Wireshark-dev: [Wireshark-dev] Netflow: How should Sequence Number field work?
From: Martin Mathieson <[email protected]>
Date: Sat, 4 Jul 2015 14:27:10 +0100
(I think my previous attempt to send this failed, so resending)

A few months ago I updated the Netflow dissector to do sequence
analysis using the Sequence Number field within an Obvservation
Domain, based upon RFC 3954 and a capture file I was looking at.

RFC 3954 describes the field as follows:

Sequence Number
         Incremental sequence counter of all Export Packets sent from
         the current Observation Domain by the Exporter.  This value
         MUST be cumulative, and SHOULD be used by the Collector to
         identify whether any Export Packets have been missed.

A Netflow frame has the Obvervation-domain + Sequence number at the
top, then a number of flows below.  What is not clear to me is whether
this field should advance by the number of flows in this frame, or the
previous frame.

The capture included in this bug report
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11047 increments
according to the number found in the previous frame for this
Obvervation domain (i.e. it represents the SN at the beginning of the
current frame).

Whereas a different capture I was looking (when the sequence analysis
was written) increments according to the number of flows in this frame
(i.e. it represents the SN at/beyond the end of the current frame).

Could someone with a working knowledge of Netflow put me right?  Is
there another spec where the usage of this field is made clear?  Are
both approaches valid?

Thanks,

Martin