cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1176
Views
0
Helpful
0
Replies

Invalid IPFIX FlowDirection values

eksantrik
Level 1
Level 1

As far as I know, the potential values for the flow direction field (Element ID: 61) are "0" and "1" for IPFIX. However, I am seeing something quite different on my ISR 4321. It is configured for IPFIX and for certain flows it reports direction values other than "0" and "1". Followings are a few samples:

 

{"Header":{"Version":10,"Length":1378,"ExportTime":1557346115,"SequenceNo":413552,"DomainID":6},"DataSets":[[{"I":8,"V":"3.0.6.164"},{"I":12,"V":"100.97.116.97"},{"I":5,"V":98},{"I":4,"V":97},{"I":7,"V":29541},{"I":11,"V":0},{"I":6,"V":"0x00"},{"I":16,"V":"0x0000"},{"I":9,"V":0},{"I":10,"V":0},{"I":95,"V":"0x00000000"},{"I":17,"V":"0x0000"},{"I":15,"V":"0.0.0.0"},{"I":13,"V":0},{"I":14,"V":101},{"I":61,"V":110},{"I":1,"V":8387235708328833893},{"I":2,"V":3275368591795642723},{"I":22,"V":1953066862},{"I":21,"V":1634479457}],[{"I":8,"V":"112.112.115.0"},{"I":12,"V":"0.0.115.113"},{"I":5,"V":108},{"I":4,"V":115},{"I":7,"V":30322},{"I":11,"V":11623},{"I":6,"V":"0x72"},{"I":16,"V":"0x6f75"},{"I":9,"V":112},{"I":10,"V":0},{"I":95,"V":"0x00000000"},{"I":17,"V":"0x0000"},{"I":15,"V":"0.0.0.0"},{"I":13,"V":0},{"I":14,"V":0},{"I":61,"V":0},{"I":1,"V":8390876182754714484},{"I":2,"V":7597412461103113313},{"I":22,"V":1952514048},{"I":21,"V":0}],[{"I":8,"V":"0.0.0.0"},{"I":12,"V":"0.0.0.0"},{"I":5,"V":98},{"I":4,"V":117},{"I":7,"V":29545},{"I":11,"V":28261},{"I":6,"V":"0x73"},{"I":16,"V":"0x732d"},{"I":9,"V":114},{"I":10,"V":1701602678},{"I":95,"V":"0x616e7400"},{"I":17,"V":"0x0000"},{"I":15,"V":"0.0.0.0"},{"I":13,"V":0},{"I":14,"V":0},{"I":61,"V":0},{"I":1,"V":121423020425216},{"I":2,"V":1852768256},{"I":22,"V":0},{"I":21,"V":28271}],[{"I":8,"V":"0.0.0.0"},{"I":12,"V":"0.0.0.0"},{"I":5,"V":13},{"I":4,"V":0},{"I":7,"V":426},{"I":11,"V":25455},{"I":6,"V":"0x6e"},{"I":16,"V":"0x7375"},{"I":9,"V":109},{"I":10,"V":1701981555},{"I":95,"V":"0x74726561"},{"I":17,"V":"0x6d69"},{"I":15,"V":"110.103.0.0"},{"I":13,"V":0},{"I":14,"V":0},{"I":61,"V":0},{"I":1,"V":25455},{"I":2,"V":7958834079207665014},{"I":22,"V":1768187247},{"I":21,"V":762541170}],[{"I":8,"V":"101.97.109.105"},{"I":12,"V":"110.103.0.0"},{"I":5,"V":0},{"I":4,"V":0},{"I":7,"V":0},{"I":11,"V":0},{"I":6,"V":"0x6f"},{"I":16,"V":"0x7468"},{"I":9,"V":101},{"I":10,"V":1912602624},{"I":95,"V":"0x00000000"},{"I":17,"V":"0x0000"},{"I":15,"V":"0.0.0.0"},{"I":13,"V":0},{"I":14,"V":0},{"I":61,"V":0},{"I":1,"V":0},{"I":2,"V":7887329569650074980},{"I":22,"V":1767976307},{"I":21,"V":1953654113}],[{"I":8,"V":"109.105.110.103"},{"I":12,"V":"0.0.0.0"},{"I":5,"V":0},{"I":4,"V":0},{"I":7,"V":0},{"I":11,"V":0},{"I":6,"V":"0x00"},{"I":16,"V":"0x0062"},{"I":9,"V":117},{"I":10,"V":1936289381},{"I":95,"V":"0x73732d69"},{"I":17,"V":"0x7272"},{"I":15,"V":"101.108.101.118"},{"I":13,"V":97},{"I":14,"V":1853095936},{"I":61,"V":0},{"I":1,"V":0},{"I":2,"V":121423020425216},{"I":22,"V":0},{"I":21,"V":1852768256}],[{"I":8,"V":"0.0.0.0"},{"I":12,"V":"0.0.110.111"},{"I":5,"V":0},{"I":4,"V":0},{"I":7,"V":0},{"I":11,"V":0},{"I":6,"V":"0x00"},{"I":16,"V":"0x0003"},{"I":9,"V":0},{"I":10,"V":7301486},{"I":95,"V":"0x7465722d"},{"I":17,"V":"0x7072"},{"I":15,"V":"111.99.101.115"},{"I":13,"V":115},{"I":14,"V":762474595},{"I":61,"V":0},{"I":1,"V":0},{"I":2,"V":25966},{"I":22,"V":1952805488},{"I":21,"V":1919513445}],[{"I":8,"V":"45.116.114.97"},{"I":12,"V":"110.115.97.99"},{"I":5,"V":116},{"I":4,"V":105},{"I":7,"V":28526},{"I":11,"V":24940},{"I":6,"V":"0x2d"},{"I":16,"V":"0x6170"},{"I":9,"V":112},{"I":10,"V":1929379840},{"I":95,"V":"0x6f746865"},{"I":17,"V":"0x7200"},{"I":15,"V":"0.0.0.0"},{"I":13,"V":0},{"I":14,"V":0},{"I":61,"V":0},{"I":1,"V":0},{"I":2,"V":0},{"I":22,"V":1953653102},{"I":21,"V":1935762292}],[{"I":8,"V":"105.111.110.97"},{"I":12,"V":"108.45.100.97"},{"I":5,"V":116},{"I":4,"V":97},{"I":7,"V":0},{"I":11,"V":0},{"I":6,"V":"0x00"},{"I":16,"V":"0x0000"},{"I":9,"V":0},{"I":10,"V":0},{"I":95,"V":"0x00006275"},{"I":17,"V":"0x7369"},{"I":15,"V":"110.101.115.115"},{"I":13,"V":45},{"I":14,"V":1919249509},{"I":61,"V":118},{"I":1,"V":7020676412466003968},{"I":2,"V":0},{"I":22,"V":28271},{"I":21,"V":0}],[{"I":8,"V":"0.0.0.0"},{"I":12,"V":"110.111.0.0"},{"I":5,"V":0},{"I":4,"V":0},{"I":7,"V":0},{"I":11,"V":0},{"I":6,"V":"0x6e"},{"I":16,"V":"0x6f00"},{"I":9,"V":0},{"I":10,"V":0},{"I":95,"V":"0x00000d00"},{"I":17,"V":"0x01ab"},{"I":15,"V":"99.111.110.115"},{"I":13,"V":117},{"I":14,"V":1835364909},{"I":61,"V":115},{"I":1,"V":8390880524866514535},{"I":2,"V":0},{"I":22,"V":0},{"I":21,"V":25455}],[{"I":8,"V":"110.115.117.109"},{"I":12,"V":"101.114.45.118"},{"I":5,"V":105},{"I":4,"V":100},{"I":7,"V":25967},{"I":11,"V":11635},{"I":6,"V":"0x74"},{"I":16,"V":"0x7265"},{"I":9,"V":97},{"I":10,"V":1835626087},{"I":95,"V":"0x00000000"},{"I":17,"V":"0x0000"},{"I":15,"V":"0.0.111.116"},{"I":13,"V":104},{"I":14,"V":1701969920},{"I":61,"V":0},{"I":1,"V":0},{"I":2,"V":0},{"I":22,"V":0},{"I":21,"V":0}],[{"I":8,"V":"109.117.108.116"},{"I":12,"V":"105.109.101.100"},{"I":5,"V":105},{"I":4,"V":97},{"I":7,"V":11635},{"I":11,"V":29810},{"I":6,"V":"0x65"},{"I":16,"V":"0x616d"},{"I":9,"V":105},{"I":10,"V":1852243968},{"I":95,"V":"0x00000000"},{"I":17,"V":"0x0000"},{"I":15,"V":"0.0.0.0"},{"I":13,"V":98},{"I":14,"V":1970497902},{"I":61,"V":101},{"I":1,"V":8319042867598353772},{"I":2,"V":7311138172103032832},{"I":22,"V":0},{"I":21,"V":0}],[{"I":8,"V":"0.0.110.111"},{"I":12,"V":"0.0.0.0"},{"I":5,"V":0},{"I":4,"V":0},{"I":7,"V":0},{"I":11,"V":28271},{"I":6,"V":"0x00"},{"I":16,"V":"0x0000"},{"I":9,"V":0},{"I":10,"V":0},{"I":95,"V":"0x6e6f0000"},{"I":17,"V":"0x0000"},{"I":15,"V":"0.0.0.0"},{"I":13,"V":13},{"I":14,"V":14434},{"I":61,"V":117},{"I":1,"V":8316299568924011873},{"I":2,"V":7954532802822628469},{"I":22,"V":1668573558},{"I":21,"V":1769240877}],[{"I":8,"V":"116.111.111.108"},{"I":12,"V":"115.0.100.101"},{"I":5,"V":115},{"I":4,"V":107},{"I":7,"V":29807},{"I":11,"V":28717},{"I":6,"V":"0x76"},{"I":16,"V":"0x6972"},{"I":9,"V":116},{"I":10,"V":1969319017},{"I":95,"V":"0x7a617469"},{"I":17,"V":"0x6f6e"},{"I":15,"V":"0.0.0.0"},{"I":13,"V":0},{"I":14,"V":0},{"I":61,"V":0},{"I":1,"V":8031158820422025216},{"I":2,"V":0},{"I":22,"V":0},{"I":21,"V":0}],[{"I":8,"V":"0.0.0.0"},{"I":12,"V":"0.0.0.0"},{"I":5,"V":109},{"I":4,"V":117},{"I":7,"V":27764},{"I":11,"V":26989},{"I":6,"V":"0x65"},{"I":16,"V":"0x6469"},{"I":9,"V":97},{"I":10,"V":761491310},{"I":95,"V":"0x66657265"},{"I":17,"V":"0x6e63"},{"I":15,"V":"105.110.103.0"},{"I":13,"V":0},{"I":14,"V":0},{"I":61,"V":0},{"I":1,"V":108256586985061},{"I":2,"V":8319042906034562422},{"I":22,"V":1634628608},{"I":21,"V":0}],[{"I":8,"V":"0.0.0.0"},{"I":12,"V":"0.0.0.0"},{"I":5,"V":0},{"I":4,"V":0},{"I":7,"V":28271},{"I":11,"V":0},{"I":6,"V":"0x00"},{"I":16,"V":"0x0000"},{"I":9,"V":0},{"I":10,"V":28271},{"I":95,"V":"0x00000000"},{"I":17,"V":"0x0000"},{"I":15,"V":"0.0.121.101"},{"I":13,"V":115},{"I":14,"V":0},{"I":61,"V":0},{"I":1,"V":14293654987631},{"I":2,"V":7958834079207664998},{"I":22,"V":1768711469},{"I":21,"V":1936220530}],[{"I":8,"V":"105.110.103.0"},{"I":12,"V":"0.0.0.0"},{"I":5,"V":0},{"I":4,"V":0},{"I":7,"V":0},{"I":11,"V":0},{"I":6,"V":"0x70"},{"I":16,"V":"0x3270"},{"I":9,"V":45},{"I":10,"V":1718185061},{"I":95,"V":"0x2d747261"},{"I":17,"V":"0x6e73"},{"I":15,"V":"102.101.114.0"},{"I":13,"V":0},{"I":14,"V":0},{"I":61,"V":0},{"I":1,"V":0},{"I":2,"V":7453023576123010145},{"I":22,"V":761754223},{"I":21,"V":1970274304}],[{"I":8,"V":"0.0.0.0"},{"I":12,"V":"0.0.0.0"},{"I":5,"V":0},{"I":4,"V":0},{"I":7,"V":0},{"I":11,"V":0},{"I":6,"V":"0x00"},{"I":16,"V":"0x0062"},{"I":9,"V":117},{"I":10,"V":1818963300},{"I":95,"V":"0x61746100"},{"I":17,"V":"0x0000"},{"I":15,"V":"0.0.0.0"},{"I":13,"V":0},{"I":14,"V":0},{"I":61,"V":0},{"I":1,"V":0},{"I":2,"V":108256586985061},{"I":22,"V":1936928105},{"I":21,"V":1920099692}],[{"I":8,"V":"101.118.97.110"},{"I":12,"V":"116.0.0.0"},{"I":5,"V":0},{"I":4,"V":0},{"I":7,"V":0},{"I":11,"V":0},{"I":6,"V":"0x00"},{"I":16,"V":"0x0000"},{"I":9,"V":0},{"I":10,"V":2036691712},{"I":95,"V":"0x00000000"},{"I":17,"V":"0x0000"},{"I":15,"V":"110.111.0.0"},{"I":13,"V":0},{"I":14,"V":0},{"I":61,"V":0},{"I":1,"V":7957579066586955776},{"I":2,"V":3298571220591},{"I":22,"V":1768121645},{"I":21,"V":1634624557}],[{"I":8,"V":"118.105.100.101"},{"I":12,"V":"111.0.0.0"},{"I":5,"V":0},{"I":4,"V":0},{"I":7,"V":0},{"I":11,"V":0},{"I":6,"V":"0x00"},{"I":16,"V":"0x0000"},{"I":9,"V":0},{"I":10,"V":0},{"I":95,"V":"0x636f6e74"},{"I":17,"V":"0x726f"},{"I":15,"V":"108.45.97.110"},{"I":13,"V":100},{"I":14,"V":762538343},{"I":61,"V":110},{"I":1,"V":7020101842059132928},{"I":2,"V":0},{"I":22,"V":1869899877},{"I":21,"V":1912602624}],[{"I":8,"V":"0.0.0.0"},{"I":12,"V":"0.0.0.0"},{"I":5,"V":0},{"I":4,"V":0},{"I":7,"V":0},{"I":11,"V":0},{"I":6,"V":"0x00"},{"I":16,"V":"0x0000"},{"I":9,"V":0},{"I":10,"V":0},{"I":95,"V":"0x00007369"},{"I":17,"V":"0x676e"},{"I":15,"V":"97.108.105.110"},{"I":13,"V":103},{"I":14,"V":0},{"I":61,"V":0},{"I":1,"V":0},{"I":2,"V":0},{"I":22,"V":25205},{"I":21,"V":1936289381}]]}

 

 

Line 303: {"AgentID":"180.189.147.26","Header":{"Version":10,"Length":1378,"ExportTime":1557346115,"SequenceNo":413510,"DomainID":6},"DataSets":[[{"I":8,"V":"1.0.0.88"},{"I":12,"V":"110.101.116.45"},{"I":5,"V":97},{"I":4,"V":100},{"I":7,"V":28009},{"I":11,"V":28160},{"I":6,"V":"0x00"},{"I":16,"V":"0x0000"},{"I":9,"V":0},{"I":10,"V":0},{"I":95,"V":"0x00000000"},{"I":17,"V":"0x0000"},{"I":15,"V":"0.0.0.0"},{"I":13,"V":0},{"I":14,"V":114},{"I":61,"V":111},{"I":1,"V":8463505522634354802},{"I":2,"V":8031166508370231296},{"I":22,"V":0},{"I":21,"V":0}],[{"I":8,"V":"0.0.0.0"},{"I":12,"V":"0.0.111.116"},{"I":5,"V":104},{"I":4,"V":101},{"I":7,"V":29184},{"I":11,"V":0},{"I":6,"V":"0x00"},{"I":16,"V":"0x0000"},{"I":9,"V":0},{"I":10,"V":0},{"I":95,"V":"0x00000000"},{"I":17,"V":"0x0000"},{"I":15,"V":"0.0.0.0"},{"I":13,"V":0},{"I":14,"V":0},{"I":61,"V":0},{"I":1,"V":7954892373139548973},{"I":2,"V":7165066978584914944},{"I":22,"V":0},{"I":21,"V":0}],[{"I":8,"V":"0.0.0.0"},{"I":12,"V":"0.0.0.0"},{"I":5,"V":98},{"I":4,"...

 

This usually happens when the source and destination IPs are some sort of a public IP.

 

Has anyone else run into this?

 

Thanks

0 Replies 0
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: