From 696037ef087a8d7cff0394ad213e130840b09f7b Mon Sep 17 00:00:00 2001 From: Alexandre Bruyelles Date: Fri, 8 Jan 2021 11:45:11 +0100 Subject: [PATCH] netflowv9: always try to map IP to ASN Some netflow agents truncates 32b ASN to a 16b fields Always checking the received ASN against our mapping should fix that issue Signed-off-by: Alexandre Bruyelles --- bin/asstatd.pl | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/bin/asstatd.pl b/bin/asstatd.pl index 42c76a3..c172f85 100755 --- a/bin/asstatd.pl +++ b/bin/asstatd.pl @@ -380,13 +380,17 @@ sub parse_netflow_v9_data_flowset { if (defined($snmpin) && defined($snmpout)) { if (not (defined($srcas))) { $srcas=0; } if (not (defined($dstas))) { $dstas=0; } - if ($srcas == 0 && $dstas == 0 && defined($srcip) && defined($dstip)) { - $srcas = replace_asn($srcip, $srcas); - $dstas = replace_asn($dstip, $dstas); - # substitute 0 for own AS number - if ($myas{$srcas}) { $srcas = 0; } - if ($myas{$dstas}) { $dstas = 0; } - } + if defined($srcip) { + $srcas = replace_asn($srcip, $srcas); + } + + if defined($dstip) { + $dstas = replace_asn($dstip, $dstas); + } + + # substitute 0 for own AS number + if ($myas{$srcas}) { $srcas = 0; } + if ($myas{$dstas}) { $dstas = 0; } handleflow($ipaddr, $inoctets + $outoctets, $srcas, $dstas, $snmpin, $snmpout, $ipversion, 'netflow', $vlanin, $vlanout); } }