Add next hop field to traffic database | Feature requests

Add next hop field to traffic database

FastNetMon

This field is useful in multiple scenarios and we have logic to parse it in place. The idea to export this field into Clickhouse database.

December 21, 2022

FastNetMon

We clearly must store these fields separately as they have different meaning and we had one dump where these fields were set to different values.

It happened for dropped / filtered traffic.

FastNetMon

So far we have no examples to review Cisco ASR 9000 behaviour in IPFIX way and Juniper / Nokia dumps are missing for Netflow v9 mode.

After getting all these dumps we will try to find way to integrate processing of these fields.

FastNetMon

Cisco ASR 9000 uses single field 18 for Netflow v9 encoding:

FastNetMon

Nokia SR is doing it exactly same way actually with exactly same fields for IPFIX:

FastNetMon

This question is way more complicated then expected. 
Juniper for example uses two next hop fields in IPFIX encoding.
Should we add both or merge them into single if they match? Same issue with other vendors as we do now know how they encode it.