PF_RING FT: add support for IPv6-in-IPv4

[ronygut]

@cardigliano In case we have IPV6 packet encapsulated inside IPV4, meaning the IPV6 is the most inner IP, PF_RING FT create a flow with the wrong tuple. Instead of creating the flow key using the inner IPV6 , it creates a flow using the IPV4 (most outer IP) data. The protocol is 41 (IPV6) Attached is a sample PCAP that demonstrate it. Please advise?

Thanks, Rony.

Running ./ftflow_pcap -i ipv6_inside_ipv4_pcap.pcap display wrong flow data. It display the IPV4 source and destination IP with wrong protocol that is 41. It should display the IPV6 source and destination IP + TCP ports.

[Flow] srcIp: 139.18.25.33, dstIp: 81.131.67.131, srcPort: 0, dstPort: 0, protocol: 41, tcpFlags: 0x00, c2s: { Packets: 8, Bytes: 1021, First: 1121498977.573438, Last: 1121498992.785352 }, s2c: { Packets: 0, Bytes: 0, First: 0.0, Last: 0.0 } [Flow] srcIp: 81.131.67.131, dstIp: 192.88.99.1, srcPort: 0, dstPort: 0, protocol: 41, tcpFlags: 0x00, c2s: { Packets: 9, Bytes: 911, First: 1121498974.753125, Last: 1121498992.972852 }, s2c: { Packets: 0, Bytes: 0, First: 0.0, Last: 0.0 }

Change .txt to .pcap

ipv6_inside_ipv4_pcap.txt

[ronygut]

@cardigliano It is not only ipv6 inside ipv4. it is also ipv4 inside ipv6, ipv4 inside ipv4 or ipv6 inside ipv6. Attached please find ipv4 inside ipv4 PCAP that does not work as well.

Please change .txt to .pcap

ipv4_in_ipv4 .txt

[ronygut]

@cardigliano , any updates?

[cardigliano]

@ronygut we are currently busy with bug fixing and other urgent activities sorry. If you want to prioritize this and allocate an engineer, please drop us an email

[ronygut]

@cardigliano Thanks for the update. We we will wait until you have more time.