Skip to content

Options API is broken and needs to be changed/removed #1

@mkcms

Description

@mkcms

Currently we store options for each exporter device like this (pseudocode):

options = map<field, value>();

But this is wrong, because in Netflow9 there can be multiple option values for a given option field.
This is because option packets are divided into multiple FLOWS, and each flow is independent.

For example:

OPTION TEMPLATE
  FLOWSET0
    FLOW0
      SAMPLER_ID = 100
      SAMPLING_INTERVAL = 10
    FLOW1
      SAMPLER_ID = 101
      SAMPLING_INTERVAL = 100

With current implementation of nf9_get_option if you asked for SAMPLER_ID option you would get 101, and for SAMPLING_INTERVAL - 100. And you have no way of getting the values in the first flow.

So I propose that we either:

  1. Change the way options are stored and the API to retrieve them

    options = vector<map<field, value>>();
    
    int nf9_get_option(const nf9_state* st, unsigned flow, nf9_field which, void* dst, size_t *size);

    (note the added flow param, which is the index of the flow)

  2. Remove the options API.

    And leave option handling for the user. We'd just have to make sure that the user can retrieve values from an options packet. This would simplify the code a lot, but we would lose some functionality.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions