Wireshark-bugs: [Wireshark-bugs] [Bug 4199] New: IPFIX/Netflow v10 templates limited to 20 field
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Tue, 3 Nov 2009 13:57:41 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4199

           Summary: IPFIX/Netflow v10 templates limited to 20 fields
           Product: Wireshark
           Version: SVN
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: Low
         Component: Wireshark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: jasondev@xxxxxxxxxxx


Build Information:
Version 1.3.2 (SVN Rev 30807 from /trunk)

Copyright 1998-2009 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GTK+ 2.16.1, with GLib 2.20.1, with libpcap 1.0.0, with libz
1.2.3.3, without POSIX capabilities, without libpcre, without SMI, without
c-ares, without ADNS, without Lua, without Python, without GnuTLS, without
Gcrypt, without Kerberos, without GeoIP, without PortAudio, without AirPcap,
with new_packet_list.
NOTE: this build doesn't support the "matches" operator for Wireshark filter
syntax.

Running on Linux 2.6.28-16-generic, with libpcap version 1.0.0.

Built using gcc 4.3.3.

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.
--
The latest SVN version of wireshark doesn't support IPFIX/Netflow v10 templates
with more than 20 fields.  This is an arbitrary limit as best as I can tell
from the code.  

I'm working with a product that uses templates with more fields than 20.  I'll
attach a diff increasing the limit to 30 - again arbitrary, however it works
for me. 

I'll also attach a pcap that can be used to demonstrate the functionality.  Be
aware that this pcap exposes a different bug - unsupported total count fields
in the dissector which I'm addressing in a subsequent bug report.

The proposed changes have been fuzz tested using the attached pcap as a data
source.


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.