TCP flags in collector mode
@lucaderi is already working on this.
Since Jul 13, 2021.
- Dominant language
- Lua
- Stars
- 1.8k
- Forks
- 51
- PR merge metrics
- No merged PRs in 30d
Description
Default template in collector mode (EXPANDED_NTOPNG_SHORTCUT_COLLECTOR_MODE) should only include %TCP_FLAGS and not %CLIENT_TCP_FLAGS %SERVER_TCP_FLAGS.
This because NetFlow flags are cumulative.
V5:
37 | tcp_flags | Cumulative OR of TCP flags
Source: https://www.ibm.com/docs/en/npi/1.3.0?topic=versions-netflow-v5-formats
V9:
TCP_FLAGS | 6 | 1 | Cumulative of all the TCP flags seen for this flow
Source: https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html
Using per-direction flags causes cumulative flags to be exported into per-direction flags and also tricks downstream receivers into taking wrong decisions.
I have also provided a Mikrotik capture privately that shows this behavior even when NetFlow is monodirectional as in V5.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.