Playing with IPFIX and bidirectional flows
-
I have been reading [RFC5101], [RFC5102] and [RFC5103], and decided to play with IPFIX in pfSense.
I'm using softflowd package and it is working with bidirectional flows disabled.However, when I enable bidirectional flows, I get the following error in my Netflow server (graylog):
java.lang.IllegalArgumentException: Multiple entries with same key: octetDeltaCount=2936 and octetDeltaCount=5016
I've included the element ID 239, biflowDirection, data_type": "unsigned8" as referenced in RFC5103.
Any glues for what I may be missing here ?
Thanks
Edit: I think the problem relies with Graylog, opened a topic there: https://community.graylog.org/t/ipfix-input-multiple-entries-with-same-key/30047