NetFlow.h

// this is part of tacppd project
// (c) Copyright in 2000-2005 by tacppd team and contributors
// see http://tacppd.org for more information

//  This program is free software; you can redistribute it and/or modify
//  it under the terms of the GNU General Public License as published by
//  the Free Software Foundation; either version 2 of the License, or
//  (at your option) any later version.
//
//  This program is distributed in the hope that it will be useful,
//  but WITHOUT ANY WARRANTY; without even the implied warranty of
//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
//  GNU General Public License for more details.
//
//  You should have received a copy of the GNU General Public License
//  along with this program; if not, write to the Free Software
//  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

/*
The NetFlow packet fragments structures used from NetFlow
examples on Cisco Systems, Inc. web site
*/

// all comments which start from /** - this is comments for KDoc
//  for classes
//    @short [short description of the class]
//    @author [class author]
//    @version [class version]
//    @see [references to other classes or methods]
//  for methods
//    @see [references]
//    @return [sentence describing the return value]
//    @exception [list the exeptions that could be thrown]
//    @param [name id] [description]    - can be multiple

#ifndef __NETFLOW_H__
#define __NETFLOW_H__

#include "global.h"

namespace tacpp {

// set up types:
typedef unsigned char Bit8;
typedef unsigned short Bit16;
//#if SIZEOF_LONG == 4
typedef unsigned long Bit32;
//#elif SIZEOF_LONG == 8
//typedef unsigned int Bit32;
//#endif

//Bit16 aaa;
//Bit8 bbb;
//Bit32 ccc;

#define IP4_ADDR_LEN    4
#define TRANS_ADDR_LEN  2
#define AS_ADDR_LEN     2

#define   ushort        Bit16
#define   uchar         Bit8
#define   ulong         Bit32
#define   ipaddrtype    Bit32

//
// HDR_VER NetFlowHeader_vX NetFlow_vX NetFlow_vX ... NetFlow_vX
//
//

struct NetFlowHeader_v1 {
  ushort version;
  ushort count;
  ulong SysUptime;
  ulong unix_secs;
  ulong unix_nsecs;
};

struct NetFlowHeader_v5 {
  ushort version;
  ushort count;
  ulong SysUptime;
  ulong unix_secs;
  ulong unix_nsecs;
  ulong flow_sequence;
  uchar engine_type;
  uchar engine_id;
  ushort reserved;
};

struct NetFlowHeader_v7 {
  ushort version;
  ushort count;
  ulong SysUptime;
  ulong unix_secs;
  ulong unix_nsecs;
  ulong flow_sequence;
  ulong reserved;
};

struct NetFlowHeader_v8 {
  ushort version;
  ushort count;
  ulong SysUptime;
  ulong unix_secs;
  ulong unix_nsecs;
  ulong flow_sequence;
  uchar engine_type;
  uchar engine_id;
  uchar aggregation;
  uchar agg_version;
  ulong reserved;
};

struct NetFlow_v1 {
  ipaddrtype srcaddr;
  ipaddrtype dstaddr;
  ipaddrtype nexthop;
  ushort input;
  ushort output;
  ulong dPkts;
  ulong dOctets;
  ulong First;
  ulong Last;
  ushort srcport;
  ushort dstport;
  ushort pad1;
  uchar prot;
  uchar tos;
  uchar tcp_flags;
  uchar tcp_retx_cnt;
  uchar tcp_retx_secs;
  uchar tcp_misseq_cnt;
  ulong reserved;
};

struct NetFlow_v5 {
  ipaddrtype srcaddr;
  ipaddrtype dstaddr;
  ipaddrtype nexthop;
  ushort input;
  ushort output;
  ulong dPkts;
  ulong dOctets;
  ulong First;
  ulong Last;
  ushort srcport;
  ushort dstport;
  uchar pad1;
  uchar tcp_flags;
  uchar prot;
  uchar tos;
  ushort dst_as;
  ushort src_as;
  uchar dst_mask;
  uchar src_mask;
  ushort pad2;
};

struct NetFlow_v7 {
  ipaddrtype srcaddr;
  ipaddrtype dstaddr;
  ipaddrtype nexthop;
  ushort input;
  ushort output;
  ulong dPkts;
  ulong dOctets;
  ulong First;
  ulong Last;
  ushort srcport;
  ushort dstport;
  uchar flags;
  uchar tcp_flags;
  uchar prot;
  uchar tos;
  ulong src_as;
  ulong dst_as;
  uchar src_mask;
  uchar dst_mask;
  ushort pad;
  ipaddrtype router_sc;
};


// The aggregated flow records within version 8 NetFlow Export datagrams

struct NetFlow_v8_ASMatrix {
  ulong flows;
  ulong dPkts;
  ulong dOctets;
  ulong First;
  ulong Last;
  ushort src_as;
  ushort dst_as;
  ushort input;
  ushort output;
};

struct NetFlow_v8_ProtocolPortMatrix {
  ulong flows;
  ulong dPkts;
  ulong dOctets;
  ulong First;
  ulong Last;
  uchar prot;
  uchar pad;
  ushort reserved;
  ushort srcport;
  ushort dstport;
};

struct NetFlow_v8_SourcePrefixMatrix {
  ulong flows;
  ulong dPkts;
  ulong dOctets;
  ulong First;
  ulong Last;
  ipaddrtype src_prefix;
  uchar src_mask;
  uchar pad;
  ushort src_as;
  ushort input;
};

struct NetFlow_v8_DestinationPrefixMatrix {
  ulong flows;
  ulong dPkts;
  ulong dOctets;
  ulong First;
  ulong Last;
  ipaddrtype dst_prefix;
  uchar dst_mask;
  uchar pad;
  ushort dst_as;
  ushort output;
};

struct NetFlow_v8_PrefixMatrix {
  ulong flows;
  ulong dPkts;
  ulong dOctets;
  ulong First;
  ulong Last;
  ipaddrtype src_prefix;
  ipaddrtype dst_prefix;
  uchar dst_mask;
  uchar src_mask;
  ushort reserved;
  ushort src_as;
  ushort dst_as;
  ushort input;
  ushort output;
};


//    this is for collecting information

#undef ulong
#undef ushort
#undef uchar
#undef ipaddrtype

class NfData {
  pthread_mutex_t mutex_;
  void lock();
  void unlock();
  unsigned int ifin_;
  unsigned long octets_;
  unsigned long packets_;
  int protocol_;
  time_t startt_;
  time_t stopt_;
 public:
  NfData(unsigned long,unsigned long,unsigned int,time_t,time_t);
  ~NfData();
  void add(unsigned long,unsigned long,time_t);
  bool isExpired(time_t);
  unsigned int getIfIn();
  time_t getStart();
  time_t getStop();
  unsigned long getOctets();
  unsigned long getPackets();
};

class NfAggregator {
  pthread_mutex_t mutex_;
  void lock();
  void unlock();
  map<Bit32,map<Bit32,map<Bit32,NfData*> > > nfb_;
  pthread_t thrvar_;
  bool writeProcess_;
  int expireTime_;
  int buf_size_;
 public:
  void process(Bit32,char*);
  NfAggregator();
  ~NfAggregator();
  void runProcess();
  void add(Bit32,Bit32,Bit32,unsigned long,unsigned long,unsigned int,time_t,time_t);
  void expire();
  int size();
  int nodesSize();
  int sourceSize();
  bool getWriteProcess();
  void setWriteProcess(bool);
  int expireTime();
  void addExpireTime();
  void delExpireTime();
};

};

#endif //__NETFLOW_H__

---