flow-print.c

netflow,抓包

    cur.dPkts = ((u_int32*)(rec+fo.dPkts));
    cur.First = ((u_int32*)(rec+fo.First));
    cur.Last = ((u_int32*)(rec+fo.Last));
    cur.srcaddr = ((u_int32*)(rec+fo.srcaddr));
    cur.dstaddr = ((u_int32*)(rec+fo.dstaddr));
    cur.input = ((u_int16*)(rec+fo.input));
    cur.src_as = ((u_int16*)(rec+fo.src_as));
    cur.src_mask = ((u_int8*)(rec+fo.src_mask));

    fmt_ipv4prefix(fmt_buf1, *cur.srcaddr, *cur.src_mask, FMT_JUST_LEFT);
    fmt_uint16s(sym_asn, 18, fmt_buf3, *cur.src_as, FMT_JUST_LEFT);
    fmt_uint16(fmt_buf4, *cur.input, FMT_JUST_LEFT);
    fmt_uint32(fmt_buf5, *cur.dFlows, FMT_JUST_LEFT);
    fmt_uint32(fmt_buf6, *cur.dOctets, FMT_JUST_LEFT);
    fmt_uint32(fmt_buf7, *cur.dPkts, FMT_JUST_LEFT);
    fmt_uint32(fmt_buf8, *cur.Last - *cur.First, FMT_JUST_LEFT);

    if (options & FT_OPT_WIDE)
      printf("%-18.18s  %-16.16s  %-7.7s%-12.12s%-12.12s%-12.12s%-12.12s\n",
        fmt_buf1, fmt_buf3, fmt_buf4, fmt_buf5, fmt_buf6, fmt_buf7, fmt_buf8);
    else
      printf("%-18.18s  %-5.5s  %-7.7s%-12.12s%-12.12s%-12.12s%-12.12s\n",
        fmt_buf1, fmt_buf3, fmt_buf4, fmt_buf5, fmt_buf6, fmt_buf7, fmt_buf8);

    if (options & FT_OPT_NOBUF)
      fflush(stdout);

  } /* while */

  ftsym_free(sym_asn);

  return 0;

} /* format12 */

/*
 * 8.4 Destination Prefix aggregation
 */
int format13(struct ftio *ftio, int options)
{
  struct ftsym *sym_asn;
  struct fts3rec_all cur;
  struct fts3rec_offsets fo;
  struct ftver ftv;
  char fmt_buf1[32], fmt_buf3[32], fmt_buf4[32], fmt_buf5[32];
  char fmt_buf6[32], fmt_buf7[32], fmt_buf8[32];
  char *rec;

  if (ftio_check_xfield(ftio, FT_XFIELD_DFLOWS | FT_XFIELD_DPKTS |
    FT_XFIELD_DOCTETS | FT_XFIELD_FIRST | FT_XFIELD_LAST | FT_XFIELD_OUTPUT |
    FT_XFIELD_DSTADDR | FT_XFIELD_DST_MASK | FT_XFIELD_DST_AS)) {
    fterr_warnx("Flow record missing required field for format.");
    return -1;
  }

  sym_asn = (struct ftsym*)0L;

  ftio_get_ver(ftio, &ftv);

  fts3rec_compute_offsets(&fo, &ftv);

  if (options & FT_OPT_NAMES) {
    sym_asn = ftsym_new(FT_PATH_SYM_ASN);
  }

  if (options & FT_OPT_WIDE)
    puts(
"dstPrefix           dstAS             input  flows       octets      packets     duration");
  else
    puts(
"dst/mask            dstAS  input  flows       octets      packets     duration");

  while ((rec = ftio_read(ftio))) {

    cur.dFlows = ((u_int32*)(rec+fo.dFlows));
    cur.dOctets = ((u_int32*)(rec+fo.dOctets));
    cur.dPkts = ((u_int32*)(rec+fo.dPkts));
    cur.First = ((u_int32*)(rec+fo.First));
    cur.Last = ((u_int32*)(rec+fo.Last));
    cur.dstaddr = ((u_int32*)(rec+fo.dstaddr));
    cur.output = ((u_int16*)(rec+fo.output));
    cur.dst_as = ((u_int16*)(rec+fo.dst_as));
    cur.dst_mask = ((u_int8*)(rec+fo.dst_mask));

    fmt_ipv4prefix(fmt_buf1, *cur.dstaddr, *cur.dst_mask, FMT_JUST_LEFT);
    fmt_uint16s(sym_asn, 18, fmt_buf3, *cur.dst_as, FMT_JUST_LEFT);
    fmt_uint16(fmt_buf4, *cur.output, FMT_JUST_LEFT);
    fmt_uint32(fmt_buf5, *cur.dFlows, FMT_JUST_LEFT);
    fmt_uint32(fmt_buf6, *cur.dOctets, FMT_JUST_LEFT);
    fmt_uint32(fmt_buf7, *cur.dPkts, FMT_JUST_LEFT);
    fmt_uint32(fmt_buf8, *cur.Last - *cur.First, FMT_JUST_LEFT);

    if (options & FT_OPT_WIDE)
      printf("%-18.18s  %-16.16s  %-7.7s%-12.12s%-12.12s%-12.12s%-12.12s\n",
        fmt_buf1, fmt_buf3, fmt_buf4, fmt_buf5, fmt_buf6, fmt_buf7, fmt_buf8);
    else
      printf("%-18.18s  %-5.5s  %-7.7s%-12.12s%-12.12s%-12.12s%-12.12s\n",
        fmt_buf1, fmt_buf3, fmt_buf4, fmt_buf5, fmt_buf6, fmt_buf7, fmt_buf8);

    if (options & FT_OPT_NOBUF)
      fflush(stdout);

  } /* while */

  ftsym_free(sym_asn);

  return 0;
} /* format13 */

/*
 * 8.5 Prefix aggregation
 */
int format14(struct ftio *ftio, int options)
{
  struct ftsym *sym_asn;
  struct fts3rec_all cur;
  struct fts3rec_offsets fo;
  struct ftver ftv;
  char fmt_buf1[32], fmt_buf2[32], fmt_buf3[32], fmt_buf4[32];
  char fmt_buf5[32], fmt_buf6[32], fmt_buf7[32], fmt_buf8[32];
  char fmt_buf9[32], fmt_buf10[32];
  char *rec;

  if (ftio_check_xfield(ftio, FT_XFIELD_DFLOWS | FT_XFIELD_DPKTS |
    FT_XFIELD_DOCTETS | FT_XFIELD_FIRST | FT_XFIELD_LAST | FT_XFIELD_INPUT |
    FT_XFIELD_OUTPUT | FT_XFIELD_SRCADDR | FT_XFIELD_DSTADDR |
    FT_XFIELD_SRC_MASK | FT_XFIELD_DST_MASK | FT_XFIELD_SRC_AS |
    FT_XFIELD_DST_AS)) {
    fterr_warnx("Flow record missing required field for format.");
    return -1;
  }

  ftio_get_ver(ftio, &ftv);

  fts3rec_compute_offsets(&fo, &ftv);

  sym_asn = (struct ftsym*)0L;

  if (options & FT_OPT_NAMES) {
    sym_asn = ftsym_new(FT_PATH_SYM_ASN);
  }

  if (options & FT_OPT_WIDE)
    puts(
"srcPrefix           srcAS             dstPrefix           dstAS             input  output flows       octets      packets     duration");
  else
    puts(
"srcPrefix           srcAS  dstPrefix           dstAS  input  output flows       octets      packets     duration");

  while ((rec = ftio_read(ftio))) {

    cur.dFlows = ((u_int32*)(rec+fo.dFlows));
    cur.dOctets = ((u_int32*)(rec+fo.dOctets));
    cur.dPkts = ((u_int32*)(rec+fo.dPkts));
    cur.First = ((u_int32*)(rec+fo.First));
    cur.Last = ((u_int32*)(rec+fo.Last));
    cur.srcaddr = ((u_int32*)(rec+fo.srcaddr));
    cur.dstaddr = ((u_int32*)(rec+fo.dstaddr));
    cur.input = ((u_int16*)(rec+fo.input));
    cur.output = ((u_int16*)(rec+fo.output));
    cur.src_as = ((u_int16*)(rec+fo.src_as));
    cur.dst_as = ((u_int16*)(rec+fo.dst_as));
    cur.src_mask = ((u_int8*)(rec+fo.src_mask));
    cur.dst_mask = ((u_int8*)(rec+fo.dst_mask));

    fmt_ipv4prefix(fmt_buf1, *cur.srcaddr, *cur.src_mask, FMT_JUST_LEFT);
    fmt_ipv4prefix(fmt_buf3, *cur.dstaddr, *cur.dst_mask, FMT_JUST_LEFT);
    fmt_uint16s(sym_asn, 18, fmt_buf2, *cur.src_as, FMT_JUST_LEFT);
    fmt_uint16s(sym_asn, 18, fmt_buf4, *cur.dst_as, FMT_JUST_LEFT);
    fmt_uint16(fmt_buf5, *cur.input, FMT_JUST_LEFT);
    fmt_uint16(fmt_buf6, *cur.output, FMT_JUST_LEFT);
    fmt_uint32(fmt_buf7, *cur.dFlows, FMT_JUST_LEFT);
    fmt_uint32(fmt_buf8, *cur.dOctets, FMT_JUST_LEFT);
    fmt_uint32(fmt_buf9, *cur.dPkts, FMT_JUST_LEFT);
    fmt_uint32(fmt_buf10, *cur.Last - *cur.First, FMT_JUST_LEFT);

    if (options & FT_OPT_WIDE)
    printf("%-18.18s  %-16.16s  %-18.18s  %-16.16s  %-7.7s%-7.7s%-12.12s%-12.12s%-12.12s%-12.12s\n",
      fmt_buf1, fmt_buf2, fmt_buf3, fmt_buf4, fmt_buf5, fmt_buf6,
      fmt_buf7, fmt_buf8, fmt_buf9, fmt_buf10);
    else
    printf("%-18.18s  %-5.5s  %-18.18s  %-5.5s  %-7.7s%-7.7s%-12.12s%-12.12s%-12.12s%-12.12s\n",
      fmt_buf1, fmt_buf2, fmt_buf3, fmt_buf4, fmt_buf5, fmt_buf6,
      fmt_buf7, fmt_buf8, fmt_buf9, fmt_buf10);

    if (options & FT_OPT_NOBUF)
      fflush(stdout);

  } /* while */

  ftsym_free(sym_asn);

  return 0;

} /* format14 */

/*
 * function: format15
 *
 * 1 line, 132 column for v8.6
 */
int format15(struct ftio *ftio, int options)
{
  struct fts3rec_all cur;
  struct fts3rec_offsets fo;
  struct ftver ftv;
  char fmt_buf1[32], fmt_buf2[32], fmt_buf3[32], fmt_buf4[32], fmt_buf5[32];
  char fmt_buf6[32], fmt_buf7[32], fmt_buf8[32];
  char *rec;

  if (ftio_check_xfield(ftio, FT_XFIELD_DPKTS |
    FT_XFIELD_DOCTETS | FT_XFIELD_DSTADDR | FT_XFIELD_OUTPUT |
    FT_XFIELD_ROUTER_SC | FT_XFIELD_EXTRA_PKTS | FT_XFIELD_TOS |
    FT_XFIELD_MARKED_TOS)) {
    fterr_warnx("Flow record missing required field for format.");
    return -1;
  }

  ftio_get_ver(ftio, &ftv);

  fts3rec_compute_offsets(&fo, &ftv);

  puts("dstIP            router_sc        Dif    ToS  mToS xpackets    octets      packets");

  while ((rec = ftio_read(ftio))) {

    cur.dOctets = ((u_int32*)(rec+fo.dOctets));
    cur.dPkts = ((u_int32*)(rec+fo.dPkts));
    cur.dstaddr = ((u_int32*)(rec+fo.dstaddr));
    cur.router_sc = ((u_int32*)(rec+fo.router_sc));
    cur.output = ((u_int16*)(rec+fo.output));
    cur.tos = ((u_int8*)(rec+fo.tos));
    cur.marked_tos = ((u_int8*)(rec+fo.marked_tos));
    cur.extra_pkts = ((u_int32*)(rec+fo.extra_pkts));

    fmt_ipv4(fmt_buf1, *cur.dstaddr, FMT_PAD_RIGHT);
    fmt_ipv4(fmt_buf2, *cur.router_sc, FMT_PAD_RIGHT);
    fmt_uint16(fmt_buf3, *cur.output, FMT_PAD_RIGHT);
    fmt_uint8(fmt_buf4, *cur.tos, FMT_PAD_RIGHT);
    fmt_uint8(fmt_buf5, *cur.marked_tos, FMT_PAD_RIGHT);
    fmt_uint32(fmt_buf6, *cur.extra_pkts, FMT_PAD_RIGHT);
    fmt_uint32(fmt_buf7, *cur.dOctets, FMT_PAD_RIGHT);
    fmt_uint32(fmt_buf8, *cur.dPkts, FMT_PAD_RIGHT);

    printf("%-15.15s  %-15.15s  %-5.5s  %-3.3s  %-3.3s  %-10.10s  %-10.10s  %-10.10s\n",
      fmt_buf1, fmt_buf2, fmt_buf3, fmt_buf4, fmt_buf5, fmt_buf6,
      fmt_buf7, fmt_buf8);

    if (options & FT_OPT_NOBUF)
      fflush(stdout);

  } /* while */

  return 0;

} /* format15 */

/*
 * function: format16
 *
 * 1 line, 132 column for v8.7
 */
int format16(struct ftio *ftio, int options)
{
  struct fts3rec_all cur;
  struct fts3rec_offsets fo;
  struct ftver ftv;
  char fmt_buf1[32], fmt_buf2[32], fmt_buf3[32], fmt_buf4[32], fmt_buf5[32];
  char fmt_buf6[32], fmt_buf7[32], fmt_buf8[32], fmt_buf9[32], fmt_buf10[32];
  char *rec;

  if (ftio_check_xfield(ftio, FT_XFIELD_DPKTS | FT_XFIELD_DOCTETS |
    FT_XFIELD_DSTADDR | FT_XFIELD_SRCADDR | FT_XFIELD_OUTPUT |
    FT_XFIELD_INPUT | FT_XFIELD_ROUTER_SC | FT_XFIELD_EXTRA_PKTS |
    FT_XFIELD_TOS | FT_XFIELD_MARKED_TOS)) {
    fterr_warnx("Flow record missing required field for format.");
    return -1;
  }

  ftio_get_ver(ftio, &ftv);

  fts3rec_compute_offsets(&fo, &ftv);

  puts("srcIP            dstIP            router_sc        Sif    Dif    ToS  mToS xpackets    octets      packets");

  while ((rec = ftio_read(ftio))) {

    cur.dOctets = ((u_int32*)(rec+fo.dOctets));
    cur.dPkts = ((u_int32*)(rec+fo.dPkts));
    cur.srcaddr = ((u_int32*)(rec+fo.srcaddr));
    cur.dstaddr = ((u_int32*)(rec+fo.dstaddr));
    cur.router_sc = ((u_int32*)(rec+fo.router_sc));
    cur.output = ((u_int16*)(rec+fo.output));
    cur.input = ((u_int16*)(rec+fo.input));
    cur.tos = ((u_int8*)(rec+fo.tos));
    cur.marked_tos = ((u_int8*)(rec+fo.marked_tos));
    cur.extra_pkts = ((u_int32*)(rec+fo.extra_pkts));

    fmt_ipv4(fmt_buf1, *cur.srcaddr, FMT_PAD_RIGHT);
    fmt_ipv4(fmt_buf2, *cur.dstaddr, FMT_PAD_RIGHT);
    fmt_ipv4(fmt_buf3, *cur.router_sc, FMT_PAD_RIGHT);
    fmt_uint16(fmt_buf4, *cur.input, FMT_PAD_RIGHT);
    fmt_uint16(fmt_buf5, *cur.output, FMT_PAD_RIGHT);
    fmt_uint8(fmt_buf6, *cur.tos, FMT_PAD_RIGHT);
    fmt_uint8(fmt_buf7, *cur.marked_tos, FMT_PAD_RIGHT);
    fmt_uint32(fmt_buf8, *cur.extra_pkts, FMT_PAD_RIGHT);
    fmt_uint32(fmt_buf9, *cur.dOctets, FMT_PAD_RIGHT);
    fmt_uint32(fmt_buf10, *cur.dPkts, FMT_PAD_RIGHT);

    printf("%-15.15s  %-15.15s  %-15.15s  %-5.5s  %-5.5s  %-3.3s  %-3.3s  %-10.10s  %-10.10s  %-10.10s\n",
      fmt_buf1, fmt_buf2, fmt_buf3, fmt_buf4, fmt_buf5, fmt_buf6,
      fmt_buf7, fmt_buf8, fmt_buf9, fmt_buf10);

    if (options & FT_OPT_NOBUF)
      fflush(stdout);

  } /* while */

  return 0;

} /* format16 */

/*
 * function: format17
 *
 * 1 line, 132 column for v8.8
 */
int format17(struct ftio *ftio, int options)
{
  struct fts3rec_all cur;
  struct fts3rec_offsets fo;
  struct ftver ftv;
  struct ftsym *sym_tcp, *sym_prot;
  char fmt_buf1[32], fmt_buf2[32], fmt_buf3[32], fmt_buf4[32], fmt_buf5[32];
  char fmt_buf6[32], fmt_buf7[32], fmt_buf8[32], fmt_buf9[32], fmt_buf10[32];
  char fmt_buf11[32], fmt_buf12[32], fmt_buf13[32];
  char *rec;

  if (ftio_check_xfield(ftio, FT_XFIELD_DPKTS | FT_XFIELD_DOCTETS |
    FT_XFIELD_DSTADDR | FT_XFIELD_SRCADDR | FT_XFIELD_OUTPUT |
    FT_XFIELD_INPUT | FT_XFIELD_ROUTER_SC | FT_XFIELD_EXTRA_PKTS |
    FT_XFIELD_SRCPORT | FT_XFIELD_DSTPORT | FT_XFIELD_PROT |
    FT_XFIELD_TOS | FT_XFIELD_MARKED_TOS)) {
    fterr_warnx("Flow record missing required field for format.");
    return -1;
  }

  sym_tcp = sym_prot = (struct ftsym*)0L;

  if (options & FT_OPT_NAMES) {
    sym_tcp = ftsym_new(FT_PATH_SYM_TCP_PORT);
    sym_prot = ftsym_new(FT_PATH_SYM_IP_PROT);
  }

  ftio_get_ver(ftio, &ftv);

  fts3rec_compute_offsets(&fo, &ftv);

  puts("srcIP            dstIP            router_sc        Sif    Dif    SrcP   DstP   prot ToS  mToS xpackets    octets      packets");

  while ((rec = ftio_read(ftio))) {

    cur.dOctets = ((u_int32*)(rec+fo.dOctets));
    cur.dPkts = ((u_int32*)(rec+fo.dPkts));
    cur.srcaddr = ((u_int32*)(rec+fo.srcaddr));
    cur.dstaddr = ((u_int32*)(rec+fo.dstaddr));
    cur.router_sc = ((u_int32*)(rec+fo.router_sc));
    cur.output = ((u_int16*)(rec+fo.output));
    cur.input = ((u_int16*)(rec+fo.input));
    cur.srcport = ((u_int16*)(rec+fo.srcport));
    cur.dstport = ((u_int16*)(rec+fo.dstport));
    cur.tos = ((u_int8*)(rec+fo.tos));
    cur.prot = ((u_int8*)(rec+fo.prot));
    cur.marked_tos = ((u_int8*)(rec+fo.marked_tos));
    cur.extra_pkts = ((u_int32*)(rec+fo.extra_pkts));

    fmt_uint16s(sym_tcp, 5, fmt_buf6, (u_int16)*cur.srcport, FMT_PAD_RIGHT);
  
    fmt_uint16s(sym_tcp, 5, fmt_buf7, (u_int16)*cur.dstport, FMT_PAD_RIGHT);

    fmt_uint16s(sym_prot, 5, fmt_buf8, (u_int16)*cur.prot, FMT_PAD_RIGHT);

    fmt_ipv4(fmt_buf1, *cur.srcaddr, FMT_PAD_RIGHT);
    fmt_ipv4(fmt_buf2, *cur.dstaddr, FMT_PAD_RIGHT);
    fmt_ipv4(fmt_buf3, *cur.router_sc, FMT_PAD_RIGHT);
    fmt_uint16(fmt_buf4, *cur.input, FMT_PAD_RIGHT);
    fmt_uint16(fmt_buf5, *cur.output, FMT_PAD_RIGHT);
    fmt_uint8(fmt_buf9, *cur.tos, FMT_PAD_RIGHT);
    fmt_uint8(fmt_buf10, *cur.marked_tos, FMT_PAD_RIGHT);
    fmt_uint32(fmt_buf11, *cur.extra_pkts, FMT_PAD_RIGHT);
    fmt_uint32(fmt_buf12, *cur.dOctets, FMT_PAD_RIGHT);
    fmt_uint32(fmt_buf13, *cur.dPkts, FMT_PAD_RIGHT);

    printf("%-15.15s  %-15.15s  %-15.15s  %-5.5s  %-5.5s  %-5.5s  %-5.5s  %-3.3s  %-3.3s  %-3.3s  %-10.10s  %-10.10s  %-10.10s\n",
      fmt_buf1, fmt_buf2, fmt_buf3, fmt_buf4, fmt_buf5, fmt_buf6,
      fmt_buf7, fmt_buf8, fmt_buf9, fmt_buf10, fmt_buf11, fmt_buf12,
      fmt_buf13);

    if (options & FT_OPT_NOBUF)
      fflush(stdout);

  } /* while */

  ftsym_free(sym_tcp);
  ftsym_free(sym_prot);

  return 0;

} /* format17 */

/*
 * 8.9 ToS AS aggregation
 */
int format18(struct ftio *ftio, int options)