ftdecode.c

netflow,抓包

    }

  } /* for */

  return ftpdu->ftd.count;

} /* fts3rec_pdu_v8_1_decode */

/*
 * function: fts3rec_pdu_v8_2_decode
 *
 * subfunction to fts3rec_pdu_decode
 *
 * returns: # of stream records decoded
*/
int fts3rec_pdu_v8_2_decode(struct ftpdu *ftpdu)
{
  int n;
  struct ftpdu_header *ph;
  struct ftpdu_v8_2 *pdu_v8_2;
  struct fts3rec_v8_2 *rec_v8_2;

  ftpdu->ftd.rec_size = sizeof (struct fts3rec_v8_2);
  pdu_v8_2 = (struct ftpdu_v8_2*)&ftpdu->buf;
  ph = (struct ftpdu_header*)&ftpdu->buf;

  /* preswap */
  if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {
    SWAPINT32(ph->sysUpTime);
    SWAPINT32(ph->unix_secs);
    SWAPINT32(ph->unix_nsecs);
  }

  for (n = 0; n < pdu_v8_2->count; ++n) {

    rec_v8_2 = (struct fts3rec_v8_2*) (ftpdu->ftd.buf +
      (n*ftpdu->ftd.rec_size));

    rec_v8_2->unix_nsecs = ph->unix_nsecs;
    rec_v8_2->unix_secs = ph->unix_secs;
    rec_v8_2->sysUpTime = ph->sysUpTime;

    rec_v8_2->engine_type = pdu_v8_2->engine_type;
    rec_v8_2->engine_type = pdu_v8_2->engine_id;

    rec_v8_2->dFlows = pdu_v8_2->records[n].dFlows;
    rec_v8_2->dPkts = pdu_v8_2->records[n].dPkts;
    rec_v8_2->dOctets = pdu_v8_2->records[n].dOctets;
    rec_v8_2->First = pdu_v8_2->records[n].First;
    rec_v8_2->Last = pdu_v8_2->records[n].Last;
    rec_v8_2->srcport = pdu_v8_2->records[n].srcport;
    rec_v8_2->dstport = pdu_v8_2->records[n].dstport;
    rec_v8_2->prot = pdu_v8_2->records[n].prot;

    /* copy in exporter IP */
    rec_v8_2->exaddr = ftpdu->ftd.exporter_ip;

    if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {

      SWAPINT32(rec_v8_2->dFlows);
      SWAPINT32(rec_v8_2->dPkts);
      SWAPINT32(rec_v8_2->dOctets);
      SWAPINT32(rec_v8_2->First);
      SWAPINT32(rec_v8_2->Last);
      SWAPINT16(rec_v8_2->srcport);
      SWAPINT16(rec_v8_2->dstport);

      SWAPINT32(rec_v8_2->exaddr);

    }

  } /* for */

  return ftpdu->ftd.count;

} /* fts3rec_pdu_v8_2_decode */

/*
 * function: fts3rec_pdu_v8_3_decode
 *
 * subfunction to fts3rec_pdu_decode
 *
 * returns: # of stream records decoded
*/
int fts3rec_pdu_v8_3_decode(struct ftpdu *ftpdu)
{
  int n;
  struct ftpdu_header *ph;
  struct ftpdu_v8_3 *pdu_v8_3;
  struct fts3rec_v8_3 *rec_v8_3;

  ftpdu->ftd.rec_size = sizeof (struct fts3rec_v8_3);
  pdu_v8_3 = (struct ftpdu_v8_3*)&ftpdu->buf;
  ph = (struct ftpdu_header*)&ftpdu->buf;

  /* preswap */
  if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {
    SWAPINT32(ph->sysUpTime);
    SWAPINT32(ph->unix_secs);
    SWAPINT32(ph->unix_nsecs);
  }

  for (n = 0; n < pdu_v8_3->count; ++n) {

    rec_v8_3 = (struct fts3rec_v8_3*) (ftpdu->ftd.buf +
      (n*ftpdu->ftd.rec_size));

    rec_v8_3->unix_nsecs = ph->unix_nsecs;
    rec_v8_3->unix_secs = ph->unix_secs;
    rec_v8_3->sysUpTime = ph->sysUpTime;

    rec_v8_3->engine_type = pdu_v8_3->engine_type;
    rec_v8_3->engine_type = pdu_v8_3->engine_id;

    rec_v8_3->dFlows = pdu_v8_3->records[n].dFlows;
    rec_v8_3->dPkts = pdu_v8_3->records[n].dPkts;
    rec_v8_3->dOctets = pdu_v8_3->records[n].dOctets;
    rec_v8_3->First = pdu_v8_3->records[n].First;
    rec_v8_3->Last = pdu_v8_3->records[n].Last;
    rec_v8_3->srcaddr = pdu_v8_3->records[n].src_prefix;
    rec_v8_3->src_mask = pdu_v8_3->records[n].src_mask;
    rec_v8_3->src_as = pdu_v8_3->records[n].src_as;
    rec_v8_3->input = pdu_v8_3->records[n].input;

    /* perform AS substitution */
    rec_v8_3->src_as = (rec_v8_3->src_as) ? rec_v8_3->src_as :
      ftpdu->ftd.as_sub;

    /* copy in exporter IP */
    rec_v8_3->exaddr = ftpdu->ftd.exporter_ip;

    if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {

      SWAPINT32(rec_v8_3->dFlows);
      SWAPINT32(rec_v8_3->dPkts);
      SWAPINT32(rec_v8_3->dOctets);
      SWAPINT32(rec_v8_3->First);
      SWAPINT32(rec_v8_3->Last);
      SWAPINT32(rec_v8_3->srcaddr);
      SWAPINT16(rec_v8_3->src_as);
      SWAPINT16(rec_v8_3->input);

      SWAPINT32(rec_v8_3->exaddr);

    }

  } /* for */

  return ftpdu->ftd.count;

} /* fts3rec_pdu_v8_3_decode */

/*
 * function: fts3rec_pdu_v8_4_decode
 *
 * subfunction to fts3rec_pdu_decode
 *
 * returns: # of stream records decoded
*/
int fts3rec_pdu_v8_4_decode(struct ftpdu *ftpdu)
{
  int n;
  struct ftpdu_header *ph;
  struct ftpdu_v8_4 *pdu_v8_4;
  struct fts3rec_v8_4 *rec_v8_4;

  ftpdu->ftd.rec_size = sizeof (struct fts3rec_v8_4);
  pdu_v8_4 = (struct ftpdu_v8_4*)&ftpdu->buf;
  ph = (struct ftpdu_header*)&ftpdu->buf;

  /* preswap */
  if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {
    SWAPINT32(ph->sysUpTime);
    SWAPINT32(ph->unix_secs);
    SWAPINT32(ph->unix_nsecs);
  }

  for (n = 0; n < pdu_v8_4->count; ++n) {

    rec_v8_4 = (struct fts3rec_v8_4*) (ftpdu->ftd.buf +
      (n*ftpdu->ftd.rec_size));

    rec_v8_4->unix_nsecs = ph->unix_nsecs;
    rec_v8_4->unix_secs = ph->unix_secs;
    rec_v8_4->sysUpTime = ph->sysUpTime;

    rec_v8_4->engine_type = pdu_v8_4->engine_type;
    rec_v8_4->engine_type = pdu_v8_4->engine_id;

    rec_v8_4->dFlows = pdu_v8_4->records[n].dFlows;
    rec_v8_4->dPkts = pdu_v8_4->records[n].dPkts;
    rec_v8_4->dOctets = pdu_v8_4->records[n].dOctets;
    rec_v8_4->First = pdu_v8_4->records[n].First;
    rec_v8_4->Last = pdu_v8_4->records[n].Last;
    rec_v8_4->dstaddr = pdu_v8_4->records[n].dst_prefix;
    rec_v8_4->dst_mask = pdu_v8_4->records[n].dst_mask;
    rec_v8_4->dst_as = pdu_v8_4->records[n].dst_as;
    rec_v8_4->output = pdu_v8_4->records[n].output;

    /* perform AS substitution */
    rec_v8_4->dst_as = (rec_v8_4->dst_as) ? rec_v8_4->dst_as :
      ftpdu->ftd.as_sub;

    /* copy in exporter IP */
    rec_v8_4->exaddr = ftpdu->ftd.exporter_ip;

    if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {

      SWAPINT32(rec_v8_4->dFlows);
      SWAPINT32(rec_v8_4->dPkts);
      SWAPINT32(rec_v8_4->dOctets);
      SWAPINT32(rec_v8_4->First);
      SWAPINT32(rec_v8_4->Last);
      SWAPINT32(rec_v8_4->dstaddr);
      SWAPINT16(rec_v8_4->dst_as);
      SWAPINT16(rec_v8_4->output);

      SWAPINT32(rec_v8_4->exaddr);

    }

  } /* for */

  return ftpdu->ftd.count;

} /* fts3rec_pdu_v8_4_decode */

/*
 * function: fts3rec_pdu_v8_5_decode
 *
 * subfunction to fts3rec_pdu_decode
 *
 * returns: # of stream records decoded
*/
int fts3rec_pdu_v8_5_decode(struct ftpdu *ftpdu)
{
  int n;
  struct ftpdu_header *ph;
  struct ftpdu_v8_5 *pdu_v8_5;
  struct fts3rec_v8_5 *rec_v8_5;

  ftpdu->ftd.rec_size = sizeof (struct fts3rec_v8_5);
  pdu_v8_5 = (struct ftpdu_v8_5*)&ftpdu->buf;
  ph = (struct ftpdu_header*)&ftpdu->buf;

  /* preswap */
  if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {
    SWAPINT32(ph->sysUpTime);
    SWAPINT32(ph->unix_secs);
    SWAPINT32(ph->unix_nsecs);
  }

  for (n = 0; n < pdu_v8_5->count; ++n) {

    rec_v8_5 = (struct fts3rec_v8_5*) (ftpdu->ftd.buf +
      (n*ftpdu->ftd.rec_size));

    rec_v8_5->unix_nsecs = ph->unix_nsecs;
    rec_v8_5->unix_secs = ph->unix_secs;
    rec_v8_5->sysUpTime = ph->sysUpTime;

    rec_v8_5->engine_type = pdu_v8_5->engine_type;
    rec_v8_5->engine_type = pdu_v8_5->engine_id;

    rec_v8_5->dFlows = pdu_v8_5->records[n].dFlows;
    rec_v8_5->dPkts = pdu_v8_5->records[n].dPkts;
    rec_v8_5->dOctets = pdu_v8_5->records[n].dOctets;
    rec_v8_5->First = pdu_v8_5->records[n].First;
    rec_v8_5->Last = pdu_v8_5->records[n].Last;
    rec_v8_5->srcaddr = pdu_v8_5->records[n].src_prefix;
    rec_v8_5->dstaddr = pdu_v8_5->records[n].dst_prefix;
    rec_v8_5->src_mask = pdu_v8_5->records[n].src_mask;
    rec_v8_5->dst_mask = pdu_v8_5->records[n].dst_mask;
    rec_v8_5->src_as = pdu_v8_5->records[n].src_as;
    rec_v8_5->dst_as = pdu_v8_5->records[n].dst_as;
    rec_v8_5->input = pdu_v8_5->records[n].input;
    rec_v8_5->output = pdu_v8_5->records[n].output;

    /* perform AS substitution */
    rec_v8_5->src_as = (rec_v8_5->src_as) ? rec_v8_5->src_as :
      ftpdu->ftd.as_sub;
    rec_v8_5->dst_as = (rec_v8_5->dst_as) ? rec_v8_5->dst_as :
      ftpdu->ftd.as_sub;

    /* copy in exporter IP */
    rec_v8_5->exaddr = ftpdu->ftd.exporter_ip;

    if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {

      SWAPINT32(rec_v8_5->dFlows);
      SWAPINT32(rec_v8_5->dPkts);
      SWAPINT32(rec_v8_5->dOctets);
      SWAPINT32(rec_v8_5->First);
      SWAPINT32(rec_v8_5->Last);
      SWAPINT32(rec_v8_5->srcaddr);
      SWAPINT32(rec_v8_5->dstaddr);
      SWAPINT16(rec_v8_5->src_as);
      SWAPINT16(rec_v8_5->dst_as);
      SWAPINT16(rec_v8_5->input);
      SWAPINT16(rec_v8_5->output);

      SWAPINT32(rec_v8_5->exaddr);

    }

  } /* for */

  return ftpdu->ftd.count;

} /* fts3rec_pdu_v8_5_decode */

/*
 * function: fts3rec_pdu_v8_6_decode
 *
 * subfunction to fts3rec_pdu_decode
 *
 * returns: # of stream records decoded
*/
int fts3rec_pdu_v8_6_decode(struct ftpdu *ftpdu)
{
  int n;
  struct ftpdu_header *ph;
  struct ftpdu_v8_6 *pdu_v8_6;
  struct fts3rec_v8_6 *rec_v8_6;

  ftpdu->ftd.rec_size = sizeof (struct fts3rec_v8_6);
  pdu_v8_6 = (struct ftpdu_v8_6*)&ftpdu->buf;
  ph = (struct ftpdu_header*)&ftpdu->buf;

  /* preswap */
  if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {
    SWAPINT32(ph->sysUpTime);
    SWAPINT32(ph->unix_secs);
    SWAPINT32(ph->unix_nsecs);
  }

  for (n = 0; n < pdu_v8_6->count; ++n) {

    rec_v8_6 = (struct fts3rec_v8_6*) (ftpdu->ftd.buf +
      (n*ftpdu->ftd.rec_size));

    rec_v8_6->unix_nsecs = ph->unix_nsecs;
    rec_v8_6->unix_secs = ph->unix_secs;
    rec_v8_6->sysUpTime = ph->sysUpTime;

    rec_v8_6->engine_type = pdu_v8_6->engine_type;
    rec_v8_6->engine_type = pdu_v8_6->engine_id;

    rec_v8_6->dPkts = pdu_v8_6->records[n].dPkts;
    rec_v8_6->dOctets = pdu_v8_6->records[n].dOctets;
    rec_v8_6->First = pdu_v8_6->records[n].First;
    rec_v8_6->Last = pdu_v8_6->records[n].Last;
    rec_v8_6->dstaddr = pdu_v8_6->records[n].dstaddr;
    rec_v8_6->extra_pkts = pdu_v8_6->records[n].extra_pkts;
    rec_v8_6->router_sc = pdu_v8_6->records[n].router_sc;
    rec_v8_6->output = pdu_v8_6->records[n].output;
    rec_v8_6->tos = pdu_v8_6->records[n].tos;
    rec_v8_6->marked_tos = pdu_v8_6->records[n].marked_tos;

    /* copy in exporter IP */
    rec_v8_6->exaddr = ftpdu->ftd.exporter_ip;

    if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {

      SWAPINT32(rec_v8_6->dPkts);
      SWAPINT32(rec_v8_6->dOctets);
      SWAPINT32(rec_v8_6->First);
      SWAPINT32(rec_v8_6->Last);
      SWAPINT32(rec_v8_6->dstaddr);
      SWAPINT32(rec_v8_6->extra_pkts);
      SWAPINT32(rec_v8_6->router_sc);
      SWAPINT16(rec_v8_6->output);

      SWAPINT32(rec_v8_6->exaddr);

    }

  } /* for */

  return ftpdu->ftd.count;

} /* fts3rec_pdu_v8_6_decode */

/*
 * function: fts3rec_pdu_v8_7_decode
 *
 * subfunction to fts3rec_pdu_decode
 *
 * returns: # of stream records decoded
*/
int fts3rec_pdu_v8_7_decode(struct ftpdu *ftpdu)
{
  int n;
  struct ftpdu_header *ph;
  struct ftpdu_v8_7 *pdu_v8_7;
  struct fts3rec_v8_7 *rec_v8_7;

  ftpdu->ftd.rec_size = sizeof (struct fts3rec_v8_7);
  pdu_v8_7 = (struct ftpdu_v8_7*)&ftpdu->buf;
  ph = (struct ftpdu_header*)&ftpdu->buf;

  /* preswap */
  if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {
    SWAPINT32(ph->sysUpTime);
    SWAPINT32(ph->unix_secs);
    SWAPINT32(ph->unix_nsecs);
  }

  for (n = 0; n < pdu_v8_7->count; ++n) {

    rec_v8_7 = (struct fts3rec_v8_7*) (ftpdu->ftd.buf +
      (n*ftpdu->ftd.rec_size));

    rec_v8_7->unix_nsecs = ph->unix_nsecs;
    rec_v8_7->unix_secs = ph->unix_secs;
    rec_v8_7->sysUpTime = ph->sysUpTime;

    rec_v8_7->engine_type = pdu_v8_7->engine_type;
    rec_v8_7->engine_type = pdu_v8_7->engine_id;

    rec_v8_7->dPkts = pdu_v8_7->records[n].dPkts;
    rec_v8_7->dOctets = pdu_v8_7->records[n].dOctets;
    rec_v8_7->First = pdu_v8_7->records[n].First;
    rec_v8_7->Last = pdu_v8_7->records[n].Last;
    rec_v8_7->dstaddr = pdu_v8_7->records[n].dstaddr;
    rec_v8_7->srcaddr = pdu_v8_7->records[n].srcaddr;
    rec_v8_7->extra_pkts = pdu_v8_7->records[n].extra_pkts;
    rec_v8_7->router_sc = pdu_v8_7->records[n].router_sc;
    rec_v8_7->output = pdu_v8_7->records[n].output;
    rec_v8_7->input = pdu_v8_7->records[n].input;
    rec_v8_7->tos = pdu_v8_7->records[n].tos;
    rec_v8_7->marked_tos = pdu_v8_7->records[n].marked_tos;

    /* copy in exporter IP */
    rec_v8_7->exaddr = ftpdu->ftd.exporter_ip;

    if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {

      SWAPINT32(rec_v8_7->dPkts);
      SWAPINT32(rec_v8_7->dOctets);
      SWAPINT32(rec_v8_7->First);
      SWAPINT32(rec_v8_7->Last);
      SWAPINT32(rec_v8_7->dstaddr);
      SWAPINT32(rec_v8_7->srcaddr);
      SWAPINT32(rec_v8_7->extra_pkts);
      SWAPINT32(rec_v8_7->router_sc);
      SWAPINT16(rec_v8_7->output);
      SWAPINT16(rec_v8_7->input);

      SWAPINT32(rec_v8_7->exaddr);

    }

  } /* for */

  return ftpdu->ftd.count;

} /* fts3rec_pdu_v8_7_decode */

/*
 * function: fts3rec_pdu_v8_8_decode
 *
 * subfunction to fts3rec_pdu_decode
 *
 * returns: # of stream records decoded
*/
int fts3rec_pdu_v8_8_decode(struct ftpdu *ftpdu)
{
  int n;
  struct ftpdu_header *ph;
  struct ftpdu_v8_8 *pdu_v8_8;
  struct fts3rec_v8_8 *rec_v8_8;

  ftpdu->ftd.rec_size = sizeof (struct fts3rec_v8_8);
  pdu_v8_8 = (struct ftpdu_v8_8*)&ftpdu->buf;
  ph = (struct ftpdu_header*)&ftpdu->buf;

  /* preswap */
  if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {
    SWAPINT32(ph->sysUpTime);
    SWAPINT32(ph->unix_secs);
    SWAPINT32(ph->unix_nsecs);
  }

  for (n = 0; n < pdu_v8_8->count; ++n) {

    rec_v8_8 = (struct fts3rec_v8_8*) (ftpdu->ftd.buf +
      (n*ftpdu->ftd.rec_size));

    rec_v8_8->unix_nsecs = ph->unix_nsecs;
    rec_v8_8->unix_secs = ph->unix_secs;
    rec_v8_8->sysUpTime = ph->sysUpTime;

    rec_v8_8->engine_type = pdu_v8_8->engine_type;
    rec_v8_8->engine_type = pdu_v8_8->engine_id;

    rec_v8_8->dstaddr = pdu_v8_8->records[n].dstaddr;
    rec_v8_8->srcaddr = pdu_v8_8->records[n].srcaddr;
    rec_v8_8->dstport = pdu_v8_8->records[n].dstport;
    rec_v8_8->srcport = pdu_v8_8->records[n].srcport;
    rec_v8_8->dPkts = pdu_v8_8->records[n].dPkts;
    rec_v8_8->dOctets = pdu_v8_8->records[n].dOctets;
    rec_v8_8->First = pdu_v8_8->records[n].First;
    rec_v8_8->Last = pdu_v8_8->records[n].Last;