Recent releases for nfdump

nfdump v1.6.13

2015-10-03T12:21:30+00:00

Initial release for GitHub

nfdump v1.6.14

2016-01-10T15:33:09+00:00

nfdump 1.6.14 released. The most important changes: - Create libnfdump for dynamic linking - Add -R to ModifyCompression - Add std sampler ID 4 Bytes and allow random sampler (tag 50) - Add BZ2 compression along existing LZ0 - Add direct write to flowtools converter ft2nfdump - Fix CentOS compile issues with flow-tools converter - Fix FreeBSD,OpenBSD build problems - Fix timestamp overflow in sflow.c - Fix IP Fragmentation in sflow collector - Fix compile errors on other platforms - Fix zero alignment bug, if only half of an extension is sent - Fix nfanon time window bug in subsequent files in -R list - Fix CommonRecordV0Type conversion bug - Fix nfexport bug, if only one single map exists

nfdump v1.6.15

2016-06-05T10:03:36+00:00

nfdump 1.6.15 released. - Fix Security issue http://www.security-assessment.com/files/documents/advisory/Nfdump%20nfcapd%201.6.14%20-%20Multiple%20Vulnerabilities.pdf - Fix obyte, opps and obps output records - Fix wrong bps type case in cvs output. Fix opbs ipbs typos

nfdump v1.6.16

2017-11-05T15:07:31+00:00

nfdump 1.6.16 released. - Add support for CISCO IOS 8 bytes timestamps ID 21/22 - Fix issue #72 - multiple stat output - Change -B behaviour as proposed in issue #59. Should not impact with previous use, but is more flexible - Add bzip compress switch in usage output of nfpcapd - Fix compile issues on some platforms - nfpcapd improvements - still beta software. - Minor bug fixes

nfdump v1.6.17

2018-04-22T13:44:04+00:00

- Add program exit in nfx.c after panic with correupt data file - Add missing size check when reading nfdump 1.5.x common record blocks - Add missing option -M in man page. Issue #103 - Add Fix processing of influx URL in nfprofile - Add missing json output format in nfdump help text - Add missing -v option in nfreplay help text - Add new output format json. Print each record as individual json object - Add sampling elements ID 302,304,305. put them identical to ID 48,49,50 - Add option to label filter terms. syntax: () %labelname. - Add %lbl option to print flow label in output - Add ipfix delta timestamp elements 158/159. - Add more detailed autogen.sh - softlink bootstrap - Add x-late src/dst ip aggregation, if compiled with NSEL support - Add ipfix sampling. Process option template/record with sampling elements 34 and 35 - Update nfdump.1 man page for xsrcport & xdstport aggregations. Request #109 - Update nfdump(1) man page for flowlabels - Update sflow code to commit 7322984 of https://github.com/sflow/sflowtool - Merge pull request #51 Influxdb from Luca. Thx for the patch - Fix bug in sorting when guessing flow direction. Issue #92 - Fix minor bugs - Fix definition for InfluxDB in configure.ac Issue #98 - Fix IPFIX time stamps - Fix elements #21,#22 offset calculation, but timestamps not yet evaluated. (#160) - Fix IPFIX add fwd status tag #89 compatible to v9 (1byte) - Fix IPFIX sampling - sampling algorithm no longer required for tag #34 - Fix IPFIX sampling add tags #305 and #304 - set them identical to #34, #35 - Fix header includes" - Fix 64bit fts compat issue in fts_compat.c - Fix potential memory leaks in nfpcapd - Fix wrong offset calculation if unknown options are found - Fix updates on existing samplers in v9 only if values change. issue 84 - Cleanup sflow code - uncomment unnecessary code

nfdump v.1.6.18

2019-08-05T17:06:40+00:00

nfdump release 1.6.18. This release mainly Improves stability. It adds nfpcapd to generate nfdump netflow records directly from interfaces/pcaps. The old COMPAT15 mode has been removed. All old 1.5.x files should have been converted so far. For a complete list of changes see the ChangeLog file.

nfdump v1.6.18

2019-08-06T15:54:35+00:00

nfdump v1.6.19

2020-02-22T07:48:22+00:00

nfdump release 1.6.19. nfdump-1.6.19 is mainly a bug fix release and improves stability. Lot's of historical code cleanup - spring cleaning. Prepare nfdump for version 1.7 For a complete list of changes see the ChangeLog file.

nfdump v1.6.20

2020-03-29T10:06:26+00:00

Important fix for -N plain number printing. v1.6.19 may disturb many output parses relaying on -N working correctly. No other changes.

nfdump v1.6.21

2020-08-02T09:58:56+00:00

Includes various bug fixes and code clean up: - Address issue #159. Implement rfc 7011 and include sender UDP port into unique template identification - Address issue #236 Add token 'dir' equivalent to 'flowdir' in filter syntax - Add optional print direction ascending or descending to output of statistics -s and oredered printing -O. Request #235 - Fix issue #234 - Fix #230 - Avoid use_syslog name clash on certain OS - Honor -n flag when printing sorted flow cache - Fix uninitialized variable printPlain - Fix bug #223 limit matchig flows -c - Restore old behaviour unlimiting output flows unless in -s stat - Fix ft2nfdump nexthop fields - Fix ft2nfdump extension map size - internal: put output parameters in a single struct - Fix GuessDir bug - issue #215 - Compact Changelog - Fix GuessDir bug - issue #215 in flow exporter

nfdump v1.6.22

2020-11-21T12:03:27+00:00

- Fix nfreplay v5 time shift bug - add support for >=, <= comparators. #256. Thanks to piorek94 - Fix yacc/bison warnings. Cleanup unused tokens - Fix syntax error 'flags AS' as AS is a reserved word. #255 - Add element 139 for ICMP type/code in IPv6. #250 - Fix IPv4/IPv6 statistics representation #252 - Cleanup nip/xip filter syntax. Add filter syntax 'nip in [ ]'. Request #246 - Add nfversion to nfpcapd - Add collected netflow/sflow version in nfdump record. Request #242 - Fix GuessDir bug - issue #215 - Re-address issue #231 - remove strict rule rfc 7011 - fix coredump of nfcapd - null exporter record.

nfdump v1.6.23

2021-05-06T15:56:14+00:00

- Fix potential FreeNode without valid Node in nfpcapd. - Add all non TCP/UDP IP protocols as streams in nfpcapd - Add mpls unwrap in nfpcapd. Skip MPLS labels - Add ESP to processed protocols in nfpcapd. - Some Code cleanup - Change spin lock to native C11 lock - Cleanup code for issue #283 - Fix minor nfpcapd issues - Add mpls unwrap in sflow code - adds mpls labels if available - Update rbtree. - Fix potential deadlock in nfpcapd if it terminates. - Add packet capture buffer size to nfpcapd - Fix sflow code extended field parsing. #262 and #273 - Fix endless loop of nfexpire, if it does not find files - Fix processing deoding error for yaf exporter - Zero out tcp flags for non TCP records - Add reverse element enterprise ID 29305 for counter values - Add biFlow direction element 239 - Add flow end reason element 136 - Make -Tall the default for nfcapd to collect extensions - Code cleanup and boundary checks in option template processing - Implement element 160 (SystemInitTime) in option template - Add Element 160 (SystemInitTime) in flow record used by Huawei - Fix path handling for -l - Fix print plain numbers #263

nfdump v1.6.24

2022-03-26T12:14:56+00:00

Release 1.6.24 fixes various bugs: - Release 1.6.24 - Update m4 files - Update Makefile.am with ACLOCAL_AMFLAGS: #336 - Update Doxigen.in file: #332 - Fix cmd line processinf in nfanon. #328 - Make configure.ac autoconf 2.69 compatible - Cleanup automake files. Fixes #304. - Fix link handling in nfpcapd - Fix compile flags #304 - Fix nfdump man page #301 - Fix minor bugs - Add NAT event record support for IPFIX. #298 - Fix issue #296 - broken json format with option -q - Fix json msec formating - Silence short packet logs due to small snaplen in pcaproc.c #221

nfdump v.1.7.0

2022-09-28T13:10:36+00:00

### NFDUMP switches to new release 1.7.0 A lot of old code has beed remove, and was rewritten. nfdump-1.7.0 replaces nfdump-1.6.x. A lot of code has been improved and new features have been added. The nfpcapd collector has been reworked completely. It allows to merge pcap and flow data. - nfdump is now a multi-threaded program and uses parallel threads mainly for reading, writing and processing flows as well as for sorting. This may result in a 2 to 3 times faster flow processing, depending on the tasks. The speed improvement also heavily depends on the hardware (SSD/HD) and flow compression option. - For netflow v9 and IPFIX, nfdump now supports flexible length fields. This improves compatibility with some exporters such as yaf and others. The netflow v9 decoder is more flexible in decoding. - Support for Cisco Network Based Application Recognition (NBAR). - Supports Maxmind geo location information to tag/geolocate IP addresses and AS numbers. - nfpcapd automatically uses TPACKET_V3 for Linux or direct BPF sockets for *BSD. This improves packet processing. It adds new options to collect MAC and VLAN information as well as the first packet of the payload. - Metric exports: By default, every 60s a flow summary statistics can be sent to a UNIX socket. The corresponding program may be [nfinflux](https://github.com/phaag/nfinflux) to insert these metrics into an influxDB or [nfexporter](https://github.com/phaag/nfexporter) for Prometheus monitoring.

nfdump v1.7.0.1

2022-09-30T11:37:54+00:00

### nfdump-1.7.0.1 Fix build issues in nfdump-1.7.0 **Full Changelog**: https://github.com/phaag/nfdump/compare/v.1.7.0...v1.7.0.1

nfdump v1.6.25

2022-10-22T07:58:28+00:00

### nfdump-1.6.25 This release is the last release for the nfdump-1.6.x tree and created for users of the nfdump-1.6.x branch. For new setups and new features, it's recommended to use nfdump-1.7.x and the v.1.7.x releases.

nfdump v1.7.1

2022-12-24T12:31:59+00:00

This release fixes mostly bugs from 1.7.0 and is now the recommended version for production. It works together with well advanced in years NfSen 1.3.9 https://github.com/phaag/nfsen. ### Changelog: - Fix #394. Event labeling - Implement #393 consistent logging - Remove extra ':' in getopt of nfcapd - Add feature #391. Add country code aggregation - Fix #392. Fix format options with IPv6 - Implement #390. Aggregation for GeoDB's enriched AS data - Add OpenBSD pflog decoding in nfpcapd and nfdump - Fix Ident change - Sync nfcapd, sfcapd code - Fix #389 receiving IPv4 on IPv6 socket in sfcapd - Fix #385 bug when compiled on i386 arch - 32bit alignment - Fix #384 bug when compile with --enable-nsel - Implement #366 Linux NFLOG link layer protocol in nfpcapd - Fix #381 pcap overwrite in nfpcapd fixed - Fix #380 nbar string validation - Implement #377. Rework sampling code in general. Switch to packet interval/space notation. Map older sampling to new notation. - Fix #375 relative timestamps with sysUptime id 160 - Rework nbar code. Use new array records and fix nbar bug in older versions. - Fix #370. Help shows correct option -A - Fix #369. Legacy -M for NfSen works again - Improve nbar handling. Add private enterprise number decoding - Merge pull request #357

nfdump v1.7.2

2023-04-23T12:46:55+00:00

Nfdump-1.7.2 removes old code, and got some new features. It fixes a few bugs and improves stability. As of nfdump-1.7.2, it is now the recommended version in production. For the full list of changes, see the ChangeLog file. Some highlights: - Update nfcapd/sfcapd man pages for erspan data link - Implement erspan protocol in nfpcapd packet processing - Sync ipfix and netflow_v9 for option field processing - Handle buggy option data(!) from exporter - Fixes compile warnings for Linux(es) and *BSDs. - Fix v9 option template processing - Fix option record processing for multiple records - Fix ipfix nbar processing - Update pcap reader with erspan device - Fix fmt argument parsing - Add IPv4 in IPv6 special cases in geolookup - Fix IP version check in geolookup - Disable signals in threads. Different OS handle signals differently - Recongnize old sampler with missing algorithm tag #35 - Fix memory leaks - Update pcap_reader and add CISCO application performance monitor tags - Add ERSPAN decoding to pcap_reader - Check uid root for src spoofing option - Fix valgrind error for uninitalised memory. #431 - Update lz4 code - Update number of enabled tags in v9 and ipfix - Add collector option -X to limit stored data. - Implement %sasn, %dasn organisation name printing tags. See #430 - Improve geoDB handling. Needs rebuild of the geoDB. - Wire sampling extension for individual sampling - Update ICMP type/code handling. Issue #423 - Codespell - cleanup - Fix #415. ICMP decoding in netflow v9 - Pimp pcap_reader - Added source address support for nfreplay - Fix dst tos bug in output_raw - Add geo info in JSON output when using GeoDB. #402 - Fix 408. Interchanged time stamps - Add icmp type/code elements 176, 177, 178, 179 - Add unique version string - Add OpenBSD pflog format in nfpcapd - Add Linux nflog in nfpcapd - Replace old packet repeater code with more modern privsep code - Replace old launcher startup code with more modern privsep code - Fix compile issue #395 on Alpine Linux

nfdump v1.7.3

2023-09-02T11:30:57+00:00

Nfdump-1.7.3 adds zstd compression speeds compression (multi threading) and adds compression levels. Furthermore it fixes some nfprofile issues. Other changes: 5e2aef9: Improve error handling in privsep.c 584453e: Fix #459. change vars to uint64_t 696f563: Merge branch 'master' of github.com:phaag/nfdump ec1f121: Allow direction status > 2, althogh not defined c2c097f: Fix #452 - to add GeoInfo 1163722: Merge branch 'master' of github.com:phaag/nfdump c51ce1f: Fix #448 man page type de9811c: Cleanup unused extensions. Implemented as arrays. Collect Juniper inline-monitorig packet data. Data is not yet decoded. 3a810ad: Add types for Juniper inline-monitoring. No decoding yet 130fafe: Update test sequence for compression levels 14be8fb: Cleanup nffile struct f9515d2: Fix potential compressed appendix corruption 4b7c42a: Update Readme for building instructions on older Ubuntu 18.04 LTS 837419b: Fix broken installation of nfdump.conf.dist df4fc16: Cleanup all compress files into sub dir 6c47de5: Move conf subdir to nfdump library. Fix linker errors 18f7bc5: Add maxworkers to nfdump.conf 336cb05: Make count check more dynamic in v5 1a71629: Fix nfsen #15 on RH 65ea877: Bark if rename fails 8802fa0: Add zstd to QueryFile() 98385f2: Cleanup and fix minor bugs 91aeeb8: Enable multiple writer threads, depending on number of Cores online a9a4322: Update Readme 92f8d01: Update Readme 2efd259: Add zstd compression cb254b1: Enable lz4 compression levels 3..12 3b7b92f: Update lz4 code 8123283: Add code for compression level handling c6fedc0: Update compression code c8c98d0: Add compresson level parsing 7413188: Fix parsing compression option to work for all possible options 12a90b4: Adapt -J option in nfdump to new compression spec, being still compatible with old one. a1f4f19: Print usage() if no arguments are given d8620c0: Update man pages e928c42: Unify compression arguments. Use now -z= for compression. Accept still old -j and -y for now e8ee2fc: Remove static var for lzo wrkmem f2ddf67: Cleanup nfprofile and fix issue #398 69e4d98: Add syslog by default for nfprofile 7041498: Add file verification for nfprofile efd28ad: Cleanup nfprofile code b54e266: Make geolookup more robust reading buggy files d90d561: Add flush() for nfprofile 399014d: Move from c11 to c17 compile standard 7b791a1: Cleanup profile code 27d65be: Prevent loading geoDB if not needed f3a174f: change var name 2c5678f: Add BlockReports 18a34c1: Update nfprofile 43f3f14: Fix last commit 881707e: Remove blockqueue. Reduce memory footprint e10c2ef: Code cleanup af0f43e: Code cleanup 2944ac9: Make consistent protocol ID for nfd raw 0742648: Code cleanup and minor bug fix 328daaf: Rework QueryFile code and cleanup 058cecb: Merge and cleanup nfpcapd and nfreplay code for sending raw records 2864358: Add nfdump protocol for nfreplay