Merge pull request #16 from cloudflare/flowlabel

Added flow label parsing (IPv6)

goflow.go

@@ -389,13 +389,13 @@ func FlowMessageToString(fmsg *flowmessage.FlowMessage) string {
 					"SrcAS:%v DstAS:%v SrcNet:%v DstNet:%v SrcIf:%v DstIf:%v Proto:%v " +
 					"SrcPort:%v DstPort:%v IPTos:%v ForwardingStatus:%v IPTTL:%v TCPFlags:%v " +
 					"SrcMac:%v DstMac:%v VlanId:%v Etype:%v IcmpType:%v IcmpCode:%v " +
-					"SrcVlan:%v DstVlan:%v ",
+					"SrcVlan:%v DstVlan:%v IPv6FlowLabel:%v",
 		fmsg.Type, fmsg.TimeRecvd, fmsg.SamplingRate, fmsg.SequenceNum, fmsg.TimeFlow, 
 		net.IP(fmsg.SrcIP), net.IP(fmsg.DstIP), fmsg.IPversion, fmsg.Bytes, fmsg.Packets, net.IP(fmsg.RouterAddr), net.IP(fmsg.NextHop), fmsg.NextHopAS, 
 		fmsg.SrcAS, fmsg.DstAS, fmsg.SrcNet, fmsg.DstNet, fmsg.SrcIf, fmsg.DstIf, fmsg.Proto, 
 		fmsg.SrcPort, fmsg.DstPort, fmsg.IPTos, fmsg.ForwardingStatus, fmsg.IPTTL, fmsg.TCPFlags, 
 		fmsg.SrcMac, fmsg.DstMac, fmsg.VlanId, fmsg.Etype, fmsg.IcmpType, fmsg.IcmpCode, 
-		fmsg.SrcVlan, fmsg.DstVlan)
+		fmsg.SrcVlan, fmsg.DstVlan, fmsg.IPv6FlowLabel)
 	return s
 }
 

pb/flow.proto

@@ -87,4 +87,6 @@ message FlowMessage {
   // Fragments (IPv4/IPv6)
   uint32 FragmentId = 35;
   uint32 FragmentOffset = 36;
+
+  uint32 IPv6FlowLabel = 37;
 }

producer/producer_nf.go

@@ -264,6 +264,9 @@ func ConvertNetFlowDataSet(version uint16, baseTime uint32, uptime uint32, recor
 		case netflow.NFV9_FIELD_FRAGMENT_OFFSET:
 			DecodeUNumber(v, &(flowMessage.FragmentOffset))
 
+		case netflow.NFV9_FIELD_IPV6_FLOW_LABEL:
+			DecodeUNumber(v, &(flowMessage.IPv6FlowLabel))
+
 		default:
 			if version == 9 {
 				// NetFlow v9 time works with a differential based on router's uptime

producer/producer_sf.go

@@ -80,6 +80,9 @@ func ParseSampledHeader(flowMessage *flowmessage.FlowMessage, sampledHeader *sfl
 				tostmp := uint32(binary.BigEndian.Uint16(data[offset : offset+2]))
 				tos = uint8(tostmp & 0x0ff0 >> 4)
 				ttl = data[offset+7]
+
+				flowLabeltmp := binary.BigEndian.Uint32(data[offset : offset+4])
+				(*flowMessage).IPv6FlowLabel = flowLabeltmp & 0xFFFFF
 			}
 		} else if etherType[0] == 0x8 && etherType[1] == 0x6 { // ARP
 		} else {