From db87c37a0abdd2ea0543b7904d3480b3107e9265 Mon Sep 17 00:00:00 2001 From: Louis Date: Fri, 13 Apr 2018 15:20:22 -0700 Subject: [PATCH] Able to determine sampling rate using other fields (used by some Cisco) --- goflow.go | 2 +- producer/producer_nf.go | 14 +++++++++++--- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/goflow.go b/goflow.go index 85dad557..5a106050 100644 --- a/goflow.go +++ b/goflow.go @@ -28,7 +28,7 @@ import ( "bytes" ) -const AppVersion = "GoFlow v2.0.0" +const AppVersion = "GoFlow v2.0.1" var ( FEnable = flag.Bool("netflow", true, "Enable NetFlow") diff --git a/producer/producer_nf.go b/producer/producer_nf.go index fc0519c0..fa1529a3 100644 --- a/producer/producer_nf.go +++ b/producer/producer_nf.go @@ -292,9 +292,17 @@ func SearchNetFlowOptionDataSets(dataFlowSet []netflow.OptionsDataFlowSet) (uint var found bool for _, dataFlowSetItem := range dataFlowSet { for _, record := range dataFlowSetItem.Records { - b := NetFlowPopulate(record.OptionsValues, 34, &samplingRate) - if b { // cannot do found |= NetFlow... - found = b + b := NetFlowPopulate(record.OptionsValues, 305, &samplingRate) + if b { + return samplingRate, b + } + b = NetFlowPopulate(record.OptionsValues, 50, &samplingRate) + if b { + return samplingRate, b + } + b = NetFlowPopulate(record.OptionsValues, 34, &samplingRate) + if b { + return samplingRate, b } } }