IPFIX 数据通过 UDP 传输至 C# - 我可以解码数据吗?

发布于 2024-11-02 02:05:01 字数 1390 浏览 0 评论 0原文

我有来自 MSDN 网站的代码示例,用于创建 UDP 侦听器/客户端,因为我尝试从防火墙接收 IPFIX/Netflow 数据,然后使用收到的数据。 该代码确实有效并开始接收数据,但它的行话(见下文)所以我想我没有正确解码它。

有谁知道我需要做什么才能以正确的格式获取数据?

我使用的代码是:

using System;
using System.Net;
using System.Net.Sockets;
using System.Text;

public class ConsoleApplication2
{
    private const int listenPort = 2055;

    private static void StartListener()
    {
        bool done = false;

        UdpClient listener = new UdpClient(listenPort);
        IPEndPoint groupEP = new IPEndPoint(IPAddress.Any, listenPort);

        try
        {
            while (!done)
            {
                Console.WriteLine("Waiting for broadcast");
                byte[] bytes = listener.Receive(ref groupEP);

                Console.WriteLine("Received broadcast from {0} :\n {1}\n",
                    groupEP.ToString(),
                    Encoding.ASCII.GetString(bytes, 0, bytes.Length));
            }

        }
        catch (Exception e)
        {
            Console.WriteLine(e.ToString());
        }
        finally
        {
            listener.Close();
        }
    }

    public static int Main()
    {
        StartListener();

        return 0;
    }
}

我得到的数据是:

?M?▼? '$▬+? ☺☺ ?M?▼???k` &??_?07????Q??E?U?j ♥ ☻
♠ P ♣ x ♣ ► ♥ → ♦ ☼?M?▼?M?▼? 1♠►?
? ☺

预先感谢,

詹姆斯

I have a code sample from the MSDN website to create a UDP listener/client as I am trying to receive IPFIX/Netflow data from a firewall and then work with the data I receive.
The code does work and starts to reveive data but its jargon (see below) so I guess I am not decoding it correctly.

Does anyone have any ideas what I need to do to be able to get the data in the correct format?

The code I am using is:

using System;
using System.Net;
using System.Net.Sockets;
using System.Text;

public class ConsoleApplication2
{
    private const int listenPort = 2055;

    private static void StartListener()
    {
        bool done = false;

        UdpClient listener = new UdpClient(listenPort);
        IPEndPoint groupEP = new IPEndPoint(IPAddress.Any, listenPort);

        try
        {
            while (!done)
            {
                Console.WriteLine("Waiting for broadcast");
                byte[] bytes = listener.Receive(ref groupEP);

                Console.WriteLine("Received broadcast from {0} :\n {1}\n",
                    groupEP.ToString(),
                    Encoding.ASCII.GetString(bytes, 0, bytes.Length));
            }

        }
        catch (Exception e)
        {
            Console.WriteLine(e.ToString());
        }
        finally
        {
            listener.Close();
        }
    }

    public static int Main()
    {
        StartListener();

        return 0;
    }
}

And the data I get back is:

?M?▼? '$▬+? ☺☺ ?M?▼???k`
&??_?07????Q??E?U?j ♥ ☻
♠ P ♣ x ♣ ► ♥ → ♦
☼?M?▼?M?▼? 1♠ ►?
? ☺

Thanks in advance,

James

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(1

作业与我同在 2024-11-09 02:05:01

您假设接收到的数据是 ASCII 格式,但事实上它的结构如下: 参见此处。这些消息有一个 标题和数据集等。您需要评估基于标准的数据,而不仅仅是直接的文本转换。

这里以消息头格式为例。文本转换根本不会对此执行任何操作:

3.1。消息头格式

   The format of the IPFIX Message Header is shown in Figure F.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |       Version Number          |            Length             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                           Export Time                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                       Sequence Number                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                    Observation Domain ID                      |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

You're assuming that the data being received is in ASCII format when in fact it's structured thusly: See here. The messages have a header and data sets etc. You need to evaluate the data based on the standard, not just a straight text conversion.

Here, for example is the message header format. A text conversion simply won't do anything with this:

3.1. Message Header Format

   The format of the IPFIX Message Header is shown in Figure F.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |       Version Number          |            Length             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                           Export Time                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                       Sequence Number                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                    Observation Domain ID                      |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文