Netflow V10 (IPFix) Options Template FlowSet
| 1665 | |
| 1666 | # https://tools.ietf.org/html/rfc5101#section-3.4.2.2 |
| 1667 | class NetflowOptionsFlowset10(NetflowOptionsFlowsetV9): |
| 1668 | """Netflow V10 (IPFix) Options Template FlowSet""" |
| 1669 | name = "Netflow V10 (IPFix) Options Template FlowSet" |
| 1670 | fields_desc = [ShortField("flowSetID", 3), |
| 1671 | ShortField("length", None), |
| 1672 | ShortField("templateID", 255), |
| 1673 | # Slightly different counting than in its NetflowV9 |
| 1674 | # counterpart: we count the total, and among them which |
| 1675 | # ones are scopes. Also, it's count, not length |
| 1676 | FieldLenField("field_count", None, |
| 1677 | count_of="options", |
| 1678 | adjust=lambda pkt, x: ( |
| 1679 | x + pkt.get_field( |
| 1680 | "scope_field_count").i2m(pkt, None))), |
| 1681 | FieldLenField("scope_field_count", None, |
| 1682 | count_of="scopes"), |
| 1683 | # We can't use PadField as we have 2 PacketListField |
| 1684 | PacketListField( |
| 1685 | "scopes", [], |
| 1686 | NetflowOptionsFlowsetScopeV9, |
| 1687 | count_from=lambda pkt: pkt.scope_field_count), |
| 1688 | PacketListField( |
| 1689 | "options", [], |
| 1690 | NetflowOptionsFlowsetOptionV9, |
| 1691 | count_from=lambda pkt: ( |
| 1692 | pkt.field_count - pkt.scope_field_count |
| 1693 | )), |
| 1694 | StrLenField("pad", None, length_from=lambda pkt: ( |
| 1695 | pkt.length - (pkt.scope_field_count * 4) - 10))] |
| 1696 | |
| 1697 | def post_build(self, pkt, pay): |
| 1698 | if self.length is None: |
| 1699 | pkt = pkt[:2] + struct.pack("!H", len(pkt)) + pkt[4:] |
| 1700 | if self.pad is None: |
| 1701 | # Padding 4-bytes with b"\x00" |
| 1702 | start = 10 + self.scope_field_count * 4 |
| 1703 | pkt = pkt[:start] + (-len(pkt) % 4) * b"\x00" |
| 1704 | return pkt + pay |
| 1705 | |
| 1706 | |
| 1707 | bind_layers(NetflowHeader, NetflowHeaderV9, version=9) |
nothing calls this directly
no test coverage detected
searching dependent graphs…