ftlib.h

netflow,抓包

  u_int32 unix_secs;  /* Current seconds since 0000 UTC 1970 */
  u_int32 unix_nsecs; /* Residual nanoseconds since 0000 UTC 1970 */
  u_int32 exaddr;     /* Exporter IP address */
  u_int32 sysUpTime;  /* Current time in millisecs since router booted */
  u_int32 dFlows;     /* Number of flows */
  u_int32 dPkts;      /* Packets sent in duration */
  u_int32 dOctets;    /* Octets sent in duration */
  u_int32 First;      /* SysUpTime at start of flow */
  u_int32 Last;       /* and of last packet of flow */
  u_int32 dstaddr;    /* Destination Prefix */
  u_int16 output;     /* output interface index */
  u_int16 dst_as;     /* Destination AS */
  u_int8  dst_mask;   /* Destination Prefix mask length */
  u_int8  tos;        /* ToS */
  u_int8  engine_type;/* Type of flow switching engine (RP,VIP,etc.) */
  u_int8  engine_id;  /* Slot number of the flow switching engine */
};

struct fts3rec_v8_13 {
  u_int32 unix_secs;  /* Current seconds since 0000 UTC 1970 */
  u_int32 unix_nsecs; /* Residual nanoseconds since 0000 UTC 1970 */
  u_int32 sysUpTime;  /* Current time in millisecs since router booted */
  u_int32 exaddr;     /* Exporter IP address */
  u_int32 dFlows;     /* Number of flows */
  u_int32 dPkts;      /* Packets sent in duration */
  u_int32 dOctets;    /* Octets sent in duration */
  u_int32 First;      /* SysUpTime at start of flow */
  u_int32 Last;       /* and of last packet of flow */
  u_int32 srcaddr;    /* Source Prefix */
  u_int32 dstaddr;    /* Destination Prefix */
  u_int16 src_as;     /* Source AS */
  u_int16 dst_as;     /* Destination AS */
  u_int16 input;      /* input interface */
  u_int16 output;     /* output interface */
  u_int8  dst_mask;   /* Destination Prefix mask length */
  u_int8  src_mask;   /* Source Prefix mask length */
  u_int8  engine_type;/* Type of flow switching engine (RP,VIP,etc.) */
  u_int8  engine_id;  /* Slot number of the flow switching engine */
  u_int8  tos;        /* ToS */
  u_int8  pad1;
  u_int16 pad2;
};

struct fts3rec_v8_14 {
  u_int32 unix_secs;  /* Current seconds since 0000 UTC 1970 */
  u_int32 unix_nsecs; /* Residual nanoseconds since 0000 UTC 1970 */
  u_int32 sysUpTime;  /* Current time in millisecs since router booted */
  u_int32 exaddr;     /* Exporter IP address */
  u_int32 dFlows;     /* Number of flows */
  u_int32 dPkts;      /* Packets sent in duration */
  u_int32 dOctets;    /* Octets sent in duration */
  u_int32 First;      /* SysUpTime at start of flow */
  u_int32 Last;       /* and of last packet of flow */
  u_int32 srcaddr;    /* Source Prefix */
  u_int32 dstaddr;    /* Destination Prefix */
  u_int16 srcport;    /* Source Port */
  u_int16 dstport;    /* Destination Port */
  u_int16 input;      /* input interface */
  u_int16 output;     /* output interface */
  u_int8  dst_mask;   /* Destination Prefix mask length */
  u_int8  src_mask;   /* Source Prefix mask length */
  u_int8  engine_type;/* Type of flow switching engine (RP,VIP,etc.) */
  u_int8  engine_id;  /* Slot number of the flow switching engine */
  u_int8  tos;        /* ToS */
  u_int8  prot;       /* IP protocol */
  u_int16 pad2;
};


/*
 * internal formats
*/

/* tagged v5 */
struct fts3rec_v1005 {
  u_int32 unix_secs;      /* Current seconds since 0000 UTC 1970 */
  u_int32 unix_nsecs;     /* Residual nanoseconds since 0000 UTC 1970 */
  u_int32 sysUpTime;      /* Current time in millisecs since router booted */
  u_int32 exaddr;         /* Exporter IP address */
  u_int32 srcaddr;        /* Source IP Address */
  u_int32 dstaddr;        /* Destination IP Address */
  u_int32 nexthop;        /* Next hop router's IP Address */
  u_int16 input;          /* Input interface index */
  u_int16 output;         /* Output interface index */
  u_int32 dPkts;          /* Packets sent in Duration */
  u_int32 dOctets;        /* Octets sent in Duration. */
  u_int32 First;          /* SysUptime at start of flow */
  u_int32 Last;           /* and of last packet of flow */
  u_int16 srcport;        /* TCP/UDP source port number or equivalent */
  u_int16 dstport;        /* TCP/UDP destination port number or equiv */
  u_int8  prot;           /* IP protocol, e.g., 6=TCP, 17=UDP, ... */
  u_int8  tos;            /* IP Type-of-Service */
  u_int8  tcp_flags;      /* OR of TCP header bits */
  u_int8  pad;
  u_int8  engine_type;    /* Type of flow switching engine (RP,VIP,etc.) */
  u_int8  engine_id;      /* Slot number of the flow switching engine */
  u_int8  src_mask;       /* mask length of source address */
  u_int8  dst_mask;       /* mask length of destination address */
  u_int16 src_as;         /* AS of source address */
  u_int16 dst_as;         /* AS of destination address */
  u_int32 src_tag;        /* Local TAG for source address */
  u_int32 dst_tag;        /* Local TAG for destination address */
};

struct fts1rec_compat {
  u_int32 unix_secs;      /* offset from real time the flow started */
  u_int32 unix_msecs;     /* "" */
  u_int32 srcaddr;        /* Source IP Address */
  u_int32 dstaddr;        /* Destination IP Address */
  u_int32 nexthop;        /* Next hop router's IP Address */
  u_int16 input;          /* Input interface index */
  u_int16 output;         /* Output interface index */
  u_int32 dPkts;          /* Packets sent in Duration */
  u_int32 dOctets;        /* Octets sent in Duration. */
  u_int32 First;          /* SysUptime at start of flow */
  u_int32 Last;           /* and of last packet of flow */
  u_int16 srcport;        /* TCP/UDP source port number or equivalent */
  u_int16 dstport;        /* TCP/UDP destination port number or equiv */
  u_int16 pad;
  u_int8  prot;           /* IP protocol, e.g., 6=TCP, 17=UDP, ... */
  u_int8  tos;            /* IP Type-of-Service */
  u_int8  flags;          /* Reason flow was discarded, etc...  */
  u_int8  tcp_retx_cnt;   /* Number of mis-seq with delay > 1sec */
  u_int8  tcp_retx_secs;  /* Cumulative secs between mis-sequenced pkts */
  u_int8  tcp_misseq_cnt; /* Number of mis-sequenced tcp pkts seen */
  u_int16 src_as;         /* originating AS of source address */
  u_int16 dst_as;         /* originating AS of destination address */
  u_int8  src_mask;       /* source address prefix mask bits */
  u_int8  dst_mask;       /* destination address prefix mask bits */
  u_int16 drops;          /* ?? */
};

struct ftio {
  caddr_t mr;                        /* mmap region */
  size_t mr_size;                    /* size of mmap'd region */
  int rec_size;                      /* size of stream record */
  struct ftiheader fth;              /* header */
  char *d_buf;                       /* records */
  u_long d_start;                    /* offset to next byte in d_buf */
  u_long d_end;                      /* available bytes in d_buf */
  char *z_buf;                       /* zlib inflate/deflate buffer */
  int z_level;                       /* compression level */
  z_stream zs;                       /* zlib io */
  int flags;                         /* FT_IO_FLAG_* */
  int fd;                            /* file description of stream */
  u_int64 xfield;                    /* FT_XFIELD* available when reading */
  void (*swapf)(struct ftio *ftio);  /* swap function */
  u_int64 rec_total;                 /* records read/written */
  struct fts3rec_v1 compat_v1;       /* backwards compatability */
  struct fts3rec_v5 compat_v5;       /* backwards compatability */
  struct fts3rec_offsets fo;         /* offsets to fields */
  int debug;
};

struct ftpdu_header_small {
  u_int16 version;      /* 1 for now. */
  u_int16 count;        /* The number of records in the PDU */
};

struct ftpdu_header {
  /* common header for everything except v1 */
  u_int16 version;      /* 1 for now. */
  u_int16 count;        /* The number of records in the PDU */
  u_int32 sysUpTime;    /* Current time in millisecs since router booted */
  u_int32 unix_secs;    /* Current seconds since 0000 UTC 1970 */
  u_int32 unix_nsecs;   /* Residual nanoseconds since 0000 UTC 1970 */
  u_int32 flow_sequence; /* Seq counter of total flows seen */
  u_int8  engine_type;   /* Type of flow switching engine (RP,VIP,etc.) */
  u_int8  engine_id;     /* Slot number of the flow switching engine */
  u_int8  aggregation;   /* Aggregation method being used */
  u_int8  agg_version;   /* Version of the aggregation export */
};

struct ftpdu_v1 {
  /* 16 byte header */
  u_int16 version;      /* 1 for now. */
  u_int16 count;        /* The number of records in the PDU */
  u_int32 sysUpTime;    /* Current time in millisecs since router booted */
  u_int32 unix_secs;    /* Current seconds since 0000 UTC 1970 */
  u_int32 unix_nsecs;   /* Residual nanoseconds since 0000 UTC 1970 */
  /* 48 byte payload */
  struct ftrec_v1 {
    u_int32 srcaddr;        /* Source IP Address */
    u_int32 dstaddr;        /* Destination IP Address */
    u_int32 nexthop;        /* Next hop router's IP Address */
    u_int16 input;          /* Input interface index */
    u_int16 output;         /* Output interface index */
    u_int32 dPkts;          /* Packets sent in Duration */
    u_int32 dOctets;        /* Octets sent in Duration. */
    u_int32 First;          /* SysUptime at start of flow */
    u_int32 Last;           /* and of last packet of flow */
    u_int16 srcport;        /* TCP/UDP source port number or equivalent */
    u_int16 dstport;        /* TCP/UDP destination port number or equiv */
    u_int16 pad;
    u_int8  prot;           /* IP protocol, e.g., 6=TCP, 17=UDP, ... */
    u_int8  tos;            /* IP Type-of-Service */
    u_int8  flags;          /* Reason flow was discarded, etc...  */
    u_int8  tcp_retx_cnt;   /* Number of mis-seq with delay > 1sec */
    u_int8  tcp_retx_secs;  /* Cumulative secs between mis-sequenced pkts */
    u_int8  tcp_misseq_cnt; /* Number of mis-sequenced tcp pkts seen */
    u_int32  reserved;
  } records[FT_PDU_V1_MAXFLOWS];
};

struct ftpdu_v5 {
  /* 24 byte header */
  u_int16 version;       /* 5 */
  u_int16 count;         /* The number of records in the PDU */
  u_int32 sysUpTime;     /* Current time in millisecs since router booted */
  u_int32 unix_secs;     /* Current seconds since 0000 UTC 1970 */
  u_int32 unix_nsecs;    /* Residual nanoseconds since 0000 UTC 1970 */
  u_int32 flow_sequence; /* Seq counter of total flows seen */
  u_int8  engine_type;   /* Type of flow switching engine (RP,VIP,etc.) */
  u_int8  engine_id;     /* Slot number of the flow switching engine */
  u_int16 reserved;
  /* 48 byte payload */
  struct ftrec_v5 {
    u_int32 srcaddr;    /* Source IP Address */
    u_int32 dstaddr;    /* Destination IP Address */
    u_int32 nexthop;    /* Next hop router's IP Address */
    u_int16 input;      /* Input interface index */
    u_int16 output;     /* Output interface index */
    u_int32 dPkts;      /* Packets sent in Duration */
    u_int32 dOctets;    /* Octets sent in Duration. */
    u_int32 First;      /* SysUptime at start of flow */
    u_int32 Last;       /* and of last packet of flow */
    u_int16 srcport;    /* TCP/UDP source port number or equivalent */
    u_int16 dstport;    /* TCP/UDP destination port number or equiv */
    u_int8  pad;
    u_int8  tcp_flags;  /* Cumulative OR of tcp flags */
    u_int8  prot;       /* IP protocol, e.g., 6=TCP, 17=UDP, ... */
    u_int8  tos;        /* IP Type-of-Service */
    u_int16 src_as;     /* originating AS of source address */
    u_int16 dst_as;     /* originating AS of destination address */
    u_int8  src_mask;   /* source address prefix mask bits */
    u_int8  dst_mask;   /* destination address prefix mask bits */
    u_int16 drops;
  } records[FT_PDU_V5_MAXFLOWS];
};

struct ftpdu_v6 {
  /* 24 byte header */
  u_int16 version;       /* 6 */
  u_int16 count;         /* The number of records in the PDU */
  u_int32 sysUpTime;     /* Current time in millisecs since router booted */
  u_int32 unix_secs;     /* Current seconds since 0000 UTC 1970 */
  u_int32 unix_nsecs;    /* Residual nanoseconds since 0000 UTC 1970 */
  u_int32 flow_sequence; /* Seq counter of total flows seen */
  u_int8  engine_type;   /* Type of flow switching engine (RP,VIP,etc.) */
  u_int8  engine_id;     /* Slot number of the flow switching engine */
  u_int16 reserved;
  /* 48 byte payload */
  struct ftrec_v6 {
    u_int32 srcaddr;      /* Source IP Address */
    u_int32 dstaddr;      /* Destination IP Address */
    u_int32 nexthop;      /* Next hop router's IP Address */
    u_int16 input;        /* Input interface index */
    u_int16 output;       /* Output interface index */
    u_int32 dPkts;        /* Packets sent in Duration */
    u_int32 dOctets;      /* Octets sent in Duration. */
    u_int32 First;        /* SysUptime at start of flow */
    u_int32 Last;         /* and of last packet of flow */
    u_int16 srcport;      /* TCP/UDP source port number or equivalent */
    u_int16 dstport;      /* TCP/UDP destination port number or equiv */
    u_int8  pad;
    u_int8  tcp_flags;    /* Cumulative OR of tcp flags */
    u_int8  prot;         /* IP protocol, e.g., 6=TCP, 17=UDP, ... */
    u_int8  tos;          /* IP Type-of-Service */
    u_int16 src_as;       /* originating AS of source address */
    u_int16 dst_as;       /* originating AS of destination address */
    u_int8  src_mask;     /* source address prefix mask bits */
    u_int8  dst_mask;     /* destination address prefix mask bits */
    u_int8  in_encaps;    /* size in bytes of the input encapsulation */
    u_int8  out_encaps;   /* size in bytes of the output encapsulation */
    u_int32 peer_nexthop; /* IP address of the next hop within the peer */
  } records[FT_PDU_V6_MAXFLOWS];
};

struct ftpdu_v7 {
  /* 24 byte header */
  u_int16 version;       /* 7 */
  u_int16 count;         /* The number of records in the PDU */
  u_int32 sysUpTime;     /* Current time in millisecs since router booted */
  u_int32 unix_secs;     /* Current seconds since 0000 UTC 1970 */
  u_int32 unix_nsecs;    /* Residual nanoseconds since 0000 UTC 1970 */
  u_int32 flow_sequence; /* Seq counter of total flows seen */
  u_int8  engine_type;   /* Type of flow switching engine (RP,VIP,etc.) */
  u_int8  engine_id;     /* Slot number of the flow switching engine */
  u_int16 reserved;
  /* 48 byte payload */
  struct ftrec_v7 {
    u_int32 srcaddr;    /* Source IP Address */
    u_int32 dstaddr;    /* Destination IP Address */
    u_int32 nexthop;    /* Next hop router's IP Address */
    u_int16 input;      /* Input interface index */
    u_int16 output;     /* Output interface index */
    u_int32 dPkts;      /* Packets sent in Duration */
    u_int32 dOctets;    /* Octets sent in Duration. */
    u_int32 First;      /* SysUptime at start of flow */
    u_int32 Last;       /* and of last packet of flow */
    u_int16 srcport;    /* TCP/UDP source port number or equivalent */
    u_int16 dstport;    /* TCP/UDP destination port number or equiv */
    u_int8  pad;
    u_int8  tcp_flags;  /* Cumulative OR of tcp flags */
    u_int8  prot;       /* IP protocol, e.g., 6=TCP, 17=UDP, ... */
    u_int8  tos;        /* IP Type-of-Service */
    u_int16 src_as;     /* originating AS of source address */
    u_int16 dst_as;     /* originating AS of destination address */
    u_int8  src_mask;   /* source address prefix mask bits */
    u_int8  dst_mask;   /* destination address prefix mask bits */