Skip to content

output/ipfix: flowDirection value placed in wrong field #305

Open

Description

@FestplattenSchnitzel

dir: 0 # Direction bit field value (0 = incoming, 1 = outgoing)

The configuration option output_plugin.ipfix.exporter.dir matches the semantic of the IPFIX flowDirection (61) field.

#define INPUT_INTERFACE(F) F(0, 10, 4, &this->dir_bit_field)

However, the value is placed in the ingressInterface (10) field.

This leads to problems with flow collectors (e.g. Akvorado) as the value 0 is not allowed in this field, also see RFC 2863.

Activity

  1. MichalJankura commented on Oct 7, 2026

    @MichalJankura

    Hi, I'd like to work on this one if nobody else is. Looking at include/ipfixprobe/ipfix-elements.hpp, INPUT_INTERFACE is defined as F(0, 10, 4, &this->dir_bit_field), so the dir option of the IPFIX exporter ends up in ingressInterface (IE 10) instead of flowDirection (IE 61).

    My plan would be to export dir as flowDirection (IE 61, unsigned8) and stop sending ingressInterface with the direction value, together with a test for the generated template/record. Since this overlaps with #325 (meaningful ingressInterface index), @SiskaPavel would you prefer both handled in one PR, or #305 first on its own? Also, should the old behaviour be kept behind an option for backward compatibility with existing collectors?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions