Problem with IPFIX packets parsing in Wireshark

asked 2019-04-01 20:08:10 +0000

im_smv gravatar image

updated 2019-04-02 09:39:34 +0000

grahamb gravatar image

When I am creating IPFIX packets where I am including template record with every packet, I see that packets are getting parsed without any warnings in Wireshark. However, if I send template record once every 10 or 20 IPFIX packets though I see a warning "Unexpected flow sequence for domain id xxxxxxx" even though the flow sequence numbers are set properly for each IPFIX packet.

See attached images for further clarification.

In the packet captures with warnings, it can be seen that packet 25 has flow sequence number 426 and it was successfully parsed. The next packet has flow sequence number 444 as 18 flows were reported in previous packet but Wireshark complains that it was expecting packet with flow sequence number 426.

In the packet captures without warnings, where template record is reported with every packet, there are no warnings generated by Wireshark while parsing.

I want to know if this is a known bug with IPFIX parsing in Wireshark.

Image 1

Image 2

Image 3

edit retag flag offensive close merge delete