 | tos [5 ] | 108 | 1 |
DEBUG ( default/core ): | 0 | src as [16 ] | 109 | 4 |
DEBUG ( default/core ): | 0 | dst as [17 ] | 113 | 4 |
DEBUG ( default/core ): | 0 | direction [61 ] | 117 | 1 |
DEBUG ( default/core ): | 0 | IPv6 BGP next hop [63 ] | 118 | 16 |
DEBUG ( default/core ): | 0 | IPv6 next hop [62 ] | 134 | 16 |
DEBUG ( default/core ): | 0 | IPv6 src mask [29 ] | 150 | 1 |
DEBUG ( default/core ): | 0 | IPv6 dst mask [30 ] | 151 | 1 |
DEBUG ( default/core ): | 0 | IPv6 flow label [31 ] | 152 | 4 |
DEBUG ( default/core ): -------------------------------------------------------------
DEBUG ( default/core ): Netflow V9/IPFIX record size : 156
DEBUG ( default/core ):
DEBUG ( default/core ): NfV10 agent : 10.252.224.27:1
DEBUG ( default/core ): NfV10 template type : flow
DEBUG ( default/core ): NfV10 template ID : 273
DEBUG ( default/core ): -------------------------------------------------------------
DEBUG ( default/core ): | pen | field type | offset | size |
DEBUG ( default/core ): | 0 | 235 [235 ] | 0 | 4 |
DEBUG ( default/core ): | 0 | 58 [58 ] | 4 | 2 |
DEBUG ( default/core ): | 0 | IPv4 src addr [8 ] | 6 | 4 |
DEBUG ( default/core ): | 0 | IPv4 dst addr [12 ] | 10 | 4 |
DEBUG ( default/core ): | 0 | L4 protocol [4 ] | 14 | 1 |
DEBUG ( default/core ): | 0 | L4 src port [7 ] | 15 | 2 |
DEBUG ( default/core ): | 0 | L4 dst port [11 ] | 17 | 2 |
DEBUG ( default/core ): | 0 | in src mac [56 ] | 19 | 6 |
DEBUG ( default/core ): | 0 | out dst mac [57 ] | 25 | 6 |
DEBUG ( default/core ): | 0 | in bytes [1 ] | 31 | 8 |
DEBUG ( default/core ): | 0 | in packets [2 ] | 39 | 8 |
DEBUG ( default/core ): | 0 | 152 [152 ] | 47 | 8 |
DEBUG ( default/core ): | 0 | 153 [153 ] | 55 | 8 |
DEBUG ( default/core ): | 0 | 136 [136 ] | 63 | 1 |
DEBUG ( default/core ): | 0 | tcp flags [6 ] | 64 | 2 |
DEBUG ( default/core ): | 0 | 368 [368 ] | 66 | 4 |
DEBUG ( default/core ): | 0 | input snmp [10 ] | 70 | 4 |
DEBUG ( default/core ): | 0 | 243 [243 ] | 74 | 2 |
DEBUG ( default/core ): | 0 | 245 [245 ] | 76 | 2 |
DEBUG ( default/core ): | 0 | 59 [59 ] | 78 | 2 |
DEBUG ( default/core ): | 0 | output snmp [14 ] | 80 | 4 |
DEBUG ( default/core ): | 0 | tos [5 ] | 84 | 1 |
DEBUG ( default/core ): | 0 | src as [16 ] | 85 | 4 |
DEBUG ( default/core ): | 0 | dst as [17 ] | 89 | 4 |
DEBUG ( default/core ): | 0 | direction [61 ] | 93 | 1 |
DEBUG ( default/core ): | 0 | BGP IPv4 next hop [18 ] | 94 | 4 |
DEBUG ( default/core ): | 0 | IPv4 next hop [15 ] | 98 | 4 |
DEBUG ( default/core ): | 0 | IPv4 src mask [9 ] | 102 | 1 |
DEBUG ( default/core ): | 0 | IPv4 dst mask [13 ] | 103 | 1 |
DEBUG ( default/core ): -------------------------------------------------------------
DEBUG ( default/core ): Netflow V9/IPFIX record size : 104
DEBUG ( default/core ):
DEBUG ( default/core ): NfV10 agent : 10.252.224.27:1
DEBUG ( default/core ): NfV10 template type : flow
DEBUG ( default/core ): NfV10 template ID : 274
DEBUG ( default/core ): -------------------------------------------------------------
DEBUG ( default/core ): | pen | field type | offset | size |
DEBUG ( default/core ): | 0 | 235 [235 ] | 0 | 4 |
DEBUG ( default/core ): | 0 | 58 [58 ] | 4 | 2 |
DEBUG ( default/core ): | 0 | IPv6 src addr [27 ] | 6 | 16 |
DEBUG ( default/core ): | 0 | IPv6 dst addr [28 ] | 22 | 16 |
DEBUG ( default/core ): | 0 | L4 protocol [4 ] | 38 | 1 |
DEBUG ( default/core ): | 0 | L4 src port [7 ] | 39 | 2 |
DEBUG ( default/core ): | 0 | L4 dst port [11 ] | 41 | 2 |
DEBUG ( default/core ): | 0 | in src mac [56 ] | 43 | 6 |
DEBUG ( default/core ): | 0 | out dst mac [57 ] | 49 | 6 |
DEBUG ( default/core ): | 0 | in bytes [1 ] | 55 | 8 |
DEBUG ( default/core ): | 0 | in packets [2 ] | 63 | 8 |
DEBUG ( default/core ): | 0 | 152 [152 ] | 71 | 8 |
DEBUG ( default/core ): | 0 | 153 [153 ] | 79 | 8 |
DEBUG ( default/core ): | 0 | 136 [136 ] | 87 | 1 |
DEBUG ( default/core ): | 0 | tcp flags [6 ] | 88 | 2 |
DEBUG ( default/core ): | 0 | 368 [368 ] | 90 | 4 |
DEBUG ( default/core ): | 0 | input snmp [10 ] | 94 | 4 |
DEBUG ( default/core ): | 0 | 243 [243 ] | 98 | 2 |
DEBUG ( default/core ): | 0 | 245 [245 ] | 100 | 2 |
DEBUG ( default/core ): | 0 | 59 [59 ] | 102 | 2 |
DEBUG ( default/core ): | 0 | output snmp [14 ] | 104 | 4 |
DEBUG ( default/core ): | 0 | tos [5 ] | 108 | 1 |
DEBUG ( default/core ): | 0 | src as [16 ] | 109 | 4 |
DEBUG ( default/core ): | 0 | dst as [17 ] | 113 | 4 |
DEBUG ( default/core ): | 0 | direction [61 ] | 117 | 1 |
DEBUG ( default/core ): | 0 | IPv6 BGP next hop [63 ] | 118 | 16 |
DEBUG ( default/core ): | 0 | IPv6 next hop [62 ] | 134 | 16 |
DEBUG ( default/core ): | 0 | IPv6 src mask [29 ] | 150 | 1 |
DEBUG ( default/core ): | 0 | IPv6 dst mask [30 ] | 151 | 1 |
DEBUG ( default/core ): | 0 | IPv6 flow label [31 ] | 152 | 4 |
DEBUG ( default/core ): -------------------------------------------------------------
DEBUG ( default/core ): Netflow V9/IPFIX record size : 156
DEBUG ( default/core ):
DEBUG ( default/core ): Received NetFlow/IPFIX packet from [10.252.224.27:39458] version [10] seqno [79150]
DEBUG ( default/core ): Processing NetFlow/IPFIX flowset [3] from [10.252.224.27:39458] seqno [79150]
DEBUG ( default/core ): NfV10 agent : 10.252.224.27:1
DEBUG ( default/core ): NfV10 template type : options
DEBUG ( default/core ): NfV10 template ID : 258
DEBUG ( default/core ): -------------------------------------------------------------
DEBUG ( default/core ): | pen | field type | offset | size |
DEBUG ( default/core ): | 0 | 145 [145 ] | 0 | 2 |
DEBUG ( default/core ): | 0 | 173 [173 ] | 2 | 8 |
DEBUG ( default/core ): -------------------------------------------------------------
DEBUG ( default/core ): Netflow V9/IPFIX record size : 10
DEBUG ( default/core ):
DEBUG ( default/core ): NfV10 agent : 10.252.224.27:1
DEBUG ( default/core ): NfV10 template type : options
DEBUG ( default/core ): NfV10 template ID : 1
DEBUG ( default/core ): -------------------------------------------------------------
DEBUG ( default/core ): | pen | field type | offset | size |
DEBUG ( default/core ): | 0 | 236 [236 ] | 0 | 65535 |
DEBUG ( default/core ): | 0 | 259 [259 ] | 65535 | 8 |
DEBUG ( default/core ): | 0 | scope [1 ] | 7 | 149 |
DEBUG ( default/core ): | 0 | 4 [4 ] | 156 | 300 |
DEBUG ( default/core ): | 131109 | 32767 [32767] | 456 | 36 |
DEBUG ( default/core ): | 0 | 2 [2 ] | 492 | 304 |
DEBUG ( default/core ): | 0 | 2 [2 ] | 796 | 309 |
DEBUG ( default/core ): | 0 | 4 [4 ] | 1105 | 310 |
DEBUG ( default/core ): | 0 | 4 [4 ] | 1415 | 33769 |
DEBUG ( default/core ): | 0 | 2 [2 ] | 35184 | 0 |
DEBUG ( default/core ): | 0 | 30065 [30065] | 35184 | 257 |
DEBUG ( default/core ): | 0 | 2 [2 ] | 35441 | 1 |
INFO ( default/core ): template element 2 repeated too often, skipping data
DEBUG ( default/core ): | 0 | 10 [10 ] | 35442 | 4 |
DEBUG ( default/core ): | 0 | 82 [82 ] | 35446 | 65535 |
INFO ( default/core ): insert_opt_template(): unable to read Options Template Flowset (malformed): nfacctd=0.0.0.0:2077 agent=10.252.224.27:39458 seq=79150
WARN ( default/core ): Unable to insert template in tpl_data_map
DEBUG ( default/core ): Received NetFlow/IPFIX packet from [10.252.224.27:39458] version [10] seqno [79150]
DEBUG ( default/core ): Processing NetFlow/IPFIX flowset [261] from [10.252.224.27:39458] seqno [79150]
DEBUG ( default/core ): Received NetFlow/IPFIX packet from [10.252.224.27:39458] version [10] seqno [79163]
DEBUG ( default/core ): Processing NetFlow/IPFIX flowset [261] from [10.252.224.27:39458] seqno [79163]

Interestingly, the first Options Template with ID 258 is well-parsed, while the second one seems not to be and reports an error.

After looking at a capture file of the IPFIX messages sent by the device that generated these logs, the Option Template packet didn't contain any padding, but following the RFC7011 section 3.4.2.2, the padding is optional.

I took a look at the nfacctd_pre_processing_checks feature that checks end-of-flowset padding:

  • end-of-flowset padding: malformed if contains non-zero bytes (before enabling these
    checks consider that RFC7011[IPFIX] mandates zero-octets padding whereas RFC3954[NFv9]
    only recommends it).

However, on both Data Record format (3.4.3) & Option Template format, padding is optional. I looked at previous versions of the RFC, and padding was still optional.

How can we proceed to resolve the issue? My conclusion is that there is no error on the IPFIX messages generated by the EOS device, but maybe I'm wrong...
I can privately send the capture of the IPFIX messages to help the investigation.

Version
Provide the version in use. An output of -V is typically good, ie. nfacctd -V

NetFlow Accounting Daemon, nfacctd 1.7.9-git [DAILY]

Arguments:
'--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--disable-dependency-tracking' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--localstatedir=/var' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--enable-static' '--enable-jansson' '--enable-kafka' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection' 'LDFLAGS=-Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld' 'PKG_CONFIG_PATH=:/usr/lib64/pkgconfig:/usr/share/pkgconfig' 'CXXFLAGS=-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection' '--enable-l2' '--enable-traffic-bins' '--enable-bgp-bins' '--enable-bmp-bins' '--enable-st-bins'

Libs:
cdada 0.5.0
libpcap version 1.9.1 (with TPACKET_V3)
rdkafka 0.11.4
jansson 2.14

Plugins:
memory
print
nfprobe
sfprobe
tee
kafka

System:
Linux 5.16.12-1.el8.x86_64 #1 SMP Mon Mar 7 15:36:33 UTC 2022 x86_64

Compiler:
gcc 8.5.0

For suggestions, critics, bugs, contact me: Paolo Lucente paolo@pmacct.net.
@ThomasJLLN ThomasJLLN changed the title NFACCTD failed to parse Option Templates from Arista EOS device [nfacctd] failed to parse Option Templates from Arista EOS device Mar 6, 2024
@paololucente
Copy link
Member

Hi Thomas ( @ThomasJLLN ),

Yes, please. Send me some capture so that i can reproduce the issue and look into it. I see also a map /etc/pmacct/ipfix.map: probably having the config and the map (or an excerpt of it and any other ancillary files referenced by the config) would help.

Paolo

@ThomasJLLN
Copy link
Author

Hello @paololucente,

Thank you for your response.
I've sent you an email with the capture file.
Please find below the configuration files:

nfacctd.conf

daemonize: false
plugin_exit_any: true
propagate_signals: true

nfacctd_port: 2077
nfacctd_ip: 0.0.0.0
nfacctd_interface: ens8f0
nfacctd_account_options: true
nfacctd_renormalize: true
nfacctd_pro_rating: true
#nfacctd_pre_processing_checks: false
#nfacctd_disable_opt_scope_check: true

pre_tag_map: /etc/pmacct/ipfix.map
#pre_tag_label_encode_as_map: true
maps_entries: 2048
maps_refresh: true
sampling_map: /etc/pmacct/sampling.map
aggregate_primitives: /etc/pmacct/primitives.lst

plugins: print[data], print[option_vrf]

pre_tag_filter[data]: 100
aggregate[data]: label, peer_src_ip, src_host, dst_host, proto, src_port, dst_port, in_iface, out_iface, vrf_id_ingress
print_history[data]: 300
print_refresh_time[data]: 300
print_output[data]: csv
print_output_file[data]: /var/log/nfacctd.log
print_output_file_append[data]: true

pre_tag_filter[option_vrf]: 200
aggregate[option_vrf]: peer_src_ip, vrf_id_ingress, vrf_name
print_output[option_vrf]: csv
print_output_file[option_vrf]: /var/log/nfacctd_option.log
print_output_file_append[option_vrf]: true
print_history[option_vrf]: 300
print_refresh_time[option_vrf]: 300

! Increase the data queue between the core process and the plugins
plugin_pipe_size: 10240000

! The value has to be <= the size defined by 'plugin_pipe_size' and keeping a ratio < 1:1000 between the two
! Once a buffer is filled, it is delivered to the plugin
plugin_buffer_size: 10240

timestamps_since_epoch: true
timestamps_secs: true

sampling.map

id=16384 ip=0.0.0.0/0

primitives.lst

name=vrf_id_ingress field_type=234 len=4 semantics=u_int
name=vrf_id_egress field_type=235 len=4 semantics=u_int
name=vrf_name field_type=236 len=32 semantics=str
name=int_descr field_type=83 len=64 semantics=str
name=sampler_interval field_type=50 len=4 semantics=u_int
name=sampler_id field_type=48 len=2 semantics=u_int

paololucente added a commit that referenced this issue Mar 20, 2024
@paololucente
* fix, nfacctd: erroneous length count prevented correctly parsing mu…
4252ab3 
…ltiple Options part of the same set in IPFIX. To address Issue #764
@paololucente paololucente self-assigned this Mar 21, 2024
paololucente added a commit that referenced this issue Apr 17, 2024
@paololucente
* nfacctd: added support for variable-length Options in IPFIX. To add…
babc793 
…ress Issue #764
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@paololucente paololucente

Labels
bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@paololucente @ThomasJLLN