forked from vjanelle/nprobe
-
Notifications
You must be signed in to change notification settings - Fork 0
/
nprobe.h
1509 lines (1264 loc) · 42.3 KB
/
nprobe.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/*
* nProbe - a Netflow v5/v9/IPFIX probe for IPv4/v6
*
* Copyright (C) 2002-2010 Luca Deri <[email protected]>
*
* http://www.ntop.org/
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License along
* with this program; if not, write to the Free Software Foundation, Inc.,
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
#ifndef _NPROBE_H_
#define _NPROBE_H_
/* *************************** */
//#define DEMO
#define MAX_DEMO_FLOWS 2000
#ifdef DEMO
#define DEMO_MODE
//#define MAKE_STATIC_PLUGINS
#endif
/* *************************** */
#include "config.h"
#ifndef _GNU_SOURCE
#define _GNU_SOURCE
#endif
/* See http://www.redhat.com/magazine/009jul05/features/execshield/ */
#ifndef _FORTIFY_SOURCE
#define _FORTIFY_SOURCE 2
#endif
#if defined(linux) || defined(__linux__)
#ifndef _GNU_SOURCE
#define _GNU_SOURCE
#endif
/*
* This allows to hide the (minimal) differences between linux and BSD
*/
#include <features.h>
#ifndef __FAVOR_BSD
#define __FAVOR_BSD
#endif
#ifndef _BSD_SOURCE
#define _BSD_SOURCE
#endif
#endif /* linux || __linux__ */
#ifdef WIN32
#include <winsock2.h> /* winsock.h is included automatically */
#include <process.h>
#include "dirent.h"
#endif
#include <stdio.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#ifdef HAVE_SYS_TIME_H
#include <sys/time.h>
#endif
#include <signal.h>
#include <fcntl.h>
#include <ctype.h>
#ifndef WIN32
#include <strings.h>
#include <pwd.h>
#endif
#include <limits.h>
#include <float.h>
#include <math.h>
#include <sys/types.h>
#ifdef linux
#include <sys/sysinfo.h>
#endif
#ifdef HAVE_SCHED_H
#ifndef __USE_GNU
#define __USE_GNU
#endif
#include <sched.h>
#endif
#ifndef WIN32
#include <sys/mman.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <net/if.h>
#include <netdb.h>
#ifdef HAVE_GDBM
#include <gdbm.h>
#endif
/* Courtesy of Curt Sampson <[email protected]> */
#ifdef __NetBSD__
#include <net/if_ether.h>
#endif
#ifdef HAVE_NETINET_IF_ETHER_H
#include <netinet/if_ether.h>
#endif
#ifdef HAVE_NET_ETHERNET_H
#include <net/ethernet.h>
#endif
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/ip6.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <netinet/ip_icmp.h>
#endif
#ifndef EMBEDDED
#include <sys/stat.h>
#endif
#include "pcap.h"
#ifdef HAVE_DL_H
#include <dl.h>
#endif
#ifdef HAVE_DLFCN_H
#include <dlfcn.h>
#endif
#ifdef HAVE_DIRENT_H
#include <dirent.h>
#endif
#ifdef WIN32
#define HAVE_MYSQL
#define HAVE_SQLITE
#endif
#ifdef HAVE_MYSQL
#include <mysql.h>
#define MYSQL_OPT "--mysql"
#define MYSQL_SKIP_DB_CREATION "--mysql-skip-db-creation"
#endif
#ifdef HAVE_LIBSQLITE3
#define HAVE_SQLITE
#endif
#ifdef HAVE_SQLITE
#include <sqlite3.h>
#endif
/* GeoIP */
#ifdef HAVE_GEOIP
#include "GeoIP.h"
#include "GeoIPCity.h"
#endif
#define TEMPLATE_LIST_LEN 48
#ifndef TH_FIN
#define TH_FIN 0x01
#endif
#ifndef TH_SYN
#define TH_SYN 0x02
#endif
#ifndef TH_RST
#define TH_RST 0x04
#endif
#ifndef TH_PUSH
#define TH_PUSH 0x08
#endif
#ifndef TH_ACK
#define TH_ACK 0x10
#endif
#ifndef TH_URG
#define TH_URG 0x20
#endif
/*
* Structure of a 10Mb/s Ethernet header.
*/
struct eth_header {
u_char ether_dhost[6];
u_char ether_shost[6];
u_short ether_type;
};
/* http://en.wikipedia.org/wiki/Stdint.h */
/* On various systems there's u_int64_t but not u_int64_t */
#include <pthread.h>
#ifndef WIN32
#include <stdarg.h>
#include <syslog.h>
#ifndef PTHREAD_RWLOCK_INITIALIZER
#undef HAVE_RW_LOCK
#endif
#ifndef HAVE_RW_LOCK
#define pthread_rwlock_t pthread_mutex_t
#define pthread_rwlock_init pthread_mutex_init
#define pthread_rwlock_wrlock pthread_mutex_lock
#define pthread_rwlock_unlock pthread_mutex_unlock
#endif
#else /* WIN32 */
#ifdef WIN32_THREADS
#define pthread_t HANDLE
#define pthread_mutex_t HANDLE
#define pthread_rwlock_t HANDLE
#endif
#if !defined (__GNUC__)
typedef u_int32_t tcp_seq;
#endif
/*
* TCP header.
* Per RFC 793, September, 1981.
*/
struct tcphdr {
u_short th_sport; /* source port */
u_short th_dport; /* destination port */
tcp_seq th_seq; /* sequence number */
tcp_seq th_ack; /* acknowledgement number */
#if BYTE_ORDER == LITTLE_ENDIAN
u_char th_x2:4, /* (unused) */
th_off:4; /* data offset */
#else
u_char th_off:4, /* data offset */
th_x2:4; /* (unused) */
#endif
u_char th_flags;
u_short th_win; /* window */
u_short th_sum; /* checksum */
u_short th_urp; /* urgent pointer */
};
/* ********************************************* */
struct ip {
#if BYTE_ORDER == LITTLE_ENDIAN
u_char ip_hl:4, /* header length */
ip_v:4; /* version */
#else
u_char ip_v:4, /* version */
ip_hl:4; /* header length */
#endif
u_char ip_tos; /* type of service */
short ip_len; /* total length */
u_short ip_id; /* identification */
short ip_off; /* fragment offset field */
#define IP_DF 0x4000 /* dont fragment flag */
#define IP_MF 0x2000 /* more fragments flag */
#define IP_OFFMASK 0x1fff /* mask for fragmenting bits */
u_char ip_ttl; /* time to live */
u_char ip_p; /* protocol */
u_short ip_sum; /* checksum */
struct in_addr ip_src,ip_dst; /* source and dest address */
};
/* ********************************************* */
/*
* Udp protocol header.
* Per RFC 768, September, 1981.
*/
struct udphdr {
u_short uh_sport; /* source port */
u_short uh_dport; /* destination port */
short uh_ulen; /* udp length */
u_short uh_sum; /* udp checksum */
};
extern int gettimeofday(struct timeval *tv, struct timezone *tz);
#ifndef WIN32
extern char *strtok_r(char *s, const char *delim, char **save_ptr);
#endif
extern int nprobe_sleep(int secToSleep);
#ifdef WIN32_THREADS
extern int pthread_create(pthread_t *threadId, void* notUsed, void *(*__start_routine) (void *), char* userParm);
extern void pthread_detach(pthread_t *threadId);
extern int pthread_mutex_init(pthread_mutex_t *mutex, char* notused);
extern void pthread_mutex_destroy(pthread_mutex_t *mutex);
extern int pthread_mutex_lock(pthread_mutex_t *mutex);
extern int pthread_mutex_trylock(pthread_mutex_t *mutex);
extern int pthread_mutex_unlock(pthread_mutex_t *mutex);
#define pthread_rwlock_init pthread_mutex_init
#define pthread_rwlock_wrlock pthread_mutex_lock
#define pthread_rwlock_unlock pthread_mutex_unlock
#endif
#endif /* WIN32 */
#ifdef WIN32
#define CONST_DIR_SEP '\\'
#else
#define CONST_DIR_SEP '/'
#endif
/* 2^32 minus a large value so that we won't wrap for sure */
#define BYTES_WRAP_THRESHOLD 0xFFFFCC00
#include "bucket.h"
typedef struct ether80211q {
u_int16_t vlanId;
u_int16_t protoType;
} Ether80211q;
/* GRE (Generic Route Encapsulation) */
#ifndef IPPROTO_GRE
#define IPPROTO_GRE 47
#endif
#define GRE_HEADER_CHECKSUM 0x8000 /* 32 bit */
#define GRE_HEADER_ROUTING 0x4000 /* 32 bit */
#define GRE_HEADER_KEY 0x2000 /* 32 bit */
#define GRE_HEADER_SEQ_NUM 0x1000 /* 32 bit */
struct gre_header {
u_int16_t flags_and_version;
u_int16_t proto;
};
/* GPRS Tunneling Protocol */
struct gtp_header {
u_int8_t flags, message_type;
u_int16_t total_length;
u_int32_t tunnel_id;
u_int16_t sequence_number;
u_int8_t pdu_nuber, next_ext_header;
};
#define NPROBE_REVISION "$Revision: 1831 $"
extern char nprobe_revision[];
typedef enum {
text_format = 0,
sqlite_format,
binary_format
} DumpFormat;
/* Update LogEventSeverity2Str in util.c when changing the structure below */
typedef enum {
severity_error = 0,
severity_warning,
severity_info
} LogEventSeverity;
/* Update LogEventType2Str in util.c when changing the structure below */
typedef enum {
probe_started = 0,
probe_stopped,
packet_drop,
flow_export_error,
collector_connection_error,
collector_connected,
collector_disconnected,
collector_too_slow
} LogEventType;
extern void allocateHash(void);
#ifdef ETHER_HEADER_HAS_EA
# define ESRC(ep) ((ep)->ether_shost.ether_addr_octet)
# define EDST(ep) ((ep)->ether_dhost.ether_addr_octet)
#else
# define ESRC(ep) ((ep)->ether_shost)
# define EDST(ep) ((ep)->ether_dhost)
#endif
/* BSD AF_ values. */
#define BSD_AF_INET 2
#define BSD_AF_INET6_BSD 24 /* OpenBSD (and probably NetBSD), BSD/OS */
#define BSD_AF_INET6_FREEBSD 28
#define BSD_AF_INET6_DARWIN 30
#if defined(DARWIN) && !defined(SNOW_LEOPARD)
#define PLUGIN_EXTENSION ".dylib"
#else
#define PLUGIN_EXTENSION ".so"
#endif
/*
Courtesy of http://ettercap.sourceforge.net/
*/
#ifndef CFG_LITTLE_ENDIAN
#define ptohs(x) ( (u_int16_t) \
((u_int16_t)*((u_int8_t *)x+1)<<8| \
(u_int16_t)*((u_int8_t *)x+0)<<0) \
)
#define ptohl(x) ( (u_int32)*((u_int8_t *)x+3)<<24| \
(u_int32)*((u_int8_t *)x+2)<<16| \
(u_int32)*((u_int8_t *)x+1)<<8| \
(u_int32)*((u_int8_t *)x+0)<<0 \
)
#else
#define ptohs(x) *(u_int16_t *)(x)
#define ptohl(x) *(u_int32 *)(x)
#endif
#define TCPOPT_EOL 0
#define TCPOPT_NOP 1
#define TCPOPT_MAXSEG 2
#define TCPOPT_WSCALE 3
#define TCPOPT_SACKOK 4
#define TCPOPT_TIMESTAMP 8
#define MAX_AS_PATH_LEN 10
/* ************************************ */
#ifndef ETHERTYPE_IP
#define ETHERTYPE_IP 0x0800 /* IP protocol */
#endif
#ifndef ETHERTYPE_IPV6
#define ETHERTYPE_IPV6 0x86DD /* IPv6 protocol */
#endif
#ifndef ETHERTYPE_MPLS
#define ETHERTYPE_MPLS 0x8847 /* MPLS protocol */
#endif
#ifndef ETHERTYPE_MPLS_MULTI
#define ETHERTYPE_MPLS_MULTI 0x8848 /* MPLS multicast packet */
#endif
#ifndef ETHERTYPE_PPPoE
#define ETHERTYPE_PPPoE 0x8864 /* PPP over Ethernet */
#endif
struct ether_mpls_header {
u_char label, exp, bos;
u_char ttl;
};
struct ppp_header {
u_int8_t address, control;
u_int16_t proto;
};
#define NULL_HDRLEN 4
#ifndef SOLARIS
/* VLAN support - Courtesy of Mikael Cam <[email protected]> - 2002/08/28 */
#ifndef ETHER_ADDR_LEN
#define ETHER_ADDR_LEN 6
#endif
struct ether_vlan_header {
u_char evl_dhost[ETHER_ADDR_LEN];
u_char evl_shost[ETHER_ADDR_LEN];
u_int16_t evl_encap_proto;
u_int16_t evl_tag;
u_int16_t evl_proto;
};
#endif
#ifdef SOLARIS
struct ip6_ext {
u_int8_t ip6e_nxt;
u_int8_t ip6e_len;
} __attribute__((__packed__));
#endif
#define NO_VLAN (u_int16_t)-1
#define MAX_VLAN 4096
#ifndef ETHERTYPE_VLAN
#define ETHERTYPE_VLAN 0x08100
#endif
typedef struct ipV4Fragment {
u_int32_t src, dst;
u_short fragmentId, numPkts, len, sport, dport;
time_t firstSeen;
struct ipV4Fragment *next;
} IpV4Fragment;
/* ************************************ */
#define TRANSPORT_UDP 1
#define TRANSPORT_TCP 2
#define TRANSPORT_SCTP 3
#ifdef IP_HDRINCL
#define TRANSPORT_UDP_RAW 4
#endif
typedef struct collectorAddress {
u_char isIPv6; /* 0=IPv4, 1=IPv6 or anything else (generic addrinfo) */
u_char transport; /* TRANSPORT_XXXX */
u_int flowSequence;
union {
struct sockaddr_in v4Address;
#ifndef IPV4_ONLY
struct sockaddr_in6 v6Address;
#endif
} u;
int sockFd; /* Socket file descriptor */
struct timeval lastExportTime; /* Time when last packet was exported [Set only with -e] */
} CollectorAddress;
/* ************************************ */
#ifndef WIN32
#include <pthread.h>
typedef struct conditionalVariable {
pthread_mutex_t mutex;
pthread_cond_t condvar;
int predicate;
} ConditionalVariable;
#else
typedef struct conditionalVariable {
HANDLE condVar;
CRITICAL_SECTION criticalSection;
} ConditionalVariable;
#endif
extern int createCondvar(ConditionalVariable *condvarId);
extern void deleteCondvar(ConditionalVariable *condvarId);
extern int waitCondvar(ConditionalVariable *condvarId);
extern int signalCondvar(ConditionalVariable *condvarId, int broadcast);
#define TEMP_PREFIX ".temp"
#define BUF_SIZE 512
#define NO_INTERFACE_INDEX ((u_int16_t)-1)
#define TRACE_ERROR 0, __FILE__, __LINE__
#define TRACE_WARNING 1, __FILE__, __LINE__
#define TRACE_NORMAL 2, __FILE__, __LINE__
#define TRACE_INFO 3, __FILE__, __LINE__
/* ************************************************ */
extern char *optarg;
/* ********** ICMP ******************** */
#ifdef WIN32
struct icmp_ra_addr
{
u_int32_t ira_addr;
u_int32_t ira_preference;
};
#endif /* WIN32 */
struct icmp_hdr
{
u_int8_t icmp_type; /* type of message, see below */
u_int8_t icmp_code; /* type sub code */
u_int16_t icmp_cksum; /* ones complement checksum of struct */
u_int16_t icmp_identifier, icmp_seqnum;
};
/*
* Definition of ICMP types and code field values.
*/
#define NPROBE_ICMP_ECHOREPLY 0 /* echo reply */
#define NPROBE_ICMP_UNREACH 3 /* dest unreachable, codes: */
#define NPROBE_ICMP_UNREACH_NET 0 /* bad net */
#define NPROBE_ICMP_UNREACH_HOST 1 /* bad host */
#define NPROBE_ICMP_UNREACH_PROTOCOL 2 /* bad protocol */
#define NPROBE_ICMP_UNREACH_PORT 3 /* bad port */
#define NPROBE_ICMP_UNREACH_NEEDFRAG 4 /* IP_DF caused drop */
#define NPROBE_ICMP_UNREACH_SRCFAIL 5 /* src route failed */
#define NPROBE_ICMP_UNREACH_NET_UNKNOWN 6 /* unknown net */
#define NPROBE_ICMP_UNREACH_HOST_UNKNOWN 7 /* unknown host */
#define NPROBE_ICMP_UNREACH_ISOLATED 8 /* src host isolated */
#define NPROBE_ICMP_UNREACH_NET_PROHIB 9 /* prohibited access */
#define NPROBE_ICMP_UNREACH_HOST_PROHIB 10 /* ditto */
#define NPROBE_ICMP_UNREACH_TOSNET 11 /* bad tos for net */
#define NPROBE_ICMP_UNREACH_TOSHOST 12 /* bad tos for host */
#define NPROBE_ICMP_UNREACH_FILTER_PROHIB 13 /* admin prohib */
#define NPROBE_ICMP_UNREACH_HOST_PRECEDENCE 14 /* host prec vio. */
#define NPROBE_ICMP_UNREACH_PRECEDENCE_CUTOFF 15 /* prec cutoff */
#define NPROBE_ICMP_SOURCEQUENCH 4 /* packet lost, slow down */
#define NPROBE_ICMP_REDIRECT 5 /* shorter route, codes: */
#define NPROBE_ICMP_REDIRECT_NET 0 /* for network */
#define NPROBE_ICMP_REDIRECT_HOST 1 /* for host */
#define NPROBE_ICMP_REDIRECT_TOSNET 2 /* for tos and net */
#define NPROBE_ICMP_REDIRECT_TOSHOST 3 /* for tos and host */
#define NPROBE_ICMP_ECHO 8 /* echo service */
#define NPROBE_ICMP_ROUTERADVERT 9 /* router advertisement */
#define NPROBE_ICMP_ROUTERSOLICIT 10 /* router solicitation */
#define NPROBE_ICMP_TIMXCEED 11 /* time exceeded, code: */
#define NPROBE_ICMP_TIMXCEED_INTRANS 0 /* ttl==0 in transit */
#define NPROBE_ICMP_TIMXCEED_REASS 1 /* ttl==0 in reass */
#define NPROBE_ICMP_PARAMPROB 12 /* ip header bad */
#define NPROBE_ICMP_PARAMPROB_ERRATPTR 0 /* error at param ptr */
#define NPROBE_ICMP_PARAMPROB_OPTABSENT 1 /* req. opt. absent */
#define NPROBE_ICMP_PARAMPROB_LENGTH 2 /* bad length */
#define NPROBE_ICMP_TSTAMP 13 /* timestamp request */
#define NPROBE_ICMP_TSTAMPREPLY 14 /* timestamp reply */
#define NPROBE_ICMP_IREQ 15 /* information request */
#define NPROBE_ICMP_IREQREPLY 16 /* information reply */
#define NPROBE_ICMP_MASKREQ 17 /* address mask request */
#define NPROBE_ICMP_MASKREPLY 18 /* address mask reply */
#define NPROBE_ICMP_MAXTYPE 18
/* ********* NETFLOW ****************** */
/*
For more info see:
http://www.cisco.com/warp/public/cc/pd/iosw/ioft/neflct/tech/napps_wp.htm
ftp://ftp.net.ohio-state.edu/users/maf/cisco/
*/
/* ********************************* */
#define FLOW_VERSION_1 1
#define V1FLOWS_PER_PAK 30
struct flow_ver1_hdr {
u_int16_t version; /* Current version = 1*/
u_int16_t count; /* The number of records in PDU. */
u_int32_t sysUptime; /* Current time in msecs since router booted */
u_int32_t unix_secs; /* Current seconds since 0000 UTC 1970 */
u_int32_t unix_nsecs; /* Residual nanoseconds since 0000 UTC 1970 */
};
struct flow_ver1_rec {
u_int32_t srcaddr; /* Source IP Address */
u_int32_t dstaddr; /* Destination IP Address */
u_int32_t nexthop; /* Next hop router's IP Address */
u_int16_t input; /* Input interface index */
u_int16_t output; /* Output interface index */
u_int32_t dPkts; /* Packets sent in Duration */
u_int32_t dOctets; /* Octets sent in Duration */
u_int32_t first; /* SysUptime at start of flow */
u_int32_t last; /* and of last packet of the flow */
u_int16_t srcport; /* TCP/UDP source port number (.e.g, FTP, Telnet, etc.,or equivalent) */
u_int16_t dstport; /* TCP/UDP destination port number (.e.g, FTP, Telnet, etc.,or equivalent) */
u_int16_t pad; /* pad to word boundary */
u_int8_t proto; /* IP protocol, e.g., 6=TCP, 17=UDP, etc... */
u_int8_t tos; /* IP Type-of-Service */
u_int8_t pad2[7]; /* pad to word boundary */
};
typedef struct single_flow_ver1_rec {
struct flow_ver1_hdr flowHeader;
struct flow_ver1_rec flowRecord[V1FLOWS_PER_PAK+1 /* safe against buffer overflows */];
} NetFlow1Record;
/* ***************************************** */
#define FLOW_VERSION_5 5
#define V5FLOWS_PER_PAK 30
struct flow_ver5_hdr {
u_int16_t version; /* Current version=5*/
u_int16_t count; /* The number of records in PDU. */
u_int32_t sysUptime; /* Current time in msecs since router booted */
u_int32_t unix_secs; /* Current seconds since 0000 UTC 1970 */
u_int32_t unix_nsecs; /* Residual nanoseconds since 0000 UTC 1970 */
u_int32_t flow_sequence; /* Sequence number of total flows seen */
u_int8_t engine_type; /* Type of flow switching engine (RP,VIP,etc.)*/
u_int8_t engine_id; /* Slot number of the flow switching engine */
u_int16_t sampleRate; /* Packet capture sample rate */
};
struct flow_ver5_rec {
u_int32_t srcaddr; /* Source IP Address */
u_int32_t dstaddr; /* Destination IP Address */
u_int32_t nexthop; /* Next hop router's IP Address */
u_int16_t input; /* Input interface index */
u_int16_t output; /* Output interface index */
u_int32_t dPkts; /* Packets sent in Duration (milliseconds between 1st
& last packet in this flow)*/
u_int32_t dOctets; /* Octets sent in Duration (milliseconds between 1st
& last packet in this flow)*/
u_int32_t first; /* SysUptime at start of flow */
u_int32_t last; /* and of last packet of the flow */
u_int16_t srcport; /* TCP/UDP source port number (.e.g, FTP, Telnet, etc.,or equivalent) */
u_int16_t dstport; /* TCP/UDP destination port number (.e.g, FTP, Telnet, etc.,or equivalent) */
u_int8_t pad1; /* pad to word boundary */
u_int8_t tcp_flags; /* Cumulative OR of tcp flags */
u_int8_t proto; /* IP protocol, e.g., 6=TCP, 17=UDP, etc... */
u_int8_t tos; /* IP Type-of-Service */
u_int16_t src_as; /* source peer/origin Autonomous System */
u_int16_t dst_as; /* dst peer/origin Autonomous System */
u_int8_t src_mask; /* source route's mask bits */
u_int8_t dst_mask; /* destination route's mask bits */
u_int16_t pad2; /* pad to word boundary */
};
typedef struct single_flow_ver5_rec {
struct flow_ver5_hdr flowHeader;
struct flow_ver5_rec flowRecord[V5FLOWS_PER_PAK+1 /* safe against buffer overflows */];
} NetFlow5Record;
/* ************************************ */
#define FLOW_VERSION_7 7
#define V7FLOWS_PER_PAK 28
/* ********************************* */
struct flow_ver7_hdr {
u_int16_t version; /* Current version=7*/
u_int16_t count; /* The number of records in PDU. */
u_int32_t sysUptime; /* Current time in msecs since router booted */
u_int32_t unix_secs; /* Current seconds since 0000 UTC 1970 */
u_int32_t unix_nsecs; /* Residual nanoseconds since 0000 UTC 1970 */
u_int32_t flow_sequence; /* Sequence number of total flows seen */
u_int32_t reserved;
};
struct flow_ver7_rec {
u_int32_t srcaddr; /* Source IP Address */
u_int32_t dstaddr; /* Destination IP Address */
u_int32_t nexthop; /* Next hop router's IP Address */
u_int16_t input; /* Input interface index */
u_int16_t output; /* Output interface index */
u_int32_t dPkts; /* Packets sent in Duration */
u_int32_t dOctets; /* Octets sent in Duration */
u_int32_t first; /* SysUptime at start of flow */
u_int32_t last; /* and of last packet of the flow */
u_int16_t srcport; /* TCP/UDP source port number (.e.g, FTP, Telnet, etc.,or equivalent) */
u_int16_t dstport; /* TCP/UDP destination port number (.e.g, FTP, Telnet, etc.,or equivalent) */
u_int8_t flags; /* Shortcut mode(dest only,src only,full flows*/
u_int8_t tcp_flags; /* Cumulative OR of tcp flags */
u_int8_t proto; /* IP protocol, e.g., 6=TCP, 17=UDP, etc... */
u_int8_t tos; /* IP Type-of-Service */
u_int16_t dst_as; /* dst peer/origin Autonomous System */
u_int16_t src_as; /* source peer/origin Autonomous System */
u_int8_t dst_mask; /* destination route's mask bits */
u_int8_t src_mask; /* source route's mask bits */
u_int16_t pad2; /* pad to word boundary */
u_int32_t router_sc; /* Router which is shortcut by switch */
};
typedef struct single_flow_ver7_rec {
struct flow_ver7_hdr flowHeader;
struct flow_ver7_rec flowRecord[V7FLOWS_PER_PAK+1 /* safe against buffer overflows */];
} NetFlow7Record;
/* ************************************ */
#define IN_PAYLOAD_ID 96
#define OUT_PAYLOAD_ID 97
/* NetFlow v9/IPFIX */
typedef struct flow_ver9_hdr {
u_int16_t version; /* Current version=9*/
u_int16_t count; /* The number of records in PDU. */
u_int32_t sysUptime; /* Current time in msecs since router booted */
u_int32_t unix_secs; /* Current seconds since 0000 UTC 1970 */
u_int32_t flow_sequence; /* Sequence number of total flows seen */
u_int32_t sourceId; /* Source id */
} V9FlowHeader;
typedef struct flow_ver9_template_field {
u_int16_t fieldId;
u_int16_t fieldLen;
u_int8_t isPenField;
} V9V10TemplateField;
typedef struct flow_ver9_template_header {
u_int16_t templateFlowset; /* = 0 */
u_int16_t flowsetLen;
} V9TemplateHeader;
typedef struct flow_ver9_template_def {
u_int16_t templateId;
u_int16_t fieldCount;
} V9TemplateDef;
typedef struct flow_ver9_ipfix_simple_template {
/* V9TemplateHeader */
u_int16_t flowsetLen;
/* V9TemplateDef */
u_int16_t templateId;
u_int16_t fieldCount, scopeFieldCount, v9ScopeLen;
u_int32_t netflow_device_ip;
u_int8_t isOptionTemplate;
} V9IpfixSimpleTemplate;
typedef struct flow_ver9_option_template {
u_int16_t templateFlowset; /* = 0 */
u_int16_t flowsetLen;
u_int16_t templateId;
u_int16_t optionScopeLen;
u_int16_t optionLen;
} V9OptionTemplate;
typedef struct flow_ver9_flow_set {
u_int16_t templateId;
u_int16_t flowsetLen;
} V9FlowSet;
typedef struct flow_set {
u_int16_t templateId;
u_int16_t fieldCount;
} FlowSet;
typedef struct flowSetV9Ipfix {
V9IpfixSimpleTemplate templateInfo;
u_int16_t flowLen; /* Real flow length */
V9V10TemplateField *fields;
struct flowSetV9Ipfix *next;
} FlowSetV9Ipfix;
#define STANDARD_ENTERPRISE_ID 0
#define NTOP_ENTERPRISE_ID 0x00008B30 /* IANA assignment for ntop */
typedef enum {
ascii_format = 0,
hex_format,
numeric_format,
ipv6_address_format
} ElementFormat;
typedef enum {
/*
NOTE
whenever this datastructure is updated
you ought to also update
dumpformat2ascii and printMetadata (plugin.c)
*/
dump_as_uint = 0, /* 1234567890 */
dump_as_formatted_uint, /* 123'456 */
dump_as_ip_port,
dump_as_ip_proto,
dump_as_ipv4_address,
dump_as_ipv6_address,
dump_as_mac_address,
dump_as_epoch,
dump_as_bool,
dump_as_tcp_flags,
dump_as_hex,
dump_as_ascii
} ElementDumpFormat;
#define FLOW_TEMPLATE 0
#define OPTION_TEMPLATE 1
#define SHORT_SNAPLEN 0
#define LONG_SNAPLEN 1
#define STATIC_FIELD_LEN 1
#define VARIABLE_FIELD_LEN 2
typedef struct flow_ver9_ipfix_template_elementids {
u_int8_t isOptionTemplate; /* 0=flow template, 1=option template */
u_int8_t useLongSnaplen;
u_int32_t templateElementEnterpriseId;
u_int16_t templateElementId;
u_int8_t variableFieldLength;
u_int16_t templateElementLen;
ElementFormat elementFormat; /* Only for elements longer than 4 bytes */
ElementDumpFormat fileDumpFormat; /* Hint when data has to be printed on
a human readable form */
char *templateElementName, *templateElementDescr;
} V9V10TemplateElementId;
#define NTOP_BASE_ID 57472
/* ******************************************* */
/*
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Version Number | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Export Time |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Observation Domain ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
typedef struct flow_ipfix_hdr {
u_int16_t version; /* Current version = 10 */
u_int16_t len; /* The length of the IPFIX PDU */
u_int32_t sysUptime; /* Current time in msecs since router booted */
u_int32_t flow_sequence; /* Sequence number of total flows seen */
u_int32_t observationDomainId; /* Source id */
} IPFIXFlowHeader;
typedef struct flow_ipfix_set {
u_int16_t set_id, set_len;
} IPFIXSet;
typedef struct flow_ipfix_field {
u_int16_t field_id, field_len;
u_int32_t enterprise_number;
} IPFIXField;
/* Bitmask */
typedef struct {
u_int32_t num_bits;
void *bits_memory;
} bitmask_selector;
/* ******************************************* */
typedef struct {
u_int32_t idx; /* Packet Hashing */
u_int8_t proto;
u_int8_t sampledPacket;
u_short numFragments;
u_short numPkts;
u_char tos;
u_short vlanId;
u_int32_t tunnel_id;
struct eth_header ehdr;
IpAddress src;
u_short sport;
IpAddress dst;
u_short dport;
u_int8_t untunneled_proto;
IpAddress untunneled_src;
u_short untunneled_sport;
IpAddress untunneled_dst;
u_short untunneled_dport;
u_int len;
u_int8_t tcpFlags;
u_int32_t tcpSeqNum;
u_int8_t icmpType, icmpCode;
u_short numMplsLabels;
u_char mplsLabels[MAX_NUM_MPLS_LABELS][MPLS_LABEL_LEN];
u_int16_t if_input, if_output;
struct pcap_pkthdr h;
u_char *p;
u_int16_t payload_shift;
u_int payloadLen, originalPayloadLen;
time_t _firstSeen; /* Always set to 0 unless numPkts > 0 */
u_int32_t src_as, dst_as;
u_int16_t src_mask, dst_mask;
u_int32_t flow_sender_ip;
} QueuedPacket;
#define DEFAULT_QUEUE_CAPACITY 4096
typedef struct {
u_int32_t insert_idx, remove_idx, queue_capacity, queue_full_num_loops;
u_int32_t num_queued_pkts, num_dequeued_pkts, queue_full_num_drops;
ConditionalVariable queue_condvar, dequeue_condvar;
QueuedPacket *queue;
} PacketQueue;
/* ************************************ */
#define NETFLOW_MAX_BUFFER_LEN 1440
#define MAX_EXPORT_QUEUE_LEN 2*65536