GoFlow enricher for application/protocol detection

[balioune]

Hello,

I would like to develop an enricher with GoFlow. My aim is to identify whether the detected flow is HTTPS, O365, SSH, etc.

Is there any enricher source code that I can use or improve for application or protocol detection?

Any help or suggestions would be welcome.

Best regards,

[balioune]

@lspgn @vincentbernat do you have any suggestions ?

[saymonaraujo]

@balioune If you are looking to map (src|dst).port to well-known protocol names, the most efficient approach is usually to handle this via a dictionary lookup in your database (e.g., ClickHouse Dictionaries).

However, if you need the data embedded in the flow record itself, GoFlow2 includes a GeoIP enricher implementation here: https://github.com/netsampler/goflow2/blob/main/cmd/enricher/main.go#0 You can use that code as a reference to build a custom component for arbitrary enrichment.