ftrec.c

netflow,抓包

      FT_OFFSET(dPkts, fts3rec_v6)
      FT_OFFSET(dOctets, fts3rec_v6)
      FT_OFFSET(First, fts3rec_v6)
      FT_OFFSET(Last, fts3rec_v6)
      FT_OFFSET(srcport, fts3rec_v6)
      FT_OFFSET(dstport, fts3rec_v6)
      FT_OFFSET(prot, fts3rec_v6)
      FT_OFFSET(tos, fts3rec_v6)
      FT_OFFSET(tcp_flags, fts3rec_v6)
      FT_OFFSET(engine_type, fts3rec_v6)
      FT_OFFSET(engine_id, fts3rec_v6)
      FT_OFFSET(src_mask, fts3rec_v6)
      FT_OFFSET(dst_mask, fts3rec_v6)
      FT_OFFSET(src_as, fts3rec_v6)
      FT_OFFSET(dst_as, fts3rec_v6)
      FT_OFFSET(in_encaps, fts3rec_v6)
      FT_OFFSET(out_encaps, fts3rec_v6)
      FT_OFFSET(peer_nexthop, fts3rec_v6)
      ret = 0;
      break;

    case 7:
      FT_OFFSET(unix_secs, fts3rec_v7)
      FT_OFFSET(unix_nsecs, fts3rec_v7)
      FT_OFFSET(sysUpTime, fts3rec_v7)
      FT_OFFSET(exaddr, fts3rec_v7)
      FT_OFFSET(srcaddr, fts3rec_v7)
      FT_OFFSET(dstaddr, fts3rec_v7)
      FT_OFFSET(nexthop, fts3rec_v7)
      FT_OFFSET(input, fts3rec_v7)
      FT_OFFSET(output, fts3rec_v7)
      FT_OFFSET(dPkts, fts3rec_v7)
      FT_OFFSET(dOctets, fts3rec_v7)
      FT_OFFSET(First, fts3rec_v7)
      FT_OFFSET(Last, fts3rec_v7)
      FT_OFFSET(srcport, fts3rec_v7)
      FT_OFFSET(dstport, fts3rec_v7)
      FT_OFFSET(prot, fts3rec_v7)
      FT_OFFSET(tos, fts3rec_v7)
      FT_OFFSET(tcp_flags, fts3rec_v7)
      FT_OFFSET(engine_type, fts3rec_v7)
      FT_OFFSET(engine_id, fts3rec_v7)
      FT_OFFSET(src_mask, fts3rec_v7)
      FT_OFFSET(dst_mask, fts3rec_v7)
      FT_OFFSET(src_as, fts3rec_v7)
      FT_OFFSET(dst_as, fts3rec_v7)
      FT_OFFSET(router_sc, fts3rec_v7)
      ret = 0;
      break;

    case 8:

      switch (ftv->agg_method) {

        case 1:
          FT_OFFSET(unix_secs, fts3rec_v8_1)
          FT_OFFSET(unix_nsecs, fts3rec_v8_1)
          FT_OFFSET(sysUpTime, fts3rec_v8_1)
          FT_OFFSET(exaddr, fts3rec_v8_1)
          FT_OFFSET(dFlows, fts3rec_v8_1)
          FT_OFFSET(dOctets, fts3rec_v8_1)
          FT_OFFSET(dPkts, fts3rec_v8_1)
          FT_OFFSET(First, fts3rec_v8_1)
          FT_OFFSET(Last, fts3rec_v8_1)
          FT_OFFSET(src_as, fts3rec_v8_1)
          FT_OFFSET(dst_as, fts3rec_v8_1)
          FT_OFFSET(input, fts3rec_v8_1)
          FT_OFFSET(output, fts3rec_v8_1)
          FT_OFFSET(engine_id, fts3rec_v8_1)
          FT_OFFSET(engine_type, fts3rec_v8_1)
          ret = 0;
          break;

        case 2:
          FT_OFFSET(unix_secs, fts3rec_v8_2)
          FT_OFFSET(unix_nsecs, fts3rec_v8_2)
          FT_OFFSET(sysUpTime, fts3rec_v8_2)
          FT_OFFSET(exaddr, fts3rec_v8_2)
          FT_OFFSET(dFlows, fts3rec_v8_2)
          FT_OFFSET(dOctets, fts3rec_v8_2)
          FT_OFFSET(dPkts, fts3rec_v8_2)
          FT_OFFSET(First, fts3rec_v8_2)
          FT_OFFSET(Last, fts3rec_v8_2)
          FT_OFFSET(prot, fts3rec_v8_2)
          FT_OFFSET(srcport, fts3rec_v8_2)
          FT_OFFSET(dstport, fts3rec_v8_2)
          FT_OFFSET(engine_id, fts3rec_v8_2)
          FT_OFFSET(engine_type, fts3rec_v8_2)
          ret = 0;
          break;

        case 3:
          FT_OFFSET(unix_secs, fts3rec_v8_3)
          FT_OFFSET(unix_nsecs, fts3rec_v8_3)
          FT_OFFSET(sysUpTime, fts3rec_v8_3)
          FT_OFFSET(exaddr, fts3rec_v8_3)
          FT_OFFSET(dFlows, fts3rec_v8_3)
          FT_OFFSET(dOctets, fts3rec_v8_3)
          FT_OFFSET(dPkts, fts3rec_v8_3)
          FT_OFFSET(First, fts3rec_v8_3)
          FT_OFFSET(Last, fts3rec_v8_3)
          FT_OFFSET(srcaddr, fts3rec_v8_3)
          FT_OFFSET(src_mask, fts3rec_v8_3)
          FT_OFFSET(src_as, fts3rec_v8_3)
          FT_OFFSET(input, fts3rec_v8_3)
          FT_OFFSET(engine_id, fts3rec_v8_3)
          FT_OFFSET(engine_type, fts3rec_v8_3)
          ret = 0;
          break;

        case 4:
          FT_OFFSET(unix_secs, fts3rec_v8_4)
          FT_OFFSET(unix_nsecs, fts3rec_v8_4)
          FT_OFFSET(sysUpTime, fts3rec_v8_4)
          FT_OFFSET(exaddr, fts3rec_v8_4)
          FT_OFFSET(dFlows, fts3rec_v8_4)
          FT_OFFSET(dOctets, fts3rec_v8_4)
          FT_OFFSET(dPkts, fts3rec_v8_4)
          FT_OFFSET(First, fts3rec_v8_4)
          FT_OFFSET(Last, fts3rec_v8_4)
          FT_OFFSET(dstaddr, fts3rec_v8_4)
          FT_OFFSET(dst_mask, fts3rec_v8_4)
          FT_OFFSET(dst_as, fts3rec_v8_4)
          FT_OFFSET(output, fts3rec_v8_4)
          FT_OFFSET(engine_id, fts3rec_v8_4)
          FT_OFFSET(engine_type, fts3rec_v8_4)
          ret = 0;
          break;

        case 5:
          FT_OFFSET(unix_secs, fts3rec_v8_5)
          FT_OFFSET(unix_nsecs, fts3rec_v8_5)
          FT_OFFSET(sysUpTime, fts3rec_v8_5)
          FT_OFFSET(exaddr, fts3rec_v8_5)
          FT_OFFSET(dFlows, fts3rec_v8_5)
          FT_OFFSET(dOctets, fts3rec_v8_5)
          FT_OFFSET(dPkts, fts3rec_v8_5)
          FT_OFFSET(First, fts3rec_v8_5)
          FT_OFFSET(Last, fts3rec_v8_5)
          FT_OFFSET(srcaddr, fts3rec_v8_5)
          FT_OFFSET(src_mask, fts3rec_v8_5)
          FT_OFFSET(src_as, fts3rec_v8_5)
          FT_OFFSET(dstaddr, fts3rec_v8_5)
          FT_OFFSET(dst_mask, fts3rec_v8_5)
          FT_OFFSET(dst_as, fts3rec_v8_5)
          FT_OFFSET(input, fts3rec_v8_5)
          FT_OFFSET(output, fts3rec_v8_5)
          FT_OFFSET(engine_id, fts3rec_v8_5)
          FT_OFFSET(engine_type, fts3rec_v8_5)
          ret = 0;
          break;

        case 6:
          FT_OFFSET(unix_secs, fts3rec_v8_6)
          FT_OFFSET(unix_nsecs, fts3rec_v8_6)
          FT_OFFSET(sysUpTime, fts3rec_v8_6)
          FT_OFFSET(exaddr, fts3rec_v8_6)
          FT_OFFSET(dPkts, fts3rec_v8_6)
          FT_OFFSET(dOctets, fts3rec_v8_6)
          FT_OFFSET(First, fts3rec_v8_6)
          FT_OFFSET(Last, fts3rec_v8_6)
          FT_OFFSET(dstaddr, fts3rec_v8_6)
          FT_OFFSET(extra_pkts, fts3rec_v8_6)
          FT_OFFSET(router_sc, fts3rec_v8_6)
          FT_OFFSET(output, fts3rec_v8_6)
          FT_OFFSET(tos, fts3rec_v8_6)
          FT_OFFSET(marked_tos, fts3rec_v8_6)
          FT_OFFSET(engine_type, fts3rec_v8_6)
          FT_OFFSET(engine_id, fts3rec_v8_6)
          ret = 0;
          break;

        case 7:
          FT_OFFSET(unix_secs, fts3rec_v8_7)
          FT_OFFSET(unix_nsecs, fts3rec_v8_7)
          FT_OFFSET(sysUpTime, fts3rec_v8_7)
          FT_OFFSET(exaddr, fts3rec_v8_7)
          FT_OFFSET(dPkts, fts3rec_v8_7)
          FT_OFFSET(dOctets, fts3rec_v8_7)
          FT_OFFSET(First, fts3rec_v8_7)
          FT_OFFSET(Last, fts3rec_v8_7)
          FT_OFFSET(dstaddr, fts3rec_v8_7)
          FT_OFFSET(srcaddr, fts3rec_v8_7)
          FT_OFFSET(extra_pkts, fts3rec_v8_7)
          FT_OFFSET(router_sc, fts3rec_v8_7)
          FT_OFFSET(output, fts3rec_v8_7)
          FT_OFFSET(input, fts3rec_v8_7)
          FT_OFFSET(tos, fts3rec_v8_7)
          FT_OFFSET(marked_tos, fts3rec_v8_7)
          FT_OFFSET(engine_type, fts3rec_v8_7)
          FT_OFFSET(engine_id, fts3rec_v8_7)
          ret = 0;
          break;

        case 8:
          FT_OFFSET(unix_secs, fts3rec_v8_8)
          FT_OFFSET(unix_nsecs, fts3rec_v8_8)
          FT_OFFSET(sysUpTime, fts3rec_v8_8)
          FT_OFFSET(exaddr, fts3rec_v8_8)
          FT_OFFSET(dPkts, fts3rec_v8_8)
          FT_OFFSET(dOctets, fts3rec_v8_8)
          FT_OFFSET(First, fts3rec_v8_8)
          FT_OFFSET(Last, fts3rec_v8_8)
          FT_OFFSET(dstaddr, fts3rec_v8_8)
          FT_OFFSET(srcaddr, fts3rec_v8_8)
          FT_OFFSET(extra_pkts, fts3rec_v8_8)
          FT_OFFSET(router_sc, fts3rec_v8_8)
          FT_OFFSET(srcport, fts3rec_v8_8)
          FT_OFFSET(dstport, fts3rec_v8_8)
          FT_OFFSET(output, fts3rec_v8_8)
          FT_OFFSET(input, fts3rec_v8_8)
          FT_OFFSET(tos, fts3rec_v8_8)
          FT_OFFSET(marked_tos, fts3rec_v8_8)
          FT_OFFSET(engine_type, fts3rec_v8_8)
          FT_OFFSET(engine_id, fts3rec_v8_8)
          FT_OFFSET(prot, fts3rec_v8_8)
          ret = 0;
          break;

        case 9:
          FT_OFFSET(unix_secs, fts3rec_v8_9)
          FT_OFFSET(unix_nsecs, fts3rec_v8_9)
          FT_OFFSET(sysUpTime, fts3rec_v8_9)
          FT_OFFSET(exaddr, fts3rec_v8_9)
          FT_OFFSET(dFlows, fts3rec_v8_9)
          FT_OFFSET(dPkts, fts3rec_v8_9)
          FT_OFFSET(dOctets, fts3rec_v8_9)
          FT_OFFSET(First, fts3rec_v8_9)
          FT_OFFSET(Last, fts3rec_v8_9)
          FT_OFFSET(src_as, fts3rec_v8_9)
          FT_OFFSET(dst_as, fts3rec_v8_9)
          FT_OFFSET(input, fts3rec_v8_9)
          FT_OFFSET(output, fts3rec_v8_9)
          FT_OFFSET(engine_type, fts3rec_v8_9)
          FT_OFFSET(engine_id, fts3rec_v8_9)
          FT_OFFSET(tos, fts3rec_v8_9)
          ret = 0;
          break;

        case 10:
          FT_OFFSET(unix_secs, fts3rec_v8_10)
          FT_OFFSET(unix_nsecs, fts3rec_v8_10)
          FT_OFFSET(sysUpTime, fts3rec_v8_10)
          FT_OFFSET(exaddr, fts3rec_v8_10)
          FT_OFFSET(dFlows, fts3rec_v8_10)
          FT_OFFSET(dPkts, fts3rec_v8_10)
          FT_OFFSET(dOctets, fts3rec_v8_10)
          FT_OFFSET(First, fts3rec_v8_10)
          FT_OFFSET(Last, fts3rec_v8_10)
          FT_OFFSET(srcport, fts3rec_v8_10)
          FT_OFFSET(dstport, fts3rec_v8_10)
          FT_OFFSET(input, fts3rec_v8_10)
          FT_OFFSET(output, fts3rec_v8_10)
          FT_OFFSET(engine_type, fts3rec_v8_10)
          FT_OFFSET(engine_id, fts3rec_v8_10)
          FT_OFFSET(prot, fts3rec_v8_10)
          FT_OFFSET(tos, fts3rec_v8_10)
          ret = 0;
          break;

        case 11:
          FT_OFFSET(unix_secs, fts3rec_v8_11)
          FT_OFFSET(unix_nsecs, fts3rec_v8_11)
          FT_OFFSET(sysUpTime, fts3rec_v8_11)
          FT_OFFSET(exaddr, fts3rec_v8_11)
          FT_OFFSET(dFlows, fts3rec_v8_11)
          FT_OFFSET(dPkts, fts3rec_v8_11)
          FT_OFFSET(dOctets, fts3rec_v8_11)
          FT_OFFSET(First, fts3rec_v8_11)
          FT_OFFSET(Last, fts3rec_v8_11)
          FT_OFFSET(srcaddr, fts3rec_v8_11)
          FT_OFFSET(src_mask, fts3rec_v8_11)
          FT_OFFSET(tos, fts3rec_v8_11)
          FT_OFFSET(src_as, fts3rec_v8_11)
          FT_OFFSET(input, fts3rec_v8_11)
          FT_OFFSET(engine_type, fts3rec_v8_11)
          FT_OFFSET(engine_id, fts3rec_v8_11)
          ret = 0;
          break;

        case 12:
          FT_OFFSET(unix_secs, fts3rec_v8_12)
          FT_OFFSET(unix_nsecs, fts3rec_v8_12)
          FT_OFFSET(sysUpTime, fts3rec_v8_12)
          FT_OFFSET(exaddr, fts3rec_v8_12)
          FT_OFFSET(dFlows, fts3rec_v8_12)
          FT_OFFSET(dPkts, fts3rec_v8_12)
          FT_OFFSET(dOctets, fts3rec_v8_12)
          FT_OFFSET(First, fts3rec_v8_12)
          FT_OFFSET(Last, fts3rec_v8_12)
          FT_OFFSET(dstaddr, fts3rec_v8_12)
          FT_OFFSET(output, fts3rec_v8_12)
          FT_OFFSET(dst_as, fts3rec_v8_12)
          FT_OFFSET(dst_mask, fts3rec_v8_12)
          FT_OFFSET(tos, fts3rec_v8_12)
          FT_OFFSET(engine_type, fts3rec_v8_12)
          FT_OFFSET(engine_id, fts3rec_v8_12)
          ret = 0;
          break;

        case 13:
          FT_OFFSET(unix_secs, fts3rec_v8_13)
          FT_OFFSET(unix_nsecs, fts3rec_v8_13)
          FT_OFFSET(sysUpTime, fts3rec_v8_13)
          FT_OFFSET(exaddr, fts3rec_v8_13)
          FT_OFFSET(dFlows, fts3rec_v8_13)
          FT_OFFSET(dPkts, fts3rec_v8_13)
          FT_OFFSET(dOctets, fts3rec_v8_13)
          FT_OFFSET(First, fts3rec_v8_13)
          FT_OFFSET(Last, fts3rec_v8_13)
          FT_OFFSET(srcaddr, fts3rec_v8_13)
          FT_OFFSET(dstaddr, fts3rec_v8_13)
          FT_OFFSET(src_as, fts3rec_v8_13)
          FT_OFFSET(dst_as, fts3rec_v8_13)
          FT_OFFSET(input, fts3rec_v8_13)
          FT_OFFSET(output, fts3rec_v8_13)
          FT_OFFSET(dst_mask, fts3rec_v8_13)
          FT_OFFSET(src_mask, fts3rec_v8_13)
          FT_OFFSET(engine_type, fts3rec_v8_13)
          FT_OFFSET(engine_id, fts3rec_v8_13)
          FT_OFFSET(tos, fts3rec_v8_13)
          ret = 0;
          break;

        case 14:
          FT_OFFSET(unix_secs, fts3rec_v8_14)
          FT_OFFSET(unix_nsecs, fts3rec_v8_14)
          FT_OFFSET(sysUpTime, fts3rec_v8_14)
          FT_OFFSET(exaddr, fts3rec_v8_14)
          FT_OFFSET(dFlows, fts3rec_v8_14)
          FT_OFFSET(dPkts, fts3rec_v8_14)
          FT_OFFSET(dOctets, fts3rec_v8_14)
          FT_OFFSET(First, fts3rec_v8_14)
          FT_OFFSET(Last, fts3rec_v8_14)
          FT_OFFSET(srcaddr, fts3rec_v8_14)
          FT_OFFSET(dstaddr, fts3rec_v8_14)
          FT_OFFSET(srcport, fts3rec_v8_14)
          FT_OFFSET(dstport, fts3rec_v8_14)
          FT_OFFSET(input, fts3rec_v8_14)
          FT_OFFSET(output, fts3rec_v8_14)
          FT_OFFSET(dst_mask, fts3rec_v8_14)
          FT_OFFSET(src_mask, fts3rec_v8_14)
          FT_OFFSET(engine_type, fts3rec_v8_14)
          FT_OFFSET(engine_id, fts3rec_v8_14)
          FT_OFFSET(tos, fts3rec_v8_14)
          FT_OFFSET(prot, fts3rec_v8_14)
          ret = 0;
          break;

      }
      break;

    case 1005:
      FT_OFFSET(unix_secs, fts3rec_v1005)
      FT_OFFSET(unix_nsecs, fts3rec_v1005)
      FT_OFFSET(sysUpTime, fts3rec_v1005)
      FT_OFFSET(exaddr, fts3rec_v1005)
      FT_OFFSET(srcaddr, fts3rec_v1005)
      FT_OFFSET(dstaddr, fts3rec_v1005)
      FT_OFFSET(nexthop, fts3rec_v1005)
      FT_OFFSET(input, fts3rec_v1005)
      FT_OFFSET(output, fts3rec_v1005)
      FT_OFFSET(dPkts, fts3rec_v1005)
      FT_OFFSET(dOctets, fts3rec_v1005)
      FT_OFFSET(First, fts3rec_v1005)
      FT_OFFSET(Last, fts3rec_v1005)
      FT_OFFSET(srcport, fts3rec_v1005)
      FT_OFFSET(dstport, fts3rec_v1005)
      FT_OFFSET(prot, fts3rec_v1005)
      FT_OFFSET(tos, fts3rec_v1005)
      FT_OFFSET(tcp_flags, fts3rec_v1005)
      FT_OFFSET(engine_type, fts3rec_v1005)
      FT_OFFSET(engine_id, fts3rec_v1005)
      FT_OFFSET(src_mask, fts3rec_v1005)
      FT_OFFSET(dst_mask, fts3rec_v1005)
      FT_OFFSET(src_as, fts3rec_v1005)
      FT_OFFSET(dst_as, fts3rec_v1005)
      FT_OFFSET(src_tag, fts3rec_v1005)
      FT_OFFSET(dst_tag, fts3rec_v1005)
      ret = 0;
      break;

  } /* switch */

  o->xfields = ftrec_xfield(ftv);

  bcopy(ftv, &o->ftv, sizeof *ftv);

  return ret;

} /* fts3rec_compute_offsets */