Bug 1958

Summary:	NetFlow v9 - incorrect count field in NetFlow v9 header
Product:	softflowd	Reporter:	ecoff
Component:	softflowd	Assignee:	Damien Miller <djm>
Status:	CLOSED INVALID
Severity:	major	CC:	ecoff
Priority:	P2
Version:	-current
Hardware:	All
OS:	All
URL:	http://www.ietf.org/rfc/rfc3954.txt

Description ecoff 2011-12-14 06:06:46 AEDT

According to the NetFlow v9 RFC, the count field in the NetFlow v9 header is:

The total number of records in the Export Packet, which is the sum of Options FlowSet records, Template FlowSet records, and Data FlowSet records. 

softflowd is exporting the count as ONLY the number of data flowset records and not including the Template flowset records.

Tools such as nfcapd ignore the count but report it when compiled with DEVEL flags:

Process_v9: New exporter domain 0 from: ::1

[1] Next packet: 0 10 records, buffer: 488 

...

Process_v9: Processed records 12, expected 10

Comment 1 Damien Miller 2019-01-23 20:05:58 AEDT

softflowd is not longer in this bugtracker

Comment 2 Damien Miller 2022-02-25 13:56:11 AEDT

closing bugs resolved before openssh-8.9