[IPFIX] NetFlow v9 to IPFIX conversion

Hello all,

I'm not sure whether this is the right place to ask, but we encountered
following problem when converting NetFlow v9 messages to IPFIX.

Some vendors (I've heard of ntop) are using elements IDs large than 32767
in NetFlow v9. When converting messages with these elements to IPFIX, they
are considered to be Enterprise Numbers. To generate proper IPFIX message,
we need to do one of the following:
a) Generate a list of the elements and map them to PEN of the correct
vendor. However, this would result in an attempt to cover all possible
elements that anybody used in NetFlow v9. Moreover, we would still have to
somehow handle the cases where the element is unknown
b) Request a PEN for NetFlow compatibility and just add this PEN for every
element that has ID larger than 32767.

Personally, I believe that the b) is more general and error-prone. Do you
think, that it would be possible to dedicate whole PEN to this cause?

Thank you for any opinions,

Petr Velan

_______________________________________________
IPFIX mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ipfix