Hi,
For statefull layer4 or layer7 proxy with content modification, we will be having 2 different TCP connections, one will be on the client side and other will be on the server side. Considering below IPFIX template:
Field Type Field Type Number Description
IN_BYTES 1 Ingress bytes counter
IN_PKTS 2 Ingress packets counter
PROTOCOL 4 Layer 4 protocol
L4_SRC_PORT 7 Source TCP/UDP port
IPV4_SRC_ADDR 8 Source IP address
INPUT_SNMP 10 SNMP ingress interface index
L4_DST_PORT 11 Destination TCP/UDP port
IPV4_DST_ADDR 12 Destination IP address
OUTPUT_SNMP 14 SNMP egress interface index
Considering src/dst ip addresses on client and sever side are different, we will be having two flow with ingress IEs (no biflow or post* IEs are added), will the SolarWinds Orion NetFlow Traffic Analyzer predefined reports work fine?
Is there a plan to support layer4 and above proxies with IPFIX biflow records. Is there a plan to use post* IEs for report generation?