ftstat.c

netflow,抓包

#define FT_STAT_OPT_PERCENT             0x001
#define FT_STAT_OPT_NAMES               0x002
#define FT_STAT_OPT_SORT                0x004
#define FT_STAT_OPT_HEADER              0x008
#define FT_STAT_OPT_XHEADER             0x010
#define FT_STAT_OPT_TOTALS              0x020
#define FT_STAT_OPT_TALLY               0x080
#define FT_STAT_OPT_TAG_MASK            0x100
#define FT_STAT_OPT_SRC_PREFIX_LEN      0x200
#define FT_STAT_OPT_SRC_PREFIX_MASK     0x400
#define FT_STAT_OPT_DST_PREFIX_LEN      0x800
#define FT_STAT_OPT_DST_PREFIX_MASK     0x1000
#define FT_STAT_OPT_ALL                 0x16FF
#define FT_STAT_OPT_GENERIC             0x00FF
#define FT_STAT_OPT_GENERIC_IP_ADDR     0x07FF
#define FT_STAT_OPT_NONE                0x0

#define FT_STAT_FIELD_INDEX      0x00000001
#define FT_STAT_FIELD_FIRST      0x00000002
#define FT_STAT_FIELD_LAST       0x00000004

#define FT_STAT_FIELD_FLOWS      0x00000010
#define FT_STAT_FIELD_OCTETS     0x00000020
#define FT_STAT_FIELD_PACKETS    0x00000040
#define FT_STAT_FIELD_DURATION   0x00000080

#define FT_STAT_FIELD_AVG_PPS    0x00000100
#define FT_STAT_FIELD_AVG_BPS    0x00000200
#define FT_STAT_FIELD_MAX_PPS    0x00000400
#define FT_STAT_FIELD_MAX_BPS    0x00000800

#define FT_STAT_FIELD_MIN_PPS    0x00001000
#define FT_STAT_FIELD_MIN_BPS    0x00002000
#define FT_STAT_FIELD_OTHER      0x00004000
#define FT_STAT_FIELD_KEY        0x00008000 /* reports with a single key */

#define FT_STAT_FIELD_KEY1       0x00010000
#define FT_STAT_FIELD_KEY2       0x00020000
#define FT_STAT_FIELD_KEY3       0x00040000
#define FT_STAT_FIELD_KEY4       0x00080000

#define FT_STAT_FIELD_KEY5       0x00100000
#define FT_STAT_FIELD_KEY6       0x00200000

#define FT_STAT_FIELD_COUNT      0x01000000 /* reports that do a count */
#define FT_STAT_FIELD_FRECS      0x02000000 /* flow records in report line */

#define FT_STAT_FIELD_PPS        0x00001500 /* any *_PPS */
#define FT_STAT_FIELD_BPS        0x00002A00 /* any *_BPS */
#define FT_STAT_FIELD_PS         (FT_STAT_FIELD_PPS|FT_STAT_FIELD_BPS)

#define FT_STAT_FIELD_GENERIC    0x0200FFF7 /* most reports */
#define FT_STAT_FIELD_GENERIC2   0x02037FF7 /* reports with 2 key fields */
#define FT_STAT_FIELD_GENERIC3   0x02077FF7 /* reports with 3 key fields */
#define FT_STAT_FIELD_GENERIC4   0x020F7FF7 /* reports with 4 key fields */
#define FT_STAT_FIELD_GENERIC5   0x021F7FF7 /* reports with 5 key fields */
#define FT_STAT_FIELD_GENERIC6   0x023F7FF7 /* reports with 6 key fields */

#define FT_STAT_SORT_ASCEND      0x1
#define FT_STAT_SORT_DESCEND     0x2

struct tally {
  u_int64 rt_flows, rt_octets, rt_packets, rt_recs, t_recs;
  double ravg_bps, ravg_pps, rt_frecs;
};

struct flow_bucket {
  u_int64 *recs, *flows, *octets, *packets, *duration;
  double *avg_pps, *avg_bps;
  double *min_pps, *min_bps;
  double *max_pps, *max_bps;
  u_int32 *index;
}; /* flow_bucket */

struct line_parser {
  enum ftstat_parse_state state;
  struct ftstat_rpt *cur_rpt;
  struct ftstat_def *cur_def;
  struct ftstat_rpt_out *cur_rpt_out;
  int lineno;
  char *buf, *fname, *word;
};

struct jump {
  char *name;
  enum ftstat_parse_state state;
  int (*func)(struct line_parser *lp, struct ftstat *ftstat);
};

struct typelookup {
  char *name;
  void* (*f_new)();
  void* (*f_accum)();
  void* (*f_calc)();
  void* (*f_dump)();
  void* (*f_free)();
  int allowed_fields; /* FT_STAT_FIELD_* */
  int allowed_options;/* FT_STAT_OPT_* */
  u_int64 xfields; /* FT_XFIELD_* */
};

struct ftstat_rpt_1 {
  u_int64 time;       /* total time in 1/1000 of flows */

  double  aflowtime;  /* average time of flow */
  double  aps;        /* average packet size */
  double  afs;        /* average flow size */
  double  apf;        /* average packets per flow */
  double  fps;        /* average flows per second */
  double  fps_real;   /* average flows per second (realtime) */

  u_int64 start;      /* earliest flow time */
  u_int64 end;        /* latest flow time */

  u_int32 time_start; /* earliest flow (realtime) */
  u_int32 time_end;   /* last flow (realtime) */

  u_int32 time_real;  /* realtime duration */

  /* average packet sizes */
  u_int64 psize32;    /* bytes/packet 1    <= p <= 32 */
  u_int64 psize64;    /* bytes/packet 32   < p <= 64  */
  u_int64 psize96; u_int64 psize128; u_int64 psize160; u_int64 psize192;
  u_int64 psize224; u_int64 psize256; u_int64 psize288; u_int64 psize320;
  u_int64 psize352; u_int64 psize384; u_int64 psize416; u_int64 psize448;
  u_int64 psize480; u_int64 psize512; u_int64 psize544; u_int64 psize576;
  u_int64 psize1024; u_int64 psize1536; u_int64 psize2048; u_int64 psize2560;
  u_int64 psize3072; u_int64 psize3584; u_int64 psize4096; u_int64 psize4608;

  /* packets per flow */
  u_int64 fpsize1;    /* packets/flow = 1 */
  u_int64 fpsize2;    /* packets/flow = 2 */
  u_int64 fpsize4;    /* packets/flow 2 < p <= 4 */
  u_int64 fpsize8;    /* packets/flow 4 < p <= 8 */
  u_int64 fpsize12; u_int64 fpsize16; u_int64 fpsize20; u_int64 fpsize24;
  u_int64 fpsize28; u_int64 fpsize32; u_int64 fpsize36; u_int64 fpsize40;
  u_int64 fpsize44; u_int64 fpsize48; u_int64 fpsize52; u_int64 fpsize60;
  u_int64 fpsize100; u_int64 fpsize200; u_int64 fpsize300; u_int64 fpsize400;
  u_int64 fpsize500; u_int64 fpsize600; u_int64 fpsize700; u_int64 fpsize800;
  u_int64 fpsize900;
  u_int64 fpsize_other; /* packets/flow 200 < p */

  /* octets per flow */
  u_int64 fosize32;     /* octets/flow 1    <= p <= 32 */
  u_int64 fosize64;     /* octets/flow 32   < p <= 64 */
  u_int64 fosize128;    /* octets/flow 64   < p <= 128 */
  u_int64 fosize256;    /* octets/flow 128   < p <= 256 */
  u_int64 fosize512; u_int64 fosize1280; u_int64 fosize2048;
  u_int64 fosize2816; u_int64 fosize3584; u_int64 fosize4352;
  u_int64 fosize5120; u_int64 fosize5888; u_int64 fosize6656;
  u_int64 fosize7424; u_int64 fosize8192; u_int64 fosize8960;
  u_int64 fosize9728; u_int64 fosize10496; u_int64 fosize11264;
  u_int64 fosize12032; u_int64 fosize12800; u_int64 fosize13568;
  u_int64 fosize14336; u_int64 fosize15104; u_int64 fosize15872;
  u_int64 fosize_other; /* octets/flow 15872   < p */

  /* time per flow */
  u_int64 ftime10;    /* time/flow 1 <= p <= 10 */
  u_int64 ftime50;    /* time/flow 10 < p <= 50 */
  u_int64 ftime100; u_int64 ftime200; u_int64 ftime500; u_int64 ftime1000;
  u_int64 ftime2000; u_int64 ftime3000; u_int64 ftime4000; u_int64 ftime5000;
  u_int64 ftime6000; u_int64 ftime7000; u_int64 ftime8000; u_int64 ftime9000;
  u_int64 ftime10000; u_int64 ftime12000; u_int64 ftime14000;
  u_int64 ftime16000; u_int64 ftime18000; u_int64 ftime20000;
  u_int64 ftime22000; u_int64 ftime24000; u_int64 ftime26000;
  u_int64 ftime28000; u_int64 ftime30000;
  u_int64 ftime_other;  /* time/flow 2000 < p */
};

struct ftstat_rpt_2 {
  int foo; /* malloc place holder */
};

struct ftstat_rpt_3 {
  struct ftchash *ftch;
};

struct ftstat_rpt_4 {
  struct ftchash *ftch;
};

struct ftstat_rpt_5 {
  struct ftchash *ftch;
};

struct ftstat_rpt_6 {
  struct flow_bucket bucket;
};

struct ftstat_rpt_7 {
  struct flow_bucket bucket;
};

struct ftstat_rpt_8 {
  struct ftchash *ftch;
};

struct ftstat_rpt_9 {
  struct ftchash *ftch;
};

struct ftstat_rpt_10 {
  struct ftchash *ftch;
};

struct ftstat_rpt_11 {
  struct flow_bucket bucket;
};

struct ftstat_rpt_12 {
  struct flow_bucket bucket;
};

struct ftstat_rpt_13 {
  struct flow_bucket bucket;
};

struct ftstat_rpt_14 {
  struct ftchash *ftch;
};

struct ftstat_rpt_15 {
  struct ftchash *ftch;
};

struct ftstat_rpt_16 {
  struct ftchash *ftch;
};

struct ftstat_rpt_17 {
  struct ftchash *ftch;
};

struct ftstat_rpt_18 {
  struct ftchash *ftch;
};

struct ftstat_rpt_19 {
  struct flow_bucket bucket;
};

struct ftstat_rpt_20 {
  struct flow_bucket bucket;
};

struct ftstat_rpt_21 {
  struct ftchash *ftch;
};

struct ftstat_rpt_22 {
  struct flow_bucket bucket;
};

struct ftstat_rpt_23 {
  struct flow_bucket bucket;
};

struct ftstat_rpt_24 {
  struct ftchash *ftch;
};

struct ftstat_rpt_25 {
  struct ftchash *ftch;
};

struct ftstat_rpt_26 {
  struct ftchash *ftch;
};

struct ftstat_rpt_27 {
  struct ftchash *ftch;
};

struct ftstat_rpt_28 {
  struct ftchash *ftch;
};

struct ftstat_rpt_29 {
  struct ftchash *ftch;
};

struct ftstat_rpt_30 {
  struct ftchash *ftch;
};

struct ftstat_rpt_31 {
  struct ftchash *ftch;
};

struct ftstat_rpt_32 {
  struct ftchash *ftch;
};

struct ftstat_rpt_33 {
  struct ftchash *ftch;
};

struct ftstat_rpt_34 {
  struct ftchash *ftch;
};

struct ftstat_rpt_35 {
  struct ftchash *ftch;
};

struct ftstat_rpt_36 {
  struct ftchash *ftch;
};

struct ftstat_rpt_37 {
  struct ftchash *ftch;
};

struct ftstat_rpt_38 {
  struct ftchash *ftch;
};

struct ftstat_rpt_39 {
  struct ftchash *ftch;
};

struct ftstat_rpt_40 {
  struct ftchash *ftch;
};

struct ftstat_rpt_41 {
  struct ftchash *ftch;
};

struct ftstat_rpt_42 {
  struct ftchash *ftch;
};

struct ftstat_rpt_43 {
  struct ftchash *ftch;
};

struct ftstat_rpt_44 {
  struct ftchash *ftch;
};

struct ftstat_rpt_45 {
  struct ftchash *ftch;
};

struct ftstat_rpt_46 {
  struct flow_bucket bucket;
};

struct ftstat_rpt_47 {
  struct flow_bucket bucket;
};

struct ftstat_rpt_48 {
  struct ftchash *ftch;
};

struct ftstat_rpt_49 {
  struct ftchash *ftch;
};

struct ftstat_rpt_50 {
  struct ftchash *ftch;
};

struct ftstat_rpt_51 {
  struct ftchash *ftch;