Support for new IPFIX features support about goflow

[lspgn]

@raghurampai it seems very generic: while the library can be improved to support it while this may not be used when producing the protobuf abstracted flows.
So far no plan of supporting them.

What's the use case? What are the fields produced? What are the devices producing it? Do you have a pcap?

[mathiaske]

Hi just jumping in
We are using dedicated Netflow Probes like Flowmon and others. These are capable of extracting additional information such as DNS requests, HTTP information etc. This is very useful in open high performance environments where firewall, proxy etc. are no option.
This data is then transmitted in IPFIX like any other network traffic information.
Using the corresponding Enterprise ID (IANA is 0) and Field IDs configurations, this allows IPFIX to be used as a widely supported, very flexible data transmission container.
Ideally the enterprise field definitions would not be hard coded, but configurable.
The CESNET IPFIXcol implements such features.

Cheers.

[lspgn]

@mathiaske Got it, thank you for the details. I believe this is beyond the scope of GoFlow which is meant to produce a unique flow format for network samples. The decoding library could definitely benefit from this though. Could you send some samples?
Actually, sFlow also supports things like DNS and HTTP, in which case, it may be interesting to have in GoFlow.

[raghurampai]

@lspgn, sorry for the delay in response. I don't have the pcap currently. The use case at high level is similar to what @mathiaske mentioned. To describe further, the monitoring of BNG (broadband subscriber services) will have some enterprise specific information elements, which basically needs to be processed-
https://www.juniper.net/documentation/en_US/junos/topics/concept/ipfix-mediation-bng.html

Thanks!

[lspgn]

@raghurampai thank you for the details!
I will definitely look into it. Do you have a spec detailing the enterprise specifics fields?

[mathiaske]

We currently use some Flowmon Probes -> CESNET, Flowmon (former Inveatec) fields
We also intend to have our own fields in the future for some use cases
-> it would be greate if this would be configurable (but please not in xml)
Example: https://github.com/CESNET/ipfixcol/blob/master/base/config/ipfix-elements.xml

[raghurampai]

Below link has the enterprise specific fields-
https://www.juniper.net/documentation/en_US/junos/topics/reference/general/logging-dictionary-template-types-tdf.html

Yes, it would be great to have option of some sort of configurable file for goflow decoder to be able to understand the enterprise specific fields. The decoder could then decode these additional fields.