ftdecode.c

netflow,抓包

    rec_v8_8->output = pdu_v8_8->records[n].output;
    rec_v8_8->input = pdu_v8_8->records[n].input;
    rec_v8_8->tos = pdu_v8_8->records[n].tos;
    rec_v8_8->prot = pdu_v8_8->records[n].prot;
    rec_v8_8->marked_tos = pdu_v8_8->records[n].marked_tos;
    rec_v8_8->extra_pkts = pdu_v8_8->records[n].extra_pkts;
    rec_v8_8->router_sc = pdu_v8_8->records[n].router_sc;

    /* copy in exporter IP */
    rec_v8_8->exaddr = ftpdu->ftd.exporter_ip;

    if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {

      SWAPINT32(rec_v8_8->dstaddr);
      SWAPINT32(rec_v8_8->srcaddr);
      SWAPINT16(rec_v8_8->dstport);
      SWAPINT16(rec_v8_8->srcport);
      SWAPINT32(rec_v8_8->dPkts);
      SWAPINT32(rec_v8_8->dOctets);
      SWAPINT32(rec_v8_8->First);
      SWAPINT32(rec_v8_8->Last);
      SWAPINT16(rec_v8_8->output);
      SWAPINT16(rec_v8_8->input);
      SWAPINT32(rec_v8_8->extra_pkts);
      SWAPINT32(rec_v8_8->router_sc);

      SWAPINT32(rec_v8_8->exaddr);

    }

  } /* for */

  return ftpdu->ftd.count;

} /* fts3rec_pdu_v8_8_decode */

/*
 * function: fts3rec_pdu_v8_9_decode
 *
 * subfunction to fts3rec_pdu_decode
 *
 * returns: # of stream records decoded
*/
int fts3rec_pdu_v8_9_decode(struct ftpdu *ftpdu)
{
  int n;
  struct ftpdu_header *ph;
  struct ftpdu_v8_9 *pdu_v8_9;
  struct fts3rec_v8_9 *rec_v8_9;

  ftpdu->ftd.rec_size = sizeof (struct fts3rec_v8_9);
  pdu_v8_9 = (struct ftpdu_v8_9*)&ftpdu->buf;
  ph = (struct ftpdu_header*)&ftpdu->buf;

  /* preswap */
  if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {
    SWAPINT32(ph->sysUpTime);
    SWAPINT32(ph->unix_secs);
    SWAPINT32(ph->unix_nsecs);
  }

  for (n = 0; n < pdu_v8_9->count; ++n) {

    rec_v8_9 = (struct fts3rec_v8_9*) (ftpdu->ftd.buf +
      (n*ftpdu->ftd.rec_size));

    rec_v8_9->unix_nsecs = ph->unix_nsecs;
    rec_v8_9->unix_secs = ph->unix_secs;
    rec_v8_9->sysUpTime = ph->sysUpTime;

    rec_v8_9->engine_type = pdu_v8_9->engine_type;
    rec_v8_9->engine_type = pdu_v8_9->engine_id;

    rec_v8_9->dFlows = pdu_v8_9->records[n].dFlows;
    rec_v8_9->dPkts = pdu_v8_9->records[n].dPkts;
    rec_v8_9->dOctets = pdu_v8_9->records[n].dOctets;
    rec_v8_9->First = pdu_v8_9->records[n].First;
    rec_v8_9->Last = pdu_v8_9->records[n].Last;
    rec_v8_9->src_as = pdu_v8_9->records[n].src_as;
    rec_v8_9->dst_as = pdu_v8_9->records[n].dst_as;
    rec_v8_9->input = pdu_v8_9->records[n].input;
    rec_v8_9->output = pdu_v8_9->records[n].output;
    rec_v8_9->tos = pdu_v8_9->records[n].tos;

    /* perform AS substitution */
    rec_v8_9->src_as = (rec_v8_9->src_as) ? rec_v8_9->src_as :
      ftpdu->ftd.as_sub;
    rec_v8_9->dst_as = (rec_v8_9->dst_as) ? rec_v8_9->dst_as :
      ftpdu->ftd.as_sub;

    /* copy in exporter IP */
    rec_v8_9->exaddr = ftpdu->ftd.exporter_ip;

    if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {

      SWAPINT32(rec_v8_9->dFlows);
      SWAPINT32(rec_v8_9->dPkts);
      SWAPINT32(rec_v8_9->dOctets);
      SWAPINT32(rec_v8_9->First);
      SWAPINT32(rec_v8_9->Last);
      SWAPINT16(rec_v8_9->src_as);
      SWAPINT16(rec_v8_9->dst_as);
      SWAPINT16(rec_v8_9->input);
      SWAPINT16(rec_v8_9->output);

      SWAPINT32(rec_v8_9->exaddr);

    }

  } /* for */

  return ftpdu->ftd.count;

} /* fts3rec_pdu_v8_9_decode */

/*
 * function: fts3rec_pdu_v8_10_decode
 *
 * subfunction to fts3rec_pdu_decode
 *
 * returns: # of stream records decoded
*/
int fts3rec_pdu_v8_10_decode(struct ftpdu *ftpdu)
{
  int n;
  struct ftpdu_header *ph;
  struct ftpdu_v8_10 *pdu_v8_10;
  struct fts3rec_v8_10 *rec_v8_10;

  ftpdu->ftd.rec_size = sizeof (struct fts3rec_v8_10);
  pdu_v8_10 = (struct ftpdu_v8_10*)&ftpdu->buf;
  ph = (struct ftpdu_header*)&ftpdu->buf;

  /* preswap */
  if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {
    SWAPINT32(ph->sysUpTime);
    SWAPINT32(ph->unix_secs);
    SWAPINT32(ph->unix_nsecs);
  }

  for (n = 0; n < pdu_v8_10->count; ++n) {

    rec_v8_10 = (struct fts3rec_v8_10*) (ftpdu->ftd.buf +
      (n*ftpdu->ftd.rec_size));

    rec_v8_10->unix_nsecs = ph->unix_nsecs;
    rec_v8_10->unix_secs = ph->unix_secs;
    rec_v8_10->sysUpTime = ph->sysUpTime;

    rec_v8_10->engine_type = pdu_v8_10->engine_type;
    rec_v8_10->engine_type = pdu_v8_10->engine_id;

    rec_v8_10->dFlows = pdu_v8_10->records[n].dFlows;
    rec_v8_10->dPkts = pdu_v8_10->records[n].dPkts;
    rec_v8_10->dOctets = pdu_v8_10->records[n].dOctets;
    rec_v8_10->First = pdu_v8_10->records[n].First;
    rec_v8_10->Last = pdu_v8_10->records[n].Last;
    rec_v8_10->prot = pdu_v8_10->records[n].prot;
    rec_v8_10->tos = pdu_v8_10->records[n].tos;
    rec_v8_10->srcport = pdu_v8_10->records[n].srcport;
    rec_v8_10->dstport = pdu_v8_10->records[n].dstport;
    rec_v8_10->prot = pdu_v8_10->records[n].prot;

    /* copy in exporter IP */
    rec_v8_10->exaddr = ftpdu->ftd.exporter_ip;

    if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {

      SWAPINT32(rec_v8_10->dFlows);
      SWAPINT32(rec_v8_10->dPkts);
      SWAPINT32(rec_v8_10->dOctets);
      SWAPINT32(rec_v8_10->First);
      SWAPINT32(rec_v8_10->Last);
      SWAPINT16(rec_v8_10->srcport);
      SWAPINT16(rec_v8_10->dstport);

      SWAPINT32(rec_v8_10->exaddr);

    }

  } /* for */

  return ftpdu->ftd.count;

} /* fts3rec_pdu_v8_10_decode */

/*
 * function: fts3rec_pdu_v8_11_decode
 *
 * subfunction to fts3rec_pdu_decode
 *
 * returns: # of stream records decoded
*/
int fts3rec_pdu_v8_11_decode(struct ftpdu *ftpdu)
{
  int n;
  struct ftpdu_header *ph;
  struct ftpdu_v8_11 *pdu_v8_11;
  struct fts3rec_v8_11 *rec_v8_11;

  ftpdu->ftd.rec_size = sizeof (struct fts3rec_v8_11);
  pdu_v8_11 = (struct ftpdu_v8_11*)&ftpdu->buf;
  ph = (struct ftpdu_header*)&ftpdu->buf;

  /* preswap */
  if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {
    SWAPINT32(ph->sysUpTime);
    SWAPINT32(ph->unix_secs);
    SWAPINT32(ph->unix_nsecs);
  }

  for (n = 0; n < pdu_v8_11->count; ++n) {

    rec_v8_11 = (struct fts3rec_v8_11*) (ftpdu->ftd.buf +
      (n*ftpdu->ftd.rec_size));

    rec_v8_11->unix_nsecs = ph->unix_nsecs;
    rec_v8_11->unix_secs = ph->unix_secs;
    rec_v8_11->sysUpTime = ph->sysUpTime;

    rec_v8_11->engine_type = pdu_v8_11->engine_type;
    rec_v8_11->engine_type = pdu_v8_11->engine_id;

    rec_v8_11->dFlows = pdu_v8_11->records[n].dFlows;
    rec_v8_11->dPkts = pdu_v8_11->records[n].dPkts;
    rec_v8_11->dOctets = pdu_v8_11->records[n].dOctets;
    rec_v8_11->First = pdu_v8_11->records[n].First;
    rec_v8_11->Last = pdu_v8_11->records[n].Last;
    rec_v8_11->srcaddr = pdu_v8_11->records[n].src_prefix;
    rec_v8_11->src_mask = pdu_v8_11->records[n].src_mask;
    rec_v8_11->tos = pdu_v8_11->records[n].tos;
    rec_v8_11->src_as = pdu_v8_11->records[n].src_as;
    rec_v8_11->input = pdu_v8_11->records[n].input;

    /* perform AS substitution */
    rec_v8_11->src_as = (rec_v8_11->src_as) ? rec_v8_11->src_as :
      ftpdu->ftd.as_sub;

    /* copy in exporter IP */
    rec_v8_11->exaddr = ftpdu->ftd.exporter_ip;

    if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {

      SWAPINT32(rec_v8_11->dFlows);
      SWAPINT32(rec_v8_11->dPkts);
      SWAPINT32(rec_v8_11->dOctets);
      SWAPINT32(rec_v8_11->First);
      SWAPINT32(rec_v8_11->Last);
      SWAPINT32(rec_v8_11->srcaddr);
      SWAPINT16(rec_v8_11->src_as);
      SWAPINT16(rec_v8_11->input);

      SWAPINT32(rec_v8_11->exaddr);

    }

  } /* for */

  return ftpdu->ftd.count;

} /* fts3rec_pdu_v8_11_decode */

/*
 * function: fts3rec_pdu_v8_12_decode
 *
 * subfunction to fts3rec_pdu_decode
 *
 * returns: # of stream records decoded
*/
int fts3rec_pdu_v8_12_decode(struct ftpdu *ftpdu)
{
  int n;
  struct ftpdu_header *ph;
  struct ftpdu_v8_12 *pdu_v8_12;
  struct fts3rec_v8_12 *rec_v8_12;

  ftpdu->ftd.rec_size = sizeof (struct fts3rec_v8_12);
  pdu_v8_12 = (struct ftpdu_v8_12*)&ftpdu->buf;
  ph = (struct ftpdu_header*)&ftpdu->buf;

  /* preswap */
  if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {
    SWAPINT32(ph->sysUpTime);
    SWAPINT32(ph->unix_secs);
    SWAPINT32(ph->unix_nsecs);
  }

  for (n = 0; n < pdu_v8_12->count; ++n) {

    rec_v8_12 = (struct fts3rec_v8_12*) (ftpdu->ftd.buf +
      (n*ftpdu->ftd.rec_size));

    rec_v8_12->unix_nsecs = ph->unix_nsecs;
    rec_v8_12->unix_secs = ph->unix_secs;
    rec_v8_12->sysUpTime = ph->sysUpTime;

    rec_v8_12->engine_type = pdu_v8_12->engine_type;
    rec_v8_12->engine_type = pdu_v8_12->engine_id;

    rec_v8_12->dFlows = pdu_v8_12->records[n].dFlows;
    rec_v8_12->dPkts = pdu_v8_12->records[n].dPkts;
    rec_v8_12->dOctets = pdu_v8_12->records[n].dOctets;
    rec_v8_12->First = pdu_v8_12->records[n].First;
    rec_v8_12->Last = pdu_v8_12->records[n].Last;
    rec_v8_12->dstaddr = pdu_v8_12->records[n].dst_prefix;
    rec_v8_12->tos = pdu_v8_12->records[n].tos;
    rec_v8_12->dst_mask = pdu_v8_12->records[n].dst_mask;
    rec_v8_12->dst_as = pdu_v8_12->records[n].dst_as;
    rec_v8_12->output = pdu_v8_12->records[n].output;

    /* perform AS substitution */
    rec_v8_12->dst_as = (rec_v8_12->dst_as) ? rec_v8_12->dst_as :
      ftpdu->ftd.as_sub;

    /* copy in exporter IP */
    rec_v8_12->exaddr = ftpdu->ftd.exporter_ip;

    if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {

      SWAPINT32(rec_v8_12->dFlows);
      SWAPINT32(rec_v8_12->dPkts);
      SWAPINT32(rec_v8_12->dOctets);
      SWAPINT32(rec_v8_12->First);
      SWAPINT32(rec_v8_12->Last);
      SWAPINT32(rec_v8_12->dstaddr);
      SWAPINT16(rec_v8_12->dst_as);
      SWAPINT16(rec_v8_12->output);

      SWAPINT32(rec_v8_12->exaddr);

    }

  } /* for */

  return ftpdu->ftd.count;

} /* fts3rec_pdu_v8_12_decode */

/*
 * function: fts3rec_pdu_v8_13_decode
 *
 * subfunction to fts3rec_pdu_decode
 *
 * returns: # of stream records decoded
*/
int fts3rec_pdu_v8_13_decode(struct ftpdu *ftpdu)
{
  int n;
  struct ftpdu_header *ph;
  struct ftpdu_v8_13 *pdu_v8_13;
  struct fts3rec_v8_13 *rec_v8_13;

  ftpdu->ftd.rec_size = sizeof (struct fts3rec_v8_13);
  pdu_v8_13 = (struct ftpdu_v8_13*)&ftpdu->buf;
  ph = (struct ftpdu_header*)&ftpdu->buf;

  /* preswap */
  if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {
    SWAPINT32(ph->sysUpTime);
    SWAPINT32(ph->unix_secs);
    SWAPINT32(ph->unix_nsecs);
  }

  for (n = 0; n < pdu_v8_13->count; ++n) {

    rec_v8_13 = (struct fts3rec_v8_13*) (ftpdu->ftd.buf +
      (n*ftpdu->ftd.rec_size));

    rec_v8_13->unix_nsecs = ph->unix_nsecs;
    rec_v8_13->unix_secs = ph->unix_secs;
    rec_v8_13->sysUpTime = ph->sysUpTime;

    rec_v8_13->engine_type = pdu_v8_13->engine_type;
    rec_v8_13->engine_type = pdu_v8_13->engine_id;

    rec_v8_13->dFlows = pdu_v8_13->records[n].dFlows;
    rec_v8_13->dPkts = pdu_v8_13->records[n].dPkts;
    rec_v8_13->dOctets = pdu_v8_13->records[n].dOctets;
    rec_v8_13->First = pdu_v8_13->records[n].First;
    rec_v8_13->Last = pdu_v8_13->records[n].Last;
    rec_v8_13->srcaddr = pdu_v8_13->records[n].src_prefix;
    rec_v8_13->dstaddr = pdu_v8_13->records[n].dst_prefix;
    rec_v8_13->src_mask = pdu_v8_13->records[n].src_mask;
    rec_v8_13->dst_mask = pdu_v8_13->records[n].dst_mask;
    rec_v8_13->tos = pdu_v8_13->records[n].tos;
    rec_v8_13->src_as = pdu_v8_13->records[n].src_as;
    rec_v8_13->dst_as = pdu_v8_13->records[n].dst_as;
    rec_v8_13->input = pdu_v8_13->records[n].input;
    rec_v8_13->output = pdu_v8_13->records[n].output;

    /* perform AS substitution */
    rec_v8_13->src_as = (rec_v8_13->src_as) ? rec_v8_13->src_as :
      ftpdu->ftd.as_sub;
    rec_v8_13->dst_as = (rec_v8_13->dst_as) ? rec_v8_13->dst_as :
      ftpdu->ftd.as_sub;

    /* copy in exporter IP */
    rec_v8_13->exaddr = ftpdu->ftd.exporter_ip;

    if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {

      SWAPINT32(rec_v8_13->dFlows);
      SWAPINT32(rec_v8_13->dPkts);
      SWAPINT32(rec_v8_13->dOctets);
      SWAPINT32(rec_v8_13->First);
      SWAPINT32(rec_v8_13->Last);
      SWAPINT32(rec_v8_13->srcaddr);
      SWAPINT32(rec_v8_13->dstaddr);
      SWAPINT16(rec_v8_13->src_as);
      SWAPINT16(rec_v8_13->dst_as);
      SWAPINT16(rec_v8_13->input);
      SWAPINT16(rec_v8_13->output);

      SWAPINT32(rec_v8_13->exaddr);

    }

  } /* for */

  return ftpdu->ftd.count;

} /* fts3rec_pdu_v8_13_decode */

/*
 * function: fts3rec_pdu_v8_14_decode
 *
 * subfunction to fts3rec_pdu_decode
 *
 * returns: # of stream records decoded
*/
int fts3rec_pdu_v8_14_decode(struct ftpdu *ftpdu)
{
  int n;
  struct ftpdu_header *ph;
  struct ftpdu_v8_14 *pdu_v8_14;
  struct fts3rec_v8_14 *rec_v8_14;

  ftpdu->ftd.rec_size = sizeof (struct fts3rec_v8_14);
  pdu_v8_14 = (struct ftpdu_v8_14*)&ftpdu->buf;
  ph = (struct ftpdu_header*)&ftpdu->buf;

  /* preswap */
  if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {
    SWAPINT32(ph->sysUpTime);
    SWAPINT32(ph->unix_secs);
    SWAPINT32(ph->unix_nsecs);
  }

  for (n = 0; n < pdu_v8_14->count; ++n) {

    rec_v8_14 = (struct fts3rec_v8_14*) (ftpdu->ftd.buf +
      (n*ftpdu->ftd.rec_size));

    rec_v8_14->unix_nsecs = ph->unix_nsecs;
    rec_v8_14->unix_secs = ph->unix_secs;
    rec_v8_14->sysUpTime = ph->sysUpTime;

    rec_v8_14->engine_type = pdu_v8_14->engine_type;
    rec_v8_14->engine_type = pdu_v8_14->engine_id;

    rec_v8_14->dFlows = pdu_v8_14->records[n].dFlows;
    rec_v8_14->dPkts = pdu_v8_14->records[n].dPkts;
    rec_v8_14->dOctets = pdu_v8_14->records[n].dOctets;
    rec_v8_14->First = pdu_v8_14->records[n].First;
    rec_v8_14->Last = pdu_v8_14->records[n].Last;
    rec_v8_14->srcaddr = pdu_v8_14->records[n].src_prefix;
    rec_v8_14->dstaddr = pdu_v8_14->records[n].dst_prefix;
    rec_v8_14->src_mask = pdu_v8_14->records[n].src_mask;
    rec_v8_14->dst_mask = pdu_v8_14->records[n].dst_mask;
    rec_v8_14->tos = pdu_v8_14->records[n].tos;
    rec_v8_14->prot = pdu_v8_14->records[n].prot;
    rec_v8_14->srcport = pdu_v8_14->records[n].srcport;
    rec_v8_14->dstport = pdu_v8_14->records[n].dstport;
    rec_v8_14->input = pdu_v8_14->records[n].input;
    rec_v8_14->output = pdu_v8_14->records[n].output;

    /* copy in exporter IP */
    rec_v8_14->exaddr = ftpdu->ftd.exporter_ip;

    if (ftpdu->ftd.byte_order == FT_HEADER_LITTLE_ENDIAN) {

      SWAPINT32(rec_v8_14->dFlows);
      SWAPINT32(rec_v8_14->dPkts);
      SWAPINT32(rec_v8_14->dOctets);
      SWAPINT32(rec_v8_14->First);
      SWAPINT32(rec_v8_14->Last);
      SWAPINT32(rec_v8_14->srcaddr);
      SWAPINT32(rec_v8_14->dstaddr);
      SWAPINT16(rec_v8_14->srcport);
      SWAPINT16(rec_v8_14->dstport);
      SWAPINT16(rec_v8_14->input);
      SWAPINT16(rec_v8_14->output);

      SWAPINT32(rec_v8_14->exaddr);

    }

  } /* for */

  return ftpdu->ftd.count;

} /* fts3rec_pdu_v8_14_decode */