Protocol CFLOW not processing full size Packet

asked 2025-02-20 16:47:30 +0000

difan
1

updated 2025-02-20 16:57:49 +0000

flag of United Kingdom of Great Britain and Northern Ireland

23850 ●4 ●986 ●227 https://www.wireshark.org

Hi team, I did a packet capture to analyze the Netflow (v9) data. I noticed that for smaller packet (< 1420 including IP header), it inteprets all fields properly. If it is full size, it doesn't inteprets the FlowSet 2 that contains the actual flow data anymore... It still shows the version, count, FlowSequence, and the FlowSet 1 which is the Template, just not the data part. I just updated the wireshark to the latest 4.4.3 too and still the same. Please help.

PS - I want to attach the packets but it requires "60 points" for that... I am new to the forum. Please let me how to attach if there is a different way to do that. Thanks!

Thanks! Difan

edit retag flag offensive close merge delete

Comments

Can you share a capture with a packet that illustrates the issue?

grahamb ( 2025-02-20 16:51:11 +0000 )edit

Unfortunately due to spammers and scammers we restrict new users from uploading images\captures etc. until they have built enough "karma".

You can put your artefacts on any public "share", and post a link back to them by editing your question.

grahamb ( 2025-02-20 16:59:39 +0000 )edit

Thanks Graham! That is a good idea. Let me know if you can download this https://1drv.ms/u/c/6b91f3ba519e259d/...

I also just noticed that they could be fragmented on the IP level. I see IP header flag "more fragments" is set. I am wondering if this is the reason. But I did try checking that "Reassemble fragmented IPv4 datagrams" for IP porotocol. After it, I don't even see UDP headers anymore...

difan ( 2025-02-21 02:45:49 +0000 )edit

How was the capture made? Was there a capture filter?
Was a bigger capture filtered and saved but the fragments not included?

Chuckc ( 2025-02-21 03:38:49 +0000 )edit

Hi Chuck, I ran this command $ sudo tcpdump -nvi eth0 -s 0 -w netflow_nosampler.pcap port 2055 on the netflow server which is Ubuntu v22 server. Let me know if there is any problem with the command. Thanks!

difan ( 2025-02-21 04:32:56 +0000 )edit

add a comment

answered 2025-02-21 13:25:14 +0000

Chuckc
3048 ●6 ●615 ●20

updated 2025-02-21 13:27:32 +0000

Ask: Disabling "Reassemble Fragmented IPv4 datagrams" preference in IPv4 protocol for tshark?

Thank you for sharing your pcap-file, I ran some tests myself and agree you should disable the ip defragmentation because you only captured the first fragments of fragmented traffic. This is because the BPF filter uses a port filter, which is only available in the first fragment. If you change your filter to include (all) IP fragments, you will probably not have this problem, but of course you might be capturing too many IP fragments to other ports. You can try the following capture filter:

udp and (port 5065 or port 5060 or ip[6:2] & 0x1fff > 0)

Try this filter:
udp and (port 2055 or ip[6:2] & 0x1fff > 0)

edit flag offensive delete link

Comments

Oh my god. You nailed it, Chuck.This makes good sense that the fragment won't contain port information, making the filter invalid. I am good now. Thanks!!

difan ( 2025-02-21 19:55:52 +0000 )edit

also can't upvote because of no points lol. Will visit here more to get more points!

difan ( 2025-02-21 19:57:41 +0000 )edit

add a comment

Protocol CFLOW not processing full size Packet

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Protocol CFLOW not processing full size Packet edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Protocol CFLOW not processing full size Packet