v9 collector

[somecallmemike]

Hi, when I collect v9 flows I am seeing duplicate v9Flowsets flowdata when the count is larger than 1:

{ header:
{ version: 9,
count: 2,
sys_uptime: 4076090536,
unix_secs: 1371840979,
package_seqence: 66436,
source_id: 0 },
v9Flowsets:
[ { flowset_id: 256,
length: 100,
flowdata: <Buffer f2 f3 ce 20 f2 f3 ce 20 00 00 00 2a 00 00 00 01 00 03 00 00 40 21 81 ba 40 21 82 6a 06 00 e5 e9 00 17 00 00 00 00 00 00 00 00 18 00 00 00 00 00 f2 f3 ed ...> },
{ flowset_id: 256,
length: 100,
flowdata: <Buffer f2 f3 ce 20 f2 f3 ce 20 00 00 00 2a 00 00 00 01 00 03 00 00 40 21 81 ba 40 21 82 6a 06 00 e5 e9 00 17 00 00 00 00 00 00 00 00 18 00 00 00 00 00 f2 f3 ed ...> } ] }

I am not really sure, but the two flowdata values should be different no?

I also noticed on line 75 of NetFlowPacket.js 'sequence' is misspelled:

this.header['package_seqence']=msgBuffer.readUInt32BE(12);

[spellgen]

The collector does not interpret the v9 record count from the header correctly - it assumes that the header.count is the number of flowsets when in fact it is the total number of records in the packet. An example could be a packet with 30 records, but only two flowsets: one for the template and one for the remaining 29 data flows.

[spellgen]

somecallmike: flowset_id's refer to the template that defines the data record when larger than 255, so generally speaking it is very likely to refer to the same template for subsequent data flowsets.