IPFIX data over UDP to C# - can I decode the data?
I have a code sample from the MSDN website to create a UDP listener/client as I am trying to receive IPFIX/Netflow data from a firewall and then work with the data I receive. The code does work and starts to reveive data but its jargon (see below) so I guess I am not decoding it correctly.
Does anyone have any ideas what I need to do to be able to get the data in the correct format?
The code I am using is:
using System;
using System.Net;
using System.Net.Sockets;
using System.Text;
public class ConsoleApplication2
{
private const int listenPort = 2055;
private 开发者_StackOverflowstatic void StartListener()
{
bool done = false;
UdpClient listener = new UdpClient(listenPort);
IPEndPoint groupEP = new IPEndPoint(IPAddress.Any, listenPort);
try
{
while (!done)
{
Console.WriteLine("Waiting for broadcast");
byte[] bytes = listener.Receive(ref groupEP);
Console.WriteLine("Received broadcast from {0} :\n {1}\n",
groupEP.ToString(),
Encoding.ASCII.GetString(bytes, 0, bytes.Length));
}
}
catch (Exception e)
{
Console.WriteLine(e.ToString());
}
finally
{
listener.Close();
}
}
public static int Main()
{
StartListener();
return 0;
}
}
And the data I get back is:
?M?▼? '$▬+? ☺☺ ?M?▼???k` &??_?07????Q??E?U?j ♥ ☻
♠ P ♣ x ♣ ► ♥ → ♦ ☼?M?▼?M?▼? 1♠ ►? ? ☺
Thanks in advance,
James
You're assuming that the data being received is in ASCII format when in fact it's structured thusly: See here. The messages have a header and data sets etc. You need to evaluate the data based on the standard, not just a straight text conversion.
Here, for example is the message header format. A text conversion simply won't do anything with this:
3.1. Message Header Format
The format of the IPFIX Message Header is shown in Figure F.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Version Number | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Export Time |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Observation Domain ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
精彩评论