Skip to content
This repository has been archived by the owner on Nov 27, 2018. It is now read-only.

Add basicList support #19

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

ogasser
Copy link

@ogasser ogasser commented Feb 6, 2018

Add support for basicList.

Results can be displayed using ipfixcat. Example:

{"name":"basicList","field":291,"value":"(semantic=4,fieldID=190,fieldLen=2)[60,52,367,52]"}

See RFC 6313 for more info on basicList.

@calmh
Copy link
Owner

calmh commented Feb 6, 2018

Hi! Thanks!

At first glance I don't think this should interpret into a string. I would expect the interpretation to return a slice of the relevant data type?

@ogasser
Copy link
Author

ogasser commented Feb 6, 2018

If we are using a "pure" slice we would lose information such as the list semantic. This could be captured in a struct. What do you think @calmh ?

@calmh
Copy link
Owner

calmh commented Feb 6, 2018 via email

@ogasser
Copy link
Author

ogasser commented Feb 7, 2018

You can use basicList to encode multiple values of an IE for a single one flow. An example would be to export the length of each packet within a flow. The following example flow

{"name":"basicList","field":291,"value":"(semantic=4,fieldID=190,fieldLen=2)[60,52,367,52]"}

contains four packets, the first has size 60 bytes, second has size 52 bytes, then 367B, and finally 52B.

The semantic specifies the relation of the list elements, e.g. semantic=4 means ordered, i.e. the first list element corresponds to the first packet in the flow.

@calmh
Copy link
Owner

calmh commented Feb 7, 2018 via email

@ogasser
Copy link
Author

ogasser commented Feb 7, 2018

basicList types now return []interface{} and support PEN.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants