+/*
+ * Cisco NetFlow protocol
+ *
+ * See
+ *
+ * https://www.cisco.com/c/en/us/td/docs/net_mgmt/netflow_collection_engine/3-6/user/guide/format.html#wp1005892
+ */
+
+#include <config.h>
+
+#include "netdissect-stdinc.h"
+
+#define ND_LONGJMP_FROM_TCHECK
+#include "netdissect.h"
+#include "addrtoname.h"
+#include "extract.h"
+
+#include "tcp.h"
+#include "ipproto.h"
+
+struct nfhdr_v1 {
+ nd_uint16_t version; /* version number */
+ nd_uint16_t count; /* # of records */
+ nd_uint32_t msys_uptime;
+ nd_uint32_t utc_sec;
+ nd_uint32_t utc_nsec;
+};
+
+struct nfrec_v1 {
+ nd_ipv4 src_ina;
+ nd_ipv4 dst_ina;
+ nd_ipv4 nhop_ina;
+ nd_uint16_t input; /* SNMP index of input interface */
+ nd_uint16_t output; /* SNMP index of output interface */
+ nd_uint32_t packets; /* packets in the flow */
+ nd_uint32_t octets; /* layer 3 octets in the packets of the flow */
+ nd_uint32_t start_time; /* sys_uptime value at start of flow */
+ nd_uint32_t last_time; /* sys_uptime value when last packet of flow was received */
+ nd_uint16_t srcport; /* TCP/UDP source port or equivalent */
+ nd_uint16_t dstport; /* TCP/UDP source port or equivalent */
+ nd_byte pad1[2]; /* pad */
+ nd_uint8_t proto; /* IP protocol type */
+ nd_uint8_t tos; /* IP type of service */
+ nd_uint8_t tcp_flags; /* cumulative OR of TCP flags */
+ nd_byte pad[3]; /* padding */
+ nd_uint32_t reserved; /* unused */
+};
+
+struct nfhdr_v5 {
+ nd_uint16_t version; /* version number */
+ nd_uint16_t count; /* # of records */
+ nd_uint32_t msys_uptime;
+ nd_uint32_t utc_sec;
+ nd_uint32_t utc_nsec;
+ nd_uint32_t sequence; /* flow sequence number */
+ nd_uint8_t engine_type; /* type of flow-switching engine */
+ nd_uint8_t engine_id; /* slot number of the flow-switching engine */
+ nd_uint16_t sampling_interval; /* sampling mode and interval */
+};
+
+struct nfrec_v5 {
+ nd_ipv4 src_ina;
+ nd_ipv4 dst_ina;
+ nd_ipv4 nhop_ina;
+ nd_uint16_t input; /* SNMP index of input interface */
+ nd_uint16_t output; /* SNMP index of output interface */
+ nd_uint32_t packets; /* packets in the flow */
+ nd_uint32_t octets; /* layer 3 octets in the packets of the flow */
+ nd_uint32_t start_time; /* sys_uptime value at start of flow */
+ nd_uint32_t last_time; /* sys_uptime value when last packet of flow was received */
+ nd_uint16_t srcport; /* TCP/UDP source port or equivalent */
+ nd_uint16_t dstport; /* TCP/UDP source port or equivalent */
+ nd_byte pad1; /* pad */
+ nd_uint8_t tcp_flags; /* cumulative OR of TCP flags */
+ nd_uint8_t proto; /* IP protocol type */
+ nd_uint8_t tos; /* IP type of service */
+ nd_uint16_t src_as; /* AS number of the source */
+ nd_uint16_t dst_as; /* AS number of the destination */
+ nd_uint8_t src_mask; /* source address mask bits */
+ nd_uint8_t dst_mask; /* destination address prefix mask bits */
+ nd_byte pad2[2];
+ nd_ipv4 peer_nexthop; /* v6: IP address of the nexthop within the peer (FIB)*/
+};
+
+struct nfhdr_v6 {
+ nd_uint16_t version; /* version number */
+ nd_uint16_t count; /* # of records */
+ nd_uint32_t msys_uptime;
+ nd_uint32_t utc_sec;
+ nd_uint32_t utc_nsec;
+ nd_uint32_t sequence; /* v5 flow sequence number */
+ nd_uint32_t reserved; /* v5 only */
+};
+
+struct nfrec_v6 {
+ nd_ipv4 src_ina;
+ nd_ipv4 dst_ina;
+ nd_ipv4 nhop_ina;
+ nd_uint16_t input; /* SNMP index of input interface */
+ nd_uint16_t output; /* SNMP index of output interface */
+ nd_uint32_t packets; /* packets in the flow */
+ nd_uint32_t octets; /* layer 3 octets in the packets of the flow */
+ nd_uint32_t start_time; /* sys_uptime value at start of flow */
+ nd_uint32_t last_time; /* sys_uptime value when last packet of flow was received */
+ nd_uint16_t srcport; /* TCP/UDP source port or equivalent */
+ nd_uint16_t dstport; /* TCP/UDP source port or equivalent */
+ nd_byte pad1; /* pad */
+ nd_uint8_t tcp_flags; /* cumulative OR of TCP flags */
+ nd_uint8_t proto; /* IP protocol type */
+ nd_uint8_t tos; /* IP type of service */
+ nd_uint16_t src_as; /* AS number of the source */
+ nd_uint16_t dst_as; /* AS number of the destination */
+ nd_uint8_t src_mask; /* source address mask bits */
+ nd_uint8_t dst_mask; /* destination address prefix mask bits */
+ nd_uint16_t flags;
+ nd_ipv4 peer_nexthop; /* v6: IP address of the nexthop within the peer (FIB)*/
+};
+
+static void
+cnfp_v1_print(netdissect_options *ndo, const u_char *cp)
+{
+ const struct nfhdr_v1 *nh;
+ const struct nfrec_v1 *nr;
+ const char *p_name;
+ uint8_t proto;
+ u_int nrecs, ver;
+#if 0
+ time_t t;
projects / tcpdump / blobdiff