X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/12813bb8891262302290826afe92347a6e2aaab1..47fc89d711eec0a073d9b3b293a1af901b5bd791:/print-cnfp.c diff --git a/print-cnfp.c b/print-cnfp.c index 025b78c5..79ca9819 100644 --- a/print-cnfp.c +++ b/print-cnfp.c @@ -32,18 +32,21 @@ /* Cisco NetFlow protocol */ -#include -#include -#include -#include +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif -#include -#include +#include #include #include #include "interface.h" +#include "addrtoname.h" +#include "extract.h" + +#include "tcp.h" +#include "ipproto.h" struct nfhdr { u_int32_t ver_cnt; /* version [15], and # of records */ @@ -55,9 +58,9 @@ struct nfhdr { }; struct nfrec { - in_addr_t src_ina; - in_addr_t dst_ina; - in_addr_t nhop_ina; + struct in_addr src_ina; + struct in_addr dst_ina; + struct in_addr nhop_ina; u_int32_t ifaces; /* src,dst ifaces */ u_int32_t packets; u_int32_t octets; @@ -66,75 +69,88 @@ struct nfrec { u_int32_t ports; /* src,dst ports */ u_int32_t proto_tos; /* proto, tos, pad, flags(v5) */ u_int32_t asses; /* v1: flags; v5: src,dst AS */ - u_int32_t masks; /* src,dst addr prefix */ - + u_int32_t masks; /* src,dst addr prefix; v6: encaps */ + struct in_addr peer_nexthop; /* v6: IP address of the nexthop within the peer (FIB)*/ }; void -cnfp_print(const u_char *cp, u_int len, const u_char *bp) +cnfp_print(const u_char *cp, const u_char *bp _U_) { register const struct nfhdr *nh; register const struct nfrec *nr; - register const struct ip *ip; struct protoent *pent; int nrecs, ver; +#if 0 time_t t; - char *p; +#endif - ip = (struct ip *)bp; - nh = (struct nfhdr *)cp; + nh = (const struct nfhdr *)cp; - if ((u_char *)(nh + 1) > snapend) + if ((const u_char *)(nh + 1) > snapend) return; - nrecs = ntohl(nh->ver_cnt) & 0xffff; - ver = (ntohl(nh->ver_cnt) & 0xffff0000) >> 16; - t = ntohl(nh->utc_sec); -/* (p = ctime(&t))[24] = '\0'; */ + nrecs = EXTRACT_32BITS(&nh->ver_cnt) & 0xffff; + ver = (EXTRACT_32BITS(&nh->ver_cnt) & 0xffff0000) >> 16; +#if 0 + /* + * This is seconds since the UN*X epoch, and is followed by + * nanoseconds. XXX - format it, rather than just dumping the + * raw seconds-since-the-Epoch. + */ + t = EXTRACT_32BITS(&nh->utc_sec); +#endif printf("NetFlow v%x, %u.%03u uptime, %u.%09u, ", ver, - ntohl(nh->msys_uptime)/1000, ntohl(nh->msys_uptime)%1000, - ntohl(nh->utc_sec), ntohl(nh->utc_nsec)); + EXTRACT_32BITS(&nh->msys_uptime)/1000, + EXTRACT_32BITS(&nh->msys_uptime)%1000, + EXTRACT_32BITS(&nh->utc_sec), EXTRACT_32BITS(&nh->utc_nsec)); - if (ver == 5) { - printf("#%u, ", htonl(nh->sequence)); - nr = (struct nfrec *)&nh[1]; + if (ver == 5 || ver == 6) { + printf("#%u, ", EXTRACT_32BITS(&nh->sequence)); + nr = (const struct nfrec *)&nh[1]; snaplen -= 24; } else { - nr = (struct nfrec *)&nh->sequence; + nr = (const struct nfrec *)&nh->sequence; snaplen -= 16; } printf("%2u recs", nrecs); - for (; nrecs-- && (u_char *)(nr + 1) <= snapend; nr++) { - char buf[5]; - char asbuf[7]; + for (; nrecs-- && (const u_char *)(nr + 1) <= snapend; nr++) { + char buf[20]; + char asbuf[20]; printf("\n started %u.%03u, last %u.%03u", - ntohl(nr->start_time)/1000, ntohl(nr->start_time)%1000, - ntohl(nr->last_time)/1000, ntohl(nr->last_time)%1000); + EXTRACT_32BITS(&nr->start_time)/1000, + EXTRACT_32BITS(&nr->start_time)%1000, + EXTRACT_32BITS(&nr->last_time)/1000, + EXTRACT_32BITS(&nr->last_time)%1000); asbuf[0] = buf[0] = '\0'; - if (ver == 5) { - sprintf(buf, "/%d", (ntohl(nr->masks) >> 24) & 0xff); - sprintf(asbuf, "%d:", (ntohl(nr->asses) >> 16) & 0xffff); + if (ver == 5 || ver == 6) { + snprintf(buf, sizeof(buf), "/%u", + (EXTRACT_32BITS(&nr->masks) >> 24) & 0xff); + snprintf(asbuf, sizeof(asbuf), ":%u", + (EXTRACT_32BITS(&nr->asses) >> 16) & 0xffff); } - printf("\n %s%s%s:%u ", inet_ntoa(nr->src_ina), buf, asbuf, - ntohl(nr->ports) >> 16); - - if (ver == 5) { - sprintf(buf, "/%d", (ntohl(nr->masks) >> 16) & 0xff); - sprintf(asbuf, "%d:", ntohl(nr->asses) & 0xffff); + printf("\n %s%s%s:%u ", intoa(nr->src_ina.s_addr), buf, asbuf, + EXTRACT_32BITS(&nr->ports) >> 16); + + if (ver == 5 || ver ==6) { + snprintf(buf, sizeof(buf), "/%d", + (EXTRACT_32BITS(&nr->masks) >> 16) & 0xff); + snprintf(asbuf, sizeof(asbuf), ":%u", + EXTRACT_32BITS(&nr->asses) & 0xffff); } - printf("> %s%s%s:%u ", inet_ntoa(nr->dst_ina), buf, asbuf, - ntohl(nr->ports) & 0xffff); + printf("> %s%s%s:%u ", intoa(nr->dst_ina.s_addr), buf, asbuf, + EXTRACT_32BITS(&nr->ports) & 0xffff); - printf(">> %s\n ", inet_ntoa(nr->nhop_ina)); + printf(">> %s\n ", intoa(nr->nhop_ina.s_addr)); - pent = getprotobynumber((ntohl(nr->proto_tos) >> 8) & 0xff); + pent = getprotobynumber((EXTRACT_32BITS(&nr->proto_tos) >> 8) & 0xff); if (!pent || nflag) - printf("%u ", (ntohl(nr->proto_tos) >> 8) & 0xff); + printf("%u ", + (EXTRACT_32BITS(&nr->proto_tos) >> 8) & 0xff); else printf("%s ", pent->p_name); @@ -142,9 +158,9 @@ cnfp_print(const u_char *cp, u_int len, const u_char *bp) if (pent && pent->p_proto == IPPROTO_TCP) { int flags; if (ver == 1) - flags = (ntohl(nr->asses) >> 24) & 0xff; + flags = (EXTRACT_32BITS(&nr->asses) >> 24) & 0xff; else - flags = (ntohl(nr->proto_tos) >> 16) & 0xff; + flags = (EXTRACT_32BITS(&nr->proto_tos) >> 16) & 0xff; if (flags & TH_FIN) putchar('F'); if (flags & TH_SYN) putchar('S'); if (flags & TH_RST) putchar('R'); @@ -154,11 +170,16 @@ cnfp_print(const u_char *cp, u_int len, const u_char *bp) if (flags) putchar(' '); } - printf("tos %u, %u (%u octets)", ntohl(nr->proto_tos) & 0xff, - ntohl(nr->packets), ntohl(nr->octets)); - + buf[0]='\0'; + if (ver == 6) { + snprintf(buf, sizeof(buf), "(%u<>%u encaps)", + (EXTRACT_32BITS(&nr->masks) >> 8) & 0xff, + (EXTRACT_32BITS(&nr->masks)) & 0xff); + } + printf("tos %u, %u (%u octets) %s", + EXTRACT_32BITS(&nr->proto_tos) & 0xff, + EXTRACT_32BITS(&nr->packets), + EXTRACT_32BITS(&nr->octets), buf); } - } -