Skip to content
This repository was archived by the owner on Feb 19, 2025. It is now read-only.

IPFIX Template decoding does not handle Enterprise-Specific Information Elements #125

Open
rafal-prasal opened this issue Jan 5, 2024 · 0 comments

Comments

@rafal-prasal
Copy link

According to IPFIX RFC, when field highest bit is set to 1 then the field is considered Enterprise.
In such case just after that filed there are additional 4 bytes with value Enterprise Number an id in the field interpretation for the lookup table.

Due to that when hitting records with Enterprise-Specific Information Elements will get corrupted.

link to RFC
https://datatracker.ietf.org/doc/html/rfc7011#page-64

link to faulty function:

func DecodeTemplateSet(payload *bytes.Buffer) ([]TemplateRecord, error) {

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant