flow-stat.c

netflow,抓包

    fterr_warnx("Flow record missing required field for format.");
    return -1;
  }

  fts3rec_compute_offsets(&fo, &ftv);

  if (fopdi_alloc(&stat, 256) < 0)
    return -1;

  bzero(&total, sizeof total);

  cur.flows = 1;

  while ((rec = ftio_read(&args->ftio))) {

    tos = *((u_int8*)(rec+fo.tos));

    CUR_GET_PLUS_FLOWS;

    TOTAL_INC;

    STAT_INCA(tos);

  }

  tbl_out1(args, 256, &stat, &total, "ToS       ", (void*)0L);
    
  fopdi_free(&stat);

  return 0;

} /* format22 */

/*
 * function: format23
 *
 * Input/Output Interface flows,octets,packets,duration
 *
 * returns 0 for success.
 */
int format23(struct fmtargs *args)
{
  struct fts3rec_offsets fo;
  struct ftchash_rec_if2 ftch_recif2, *ftch_recif2p;
  struct ftchash *ftch;
  struct ftver ftv;
  struct fopd total;
  struct fopd32 cur;
  u_long hash;
  char *rec;

  ftio_get_ver(&args->ftio, &ftv);

  if (ftio_check_xfield(&args->ftio, FT_XFIELD_DPKTS |
    FT_XFIELD_DOCTETS | FT_XFIELD_FIRST | FT_XFIELD_LAST |
    FT_XFIELD_OUTPUT | FT_XFIELD_INPUT)) {
    fterr_warnx("Flow record missing required field for format.");
    return -1;
  }

  fts3rec_compute_offsets(&fo, &ftv);

  bzero(&total, sizeof total);

  bzero(&ftch_recif2, sizeof ftch_recif2);
 
  if (!(ftch = ftchash_new(65536, sizeof (struct ftchash_rec_if2), 4, 65536))) {
    fterr_warnx("ftchash_new(): failed");
    return -1;
  }

  cur.flows = 1;

  while ((rec = ftio_read(&args->ftio))) {

    ftch_recif2.input = *((u_int16*)(rec+fo.input));
    ftch_recif2.output = *((u_int16*)(rec+fo.output));

    hash = (ftch_recif2.input) ^ (ftch_recif2.output);

    if (!(ftch_recif2p = ftchash_update(ftch, &ftch_recif2, hash))) {
      fterr_warnx("ftch_update(): failed");
      ftchash_free(ftch);
      return -1;
    }

    CUR_GET_PLUS_FLOWS;
    
    TOTAL_INC;
    
    STAT_INCP(ftch_recif2p);

  }

  chash_if2_dump(ftch, args->cc, args->sort_order, args->options, &total);
    
  ftchash_free(ftch);

  return 0;

} /* format23 */

/*
 * function: format24
 *
 *  Source prefix flows,octets,packets,duration
 *
 * returns 0 for success.
 */
int format24(struct fmtargs *args)
{
  struct fts3rec_offsets fo;
  struct ftchash *ftch;
  struct ftchash_rec_prefix ftch_recpre, *ftch_recprep;
  struct fopd total;
  struct fopd32 cur;
  struct ftver ftv;
  u_int32 hash;
  char *rec;

  ftio_get_ver(&args->ftio, &ftv);

  if (ftio_check_xfield(&args->ftio, FT_XFIELD_DPKTS |
    FT_XFIELD_DOCTETS | FT_XFIELD_FIRST | FT_XFIELD_LAST |
    FT_XFIELD_SRCADDR | FT_XFIELD_SRC_MASK)) {
    fterr_warnx("Flow record missing required field for format.");
    return -1;
  }

  fts3rec_compute_offsets(&fo, &ftv);

  bzero(&total, sizeof total);

  bzero(&ftch_recpre, sizeof ftch_recpre);

  if (!(ftch = ftchash_new(65536, sizeof (struct ftchash_rec_prefix), 5,
    65536))) {
    fterr_warnx("ftchash_new(): failed");
    return -1;
  }

  cur.flows = 1;

  while ((rec = ftio_read(&args->ftio))) {

    ftch_recpre.prefix = *((u_int32*)(rec+fo.srcaddr));
    ftch_recpre.mask = *((u_char*)(rec+fo.src_mask));

    /* mask off host bits */
    ftch_recpre.prefix &= ipv4_len2mask(ftch_recpre.mask);

    hash = (ftch_recpre.prefix>>16) ^ (ftch_recpre.prefix & 0xFFFF);
    hash = hash ^ (ftch_recpre.mask);

    if (!(ftch_recprep = ftchash_update(ftch, &ftch_recpre, hash))) {
      fterr_warnx("ftch_update(): failed");
      ftchash_free(ftch);
      return -1;
    }

    CUR_GET_PLUS_FLOWS;
    
    TOTAL_INC;

    STAT_INCP(ftch_recprep);

  }

  chash_pre_dump(ftch, args->cc, args->sort_order, args->options, &total);

  ftchash_free(ftch);

  return 0;

} /* format24 */

/*
 * function: format25
 *
 *  Destination prefix flows,octets,packets,duration
 *
 * returns 0 for success.
 */
int format25(struct fmtargs *args)
{
  struct fts3rec_offsets fo;
  struct ftchash *ftch;
  struct ftchash_rec_prefix ftch_recpre, *ftch_recprep;
  struct fopd total;
  struct fopd32 cur;
  struct ftver ftv;
  u_int32 hash;
  char *rec;

  ftio_get_ver(&args->ftio, &ftv);

  if (ftio_check_xfield(&args->ftio, FT_XFIELD_DPKTS |
    FT_XFIELD_DOCTETS | FT_XFIELD_FIRST | FT_XFIELD_LAST |
    FT_XFIELD_DSTADDR | FT_XFIELD_DST_MASK)) {
    fterr_warnx("Flow record missing required field for format.");
    return -1;
  }

  fts3rec_compute_offsets(&fo, &ftv);

  bzero(&total, sizeof total);

  bzero(&ftch_recpre, sizeof ftch_recpre);

  if (!(ftch = ftchash_new(65536, sizeof (struct ftchash_rec_prefix), 5,
    65536))) {
    fterr_warnx("ftchash_new(): failed");
    return -1;
  }

  cur.flows = 1;

  while ((rec = ftio_read(&args->ftio))) {

    ftch_recpre.prefix = *((u_int32*)(rec+fo.dstaddr));
    ftch_recpre.mask = *((u_char*)(rec+fo.dst_mask));

    /* mask off host bits */
    ftch_recpre.prefix &= ipv4_len2mask(ftch_recpre.mask);

    hash = (ftch_recpre.prefix>>16) ^ (ftch_recpre.prefix & 0xFFFF);
    hash = hash ^ (ftch_recpre.mask);

    if (!(ftch_recprep = ftchash_update(ftch, &ftch_recpre, hash))) {
      fterr_warnx("ftch_update(): failed");
      ftchash_free(ftch);
      return -1;
    }

    CUR_GET_PLUS_FLOWS;

    TOTAL_INC;

    STAT_INCP(ftch_recprep);

  }

  chash_pre_dump(ftch, args->cc, args->sort_order, args->options, &total);

  ftchash_free(ftch);

  return 0;

} /* format25 */

/*
 * function: format26
 *
 *  Source/Destination prefix flows,octets,packets,duration
 *
 * returns 0 for success.
 */
int format26(struct fmtargs *args)
{
  struct fts3rec_offsets fo;
  struct ftchash *ftch;
  struct ftchash_rec_prefix2 ftch_recpre2, *ftch_recpre2p;
  struct fopd total;
  struct fopd32 cur;
  struct ftver ftv;
  u_int32 hash;
  char *rec;

  ftio_get_ver(&args->ftio, &ftv);

  if (ftio_check_xfield(&args->ftio, FT_XFIELD_DPKTS |
    FT_XFIELD_DOCTETS | FT_XFIELD_FIRST | FT_XFIELD_LAST |
    FT_XFIELD_SRCADDR | FT_XFIELD_DSTADDR | FT_XFIELD_SRC_MASK |
    FT_XFIELD_DST_MASK)) {
    fterr_warnx("Flow record missing required field for format.");
    return -1;
  }

  bzero(&total, sizeof total);

  bzero(&ftch_recpre2, sizeof ftch_recpre2);

  fts3rec_compute_offsets(&fo, &ftv);

  if (!(ftch = ftchash_new(65536, sizeof (struct ftchash_rec_prefix2), 16,
    65536))) {
    fterr_warnx("ftchash_new(): failed");
    return -1;
  }

  cur.flows = 1;

  while ((rec = ftio_read(&args->ftio))) {

    ftch_recpre2.src_prefix = *((u_int32*)(rec+fo.srcaddr));
    ftch_recpre2.src_mask = *((u_char*)(rec+fo.src_mask));

    ftch_recpre2.dst_prefix = *((u_int32*)(rec+fo.dstaddr));
    ftch_recpre2.dst_mask = *((u_char*)(rec+fo.dst_mask));

    /* mask off host bits */
    ftch_recpre2.src_prefix &= ipv4_len2mask(ftch_recpre2.src_mask);
    ftch_recpre2.dst_prefix &= ipv4_len2mask(ftch_recpre2.dst_mask);

    hash = (ftch_recpre2.src_prefix>>16)^
           (ftch_recpre2.src_prefix & 0xFFFF)^
           (ftch_recpre2.dst_prefix>>16)^
           (ftch_recpre2.dst_prefix & 0xFFFF)^
           (ftch_recpre2.src_mask)^
           (u_int32)(ftch_recpre2.dst_mask<<8);

    if (!(ftch_recpre2p = ftchash_update(ftch, &ftch_recpre2, hash))) {
      fterr_warnx("ftch_update(): failed");
      ftchash_free(ftch);
      return -1;
    }

    CUR_GET_PLUS_FLOWS;

    TOTAL_INC;

    STAT_INCP(ftch_recpre2p);

  }

  chash_pre2_dump(ftch, args->cc, args->sort_order, args->options, &total);

  ftchash_free(ftch);

  return 0;

} /* format26 */

/*
 * function: format27
 *
 *  Exporter IP flows,octets,packets,duration
 *
 * returns 0 for success.
 */
int format27(struct fmtargs *args)
{
  struct ftchash *ftch;
  struct ftchash_rec_ip ftch_recip, *ftch_recipp;
  struct fts3rec_offsets fo;
  struct fopd total;
  struct fopd32 cur;
  struct ftver ftv;
  u_int32 hash;
  char *rec;

  ftio_get_ver(&args->ftio, &ftv);

  if (ftio_check_xfield(&args->ftio, FT_XFIELD_DPKTS |
    FT_XFIELD_DOCTETS | FT_XFIELD_FIRST | FT_XFIELD_LAST |
    FT_XFIELD_EXADDR)) {
    fterr_warnx("Flow record missing required field for format.");
    return -1;
  }

  fts3rec_compute_offsets(&fo, &ftv);

  bzero(&total, sizeof total);

  bzero(&ftch_recip, sizeof ftch_recip);

  cur.flows = 1;

  if (!(ftch = ftchash_new(65536, sizeof (struct ftchash_rec_ip), 4, 65536))) {
    fterr_warnx("ftchash_new(): failed");
    return -1;
  }

  while ((rec = ftio_read(&args->ftio))) {

    ftch_recip.addr = *((u_int32*)(rec+fo.exaddr));

    hash = (ftch_recip.addr>>16) ^ (ftch_recip.addr & 0xFFFF);

    if (!(ftch_recipp = ftchash_update(ftch, &ftch_recip, hash))) {
      fterr_warnx("ftch_update(): failed");
      ftchash_free(ftch);
      return -1;
    }

    CUR_GET_PLUS_FLOWS;

    TOTAL_INC;

    STAT_INCP(ftch_recipp);

  } /* while */

  chash_ip_dump(ftch, args->cc, args->sort_order, args->options, &total);

  ftchash_free(ftch);

  return 0;
}

/*
 * function: format28
 *
 *  flows,octets,packets,duration by engine_id
 *
 *  returns 0 for success.
 */
int format28(struct fmtargs *args)
{
  struct fts3rec_offsets fo;
  struct fopdi stat;
  struct fopd total;
  struct fopd32 cur;
  struct ftver ftv;
  char *rec;
  u_char engine_id;

  ftio_get_ver(&args->ftio, &ftv);

  if (ftio_check_xfield(&args->ftio, FT_XFIELD_DPKTS |
    FT_XFIELD_DOCTETS | FT_XFIELD_FIRST | FT_XFIELD_LAST |
    FT_XFIELD_ENGINE_ID)) {
    fterr_warnx("Flow record missing required field for format.");
    return -1;
  }

  fts3rec_compute_offsets(&fo, &ftv);

  if (fopdi_alloc(&stat, 256) < 0)
    return -1;

  bzero(&total, sizeof total);

  cur.flows = 1;

  while ((rec = ftio_read(&args->ftio))) {

    CUR_GET_PLUS_FLOWS;

    TOTAL_INC;

    engine_id = *((u_char*)(rec+fo.engine_id));

    STAT_INCA(engine_id);

  }

  tbl_out1(args, 256, &stat, &total, "engine_id ", (void*)0L);

  fopdi_free(&stat);

  return 0;

} /* format28 */

/*
 * function: format29
 *
 *  flows,octets,packets,duration by engine_type
 *
 *  returns 0 for success.
 */
int format29(struct fmtargs *args)
{
  struct fts3rec_offsets fo;
  struct fopdi stat;
  struct fopd total;
  struct fopd32 cur;
  struct ftver ftv;
  char *rec;
  u_char engine_type;

  ftio_get_ver(&args->ftio, &ftv);

  if (ftio_check_xfield(&args->ftio, FT_XFIELD_DPKTS |
    FT_XFIELD_DOCTETS | FT_XFIELD_FIRST | FT_XFIELD_LAST |
    FT_XFIELD_ENGINE_TYPE)) {
    fterr_warnx("Flow record missing required field for format.");
    return -1;
  }

  fts3rec_compute_offsets(&fo, &ftv);

  if (fopdi_alloc(&stat, 256) < 0)
    return -1;

  bzero(&total, sizeof total);

  cur.flows = 1;

  while ((rec = ftio_read(&args->ftio))) {

    CUR_GET_PLUS_FLOWS;

    TOTAL_INC;

    engine_type = *((u_char*)(rec+fo.engine_type));

    STAT_INCA(engine_type);

  }

  tbl_out1(args, 256, &stat, &total, "engine_type ", (void*)0L);

  fopdi_free(&stat);

  return 0;

} /* format29 */

/*
 * function: format30
 *
 *  flows,octets,packets,duration by src_tag
 *
 *  returns 0 for success.
 */
int format30(struct fmtargs *args)
{
  struct fts3rec_offsets fo;
  struct ftchash *ftch;
  struct ftchash_rec_c32 ftch_recc32, *ftch_recc32p;
  struct fopd32 cur;
  struct ftver ftv;
  struct fopd total;
  u_int32 hash;
  char *rec;

  ftio_get_ver(&args->ftio, &ftv);

  if (ftio_check_xf