inputs.netflow: Source port and destination port for TCP layer are not being included in metrics when using sFlow v5 decoder

[joseluisgonzalezca]

Relevant telegraf.conf

[[inputs.netflow]]
  service_address = "udp://:2055"
  protocol = "sflow v5"

[[outputs.file]]
  files = ["stdout"]
  data_format = "json"

Logs from Telegraf

{"fields":{"agent_ip":"192.168.227.2","agent_subid":0,"datalink_frame_type":"IPv4","direction":"ingress","dst":"192.168.100.221","fragment_flags":"......D.","fragment_offset":0,"in_snmp":27,"in_total_packets":3633958918,"ip_total_len":1500,"ip_version":4,"ipv4_id":34151,"ipv4_inet_header_len":5,"ipv4_total_len":1500,"l2_bytes":1518,"l2_protocol":"ETHERNET-ISO8023","out_snmp":33,"protocol":"tcp","sampling_drops":21405750,"sampling_interval":200,"seq_number":18721933,"src":"192.168.100.223","src_tos":0,"sys_uptime":2042522488,"tcp_ack_number":1885360632,"tcp_flags":"...A....","tcp_seq_number":3443873179,"tcp_urgent_ptr":0,"tcp_window_size":514,"ttl":64,"vlan_dst":100,"vlan_dst_priority":0,"vlan_src":100,"vlan_src_priority":0},"name":"netflow","tags":{"host":"40f2df22e0c0","source":"::1","version":"sFlowV5"},"timestamp":1726823867}

System info

Telegraf v1.32.0 running on Docker, Debian 12 as base OS

Docker

services:
  telegraf:
    image: telegraf:1.32.0
    container_name: telegraf
    ports:
      - 2055:2055/udp
    restart: unless-stopped
    volumes:
    - ./telegraf.conf:/etc/telegraf/telegraf.conf:ro
    - ./sflow-packet.bin:/tmp/sflow-packet.bin:ro

Steps to reproduce

Same steps as described in issue #15918 (comment)

Expected behavior

Source port and destination port must be present in Telegraf metrics for TCP packets.

Actual behavior

Fields are being decoded by goflow2 dissector but are not being properly included in Telegraf Metric struct.

Additional info

The issue is related to an already solved issue (see PR #16009). src_port and dst_port for the TCP layer have a custom type layers.TCPPort which cannot be included into Telegraf metrics. These variables should be converted to uint16 to be properly included into metrics:

Affected code lines:

telegraf/plugins/inputs/netflow/sflow_v5.go

Lines 414 to 415 in 115df09

	fields["src_port"] = l.SrcPort
	fields["dst_port"] = l.DstPort

Casting is already done for UDP layer ports and it's working as expected:

telegraf/plugins/inputs/netflow/sflow_v5.go

Lines 441 to 442 in 115df09

	fields["src_port"] = uint16(l.SrcPort)
	fields["dst_port"] = uint16(l.DstPort)

[srebhan]

@joseluisgonzalezca as you already identified what needs to be done, would you be willing to put up a PR?

[joseluisgonzalezca]

Hi Sven!

Sorry for the late reply. I've been busy these last weeks and I wasn't able to address the issue. I have just submitted the fix in this PR: #16197

Thanks again!