ListenNetFlow processor does not decode Cisco ASA enterprise IPFIX fields (PEN 9)**

Question

**Environment**- Cloudera CFM 2.1.7 / Apache NiFi 1.26.0- Cloudera CDP 7.3.1- Flow source: Cisco ASA Firewall (IPFIX export) **Issue** The `ListenNetFlow` processor successfully decodes standard IPFIX/NetFlow v9 fields but produces a WARN for every packet that contains Cisco ASA enterprise fields: ```WARN com.cloudera.nifi.netflow.ListenNetFlow: Sender [/x.x.x.x] Field Type [33002] Length [2] Field Decoder not foundWARN com.cloudera.nifi.netflow.ListenNetFlow: Sender [/x.x.x.x] Field Type [33001] Length [12] Field Decoder not foundWARN com.cloudera.nifi.netflow.ListenNetFlow: Sender [/x.x.x.x] Field Type [33000] Length [12] Field Decoder not foundWARN com.cloudera.nifi.netflow.ListenNetFlow: Sender [/x.x.x.x] Field Type [40000] Length [12] Field Decoder not found ``` At production NetFlow volume, this generates thousands of WARN lines per second, making `nifi-app.log` effectively unusable for monitoring other issues. More critically, the data in these fields is silently dropped: | Field ID | Cisco Name | Description ||---|---|---|| 33000 | INGRESS_ACL_ID | ACL that matched the flow on ingress || 33001 | EGRESS_ACL_ID | ACL that matched the flow on egress || 33002 | FW_EVENT | Firewall event type (allow / deny / teardown) | These are Cisco Private Enterprise Number (PEN 9) fields. They are documented in Cisco's IPFIX implementation guide and are present in every flow exported by Cisco ASA firewalls. For security operations use cases, `FW_EVENT` (33002) in particular is essential — it identifies whether a connection was permitted or denied. **Expected behavior** `ListenNetFlow` should support registering enterprise IPFIX field decoders via configuration (PEN + field ID mapping), so operators can define custom fields without modifying processor source code.As a baseline, well-known Cisco PEN 9 fields (33000, 33001, 33002) should be included in the default field registry.Unknown enterprise fields should be logged at DEBUG, not WARN, since encountering undefined vendor fields is expected behavior in production IPFIX environments. **Impact** - Log files roll too fast to monitor other issues- ACL and firewall event data is lost from every flow record- Security teams lose visibility into deny/allow decisions at the firewall level  Happy to provide packet captures or field mapping documentation if useful.

MattWho · Accepted Answer

@MarinaM

You can suppress those WARN messages by setting a custom log level just that processor class in the logback.xml

<logger name="com.cloudera.nifi.netflow.ListenNetFlow" level="ERROR"/>

You can also reach out to your Cloudera account manager with your enhancement/new feature request(s) for the ListenNetFlow processor.

Thank you,
Matt

ckumar · Answer

Error message tells that NetFlow instance which is emitting packets with fields unknown to the implementation which is used in ListenNetFlow . Processor uses  this schema to process the message

Sign up

Please use your Cloudera account.

Login to the community

Please use your Cloudera account.