This will currently indeed discard the entire datagram if one sample has an unknown type. I vaguely recall there was a reason why I did that, but I can't think of it anymore. Let me have another look and see if there is anything I can do. Same as for the related bug (99118), if you happen to have data you could share with me which I could test this against, that would be very helpful.
Thanks!
Elisa
On Sep 24, 2014, at 6:32 PM, Andrew Feren via RT <bug-Net-sFlow@rt.cpan.org> wrote:
Show quoted text> Wed Sep 24 12:32:39 2014: Request 99119 was acted upon.
> Transaction: Ticket created by ACFEREN
> Queue: Net-sFlow
> Subject: All details discarded when an unknown format is found
> Broken in: (no value)
> Severity: (no value)
> Owner: Nobody
> Requestors: ACFEREN@cpan.org
> Status: new
> Ticket <URL:
https://rt.cpan.org/Ticket/Display.html?id=99119 >
>
>
> This is related to Bug 99118. I've attached a screenshot to illustrate the issue. Wireshark currently can't decode format 7 either, but wireshark still gives results for the Generic counters and Ethernet interface counters in the sample.
>
> When _decodeCounterRecord returns if there is an error the last sample is popped off of @sFlowSamples. Unfortunately, that last sample also also contains the successfully decoded values.
>
> changing
>
> pop @sFlowSamples;
>
> to
>
> pop @sFlowSamples unless $error =~ /rest of the datagram skipped/;
>
> Seems to resolve the problem, but perhaps there is a better solution.
>
> Regardless of the exact solution I think the change needs to be made every place where samples are popped on error.
> <Screenshot from 2014-09-24 12:11:49.png>
![Wed Sep 24 12:32:39 2014 (135.1k) by ACFEREN [...] cpan.org](/Ticket/Attachment/1414826/751135/Screenshot%20from%202014-09-24%2012%3A11%3A49.png){kind=link}