logstash-codec-netflow 3.11.1 → 3.11.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +8 -2
- data/lib/logstash/codecs/netflow/util.rb +15 -10
- data/logstash-codec-netflow.gemspec +3 -3
- data/spec/codecs/benchmarks/ACLidASA.rb +36 -0
- data/spec/codecs/benchmarks/IP6Addr.rb +24 -0
- data/spec/codecs/benchmarks/IPAddr.rb +32 -0
- data/spec/codecs/benchmarks/MacAddr.rb +34 -0
- data/spec/codecs/{netflow_bench_cisco_asa.py → benchmarks/netflow_bench_cisco_asa.py} +0 -0
- data/spec/codecs/{netflow_bench_cisco_asr.py → benchmarks/netflow_bench_cisco_asr.py} +0 -0
- metadata +14 -6
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 77f122827b88b2cd3de0a5d33e68bebf2543b123
|
|
4
|
+
data.tar.gz: dd53ee247135f3c112105cdb44287bfd4cdff02b
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 58fb4cd257c95d1dc594908982dc680e85827109c50d30b82a20e898bc21676c0e128d66cd9bd541b65b842eba2080a2110cf41ea042b75e28292c56641e8c49
|
|
7
|
+
data.tar.gz: 010589f423fc57e4c3600c47ffd1a07fcd3a80382b7b037c4756ef27a24254ccc5fc506a3f8744263455fba6ee7e71fa6af28539fe26bf49fde99e277a41939f
|
data/CHANGELOG.md
CHANGED
|
@@ -1,7 +1,13 @@
|
|
|
1
|
+
## 3.11.2
|
|
2
|
+
|
|
3
|
+
- Further improved decoding performance of ASA ACL ids
|
|
4
|
+
- Further improved decoding performance of MAC addresses
|
|
5
|
+
- Improved decoding performance of IPv4 addresses
|
|
6
|
+
|
|
1
7
|
## 3.11.1
|
|
2
8
|
|
|
3
|
-
- Improved decoding performance
|
|
4
|
-
- Improved decoding performance
|
|
9
|
+
- Improved decoding performance of ASA ACL ids
|
|
10
|
+
- Improved decoding performance of mac addresses
|
|
5
11
|
|
|
6
12
|
## 3.11.0
|
|
7
13
|
|
|
@@ -8,17 +8,15 @@ class IP4Addr < BinData::Primitive
|
|
|
8
8
|
|
|
9
9
|
def set(val)
|
|
10
10
|
unless val.nil?
|
|
11
|
-
|
|
12
|
-
if ! ip.ipv4?
|
|
13
|
-
raise ArgumentError, "invalid IPv4 address '#{val}'"
|
|
14
|
-
end
|
|
15
|
-
self.storage = ip.to_i
|
|
11
|
+
self.storage = val.split('.').inject(0) {|total,value| (total << 8 ) + value.to_i}
|
|
16
12
|
end
|
|
17
13
|
end
|
|
18
14
|
|
|
19
15
|
def get
|
|
16
|
+
# This is currently the fastest implementation
|
|
17
|
+
# For benchmarks see spec/codecs/benchmarks/IPaddr.rb
|
|
20
18
|
unless self.storage.nil?
|
|
21
|
-
|
|
19
|
+
[self.storage].pack('N').unpack('C4').join('.')
|
|
22
20
|
end
|
|
23
21
|
end
|
|
24
22
|
end
|
|
@@ -38,6 +36,9 @@ class IP6Addr < BinData::Primitive
|
|
|
38
36
|
end
|
|
39
37
|
|
|
40
38
|
def get
|
|
39
|
+
# There faster implementations, however they come with the
|
|
40
|
+
# loss of compressed IPv6 notation.
|
|
41
|
+
# For benchmarks see spec/codecs/benchmarks/IP6Addr.rb
|
|
41
42
|
unless self.storage.nil?
|
|
42
43
|
IPAddr.new_ntoh((0..7).map { |i|
|
|
43
44
|
(self.storage >> (112 - 16 * i)) & 0xffff
|
|
@@ -57,8 +58,10 @@ class MacAddr < BinData::Primitive
|
|
|
57
58
|
end
|
|
58
59
|
|
|
59
60
|
def get
|
|
60
|
-
|
|
61
|
-
|
|
61
|
+
# This is currently the fastest implementation
|
|
62
|
+
# For benchmarks see spec/codecs/benchmarks/MacAddr.rb
|
|
63
|
+
b = self.bytes.unpack('H*')[0]
|
|
64
|
+
b[0..1] + ":" + b[2..3] + ":" + b[4..5] + ":" + b[6..7] + ":" + b[8..9] + ":" + b[10..11]
|
|
62
65
|
end
|
|
63
66
|
end
|
|
64
67
|
|
|
@@ -102,8 +105,10 @@ class ACLIdASA < BinData::Primitive
|
|
|
102
105
|
end
|
|
103
106
|
|
|
104
107
|
def get
|
|
105
|
-
|
|
106
|
-
|
|
108
|
+
# This is currently the fastest implementation
|
|
109
|
+
# For benchmarks see spec/codecs/benchmarks/ACLIdASA.rb
|
|
110
|
+
b = self.bytes.unpack('H*')[0]
|
|
111
|
+
b[0..7] + "-" + b[8..15] + "-" + b[16..23]
|
|
107
112
|
end
|
|
108
113
|
end
|
|
109
114
|
|
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
Gem::Specification.new do |s|
|
|
2
2
|
|
|
3
3
|
s.name = 'logstash-codec-netflow'
|
|
4
|
-
s.version = '3.11.
|
|
4
|
+
s.version = '3.11.2'
|
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
|
6
|
-
s.summary = "Reads Netflow v5
|
|
6
|
+
s.summary = "Reads Netflow v5, Netflow v9 and IPFIX data"
|
|
7
7
|
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
|
8
8
|
s.authors = ["Elastic"]
|
|
9
9
|
s.email = 'info@elastic.co'
|
|
10
10
|
s.homepage = "http://www.elastic.co/guide/en/logstash/current/index.html"
|
|
11
|
-
s.require_paths
|
|
11
|
+
s.require_paths = ["lib"]
|
|
12
12
|
|
|
13
13
|
# Files
|
|
14
14
|
s.files = Dir["lib/**/*","spec/**/*","*.gemspec","*.md","CONTRIBUTORS","Gemfile","LICENSE","NOTICE.TXT", "vendor/jar-dependencies/**/*.jar", "vendor/jar-dependencies/**/*.rb", "VERSION", "docs/**/*"]
|
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
require 'benchmark'
|
|
2
|
+
|
|
3
|
+
Benchmark.bm do |x|
|
|
4
|
+
x.report {
|
|
5
|
+
# Implementation pre v3.11.0
|
|
6
|
+
bytes=[41, 41, 41, 41, 41, 41, 41, 41, 41, 41, 41, 41]
|
|
7
|
+
2000000.times do
|
|
8
|
+
b = bytes.collect { |byte|
|
|
9
|
+
unless byte.nil?
|
|
10
|
+
byte.to_s(16).rjust(2,'0')
|
|
11
|
+
end
|
|
12
|
+
}.join
|
|
13
|
+
b.scan(/......../).collect { |aclid| aclid }.join("-")
|
|
14
|
+
end }
|
|
15
|
+
|
|
16
|
+
x.report {
|
|
17
|
+
# Implementation as of v3.11.1
|
|
18
|
+
bytes='AAAAAAAAAAAA'
|
|
19
|
+
2000000.times do
|
|
20
|
+
b = bytes.unpack('H*')[0]
|
|
21
|
+
b.scan(/......../).collect { |aclid| aclid }.join("-")
|
|
22
|
+
end }
|
|
23
|
+
|
|
24
|
+
x.report {
|
|
25
|
+
# Implementation as of v3.11.2
|
|
26
|
+
bytes='AAAAAAAAAAAA'
|
|
27
|
+
2000000.times do
|
|
28
|
+
b = bytes.unpack('H*')[0]
|
|
29
|
+
b[0..7] + "-" + b[8..15] + "-" + b[16..23]
|
|
30
|
+
end }
|
|
31
|
+
end
|
|
32
|
+
|
|
33
|
+
# user system total real
|
|
34
|
+
# 19.710000 0.000000 19.710000 ( 19.717288)
|
|
35
|
+
# 7.000000 0.000000 7.000000 ( 7.003011)
|
|
36
|
+
# 3.500000 0.000000 3.500000 ( 3.501547)
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
require 'benchmark'
|
|
2
|
+
require 'ipaddr'
|
|
3
|
+
|
|
4
|
+
Benchmark.bm do |x|
|
|
5
|
+
x.report {
|
|
6
|
+
# Implementation pre v3.11.0
|
|
7
|
+
ip = 85060308944708794891899627827609206785
|
|
8
|
+
2000000.times do
|
|
9
|
+
IPAddr.new_ntoh([ip].pack('N')).to_s
|
|
10
|
+
end }
|
|
11
|
+
|
|
12
|
+
x.report {
|
|
13
|
+
# Implementation as of v3.11.2
|
|
14
|
+
ip = 85060308944708794891899627827609206785
|
|
15
|
+
2000000.times do
|
|
16
|
+
b = "%032x" % ip
|
|
17
|
+
b[0..3] + ":" + b[4..7] + ":" + b[8..11] + ":" + b[12..15] + ":" + b[16..19] + ":" + b[20..23] + ":" + b[24..27] + ":" + b[28..31]
|
|
18
|
+
end }
|
|
19
|
+
|
|
20
|
+
end
|
|
21
|
+
|
|
22
|
+
# user system total real
|
|
23
|
+
# 21.800000 0.000000 21.800000 ( 21.811893)
|
|
24
|
+
# 11.760000 0.000000 11.760000 ( 11.768260)
|
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
require 'benchmark'
|
|
2
|
+
require 'ipaddr'
|
|
3
|
+
|
|
4
|
+
Benchmark.bm do |x|
|
|
5
|
+
x.report {
|
|
6
|
+
# Implementation pre v3.11.0
|
|
7
|
+
ip = 3232235521
|
|
8
|
+
2000000.times do
|
|
9
|
+
IPAddr.new_ntoh([ip].pack('N')).to_s
|
|
10
|
+
end }
|
|
11
|
+
|
|
12
|
+
x.report {
|
|
13
|
+
# Implementation as of v3.11.2
|
|
14
|
+
ip = 3232235521
|
|
15
|
+
2000000.times do
|
|
16
|
+
[ip].pack('N').unpack('C4').join('.')
|
|
17
|
+
end }
|
|
18
|
+
|
|
19
|
+
x.report {
|
|
20
|
+
ip = 3232235521
|
|
21
|
+
2000000.times do
|
|
22
|
+
b = "%08x" % ip
|
|
23
|
+
"%d.%d.%d.%d" % [b[0..1].to_i(16), b[2..3].to_i(16), b[4..5].to_i(16), b[6..7].to_i(16)]
|
|
24
|
+
end }
|
|
25
|
+
|
|
26
|
+
end
|
|
27
|
+
|
|
28
|
+
# user system total real
|
|
29
|
+
# 21.330000 0.000000 21.330000 ( 21.348559)
|
|
30
|
+
# 4.410000 0.000000 4.410000 ( 4.411973)
|
|
31
|
+
# 6.450000 0.000000 6.450000 ( 6.446321)
|
|
32
|
+
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
require 'benchmark'
|
|
2
|
+
|
|
3
|
+
Benchmark.bm do |x|
|
|
4
|
+
x.report {
|
|
5
|
+
# Implementation pre v3.11.0
|
|
6
|
+
bytes=[41, 41, 41, 41, 41, 41]
|
|
7
|
+
2000000.times do
|
|
8
|
+
bytes.collect { |byte|
|
|
9
|
+
unless byte.nil?
|
|
10
|
+
byte.to_s(16).rjust(2,'0')
|
|
11
|
+
end
|
|
12
|
+
}.join(":")
|
|
13
|
+
end }
|
|
14
|
+
|
|
15
|
+
x.report {
|
|
16
|
+
# Implementation as of v3.11.1
|
|
17
|
+
bytes='AAAAAA'
|
|
18
|
+
2000000.times do
|
|
19
|
+
b = bytes.unpack('H*')[0]
|
|
20
|
+
b.scan(/../).collect { |byte| byte }.join(":")
|
|
21
|
+
end }
|
|
22
|
+
|
|
23
|
+
x.report {
|
|
24
|
+
bytes='AAAAAA'
|
|
25
|
+
2000000.times do
|
|
26
|
+
b = bytes.unpack('H*')[0]
|
|
27
|
+
b[0..1] + ":" + b[2..3] + ":" + b[4..5] + ":" + b[6..7] + ":" + b[8..9] + ":" + b[10..11]
|
|
28
|
+
end }
|
|
29
|
+
end
|
|
30
|
+
|
|
31
|
+
# user system total real
|
|
32
|
+
# 8.400000 0.000000 8.400000 ( 8.408549)
|
|
33
|
+
# 10.960000 0.000000 10.960000 ( 10.959357)
|
|
34
|
+
# 5.600000 0.000000 5.600000 ( 5.597817)
|
|
File without changes
|
|
File without changes
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: logstash-codec-netflow
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 3.11.
|
|
4
|
+
version: 3.11.2
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Elastic
|
|
@@ -73,6 +73,12 @@ files:
|
|
|
73
73
|
- lib/logstash/codecs/netflow/netflow.yaml
|
|
74
74
|
- lib/logstash/codecs/netflow/util.rb
|
|
75
75
|
- logstash-codec-netflow.gemspec
|
|
76
|
+
- spec/codecs/benchmarks/ACLidASA.rb
|
|
77
|
+
- spec/codecs/benchmarks/IP6Addr.rb
|
|
78
|
+
- spec/codecs/benchmarks/IPAddr.rb
|
|
79
|
+
- spec/codecs/benchmarks/MacAddr.rb
|
|
80
|
+
- spec/codecs/benchmarks/netflow_bench_cisco_asa.py
|
|
81
|
+
- spec/codecs/benchmarks/netflow_bench_cisco_asr.py
|
|
76
82
|
- spec/codecs/ipfix.dat
|
|
77
83
|
- spec/codecs/ipfix_test_barracuda_data256.dat
|
|
78
84
|
- spec/codecs/ipfix_test_barracuda_tpl.dat
|
|
@@ -146,8 +152,6 @@ files:
|
|
|
146
152
|
- spec/codecs/netflow9_test_ubnt_edgerouter_tpl.dat
|
|
147
153
|
- spec/codecs/netflow9_test_unknown_tpl266_292_data.dat
|
|
148
154
|
- spec/codecs/netflow9_test_valid01.dat
|
|
149
|
-
- spec/codecs/netflow_bench_cisco_asa.py
|
|
150
|
-
- spec/codecs/netflow_bench_cisco_asr.py
|
|
151
155
|
- spec/codecs/netflow_spec.rb
|
|
152
156
|
- spec/codecs/netflow_stress.py
|
|
153
157
|
homepage: http://www.elastic.co/guide/en/logstash/current/index.html
|
|
@@ -175,8 +179,14 @@ rubyforge_project:
|
|
|
175
179
|
rubygems_version: 2.4.8
|
|
176
180
|
signing_key:
|
|
177
181
|
specification_version: 4
|
|
178
|
-
summary: Reads Netflow v5
|
|
182
|
+
summary: Reads Netflow v5, Netflow v9 and IPFIX data
|
|
179
183
|
test_files:
|
|
184
|
+
- spec/codecs/benchmarks/ACLidASA.rb
|
|
185
|
+
- spec/codecs/benchmarks/IP6Addr.rb
|
|
186
|
+
- spec/codecs/benchmarks/IPAddr.rb
|
|
187
|
+
- spec/codecs/benchmarks/MacAddr.rb
|
|
188
|
+
- spec/codecs/benchmarks/netflow_bench_cisco_asa.py
|
|
189
|
+
- spec/codecs/benchmarks/netflow_bench_cisco_asr.py
|
|
180
190
|
- spec/codecs/ipfix.dat
|
|
181
191
|
- spec/codecs/ipfix_test_barracuda_data256.dat
|
|
182
192
|
- spec/codecs/ipfix_test_barracuda_tpl.dat
|
|
@@ -250,7 +260,5 @@ test_files:
|
|
|
250
260
|
- spec/codecs/netflow9_test_ubnt_edgerouter_tpl.dat
|
|
251
261
|
- spec/codecs/netflow9_test_unknown_tpl266_292_data.dat
|
|
252
262
|
- spec/codecs/netflow9_test_valid01.dat
|
|
253
|
-
- spec/codecs/netflow_bench_cisco_asa.py
|
|
254
|
-
- spec/codecs/netflow_bench_cisco_asr.py
|
|
255
263
|
- spec/codecs/netflow_spec.rb
|
|
256
264
|
- spec/codecs/netflow_stress.py
|