1 /* $OpenBSD: print-cnfp.c,v 1.2 1998/06/25 20:26:59 mickey Exp $ */ 2 3 /* 4 * Copyright (c) 1998 Michael Shalayeff 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. All advertising materials mentioning features or use of this software 16 * must display the following acknowledgement: 17 * This product includes software developed by Michael Shalayeff. 18 * 4. The name of the author may not be used to endorse or promote products 19 * derived from this software without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 /* Cisco NetFlow protocol */ 34 35 #ifndef lint 36 static const char rcsid[] = 37 "@(#) $Header: /tcpdump/master/tcpdump/print-cnfp.c,v 1.8 2001/09/17 21:57:58 fenner Exp $"; 38 #endif 39 40 #ifdef HAVE_CONFIG_H 41 #include "config.h" 42 #endif 43 44 #include <sys/types.h> 45 #include <sys/time.h> 46 #include <sys/socket.h> 47 #include <netdb.h> 48 49 #include <netinet/in.h> 50 51 #include <arpa/inet.h> 52 53 #include <stdio.h> 54 #include <string.h> 55 56 #include "interface.h" 57 58 #include "tcp.h" 59 60 struct nfhdr { 61 u_int32_t ver_cnt; /* version [15], and # of records */ 62 u_int32_t msys_uptime; 63 u_int32_t utc_sec; 64 u_int32_t utc_nsec; 65 u_int32_t sequence; /* v5 flow sequence number */ 66 u_int32_t reserved; /* v5 only */ 67 }; 68 69 struct nfrec { 70 struct in_addr src_ina; 71 struct in_addr dst_ina; 72 struct in_addr nhop_ina; 73 u_int32_t ifaces; /* src,dst ifaces */ 74 u_int32_t packets; 75 u_int32_t octets; 76 u_int32_t start_time; /* sys_uptime value */ 77 u_int32_t last_time; /* sys_uptime value */ 78 u_int32_t ports; /* src,dst ports */ 79 u_int32_t proto_tos; /* proto, tos, pad, flags(v5) */ 80 u_int32_t asses; /* v1: flags; v5: src,dst AS */ 81 u_int32_t masks; /* src,dst addr prefix; v6: encaps */ 82 struct in_addr peer_nexthop; /* v6: IP address of the nexthop within the peer (FIB)*/ 83 }; 84 85 void 86 cnfp_print(const u_char *cp, u_int len, const u_char *bp) 87 { 88 register const struct nfhdr *nh; 89 register const struct nfrec *nr; 90 register const struct ip *ip; 91 struct protoent *pent; 92 int nrecs, ver; 93 time_t t; 94 95 ip = (const struct ip *)bp; 96 nh = (const struct nfhdr *)cp; 97 98 if ((const u_char *)(nh + 1) > snapend) 99 return; 100 101 nrecs = ntohl(nh->ver_cnt) & 0xffff; 102 ver = (ntohl(nh->ver_cnt) & 0xffff0000) >> 16; 103 t = ntohl(nh->utc_sec); 104 /* (p = ctime(&t))[24] = '\0'; */ 105 106 printf("NetFlow v%x, %u.%03u uptime, %u.%09u, ", ver, 107 (unsigned)ntohl(nh->msys_uptime)/1000, 108 (unsigned)ntohl(nh->msys_uptime)%1000, 109 (unsigned)ntohl(nh->utc_sec), (unsigned)ntohl(nh->utc_nsec)); 110 111 if (ver == 5 || ver == 6) { 112 printf("#%u, ", (unsigned)htonl(nh->sequence)); 113 nr = (const struct nfrec *)&nh[1]; 114 snaplen -= 24; 115 } else { 116 nr = (const struct nfrec *)&nh->sequence; 117 snaplen -= 16; 118 } 119 120 printf("%2u recs", nrecs); 121 122 for (; nrecs-- && (const u_char *)(nr + 1) <= snapend; nr++) { 123 char buf[20]; 124 char asbuf[20]; 125 126 printf("\n started %u.%03u, last %u.%03u", 127 (unsigned)ntohl(nr->start_time)/1000, 128 (unsigned)ntohl(nr->start_time)%1000, 129 (unsigned)ntohl(nr->last_time)/1000, 130 (unsigned)ntohl(nr->last_time)%1000); 131 132 asbuf[0] = buf[0] = '\0'; 133 if (ver == 5 || ver == 6) { 134 snprintf(buf, sizeof(buf), "/%u", 135 (unsigned)(ntohl(nr->masks) >> 24) & 0xff); 136 snprintf(asbuf, sizeof(asbuf), ":%u", 137 (unsigned)(ntohl(nr->asses) >> 16) & 0xffff); 138 } 139 printf("\n %s%s%s:%u ", inet_ntoa(nr->src_ina), buf, asbuf, 140 (unsigned)ntohl(nr->ports) >> 16); 141 142 if (ver == 5 || ver ==6) { 143 snprintf(buf, sizeof(buf), "/%d", 144 (unsigned)(ntohl(nr->masks) >> 16) & 0xff); 145 snprintf(asbuf, sizeof(asbuf), ":%u", 146 (unsigned)ntohl(nr->asses) & 0xffff); 147 } 148 printf("> %s%s%s:%u ", inet_ntoa(nr->dst_ina), buf, asbuf, 149 (unsigned)ntohl(nr->ports) & 0xffff); 150 151 printf(">> %s\n ", inet_ntoa(nr->nhop_ina)); 152 153 pent = getprotobynumber((ntohl(nr->proto_tos) >> 8) & 0xff); 154 if (!pent || nflag) 155 printf("%u ", 156 (unsigned)(ntohl(nr->proto_tos) >> 8) & 0xff); 157 else 158 printf("%s ", pent->p_name); 159 160 /* tcp flags for tcp only */ 161 if (pent && pent->p_proto == IPPROTO_TCP) { 162 int flags; 163 if (ver == 1) 164 flags = (ntohl(nr->asses) >> 24) & 0xff; 165 else 166 flags = (ntohl(nr->proto_tos) >> 16) & 0xff; 167 if (flags & TH_FIN) putchar('F'); 168 if (flags & TH_SYN) putchar('S'); 169 if (flags & TH_RST) putchar('R'); 170 if (flags & TH_PUSH) putchar('P'); 171 if (flags & TH_ACK) putchar('A'); 172 if (flags & TH_URG) putchar('U'); 173 if (flags) 174 putchar(' '); 175 } 176 177 buf[0]='\0'; 178 if (ver == 6) { 179 snprintf(buf, sizeof(buf), "(%u<>%u encaps)", 180 (unsigned)(ntohl(nr->masks) >> 8) & 0xff, 181 (unsigned)(ntohl(nr->masks)) & 0xff); 182 } 183 printf("tos %u, %u (%u octets) %s", 184 (unsigned)ntohl(nr->proto_tos) & 0xff, 185 (unsigned)ntohl(nr->packets), 186 (unsigned)ntohl(nr->octets), buf); 187 } 188 } 189