logstash-plugins/logstash-codec-netflow

Avaya support

rdrgporto opened this issue · 6 comments

rdrgporto commented

Hi everyone,

I've been working with this codec with Cisco devices. Morever, I would like to work with Avaya devices, however, I have taken a look at Elastic documentacion and I have seen that any Avaya devices are supported.

Is there any possibility to add support for Avaya devices ?

Thanks in advance,

Regards 🖖

jorritfolmer commented

Do you currently have Avaya devices sending netflow/ipfix that isn't properly decoded?
If so, you can provide a pcap with Avaya netflow/ipfix traffic so we can fix that?

rdrgporto commented

Hi @jorritfolmer,

I have configured an Avaya VSP-9012 in order to send data by IPFIX. Regarding to Logstash, I did a simple conf:

  input {

    udp { port => 9995}

  }

  output {

    elasticsearch {
        hosts => ["localhost:9200"]
        index => "ipfix-%{+yyyy.ww}"
  }

I have attached an example of pcap (I did it by tcdump).

Thanks in advance,

Regards

robcowart commented

@rdrgporto can you provide the actual PCAP file, instead of a text representation of it?

  • 👍1
rdrgporto commented

Hi @robcowart,

Here you are:

Thanks in advance,

Regards

jorritfolmer commented

Hi @rdrgporto I checked your pcap but there aren't any flow packets in it, only templates. The templates decode fine btw.

  • Can you perhaps generate some traffic in your lab setup so the Avaya also exports flows?
  • Can you specify what Avaya device you have?
rdrgporto commented

Hi,

With Filebeat Input Netflow works 😃

Regards