StefanSA/flowcollector-go
1
0
Fork 0
Code Issues 1 Pull requests 4 Projects Releases 19 Packages 1 Wiki Activity Actions
19 releases 20 tags
  • v0.1.17 bb89de4692

    v0.1.17
    All checks were successful
    ci / go-test (push) Successful in 4m39s
    Details
    ci / release-smoke (push) Successful in 4m43s
    Details
    ci / integration (push) Successful in 4m36s
    Details
    ci / parser-fixtures (push) Successful in 4m35s
    Details
    release / metadata (push) Successful in 3s
    Details
    release / build-artifacts (push) Successful in 5m3s
    Details
    release / publish (push) Successful in 1m6s
    Details
    Stable

    StefanSA released this 2026-07-22 11:11:10 +02:00 | 0 commits to main since this release

    v0.1.17 - 2026-07-22

    Fixed

    • Scoped NetFlow v9 and IPFIX templates by exporter UDP source port together
      with the source/observation domain, preventing template state from crossing
      exporter transport contexts.
    • Kept NetFlow v9 and IPFIX Options records metadata-only so scopes, exporter
      addresses, application metadata, and option values cannot create false flow
      byte, packet, address, port, sampling, or timestamp fields.
    • Preserved the explicit NetFlow v9 scope namespace
      netflow.v9.scope.<scope-type> and kept scope fields out of ordinary
      Information Element normalization.
    • Prevented enterprise IPFIX Information Elements from inheriting IANA aliases
      solely because their numeric IDs match.
    • Removed proven false aliases where flow totals, exported counters, sampler
      identifiers/modes, interfaces, timestamps, VLAN identifiers, or TCP fields
      were promoted to unrelated canonical fields.
    • Added standards-compliant one-to-eight-byte IPFIX reduced-size integer
      decoding, signed sign extension, fixed-zero-length template rejection, and
      millisecond timestamp overflow protection.
    • Changed sFlow exporter identity to the datagram agent_address and sub-agent
      context instead of the UDP relay address.
    • Restricted sFlow sampled-header tuple decoding to the declared Ethernet,
      IPv4, or IPv6 header protocol and rejected invalid protocol/port promotion.

    Compatibility

    • Existing legitimate NetFlow v5, NetFlow v9, and IPFIX byte/packet decoding
      remains unchanged.
    • NetFlow v9 application metadata remains available while Options records stay
      outside traffic normalization.
    • sFlow sampling remains applied exactly once.
    • The canonical audit, fixtures, pre/post evidence, runtime queries, and audit
      matrix are recorded at
      docs/audits/flowcollector-go/wire-to-canonical-conformance-20260722.md in
      the governed platform documentation tree.

    Known limitations

    • Some Cisco NetFlow v5 wire semantics, PEN 4300 aliases, NetFlow v9 vendor
      extensions, and later sFlow extensions remain REFERENCE_MISSING.
    • NetFlow v9 Count, padding, packet-sequence, and non-standard withdrawal
      behavior remains incomplete.
    • IPFIX UDP template lifecycle and NTP fractional timestamp behavior remains
      incomplete.
    • sFlow counter samples are parsed but not runtime-dispatched; some interface
      formats and extended records remain unsupported or unproven.
    Downloads
  • v0.1.16 aee2736f33

    v0.1.16
    All checks were successful
    ci / go-test (push) Successful in 5m52s
    Details
    ci / release-smoke (push) Successful in 5m59s
    Details
    ci / integration (push) Successful in 5m49s
    Details
    ci / parser-fixtures (push) Successful in 5m44s
    Details
    release / metadata (push) Successful in 3s
    Details
    release / build-artifacts (push) Successful in 7m1s
    Details
    release / publish (push) Successful in 1m37s
    Details
    Stable

    StefanSA released this 2026-07-20 14:41:57 +02:00 | 3 commits to main since this release

    v0.1.16 - 2026-07-20

    Fixed

    • Added deterministic flow.in.netif.name and flow.out.netif.name fallback
      values formatted as index: <id> whenever a valid non-zero numeric interface
      index is present without an exported name.
    • Preserved exporter-provided friendly interface names and the existing
      exporter-scoped SNMP behavior that replaces only matching numeric fallback
      names with real interface metadata.
    • Applied the central interface-name fallback consistently to NetFlow v5,
      NetFlow v9, IPFIX, and sFlow v5 events without changing the numeric interface
      fields.

    Compatibility

    • Retained the proven directional VLAN fields flow.in.vlan.tag.id and
      flow.out.vlan.tag.id.
    • Did not add an unproven vlan.tag.id alias.
    • tcp.options.tags remains unsupported pending parity evidence for the exact
      VictoriaFlow bit ordering and canonical tag names; TCP flags are not used as
      a substitute.
    Downloads
  • v0.1.15 e6671d9402

    v0.1.15
    All checks were successful
    ci / go-test (push) Successful in 4m49s
    Details
    ci / release-smoke (push) Successful in 4m41s
    Details
    ci / integration (push) Successful in 4m34s
    Details
    ci / parser-fixtures (push) Successful in 4m34s
    Details
    release / metadata (push) Successful in 3s
    Details
    release / build-artifacts (push) Successful in 5m13s
    Details
    release / publish (push) Successful in 1m10s
    Details
    Stable

    StefanSA released this 2026-07-13 08:13:45 +02:00 | 5 commits to main since this release

    v0.1.15 - 2026-07-13

    Changed

    • Made external hosts.csv the authoritative first hostname source for DNS
      enrichment.
    • Changed DNS resolution order to hosts.csv, positive cache, negative cache,
      optional private PTR skip, and PTR lookup for remaining addresses.
    • Added canonical ip,hostname header support while preserving comment-based
      hosts files.
    • Documented hosts.csv plus skip_private_ptr=true as the recommended
      production private-network deployment model.
    • Runtime validated using the dedicated /opt/containers/flowcollector-go test
      deployment.
    Downloads
  • v0.1.14 ad369de14f

    v0.1.14
    Some checks failed
    ci / go-test (push) Successful in 4m36s
    Details
    ci / release-smoke (push) Successful in 4m43s
    Details
    ci / integration (push) Successful in 4m33s
    Details
    ci / parser-fixtures (push) Successful in 4m32s
    Details
    release / metadata (push) Successful in 3s
    Details
    release / build-artifacts (push) Successful in 5m2s
    Details
    release / publish (push) Failing after 1s
    Details
    Stable

    StefanSA released this 2026-07-12 17:34:38 +02:00 | 7 commits to main since this release

    v0.1.14 - 2026-07-12

    Fixed

    • Hardened DNS enrichment caching and lookup behavior:
      • added bounded positive and negative DNS caches
      • added configurable negative-cache TTL and private PTR lookup control
      • retained DNS enrichment compatibility fields while reducing repeated resolver pressure
      • runtime validated using the dedicated /opt/containers/flowcollector-go test deployment
    Downloads
  • v0.1.13 5ac6e70561

    v0.1.13
    All checks were successful
    ci / go-test (push) Successful in 4m39s
    Details
    ci / release-smoke (push) Successful in 4m42s
    Details
    ci / integration (push) Successful in 4m34s
    Details
    ci / parser-fixtures (push) Successful in 4m33s
    Details
    release / metadata (push) Successful in 3s
    Details
    release / build-artifacts (push) Successful in 5m4s
    Details
    release / publish (push) Successful in 1m16s
    Details
    Stable

    StefanSA released this 2026-07-09 11:07:48 +02:00 | 9 commits to main since this release

    v0.1.13 - 2026-07-09

    Fixed

    • Fixed the GeoIP/CIDR enrichment interaction:
      • GeoIP enrichment now operates independently of the CIDR plugin
      • CIDR metadata no longer suppresses MaxMind GeoIP lookups
      • CIDR-derived site metadata uses dedicated flow.src.site.* / flow.dst.site.* fields
      • existing GeoIP compatibility fields remain fully functional
      • runtime validated using the dedicated /opt/containers/flowcollector-go test deployment
    Downloads
  • v0.1.12 dc6c24bf15

    v0.1.12
    All checks were successful
    ci / go-test (push) Successful in 1m22s
    Details
    ci / release-smoke (push) Successful in 5m50s
    Details
    ci / integration (push) Successful in 4m23s
    Details
    ci / parser-fixtures (push) Successful in 4m17s
    Details
    release / metadata (push) Successful in 3s
    Details
    release / build-artifacts (push) Successful in 5m18s
    Details
    release / publish (push) Successful in 1m16s
    Details
    Stable

    StefanSA released this 2026-07-09 09:50:00 +02:00 | 11 commits to main since this release

    v0.1.12 - 2026-07-09

    Changed

    • Separated CIDR site metadata from GeoIP enrichment:
      • CIDR location metadata now writes to flow.src.site.* / flow.dst.site.*
      • CIDR enrichment no longer writes source.geo.*, destination.geo.*, flow.src.geo.*, or flow.dst.geo.*
      • source.geo.*, destination.geo.*, client.geo.*, and server.geo.* remain GeoIP/MaxMind-owned
      • legacy CIDR metadata geo.* input keys are still accepted and mapped into the new site namespace
    Downloads
  • v0.1.11 43e773b346

    v0.1.11
    All checks were successful
    ci / go-test (push) Successful in 4m44s
    Details
    ci / release-smoke (push) Successful in 4m51s
    Details
    ci / integration (push) Successful in 4m41s
    Details
    ci / parser-fixtures (push) Successful in 4m43s
    Details
    release / metadata (push) Successful in 3s
    Details
    release / build-artifacts (push) Successful in 5m13s
    Details
    release / publish (push) Successful in 1m15s
    Details
    Stable

    StefanSA released this 2026-07-07 21:19:35 +02:00 | 12 commits to main since this release

    v0.1.11 - 2026-07-07

    Added

    • Added optional external CSV-based app.category fallback.
    • Existing app_ports.csv remains fully backward compatible.
    • Registry/IPFIX/NBAR application categories always take precedence.
    • Port-derived categories are only applied when app.category is empty.
    • Protocol-specific mappings have precedence over protocol-agnostic mappings.
    • Existing app.name, flow.app.name, normalization, parser logic, GeoIP/ASN enrichment and compatibility fields remain unchanged.
    Downloads
  • v0.1.10 ebda2b5828

    v0.1.10
    All checks were successful
    ci / go-test (push) Successful in 4m35s
    Details
    ci / release-smoke (push) Successful in 5m23s
    Details
    ci / integration (push) Successful in 4m34s
    Details
    ci / parser-fixtures (push) Successful in 4m32s
    Details
    release / metadata (push) Successful in 3s
    Details
    release / build-artifacts (push) Successful in 5m25s
    Details
    release / publish (push) Successful in 1m48s
    Details
    Stable

    StefanSA released this 2026-07-07 09:22:27 +02:00 | 14 commits to main since this release

    v0.1.10 - 2026-07-07

    Added

    • Added ElastiFlow compatibility field l4.session.established for migrated GeoIP dashboards.
    • Field is emitted only when session state can be determined from existing flow information.
    • No guessed session state is emitted.
    • Existing ECS behavior is unchanged.
    • No additional enrichment or parser changes beyond the compatibility field.
    Downloads
  • v0.1.9 bbcdc88c16

    v0.1.9
    Some checks failed
    ci / go-test (push) Successful in 4m35s
    Details
    ci / release-smoke (push) Successful in 5m20s
    Details
    ci / integration (push) Successful in 5m22s
    Details
    ci / parser-fixtures (push) Successful in 5m20s
    Details
    release / metadata (push) Successful in 3s
    Details
    release / build-artifacts (push) Successful in 5m8s
    Details
    release / publish (push) Failing after 1m26s
    Details
    Stable

    StefanSA released this 2026-07-07 07:57:55 +02:00 | 17 commits to main since this release

    v0.1.9 - 2026-07-07

    Added

    • Added ElastiFlow client/server GeoIP and ASN compatibility fields:
      • flow.client.geo.* now mirrors client.geo.*
      • flow.server.geo.* now mirrors server.geo.*
      • flow.client.as.* now mirrors client.as.*
      • flow.server.as.* now mirrors server.as.*
      • flow.client.geo.loc.coord and flow.server.geo.loc.coord use the existing "lat,lon" compatibility format
      • no additional GeoIP or ASN lookups are performed
    Downloads
  • v0.1.8 d2e73ac75c

    v0.1.8
    All checks were successful
    ci / go-test (push) Successful in 4m42s
    Details
    ci / release-smoke (push) Successful in 4m37s
    Details
    ci / integration (push) Successful in 4m30s
    Details
    ci / parser-fixtures (push) Successful in 4m30s
    Details
    release / metadata (push) Successful in 3s
    Details
    release / build-artifacts (push) Successful in 4m57s
    Details
    release / publish (push) Successful in 1m28s
    Details
    Stable

    StefanSA released this 2026-07-06 21:51:15 +02:00 | 18 commits to main since this release

    Downloads