[Bug 1959] New: Incorrect Sequence Numbers for NetFlow v9 export.

bugzilla-daemon at bugzilla.mindrot.org
2011-12-13T19:14:22Z

Bug #: 1959
           Summary: Incorrect Sequence Numbers for NetFlow v9 export.
    Classification: Unclassified
           Product: softflowd
           Version: -current
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: major
          Priority: P2
         Component: softflowd
        AssignedTo: djm at mindrot.org
        ReportedBy: ecoff at andrew.cmu.edu


According to the NetFlow v9 RFC, the sequence number in the NetFlow v9
header is the:

"Incremental sequence counter of all Export Packets sent from the
current Observation Domain by the Exporter.  This value MUST be
cumulative, and SHOULD be used by the Collector to identify whether any
Export Packets have been missed."

This is a change from the NetFlow Version 5 and Version 8 headers,
where this number represented "total flows."

softflowd is incrementing sequence numbers the NetFlow v5 way.  It
should increment the sequence number by 1 for each packet sent.