Skip to content

GitLab

Commit c619c119 authored by Håvard Moås's avatar Håvard Moås
Browse files

Update IPFIXLIB for experimental changes to support some more data types, havard.mork@gmail.com 

git-svn-id: file:///home/svn/mapi/branches/haavardm-mapi@40 8d5bb341-7cf1-0310-8cf6-ba355fef3186
parent c5d7cc29
Hide whitespace changes
Inline Side-by-side
ipfixlib/engine.c
View file @ c619c119
......@@ -493,7 +493,8 @@ void addPktToHash(np_ctxt_t *npctxt,
u_int8_t icmpType,
u_char *fingerprint,
u_char *payload,
int payloadLen) {
int payloadLen,
u_int headerLen, u_int64_t v4_options) {
u_int32_t n=0, mutexIdx, idx; /* (src+dst+sport+dport) % hashSize; */
HashBucket *bkt;
u_int32_t srcHost, dstHost;
......@@ -602,6 +603,13 @@ void addPktToHash(np_ctxt_t *npctxt,
if(npctxt->bitrateCalcEnabled!=0) {
updateBitrateCalculation(npctxt,bkt,len, stamp,0);
}
if(src.ipVersion == 4 && proto == IPPROTO_TCP)
bkt->optionsIPV4src2dst |= v4_options;
else
bkt->optionsIPV6src2dst |= 0; // N/I
} else {
bkt->bytesRcvd += len, bkt->pktRcvd += numPkts;
if(bkt->firstSeenRcvd == 0)
......@@ -619,6 +627,19 @@ void addPktToHash(np_ctxt_t *npctxt,
if(npctxt->bitrateCalcEnabled!=0) {
updateBitrateCalculation(npctxt,bkt,len, stamp,1);
}
if(src.ipVersion == 4 && proto == IPPROTO_TCP)
bkt->optionsIPV4dst2src |= v4_options;
else
bkt->optionsIPV6dst2src |= 0; // N/I
/* calculate first packet's size on dst2src. Src2dst already calculated. */
if(bkt->dst2srcPktlenIpv4==0 && bkt->dst2srcPktlenIpv6==0) {
if(src.ipVersion == 4)
bkt->dst2srcPktlenIpv4 = len;
else
bkt->dst2srcPktlenIpv6 = payloadLen;
}
}
pthread_mutex_unlock(&hashMutex[mutexIdx]);
......@@ -707,6 +728,31 @@ void addPktToHash(np_ctxt_t *npctxt,
updateBitrateCalculation(npctxt,bkt,len,stamp,0);
}
if(src.ipVersion == 4 && proto == IPPROTO_TCP)
bkt->optionsIPV4src2dst = v4_options;
else
bkt->optionsIPV6src2dst = 0; // N/I
bkt->optionsIPV4dst2src = 0;
bkt->optionsIPV6dst2src = 0;
/* Calculate src2dst payload length (payload length for ipv6). Only first packet. */
bkt->src2dstPktlenIpv4 = 0;
bkt->src2dstPktlenIpv6 = 0;
bkt->dst2srcPktlenIpv4 = 0;
bkt->dst2srcPktlenIpv6 = 0;
if(src.ipVersion == 4)
bkt->src2dstPktlenIpv4 = len;
else
bkt->src2dstPktlenIpv6 = payloadLen;
if(src.ipVersion == 4 && proto == IPPROTO_TCP)
bkt->headerlengthIPv4 = headerLen;
else
bkt->headerlengthIPv4 = 0;
bkt->proto = proto;
bkt->sport = sport, bkt->dport = dport;
bkt->firstSeenSent = bkt->lastSeenSent = stamp;
......@@ -721,6 +767,11 @@ void addPktToHash(np_ctxt_t *npctxt,
setPayload(npctxt, bkt, payload, payloadLen, 0);
bkt->src2dstTcpFlags |= flags;
/* Increase num of observed flows */
npctxt->numObservedFlows = npctxt->numObservedFlows + 1;
/* Put the bucket on top of the list */
pthread_mutex_lock(&hashMutex[mutexIdx]);
addToList(bkt, &npctxt->hash[idx]);
......
ipfixlib/engine.h
View file @ c619c119
......@@ -55,7 +55,8 @@ extern void addPktToHash(np_ctxt_t *npctxt,
IpAddress dst, u_short dport, u_int len,
unsigned long long stamp, u_int8_t flags,
u_int8_t icmpType, u_char *fingerprint,
u_char *payload, int payloadLen);
u_char *payload, int payloadLen,
u_int headerLen, u_int64_t v4_options);
extern void printICMPflags(u_int32_t flags, char *icmpBuf, int icmpBufLen);
extern void printFlow(np_ctxt_t *npctxt, HashBucket *theFlow, int direction);
extern int isFlowExpired(np_ctxt_t *npctxt, HashBucket *myBucket, time_t theTime);
......
ipfixlib/npctxt.h
View file @ c619c119
......@@ -184,7 +184,7 @@ typedef struct collectorAddress {
/* ************************************ */
#define MAX_NUM_COLLECTORS 8
#define PAYLOAD_EXCERPT_MAX 32
#define PAYLOAD_EXCERPT_MAX 16
typedef struct ipV4Fragment {
u_int32_t src, dst;
......@@ -237,8 +237,8 @@ typedef struct {
FILE *fileexportHandle;
char *fileexportName;
u_char traceMode;
int minNumFlowsPerPacket; /* FlowSets are sent when this number is hit */
int maxNumFlowsPerPacket; /* Max size of a flowset. Not enforced! */
u_int16_t minNumFlowsPerPacket; /* FlowSets are sent when this number is hit */
u_int16_t maxNumFlowsPerPacket; /* Max size of a flowset. Not enforced! */
// Last time a FlowSet was physically sent. See also flowExportDelay.
unsigned long long lastExportTime;
......@@ -290,6 +290,7 @@ typedef struct {
u_int maxBucketSearch;
u_int lastMaxBucketSearch;
u_int flowSequence;
u_int64_t numObservedFlows;
unsigned long long initialSniffTime;
u_short scanCycle /* sec */;
......@@ -300,6 +301,10 @@ typedef struct {
u_int16_t histPktSizeBucket[PKTSZ_HISTOGRAM_SLOTS];
u_int16_t histPktDistBucket[PKTDIST_HISTOGRAM_SLOTS];
u_int8_t bitrateCalcEnabled; // Bitset, see BITRATECALC_* flags for options
// Exporter's addresses
uint32_t exporterIpv4Address; // in_addr
struct in6_addr exporterIpv6Address;
} np_ctxt_t;
#endif
ipfixlib/npktproc.c
View file @ c619c119
......@@ -65,13 +65,16 @@ nprobeProcessPacket(void *ctxt, mapid_pkthdr_t *pkt_head, const void *pkt)
IpAddress src, dst;
u_char isFragment = 0;
np_ctxt_t *npctxt = (np_ctxt_t *)ctxt;
u_int64_t v4_options = 0;
//u_int32_t v6_options = 0;
u_int hlen=0;
#ifdef DEBUG
traceEvent(npctxt, TRACE_INFO, ".");
#endif
if(caplen >= sizeof(struct ether_header)) {
u_int plen, hlen=0;
u_int plen;
u_short sport, dport;
npctxt->totalPkts++, npctxt->totalBytes += length;
......@@ -116,6 +119,18 @@ nprobeProcessPacket(void *ctxt, mapid_pkthdr_t *pkt_head, const void *pkt)
isFragment = (ntohs(ip.ip_off) & 0x3fff) ? 1 : 0;
off = ntohs(ip.ip_off);
//
// Parse IPv4 header options, if they exist
if(hlen >= 24) {
u_int olen = 4;
if(hlen >= 28)
olen = 8;
memcpy(&v4_options,(char *)pkt+ehshift+sizeof(struct ip), olen);
}
} else if(eth_type == ETHERTYPE_IPV6) {
memcpy(&ipv6, (char *)pkt+ehshift, sizeof(struct ip6_hdr));
if(((ipv6.ip6_vfc >> 4) & 0x0f) != 6) return; /* IP v6 only */
......@@ -133,6 +148,8 @@ nprobeProcessPacket(void *ctxt, mapid_pkthdr_t *pkt_head, const void *pkt)
}
proto = ipv6.ip6_nxt; /* next header (protocol) */
}
plen = length-ehshift;
......@@ -354,7 +371,8 @@ nprobeProcessPacket(void *ctxt, mapid_pkthdr_t *pkt_head, const void *pkt)
pkt_head->ts, flags,
(proto == IPPROTO_ICMP) ? icmpPkt.icmp_type : 0,
npctxt->computeFingerprint ? fingerprint : NULL,
payload, payloadLen);
payload, payloadLen,
hlen,v4_options);
}
#ifdef DEBUG
else {
......
ipfixlib/nprobe.c
View file @ c619c119
......@@ -1038,6 +1038,8 @@ npInitContext(void)
{
struct timeval now;
np_ctxt_t *npctxt = calloc(1, sizeof (np_ctxt_t));
char ac[80];
int i;
printf("npInitContext (l. %d): nInstances=%d\n", __LINE__, nInstances);
if (!npctxt)
......@@ -1132,6 +1134,23 @@ npInitContext(void)
npctxt->bitrateCalcEnabled = BITRATECALC_NONE;
npctxt->numObservedFlows = 0;
// Attempt to get own IP address
if (gethostname(ac, sizeof(ac))==0) {
struct hostent *phe = gethostbyname(ac);
if (phe != NULL) {
for (i = 0; phe->h_addr_list[i] != 0; ++i) {
struct in_addr addr;
if(phe->h_addrtype==AF_INET)
memcpy(&npctxt->exporterIpv4Address, phe->h_addr_list[i], sizeof(struct in_addr));
else if(phe->h_addrtype==AF_INET6)
memcpy(&npctxt->exporterIpv6Address, phe->h_addr_list[i], sizeof(struct in6_addr));
}
}
}
return npctxt;
}
......
ipfixlib/nprobe_bucket.h
View file @ c619c119
......@@ -130,5 +130,18 @@ typedef struct hashBucket {
u_int32_t dst2srcRateMax1sec; // Avg rate within 1sec, max reading
u_int32_t dst2srcRateMin10sec; // Avg rate within 10sec, min reading
u_int32_t dst2srcRateMin100sec; // Avg rate within 100sec, min reading
u_int16_t src2dstPktlenIpv4;
u_int16_t dst2srcPktlenIpv4;
u_int32_t src2dstPktlenIpv6;
u_int32_t dst2srcPktlenIpv6;
u_int8_t headerlengthIPv4;
u_int32_t optionsIPV6src2dst;
u_int32_t optionsIPV6dst2src;
u_int64_t optionsIPV4src2dst;
u_int64_t optionsIPV4dst2src;
} HashBucket;
ipfixlib/util.c
View file @ c619c119
......@@ -37,12 +37,12 @@
/* ******************************************* */
#define FID_PAYLOAD 87
#define FID_HISTOGRAM_PKT_LNGTH 32769
#define FID_HISTOGRAM_PKT_DIST 32770
#define FID_RATE_1SEC_MAX 32771
#define FID_RATE_10SEC_MIN 32772
#define FID_RATE_100SEC_MIN 32773
#define FID_PAYLOAD 32776
#ifndef __KERNEL__
......@@ -643,9 +643,9 @@ void nprintf(FILE *stream, char *fmt, HashBucket *theFlow, int direction) {
* switch statement in handleTemplate as well. */
static V9TemplateId ver9_templates[] = {
/* { 0, 0, "NOT_USED" }, */
{ 1, 4, "BYTES" },
{ 1, 4, "BYTES" }, // not ipfix
{ 2, 4, "PKTS" },
{ 3, 4, "FLOWS" },
{ 3, 4, "FLOWS" }, // not ipfix
{ 4, 1, "PROT" },
{ 5, 1, "TOS" },
{ 6, 1, "TCP_FLAGS" },
......@@ -665,65 +665,36 @@ static V9TemplateId ver9_templates[] = {
{ 20, 4, "MUL_DOCTETS" },
{ 21, 4, "LAST_SWITCHED" },
{ 22, 4, "FIRST_SWITCHED" },
{ 23, 4, "OUT_BYTES" },
{ 24, 4, "OUT_PKTS" },
{ 25, 2, "MIN_PKT_LNGTH" },
{ 23, 4, "OUT_BYTES" }, // not ipfix
{ 24, 4, "OUT_PKTS" }, // NOTE: difference v9/ipfix
{ 25, 2, "MIN_PKT_LNGTH" },
{ 26, 2, "MAX_PKT_LNGTH" },
{ 27, 16, "IPV6_SRC_ADDR" },
{ 28, 16, "IPV6_DST_ADDR" },
{ 29, 1, "IPV6_SRC_MASK" },
{ 30, 1, "IPV6_DST_MASK" },
/* { 31, 3, "FLOW_LABEL" }, */
{ 31, 3, "FLOW_LABEL" }, // !!
{ 32, 2, "ICMP_TYPE" },
{ 33, 1, "IGMP_TYPE" },
{ 34, 4, "SAMPLING_INTERVAL" },
{ 35, 1, "SAMPLING_ALGO" },
{ 34, 4, "SAMPLING_INTERVAL" }, // not ipfix
{ 35, 1, "SAMPLING_ALGO" }, // not ipfix
{ 36, 2, "FLOW_ACTIVE_TIMEOUT" },
{ 37, 2, "FLOW_INACTIVE_TIMEOUT" },
{ 38, 1, "ENGINE_TYPE" },
{ 39, 1, "ENGINE_ID" },
{ 38, 1, "ENGINE_TYPE" }, // not ipfix
{ 39, 1, "ENGINE_ID" }, // not ipfix
{ 40, 4, "TOTAL_BYTES_EXP" },
{ 41, 4, "TOTAL_PKTS_EXP" },
{ 42, 4, "TOTAL_FLOWS_EXP" },
/* { 43, 0, "RESERVED" }, */
/* { 44, 0, "RESERVED" }, */
/* { 45, 0, "RESERVED" }, */
/* { 46, 0, "RESERVED" }, */
/* { 47, 0, "RESERVED" }, */
/* { 48, 0, "RESERVED" }, */
/* { 49, 0, "RESERVED" }, */
/* { 50, 0, "RESERVED" }, */
/* { 51, 0, "RESERVED" }, */
/* { 52, 0, "RESERVED" }, */
/* { 53, 0, "RESERVED" }, */
/* { 54, 0, "RESERVED" }, */
/* { 55, 0, "RESERVED" }, */
/* { 56, 0, "RESERVED" }, */
/* { 57, 0, "RESERVED" }, */
/* { 58, 0, "RESERVED" }, */
/* { 59, 0, "RESERVED" }, */
// NOT 43-59
{ 60, 1, "IP_PROTOCOL_VERSION" },
{ 61, 1, "DIRECTION" },
{ 62, 1, "IPV6_NEXT_HOP" },
{ 63, 16, "BPG_IPV6_NEXT_HOP" },
{ 64, 16, "IPV6_OPTION_HEADERS" },
/* { 65, 0, "RESERVED" }, */
/* { 66, 0, "RESERVED" }, */
/* { 67, 0, "RESERVED" }, */
/* { 68, 0, "RESERVED" }, */
/* { 69, 0, "RESERVED" }, */
/* { 70, 3, "MPLS_LABEL_1" }, */
/* { 71, 3, "MPLS_LABEL_2" }, */
/* { 72, 3, "MPLS_LABEL_3" }, */
/* { 73, 3, "MPLS_LABEL_4" }, */
/* { 74, 3, "MPLS_LABEL_5" }, */
/* { 75, 3, "MPLS_LABEL_6" }, */
/* { 76, 3, "MPLS_LABEL_7" }, */
/* { 77, 3, "MPLS_LABEL_8" }, */
/* { 78, 3, "MPLS_LABEL_9" }, */
/* { 79, 3, "MPLS_LABEL_10" }, */
//{ 62, 16, "IPV6_NEXT_HOP" },
//{ 63, 16, "BPG_IPV6_NEXT_HOP" },
{ 64, 4, "IPV6_OPTION_HEADERS" },
// NOT 65-87
/* nFlow Extensions */
/*
{ 80, 1, "FRAGMENTED" },
{ 81, FINGERPRINT_LEN, "FINGERPRINT" },
{ 82, 2, "VLAN_TAG" },
......@@ -731,15 +702,47 @@ static V9TemplateId ver9_templates[] = {
{ 84, 4, "NW_LATENCY_NSEC" },
{ 85, 4, "APPL_LATENCY_SEC" },
{ 86, 4, "APPL_LATENCY_NSEC" },
*/
// { 87, 0 /* The length is set at runtime */, "PAYLOAD" },
{ FID_PAYLOAD,PAYLOAD_EXCERPT_MAX, "PAYLOAD" },
{ 88, 4, "ICMP_FLAGS" },
// NOT 89-129
{130, 4, "EXPORTER_IPV4"},
{131, 16, "EXPORTER_IPV6"},
// *
{136, 1, "FLOW_END_REASON"},
// *
{145, 4, "TEMPLATE_ID"},
// *
{148, 4, "FLOW_ID"},
// *
{150, 4, "FLOW_START_SECONDS" },
{151, 4, "FLOW_END_SECONDS" },
{152, 8, "FLOW_START_MILLISECONDS" },
{153, 8, "FLOW_END_MILLISECONDS" },
{154, 8, "FLOW_START_MICROSECONDS" },
{155, 8, "FLOW_END_MICROSECONDS" },
// *
{160, 8, "SYSINIT_MILLIS"},
{161, 8, "FLOW_DUR_MILLIS"},
{162, 8, "FLOW_DUR_MICROS"},
{163, 8, "NUM_FLOWS_OBSERVED"},
{164, 8, "NUM_IGNORED_PKT"},
{165, 8, "NUM_IGNORED_OCTETS"},
{166, 8, "NOTSENT_FLOWS"},
{167, 8, "NOTSENT_PKTS"},
{168, 8, "NOTSENT_OCTETS"},
// *
{190, 2, "PKTLEN_IPV4"},
{191, 4, "PKTLEN_IPV6"},
// *
//{204, 1 - octetDeltaCount - int
//{205, 1 - postOctetDeltaCount - int
//{206, 1 - octetTotalCount - int
{207, 1, "HDRLEN_IPV4"},
{208, 8, "IPV4_OPT"},
{209, 8, "TCP_OPT"},
{210, 1, "PADDING"},
/* ipfixlib extensions */
// Note that 32768 is reserved (ent.mark = 1, ent.id = 0)
......@@ -748,8 +751,7 @@ static V9TemplateId ver9_templates[] = {
{ FID_RATE_1SEC_MAX, 4, "RATE_1SEC_MAX_TRANSFER" },
{ FID_RATE_10SEC_MIN, 4, "RATE_10SEC_MIN_TRANSFER" },
{ FID_RATE_100SEC_MIN, 4, "RATE_100SEC_MIN_TRANSFER" },
{ 32774, 4, "FLOW_DURATION_MILLISECONDS" },
{ 32775, 4, "FLOW_DURATION_MICROSECONDS" },
{ FID_PAYLOAD, PAYLOAD_EXCERPT_MAX, "PAYLOAD" },
{ 0, 0, NULL }
};
......@@ -785,6 +787,16 @@ static void copyInt32(u_int32_t _t32, char *outBuffer, u_int *outBufferBegin, u_
}
}
static void copyInt64(u_int64_t _t64, char *outBuffer, u_int *outBufferBegin, u_int *outBufferMax) {
u_int64_t t64 = htonl(_t64);
if((*outBufferBegin)+sizeof(t64) < (*outBufferMax)) {
memcpy(&outBuffer[(*outBufferBegin)], &t64, sizeof(t64));
(*outBufferBegin) += sizeof(t64);
}
}
/* static void copyInt32Array(u_int32_t *_t32a, char *outBuffer, u_int *outBufferBegin, u_int *outBufferMax, u_int nelements) {
u_int i;
for(i=0; i<nelements; i++) {
......@@ -1067,6 +1079,10 @@ static void handleTemplate(np_ctxt_t *npctxt, V9TemplateId *theTemplate,
/* FIXME: Not implemented */
copyInt8(0, outBuffer, outBufferBegin, outBufferMax);
break;
case 31:
/* FIXME: Not implemented */
copyInt32(0, outBuffer, outBufferBegin, outBufferMax);
break;
case 32:
/* FIXME: Not implemented */
copyInt16(0, outBuffer, outBufferBegin, outBufferMax);
......@@ -1109,14 +1125,9 @@ static void handleTemplate(np_ctxt_t *npctxt, V9TemplateId *theTemplate,
case 61:
copyInt8(direction, outBuffer, outBufferBegin, outBufferMax); /* FIX */
break;
case 62:
/* FIXME: Not implemented */
copyInt8(0, outBuffer, outBufferBegin, outBufferMax);
break;
case 63:
case 64:
/* FIXME: Not implemented */
copyInt16(0, outBuffer, outBufferBegin, outBufferMax);
copyInt32(direction==0?theFlow->optionsIPV6src2dst:theFlow->optionsIPV6dst2src,
outBuffer, outBufferBegin, outBufferMax);
break;
/* nFlow Extensions */
......@@ -1171,14 +1182,26 @@ static void handleTemplate(np_ctxt_t *npctxt, V9TemplateId *theTemplate,
}
copyInt32(res32, outBuffer, outBufferBegin, outBufferMax);
break;
case FID_PAYLOAD:
exportPayload(npctxt, theFlow, direction, theTemplate,
outBuffer, outBufferBegin, outBufferMax);
break;
case 88:
copyInt32(direction == 0 ? theFlow->src2dstIcmpFlags : theFlow->dst2srcIcmpFlags,
outBuffer, outBufferBegin, outBufferMax);
break;
case 130:
copyInt32(npctxt->exporterIpv4Address, outBuffer, outBufferBegin, outBufferMax);
break;
case 131:
copyIpV6(npctxt->exporterIpv6Address, outBuffer, outBufferBegin, outBufferMax);
break;
case 136:
copyInt8(0, outBuffer, outBufferBegin, outBufferMax); /* FIX */
break;
case 145:
copyInt32(0, outBuffer, outBufferBegin, outBufferMax); /* FIX */
break;
case 148:
copyInt32(0, outBuffer, outBufferBegin, outBufferMax); /* FIX */
break;
case 150: // FLOW_START_SECONDS uint32
copyInt32(direction == 1 ? (theFlow->firstSeenRcvd>>32) : (theFlow->firstSeenSent>>32), outBuffer,outBufferBegin,outBufferMax);
break;
......@@ -1216,6 +1239,61 @@ static void handleTemplate(np_ctxt_t *npctxt, V9TemplateId *theTemplate,
copyInt32(usec, outBuffer,outBufferBegin,outBufferMax);
}
break;
case 160:
//FIXME int64
copyInt64(0,outBuffer, outBufferBegin, outBufferMax);
break;
case 161: // FLOW_DURATION_MILLISECONDS
if(direction==0)
copyInt64(msTimeDiff(theFlow->lastSeenSent,theFlow->firstSeenSent),outBuffer, outBufferBegin, outBufferMax);
else
copyInt64(msTimeDiff(theFlow->lastSeenRcvd,theFlow->firstSeenRcvd),outBuffer, outBufferBegin, outBufferMax);
break;
case 162: // FLOW_DURATION_MICROSECONDS
if(direction==0)
copyInt64(nsTimeDiff(theFlow->lastSeenSent,theFlow->firstSeenSent),outBuffer, outBufferBegin, outBufferMax);
else
copyInt64(nsTimeDiff(theFlow->lastSeenRcvd,theFlow->firstSeenRcvd),outBuffer, outBufferBegin, outBufferMax);
break;
case 163:
copyInt64(npctxt->numObservedFlows,outBuffer, outBufferBegin, outBufferMax);
break;
case 164: /* ignoredPacketTotalCount */
copyInt64(0,outBuffer, outBufferBegin, outBufferMax);
break;
case 165: /* ignoredOctetTotalCount */
copyInt64(0,outBuffer, outBufferBegin, outBufferMax);
break;
case 166: // FIXME
copyInt64(0,outBuffer, outBufferBegin, outBufferMax);
break;
case 167: // FIXME
copyInt64(0,outBuffer, outBufferBegin, outBufferMax);
break;
case 168: // FIXME
copyInt64(0,outBuffer, outBufferBegin, outBufferMax);
break;
case 190:
copyInt16(direction==0?theFlow->src2dstPktlenIpv4:theFlow->dst2srcPktlenIpv4,
outBuffer, outBufferBegin, outBufferMax);
break;
case 191:
copyInt32(direction==0?theFlow->src2dstPktlenIpv6:theFlow->dst2srcPktlenIpv6,
outBuffer, outBufferBegin, outBufferMax);
break;
case 207:
copyInt8(theFlow->headerlengthIPv4,outBuffer, outBufferBegin, outBufferMax);
break;
case 208:
copyInt64(direction==0?theFlow->optionsIPV4src2dst:theFlow->optionsIPV4dst2src,
outBuffer, outBufferBegin, outBufferMax);
break;
case 209: //FIXME int64
copyInt64(0,outBuffer, outBufferBegin, outBufferMax);
break;
case 210: // Padding, always 0
copyInt8(0,outBuffer, outBufferBegin, outBufferMax);
break;
case FID_HISTOGRAM_PKT_LNGTH: // HISTOGRAM_PKT_LNGTH
copyInt32ArrayToRelativeInt8(direction==0?theFlow->src2dstPktSizeHistogram:theFlow->dst2srcPktSizeHistogram,outBuffer,outBufferBegin,outBufferMax,PKTSZ_HISTOGRAM_SLOTS);
break;
......@@ -1231,17 +1309,9 @@ static void handleTemplate(np_ctxt_t *npctxt, V9TemplateId *theTemplate,
case FID_RATE_100SEC_MIN: // RATE_100SEC_MIN_TRANSFER
copyInt32(direction==0?theFlow->src2dstRateMin100sec:theFlow->dst2srcRateMin100sec, outBuffer, outBufferBegin,outBufferMax);
break;
case 32774: // FLOW_DURATION_MILLISECONDS
if(direction==0)
copyInt32(msTimeDiff(theFlow->lastSeenSent,theFlow->firstSeenSent),outBuffer, outBufferBegin, outBufferMax);
else
copyInt32(msTimeDiff(theFlow->lastSeenRcvd,theFlow->firstSeenRcvd),outBuffer, outBufferBegin, outBufferMax);
break;
case 32775: // FLOW_DURATION_MICROSECONDS
if(direction==0)
copyInt32(nsTimeDiff(theFlow->lastSeenSent,theFlow->firstSeenSent),outBuffer, outBufferBegin, outBufferMax);
else
copyInt32(nsTimeDiff(theFlow->lastSeenRcvd,theFlow->firstSeenRcvd),outBuffer, outBufferBegin, outBufferMax);
case FID_PAYLOAD:
exportPayload(npctxt, theFlow, direction, theTemplate,
outBuffer, outBufferBegin, outBufferMax);
break;
}
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment