scapy.layers.netflow

Cisco NetFlow protocol v1, v5, v9 and v10 (IPFix)

HowTo dissect NetflowV9/10 (IPFix) packets:

# From a pcap / list of packets

Using sniff and sessions: >>> sniff(offline=open(“my_great_pcap.pcap”, “rb”), session=NetflowSession)

Using the netflowv9_defragment/ipfix_defragment commands: - get a list of packets containing NetflowV9/10 packets - call netflowv9_defragment(plist) to defragment the list

(ipfix_defragment is an alias for netflowv9_defragment)

# Live / on-the-flow / other: use NetflowSession >>> sniff(session=NetflowSession, prn=[…])

class scapy.layers.netflow.N9SecondsIntField(name, default, *args, **kargs)

Bases: scapy.fields.SecondsIntField, scapy.layers.netflow._AdjustableNetflowField

Defines dateTimeSeconds (without EPOCH: just seconds)

class scapy.layers.netflow.N9UTCTimeField(name, default, *args, **kargs)

Bases: scapy.fields.UTCTimeField, scapy.layers.netflow._AdjustableNetflowField

Defines dateTimeSeconds (EPOCH)

class scapy.layers.netflow.NetflowDataflowsetV9

Bases: scapy.packet.Packet

aliastypes
classmethod dispatch_hook(_pkt=None, *args, **kargs)
fields_desc
NetflowDataflowsetV9 fields

templateID

ShortField

255

length

FieldLenField

None

records

PadField

[]

payload_guess

Possible sublayers: NetflowDataflowsetV9

class scapy.layers.netflow.NetflowFlowsetV9

Bases: scapy.packet.Packet

aliastypes
fields_desc
NetflowFlowsetV9 fields

flowSetID

ShortField

0

length

FieldLenField

None

templates

PacketListField

[]

payload_guess

Possible sublayers: NetflowDataflowsetV9

class scapy.layers.netflow.NetflowHeader

Bases: scapy.packet.Packet

aliastypes
fields_desc
NetflowHeader fields

version

ShortField

1

payload_guess

Possible sublayers: NetflowHeaderV10, NetflowHeaderV1, NetflowHeaderV5, NetflowHeaderV9

class scapy.layers.netflow.NetflowHeaderV1

Bases: scapy.packet.Packet

aliastypes
fields_desc
NetflowHeaderV1 fields

count

ShortField

0

sysUptime

IntField

0

unixSecs

UTCTimeField

0

unixNanoSeconds

UTCTimeField

0

payload_guess

Possible sublayers: NetflowRecordV1

class scapy.layers.netflow.NetflowHeaderV10

Bases: scapy.packet.Packet

IPFix (Netflow V10) Header

aliastypes
fields_desc
NetflowHeaderV10 fields

length

ShortField

None

ExportTime

UTCTimeField

0

flowSequence

IntField

0

ObservationDomainID

IntField

0

payload_guess

Possible sublayers: NetflowDataflowsetV9

class scapy.layers.netflow.NetflowHeaderV5

Bases: scapy.packet.Packet

aliastypes
fields_desc
NetflowHeaderV5 fields

count

ShortField

0

sysUptime

IntField

0

unixSecs

UTCTimeField

0

unixNanoSeconds

UTCTimeField

0

flowSequence

IntField

0

engineType

ByteField

0

engineID

ByteField

0

samplingInterval

ShortField

0

payload_guess

Possible sublayers: NetflowRecordV5

class scapy.layers.netflow.NetflowHeaderV9

Bases: scapy.packet.Packet

aliastypes
fields_desc
NetflowHeaderV9 fields

count

ShortField

None

sysUptime

IntField

0

unixSecs

UTCTimeField

None

packageSequence

IntField

0

SourceID

IntField

0

payload_guess

Possible sublayers: NetflowDataflowsetV9

post_build(pkt, pay)
class scapy.layers.netflow.NetflowOptionsFlowset10

Bases: scapy.layers.netflow.NetflowOptionsFlowsetV9

Netflow V10 (IPFix) Options Template FlowSet

aliastypes
extract_padding(s)
fields_desc
NetflowOptionsFlowset10 fields

flowSetID

ShortField

3

length

ShortField

None

templateID

ShortField

255

field_count

FieldLenField

None

scope_field_count

FieldLenField

None

scopes

PacketListField

[]

options

PacketListField

[]

class scapy.layers.netflow.NetflowOptionsFlowsetOptionV9

Bases: scapy.packet.Packet

aliastypes
default_payload_class(p)
fields_desc
NetflowOptionsFlowsetOptionV9 fields

enterpriseBit

BitField (1 bit)

0

optionFieldType

BitEnumField (15 bits)

None

optionFieldlength

ShortField

0

enterpriseNumber

ShortField (Cond)

0

class scapy.layers.netflow.NetflowOptionsFlowsetScopeV9

Bases: scapy.packet.Packet

aliastypes
default_payload_class(p)
fields_desc
NetflowOptionsFlowsetScopeV9 fields

scopeFieldType

ShortEnumField

None

scopeFieldlength

ShortField

0

class scapy.layers.netflow.NetflowOptionsFlowsetV9

Bases: scapy.packet.Packet

aliastypes
default_payload_class(p)
extract_padding(s)
fields_desc
NetflowOptionsFlowsetV9 fields

flowSetID

ShortField

1

length

ShortField

None

templateID

ShortField

255

option_scope_length

FieldLenField

None

option_field_length

FieldLenField

None

scopes

PacketListField

[]

options

PacketListField

[]

payload_guess

Possible sublayers: NetflowDataflowsetV9

post_build(pkt, pay)
class scapy.layers.netflow.NetflowOptionsRecordOptionV9

Bases: scapy.layers.netflow.NetflowRecordV9

aliastypes
fields_desc
NetflowOptionsRecordOptionV9 fields

fieldValue

StrField

b''

class scapy.layers.netflow.NetflowOptionsRecordScopeV9

Bases: scapy.layers.netflow.NetflowRecordV9

aliastypes
fields_desc
NetflowOptionsRecordScopeV9 fields

fieldValue

StrField

b''

class scapy.layers.netflow.NetflowRecordV1

Bases: scapy.packet.Packet

aliastypes
fields_desc
NetflowRecordV1 fields

ipsrc

IPField

'0.0.0.0'

ipdst

IPField

'0.0.0.0'

nexthop

IPField

'0.0.0.0'

inputIfIndex

ShortField

0

outpuIfIndex

ShortField

0

dpkts

IntField

0

dbytes

IntField

0

starttime

IntField

0

endtime

IntField

0

srcport

ShortField

0

dstport

ShortField

0

padding

ShortField

0

proto

ByteField

0

tos

ByteField

0

padding1

IntField

0

padding2

IntField

0

payload_guess

Possible sublayers: NetflowRecordV1

class scapy.layers.netflow.NetflowRecordV5

Bases: scapy.packet.Packet

aliastypes
fields_desc
NetflowRecordV5 fields

src

IPField

'127.0.0.1'

dst

IPField

'127.0.0.1'

nexthop

IPField

'0.0.0.0'

input

ShortField

0

output

ShortField

0

dpkts

IntField

1

dOctets

IntField

60

first

IntField

0

last

IntField

0

srcport

ShortField

0

dstport

ShortField

0

pad1

ByteField

0

tcpFlags

FlagsField (8 bits)

<Flag 2 (S)>

prot

ByteEnumField

6

tos

ByteField

0

src_as

ShortField

0

dst_as

ShortField

0

src_mask

ByteField

0

dst_mask

ByteField

0

pad2

ShortField

0

payload_guess

Possible sublayers: NetflowRecordV5

class scapy.layers.netflow.NetflowRecordV9

Bases: scapy.packet.Packet

aliastypes
default_payload_class(p)
fields_desc
NetflowRecordV9 fields

fieldValue

StrField

b''

class scapy.layers.netflow.NetflowSession(*args)

Bases: scapy.sessions.IPSession

Session used to defragment NetflowV9/10 packets on the flow. See help(scapy.layers.netflow) for more infos.

on_packet_received(pkt)
class scapy.layers.netflow.NetflowTemplateFieldV9(*args, **kwargs)

Bases: scapy.packet.Packet

aliastypes
default_payload_class(p)
fields_desc
NetflowTemplateFieldV9 fields

enterpriseBit

BitField (1 bit)

0

fieldType

BitEnumField (15 bits)

None

fieldLength

ShortField

0

enterpriseNumber

IntField (Cond)

0

class scapy.layers.netflow.NetflowTemplateV9

Bases: scapy.packet.Packet

aliastypes
default_payload_class(p)
fields_desc
NetflowTemplateV9 fields

templateID

ShortField

255

fieldCount

FieldLenField

None

template_fields

PacketListField

[]

class scapy.layers.netflow.ShortOrInt(name, default)

Bases: scapy.fields.IntField

getfield(pkt, x)
scapy.layers.netflow.ipfix_defragment(*args, **kwargs)

Alias for netflowv9_defragment

scapy.layers.netflow.netflowv9_defragment(plist, verb=1)

Process all NetflowV9/10 Packets to match IDs of the DataFlowsets with the Headers

params:
  • plist: the list of mixed NetflowV9/10 packets.

  • verb: verbose print (0/1)