bug(netflow): Failed to parse NetFlow packet #958

New issue

Closed

opened 2026-03-28 04:30:16 +00:00 by mfreeman451 · 1 comment

mfreeman451 commented

2026-03-28 04:30:16 +00:00

Owner

Imported from GitHub.

Original GitHub issue: #2678
Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/issues/2678
Original created: 2026-02-03T04:00:31Z

Describe the bug

[2026-02-03T03:58:59Z DEBUG netflow_collector::listener] Received 184 bytes from 192.168.0.0:49267                                                                                               [2026-02-03T03:58:59Z WARN  netflow_collector::listener] Failed to parse NetFlow packet from 192.168.0.0:49267: Partial { message: "V9 parse error: Parsing Error: Error { input: [192, 168, 1, 25, 142, 250, 125, 132, 152, 117, 116, 129, 4, 233, 43, 1, 187, 16, 0, 28, 0, 4, 0, 0, 0, 1, 0, 0, 0, 40, 6, 128, 46, 44, 6, 128, 46, 44, 6, 0, 244, 146, 191, 117, 199, 43, 28, 179, 201, 43, 119, 23, 8, 0, 255, 3, 1, 5, 0, 64, 192, 168, 1, 218, 172, 66, 0, 227, 152, 117, 116, 129, 4, 227, 26, 1, 187, 24, 0, 28, 0, 4, 0, 0, 0, 44, 0, 0, 14, 67, 6, 127, 125, 86, 6, 128, 104, 56, 6, 0, 137, 0, 0, 0, 244, 146, 191, 117, 199, 43, 86, 144, 194, 217, 119, 238, 8, 0, 255, 3, 1, 3, 0, 40, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 10, 117, 0, 0, 0, 0, 0, 0, 16, 188, 0, 0, 0, 0, 0, 14, 27, 230, 0, 0, 0, 0, 0, 0, 16, 190[], code: MapRes }" }                                                                                                                                                    [2026-02-03T03:59:11Z DEBUG netflow_collector::listener] Received 176 bytes from 10.0.2.1:52354                                                                                                  [2026-02-03T03:59:11Z DEBUG netflow_collector::listener] Parsed NetFlow packet V9(V9 { header: Header { version: 9, count: 2, sys_up_time: 108624564, unix_secs: 1770091151, sequence_number: 6140, source_id: 0 }, flowsets: [FlowSet { header: FlowSetHeader { flowset_id: 0, length: 92 }, body: Template(Templates { templates: [Template { template_id: 259, field_count: 21, fields: [TemplateField { field_type_number: 8, field_type: Ipv4SrcAddr, field_length: 4 }, TemplateField { field_type_number: 12, field_type: Ipv4DstAddr, field_length: 4 }, TemplateField { field_type_number: 15, field_type: Ipv4NextHop, field_length: 4 }, TemplateField { field_type_number: 60, field_type: IpProtocolVersion, field_length: 1 }, TemplateField { field_type_number: 7, field_type: L4SrcPort, field_length: 2 }, TemplateField { field_type_number: 11, field_type: L4DstPort, field_length: 2 }, TemplateField { field_type_number: 6, field_type: TcpFlags, field_length: 1 }, TemplateField { field_type_number: 10, field_type: InputSnmp, field_length: 2 }, TemplateField { field_type_number: 14, field_type: OutputSnmp, field_length: 2 }, TemplateField { field_type_number: 2, field_type: InPkts, field_length: 4 }, TemplateField { field_type_number: 1, field_type: InBytes, field_length: 4 }, TemplateField { field_type_number: 22, field_type: FirstSwitched, field_length: 4 }, TemplateField { field_type_number: 21, field_type: LastSwitched, field_length: 4 }, TemplateField { field_type_number: 4, field_type: Protocol, field_length: 1 }, TemplateField { field_type_number: 5, field_type: SrcTos, field_length: 1 }, TemplateField { field_type_number: 209, field_type: Unknown, field_length: 4 }, TemplateField { field_type_number: 80, field_type: InDstMac, field_length: 6 }, TemplateField { field_type_number: 56, field_type: InSrcMac, field_length: 6 }, TemplateField { field_type_number: 256, field_type: Unknown, field_length: 2 }, TemplateField { field_type_number: 61, field_type: Direction, field_length: 1 }, TemplateField { field_type_number: 48, field_type: FlowSamplerId, field_length: 1 }] }], padding: [] }) }, FlowSet { header: FlowSetHeader { flowset_id: 259, length: 64 }, body: Data(Data { fields: [[(Ipv4SrcAddr, Ip4Addr(10.0.2.13)), (Ipv4DstAddr, Ip4Addr(140.82.114.33)), (Ipv4NextHop, Ip4Addr(216.17.46.97)), (IpProtocolVersion, DataNumber(U8(4))), (L4SrcPort, DataNumber(U16(12870))), (L4DstPort, DataNumber(U16(443))), (TcpFlags, DataNumber(U8(26))), (InputSnmp, DataNumber(U16(40))), (OutputSnmp, DataNumber(U16(3))), (InPkts, DataNumber(U32(14))), (InBytes, DataNumber(U32(3271))), (FirstSwitched, Duration(108594.264s)), (LastSwitched, Duration(108594.494s)), (Protocol, ProtocolType(Tcp)), (SrcTos, DataNumber(U8(0))), (Unknown, Vec([241, 0, 0, 0])), (InDstMac, MacAddr("0C:EA:14:32:D2:7F")), (InSrcMac, MacAddr("BC:24:11:C2:05:60")), (Unknown, Vec([8, 0])), (Direction, DataNumber(U8(255))), (FlowSamplerId, DataNumber(U8(3)))]], padding: [] }) }] })                                                                                                                               [2026-02-03T03:59:11Z DEBUG netflow_collector::listener] Converted 1 flow records (0 dropped)                                                                                                    [2026-02-03T03:59:13Z DEBUG netflow_collector::listener] Received 60 bytes from 10.0.2.1:52354                                                                                                   [2026-02-03T03:59:13Z WARN  netflow_collector::listener] Failed to parse NetFlow packet from 10.0.2.1:52354: Partial { message: "V9 parse error: Parsing Error: Error { input: [0, 0, 0, 0, 0, 0,0, 0, 0, 0, 23, 253, 0, 0, 0, 0, 0, 0, 20, 194, 0, 0, 0, 0, 0, 32, 119, 241, 0, 0, 0, 0, 0, 0, 20, 195[], code: MapRes }" }
[2026-02-03T03:59:13Z INFO  netflow_collector::metrics] V9 Template Cache [V9SourceKey { addr: 192.168.0.0:49267, source_id: 0 }] - V9: 0/2000, IPFIX: 0/2000, V9 Hits/Misses: 0/1, IPFIX Hits/Mi
sses: 0/0
[2026-02-03T03:59:13Z INFO  netflow_collector::metrics] V9 Template Cache [V9SourceKey { addr: 10.0.2.1:52354, source_id: 0 }] - V9: 1/2000, IPFIX: 0/2000, V9 Hits/Misses: 1/1, IPFIX Hits/Misse
s: 0/0

To Reproduce
Steps to reproduce the behavior:

Go to '...'
Click on '....'
Scroll down to '....'
See error

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

OS: [e.g. iOS]
Browser [e.g. chrome, safari]
Version [e.g. 22]

Smartphone (please complete the following information):

Device: [e.g. iPhone6]
OS: [e.g. iOS8.1]
Browser [e.g. stock browser, safari]
Version [e.g. 22]

Additional context
Add any other context about the problem here.

Imported from GitHub. Original GitHub issue: #2678 Original author: @mfreeman451 Original URL: https://github.com/carverauto/serviceradar/issues/2678 Original created: 2026-02-03T04:00:31Z --- **Describe the bug** ``` [2026-02-03T03:58:59Z DEBUG netflow_collector::listener] Received 184 bytes from 192.168.0.0:49267 [2026-02-03T03:58:59Z WARN netflow_collector::listener] Failed to parse NetFlow packet from 192.168.0.0:49267: Partial { message: "V9 parse error: Parsing Error: Error { input: [192, 168, 1, 25, 142, 250, 125, 132, 152, 117, 116, 129, 4, 233, 43, 1, 187, 16, 0, 28, 0, 4, 0, 0, 0, 1, 0, 0, 0, 40, 6, 128, 46, 44, 6, 128, 46, 44, 6, 0, 244, 146, 191, 117, 199, 43, 28, 179, 201, 43, 119, 23, 8, 0, 255, 3, 1, 5, 0, 64, 192, 168, 1, 218, 172, 66, 0, 227, 152, 117, 116, 129, 4, 227, 26, 1, 187, 24, 0, 28, 0, 4, 0, 0, 0, 44, 0, 0, 14, 67, 6, 127, 125, 86, 6, 128, 104, 56, 6, 0, 137, 0, 0, 0, 244, 146, 191, 117, 199, 43, 86, 144, 194, 217, 119, 238, 8, 0, 255, 3, 1, 3, 0, 40, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 10, 117, 0, 0, 0, 0, 0, 0, 16, 188, 0, 0, 0, 0, 0, 14, 27, 230, 0, 0, 0, 0, 0, 0, 16, 190[], code: MapRes }" } [2026-02-03T03:59:11Z DEBUG netflow_collector::listener] Received 176 bytes from 10.0.2.1:52354 [2026-02-03T03:59:11Z DEBUG netflow_collector::listener] Parsed NetFlow packet V9(V9 { header: Header { version: 9, count: 2, sys_up_time: 108624564, unix_secs: 1770091151, sequence_number: 6140, source_id: 0 }, flowsets: [FlowSet { header: FlowSetHeader { flowset_id: 0, length: 92 }, body: Template(Templates { templates: [Template { template_id: 259, field_count: 21, fields: [TemplateField { field_type_number: 8, field_type: Ipv4SrcAddr, field_length: 4 }, TemplateField { field_type_number: 12, field_type: Ipv4DstAddr, field_length: 4 }, TemplateField { field_type_number: 15, field_type: Ipv4NextHop, field_length: 4 }, TemplateField { field_type_number: 60, field_type: IpProtocolVersion, field_length: 1 }, TemplateField { field_type_number: 7, field_type: L4SrcPort, field_length: 2 }, TemplateField { field_type_number: 11, field_type: L4DstPort, field_length: 2 }, TemplateField { field_type_number: 6, field_type: TcpFlags, field_length: 1 }, TemplateField { field_type_number: 10, field_type: InputSnmp, field_length: 2 }, TemplateField { field_type_number: 14, field_type: OutputSnmp, field_length: 2 }, TemplateField { field_type_number: 2, field_type: InPkts, field_length: 4 }, TemplateField { field_type_number: 1, field_type: InBytes, field_length: 4 }, TemplateField { field_type_number: 22, field_type: FirstSwitched, field_length: 4 }, TemplateField { field_type_number: 21, field_type: LastSwitched, field_length: 4 }, TemplateField { field_type_number: 4, field_type: Protocol, field_length: 1 }, TemplateField { field_type_number: 5, field_type: SrcTos, field_length: 1 }, TemplateField { field_type_number: 209, field_type: Unknown, field_length: 4 }, TemplateField { field_type_number: 80, field_type: InDstMac, field_length: 6 }, TemplateField { field_type_number: 56, field_type: InSrcMac, field_length: 6 }, TemplateField { field_type_number: 256, field_type: Unknown, field_length: 2 }, TemplateField { field_type_number: 61, field_type: Direction, field_length: 1 }, TemplateField { field_type_number: 48, field_type: FlowSamplerId, field_length: 1 }] }], padding: [] }) }, FlowSet { header: FlowSetHeader { flowset_id: 259, length: 64 }, body: Data(Data { fields: [[(Ipv4SrcAddr, Ip4Addr(10.0.2.13)), (Ipv4DstAddr, Ip4Addr(140.82.114.33)), (Ipv4NextHop, Ip4Addr(216.17.46.97)), (IpProtocolVersion, DataNumber(U8(4))), (L4SrcPort, DataNumber(U16(12870))), (L4DstPort, DataNumber(U16(443))), (TcpFlags, DataNumber(U8(26))), (InputSnmp, DataNumber(U16(40))), (OutputSnmp, DataNumber(U16(3))), (InPkts, DataNumber(U32(14))), (InBytes, DataNumber(U32(3271))), (FirstSwitched, Duration(108594.264s)), (LastSwitched, Duration(108594.494s)), (Protocol, ProtocolType(Tcp)), (SrcTos, DataNumber(U8(0))), (Unknown, Vec([241, 0, 0, 0])), (InDstMac, MacAddr("0C:EA:14:32:D2:7F")), (InSrcMac, MacAddr("BC:24:11:C2:05:60")), (Unknown, Vec([8, 0])), (Direction, DataNumber(U8(255))), (FlowSamplerId, DataNumber(U8(3)))]], padding: [] }) }] }) [2026-02-03T03:59:11Z DEBUG netflow_collector::listener] Converted 1 flow records (0 dropped) [2026-02-03T03:59:13Z DEBUG netflow_collector::listener] Received 60 bytes from 10.0.2.1:52354 [2026-02-03T03:59:13Z WARN netflow_collector::listener] Failed to parse NetFlow packet from 10.0.2.1:52354: Partial { message: "V9 parse error: Parsing Error: Error { input: [0, 0, 0, 0, 0, 0,0, 0, 0, 0, 23, 253, 0, 0, 0, 0, 0, 0, 20, 194, 0, 0, 0, 0, 0, 32, 119, 241, 0, 0, 0, 0, 0, 0, 20, 195[], code: MapRes }" } [2026-02-03T03:59:13Z INFO netflow_collector::metrics] V9 Template Cache [V9SourceKey { addr: 192.168.0.0:49267, source_id: 0 }] - V9: 0/2000, IPFIX: 0/2000, V9 Hits/Misses: 0/1, IPFIX Hits/Mi sses: 0/0 [2026-02-03T03:59:13Z INFO netflow_collector::metrics] V9 Template Cache [V9SourceKey { addr: 10.0.2.1:52354, source_id: 0 }] - V9: 1/2000, IPFIX: 0/2000, V9 Hits/Misses: 1/1, IPFIX Hits/Misse s: 0/0 ``` **To Reproduce** Steps to reproduce the behavior: 1. Go to '...' 2. Click on '....' 3. Scroll down to '....' 4. See error **Expected behavior** A clear and concise description of what you expected to happen. **Screenshots** If applicable, add screenshots to help explain your problem. **Desktop (please complete the following information):** - OS: [e.g. iOS] - Browser [e.g. chrome, safari] - Version [e.g. 22] **Smartphone (please complete the following information):** - Device: [e.g. iPhone6] - OS: [e.g. iOS8.1] - Browser [e.g. stock browser, safari] - Version [e.g. 22] **Additional context** Add any other context about the problem here.

mfreeman451 commented

2026-03-28 04:30:16 +00:00

Author

Owner

Imported GitHub comment.

Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/issues/2678#issuecomment-3874034642
Original created: 2026-02-09T21:45:43Z

closing, cant repro

Imported GitHub comment. Original author: @mfreeman451 Original URL: https://github.com/carverauto/serviceradar/issues/2678#issuecomment-3874034642 Original created: 2026-02-09T21:45:43Z --- closing, cant repro