logstash-codec-netflow 3.4.1 → 3.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +8 -0
  3. data/CONTRIBUTORS +1 -0
  4. data/lib/logstash/codecs/netflow/netflow.yaml +15 -0
  5. data/logstash-codec-netflow.gemspec +1 -1
  6. data/spec/codecs/netflow9_test_cisco_wlc_data261.dat +0 -0
  7. data/spec/codecs/netflow9_test_cisco_wlc_tpl.dat +0 -0
  8. data/spec/codecs/netflow_spec.rb +45 -0
  9. metadata +79 -73
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: e24cdd7142f243456a0979b80fee32122326f8a8
4
- data.tar.gz: 7957b0685a192b19c5c47e642fe0afdb8d53b25a
3
+ metadata.gz: 32f71436a65fa46010df46996c298d6ee3fd69c3
4
+ data.tar.gz: 3546a333cad653c94bc66a9eadc7a0b84169b2cf
5
5
  SHA512:
6
- metadata.gz: 95744daec1b4bdab27fc5632735d4c7d09f2de41826dedf7ba52e2f8e6f0a298cb1e952a5e9e9009268f2862e87fb9d47ce1a2edb6856edbd4aa769f3c9cbb87
7
- data.tar.gz: 572be553da4d2a93619df3f146c274d8b7babc85292b31ea676321c0e8320e420f5fad27010b826564a1b835f9537975af341f17fd29452da479016fc29cdf11
6
+ metadata.gz: 829dadfc0855a0185db386d859a81d151639b51ffd663ceb51bc6126ab870b0bf8a8f49fbd600f2dda17bb290a17ab469e98ae28e7039807a41b0dac4cc3c2e4
7
+ data.tar.gz: ef4c100952e730e612fb20c08dd624ad498e20f4de7b8e04602d93c2b162e844767d903c4554811db9e237d31512415bc19496a242cbeb1733834718d26239fc
data/CHANGELOG.md CHANGED
@@ -1,3 +1,11 @@
1
+ ## 3.5.0
2
+
3
+ - Added support for Cisco WLC (Netflow v9)
4
+
5
+ ## 3.4.0
6
+
7
+ - Added support for Cisco NBAR (Netflow v9)
8
+
1
9
  ## 3.3.0
2
10
 
3
11
  - Added support for Cisco ASR 9000 (Netflow v9)
data/CONTRIBUTORS CHANGED
@@ -20,6 +20,7 @@ Contributors:
20
20
  * Richard Pijnenburg (electrical)
21
21
  * Salvador Ferrer (salva-ferrer)
22
22
  * Will Rigby (wrigby)
23
+ * Yehonatan Devorkin (Devorkin)
23
24
  * Rojuinex
24
25
  * debadair
25
26
  * hkshirish
data/lib/logstash/codecs/netflow/netflow.yaml CHANGED
@@ -232,9 +232,15 @@
232
232
  96:
233
233
  - :string
234
234
  - :application_name
235
+ 98:
236
+ - :uint8
237
+ - :postIpDiffServCodePoint
235
238
  136:
236
239
  - :uint8
237
240
  - :flow_end_reason
241
+ 147:
242
+ - :string
243
+ - :wlanSSID
238
244
  148:
239
245
  - :uint32
240
246
  - :conn_id
@@ -325,6 +331,15 @@
325
331
  362:
326
332
  - :uint16
327
333
  - :postNATPortBlockEnd
334
+ 365:
335
+ - :mac_addr
336
+ - :staMacAddress
337
+ 366:
338
+ - :ip4_addr
339
+ - :staIPv4Address
340
+ 367:
341
+ - :mac_addr
342
+ - :wtpMacAddress
328
343
  8192:
329
344
  - :uint32
330
345
  - :streamcore_wan_rtt
data/logstash-codec-netflow.gemspec CHANGED
@@ -1,7 +1,7 @@
1
1
  Gem::Specification.new do |s|
2
2
 
3
3
  s.name = 'logstash-codec-netflow'
4
- s.version = '3.4.1'
4
+ s.version = '3.5.0'
5
5
  s.licenses = ['Apache License (2.0)']
6
6
  s.summary = "The netflow codec is for decoding Netflow v5/v9/v10 (IPFIX) flows."
7
7
  s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
data/spec/codecs/netflow_spec.rb CHANGED
@@ -1698,6 +1698,51 @@ describe LogStash::Codecs::Netflow do
1698
1698
  end
1699
1699
  end
1700
1700
 
1701
+ context "Netflow 9 Cisco WLC" do
1702
+ let(:data) do
1703
+ packets = []
1704
+ packets << IO.read(File.join(File.dirname(__FILE__), "netflow9_test_cisco_wlc_tpl.dat"), :mode => "rb")
1705
+ packets << IO.read(File.join(File.dirname(__FILE__), "netflow9_test_cisco_wlc_data261.dat"), :mode => "rb")
1706
+ end
1707
+
1708
+ let(:json_events) do
1709
+ events = []
1710
+ events << <<-END
1711
+ {
1712
+ "netflow": {
1713
+ "ip_dscp": 0,
1714
+ "in_pkts": 53362,
1715
+ "wtpMacAddress": "00:f6:63:cc:80:60",
1716
+ "staMacAddress": "34:02:86:75:c0:51",
1717
+ "flowset_id": 261,
1718
+ "version": 9,
1719
+ "application_id": "13:431",
1720
+ "flow_seq_num": 78,
1721
+ "in_bytes": 80973880,
1722
+ "postIpDiffServCodePoint": 0,
1723
+ "wlanSSID": "Test-env",
1724
+ "staIPv4Address": "192.168.20.121",
1725
+ "direction": 1
1726
+ },
1727
+ "@timestamp": "2017-06-22T06:31:14.000Z",
1728
+ "@version": "1"
1729
+ }
1730
+ END
1731
+ events.map{|event| event.gsub(/\s+/, "")}
1732
+ end
1733
+
1734
+ it "should decode raw data" do
1735
+ expect(decode.size).to eq(19)
1736
+ expect(decode[18].get("[netflow][application_id]")).to eq("13:431")
1737
+ end
1738
+
1739
+ it "should serialize to json" do
1740
+ expect(JSON.parse(decode[18].to_json)).to eq(JSON.parse(json_events[0]))
1741
+ end
1742
+ end
1743
+
1744
+
1745
+
1701
1746
  end
1702
1747
 
1703
1748
  describe LogStash::Codecs::Netflow, 'missing templates, no template caching configured' do
metadata CHANGED
@@ -1,102 +1,109 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: logstash-codec-netflow
3
3
  version: !ruby/object:Gem::Version
4
- version: 3.4.1
4
+ version: 3.5.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Elastic
8
- autorequire:
8
+ autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
11
  date: 2017-06-23 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
+ name: logstash-core-plugin-api
14
15
  requirement: !ruby/object:Gem::Requirement
15
16
  requirements:
16
- - - ">="
17
+ - - '>='
17
18
  - !ruby/object:Gem::Version
18
19
  version: '1.60'
19
- - - "<="
20
+ - - <=
20
21
  - !ruby/object:Gem::Version
21
22
  version: '2.99'
22
- name: logstash-core-plugin-api
23
- prerelease: false
24
23
  type: :runtime
24
+ prerelease: false
25
25
  version_requirements: !ruby/object:Gem::Requirement
26
26
  requirements:
27
- - - ">="
27
+ - - '>='
28
28
  - !ruby/object:Gem::Version
29
29
  version: '1.60'
30
- - - "<="
30
+ - - <=
31
31
  - !ruby/object:Gem::Version
32
32
  version: '2.99'
33
33
  - !ruby/object:Gem::Dependency
34
+ name: bindata
34
35
  requirement: !ruby/object:Gem::Requirement
35
36
  requirements:
36
- - - ">="
37
+ - - '>='
37
38
  - !ruby/object:Gem::Version
38
39
  version: 1.5.0
39
- name: bindata
40
- prerelease: false
41
40
  type: :runtime
41
+ prerelease: false
42
42
  version_requirements: !ruby/object:Gem::Requirement
43
43
  requirements:
44
- - - ">="
44
+ - - '>='
45
45
  - !ruby/object:Gem::Version
46
46
  version: 1.5.0
47
47
  - !ruby/object:Gem::Dependency
48
+ name: logstash-devutils
48
49
  requirement: !ruby/object:Gem::Requirement
49
50
  requirements:
50
- - - ">="
51
+ - - '>='
51
52
  - !ruby/object:Gem::Version
52
53
  version: 1.0.0
53
- name: logstash-devutils
54
- prerelease: false
55
54
  type: :development
55
+ prerelease: false
56
56
  version_requirements: !ruby/object:Gem::Requirement
57
57
  requirements:
58
- - - ">="
58
+ - - '>='
59
59
  - !ruby/object:Gem::Version
60
60
  version: 1.0.0
61
- description: This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program
61
+ description: This gem is a Logstash plugin required to be installed on top of the
62
+ Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This
63
+ gem is not a stand-alone program
62
64
  email: info@elastic.co
63
65
  executables: []
64
66
  extensions: []
65
67
  extra_rdoc_files: []
66
68
  files:
67
- - CHANGELOG.md
68
- - CONTRIBUTORS
69
- - Gemfile
70
- - LICENSE
71
- - NOTICE.TXT
72
- - README.md
73
- - docs/index.asciidoc
74
- - lib/logstash/codecs/netflow.rb
75
69
  - lib/logstash/codecs/netflow/iana2yaml.rb
76
70
  - lib/logstash/codecs/netflow/ipfix.yaml
77
- - lib/logstash/codecs/netflow/netflow.yaml
78
71
  - lib/logstash/codecs/netflow/util.rb
79
- - logstash-codec-netflow.gemspec
72
+ - lib/logstash/codecs/netflow/netflow.yaml
73
+ - lib/logstash/codecs/netflow.rb
80
74
  - spec/codecs/ipfix.dat
81
- - spec/codecs/ipfix_test_netscaler_data.dat
82
- - spec/codecs/ipfix_test_netscaler_tpl.dat
83
75
  - spec/codecs/ipfix_test_openbsd_pflow_data.dat
84
76
  - spec/codecs/ipfix_test_openbsd_pflow_tpl.dat
85
- - spec/codecs/ipfix_test_vmware_vds_data264.dat
86
- - spec/codecs/ipfix_test_vmware_vds_data266.dat
87
- - spec/codecs/ipfix_test_vmware_vds_data266_267.dat
88
- - spec/codecs/ipfix_test_vmware_vds_tpl.dat
89
77
  - spec/codecs/netflow5.dat
90
78
  - spec/codecs/netflow5_test_invalid01.dat
91
79
  - spec/codecs/netflow5_test_invalid02.dat
92
80
  - spec/codecs/netflow5_test_juniper_mx80.dat
93
81
  - spec/codecs/netflow5_test_microtik.dat
94
- - spec/codecs/netflow9_test_0length_fields_tpl_data.dat
95
82
  - spec/codecs/netflow9_test_cisco_asa_1_data.dat
96
83
  - spec/codecs/netflow9_test_cisco_asa_1_tpl.dat
97
84
  - spec/codecs/netflow9_test_cisco_asa_2_data.dat
98
85
  - spec/codecs/netflow9_test_cisco_asa_2_tpl_26x.dat
99
86
  - spec/codecs/netflow9_test_cisco_asa_2_tpl_27x.dat
87
+ - spec/codecs/netflow9_test_invalid01.dat
88
+ - spec/codecs/netflow9_test_macaddr_data.dat
89
+ - spec/codecs/netflow9_test_macaddr_tpl.dat
90
+ - spec/codecs/netflow9_test_nprobe_data.dat
91
+ - spec/codecs/netflow9_test_nprobe_tpl.dat
92
+ - spec/codecs/netflow9_test_softflowd_tpl_data.dat
93
+ - spec/codecs/netflow9_test_valid01.dat
94
+ - spec/codecs/netflow9_test_ubnt_edgerouter_tpl.dat
95
+ - spec/codecs/netflow9_test_ubnt_edgerouter_data1024.dat
96
+ - spec/codecs/netflow9_test_ubnt_edgerouter_data1025.dat
97
+ - spec/codecs/ipfix_test_netscaler_data.dat
98
+ - spec/codecs/ipfix_test_netscaler_tpl.dat
99
+ - spec/codecs/ipfix_test_vmware_vds_data264.dat
100
+ - spec/codecs/ipfix_test_vmware_vds_data266.dat
101
+ - spec/codecs/ipfix_test_vmware_vds_data266_267.dat
102
+ - spec/codecs/ipfix_test_vmware_vds_tpl.dat
103
+ - spec/codecs/netflow9_test_0length_fields_tpl_data.dat
104
+ - spec/codecs/netflow9_test_juniper_srx_tplopt.dat
105
+ - spec/codecs/netflow9_test_streamcore_tpl_data256.dat
106
+ - spec/codecs/netflow9_test_streamcore_tpl_data260.dat
100
107
  - spec/codecs/netflow9_test_cisco_asr9k_data256.dat
101
108
  - spec/codecs/netflow9_test_cisco_asr9k_data260.dat
102
109
  - spec/codecs/netflow9_test_cisco_asr9k_opttpl256.dat
@@ -107,67 +114,77 @@ files:
107
114
  - spec/codecs/netflow9_test_cisco_nbar_data262.dat
108
115
  - spec/codecs/netflow9_test_cisco_nbar_opttpl260.dat
109
116
  - spec/codecs/netflow9_test_cisco_nbar_tpl262.dat
110
- - spec/codecs/netflow9_test_invalid01.dat
111
- - spec/codecs/netflow9_test_juniper_srx_tplopt.dat
112
- - spec/codecs/netflow9_test_macaddr_data.dat
113
- - spec/codecs/netflow9_test_macaddr_tpl.dat
114
- - spec/codecs/netflow9_test_nprobe_data.dat
115
- - spec/codecs/netflow9_test_nprobe_tpl.dat
116
- - spec/codecs/netflow9_test_softflowd_tpl_data.dat
117
- - spec/codecs/netflow9_test_streamcore_tpl_data256.dat
118
- - spec/codecs/netflow9_test_streamcore_tpl_data260.dat
119
- - spec/codecs/netflow9_test_ubnt_edgerouter_data1024.dat
120
- - spec/codecs/netflow9_test_ubnt_edgerouter_data1025.dat
121
- - spec/codecs/netflow9_test_ubnt_edgerouter_tpl.dat
122
- - spec/codecs/netflow9_test_valid01.dat
117
+ - spec/codecs/netflow9_test_cisco_wlc_tpl.dat
118
+ - spec/codecs/netflow9_test_cisco_wlc_data261.dat
123
119
  - spec/codecs/netflow_spec.rb
120
+ - logstash-codec-netflow.gemspec
121
+ - CHANGELOG.md
122
+ - README.md
123
+ - CONTRIBUTORS
124
+ - Gemfile
125
+ - LICENSE
126
+ - NOTICE.TXT
127
+ - docs/index.asciidoc
124
128
  homepage: http://www.elastic.co/guide/en/logstash/current/index.html
125
129
  licenses:
126
130
  - Apache License (2.0)
127
131
  metadata:
128
132
  logstash_plugin: 'true'
129
133
  logstash_group: codec
130
- post_install_message:
134
+ post_install_message:
131
135
  rdoc_options: []
132
136
  require_paths:
133
137
  - lib
134
138
  required_ruby_version: !ruby/object:Gem::Requirement
135
139
  requirements:
136
- - - ">="
140
+ - - '>='
137
141
  - !ruby/object:Gem::Version
138
142
  version: '0'
139
143
  required_rubygems_version: !ruby/object:Gem::Requirement
140
144
  requirements:
141
- - - ">="
145
+ - - '>='
142
146
  - !ruby/object:Gem::Version
143
147
  version: '0'
144
148
  requirements: []
145
- rubyforge_project:
146
- rubygems_version: 2.4.8
147
- signing_key:
149
+ rubyforge_project:
150
+ rubygems_version: 2.0.14
151
+ signing_key:
148
152
  specification_version: 4
149
153
  summary: The netflow codec is for decoding Netflow v5/v9/v10 (IPFIX) flows.
150
154
  test_files:
151
155
  - spec/codecs/ipfix.dat
152
- - spec/codecs/ipfix_test_netscaler_data.dat
153
- - spec/codecs/ipfix_test_netscaler_tpl.dat
154
156
  - spec/codecs/ipfix_test_openbsd_pflow_data.dat
155
157
  - spec/codecs/ipfix_test_openbsd_pflow_tpl.dat
156
- - spec/codecs/ipfix_test_vmware_vds_data264.dat
157
- - spec/codecs/ipfix_test_vmware_vds_data266.dat
158
- - spec/codecs/ipfix_test_vmware_vds_data266_267.dat
159
- - spec/codecs/ipfix_test_vmware_vds_tpl.dat
160
158
  - spec/codecs/netflow5.dat
161
159
  - spec/codecs/netflow5_test_invalid01.dat
162
160
  - spec/codecs/netflow5_test_invalid02.dat
163
161
  - spec/codecs/netflow5_test_juniper_mx80.dat
164
162
  - spec/codecs/netflow5_test_microtik.dat
165
- - spec/codecs/netflow9_test_0length_fields_tpl_data.dat
166
163
  - spec/codecs/netflow9_test_cisco_asa_1_data.dat
167
164
  - spec/codecs/netflow9_test_cisco_asa_1_tpl.dat
168
165
  - spec/codecs/netflow9_test_cisco_asa_2_data.dat
169
166
  - spec/codecs/netflow9_test_cisco_asa_2_tpl_26x.dat
170
167
  - spec/codecs/netflow9_test_cisco_asa_2_tpl_27x.dat
168
+ - spec/codecs/netflow9_test_invalid01.dat
169
+ - spec/codecs/netflow9_test_macaddr_data.dat
170
+ - spec/codecs/netflow9_test_macaddr_tpl.dat
171
+ - spec/codecs/netflow9_test_nprobe_data.dat
172
+ - spec/codecs/netflow9_test_nprobe_tpl.dat
173
+ - spec/codecs/netflow9_test_softflowd_tpl_data.dat
174
+ - spec/codecs/netflow9_test_valid01.dat
175
+ - spec/codecs/netflow9_test_ubnt_edgerouter_tpl.dat
176
+ - spec/codecs/netflow9_test_ubnt_edgerouter_data1024.dat
177
+ - spec/codecs/netflow9_test_ubnt_edgerouter_data1025.dat
178
+ - spec/codecs/ipfix_test_netscaler_data.dat
179
+ - spec/codecs/ipfix_test_netscaler_tpl.dat
180
+ - spec/codecs/ipfix_test_vmware_vds_data264.dat
181
+ - spec/codecs/ipfix_test_vmware_vds_data266.dat
182
+ - spec/codecs/ipfix_test_vmware_vds_data266_267.dat
183
+ - spec/codecs/ipfix_test_vmware_vds_tpl.dat
184
+ - spec/codecs/netflow9_test_0length_fields_tpl_data.dat
185
+ - spec/codecs/netflow9_test_juniper_srx_tplopt.dat
186
+ - spec/codecs/netflow9_test_streamcore_tpl_data256.dat
187
+ - spec/codecs/netflow9_test_streamcore_tpl_data260.dat
171
188
  - spec/codecs/netflow9_test_cisco_asr9k_data256.dat
172
189
  - spec/codecs/netflow9_test_cisco_asr9k_data260.dat
173
190
  - spec/codecs/netflow9_test_cisco_asr9k_opttpl256.dat
@@ -178,17 +195,6 @@ test_files:
178
195
  - spec/codecs/netflow9_test_cisco_nbar_data262.dat
179
196
  - spec/codecs/netflow9_test_cisco_nbar_opttpl260.dat
180
197
  - spec/codecs/netflow9_test_cisco_nbar_tpl262.dat
181
- - spec/codecs/netflow9_test_invalid01.dat
182
- - spec/codecs/netflow9_test_juniper_srx_tplopt.dat
183
- - spec/codecs/netflow9_test_macaddr_data.dat
184
- - spec/codecs/netflow9_test_macaddr_tpl.dat
185
- - spec/codecs/netflow9_test_nprobe_data.dat
186
- - spec/codecs/netflow9_test_nprobe_tpl.dat
187
- - spec/codecs/netflow9_test_softflowd_tpl_data.dat
188
- - spec/codecs/netflow9_test_streamcore_tpl_data256.dat
189
- - spec/codecs/netflow9_test_streamcore_tpl_data260.dat
190
- - spec/codecs/netflow9_test_ubnt_edgerouter_data1024.dat
191
- - spec/codecs/netflow9_test_ubnt_edgerouter_data1025.dat
192
- - spec/codecs/netflow9_test_ubnt_edgerouter_tpl.dat
193
- - spec/codecs/netflow9_test_valid01.dat
198
+ - spec/codecs/netflow9_test_cisco_wlc_tpl.dat
199
+ - spec/codecs/netflow9_test_cisco_wlc_data261.dat
194
200
  - spec/codecs/netflow_spec.rb