Bug 1958 - NetFlow v9 - incorrect count field in NetFlow v9 header
Summary: NetFlow v9 - incorrect count field in NetFlow v9 header
Status: CLOSED INVALID
Alias: None
Product: softflowd
Classification: Unclassified
Component: softflowd (show other bugs)
Version: -current
Hardware: All All
: P2 major
Assignee: Damien Miller
URL: http://www.ietf.org/rfc/rfc3954.txt
Keywords:
Depends on:
Blocks:
 
Reported: 2011-12-14 06:06 AEDT by ecoff
Modified: 2022-02-25 13:56 AEDT (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description ecoff 2011-12-14 06:06:46 AEDT 
According to the NetFlow v9 RFC, the count field in the NetFlow v9 header is:

The total number of records in the Export Packet, which is the sum of Options FlowSet records, Template FlowSet records, and Data FlowSet records. 

softflowd is exporting the count as ONLY the number of data flowset records and not including the Template flowset records.

Tools such as nfcapd ignore the count but report it when compiled with DEVEL flags:

Process_v9: New exporter domain 0 from: ::1

[1] Next packet: 0 10 records, buffer: 488 

...

Process_v9: Processed records 12, expected 10
Comment 1 Damien Miller 2019-01-23 20:05:58 AEDT 
softflowd is not longer in this bugtracker
Comment 2 Damien Miller 2022-02-25 13:56:11 AEDT 
closing bugs resolved before openssh-8.9