perf-flow.h

著名的入侵检测系统snort的最新版本的源码

/* $Id$ */
/*
** perf-flow.h
**
** Copyright (C) 2002 Sourcefire,Inc
** Marc Norton <[e-mail]>
** Dan Roelker <[e-mail]>
**
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** published by the Free Software Foundation.  You may not use, modify or
** distribute this program under any other version of the GNU General
** Public License.
**
** This program is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
** GNU General Public License for more details.
**
** You should have received a copy of the GNU General Public License
** along with this program; if not, write to the Free Software
** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
**
*/


#ifndef _PERF_FLOW_H
#define _PERF_FLOW_H

#include "sf_types.h"

#define SF_MAX_PKT_LEN 4500
#define SF_MAX_PORT (64*1024)

typedef struct _portflow {

    double   totperc[SF_MAX_PORT];
    double   sport_rate[SF_MAX_PORT];
    double   dport_rate[SF_MAX_PORT];

} PORTFLOW;

typedef struct _icmpflow {

    double totperc[256];
    int    display[256];

} ICMPFLOW;

typedef struct _sfflow {

    UINT64   *pktLenCnt;
    UINT64    pktTotal;

    UINT64   byteTotal;

    UINT64   *pktLenPercent;
    
    UINT64   *portTcpSrc;
    UINT64   *portTcpDst;
    UINT64   *portUdpSrc;
    UINT64   *portUdpDst;

    UINT64   *typeIcmp;

    UINT64    portTcpHigh;
    UINT64    portTcpTotal;

    UINT64    portUdpHigh;
    UINT64    portUdpTotal;

    UINT64    typeIcmpTotal;

    int       maxPortToTrack;
}  SFFLOW;

typedef struct _sfflow_stats {

    double    pktLenPercent[SF_MAX_PKT_LEN];
   
    double    trafficTCP;
    double    trafficUDP;
    double    trafficICMP;
    double    trafficOTHER;

    PORTFLOW  portflowTCP;
    double    portflowHighTCP;

    PORTFLOW  portflowUDP;
    double    portflowHighUDP;

    ICMPFLOW  flowICMP;


}  SFFLOW_STATS;

/*
**  Functions for the performance functions to call
*/
int InitFlowStats   (SFFLOW *sfFlow);
int UpdateFlowStats (SFFLOW *sfFlow, const unsigned char *pucBuffer, int len,
        int iRebuiltPkt);
int ProcessFlowStats(SFFLOW *sfFlow);

/*
**  These functions wrap the perf-flow functionality within
**  decode.c so we don't have to decode the packet for our
**  own stats.  Helps speed.
*/
int UpdateUDPFlowStatsEx(int sport, int dport, int len );
int UpdateTCPFlowStatsEx(int sport, int dport, int len );
int UpdateICMPFlowStatsEx(int type, int len);

#endif