scapy icon indicating copy to clipboard operation
scapy copied to clipboard

layers/netflow: NFv9/10 flow record type fix

Open msune opened this issue 5 months ago • 2 comments

This commit fixes the Python types of a number of fields defined in Netflowv9/10 for the following pre-defined fields (mostly the ones in RFC3954 https://datatracker.ietf.org/doc/html/rfc3954).

It appears that in absence of an assigned field type, it defaults to BytesField instead of IntField. Fields:

  • IN_BYTES, IN_PKTS, OUT_BYTES, OUT_PKTS: IntField (4 bytes). Please note code doesn't seem to support the larget 8byte optional length.
  • MUL_DST_PKTS, MUL_DST_BYTES: same as above
  • INPUT_SNMP, OUTPUT_SNMP: ShortField (2 bytes), iface index. Note: code doesn't seem to support optional larger values (undefined max. length, but 8 bytes might be sufficient).

Note there are many other field types defined that are not part of the spec / unknown without field type and length.

Fixes #4810

msune avatar Aug 06 '25 21:08 msune

This comes from #4810. I've revised a number of fields.

A couple of thoughts:

  • I didn't test the changes, I am just opening this Draft PR for discussion.
  • I assumed this was the case, but I'd like someone to confirm:

It appears that in absence of an assigned field type, it defaults to BytesField instead of IntField. Fields:

  • I am not sure which coverage exists for this layer, and where should that coverage be added (not familiar with Scapy's testing approach). Some directions might help here.

cc @gpotter2

msune avatar Aug 06 '25 22:08 msune

we likely should try to adapt the code so that it supports NBytesField to support integer values of arbitrary lengths. Right now this code likely won't work.

Ack. It would be good to support the 8bytes counters, as this is a commonly used thing.

msune avatar Aug 07 '25 05:08 msune