Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix V9DataFlowSet to avoid following struct.unpack error: #49

Open
wants to merge 1 commit into
base: release
Choose a base branch
from
Open

Fix V9DataFlowSet to avoid following struct.unpack error: #49

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions netflow/v9.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,7 +205,7 @@ def __init__(self, data, template):
offset = 4

# As the field lengths are variable V9 has padding to next 32 Bit
padding_size = 4 - (self.length % 4) # 4 Byte
padding_size = 4 - (self.length % 4) if self.length % 4 else 0 # 4 Byte

# For performance reasons, we use struct.unpack to get individual values. Here
# we prepare the format string for parsing it. The format string is based on the template fields and their
Expand All @@ -225,10 +225,16 @@ def __init__(self, data, template):
struct_format += '%ds' % flen
struct_len += flen

while offset <= (self.length - padding_size):
while offset + struct_len <= (self.length - padding_size):
# Here we actually unpack the values, the struct format string is used in every data record
# iteration, until the final offset reaches the end of the whole data stream
unpacked_values = struct.unpack(struct_format, data[offset:offset + struct_len])
try:
unpacked_values = struct.unpack(struct_format, data[offset:offset + struct_len])
except:
print("struct.unpack is failed. (offset: {}, struct_len: {}, length: {}, padding_size: {})"
.format(offset, struct_len, self.length, padding_size))
offset += struct_len
continue

new_record = V9DataRecord()
for field, value in zip(template.fields, unpacked_values):
Expand Down