nfdump displays 0.0.0.0 for src/dst in IPv6 MPLS flows generated by an ipv4-ipv6 monitor

[awebfiend]

Hello,

I'm collecting netflow from Cisco routers that are using MPLS aware flow monitors on IPv4 and IPv6 flows. I would like to figure out how to get the IPv6 records displayed. Some data points:

• The routers are running IOS-XR with the config record mpls IPv4-IPv6-fields, resulting template below
• The flows are being collected over IPv4 and nfcapd is listening to an IPv4 address
• I have tried nfcapd/nfdump versions 1.7.3 and 1.7.7
• I have tried running nfcapd and nfdump with -6. Attached at the end of the message.
• I have NOT tried sending the flow over IPv6 to an nfcapd instance listening on IPv6
• I tried another tool nfacctd, that does seem to correctly record the IPv6 source and destination addresses

Not sure where to go from here.

Thanks.

A flow record looks like this when captured with nfcapd -E:

Flow Record: 
  Flags        =              0x00 NETFLOW v9, Unsampled
  Elements     =                 8: 1 2 3 4 12 14 18 36 
  size         =               216
  engine type  =                 1
  engine ID    =                 1
  export sysid =                 1
  first        =     1762814180290 [2025-11-10 22:36:20.290]
  last         =     1762814216254 [2025-11-10 22:36:56.254]
  received at  =     1764095029858 [2025-11-25 18:23:49.858]
  proto        =                 6 TCP
  tcp flags    =              0x00 ........
  src port     =             56551
  dst port     =               443
  src tos      =                 0
  in packets   =                 2
  in bytes     =               168
  src addr     =           0.0.0.0
  dst addr     =           0.0.0.0
  src addr     =  fd98:1557:64be:0000:0000:0000:0000:0001
  dst addr     =  fd98:1557:64be:1003::134
  input        =                 6
  output       =               847
  src mask     =                 0 /0
  dst mask     =                 0 /0
  fwd status   =               187
  dst tos      =                 1
  direction    =                 1
  biFlow Dir   =              0x00
  end reason   =              0x00
  ip exporter  =   192.168.1.126

An nfdump -o raw dump of that same record looks like this:

Flow Record: 
  RecordCount  =                 4
  Flags        =              0x00 NETFLOW v9, Unsampled
  Elements     =                 8: 1 2 3 4 12 14 18 36 
  size         =               216
  engine type  =                 1
  engine ID    =                 1
  export sysid =                 1
  first        =     1762814180290 [2025-11-10 22:36:20.290]
  last         =     1762814216254 [2025-11-10 22:36:56.254]
  received at  =     1764095029858 [2025-11-25 18:23:49.858]
  proto        =                 6 TCP
  tcp flags    =              0x00 ........
  src port     =             56551
  dst port     =               443
  src tos      =                 0
  fwd status   =                66
  in packets   =                 2
  in bytes     =               168
  src addr     =           0.0.0.0
  dst addr     =           0.0.0.0
  src addr     =                ::
  dst addr     =                ::
  input        =                 6
  output       =               847
  src mask     =                 0 /0
  dst mask     =                 0 /0
  dst tos      =                 0
  direction    =                 1
  biFlow Dir   =              0x00 
  end reason   =              0x00 
  ip exporter  =   192.168.1.126
  MPLS Lbl  1  =       1234566-0-0
  MPLS Lbl  2  =       1234563-0-0
  MPLS Lbl  3  =             2-0-1
  samplingID   =                 1
  ingress VRF  =        1610612736
  egress VRF   =        1610612736

This is a dump of the template that's sent when using the config record mpls IPv4-IPv6-fields:

        Template (Id = 313, Count = 32)
            Template Id: 313
            Field Count: 32
            Field (1/32): MPLS_LABEL_1
                Type: MPLS_LABEL_1 (70)
                Length: 3
            Field (2/32): MPLS_LABEL_2
                Type: MPLS_LABEL_2 (71)
                Length: 3
            Field (3/32): MPLS_LABEL_3
                Type: MPLS_LABEL_3 (72)
                Length: 3
            Field (4/32): MPLS_LABEL_4
                Type: MPLS_LABEL_4 (73)
                Length: 3
            Field (5/32): MPLS_LABEL_5
                Type: MPLS_LABEL_5 (74)
                Length: 3
            Field (6/32): MPLS_LABEL_6
                Type: MPLS_LABEL_6 (75)
                Length: 3
            Field (7/32): INPUT_SNMP
                Type: INPUT_SNMP (10)
                Length: 4
            Field (8/32): OUTPUT_SNMP
                Type: OUTPUT_SNMP (14)
                Length: 4
            Field (9/32): BYTES
                Type: BYTES (1)
                Length: 4
            Field (10/32): PKTS
                Type: PKTS (2)
                Length: 4
            Field (11/32): LAST_SWITCHED
                Type: LAST_SWITCHED (21)
                Length: 4
            Field (12/32): FIRST_SWITCHED
                Type: FIRST_SWITCHED (22)
                Length: 4
            Field (13/32): MPLS_TOP_LABEL_ADDR
                Type: MPLS_TOP_LABEL_ADDR (47)
                Length: 4
            Field (14/32): MPLS_TOP_LABEL_IPv6_ADDRESS
                Type: MPLS_TOP_LABEL_IPv6_ADDRESS (140)
                Length: 16
            Field (15/32): IPV6_SRC_ADDR
                Type: IPV6_SRC_ADDR (27)
                Length: 16
            Field (16/32): IPV6_DST_ADDR
                Type: IPV6_DST_ADDR (28)
                Length: 16
            Field (17/32): FLOW_LABEL
                Type: FLOW_LABEL (31)
                Length: 3
            Field (18/32): mplsTopLabelPrefixLength
                Type: mplsTopLabelPrefixLength (91)
                Length: 1
            Field (19/32): IPV6_OPTION_HEADERS
                Type: IPV6_OPTION_HEADERS (64)
                Length: 4
            Field (20/32): IP_SRC_ADDR
                Type: IP_SRC_ADDR (8)
                Length: 4
            Field (21/32): IP_DST_ADDR
                Type: IP_DST_ADDR (12)
                Length: 4
            Field (22/32): L4_SRC_PORT
                Type: L4_SRC_PORT (7)
                Length: 2
            Field (23/32): L4_DST_PORT
                Type: L4_DST_PORT (11)
                Length: 2
            Field (24/32): MPLS_TOP_LABEL_TYPE
                Type: MPLS_TOP_LABEL_TYPE (46)
                Length: 1
            Field (25/32): FORWARDING_STATUS
                Type: FORWARDING_STATUS (89)
                Length: 1
            Field (26/32): DIRECTION
                Type: DIRECTION (61)
                Length: 1
            Field (27/32): IP_TOS
                Type: IP_TOS (5)
                Length: 1
            Field (28/32): PROTOCOL
                Type: PROTOCOL (4)
                Length: 1
            Field (29/32): TCP_FLAGS
                Type: TCP_FLAGS (6)
                Length: 1
            Field (30/32): FLOW_SAMPLER_ID
                Type: FLOW_SAMPLER_ID (48)
                Length: 2
            Field (31/32): ingressVRFID
                Type: ingressVRFID (234)
                Length: 4
            Field (32/32): egressVRFID
                Type: egressVRFID (235)
                Length: 4          

With the -6 -E option on nfcapd, I see different Elements and a prefixed ip exporter. Element 12 has gone and 13 is there in it's place.

Flow Record: 
  Flags        =              0x00 NETFLOW v9, Unsampled
  Elements     =                 8: 1 2 3 4 13 14 18 36 
 [...snipped...] 
  biFlow Dir   =              0x00 
  end reason   =              0x00 
  ip exporter  =  ::ffff:192.168.1.126

[phaag]

Generally IPv6 records work out of the box. Your exporter is sending IPv4 addresses and IPv6 addresses at the same time, which can be confusing for nfdump versions < 1.7.7. Please check out the latest master repo or release 1.7.7 and check again. If there is still any issue, just let me know.

[awebfiend]

Thanks for looking at this. I ran my test again and I see the same issue with 1.7.7. Unfortunately we're stuck using IPv4-IPv6-fields for this use case.

[phaag]

Can you send my a sample nfcapd file? If so, use the email address in the authors file.

[awebfiend]

Thanks for continuing to look at this. I sent you a sample nfcapd file and the pcap with the template and flows that generated it.

[phaag]

Your exporter sends IPv4 and IPv6 elements in the same flow record and does not send the field #60 ipVersion.
So nfdump does not detect which IP addresses are used and simply prints IPv4 records, if they are available.
Therefore you miss IPv6 and see empty 0.0.0.0 IPv4 records. Basicall an exporter should use different templates
for different IP versions, is most effectiv or announce at least the ipVersion element #60. Sure - I can do
some heuristics but I think guessing is not reliable ..

If you can convince the CISCO IOS-XR to separate templates for IPv6 and IPv4, that would be best and most
efficient, or at least to announce the ipVersion.

Besides, I can try to implement some guessing if both elements IPv4 and IPv6 are available.

[phaag]

Transferred as new issue and fixed in latest master repo - Fix lazy exporters ipfix stream.

[awebfiend]

Thank you for adding this fix. I think we're stuck with the combined IPv4-IPv6-fields from IOS-XR so this is really helpful.