diff --git a/netflow/v9.py b/netflow/v9.py index 25bc59c..6a9618f 100644 --- a/netflow/v9.py +++ b/netflow/v9.py @@ -194,6 +194,8 @@ class V9DataFlowSet: raise V9TemplateNotRecognized template = templates[self.template_id] + if len(template.fields) == 0: + return #ignore options templates at the moment # As the field lengths are variable V9 has padding to next 32 Bit padding_size = 4 - (self.length % 4) # 4 Byte @@ -262,6 +264,12 @@ class V9TemplateRecord: self.template_id, self.field_count, ' '.join([V9_FIELD_TYPES[field.field_type] for field in self.fields])) +class V9OptionsTemplateFlowSet: + def __init__(self, data): + pack = struct.unpack('!HHH', data[:6]) + self.flowset_id = pack[0] + self.length = pack[1] + self.template_id = pack[2] class V9TemplateFlowSet: """A template flowset, which holds an id that is used by data flowsets to @@ -353,6 +361,14 @@ class V9ExportPacket: # Update the templates with the provided templates, even if they are the same self._templates.update(tfs.templates) offset += tfs.length + elif flowset_id == 1: + otfs = V9OptionsTemplateFlowSet(data[offset:]) + if not self._new_templates: + if otfs.template_id not in self._templates: + self._new_templates = True + + self._templates.update({otfs.template_id: V9TemplateRecord(otfs.template_id, 0, {})}) + offset += otfs.length else: try: dfs = V9DataFlowSet(data[offset:], self._templates)