logstash-codec-netflow 3.13.0 → 3.13.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +4 -0
  3. data/lib/logstash/codecs/netflow.rb +4 -3
  4. data/logstash-codec-netflow.gemspec +1 -1
  5. data/spec/codecs/ipfix_stress.py +30 -0
  6. metadata +136 -132
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: 2e7dc24e899f3afdf8980d5815727b8394cf9b69
4
- data.tar.gz: 3fa3f494f7ad39af68d3b99e6c918b995cd8cae7
3
+ metadata.gz: c23e37ebce85ad5d7ee957761e1f16cc37772955
4
+ data.tar.gz: e09afae9e5e63bf778eb12462d07c82aff476bd8
5
5
  SHA512:
6
- metadata.gz: d81ead3c2fe61b83376d7a97fa7c9ded2039d42b2f95d7d80e39727bb60dd305a80367775d75f060accd7ec611e06f3c355ca75a3d8a76ae8535d72b4f24dddf
7
- data.tar.gz: fe71e6a1e05f666a8b43c3de974b98e59f7a4663f12dcad0879cf5ca7b41f02740d5fe30bbfd3476c3c5bad76866ca06961afabcd5f14b4de6620b703f696b9d
6
+ metadata.gz: 665ba52fd62e594ca0058d7c3ff0e1fa34f81295db93c5c8bbf1b8537ce19870305d16d04090118427473f411da4ac230c2ca4eaf95c689bde8865c054eacbb6
7
+ data.tar.gz: a02bc82d767aaccfce8551787563d453c8fcc627afc744c24077b0824b0f0df3a84f74dbc9fd33a8b9e035c08bb928d9920b3c98271ed5f4d1f3d73b1951ea92
data/CHANGELOG.md CHANGED
@@ -1,3 +1,7 @@
1
+ ## 3.13.1
2
+
3
+ - Fixes exceptions due to concurrent access of IPFIX templates, see issue #134
4
+
1
5
  ## 3.13.0
2
6
 
3
7
  - Added support for Netflow 9 reduced-size encoding support
data/lib/logstash/codecs/netflow.rb CHANGED
@@ -344,9 +344,10 @@ class LogStash::Codecs::Netflow < LogStash::Codecs::Base
344
344
  when 256..65535
345
345
  # Data flowset
346
346
  key = "#{flowset.observation_domain_id}|#{record.flowset_id}"
347
- if @ipfix_templates[key] != nil
348
- template = @ipfix_templates[key]
349
- else
347
+
348
+ template = @decode_mutex_ipfix.synchronize { @ipfix_templates[key] }
349
+
350
+ if !template
350
351
  @logger.warn("Can't (yet) decode flowset id #{record.flowset_id} from observation domain id #{flowset.observation_domain_id}, because no template to decode it with has been received. This message will usually go away after 1 minute.")
351
352
  return events
352
353
  end
data/logstash-codec-netflow.gemspec CHANGED
@@ -1,7 +1,7 @@
1
1
  Gem::Specification.new do |s|
2
2
 
3
3
  s.name = 'logstash-codec-netflow'
4
- s.version = '3.13.0'
4
+ s.version = '3.13.1'
5
5
  s.licenses = ['Apache License (2.0)']
6
6
  s.summary = "Reads Netflow v5, Netflow v9 and IPFIX data"
7
7
  s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
data/spec/codecs/ipfix_stress.py ADDED
@@ -0,0 +1,30 @@
1
+ import socket
2
+ import sys
3
+ import time
4
+ import random
5
+
6
+ ## Standalone IPFIX stressor
7
+ ## Used to reproduce issue 134 https://github.com/logstash-plugins/logstash-codec-netflow/issues/134
8
+
9
+ host = 'host02'
10
+ port = 2055
11
+
12
+ tpl = '\x00\n\x00\xa4Z\xd2\xc6\xfc\x00\x00K\xce\xabfn\xab\x00\x02\x00\x94\xce\xc7\x00\x17\x00\x08\x00\x04\x00\x1b\x00\x10\x00\x07\x00\x02\x00\x0c\x00\x04\x00\x1c\x00\x10\x00\x0b\x00\x02\x00\x10\x00\x04\x00\x11\x00\x04\x00\x04\x00\x01\x80\x01\xff\xff\x00\x00<%\x80\x1c\xff\xff\x00\x00<%\x00\x96\x00\x04\x00\x97\x00\x04\x80\x03\x00\x08\x00\x00<%\x80\x04\x00\x08\x00\x00<%\x80\x15\xff\xff\x00\x00<%\x80\x19\x00\x04\x00\x00<%\x80\x1a\xff\xff\x00\x00<%\x80\x16\xff\xff\x00\x00<%\x80\x0f\xff\xff\x00\x00<%\x80\x02\xff\xff\x00\x00<%\x80\x10\xff\xff\x00\x00<%\x80/\xff\xff\x00\x00<%'
13
+
14
+ # 8 flows:
15
+ data = '\x00\n\x05KZ\xd2\xc78\x00\x00K\xd4\xabfn\xab\xce\xc7\x05;\xb5\xd6WG\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd2\x1b\x8a,\xa1\x0e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xba\xde\x00\x00\x1d\x97\x00\x00\x1d\x97\x06\x0eBeing analyzed\x00Z\xd2\xc6zZ\xd2\xc6\xfe\x00\x00\x00\x00\x00\x00\x00<\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!INITIAL,SERVER_IS_LOCAL,BEGINNING\x0eBeing analyzed\x00\x05IPFIX\x00\x00\x00\x00 \x01\x03\x88\xcf\n\x00\x06\x00\x00\x00\x00\x00\x00\x00\x01\x00\x88\x00\x00\x00\x00 \x01\x03\x88\xcf\n\x00\x06\x00\x00\x00\x00\x00\x00\x00\x02\x00\x87\x00\x00\x00\x00\x00\x00\x00\x00:\x1aIP protocol 58 (IPv6-ICMP)\x00Z\xd2\xc6\xecZ\xd2\xc6\xfe\x00\x00\x00\x00\x00\x00\x00V\x00\x00\x00\x00\x00\x00\x00N\x00\x00\x00\x00\x00\x00\x00-INITIAL,SERVER_IS_LOCAL,BEGINNING,ESTABLISHED\x1aIP protocol 58 (IPv6-ICMP)\x00\x05IPFIX\x05\xbc\x0b#\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xac{\x8a,\xa1\x0e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00V\xec\x00\x00\x1d\x97\x00\x00\x1d\x97\x06\x0eBeing analyzed\x00Z\xd2\xc6\x84Z\xd2\xc7\x02\x00\x00\x00\x00\x00\x00\x00<\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!INITIAL,SERVER_IS_LOCAL,BEGINNING\x0eBeing analyzed\x00\x05IPFIX\xceu\x19Y\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8a,\xa1\x0e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\xe2\x00\x00\x1d\x97\x01\x14IP protocol 1 (ICMP)\x00Z\xd2\xc6\xfeZ\xd2\xc7*\x00\x00\x00\x00\x00\x00\x00<\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!INITIAL,SERVER_IS_LOCAL,BEGINNING\x14IP protocol 1 (ICMP)\x00\x05IPFIX\x00\x00\x00\x00 \x01\x03\x88\xcf\n\x00\x06\x00\x00\x00\x00\x00\x00\x00\x01\x00\x88\x00\x00\x00\x00 \x01\x03\x88\xcf\n\x00\x06\x00\x00\x00\x00\x00\x00\x00\x02\x00\x87\x00\x00\x00\x00\x00\x00\x00\x00:\x1aIP protocol 58 (IPv6-ICMP)\x00Z\xd2\xc7\nZ\xd2\xc7*\x00\x00\x00\x00\x00\x00\x00V\x00\x00\x00\x00\x00\x00\x00N\x00\x00\x00\x00\x00\x00\x00-INITIAL,SERVER_IS_LOCAL,BEGINNING,ESTABLISHED\x1aIP protocol 58 (IPv6-ICMP)\x00\x05IPFIX\xb9\xe8\x1d\xc7\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xda=\x8a,\xa1\x0e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1d\x1b\x00\x00\x1d\x97\x00\x00\x1d\x97\x06\x0eBeing analyzed\x00Z\xd2\xc6\xfbZ\xd2\xc78\x00\x00\x00\x00\x00\x00\x00<\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!INITIAL,SERVER_IS_LOCAL,BEGINNING\x0eBeing analyzed\x00\x05IPFIX\xb1\xbc\xe4\x89\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00$\xd6\x8a,\xa1\x0e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\xd0\x00\x00\x1d\x97\x00\x00\x1d\x97\x06\x0eBeing analyzed\x00Z\xd2\xc7\x1aZ\xd2\xc78\x00\x00\x00\x00\x00\x00\x00<\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!INITIAL,SERVER_IS_LOCAL,BEGINNING\x0eBeing analyzed\x00\x05IPFIX\x8a,\xa1\x0e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x83\x99\x8a,\xa1\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb3\x00\x00\x1d\x97\x00\x00\x1d\x97\x06\x05BGP-4\x00Z\xd2\xc6\x0cZ\xd2\xc78\x00\x00\x00\x00\x00\x00\x1b\xa4\x00\x00\x00\x00\x00\x00\x0c\xee\x00\x00\x00\x00\x00\x00\x006INTERACTIVE,CLIENT_IS_LOCAL,INBOUND,ESTABLISHED,ACTIVE\x05BGP-4\x00\x05IPFIX'
16
+
17
+
18
+ sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
19
+
20
+ print("IPFIX v9: sending 1 template 1 data packet in an infinite loop")
21
+
22
+ duration = 0.0
23
+ while True:
24
+ for i in range(0,400):
25
+ sock.sendto(tpl, (host, port))
26
+ sock.sendto(data, (host, port))
27
+ sys.stdout.write('.')
28
+ sys.stdout.flush()
29
+ time.sleep(random.random())
30
+ print
metadata CHANGED
@@ -1,124 +1,107 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: logstash-codec-netflow
3
3
  version: !ruby/object:Gem::Version
4
- version: 3.13.0
4
+ version: 3.13.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - Elastic
8
- autorequire:
8
+ autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2018-04-28 00:00:00.000000000 Z
11
+ date: 2018-04-29 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
+ name: logstash-core-plugin-api
14
15
  requirement: !ruby/object:Gem::Requirement
15
16
  requirements:
16
17
  - - ~>
17
18
  - !ruby/object:Gem::Version
18
19
  version: '2.0'
19
- name: logstash-core-plugin-api
20
- prerelease: false
21
20
  type: :runtime
21
+ prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
24
  - - ~>
25
25
  - !ruby/object:Gem::Version
26
26
  version: '2.0'
27
27
  - !ruby/object:Gem::Dependency
28
+ name: bindata
28
29
  requirement: !ruby/object:Gem::Requirement
29
30
  requirements:
30
31
  - - '>='
31
32
  - !ruby/object:Gem::Version
32
33
  version: 1.5.0
33
- name: bindata
34
- prerelease: false
35
34
  type: :runtime
35
+ prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
38
  - - '>='
39
39
  - !ruby/object:Gem::Version
40
40
  version: 1.5.0
41
41
  - !ruby/object:Gem::Dependency
42
+ name: logstash-devutils
42
43
  requirement: !ruby/object:Gem::Requirement
43
44
  requirements:
44
45
  - - '>='
45
46
  - !ruby/object:Gem::Version
46
47
  version: 1.0.0
47
- name: logstash-devutils
48
- prerelease: false
49
48
  type: :development
49
+ prerelease: false
50
50
  version_requirements: !ruby/object:Gem::Requirement
51
51
  requirements:
52
52
  - - '>='
53
53
  - !ruby/object:Gem::Version
54
54
  version: 1.0.0
55
- description: This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program
55
+ description: This gem is a Logstash plugin required to be installed on top of the
56
+ Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This
57
+ gem is not a stand-alone program
56
58
  email: info@elastic.co
57
59
  executables: []
58
60
  extensions: []
59
61
  extra_rdoc_files: []
60
62
  files:
61
- - CHANGELOG.md
62
- - CONTRIBUTORS
63
- - Gemfile
64
- - LICENSE
65
- - NOTICE.TXT
66
- - README.md
67
- - RFC_COMPLIANCE_IPFIX.md
68
- - RFC_COMPLIANCE_NETFLOW_v9.md
69
- - docs/index.asciidoc
70
- - lib/logstash/codecs/netflow.rb
71
63
  - lib/logstash/codecs/netflow/iana2yaml.rb
72
- - lib/logstash/codecs/netflow/ipfix.yaml
73
64
  - lib/logstash/codecs/netflow/netflow.yaml
74
65
  - lib/logstash/codecs/netflow/util.rb
75
- - logstash-codec-netflow.gemspec
76
- - spec/codecs/benchmarks/ACLidASA.rb
77
- - spec/codecs/benchmarks/IP6Addr.rb
78
- - spec/codecs/benchmarks/IPAddr.rb
79
- - spec/codecs/benchmarks/MacAddr.rb
80
- - spec/codecs/benchmarks/netflow_bench_cisco_asa.py
81
- - spec/codecs/benchmarks/netflow_bench_cisco_asr.py
66
+ - lib/logstash/codecs/netflow/ipfix.yaml
67
+ - lib/logstash/codecs/netflow.rb
82
68
  - spec/codecs/ipfix.dat
83
- - spec/codecs/ipfix_test_barracuda_data256.dat
84
- - spec/codecs/ipfix_test_barracuda_extended_uniflow_data256.dat
85
- - spec/codecs/ipfix_test_barracuda_extended_uniflow_tpl256.dat
86
- - spec/codecs/ipfix_test_barracuda_tpl.dat
87
- - spec/codecs/ipfix_test_mikrotik_data258.dat
88
- - spec/codecs/ipfix_test_mikrotik_data259.dat
89
- - spec/codecs/ipfix_test_mikrotik_tpl.dat
90
- - spec/codecs/ipfix_test_netscaler_data.dat
91
- - spec/codecs/ipfix_test_netscaler_tpl.dat
92
- - spec/codecs/ipfix_test_nokia_bras_data256.dat
93
- - spec/codecs/ipfix_test_nokia_bras_tpl.dat
94
69
  - spec/codecs/ipfix_test_openbsd_pflow_data.dat
95
70
  - spec/codecs/ipfix_test_openbsd_pflow_tpl.dat
96
- - spec/codecs/ipfix_test_procera_data52935.dat
97
- - spec/codecs/ipfix_test_procera_tpl52935.dat
98
- - spec/codecs/ipfix_test_viptela_data257.dat
99
- - spec/codecs/ipfix_test_viptela_tpl257.dat
100
- - spec/codecs/ipfix_test_vmware_vds_data264.dat
101
- - spec/codecs/ipfix_test_vmware_vds_data266.dat
102
- - spec/codecs/ipfix_test_vmware_vds_data266_267.dat
103
- - spec/codecs/ipfix_test_vmware_vds_tpl.dat
104
- - spec/codecs/ipfix_test_yaf_data45841.dat
105
- - spec/codecs/ipfix_test_yaf_data45873.dat
106
- - spec/codecs/ipfix_test_yaf_data53248.dat
107
- - spec/codecs/ipfix_test_yaf_tpl45841.dat
108
- - spec/codecs/ipfix_test_yaf_tpls_option_tpl.dat
109
71
  - spec/codecs/netflow5.dat
110
72
  - spec/codecs/netflow5_test_invalid01.dat
111
73
  - spec/codecs/netflow5_test_invalid02.dat
112
74
  - spec/codecs/netflow5_test_juniper_mx80.dat
113
75
  - spec/codecs/netflow5_test_microtik.dat
114
- - spec/codecs/netflow9_cisco_asr1001x_tpl259.dat
115
- - spec/codecs/netflow9_test_0length_fields_tpl_data.dat
116
- - spec/codecs/netflow9_test_cisco_1941K9.dat
117
76
  - spec/codecs/netflow9_test_cisco_asa_1_data.dat
118
77
  - spec/codecs/netflow9_test_cisco_asa_1_tpl.dat
119
78
  - spec/codecs/netflow9_test_cisco_asa_2_data.dat
120
79
  - spec/codecs/netflow9_test_cisco_asa_2_tpl_26x.dat
121
80
  - spec/codecs/netflow9_test_cisco_asa_2_tpl_27x.dat
81
+ - spec/codecs/netflow9_test_invalid01.dat
82
+ - spec/codecs/netflow9_test_macaddr_data.dat
83
+ - spec/codecs/netflow9_test_macaddr_tpl.dat
84
+ - spec/codecs/netflow9_test_nprobe_data.dat
85
+ - spec/codecs/netflow9_test_nprobe_tpl.dat
86
+ - spec/codecs/netflow9_test_softflowd_tpl_data.dat
87
+ - spec/codecs/netflow9_test_valid01.dat
88
+ - spec/codecs/netflow9_test_ubnt_edgerouter_tpl.dat
89
+ - spec/codecs/netflow9_test_ubnt_edgerouter_data1024.dat
90
+ - spec/codecs/netflow9_test_ubnt_edgerouter_data1025.dat
91
+ - spec/codecs/ipfix_test_netscaler_data.dat
92
+ - spec/codecs/ipfix_test_netscaler_tpl.dat
93
+ - spec/codecs/ipfix_test_vmware_vds_data264.dat
94
+ - spec/codecs/ipfix_test_vmware_vds_data266.dat
95
+ - spec/codecs/ipfix_test_vmware_vds_data266_267.dat
96
+ - spec/codecs/ipfix_test_vmware_vds_tpl.dat
97
+ - spec/codecs/ipfix_test_barracuda_data256.dat
98
+ - spec/codecs/ipfix_test_barracuda_tpl.dat
99
+ - spec/codecs/ipfix_test_mikrotik_data258.dat
100
+ - spec/codecs/ipfix_test_mikrotik_data259.dat
101
+ - spec/codecs/ipfix_test_mikrotik_tpl.dat
102
+ - spec/codecs/ipfix_test_nokia_bras_tpl.dat
103
+ - spec/codecs/netflow9_test_0length_fields_tpl_data.dat
104
+ - spec/codecs/netflow_spec.rb
122
105
  - spec/codecs/netflow9_test_cisco_asr9k_data256.dat
123
106
  - spec/codecs/netflow9_test_cisco_asr9k_data260.dat
124
107
  - spec/codecs/netflow9_test_cisco_asr9k_opttpl256.dat
@@ -129,43 +112,63 @@ files:
129
112
  - spec/codecs/netflow9_test_cisco_nbar_data262.dat
130
113
  - spec/codecs/netflow9_test_cisco_nbar_opttpl260.dat
131
114
  - spec/codecs/netflow9_test_cisco_nbar_tpl262.dat
132
- - spec/codecs/netflow9_test_cisco_wlc_8510_tpl_262.dat
115
+ - spec/codecs/netflow9_test_unknown_tpl266_292_data.dat
133
116
  - spec/codecs/netflow9_test_cisco_wlc_data261.dat
134
117
  - spec/codecs/netflow9_test_cisco_wlc_tpl.dat
135
- - spec/codecs/netflow9_test_field_layer2segmentid_data.dat
136
- - spec/codecs/netflow9_test_field_layer2segmentid_tpl.dat
137
118
  - spec/codecs/netflow9_test_fortigate_fortios_521_data256.dat
138
119
  - spec/codecs/netflow9_test_fortigate_fortios_521_data257.dat
139
120
  - spec/codecs/netflow9_test_fortigate_fortios_521_tpl.dat
140
- - spec/codecs/netflow9_test_huawei_netstream_data.dat
141
- - spec/codecs/netflow9_test_huawei_netstream_tpl.dat
142
- - spec/codecs/netflow9_test_invalid01.dat
143
- - spec/codecs/netflow9_test_iptnetflow_reduced_size_encoding_tpldata260.dat
144
121
  - spec/codecs/netflow9_test_juniper_srx_tplopt.dat
145
- - spec/codecs/netflow9_test_macaddr_data.dat
146
- - spec/codecs/netflow9_test_macaddr_tpl.dat
147
- - spec/codecs/netflow9_test_nprobe_data.dat
148
122
  - spec/codecs/netflow9_test_nprobe_dpi.dat
149
- - spec/codecs/netflow9_test_nprobe_tpl.dat
150
- - spec/codecs/netflow9_test_paloalto_panos_data.dat
151
- - spec/codecs/netflow9_test_paloalto_panos_tpl.dat
152
- - spec/codecs/netflow9_test_softflowd_tpl_data.dat
153
123
  - spec/codecs/netflow9_test_streamcore_tpl_data256.dat
154
124
  - spec/codecs/netflow9_test_streamcore_tpl_data260.dat
155
- - spec/codecs/netflow9_test_ubnt_edgerouter_data1024.dat
156
- - spec/codecs/netflow9_test_ubnt_edgerouter_data1025.dat
157
- - spec/codecs/netflow9_test_ubnt_edgerouter_tpl.dat
158
- - spec/codecs/netflow9_test_unknown_tpl266_292_data.dat
159
- - spec/codecs/netflow9_test_valid01.dat
160
- - spec/codecs/netflow_spec.rb
125
+ - spec/codecs/ipfix_test_yaf_data45841.dat
126
+ - spec/codecs/ipfix_test_yaf_data45873.dat
127
+ - spec/codecs/ipfix_test_yaf_data53248.dat
128
+ - spec/codecs/ipfix_test_yaf_tpl45841.dat
129
+ - spec/codecs/ipfix_test_yaf_tpls_option_tpl.dat
130
+ - spec/codecs/netflow9_cisco_asr1001x_tpl259.dat
131
+ - spec/codecs/netflow9_test_cisco_1941K9.dat
132
+ - spec/codecs/netflow9_test_cisco_wlc_8510_tpl_262.dat
133
+ - spec/codecs/netflow9_test_paloalto_panos_data.dat
134
+ - spec/codecs/netflow9_test_paloalto_panos_tpl.dat
161
135
  - spec/codecs/netflow_stress.py
136
+ - spec/codecs/ipfix_test_viptela_tpl257.dat
137
+ - spec/codecs/ipfix_test_viptela_data257.dat
138
+ - spec/codecs/ipfix_test_nokia_bras_data256.dat
139
+ - spec/codecs/netflow9_test_field_layer2segmentid_data.dat
140
+ - spec/codecs/ipfix_test_procera_tpl52935.dat
141
+ - spec/codecs/ipfix_test_procera_data52935.dat
142
+ - spec/codecs/ipfix_test_barracuda_extended_uniflow_tpl256.dat
143
+ - spec/codecs/benchmarks/netflow_bench_cisco_asa.py
144
+ - spec/codecs/benchmarks/netflow_bench_cisco_asr.py
145
+ - spec/codecs/benchmarks/ACLidASA.rb
146
+ - spec/codecs/benchmarks/MacAddr.rb
147
+ - spec/codecs/benchmarks/IPAddr.rb
148
+ - spec/codecs/benchmarks/IP6Addr.rb
149
+ - spec/codecs/ipfix_test_barracuda_extended_uniflow_data256.dat
150
+ - spec/codecs/netflow9_test_field_layer2segmentid_tpl.dat
151
+ - spec/codecs/netflow9_test_huawei_netstream_tpl.dat
152
+ - spec/codecs/netflow9_test_huawei_netstream_data.dat
153
+ - spec/codecs/ipfix_stress.py
154
+ - spec/codecs/netflow9_test_iptnetflow_reduced_size_encoding_tpldata260.dat
155
+ - logstash-codec-netflow.gemspec
156
+ - CHANGELOG.md
157
+ - README.md
158
+ - RFC_COMPLIANCE_IPFIX.md
159
+ - RFC_COMPLIANCE_NETFLOW_v9.md
160
+ - CONTRIBUTORS
161
+ - Gemfile
162
+ - LICENSE
163
+ - NOTICE.TXT
164
+ - docs/index.asciidoc
162
165
  homepage: http://www.elastic.co/guide/en/logstash/current/index.html
163
166
  licenses:
164
167
  - Apache License (2.0)
165
168
  metadata:
166
169
  logstash_plugin: 'true'
167
170
  logstash_group: codec
168
- post_install_message:
171
+ post_install_message:
169
172
  rdoc_options: []
170
173
  require_paths:
171
174
  - lib
@@ -180,58 +183,49 @@ required_rubygems_version: !ruby/object:Gem::Requirement
180
183
  - !ruby/object:Gem::Version
181
184
  version: '0'
182
185
  requirements: []
183
- rubyforge_project:
184
- rubygems_version: 2.4.8
185
- signing_key:
186
+ rubyforge_project:
187
+ rubygems_version: 2.0.14.1
188
+ signing_key:
186
189
  specification_version: 4
187
190
  summary: Reads Netflow v5, Netflow v9 and IPFIX data
188
191
  test_files:
189
- - spec/codecs/benchmarks/ACLidASA.rb
190
- - spec/codecs/benchmarks/IP6Addr.rb
191
- - spec/codecs/benchmarks/IPAddr.rb
192
- - spec/codecs/benchmarks/MacAddr.rb
193
- - spec/codecs/benchmarks/netflow_bench_cisco_asa.py
194
- - spec/codecs/benchmarks/netflow_bench_cisco_asr.py
195
192
  - spec/codecs/ipfix.dat
196
- - spec/codecs/ipfix_test_barracuda_data256.dat
197
- - spec/codecs/ipfix_test_barracuda_extended_uniflow_data256.dat
198
- - spec/codecs/ipfix_test_barracuda_extended_uniflow_tpl256.dat
199
- - spec/codecs/ipfix_test_barracuda_tpl.dat
200
- - spec/codecs/ipfix_test_mikrotik_data258.dat
201
- - spec/codecs/ipfix_test_mikrotik_data259.dat
202
- - spec/codecs/ipfix_test_mikrotik_tpl.dat
203
- - spec/codecs/ipfix_test_netscaler_data.dat
204
- - spec/codecs/ipfix_test_netscaler_tpl.dat
205
- - spec/codecs/ipfix_test_nokia_bras_data256.dat
206
- - spec/codecs/ipfix_test_nokia_bras_tpl.dat
207
193
  - spec/codecs/ipfix_test_openbsd_pflow_data.dat
208
194
  - spec/codecs/ipfix_test_openbsd_pflow_tpl.dat
209
- - spec/codecs/ipfix_test_procera_data52935.dat
210
- - spec/codecs/ipfix_test_procera_tpl52935.dat
211
- - spec/codecs/ipfix_test_viptela_data257.dat
212
- - spec/codecs/ipfix_test_viptela_tpl257.dat
213
- - spec/codecs/ipfix_test_vmware_vds_data264.dat
214
- - spec/codecs/ipfix_test_vmware_vds_data266.dat
215
- - spec/codecs/ipfix_test_vmware_vds_data266_267.dat
216
- - spec/codecs/ipfix_test_vmware_vds_tpl.dat
217
- - spec/codecs/ipfix_test_yaf_data45841.dat
218
- - spec/codecs/ipfix_test_yaf_data45873.dat
219
- - spec/codecs/ipfix_test_yaf_data53248.dat
220
- - spec/codecs/ipfix_test_yaf_tpl45841.dat
221
- - spec/codecs/ipfix_test_yaf_tpls_option_tpl.dat
222
195
  - spec/codecs/netflow5.dat
223
196
  - spec/codecs/netflow5_test_invalid01.dat
224
197
  - spec/codecs/netflow5_test_invalid02.dat
225
198
  - spec/codecs/netflow5_test_juniper_mx80.dat
226
199
  - spec/codecs/netflow5_test_microtik.dat
227
- - spec/codecs/netflow9_cisco_asr1001x_tpl259.dat
228
- - spec/codecs/netflow9_test_0length_fields_tpl_data.dat
229
- - spec/codecs/netflow9_test_cisco_1941K9.dat
230
200
  - spec/codecs/netflow9_test_cisco_asa_1_data.dat
231
201
  - spec/codecs/netflow9_test_cisco_asa_1_tpl.dat
232
202
  - spec/codecs/netflow9_test_cisco_asa_2_data.dat
233
203
  - spec/codecs/netflow9_test_cisco_asa_2_tpl_26x.dat
234
204
  - spec/codecs/netflow9_test_cisco_asa_2_tpl_27x.dat
205
+ - spec/codecs/netflow9_test_invalid01.dat
206
+ - spec/codecs/netflow9_test_macaddr_data.dat
207
+ - spec/codecs/netflow9_test_macaddr_tpl.dat
208
+ - spec/codecs/netflow9_test_nprobe_data.dat
209
+ - spec/codecs/netflow9_test_nprobe_tpl.dat
210
+ - spec/codecs/netflow9_test_softflowd_tpl_data.dat
211
+ - spec/codecs/netflow9_test_valid01.dat
212
+ - spec/codecs/netflow9_test_ubnt_edgerouter_tpl.dat
213
+ - spec/codecs/netflow9_test_ubnt_edgerouter_data1024.dat
214
+ - spec/codecs/netflow9_test_ubnt_edgerouter_data1025.dat
215
+ - spec/codecs/ipfix_test_netscaler_data.dat
216
+ - spec/codecs/ipfix_test_netscaler_tpl.dat
217
+ - spec/codecs/ipfix_test_vmware_vds_data264.dat
218
+ - spec/codecs/ipfix_test_vmware_vds_data266.dat
219
+ - spec/codecs/ipfix_test_vmware_vds_data266_267.dat
220
+ - spec/codecs/ipfix_test_vmware_vds_tpl.dat
221
+ - spec/codecs/ipfix_test_barracuda_data256.dat
222
+ - spec/codecs/ipfix_test_barracuda_tpl.dat
223
+ - spec/codecs/ipfix_test_mikrotik_data258.dat
224
+ - spec/codecs/ipfix_test_mikrotik_data259.dat
225
+ - spec/codecs/ipfix_test_mikrotik_tpl.dat
226
+ - spec/codecs/ipfix_test_nokia_bras_tpl.dat
227
+ - spec/codecs/netflow9_test_0length_fields_tpl_data.dat
228
+ - spec/codecs/netflow_spec.rb
235
229
  - spec/codecs/netflow9_test_cisco_asr9k_data256.dat
236
230
  - spec/codecs/netflow9_test_cisco_asr9k_data260.dat
237
231
  - spec/codecs/netflow9_test_cisco_asr9k_opttpl256.dat
@@ -242,33 +236,43 @@ test_files:
242
236
  - spec/codecs/netflow9_test_cisco_nbar_data262.dat
243
237
  - spec/codecs/netflow9_test_cisco_nbar_opttpl260.dat
244
238
  - spec/codecs/netflow9_test_cisco_nbar_tpl262.dat
245
- - spec/codecs/netflow9_test_cisco_wlc_8510_tpl_262.dat
239
+ - spec/codecs/netflow9_test_unknown_tpl266_292_data.dat
246
240
  - spec/codecs/netflow9_test_cisco_wlc_data261.dat
247
241
  - spec/codecs/netflow9_test_cisco_wlc_tpl.dat
248
- - spec/codecs/netflow9_test_field_layer2segmentid_data.dat
249
- - spec/codecs/netflow9_test_field_layer2segmentid_tpl.dat
250
242
  - spec/codecs/netflow9_test_fortigate_fortios_521_data256.dat
251
243
  - spec/codecs/netflow9_test_fortigate_fortios_521_data257.dat
252
244
  - spec/codecs/netflow9_test_fortigate_fortios_521_tpl.dat
253
- - spec/codecs/netflow9_test_huawei_netstream_data.dat
254
- - spec/codecs/netflow9_test_huawei_netstream_tpl.dat
255
- - spec/codecs/netflow9_test_invalid01.dat
256
- - spec/codecs/netflow9_test_iptnetflow_reduced_size_encoding_tpldata260.dat
257
245
  - spec/codecs/netflow9_test_juniper_srx_tplopt.dat
258
- - spec/codecs/netflow9_test_macaddr_data.dat
259
- - spec/codecs/netflow9_test_macaddr_tpl.dat
260
- - spec/codecs/netflow9_test_nprobe_data.dat
261
246
  - spec/codecs/netflow9_test_nprobe_dpi.dat
262
- - spec/codecs/netflow9_test_nprobe_tpl.dat
263
- - spec/codecs/netflow9_test_paloalto_panos_data.dat
264
- - spec/codecs/netflow9_test_paloalto_panos_tpl.dat
265
- - spec/codecs/netflow9_test_softflowd_tpl_data.dat
266
247
  - spec/codecs/netflow9_test_streamcore_tpl_data256.dat
267
248
  - spec/codecs/netflow9_test_streamcore_tpl_data260.dat
268
- - spec/codecs/netflow9_test_ubnt_edgerouter_data1024.dat
269
- - spec/codecs/netflow9_test_ubnt_edgerouter_data1025.dat
270
- - spec/codecs/netflow9_test_ubnt_edgerouter_tpl.dat
271
- - spec/codecs/netflow9_test_unknown_tpl266_292_data.dat
272
- - spec/codecs/netflow9_test_valid01.dat
273
- - spec/codecs/netflow_spec.rb
249
+ - spec/codecs/ipfix_test_yaf_data45841.dat
250
+ - spec/codecs/ipfix_test_yaf_data45873.dat
251
+ - spec/codecs/ipfix_test_yaf_data53248.dat
252
+ - spec/codecs/ipfix_test_yaf_tpl45841.dat
253
+ - spec/codecs/ipfix_test_yaf_tpls_option_tpl.dat
254
+ - spec/codecs/netflow9_cisco_asr1001x_tpl259.dat
255
+ - spec/codecs/netflow9_test_cisco_1941K9.dat
256
+ - spec/codecs/netflow9_test_cisco_wlc_8510_tpl_262.dat
257
+ - spec/codecs/netflow9_test_paloalto_panos_data.dat
258
+ - spec/codecs/netflow9_test_paloalto_panos_tpl.dat
274
259
  - spec/codecs/netflow_stress.py
260
+ - spec/codecs/ipfix_test_viptela_tpl257.dat
261
+ - spec/codecs/ipfix_test_viptela_data257.dat
262
+ - spec/codecs/ipfix_test_nokia_bras_data256.dat
263
+ - spec/codecs/netflow9_test_field_layer2segmentid_data.dat
264
+ - spec/codecs/ipfix_test_procera_tpl52935.dat
265
+ - spec/codecs/ipfix_test_procera_data52935.dat
266
+ - spec/codecs/ipfix_test_barracuda_extended_uniflow_tpl256.dat
267
+ - spec/codecs/benchmarks/netflow_bench_cisco_asa.py
268
+ - spec/codecs/benchmarks/netflow_bench_cisco_asr.py
269
+ - spec/codecs/benchmarks/ACLidASA.rb
270
+ - spec/codecs/benchmarks/MacAddr.rb
271
+ - spec/codecs/benchmarks/IPAddr.rb
272
+ - spec/codecs/benchmarks/IP6Addr.rb
273
+ - spec/codecs/ipfix_test_barracuda_extended_uniflow_data256.dat
274
+ - spec/codecs/netflow9_test_field_layer2segmentid_tpl.dat
275
+ - spec/codecs/netflow9_test_huawei_netstream_tpl.dat
276
+ - spec/codecs/netflow9_test_huawei_netstream_data.dat
277
+ - spec/codecs/ipfix_stress.py
278
+ - spec/codecs/netflow9_test_iptnetflow_reduced_size_encoding_tpldata260.dat