I wrote a Netflow v10 (IPFIX) traffic generator. It spoofs Source IP addresses to pretend to be coming from multiple sites, and has fake users it sends reports about. The idea is very similar to Solarwinds Flow Generator, if anyone has ever come across that tool.
It seems to work pretty good, but when I do a packet capture with Wireshark, Wireshark tells me my sequence numbers aren't right.
As far as I can tell from reading the IPFIX RFC, the sequence numbers start at 0 (in the first data packet), and in subsequent packets are incremented by the number of flows within the previous packet (not counting template or option flows). They are a way for the collector to know if it missed any packets.
So for a given site (exporter IP), if I'm sending 10 data flows per packet, the first packet will have a sequence of 0, the next will have a sequence of 10, then 20, and so on. That is exactly what I'm doing, but Wireshark is unhappy.
Wireshark mentions what it expects the sequence numbers to be, but the numbers it expects don't make any sense. My first packet coming from 184.108.40.206 for example had one Data Template, and 17 data flows. I had a sequence number of 0, and wireshark says it was expecting it to be 71. It appears to be counting flows that came from other source IPs (other exporters), and expecting the sequence numbers to be synchronized between different sites for some reason.
Anyone know what my issue might be?
Here is my packet capture, if anyone has a minute to have a look: https://drive.google.com/file/d/1_Sz-ndnbA8w0FZwBriXykXb-O3hZFoqC/view?usp=sharing
It appears that if I make each exporter's observation domain unique, Wireshark is happy with my sequence numbers. Why would different exporters need different observation domain IDs? How can that even be synchronized? If 2 different routers are acting as netflow exporters and sending a single netflow collector data, how do the 2 routers know what to use for an observation domain ID so that they don't interfere with each other? Is the observation domain something that an admin has to configure by hand on each exporter to make sure they are unique?