From 391de230b58295e11517e5ce34b728cef130c977 Mon Sep 17 00:00:00 2001
From: Neil McKee <neil.mckee@inmon.com>
Date: Mon, 18 Sep 2023 15:49:58 -0700
Subject: [PATCH] bugfix in VXLAN decode

---
 src/Linux/mod_tcp.c     | 8 +++++++-
 src/Linux/readPackets.c | 2 +-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/Linux/mod_tcp.c b/src/Linux/mod_tcp.c
index ccfe9f7..026856a 100644
--- a/src/Linux/mod_tcp.c
+++ b/src/Linux/mod_tcp.c
@@ -140,6 +140,8 @@ extern "C" {
     UTArray *samples; // HSPPendingSample
     SFLAddress src;
     SFLAddress dst;
+    uint16_t sport;
+    uint16_t dport;
     bool flipped:1;
     bool udp:1;
     struct inet_diag_req_v2 conn_req;
@@ -182,9 +184,11 @@ extern "C" {
   static char *tcpSamplePrint(HSPTCPSample *ts) {
     static char buf[128];
     char ip1[51],ip2[51];
-    snprintf(buf, 128, "TCPSample: %s - %s samples:%u %s",
+    snprintf(buf, 128, "TCPSample: %s:%u - %s:%u samples:%u %s",
 	     SFLAddress_print(&ts->src, ip1, 50),
+	     ts->sport,
 	     SFLAddress_print(&ts->dst, ip2, 50),
+	     ts->dport,
 	     UTArrayN(ts->samples),
 	     ts->flipped ? "FLIPPED": "");
     return buf;
@@ -664,6 +668,8 @@ extern "C" {
       }
     }
     // L4 ports
+    tcpSample->sport = sport;
+    tcpSample->dport = dport;
     if(localSrc) {
       sockid->idiag_sport = htons(sport);
       sockid->idiag_dport = htons(dport);
diff --git a/src/Linux/readPackets.c b/src/Linux/readPackets.c
index 13fa102..c8fec23 100644
--- a/src/Linux/readPackets.c
+++ b/src/Linux/readPackets.c
@@ -806,7 +806,7 @@ extern "C" {
   }
   
   static void decodePendingSample_vxlan(HSPPendingSample *ps) {
-    int ip_offset_1 = ps->l4_offset + 8 /* udp */ + 8 /* vxlan */ + 12 /* inner MAC */;
+    int ip_offset_1 = ps->l4_offset + 8 /* udp */ + 8 /* vxlan */ + 14 /* inner MAC */;
     if(ps->ipproto == IPPROTO_UDP
        && ps->hdr_len >= ip_offset_1) {
       // Check for VXLAN(4789|8472) header at l4_offset,