1 /*- 2 * Copyright (c) 2004 Gleb Smirnoff <glebius@cell.sick.ru> 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. All advertising materials mentioning features or use of this software 14 * must display the following acknowledgement: 15 * This product includes software developed by Gleb Smirnoff and 16 * contributors. 17 * 4. Neither the name of the author nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 * 33 * $SourceForge: netflow.h,v 1.8 2004/09/16 17:05:11 glebius Exp $ 34 * $FreeBSD$ 35 */ 36 37 /* netflow timeouts in seconds */ 38 39 #define ACTIVE_TIMEOUT (30*60) /* maximum flow lifetime is 30 min */ 40 #define INACTIVE_TIMEOUT 15 41 42 /* More info can be found in these two Cisco documents: 43 * http://www.cisco.com/warp/public/cc/pd/iosw/ioft/neflct/tech/napps_wp.htm 44 * http://www.cisco.com/en/US/products/sw/netmgtsw/ps1964/prod_installation_guide09186a00800fea56.html#wp1006186 45 * However, they say quite different things. 46 */ 47 48 #define NETFLOW_V1 1 49 #define NETFLOW_V5 5 50 51 struct netflow_v1_header 52 { 53 uint16_t version; /* NetFlow version */ 54 uint16_t count; /* Number of records in flow */ 55 uint32_t sys_uptime; /* System uptime */ 56 uint32_t unix_secs; /* Current seconds since 0000 UTC 1970 */ 57 uint32_t unix_nsecs; /* Remaining nanoseconds since 0000 UTC 1970 */ 58 } __attribute__((__packed__)); 59 60 struct netflow_v5_header 61 { 62 uint16_t version; /* NetFlow version */ 63 uint16_t count; /* Number of records in flow */ 64 uint32_t sys_uptime; /* System uptime */ 65 uint32_t unix_secs; /* Current seconds since 0000 UTC 1970 */ 66 uint32_t unix_nsecs; /* Remaining nanoseconds since 0000 UTC 1970 */ 67 uint32_t flow_seq; /* Sequence number of the first record */ 68 uint8_t engine_type; /* Type of flow switching engine (RP,VIP,etc.) */ 69 uint8_t engine_id; /* Slot number of the flow switching engine */ 70 uint16_t pad; /* Pad to word boundary */ 71 } __attribute__((__packed__)); 72 73 struct netflow_v1_record 74 { 75 uint32_t src_addr; /* Source IP address */ 76 uint32_t dst_addr; /* Destination IP address */ 77 uint32_t next_hop; /* Next hop IP address */ 78 uint16_t in_ifx; /* Source interface index */ 79 uint16_t out_ifx; /* Destination interface index */ 80 uint32_t packets; /* Number of packets in a flow */ 81 uint32_t octets; /* Number of octets in a flow */ 82 uint32_t first; /* System uptime at start of a flow */ 83 uint32_t last; /* System uptime at end of a flow */ 84 uint16_t s_port; /* Source port */ 85 uint16_t d_port; /* Destination port */ 86 uint16_t pad1; /* Pad to word boundary */ 87 uint8_t prot; /* IP protocol */ 88 uint8_t tos; /* IP type of service */ 89 uint8_t flags; /* Cumulative OR of tcp flags */ 90 uint8_t pad2; /* pad to word boundary */ 91 uint16_t pad3; /* Pad to word boundary */ 92 uint8_t reserved[5]; /* Reserved for future use */ 93 } __attribute__((__packed__)); 94 95 struct netflow_v5_record 96 { 97 uint32_t src_addr; /* Source IP address */ 98 uint32_t dst_addr; /* Destination IP address */ 99 uint32_t next_hop; /* Next hop IP address */ 100 uint16_t i_ifx; /* Source interface index */ 101 uint16_t o_ifx; /* Destination interface index */ 102 uint32_t packets; /* Number of packets in a flow */ 103 uint32_t octets; /* Number of octets in a flow */ 104 uint32_t first; /* System uptime at start of a flow */ 105 uint32_t last; /* System uptime at end of a flow */ 106 uint16_t s_port; /* Source port */ 107 uint16_t d_port; /* Destination port */ 108 uint8_t pad1; /* pad to word boundary */ 109 uint8_t flags; /* Cumulative OR of tcp flags */ 110 uint8_t prot; /* IP protocol */ 111 uint8_t tos; /* IP type of service */ 112 uint16_t src_as; /* Src peer/origin Autonomous System */ 113 uint16_t dst_as; /* Dst peer/origin Autonomous System */ 114 uint8_t src_mask; /* Source route's mask bits */ 115 uint8_t dst_mask; /* Destination route's mask bits */ 116 uint16_t pad2; /* Pad to word boundary */ 117 } __attribute__((__packed__)); 118 119 #define NETFLOW_V1_MAX_RECORDS 24 120 #define NETFLOW_V5_MAX_RECORDS 30 121 122 #define NETFLOW_V1_MAX_SIZE (sizeof(netflow_v1_header)+ \ 123 sizeof(netflow_v1_record)*NETFLOW_V1_MAX_RECORDS) 124 #define NETFLOW_V5_MAX_SIZE (sizeof(netflow_v5_header)+ \ 125 sizeof(netflow_v5_record)*NETFLOW_V5_MAX_RECORDS) 126