ftencode.c

netflow,抓包

  pdu_v8_4->records[i].dst_mask = rec_v8_4->dst_mask;
  pdu_v8_4->records[i].dst_as = rec_v8_4->dst_as;
  pdu_v8_4->records[i].output = rec_v8_4->output;

  /* increment sequence # */
  enc->seq_next[seq_index]++;

  pdu_v8_4->count ++;
  enc->buf_size += sizeof (struct ftrec_v8_4);

  if (pdu_v8_4->count >= FT_PDU_V8_4_MAXFLOWS)
    return 0;
  else
    return 1;
} /* fts3rec_pdu_v8_4_encode */

/*
 * function: fts3rec_pdu_v8_5_encode
 *
 * Encode a fts3rec into a version 8 Agg method 5
 *
 * returns: -1 error encoding, PDU not encoded.
 *           0 PDU encoded.  Hint next call will fail.
 *           1 PDU encoded.  Room for more.
 * 
*/
int fts3rec_pdu_v8_5_encode(struct ftencode *enc,
  struct fts3rec_v8_5 *rec_v8_5)
{
  struct ftpdu_v8_5 *pdu_v8_5;
  u_int seq_index;
  int i;

  pdu_v8_5 = (struct ftpdu_v8_5*) enc->buf_enc;

  /* index to sequence # */
  seq_index = rec_v8_5->engine_id<<8 | rec_v8_5->engine_type;

  i = pdu_v8_5->count;

  /* space to encode more ? */
  if (i >= FT_PDU_V8_5_MAXFLOWS)
    return -1;

  /* if this is the first record, fill in the header */
  if (!i) {

    pdu_v8_5->version = 8;
    pdu_v8_5->sysUpTime = rec_v8_5->sysUpTime;
    pdu_v8_5->unix_secs = rec_v8_5->unix_secs;
    pdu_v8_5->unix_nsecs = rec_v8_5->unix_nsecs;
    pdu_v8_5->engine_type = rec_v8_5->engine_type;
    pdu_v8_5->engine_id = rec_v8_5->engine_id;
    pdu_v8_5->aggregation = 5;
    pdu_v8_5->agg_version = 2;
    pdu_v8_5->flow_sequence = enc->seq_next[seq_index];
    enc->buf_size = 28; /* pdu header size */

  } else {

    /*  sysUpTime, unix_secs, unix_nsecs, and engine_* must match for
     *  each pdu.  If a stream is being re-encoded this will normally
     *  work out fine, if the stream was sorted or changed in some way
     *  the PDU may only be able to hold one record.
    */

    if ((pdu_v8_5->sysUpTime != rec_v8_5->sysUpTime) ||
        (pdu_v8_5->unix_secs != rec_v8_5->unix_secs) ||
        (pdu_v8_5->unix_nsecs != rec_v8_5->unix_nsecs) ||
        (pdu_v8_5->engine_id != rec_v8_5->engine_id) ||
        (pdu_v8_5->engine_type != rec_v8_5->engine_type))
        return -1;

  }

  pdu_v8_5->records[i].dFlows = rec_v8_5->dFlows;
  pdu_v8_5->records[i].dPkts = rec_v8_5->dPkts;
  pdu_v8_5->records[i].dOctets = rec_v8_5->dOctets;
  pdu_v8_5->records[i].First = rec_v8_5->First;
  pdu_v8_5->records[i].Last = rec_v8_5->Last;
  pdu_v8_5->records[i].src_prefix = rec_v8_5->srcaddr;
  pdu_v8_5->records[i].dst_prefix = rec_v8_5->dstaddr;
  pdu_v8_5->records[i].dst_mask = rec_v8_5->dst_mask;
  pdu_v8_5->records[i].src_mask = rec_v8_5->src_mask;
  pdu_v8_5->records[i].src_as = rec_v8_5->src_as;
  pdu_v8_5->records[i].dst_as = rec_v8_5->dst_as;
  pdu_v8_5->records[i].input = rec_v8_5->input;
  pdu_v8_5->records[i].output = rec_v8_5->output;

  /* increment sequence # */
  enc->seq_next[seq_index]++;

  pdu_v8_5->count ++;
  enc->buf_size += sizeof (struct ftrec_v8_5);

  if (pdu_v8_5->count >= FT_PDU_V8_5_MAXFLOWS)
    return 0;
  else
    return 1;
} /* fts3rec_pdu_v8_5_encode */


/*
 * function: fts3rec_pdu_v8_6_encode
 *
 * Encode a fts3rec into a version 8 Agg method 6
 *
 * returns: -1 error encoding, PDU not encoded.
 *           0 PDU encoded.  Hint next call will fail.
 *           1 PDU encoded.  Room for more.
 * 
*/
int fts3rec_pdu_v8_6_encode(struct ftencode *enc,
  struct fts3rec_v8_6 *rec_v8_6)
{
  struct ftpdu_v8_6 *pdu_v8_6;
  u_int seq_index;
  int i;

  pdu_v8_6 = (struct ftpdu_v8_6*) enc->buf_enc;

  /* index to sequence # */
  seq_index = rec_v8_6->engine_id<<8 | rec_v8_6->engine_type;

  i = pdu_v8_6->count;

  /* space to encode more ? */
  if (i >= FT_PDU_V8_6_MAXFLOWS)
    return -1;

  /* if this is the first record, fill in the header */
  if (!i) {

    pdu_v8_6->version = 8;
    pdu_v8_6->sysUpTime = rec_v8_6->sysUpTime;
    pdu_v8_6->unix_secs = rec_v8_6->unix_secs;
    pdu_v8_6->unix_nsecs = rec_v8_6->unix_nsecs;
    pdu_v8_6->engine_type = rec_v8_6->engine_type;
    pdu_v8_6->engine_id = rec_v8_6->engine_id;
    pdu_v8_6->aggregation = 6;
    pdu_v8_6->agg_version = 2;
    pdu_v8_6->flow_sequence = enc->seq_next[seq_index];
    enc->buf_size = 28; /* pdu header size */

  } else {

    /*  sysUpTime, unix_secs, unix_nsecs, and engine_* must match for
     *  each pdu.  If a stream is being re-encoded this will normally
     *  work out fine, if the stream was sorted or changed in some way
     *  the PDU may only be able to hold one record.
    */

    if ((pdu_v8_6->sysUpTime != rec_v8_6->sysUpTime) ||
        (pdu_v8_6->unix_secs != rec_v8_6->unix_secs) ||
        (pdu_v8_6->unix_nsecs != rec_v8_6->unix_nsecs) ||
        (pdu_v8_6->engine_id != rec_v8_6->engine_id) ||
        (pdu_v8_6->engine_type != rec_v8_6->engine_type))
        return -1;

  }

  pdu_v8_6->records[i].dstaddr = rec_v8_6->dstaddr;
  pdu_v8_6->records[i].dPkts = rec_v8_6->dPkts;
  pdu_v8_6->records[i].dOctets = rec_v8_6->dOctets;
  pdu_v8_6->records[i].First = rec_v8_6->First;
  pdu_v8_6->records[i].Last = rec_v8_6->Last;
  pdu_v8_6->records[i].output = rec_v8_6->output;
  pdu_v8_6->records[i].tos = rec_v8_6->tos;
  pdu_v8_6->records[i].marked_tos = rec_v8_6->marked_tos;
  pdu_v8_6->records[i].extra_pkts = rec_v8_6->extra_pkts;
  pdu_v8_6->records[i].router_sc = rec_v8_6->router_sc;

  /* increment sequence # */
  enc->seq_next[seq_index]++;

  pdu_v8_6->count ++;
  enc->buf_size += sizeof (struct ftrec_v8_6);

  if (pdu_v8_6->count >= FT_PDU_V8_6_MAXFLOWS)
    return 0;
  else
    return 1;
} /* fts3rec_pdu_v8_6_encode */

/*
 * function: fts3rec_pdu_v8_7_encode
 *
 * Encode a fts3rec into a version 8 Agg method 7
 *
 * returns: -1 error encoding, PDU not encoded.
 *           0 PDU encoded.  Hint next call will fail.
 *           1 PDU encoded.  Room for more.
 * 
*/
int fts3rec_pdu_v8_7_encode(struct ftencode *enc,
  struct fts3rec_v8_7 *rec_v8_7)
{
  struct ftpdu_v8_7 *pdu_v8_7;
  u_int seq_index;
  int i;

  pdu_v8_7 = (struct ftpdu_v8_7*) enc->buf_enc;

  /* index to sequence # */
  seq_index = rec_v8_7->engine_id<<8 | rec_v8_7->engine_type;

  i = pdu_v8_7->count;

  /* space to encode more ? */
  if (i >= FT_PDU_V8_7_MAXFLOWS)
    return -1;

  /* if this is the first record, fill in the header */
  if (!i) {

    pdu_v8_7->version = 8;
    pdu_v8_7->sysUpTime = rec_v8_7->sysUpTime;
    pdu_v8_7->unix_secs = rec_v8_7->unix_secs;
    pdu_v8_7->unix_nsecs = rec_v8_7->unix_nsecs;
    pdu_v8_7->engine_type = rec_v8_7->engine_type;
    pdu_v8_7->engine_id = rec_v8_7->engine_id;
    pdu_v8_7->aggregation = 7;
    pdu_v8_7->agg_version = 2;
    pdu_v8_7->flow_sequence = enc->seq_next[seq_index];
    enc->buf_size = 28; /* pdu header size */

  } else {

    /*  sysUpTime, unix_secs, unix_nsecs, and engine_* must match for
     *  each pdu.  If a stream is being re-encoded this will normally
     *  work out fine, if the stream was sorted or changed in some way
     *  the PDU may only be able to hold one record.
    */

    if ((pdu_v8_7->sysUpTime != rec_v8_7->sysUpTime) ||
        (pdu_v8_7->unix_secs != rec_v8_7->unix_secs) ||
        (pdu_v8_7->unix_nsecs != rec_v8_7->unix_nsecs) ||
        (pdu_v8_7->engine_id != rec_v8_7->engine_id) ||
        (pdu_v8_7->engine_type != rec_v8_7->engine_type))
        return -1;

  }

  pdu_v8_7->records[i].dstaddr = rec_v8_7->dstaddr;
  pdu_v8_7->records[i].srcaddr = rec_v8_7->srcaddr;
  pdu_v8_7->records[i].dPkts = rec_v8_7->dPkts;
  pdu_v8_7->records[i].dOctets = rec_v8_7->dOctets;
  pdu_v8_7->records[i].First = rec_v8_7->First;
  pdu_v8_7->records[i].Last = rec_v8_7->Last;
  pdu_v8_7->records[i].output = rec_v8_7->output;
  pdu_v8_7->records[i].input = rec_v8_7->input;
  pdu_v8_7->records[i].tos = rec_v8_7->tos;
  pdu_v8_7->records[i].marked_tos = rec_v8_7->marked_tos;
  pdu_v8_7->records[i].extra_pkts = rec_v8_7->extra_pkts;
  pdu_v8_7->records[i].router_sc = rec_v8_7->router_sc;

  /* increment sequence # */
  enc->seq_next[seq_index]++;

  pdu_v8_7->count ++;
  enc->buf_size += sizeof (struct ftrec_v8_7);

  if (pdu_v8_7->count >= FT_PDU_V8_7_MAXFLOWS)
    return 0;
  else
    return 1;
} /* fts3rec_pdu_v8_7_encode */

/*
 * function: fts3rec_pdu_v8_8_encode
 *
 * Encode a fts3rec into a version 8 Agg method 8
 *
 * returns: -1 error encoding, PDU not encoded.
 *           0 PDU encoded.  Hint next call will fail.
 *           1 PDU encoded.  Room for more.
 * 
*/
int fts3rec_pdu_v8_8_encode(struct ftencode *enc,
  struct fts3rec_v8_8 *rec_v8_8)
{
  struct ftpdu_v8_8 *pdu_v8_8;
  u_int seq_index;
  int i;

  pdu_v8_8 = (struct ftpdu_v8_8*) enc->buf_enc;

  /* index to sequence # */
  seq_index = rec_v8_8->engine_id<<8 | rec_v8_8->engine_type;

  i = pdu_v8_8->count;

  /* space to encode more ? */
  if (i >= FT_PDU_V8_8_MAXFLOWS)
    return -1;

  /* if this is the first record, fill in the header */
  if (!i) {

    pdu_v8_8->version = 8;
    pdu_v8_8->sysUpTime = rec_v8_8->sysUpTime;
    pdu_v8_8->unix_secs = rec_v8_8->unix_secs;
    pdu_v8_8->unix_nsecs = rec_v8_8->unix_nsecs;
    pdu_v8_8->engine_type = rec_v8_8->engine_type;
    pdu_v8_8->engine_id = rec_v8_8->engine_id;
    pdu_v8_8->aggregation = 8;
    pdu_v8_8->agg_version = 2;
    pdu_v8_8->flow_sequence = enc->seq_next[seq_index];
    enc->buf_size = 28; /* pdu header size */

  } else {

    /*  sysUpTime, unix_secs, unix_nsecs, and engine_* must match for
     *  each pdu.  If a stream is being re-encoded this will normally
     *  work out fine, if the stream was sorted or changed in some way
     *  the PDU may only be able to hold one record.
    */

    if ((pdu_v8_8->sysUpTime != rec_v8_8->sysUpTime) ||
        (pdu_v8_8->unix_secs != rec_v8_8->unix_secs) ||
        (pdu_v8_8->unix_nsecs != rec_v8_8->unix_nsecs) ||
        (pdu_v8_8->engine_id != rec_v8_8->engine_id) ||
        (pdu_v8_8->engine_type != rec_v8_8->engine_type))
        return -1;

  }

  pdu_v8_8->records[i].dstaddr = rec_v8_8->dstaddr;
  pdu_v8_8->records[i].srcaddr = rec_v8_8->srcaddr;
  pdu_v8_8->records[i].dstport = rec_v8_8->dstport;
  pdu_v8_8->records[i].srcport = rec_v8_8->srcport;
  pdu_v8_8->records[i].dPkts = rec_v8_8->dPkts;
  pdu_v8_8->records[i].dOctets = rec_v8_8->dOctets;
  pdu_v8_8->records[i].First = rec_v8_8->First;
  pdu_v8_8->records[i].Last = rec_v8_8->Last;
  pdu_v8_8->records[i].output = rec_v8_8->output;
  pdu_v8_8->records[i].input = rec_v8_8->input;
  pdu_v8_8->records[i].tos = rec_v8_8->tos;
  pdu_v8_8->records[i].marked_tos = rec_v8_8->marked_tos;
  pdu_v8_8->records[i].extra_pkts = rec_v8_8->extra_pkts;
  pdu_v8_8->records[i].router_sc = rec_v8_8->router_sc;

  /* increment sequence # */
  enc->seq_next[seq_index]++;

  pdu_v8_8->count ++;
  enc->buf_size += sizeof (struct ftrec_v8_8);

  if (pdu_v8_8->count >= FT_PDU_V8_8_MAXFLOWS)
    return 0;
  else
    return 1;
} /* fts3rec_pdu_v8_8_encode */

/*
 * function: fts3rec_pdu_v8_9_encode
 *
 * Encode a fts3rec into a version 8 Agg method 9
 *
 * returns: -1 error encoding, PDU not encoded.
 *           0 PDU encoded.  Hint next call will fail.
 *           1 PDU encoded.  Room for more.
 * 
*/
int fts3rec_pdu_v8_9_encode(struct ftencode *enc,
  struct fts3rec_v8_9 *rec_v8_9)
{
  struct ftpdu_v8_9 *pdu_v8_9;
  u_int seq_index;
  int i;

  pdu_v8_9 = (struct ftpdu_v8_9*) enc->buf_enc;

  /* index to sequence # */
  seq_index = rec_v8_9->engine_id<<8 | rec_v8_9->engine_type;

  i = pdu_v8_9->count;

  /* space to encode more ? */
  if (i >= FT_PDU_V8_9_MAXFLOWS)
    return -1;

  /* if this is the first record, fill in the header */
  if (!i) {

    pdu_v8_9->version = 8;
    pdu_v8_9->sysUpTime = rec_v8_9->sysUpTime;
    pdu_v8_9->unix_secs = rec_v8_9->unix_secs;
    pdu_v8_9->unix_nsecs = rec_v8_9->unix_nsecs;
    pdu_v8_9->engine_type = rec_v8_9->engine_type;
    pdu_v8_9->engine_id = rec_v8_9->engine_id;
    pdu_v8_9->aggregation = 9;
    pdu_v8_9->agg_version = 2;
    pdu_v8_9->flow_sequence = enc->seq_next[seq_index];
    enc->buf_size = 28; /* pdu header size */

  } else {

    /*  sysUpTime, unix_secs, unix_nsecs, and engine_* must match for
     *  each pdu.  If a stream is being re-encoded this will normally
     *  work out fine, if the stream was sorted or changed in some way
     *  the PDU may only be able to hold one record.
    */

    if ((pdu_v8_9->sysUpTime != rec_v8_9->sysUpTime) ||
        (pdu_v8_9->unix_secs != rec_v8_9->unix_secs) ||
        (pdu_v8_9->unix_nsecs != rec_v8_9->unix_nsecs) ||
        (pdu_v8_9->engine_id != rec_v8_9->engine_id) ||
        (pdu_v8_9->engine_type != rec_v8_9->engine_type))
        return -1;

  }

  pdu_v8_9->records[i].dFlows = rec_v8_9->dFlows;
  pdu_v8_9->records[i].dPkts = rec_v8_9->dPkts;
  pdu_v8_9->records[i].dOctets = rec_v8_9->dOctets;
  pdu_v8_9->records[i].First = rec_v8_9->First;
  pdu_v8_9->records[i].Last = rec_v8_9->Last;
  pdu_v8_9->records[i].src_as = rec_v8_9->src_as;
  pdu_v8_9->records[i].dst_as = rec_v8_9->dst_as;
  pdu_v8_9->records[i].input = rec_v8_9->input;
  pdu_v8_9->records[i].output = rec_v8_9->output;
  pdu_v8_9->records[i].tos = rec_v8_9->tos;

  /* increment sequence # */
  enc->seq_next[seq_index]++;

  pdu_v8_9->count ++;