pythonscapynetflow

Decode raw Netflow Data to human readable text in Python

I manage to collect some raw Netflow Data and with the usuage of scapy to decode my packets to Netflow version 9. However, I am stuck and unable to move on to convert the field values to human readable text. The code below is how I view the data with scapy:

from scapy.all import *

def handle(self, ip, data):     
    logging.info('Receiving Data from %s with %s bytes of data.' % (ip, len(data)))
    a = NetflowHeader(raw(data))
    a.show()

This is the output i get:

enter image description here

Solution

  • Update: newer Scapy versions have support for on-the-flow netflow v9 parsing (use the GitHub master version).

    # Live / on-the-flow / other: use NetflowSession
>>> sniff(session=NetflowSession, prn=[...])

    Original post:

    Netflow v9 is a poor format, because each packet needs some previous packets to be dissected. Scapy does not support this functionality on-the-go, but it instead provides a function callable on a packet list.

    You need to collect a list of the netflowV9 packets then call netflowv9_defragment(thelist)

    See https://github.com/secdev/scapy/blob/master/scapy/layers/netflow.py#L11

    This only means you can’t use prn with NetflowV9