netflow.h revision 158028
1189251Ssam/*- 2189251Ssam * Copyright (c) 2004 Gleb Smirnoff <glebius@FreeBSD.org> 3189251Ssam * All rights reserved. 4189251Ssam * 5189251Ssam * Redistribution and use in source and binary forms, with or without 6189251Ssam * modification, are permitted provided that the following conditions 7189251Ssam * are met: 8189251Ssam * 1. Redistributions of source code must retain the above copyright 9189251Ssam * notice, this list of conditions and the following disclaimer. 10189251Ssam * 2. Redistributions in binary form must reproduce the above copyright 11189251Ssam * notice, this list of conditions and the following disclaimer in the 12189251Ssam * documentation and/or other materials provided with the distribution. 13189251Ssam * 14189251Ssam * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15189251Ssam * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16189251Ssam * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17189251Ssam * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18189251Ssam * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19189251Ssam * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20189251Ssam * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21189251Ssam * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22189251Ssam * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23189251Ssam * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24189251Ssam * SUCH DAMAGE. 25189251Ssam * 26189251Ssam * $SourceForge: netflow.h,v 1.8 2004/09/16 17:05:11 glebius Exp $ 27189251Ssam * $FreeBSD: head/sys/netgraph/netflow/netflow.h 158028 2006-04-25 20:01:50Z maxim $ 28189251Ssam */ 29189251Ssam 30189251Ssam/* netflow timeouts in seconds */ 31189251Ssam 32189251Ssam#define ACTIVE_TIMEOUT (30*60) /* maximum flow lifetime is 30 min */ 33189251Ssam#define INACTIVE_TIMEOUT 15 34189251Ssam 35189251Ssam/* 36189251Ssam * More info can be found in these Cisco documents: 37189251Ssam * 38189251Ssam * Cisco IOS NetFlow, White Papers. 39189251Ssam * http://www.cisco.com/en/US/products/ps6601/prod_white_papers_list.html 40189251Ssam * 41189251Ssam * Cisco CNS NetFlow Collection Engine User Guide, 5.0.2, NetFlow Export 42189251Ssam * Datagram Formats. 43189251Ssam * http://www.cisco.com/en/US/products/sw/netmgtsw/ps1964/products_user_guide_chapter09186a00803f3147.html#wp26453 44189251Ssam * 45189251Ssam */ 46189251Ssam 47189251Ssam#define NETFLOW_V1 1 48189251Ssam#define NETFLOW_V5 5 49189251Ssam 50189251Ssamstruct netflow_v1_header 51189251Ssam{ 52189251Ssam uint16_t version; /* NetFlow version */ 53189251Ssam uint16_t count; /* Number of records in flow */ 54189251Ssam uint32_t sys_uptime; /* System uptime */ 55189251Ssam uint32_t unix_secs; /* Current seconds since 0000 UTC 1970 */ 56189251Ssam uint32_t unix_nsecs; /* Remaining nanoseconds since 0000 UTC 1970 */ 57189251Ssam} __attribute__((__packed__)); 58189251Ssam 59189251Ssamstruct netflow_v5_header 60189251Ssam{ 61189251Ssam uint16_t version; /* NetFlow version */ 62189251Ssam uint16_t count; /* Number of records in flow */ 63189251Ssam uint32_t sys_uptime; /* System uptime */ 64189251Ssam uint32_t unix_secs; /* Current seconds since 0000 UTC 1970 */ 65189251Ssam uint32_t unix_nsecs; /* Remaining nanoseconds since 0000 UTC 1970 */ 66189251Ssam uint32_t flow_seq; /* Sequence number of the first record */ 67189251Ssam uint8_t engine_type; /* Type of flow switching engine (RP,VIP,etc.) */ 68189251Ssam uint8_t engine_id; /* Slot number of the flow switching engine */ 69189251Ssam uint16_t pad; /* Pad to word boundary */ 70189251Ssam} __attribute__((__packed__)); 71189251Ssam 72189251Ssamstruct netflow_v1_record 73189251Ssam{ 74189251Ssam uint32_t src_addr; /* Source IP address */ 75189251Ssam uint32_t dst_addr; /* Destination IP address */ 76189251Ssam uint32_t next_hop; /* Next hop IP address */ 77189251Ssam uint16_t in_ifx; /* Source interface index */ 78189251Ssam uint16_t out_ifx; /* Destination interface index */ 79189251Ssam uint32_t packets; /* Number of packets in a flow */ 80189251Ssam uint32_t octets; /* Number of octets in a flow */ 81189251Ssam uint32_t first; /* System uptime at start of a flow */ 82189251Ssam uint32_t last; /* System uptime at end of a flow */ 83189251Ssam uint16_t s_port; /* Source port */ 84189251Ssam uint16_t d_port; /* Destination port */ 85189251Ssam uint16_t pad1; /* Pad to word boundary */ 86189251Ssam uint8_t prot; /* IP protocol */ 87189251Ssam uint8_t tos; /* IP type of service */ 88189251Ssam uint8_t flags; /* Cumulative OR of tcp flags */ 89189251Ssam uint8_t pad2; /* Pad to word boundary */ 90189251Ssam uint16_t pad3; /* Pad to word boundary */ 91189251Ssam uint8_t reserved[5]; /* Reserved for future use */ 92189251Ssam} __attribute__((__packed__)); 93189251Ssam 94189251Ssamstruct netflow_v5_record 95189251Ssam{ 96189251Ssam uint32_t src_addr; /* Source IP address */ 97189251Ssam uint32_t dst_addr; /* Destination IP address */ 98189251Ssam uint32_t next_hop; /* Next hop IP address */ 99189251Ssam uint16_t i_ifx; /* Source interface index */ 100189251Ssam uint16_t o_ifx; /* Destination interface index */ 101189251Ssam uint32_t packets; /* Number of packets in a flow */ 102189251Ssam uint32_t octets; /* Number of octets in a flow */ 103189251Ssam uint32_t first; /* System uptime at start of a flow */ 104189251Ssam uint32_t last; /* System uptime at end of a flow */ 105189251Ssam uint16_t s_port; /* Source port */ 106189251Ssam uint16_t d_port; /* Destination port */ 107189251Ssam uint8_t pad1; /* Pad to word boundary */ 108189251Ssam uint8_t flags; /* Cumulative OR of tcp flags */ 109189251Ssam uint8_t prot; /* IP protocol */ 110189251Ssam uint8_t tos; /* IP type of service */ 111189251Ssam uint16_t src_as; /* Src peer/origin Autonomous System */ 112189251Ssam uint16_t dst_as; /* Dst peer/origin Autonomous System */ 113189251Ssam uint8_t src_mask; /* Source route's mask bits */ 114189251Ssam uint8_t dst_mask; /* Destination route's mask bits */ 115189251Ssam uint16_t pad2; /* Pad to word boundary */ 116189251Ssam} __attribute__((__packed__)); 117189251Ssam 118189251Ssam#define NETFLOW_V1_MAX_RECORDS 24 119189251Ssam#define NETFLOW_V5_MAX_RECORDS 30 120189251Ssam 121189251Ssam#define NETFLOW_V1_MAX_SIZE (sizeof(netflow_v1_header)+ \ 122189251Ssam sizeof(netflow_v1_record)*NETFLOW_V1_MAX_RECORDS) 123189251Ssam#define NETFLOW_V5_MAX_SIZE (sizeof(netflow_v5_header)+ \ 124189251Ssam sizeof(netflow_v5_record)*NETFLOW_V5_MAX_RECORDS) 125189251Ssam 126189251Ssamstruct netflow_v5_export_dgram { 127189251Ssam struct netflow_v5_header header; 128189251Ssam struct netflow_v5_record r[NETFLOW_V5_MAX_RECORDS]; 129189251Ssam} __attribute__((__packed__)); 130189251Ssam