netflowrecord.java

流量分析 可以对SNIFFER抓的包进行分析

package com.tianxun.NEI.sniffer.util;

import java.io.OutputStream;

/**
 * 根据NetFlow V5 记录的格式.
 *
 * @author 聂军
 * @version 1.0 2004-9-11
 */

public class NetFlowRecord extends NetFlow {

    /**
     * 一个Flow记录的大小.
     */
    public static final int DEFAULT_SIZE = 48;

    private static final int MAX_VALID_TIME =  30000;

    private long srcaddr = 0;
    private long dstaddr = 0;
    private int srcport = 0;
    private int dstport = 0;
    private int prot = 0;
    private int tos = 0;
    private int tcpFlags = 0;
    private int dPkts = 0;
    private int dOctets = 0;
    private long firstTime = 0;

    public NetFlowRecord(long ipSrc, long ipDst,
        int fPort, int tPort, int p, int t) {
        srcaddr = ipSrc;
        dstaddr = ipDst;
        srcport = fPort;
        dstport = tPort;
        prot = p;
        tos = t;
        firstTime = System.currentTimeMillis();
    }

    public void setSrcAddr(long src) {
        srcaddr = src;
    }

    public long getSrcAddr() {
        return srcaddr;
    }

    public void setDstAddr(long dst) {
        dstaddr = dst;
    }

    public long getDstAddr() {
        return dstaddr;
    }

    public void setSrcPort(int port) {
        srcport = port;
    }

    public int getSrcPort() {
        return srcport;
    }

    public void setDstPort(int port) {
        dstport = port;
    }

    public int getDstPort() {
        return dstport;
    }

    public void setProt(int p) {
        prot = p;
    }

    public int getProt() {
        return prot;
    }

    public void setTos(int t) {
        tos = t;
    }

    public int getTos() {
        return tos;
    }

    public void setTcpFlags(int t) {
        tcpFlags = t;
    }

    public int getTcpFlags() {
        return tcpFlags;
    }

    public void addDPkts(int increase) {
        dPkts = dPkts + increase;
    }

    public int getDPkts() {
        return dPkts;
    }

    public void addDOctets(int increase) {
        dOctets = dOctets + increase;
    }

    public int getDOctets() {
        return dOctets;
    }

    public long getFirstTime() {
        return firstTime;
    }

    /**
     * 判断Flow记录是否在缓存中已经过期.
     *
     * @return true表示过期, false表示无效(应该被发送)
     */
    public boolean isInvalid() {
        if ((System.currentTimeMillis() - firstTime) > MAX_VALID_TIME) {
            return true;
        }
        return false;
    }

    /**
     * 将NetFlow包头的数据写入到缓冲流中.
     * 将NetFlow数据而不是包头写入到缓冲流中,这个时候已经是NETFLOW的格式了//lvjie
     * @param os - 缓冲输出流.
     * @throws Exception - Exception.
     */
    public void writeBytes(OutputStream os) throws Exception {
        byte[] buffer = new byte[DEFAULT_SIZE];
        writeNumber(buffer, 0, srcaddr, 4);
        writeNumber(buffer, 4, dstaddr, 4);
        writeNumber(buffer, 8, 0, 4);
        writeNumber(buffer, 12, 0, 2);
        writeNumber(buffer, 14, 0, 2);
        writeNumber(buffer, 16, dPkts, 4);
        writeNumber(buffer, 20, dOctets, 4);
        writeNumber(buffer, 24, 0, 4);
        writeNumber(buffer, 28, 0, 4);
        writeNumber(buffer, 32, srcport, 2);
        writeNumber(buffer, 34, dstport, 2);
        writeNumber(buffer, 36, 0, 1);
        writeNumber(buffer, 37, tcpFlags, 1);
        writeNumber(buffer, 38, prot, 1);
        writeNumber(buffer, 39, tos, 1);
        writeNumber(buffer, 40, 0, 2);
        writeNumber(buffer, 42, 0, 2);
        writeNumber(buffer, 44, 0, 1);
        writeNumber(buffer, 45, 0, 1);
        writeNumber(buffer, 46, 0, 2);
        os.write(buffer, 0, DEFAULT_SIZE);
    }

    /**
     * @see java.lang.Object#toString()
     */
    public String toString() {
        return "NetFlowRecord[srcaddr=" + long2ip(srcaddr) + ", dstaddr="
            + long2ip(dstaddr) + ", srcport=" + srcport + ", dstport=" + dstport
            + ", prot=" + prot + ", tos=" + tos
            + ", dPkts=" + dPkts + ", dOctets=" + dOctets + "]";
    }

}