Update code to support nfdump v1.7

[gabrielmocan]

Update code to support nfdump v1.7

[chrispassas]

@gabrielmocan The project I originally created this for hasn't needed another version of nfdump so I haven't worked on this in a while.

If you can generate a sample of nfdump 1.7 output I'll take a look and see if I can figure out what changed and support it. If you want to make a pull request thats welcome also.

In the past it was a combination of looking at nfdump source code, and text output/trial error to determine the correct way to read the file.

[chrispassas]

@gabrielmocan OK I found something if you want to dig into this.

When I original here are some pointers on how I approached it.

• The header file for layout 1
  https://github.com/phaag/nfdump/blob/master/src/lib/nffile.h#L80
• using nfdump to output your file in csv
• run this Go nfdump and print out in csv to compare output
  This helps you determine if your reading the code correctly or not

Now I see a new .h file for layout 2 here
https://github.com/phaag/nfdump/blob/master/src/lib/nffileV2.h#L43

Take a look at that and see if you can make sense of it. I would be the new file format at least the "magic" and "version" are the same but from that point on its possible there could be differences.

[gabrielmocan]

I'm closing this issue as now we have https://github.com/phaag/go-nfdump to decode v2 files.

[gabrielmocan]

@chrispassas thank you for your reply. I've tried to attach a sample here but I guess due to it's format, GitHub is complaining about it. I'm attaching it on Google Drive.

https://drive.google.com/file/d/1ug-lAbe7YPrLyX8n5SSlK1eSx69gmsnT

If you can take a look and see if there is too much or too little to do. If too much, you can give at least some directions, if possible, so I can work on it.

Anyways, thanks in advance!

[chrispassas]

@gabrielmocan I spent some time looking at this and found a couple bugs that caused the module to not return error messages when it should parsing the nfdump file header.

I pushed the changes to master and your file now returns an error. This package currently only supports nfdump version 1 layout files. It appears your file is version 2 layout.

I'm going to look into what changed and see how much work it is to update.

[gabrielmocan]

Thanks @chrispassas , I'll take a look. I'm also talking to @phaag, as he also working on Golang tooling for nfdump.