ntop / ntop/nProbe

Export for %GTPV2_REQ_MSG_TYPE and %GTPV2_RSP_MSG_TYPE not working in v9.5 and v9.7

Open
#503 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Lua
Stars
1.8k
Forks
51
No merged PRs in 30d

Description

Hello,

We've upgraded recently nprobe in a server, moving from v.8.7.181005 (r6312) to v.9.5.210716 (r7377) (and later to v9.7.210803 (r7412)). With this change, we've detected the information in the fields %GTPV2_REQ_MSG_TYPE and %GTPV2_RSP_MSG_TYPE stopped getting populated.

Listening to the same trace in releases 9.5 and 9.7 and previous releases (8.6, 8.7, 9.4) results in a different output, being blank (0) for these 2 fields in 9.7 release.

In the nprobe help I don't find the name of the fields have changed, and there's no warnings for them in the logs. Is there any config adjustment we'd need to do for these releases?
Thanks.

Below you can find the configuration and output for a test. We can provide the pcap for the tests as well.

The configuration for the tests:

-n=none
-i=/var/tmp/20210803.pcap
--flow-templ="%IPV4_SRC_ADDR %IPV4_DST_ADDR %IN_PKTS %IN_BYTES %OUT_PKTS %OUT_BYTES %FIRST_SWITCHED %LAST_SWITCHED %L4_SRC_PORT %L4_DST_PORT %PROTOCOL %L7_PROTO_NAME %SRC_IP_COUNTRY %DST_IP_COUNTRY %SSL_SERVER_NAME %UPSTREAM_TUNNEL_ID %DOWNSTREAM_TUNNEL_ID %UNTUNNELED_IPV4_SRC_ADDR %UNTUNNELED_IPV4_DST_ADDR %GTPV2_REQ_MSG_TYPE %GTPV2_RSP_MSG_TYPE %GTPV2_C2S_S1U_GTPU_TEID %GTPV2_C2S_S1U_GTPU_IP %GTPV2_S2C_S1U_GTPU_TEID %GTPV2_S5_S8_GTPC_TEID %GTPV2_S2C_S1U_GTPU_IP %GTPV2_C2S_S5_S8_GTPU_TEID %GTPV2_S2C_S5_S8_GTPU_TEID %GTPV2_C2S_S5_S8_GTPU_IP %GTPV2_S2C_S5_S8_GTPU_IP %GTPV2_END_USER_IMSI %GTPV2_END_USER_MSISDN %GTPV2_APN_NAME %GTPV2_ULI_MCC %GTPV2_ULI_MNC %GTPV2_ULI_CELL_TAC %GTPV2_ULI_CELL_ID %GTPV2_RESPONSE_CAUSE %GTPV2_RAT_TYPE %GTPV2_PDN_IP %GTPV2_END_USER_IMEI %GTPV2_C2S_S5_S8_GTPC_IP %GTPV2_S2C_S5_S8_GTPC_IP %GTPV2_C2S_S5_S8_SGW_GTPU_TEID %GTPV2_S2C_S5_S8_SGW_GTPU_TEID %GTPV2_C2S_S5_S8_SGW_GTPU_IP %GTPV2_S2C_S5_S8_SGW_GTPU_IP"
-P=/media/data1/nprobe/flows-test
-D=t 
--tunnel
-b=1

Output excerpt in 9.7.210803-7412:

IPV4_SRC_ADDR|IPV4_DST_ADDR|IN_PKTS|IN_BYTES|OUT_PKTS|OUT_BYTES|FIRST_SWITCHED|LAST_SWITCHED|L4_SRC_PORT|L4_DST_PORT|PROTOCOL|L7_PROTO_NAME|SRC_IP_COUNTRY|DST_IP_COUNTRY|UPSTREAM_TUNNEL_ID|DOWNSTREAM_TUNNEL_ID|UNTUNNELED_IPV4_SRC_ADDR|UNTUNNELED_IPV4_DST_ADDR|GTPV2_REQ_MSG_TYPE|GTPV2_RSP_MSG_TYPE|GTPV2_C2S_S1U_GTPU_TEID|GTPV2_C2S_S1U_GTPU_IP|GTPV2_S2C_S1U_GTPU_TEID|GTPV2_S5_S8_GTPC_TEID|GTPV2_S2C_S1U_GTPU_IP|GTPV2_C2S_S5_S8_GTPU_TEID|GTPV2_S2C_S5_S8_GTPU_TEID|GTPV2_C2S_S5_S8_GTPU_IP|GTPV2_S2C_S5_S8_GTPU_IP|GTPV2_END_USER_IMSI|GTPV2_END_USER_MSISDN|GTPV2_APN_NAME|GTPV2_ULI_MCC|GTPV2_ULI_MNC|GTPV2_ULI_CELL_TAC|GTPV2_ULI_CELL_ID|GTPV2_RESPONSE_CAUSE|GTPV2_RAT_TYPE|GTPV2_PDN_IP|GTPV2_END_USER_IMEI|GTPV2_C2S_S5_S8_GTPC_IP|GTPV2_S2C_S5_S8_GTPC_IP|GTPV2_C2S_S5_S8_SGW_GTPU_TEID|GTPV2_S2C_S5_S8_SGW_GTPU_TEID|GTPV2_C2S_S5_S8_SGW_GTPU_IP|GTPV2_S2C_S5_S8_SGW_GTPU_IP
172.25.95.229|10.10.248.34|1|51|0|0|1627986552|1627986552|2123|2123|17|GTP||CG|01A01F06|00000000|172.25.95.229|10.10.248.34|0|0|0|0.0.0.0|0|00000000,00000000|0.0.0.0|0|0|0.0.0.0|0.0.0.0||||0|0|0|0|16|0|0.0.0.0||0.0.0.0|0.0.0.0|0|0|0.0.0.0|0.0.0.0
172.25.95.229|10.10.248.34|1|51|0|0|1627986552|1627986552|2123|2123|17|GTP||CG|01A01F06|00000000|172.25.95.229|10.10.248.34|0|0|0|0.0.0.0|0|00000000,00000000|0.0.0.0|0|0|0.0.0.0|0.0.0.0||||0|0|0|0|16|0|0.0.0.0||0.0.0.0|0.0.0.0|0|0|0.0.0.0|0.0.0.0
172.25.95.229|10.10.248.34|1|96|0|0|1627986552|1627986552|2123|2123|17|GTP||CG|07172107|00000000|172.25.95.229|10.10.248.34|0|0|0|0.0.0.0|0|00000000,00000000|172.25.95.249|0|0|0.0.0.0|0.0.0.0||||0|0|0|0|16|0|0.0.0.0||0.0.0.0|0.0.0.0|0|0|0.0.0.0|0.0.0.0
172.25.95.229|10.10.248.34|1|96|0|0|1627986552|1627986552|2123|2123|17|GTP||CG|07172107|00000000|172.25.95.229|10.10.248.34|0|0|0|0.0.0.0|0|00000000,00000000|172.25.95.249|0|0|0.0.0.0|0.0.0.0||||0|0|0|0|16|0|0.0.0.0||0.0.0.0|0.0.0.0|0|0|0.0.0.0|0.0.0.0

Output excerpt in 9.4.210609-7145 release:

IPV4_SRC_ADDR|IPV4_DST_ADDR|IN_PKTS|IN_BYTES|OUT_PKTS|OUT_BYTES|FIRST_SWITCHED|LAST_SWITCHED|L4_SRC_PORT|L4_DST_PORT|PROTOCOL|L7_PROTO_NAME|SRC_IP_COUNTRY|DST_IP_COUNTRY|UPSTREAM_TUNNEL_ID|DOWNSTREAM_TUNNEL_ID|UNTUNNELED_IPV4_SRC_ADDR|UNTUNNELED_IPV4_DST_ADDR|GTPV2_REQ_MSG_TYPE|GTPV2_RSP_MSG_TYPE|GTPV2_C2S_S1U_GTPU_TEID|GTPV2_C2S_S1U_GTPU_IP|GTPV2_S2C_S1U_GTPU_TEID|GTPV2_S5_S8_GTPC_TEID|GTPV2_S2C_S1U_GTPU_IP|GTPV2_C2S_S5_S8_GTPU_TEID|GTPV2_S2C_S5_S8_GTPU_TEID|GTPV2_C2S_S5_S8_GTPU_IP|GTPV2_S2C_S5_S8_GTPU_IP|GTPV2_END_USER_IMSI|GTPV2_END_USER_MSISDN|GTPV2_APN_NAME|GTPV2_ULI_MCC|GTPV2_ULI_MNC|GTPV2_ULI_CELL_TAC|GTPV2_ULI_CELL_ID|GTPV2_RESPONSE_CAUSE|GTPV2_RAT_TYPE|GTPV2_PDN_IP|GTPV2_END_USER_IMEI|GTPV2_C2S_S5_S8_GTPC_IP|GTPV2_S2C_S5_S8_GTPC_IP|GTPV2_C2S_S5_S8_SGW_GTPU_TEID|GTPV2_S2C_S5_S8_SGW_GTPU_TEID|GTPV2_C2S_S5_S8_SGW_GTPU_IP|GTPV2_S2C_S5_S8_SGW_GTPU_IP
172.25.95.229|10.10.248.34|1|51|0|0|1627987725|1627987725|2123|2123|17|GTP||CG|01A01F06|00000000|172.25.95.229|10.10.248.34|0x00|0x25|0x00000000|0.0.0.0|0x00000000|00000000,00000000|0.0.0.0|0x00000000|0x00000000|0.0.0.0|0.0.0.0||||0|0|0|0|16|0|0.0.0.0||0.0.0.0|0.0.0.0|0x00000000|0x00000000|0.0.0.0|0.0.0.0
172.25.95.229|10.10.248.34|1|51|0|0|1627987725|1627987725|2123|2123|17|GTP||CG|01A01F06|00000000|172.25.95.229|10.10.248.34|0x00|0x25|0x00000000|0.0.0.0|0x00000000|00000000,00000000|0.0.0.0|0x00000000|0x00000000|0.0.0.0|0.0.0.0||||0|0|0|0|16|0|0.0.0.0||0.0.0.0|0.0.0.0|0x00000000|0x00000000|0.0.0.0|0.0.0.0
172.25.95.229|10.10.248.34|1|96|0|0|1627987725|1627987725|2123|2123|17|GTP||CG|07172107|00000000|172.25.95.229|10.10.248.34|0x00|0x23|0x00000000|0.0.0.0|0x00C46B3D|00000000,00000000|172.25.95.249|0x00000000|0x00000000|0.0.0.0|0.0.0.0||||0|0|0|0|16|0|0.0.0.0||0.0.0.0|0.0.0.0|0x00000000|0x00000000|0.0.0.0|0.0.0.0
172.25.95.229|10.10.248.34|1|96|0|0|1627987725|1627987725|2123|2123|17|GTP||CG|07172107|00000000|172.25.95.229|10.10.248.34|0x00|0x23|0x00000000|0.0.0.0|0x00C46B3D|00000000,00000000|172.25.95.249|0x00000000|0x00000000|0.0.0.0|0.0.0.0||||0|0|0|0|16|0|0.0.0.0||0.0.0.0|0.0.0.0|0x00000000|0x00000000|0.0.0.0|0.0.0.0

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the report with /var/tmp/20210803.pcap and the shown nProbe configuration, comparing releases 9.4, 9.5, and 9.7. Check the output for %GTPV2_REQ_MSG_TYPE and %GTPV2_RSP_MSG_TYPE; done means the newer releases populate these fields consistently with the 9.4 output or document the required configuration change.

Written by the indexing model from the issue text.

Assessment

Domain
networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.