Graylog2 / Graylog2/graylog2-server

Netflow plugin, tries to show ipv4 addresses in the message for ipv6 flows

Open
#6,076 1 comment 0 reactions 1 assignee Claimed by @kroepke View on GitHub
#M bug good first issue triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Redirecting netflow statistics directly to graylog using sysctl net.netflow.destination=ip:port and configuring an Netflow UDP input to process all the incoming stats.

## Expected Behavior
In the message it should show source and destination ip.

## Current Behavior
Only does so for ipv4

## Possible Solution
Change [toMessage](https://github.com/Graylog2/graylog2-server/blob/20ab7325eb82ec09c08ece0433e183412f32a05d/graylog2-server/src/main/java/org/graylog/plugins/netflow/flows/NetFlowFormatter.java#L131) to use either ipv4 or ipv6 header for the flow.

## Steps to Reproduce (for bugs)

1. Configure a flow accounting on a ipv6 enabled interface with netflow pointing to Graylog Netflow input
2. Look for messages with null values for source and destination

* Graylog Version: Graylog 3.0.2+1686930 on aac10c1cf381 (Oracle Corporation 1.8.0_212 on Linux 5.1.0)
* Elasticsearch Version:
* MongoDB Version:
* Operating System:
* Browser version:

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.