Uploaded image for project: 'Network Observability'
  1. Network Observability
  2. NETOBSERV-2208

IPFIX MAC addresses are truncated

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Undefined Undefined
    • netobserv-1.9
    • netobserv-1.8
    • None
    • None
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • Hide
      Previously, when configuring FlowCollector with an IPFIX exporter, MAC addresses in the IPFIX flows were truncated to their 2 first bytes.
      With this fix, MAC addresses are fully represented in the IPFIX flows.
      Show
      Previously, when configuring FlowCollector with an IPFIX exporter, MAC addresses in the IPFIX flows were truncated to their 2 first bytes. With this fix, MAC addresses are fully represented in the IPFIX flows.

      When configuring IPFIX export, MAC addresses are truncated to the first two bytes.

       

      Explanation: we were wrongly using the string representation of the MAC addresses instead of their binary representation. A MAC is 6 bytes, but when represented as a string, it's 2x6 characters + the ":" separators, which is 17 bytes.

      In go-ipfix 0.12, this would just truncate to 6 bytes (6 bytes as string like "01:12:" = 2 MAC bytes) without causing more side effect or corrupting the buffer, because the buffer index was incremented exactly to the expected size (6 bytes): https://github.com/vmware/go-ipfix/blob/34201df9daa01865abac010657a54c8a7d09e67c/pkg/entities/record.go#L217

      However since version 0.13, the way data is written to the buffer changed: https://github.com/vmware/go-ipfix/blob/3c6f32b463800cc84aeb27869b13dbe64a59dbcc/pkg/entities/ie.go#L682 - it's appended regardless of its size. Later on, there's a verification that the buffer size match exactly the expectation: https://github.com/vmware/go-ipfix/blob/3c6f32b463800cc84aeb27869b13dbe64a59dbcc/pkg/exporter/process.go#L467 - which would return an error in our case. This makes our tests failing with go-ipfix 0.13.

              Unassigned Unassigned
              jtakvori Joel Takvorian
              None
              None
              None
              Mehul Modi Mehul Modi
              None
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: