Graylog2 / Graylog2/graylog2-server
Netflow plugin, tries to show ipv4 addresses in the message for ipv6 flows
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Redirecting netflow statistics directly to graylog using sysctl net.netflow.destination=ip:port and configuring an Netflow UDP input to process all the incoming stats.
## Expected Behavior
In the message it should show source and destination ip.
## Current Behavior
Only does so for ipv4
## Possible Solution
Change [toMessage](https://github.com/Graylog2/graylog2-server/blob/20ab7325eb82ec09c08ece0433e183412f32a05d/graylog2-server/src/main/java/org/graylog/plugins/netflow/flows/NetFlowFormatter.java#L131) to use either ipv4 or ipv6 header for the flow.
## Steps to Reproduce (for bugs)
1. Configure a flow accounting on a ipv6 enabled interface with netflow pointing to Graylog Netflow input
2. Look for messages with null values for source and destination
* Graylog Version: Graylog 3.0.2+1686930 on aac10c1cf381 (Oracle Corporation 1.8.0_212 on Linux 5.1.0)
* Elasticsearch Version:
* MongoDB Version:
* Operating System:
* Browser version:
Contributor guide
Assessment
This issue has not been assessed yet.