Bug 270083 - [netgraph] ng_netflow, NetFlow v9: maximum packets count between re-announcing data templates is ignored
Summary: [netgraph] ng_netflow, NetFlow v9: maximum packets count between re-announci...
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 13.1-STABLE
Hardware: amd64 Any
: --- Affects Only Me
Assignee: freebsd-net (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-03-10 08:09 UTC by Marek Zarychta
Modified: 2023-03-12 20:57 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marek Zarychta 2023-03-10 08:09:44 UTC
The module seems to ignore the value of "packets" in "settemplate". It is NetFlow_v9 specific setting. To reproduce configure the export9 node with: 

msg netflow: settemplate { time=43200 packets=10 }

and wait for the template to be transmitted. 

Most likely the logic of "sent_packets" is not fully operational and re-announcements of the template are done only on a time basis. This is only a mild flaw since periodic re-announcements of the template work fine.
Comment 1 Marek Zarychta 2023-03-10 11:33:17 UTC
Unfortunately, the removal of code doing re-announcements on the basis of packet counter, according to RFC 3954, is forbidden[1], so maybe our respectable programmers can fix it. 

[1]   3. On a regular basis, the Exporter MUST send all the Template
      Records and Options Template Records to refresh the Collector.
      Template IDs have a limited lifetime at the Collector and MUST be
      periodically refreshed.  Two approaches are taken to make sure
      that Templates get refreshed at the Collector:
            * Every N number of Export Packets.
            * On a time basis, so every N number of minutes.
      Both options MUST be configurable by the user on the Exporter.
      When one of these expiry conditions is met, the Exporter MUST send
      the Template FlowSet and Options Template.