inputs.netflow
: Source MAC address and Destination MAC address are not being included in metrics when using sFlow v5 decoder
#15918
Labels
bug
unexpected problem or unintended behavior
Relevant telegraf.conf
Logs from Telegraf
System info
Telegraf v1.32.0 running on Docker, Debian 12 as base OS
Docker
Docker compose for testing environment:
Steps to reproduce
I have captured some sFlow traffic using tcpdump. You can use this trace as reference:
telegraf-sflow.pcap.zip
Because I'm using default Netflow port (2055/UDP) for sFlow traffic, Wireshark may not be able to dissect it. You can tune Wireshark analyzer to decode traffic as sFlow:
I have taken one of this packets and copied its content directly from Wireshark to a binary file. The final step requires to run Telegraf locally (or with Docker) with the provided configuration and send the sFlow message stored in the file by using Netcat:
sflow-packet.bin.zip
Expected behavior
Source MAC address and destination MAC address must be present in Telegraf metrics.
Actual behavior
Fields are being decoded by
goflow2
dissector but are not being properly included in TelegrafMetric
struct.Additional info
I have made some tests with a dummy function to try to identity the underlying problem. I'm certain that the problem comes from the type of the decoded
SrcMAC
andDstMAC
variables. If you execute this code in local, you can see that the type isnet.HardwareAddr
:However, when the fields are included in the metric, Telegraf checks that the type is a known one (check
convertField
function which is called when a new Telegraf metric is created):telegraf/metric/metric.go
Line 55 in 640eda0
I think the fix is quite straightforward. It's only necessary to modify the lines where MAC addresses are included to the fields map and convert them to string by using
String()
function:telegraf/plugins/inputs/netflow/sflow_v5.go
Line 372 in 640eda0
telegraf/plugins/inputs/netflow/sflow_v5.go
Line 373 in 640eda0
Hope this helps. Thanks for your work!
The text was updated successfully, but these errors were encountered: