nfdump not showing NAT/Translated IPs for sflow

[mikej96]

I can't seem to get nfdump to show the src/dst xlt ip's and ports from an A10 CGN device sending sflow to an sfcapd collector.

I am testing using the latest master branch as well as 1.6.25 compiling with --enable-sflow and --enable-nsel and --enable-devel

The nat_src and nat_dst and nat_src_port and nat_dst_port all show up in the packet and get processed by sfcapd, but nfdump does not show them when using any type of output modifier including -o raw. The default nfdump shows the following:

2023-11-30 16:39:31.327 INVALID  Ignore UDP       100.69.55.17:6881  ->  101.119.161.193:3499           0.0.0.0:0     ->          0.0.0.0:0        1.5 M        0

I've attached sample sfcapd output and sample ndump output. Any ideas on what I might be doing wrong? It seems like it could be a bug with sfcapd saving the data properly to the nfcapd files, or a problem with nfdump reading them.

Happy to help troubleshoot more, and can provide any other information if requested.

Example nfdump output:
example_nfdump_trimmed.txt

Example sfcapd output:
example_packet_from_sfcapd.txt

[phaag]

@mikej96 - would you mind, to collect a pcap, sent to sfcapd, worth a couple 10k bytes of data and send it to me to the email address in the AUTHORS file?

[mikej96]

pcap sent, thank you!

[phaag]

Implemented in master repo.