1 /* 2 * Argus Software 3 * Copyright (c) 2000-2016 QoSient, LLC 4 * All rights reserved. 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation; either version 2, or (at your option) 9 * any later version. 10 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 16 * You should have received a copy of the GNU General Public License 17 * along with this program; if not, write to the Free Software 18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. 19 * 20 */ 21 22 /* 23 * $Id: //depot/argus/clients/include/argus_util.h#104 $ 24 * $DateTime: 2016/06/01 15:17:28 $ 25 * $Change: 3148 $ 26 */ 27 28 #ifndef ArgusUtil_h 29 #define ArgusUtil_h 30 31 #ifdef __cplusplus 32 extern "C" { 33 #endif 34 35 #include <argus_os.h> 36 #include <argus_compat.h> 37 38 #include <netinet/in_systm.h> 39 #include <netinet/ip.h> 40 41 #if defined(ARGUS_THREADS) 42 #include <pthread.h> 43 #endif 44 45 #include <argus_def.h> 46 #include <argus_out.h> 47 48 #include <argus/cons_out.h> 49 #include <argus/cflowd.h> 50 51 #define ARGUS_MAX_PRINT_ALG 201 52 #define MAX_PRINT_ALG_TYPES 201 53 54 55 #include <argus/CflowdFlowPdu.h> 56 57 typedef void (*proc)(void); 58 typedef char *(*strproc)(void); 59 60 struct ArgusQueueHeader { 61 struct ArgusQueueHeader *nxt; 62 struct ArgusQueueHeader *prv; 63 struct ArgusQueueStruct *queue; 64 struct timeval lasttime, logtime; 65 }; 66 67 struct ArgusMemoryHeader { 68 struct ArgusMemoryHeader *nxt, *prv; 69 #if defined(__GNUC__) 70 void *frame[3]; 71 #endif 72 unsigned int tag; 73 unsigned short len; 74 unsigned short offset; 75 }; 76 77 struct ArgusMemoryList { 78 struct ArgusMemoryHeader *start, *end; 79 #if defined(ARGUS_THREADS) 80 pthread_mutex_t lock; 81 #endif 82 int total, count, size; 83 int out, in, freed; 84 }; 85 86 struct ArgusQueueStruct { 87 unsigned int count, status, arraylen; 88 #if defined(ARGUS_THREADS) 89 pthread_mutex_t lock; 90 #endif 91 struct ArgusQueueHeader *start, *end; 92 struct ArgusQueueHeader **array; 93 }; 94 95 struct enamemem { 96 u_short e_addr0; 97 u_short e_addr1; 98 u_short e_addr2; 99 char *e_oui; 100 char *e_name; 101 char *e_ouiname; 102 u_char *e_nsap; /* used only for nsaptable[] */ 103 #define e_bs e_nsap /* for byestringtable */ 104 struct enamemem *e_nxt; 105 }; 106 107 struct protoidmem { 108 u_int p_oui; 109 arg_uint16 p_proto; 110 char *p_name; 111 struct protoidmem *p_nxt; 112 }; 113 114 #include <argus_parser.h> 115 #include <argus_cluster.h> 116 117 #if defined(__OpenBSD__) 118 #include <netinet/in_systm.h> 119 #include <netinet/ip.h> 120 #endif 121 122 #include <netinet/ip_icmp.h> 123 #undef ICMP_MAXTYPE 124 #define ICMP_MAXTYPE 47 125 126 127 struct ArgusFileEntry { 128 struct ArgusFileEntry *nxt; 129 char *str; 130 }; 131 132 133 #define ARGUS_NOLOCK 0x00 134 #define ARGUS_LOCK 0x01 135 #define ARGUS_NOSORT 0x02 136 137 #define ARGUS_RFILE_LIST 1 138 #define ARGUS_WFILE_LIST 2 139 #define ARGUS_DEVICE_LIST 3 140 #define ARGUS_OUTPUT_LIST 4 141 #define ARGUS_MODE_LIST 5 142 143 144 struct ArgusListObjectStruct { 145 struct ArgusListObjectStruct *nxt, *prv; 146 union { 147 void *obj; 148 unsigned int val; 149 } list_union; 150 }; 151 152 #define list_obj list_union.obj 153 #define list_val list_union.val 154 155 struct ArgusListRecord { 156 struct ArgusListObjectStruct *nxt, *prv; 157 struct ArgusRecordHeader argus; 158 }; 159 160 struct ArgusListStruct { 161 struct ArgusListObjectStruct *start; 162 struct ArgusListObjectStruct *end; 163 #if defined(ARGUS_THREADS) 164 pthread_mutex_t lock; 165 pthread_cond_t cond; 166 #endif 167 struct timeval outputTime, reportTime; 168 unsigned int count; 169 }; 170 171 struct ArgusPrintFieldStruct { 172 char *field, *format; 173 int length, index, type, value; 174 void (*print)(struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 175 void (*label)(struct ArgusParserStruct *, char *, int); 176 char *dbformat, *pformat; 177 int offset, pair, attr; 178 }; 179 180 /* 181 * hash tables for whatever-to-name translations 182 */ 183 184 #define HASHNAMESIZE 8192 185 186 struct h6namemem { 187 struct h6namemem *nxt; 188 int sec; 189 struct in6_addr addr; 190 char *name; 191 }; 192 193 struct hnamemem { 194 struct hnamemem *nxt; 195 int sec; 196 char *name, *nname; 197 u_int addr, status; 198 }; 199 200 struct evendmem { 201 struct evendmem *nxt; 202 u_int addr; 203 char *name; 204 }; 205 206 207 #define Version1 1 208 #define Version5 5 209 #define Version6 6 210 #define Version7 7 211 #define Version8 8 212 213 214 struct ArgusRecord *ArgusNetFlowCallRecord (struct ArgusParserStruct *, struct ArgusInput *, u_char **, int *); 215 struct ArgusRecord *ArgusNetFlowDetailInt (struct ArgusParserStruct *, struct ArgusInput *, u_char **, int *); 216 struct ArgusRecord *ArgusParseCiscoRecord (struct ArgusParserStruct *, struct ArgusInput *, u_char **, int *); 217 218 #ifdef ARGUS_SASL 219 #include <sasl/sasl.h> 220 #endif 221 222 #include <sys/stat.h> 223 #include <stdio.h> 224 225 #define ARGUS_DATA_SOURCE 0x01 226 #define ARGUS_V2_DATA_SOURCE 0x02 227 #define ARGUS_SFLOW_DATA_SOURCE 0x04 228 #define ARGUS_JFLOW_DATA_SOURCE 0x08 229 #define ARGUS_CISCO_DATA_SOURCE 0x10 230 #define ARGUS_DATAGRAM_SOURCE 0x20 231 #define ARGUS_IPFIX_DATA_SOURCE 0x40 232 #define ARGUS_FLOW_TOOLS_SOURCE 0x80 233 234 #define ARGUS_NAMED_PIPE_SOURCE 0x100 235 236 #define ARGUS_MY_ADDRESS 1 237 #define ARGUS_MY_NETWORK 2 238 239 240 #define ipaddr_string(p) ArgusGetName(ArgusParser, (u_char *)(p)) 241 242 #ifdef ArgusUtil 243 244 void ArgusHandleSig (int); 245 246 char *chroot_dir = NULL; 247 uid_t new_uid; 248 gid_t new_gid; 249 250 251 extern int ArgusDeletePIDFile (struct ArgusParserStruct *); 252 extern char *ArgusCreatePIDFile (struct ArgusParserStruct *, char *); 253 254 void ArgusMainInit (struct ArgusParserStruct *, int, char **); 255 256 int RaDescend(char *); 257 int RaProcessRecursiveFiles (char *); 258 259 #define RAENVITEMS 2 260 261 char *RaResourceEnvStr [] = { 262 "HOME", 263 "ARGUSHOME", 264 }; 265 266 char *RaOutputFilter = NULL; 267 char *RaHomePath = NULL; 268 269 int RaWriteOut = 1; 270 int ArgusSOptionRecord = 1; 271 272 long thiszone; 273 274 void ArgusParseArgs (struct ArgusParserStruct *, int, char **); 275 276 char *ArgusTrimString (char *str); 277 char *ArgusGetString (struct ArgusParserStruct *, u_char *, int); 278 279 280 void ArgusPrintBssid (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 281 void ArgusPrintSsid (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 282 void ArgusPrintCause (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 283 void ArgusPrintStartDate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 284 void ArgusPrintLastDate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 285 void ArgusPrintSrcStartDate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 286 void ArgusPrintSrcLastDate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 287 void ArgusPrintDstStartDate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 288 void ArgusPrintDstLastDate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 289 void ArgusPrintRelativeDate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 290 void ArgusPrintSourceID (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 291 void ArgusPrintFlags (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 292 void ArgusPrintMacAddress (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 293 void ArgusPrintSrcMacAddress (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 294 void ArgusPrintDstMacAddress (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 295 void ArgusPrintProto (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 296 void ArgusPrintAddr (struct ArgusParserStruct *, char *, int, void *, int, unsigned char, int, int); 297 void ArgusPrintSrcNet (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 298 void ArgusPrintSrcAddr (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 299 void ArgusPrintDstNet (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 300 void ArgusPrintDstAddr (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 301 void ArgusPrintLocalNet (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 302 void ArgusPrintLocalAddr (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 303 void ArgusPrintRemoteNet (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 304 void ArgusPrintRemoteAddr (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 305 void ArgusPrintPort (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int, unsigned char, unsigned int, int, int); 306 void ArgusPrintSrcPort (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 307 void ArgusPrintDstPort (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 308 void ArgusPrintDirection (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 309 void ArgusPrintPackets (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 310 void ArgusPrintSrcPackets (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 311 void ArgusPrintDstPackets (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 312 void ArgusPrintBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 313 void ArgusPrintSrcBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 314 void ArgusPrintDstBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 315 316 void ArgusPrintAppBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 317 void ArgusPrintSrcAppBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 318 void ArgusPrintDstAppBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 319 320 void ArgusPrintProducerConsumerRatio (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 321 void ArgusPrintAppByteRatio (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 322 323 void ArgusPrintTransEfficiency (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 324 void ArgusPrintSrcTransEfficiency (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 325 void ArgusPrintDstTransEfficiency (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 326 327 void ArgusPrintSrcIntPkt (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 328 void ArgusPrintSrcIntPktDist (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 329 void ArgusPrintDstIntPkt (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 330 void ArgusPrintDstIntPktDist (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 331 void ArgusPrintActiveIntPkt (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 332 void ArgusPrintActiveIntPkt (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 333 void ArgusPrintActiveIntPktDist (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 334 void ArgusPrintActiveSrcIntPkt (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 335 void ArgusPrintActiveSrcIntPktDist (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 336 void ArgusPrintActiveDstIntPkt (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 337 void ArgusPrintActiveDstIntPktDist (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 338 void ArgusPrintIdleIntPkt (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 339 void ArgusPrintIdleIntPktDist (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 340 void ArgusPrintIdleSrcIntPkt (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 341 void ArgusPrintIdleSrcIntPktDist (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 342 void ArgusPrintIdleDstIntPkt (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 343 void ArgusPrintIdleDstIntPktDist (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 344 void ArgusPrintSrcIntPktMax (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 345 void ArgusPrintSrcIntPktMin (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 346 void ArgusPrintDstIntPktMax (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 347 void ArgusPrintDstIntPktMin (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 348 void ArgusPrintActiveSrcIntPktMax (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 349 void ArgusPrintActiveSrcIntPktMin (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 350 void ArgusPrintActiveDstIntPktMax (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 351 void ArgusPrintActiveDstIntPktMin (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 352 void ArgusPrintIdleSrcIntPktMax (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 353 void ArgusPrintIdleSrcIntPktMin (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 354 void ArgusPrintIdleDstIntPktMax (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 355 void ArgusPrintIdleDstIntPktMin (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 356 void ArgusPrintSrcJitter (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 357 void ArgusPrintDstJitter (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 358 void ArgusPrintActiveSrcJitter (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 359 void ArgusPrintActiveDstJitter (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 360 void ArgusPrintIdleJitter (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 361 void ArgusPrintIdleSrcJitter (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 362 void ArgusPrintIdleDstJitter (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 363 void ArgusPrintState (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 364 void ArgusPrintDeltaDuration (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 365 void ArgusPrintDeltaStartTime (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 366 void ArgusPrintDeltaLastTime (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 367 void ArgusPrintDeltaSrcPkts (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 368 void ArgusPrintDeltaDstPkts (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 369 void ArgusPrintDeltaSrcBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 370 void ArgusPrintDeltaDstBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 371 void ArgusPrintPercentDeltaSrcPkts (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 372 void ArgusPrintPercentDeltaDstPkts (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 373 void ArgusPrintPercentDeltaSrcBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 374 void ArgusPrintPercentDeltaDstBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 375 void ArgusPrintSrcUserData (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 376 void ArgusPrintDstUserData (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 377 void ArgusPrintUserData (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 378 void ArgusPrintTCPOptions (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 379 void ArgusPrintTCPExtensions (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 380 void ArgusPrintSrcLoad (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 381 void ArgusPrintDstLoad (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 382 void ArgusPrintLoad (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 383 void ArgusPrintSrcLoss (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 384 void ArgusPrintDstLoss (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 385 void ArgusPrintLoss (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 386 void ArgusPrintPercentSrcLoss (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 387 void ArgusPrintPercentDstLoss (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 388 void ArgusPrintPercentLoss (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 389 void ArgusPrintSrcRetrans (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 390 void ArgusPrintDstRetrans (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 391 void ArgusPrintRetrans (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 392 void ArgusPrintPercentSrcRetrans (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 393 void ArgusPrintPercentDstRetrans (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 394 void ArgusPrintPercentRetrans (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 395 void ArgusPrintSrcNacks (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 396 void ArgusPrintDstNacks (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 397 void ArgusPrintNacks (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 398 void ArgusPrintPercentSrcNacks (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 399 void ArgusPrintPercentDstNacks (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 400 void ArgusPrintPercentNacks (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 401 402 void ArgusPrintSrcSolo (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 403 void ArgusPrintDstSolo (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 404 void ArgusPrintSolo (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 405 void ArgusPrintPercentSrcSolo (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 406 void ArgusPrintPercentDstSolo (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 407 void ArgusPrintPercentSolo (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 408 void ArgusPrintSrcFirst (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 409 void ArgusPrintDstFirst (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 410 void ArgusPrintFirst (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 411 void ArgusPrintPercentSrcFirst (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 412 void ArgusPrintPercentDstFirst (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 413 void ArgusPrintPercentFirst (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 414 void ArgusPrintAutoId (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 415 416 void ArgusPrintSrcRate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 417 void ArgusPrintDstRate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 418 void ArgusPrintRate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 419 void ArgusPrintSrcTos (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 420 void ArgusPrintDstTos (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 421 void ArgusPrintSrcDSByte (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 422 void ArgusPrintDstDSByte (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 423 void ArgusPrintSrcIpId (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 424 void ArgusPrintDstIpId (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 425 void ArgusPrintSrcTtl (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 426 void ArgusPrintDstTtl (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 427 void ArgusPrintSrcVlan (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 428 void ArgusPrintDstVlan (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 429 void ArgusPrintSrcVID (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 430 void ArgusPrintDstVID (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 431 void ArgusPrintSrcVPRI (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 432 void ArgusPrintDstVPRI (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 433 void ArgusPrintSrcMpls (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 434 void ArgusPrintDstMpls (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 435 void ArgusPrintSrcWindow (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 436 void ArgusPrintDstWindow (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 437 void ArgusPrintJoinDelay (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 438 void ArgusPrintLeaveDelay (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 439 void ArgusPrintMean (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 440 void ArgusPrintMin (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 441 void ArgusPrintMax (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 442 void ArgusPrintStdDeviation (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 443 void ArgusPrintStartRange (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 444 void ArgusPrintEndRange (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 445 void ArgusPrintSrcDuration (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 446 void ArgusPrintDstDuration (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 447 void ArgusPrintDuration (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 448 void ArgusPrintTransactions (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 449 void ArgusPrintSequenceNumber (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 450 void ArgusPrintRank (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 451 void ArgusPrintBinNumber (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 452 void ArgusPrintBins (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 453 void ArgusPrintTCPSrcBase (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 454 void ArgusPrintTCPDstBase (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 455 void ArgusPrintTCPRTT (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 456 void ArgusPrintTCPSynAck (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 457 void ArgusPrintTCPAckDat (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 458 void ArgusPrintTCPSrcMax (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 459 void ArgusPrintTCPDstMax (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 460 void ArgusPrintSrcGap (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 461 void ArgusPrintDstGap (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 462 void ArgusPrintManStatus (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 463 void ArgusPrintICMPStatus (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 464 void ArgusPrintIGMPStatus (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 465 void ArgusPrintIPStatus (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 466 void ArgusPrintInode (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 467 void ArgusPrintByteOffset (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 468 void ArgusPrintSrcEncaps (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 469 void ArgusPrintDstEncaps (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 470 void ArgusPrintSrcPktSize (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 471 void ArgusPrintSrcMaxPktSize (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 472 void ArgusPrintSrcMinPktSize (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 473 void ArgusPrintSrcMeanPktSize (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 474 void ArgusPrintDstPktSize (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 475 void ArgusPrintDstMaxPktSize (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 476 void ArgusPrintDstMinPktSize (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 477 void ArgusPrintDstMeanPktSize (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 478 void ArgusPrintSrcCountryCode (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 479 void ArgusPrintDstCountryCode (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 480 void ArgusPrintInodeCountryCode (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 481 void ArgusPrintSrcHopCount (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 482 void ArgusPrintDstHopCount (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 483 void ArgusPrintIcmpId (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 484 void ArgusPrintLabel (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 485 void ArgusPrintSrcAsn (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 486 void ArgusPrintDstAsn (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 487 void ArgusPrintInodeAsn (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 488 void ArgusPrintKeyStrokeSrcNStroke (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 489 void ArgusPrintKeyStrokeDstNStroke (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 490 void ArgusPrintKeyStrokeNStroke (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 491 void ArgusPrintSum (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 492 void ArgusPrintRunTime (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 493 void ArgusPrintIdleTime (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 494 void ArgusPrintResponse (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 495 void ArgusPrintSrcOui (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 496 void ArgusPrintDstOui (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 497 void ArgusPrintCor (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 498 499 500 void ArgusPrintBssidLabel (struct ArgusParserStruct *, char *, int); 501 void ArgusPrintSsidLabel (struct ArgusParserStruct *, char *, int); 502 void ArgusPrintCauseLabel (struct ArgusParserStruct *, char *, int); 503 void ArgusPrintStartDateLabel (struct ArgusParserStruct *, char *, int); 504 void ArgusPrintLastDateLabel (struct ArgusParserStruct *, char *, int); 505 void ArgusPrintSrcStartDateLabel (struct ArgusParserStruct *, char *, int); 506 void ArgusPrintSrcLastDateLabel (struct ArgusParserStruct *, char *, int); 507 void ArgusPrintDstStartDateLabel (struct ArgusParserStruct *, char *, int); 508 void ArgusPrintDstLastDateLabel (struct ArgusParserStruct *, char *, int); 509 void ArgusPrintRelativeDateLabel (struct ArgusParserStruct *, char *, int); 510 void ArgusPrintSourceIDLabel (struct ArgusParserStruct *, char *, int); 511 void ArgusPrintFlagsLabel (struct ArgusParserStruct *, char *, int); 512 void ArgusPrintSrcMacAddressLabel (struct ArgusParserStruct *, char *, int); 513 void ArgusPrintDstMacAddressLabel (struct ArgusParserStruct *, char *, int); 514 void ArgusPrintMacAddressLabel (struct ArgusParserStruct *, char *, int); 515 void ArgusPrintProtoLabel (struct ArgusParserStruct *, char *, int); 516 void ArgusPrintAddrLabel (struct ArgusParserStruct *, char *, int); 517 void ArgusPrintSrcNetLabel (struct ArgusParserStruct *, char *, int); 518 void ArgusPrintSrcAddrLabel (struct ArgusParserStruct *, char *, int); 519 void ArgusPrintDstNetLabel (struct ArgusParserStruct *, char *, int); 520 void ArgusPrintDstAddrLabel (struct ArgusParserStruct *, char *, int); 521 void ArgusPrintLocalNetLabel (struct ArgusParserStruct *, char *, int); 522 void ArgusPrintLocalAddrLabel (struct ArgusParserStruct *, char *, int); 523 void ArgusPrintRemoteNetLabel (struct ArgusParserStruct *, char *, int); 524 void ArgusPrintRemoteAddrLabel (struct ArgusParserStruct *, char *, int); 525 void ArgusPrintSrcPortLabel (struct ArgusParserStruct *, char *, int); 526 void ArgusPrintDstPortLabel (struct ArgusParserStruct *, char *, int); 527 void ArgusPrintSrcIpIdLabel (struct ArgusParserStruct *, char *, int); 528 void ArgusPrintDstIpIdLabel (struct ArgusParserStruct *, char *, int); 529 void ArgusPrintIpIdLabel (struct ArgusParserStruct *, char *, int); 530 void ArgusPrintSrcTtlLabel (struct ArgusParserStruct *, char *, int); 531 void ArgusPrintDstTtlLabel (struct ArgusParserStruct *, char *, int); 532 void ArgusPrintTtlLabel (struct ArgusParserStruct *, char *, int); 533 void ArgusPrintDirectionLabel (struct ArgusParserStruct *, char *, int); 534 void ArgusPrintPacketsLabel (struct ArgusParserStruct *, char *, int); 535 void ArgusPrintSrcPacketsLabel (struct ArgusParserStruct *, char *, int); 536 void ArgusPrintDstPacketsLabel (struct ArgusParserStruct *, char *, int); 537 void ArgusPrintBytesLabel (struct ArgusParserStruct *, char *, int); 538 void ArgusPrintSrcBytesLabel (struct ArgusParserStruct *, char *, int); 539 void ArgusPrintDstBytesLabel (struct ArgusParserStruct *, char *, int); 540 541 void ArgusPrintAppBytesLabel (struct ArgusParserStruct *, char *, int); 542 void ArgusPrintSrcAppBytesLabel (struct ArgusParserStruct *, char *, int); 543 void ArgusPrintDstAppBytesLabel (struct ArgusParserStruct *, char *, int); 544 545 void ArgusPrintProducerConsumerRatioLabel (struct ArgusParserStruct *, char *, int); 546 void ArgusPrintAppByteRatioLabel (struct ArgusParserStruct *, char *, int); 547 548 void ArgusPrintTransEfficiencyLabel (struct ArgusParserStruct *, char *, int); 549 void ArgusPrintSrcTransEfficiencyLabel (struct ArgusParserStruct *, char *, int); 550 void ArgusPrintDstTransEfficiencyLabel (struct ArgusParserStruct *, char *, int); 551 552 void ArgusPrintSrcIntPktLabel (struct ArgusParserStruct *, char *, int); 553 void ArgusPrintSrcIntPktDistLabel (struct ArgusParserStruct *, char *, int); 554 void ArgusPrintDstIntPktLabel (struct ArgusParserStruct *, char *, int); 555 void ArgusPrintDstIntPktDistLabel (struct ArgusParserStruct *, char *, int); 556 void ArgusPrintActiveSrcIntPktLabel (struct ArgusParserStruct *, char *, int); 557 void ArgusPrintActiveSrcIntPktDistLabel (struct ArgusParserStruct *, char *, int); 558 void ArgusPrintActiveDstIntPktLabel (struct ArgusParserStruct *, char *, int); 559 void ArgusPrintActiveDstIntPktDistLabel (struct ArgusParserStruct *, char *, int); 560 void ArgusPrintIdleSrcIntPktLabel (struct ArgusParserStruct *, char *, int); 561 void ArgusPrintIdleSrcIntPktDistLabel (struct ArgusParserStruct *, char *, int); 562 void ArgusPrintIdleDstIntPktLabel (struct ArgusParserStruct *, char *, int); 563 void ArgusPrintIdleDstIntPktDistLabel (struct ArgusParserStruct *, char *, int); 564 void ArgusPrintSrcIntPktMaxLabel (struct ArgusParserStruct *, char *, int); 565 void ArgusPrintSrcIntPktMinLabel (struct ArgusParserStruct *, char *, int); 566 void ArgusPrintDstIntPktMaxLabel (struct ArgusParserStruct *, char *, int); 567 void ArgusPrintDstIntPktMinLabel (struct ArgusParserStruct *, char *, int); 568 void ArgusPrintActiveSrcIntPktMaxLabel (struct ArgusParserStruct *, char *, int); 569 void ArgusPrintActiveSrcIntPktMinLabel (struct ArgusParserStruct *, char *, int); 570 void ArgusPrintActiveDstIntPktMaxLabel (struct ArgusParserStruct *, char *, int); 571 void ArgusPrintActiveDstIntPktMinLabel (struct ArgusParserStruct *, char *, int); 572 void ArgusPrintIdleSrcIntPktMaxLabel (struct ArgusParserStruct *, char *, int); 573 void ArgusPrintIdleSrcIntPktMinLabel (struct ArgusParserStruct *, char *, int); 574 void ArgusPrintIdleDstIntPktMaxLabel (struct ArgusParserStruct *, char *, int); 575 void ArgusPrintIdleDstIntPktMinLabel (struct ArgusParserStruct *, char *, int); 576 void ArgusPrintSrcJitterLabel (struct ArgusParserStruct *, char *, int); 577 void ArgusPrintDstJitterLabel (struct ArgusParserStruct *, char *, int); 578 void ArgusPrintActiveSrcJitterLabel (struct ArgusParserStruct *, char *, int); 579 void ArgusPrintActiveDstJitterLabel (struct ArgusParserStruct *, char *, int); 580 void ArgusPrintIdleSrcJitterLabel (struct ArgusParserStruct *, char *, int); 581 void ArgusPrintIdleDstJitterLabel (struct ArgusParserStruct *, char *, int); 582 void ArgusPrintStateLabel (struct ArgusParserStruct *, char *, int); 583 void ArgusPrintDeltaDurationLabel (struct ArgusParserStruct *, char *, int); 584 void ArgusPrintDeltaStartTimeLabel (struct ArgusParserStruct *, char *, int); 585 void ArgusPrintDeltaLastTimeLabel (struct ArgusParserStruct *, char *, int); 586 void ArgusPrintDeltaSrcPktsLabel (struct ArgusParserStruct *, char *, int); 587 void ArgusPrintDeltaDstPktsLabel (struct ArgusParserStruct *, char *, int); 588 void ArgusPrintDeltaSrcBytesLabel (struct ArgusParserStruct *, char *, int); 589 void ArgusPrintDeltaDstBytesLabel (struct ArgusParserStruct *, char *, int); 590 void ArgusPrintPercentDeltaSrcPktsLabel (struct ArgusParserStruct *, char *, int); 591 void ArgusPrintPercentDeltaDstPktsLabel (struct ArgusParserStruct *, char *, int); 592 void ArgusPrintPercentDeltaSrcBytesLabel (struct ArgusParserStruct *, char *, int); 593 void ArgusPrintPercentDeltaDstBytesLabel (struct ArgusParserStruct *, char *, int); 594 void ArgusPrintSrcUserDataLabel (struct ArgusParserStruct *, char *, int); 595 void ArgusPrintDstUserDataLabel (struct ArgusParserStruct *, char *, int); 596 void ArgusPrintUserDataLabel (struct ArgusParserStruct *, char *, int); 597 void ArgusPrintTCPOptionsLabel (struct ArgusParserStruct *, char *, int); 598 void ArgusPrintTCPExtensionsLabel (struct ArgusParserStruct *, char *, int); 599 void ArgusPrintSrcLoadLabel (struct ArgusParserStruct *, char *, int); 600 void ArgusPrintDstLoadLabel (struct ArgusParserStruct *, char *, int); 601 void ArgusPrintLoadLabel (struct ArgusParserStruct *, char *, int); 602 void ArgusPrintSrcLossLabel (struct ArgusParserStruct *, char *, int); 603 void ArgusPrintDstLossLabel (struct ArgusParserStruct *, char *, int); 604 void ArgusPrintLossLabel (struct ArgusParserStruct *, char *, int); 605 void ArgusPrintSrcRetransLabel (struct ArgusParserStruct *, char *, int); 606 void ArgusPrintDstRetransLabel (struct ArgusParserStruct *, char *, int); 607 void ArgusPrintRetransLabel (struct ArgusParserStruct *, char *, int); 608 void ArgusPrintPercentSrcRetransLabel (struct ArgusParserStruct *, char *, int); 609 void ArgusPrintPercentDstRetransLabel (struct ArgusParserStruct *, char *, int); 610 void ArgusPrintPercentRetransLabel (struct ArgusParserStruct *, char *, int); 611 void ArgusPrintSrcNacksLabel (struct ArgusParserStruct *, char *, int); 612 void ArgusPrintDstNacksLabel (struct ArgusParserStruct *, char *, int); 613 void ArgusPrintNacksLabel (struct ArgusParserStruct *, char *, int); 614 void ArgusPrintPercentSrcNacksLabel (struct ArgusParserStruct *, char *, int); 615 void ArgusPrintPercentDstNacksLabel (struct ArgusParserStruct *, char *, int); 616 void ArgusPrintPercentNacksLabel (struct ArgusParserStruct *, char *, int); 617 void ArgusPrintSrcSoloLabel (struct ArgusParserStruct *, char *, int); 618 void ArgusPrintDstSoloLabel (struct ArgusParserStruct *, char *, int); 619 void ArgusPrintSoloLabel (struct ArgusParserStruct *, char *, int); 620 void ArgusPrintPercentSrcSoloLabel (struct ArgusParserStruct *, char *, int); 621 void ArgusPrintPercentDstSoloLabel (struct ArgusParserStruct *, char *, int); 622 void ArgusPrintPercentSoloLabel (struct ArgusParserStruct *, char *, int); 623 void ArgusPrintSrcFirstLabel (struct ArgusParserStruct *, char *, int); 624 void ArgusPrintDstFirstLabel (struct ArgusParserStruct *, char *, int); 625 void ArgusPrintFirstLabel (struct ArgusParserStruct *, char *, int); 626 void ArgusPrintPercentSrcFirstLabel (struct ArgusParserStruct *, char *, int); 627 void ArgusPrintPercentDstFirstLabel (struct ArgusParserStruct *, char *, int); 628 void ArgusPrintPercentFirstLabel (struct ArgusParserStruct *, char *, int); 629 void ArgusPrintPercentSrcLossLabel (struct ArgusParserStruct *, char *, int); 630 void ArgusPrintPercentDstLossLabel (struct ArgusParserStruct *, char *, int); 631 void ArgusPrintPercentLossLabel (struct ArgusParserStruct *, char *, int); 632 void ArgusPrintSrcRateLabel (struct ArgusParserStruct *, char *, int); 633 void ArgusPrintDstRateLabel (struct ArgusParserStruct *, char *, int); 634 void ArgusPrintRateLabel (struct ArgusParserStruct *, char *, int); 635 void ArgusPrintSrcTosLabel (struct ArgusParserStruct *, char *, int); 636 void ArgusPrintDstTosLabel (struct ArgusParserStruct *, char *, int); 637 void ArgusPrintSrcDSByteLabel (struct ArgusParserStruct *, char *, int); 638 void ArgusPrintDstDSByteLabel (struct ArgusParserStruct *, char *, int); 639 void ArgusPrintSrcVlanLabel (struct ArgusParserStruct *, char *, int); 640 void ArgusPrintDstVlanLabel (struct ArgusParserStruct *, char *, int); 641 void ArgusPrintSrcVIDLabel (struct ArgusParserStruct *, char *, int); 642 void ArgusPrintDstVIDLabel (struct ArgusParserStruct *, char *, int); 643 void ArgusPrintSrcVPRILabel (struct ArgusParserStruct *, char *, int); 644 void ArgusPrintDstVPRILabel (struct ArgusParserStruct *, char *, int); 645 void ArgusPrintSrcMplsLabel (struct ArgusParserStruct *, char *, int); 646 void ArgusPrintDstMplsLabel (struct ArgusParserStruct *, char *, int); 647 void ArgusPrintWindowLabel (struct ArgusParserStruct *, char *, int); 648 void ArgusPrintSrcWindowLabel (struct ArgusParserStruct *, char *, int); 649 void ArgusPrintDstWindowLabel (struct ArgusParserStruct *, char *, int); 650 void ArgusPrintJoinDelayLabel (struct ArgusParserStruct *, char *, int); 651 void ArgusPrintLeaveDelayLabel (struct ArgusParserStruct *, char *, int); 652 void ArgusPrintMeanLabel (struct ArgusParserStruct *, char *, int); 653 void ArgusPrintMinLabel (struct ArgusParserStruct *, char *, int); 654 void ArgusPrintMaxLabel (struct ArgusParserStruct *, char *, int); 655 void ArgusPrintStdDeviationLabel (struct ArgusParserStruct *, char *, int); 656 void ArgusPrintStartRangeLabel (struct ArgusParserStruct *, char *, int); 657 void ArgusPrintEndRangeLabel (struct ArgusParserStruct *, char *, int); 658 void ArgusPrintSrcDurationLabel (struct ArgusParserStruct *, char *, int); 659 void ArgusPrintDstDurationLabel (struct ArgusParserStruct *, char *, int); 660 void ArgusPrintDurationLabel (struct ArgusParserStruct *, char *, int); 661 void ArgusPrintTransactionsLabel (struct ArgusParserStruct *, char *, int); 662 void ArgusPrintSequenceNumberLabel (struct ArgusParserStruct *, char *, int); 663 void ArgusPrintRankLabel (struct ArgusParserStruct *, char *, int); 664 void ArgusPrintBinNumberLabel (struct ArgusParserStruct *, char *, int); 665 void ArgusPrintBinsLabel (struct ArgusParserStruct *, char *, int); 666 void ArgusPrintTCPSrcBaseLabel (struct ArgusParserStruct *, char *, int); 667 void ArgusPrintTCPDstBaseLabel (struct ArgusParserStruct *, char *, int); 668 void ArgusPrintTCPRTTLabel (struct ArgusParserStruct *, char *, int); 669 void ArgusPrintTCPSynAckLabel (struct ArgusParserStruct *, char *, int); 670 void ArgusPrintTCPAckDatLabel (struct ArgusParserStruct *, char *, int); 671 void ArgusPrintTCPSrcMaxLabel (struct ArgusParserStruct *, char *, int); 672 void ArgusPrintTCPDstMaxLabel (struct ArgusParserStruct *, char *, int); 673 void ArgusPrintSrcGapLabel (struct ArgusParserStruct *, char *, int); 674 void ArgusPrintDstGapLabel (struct ArgusParserStruct *, char *, int); 675 void ArgusPrintInodeLabel (struct ArgusParserStruct *, char *, int); 676 void ArgusPrintByteOffsetLabel (struct ArgusParserStruct *, char *, int); 677 void ArgusPrintSrcEncapsLabel (struct ArgusParserStruct *, char *, int); 678 void ArgusPrintDstEncapsLabel (struct ArgusParserStruct *, char *, int); 679 void ArgusPrintMaxPktSizeLabel (struct ArgusParserStruct *, char *, int); 680 void ArgusPrintSrcPktSizeLabel (struct ArgusParserStruct *, char *, int); 681 void ArgusPrintSrcMaxPktSizeLabel (struct ArgusParserStruct *, char *, int); 682 void ArgusPrintSrcMinPktSizeLabel (struct ArgusParserStruct *, char *, int); 683 void ArgusPrintSrcMeanPktSizeLabel (struct ArgusParserStruct *, char *, int); 684 void ArgusPrintDstPktSizeLabel (struct ArgusParserStruct *, char *, int); 685 void ArgusPrintDstMaxPktSizeLabel (struct ArgusParserStruct *, char *, int); 686 void ArgusPrintDstMinPktSizeLabel (struct ArgusParserStruct *, char *, int); 687 void ArgusPrintDstMeanPktSizeLabel (struct ArgusParserStruct *, char *, int); 688 void ArgusPrintSrcCountryCodeLabel (struct ArgusParserStruct *, char *, int); 689 void ArgusPrintDstCountryCodeLabel (struct ArgusParserStruct *, char *, int); 690 void ArgusPrintInodeCountryCodeLabel (struct ArgusParserStruct *, char *, int); 691 void ArgusPrintSrcHopCountLabel (struct ArgusParserStruct *, char *, int); 692 void ArgusPrintDstHopCountLabel (struct ArgusParserStruct *, char *, int); 693 void ArgusPrintIcmpIdLabel (struct ArgusParserStruct *, char *, int); 694 void ArgusPrintAutoIdLabel (struct ArgusParserStruct *, char *, int); 695 void ArgusPrintLabelLabel (struct ArgusParserStruct *, char *, int); 696 void ArgusPrintSrcAsnLabel (struct ArgusParserStruct *, char *, int); 697 void ArgusPrintDstAsnLabel (struct ArgusParserStruct *, char *, int); 698 void ArgusPrintInodeAsnLabel (struct ArgusParserStruct *, char *, int); 699 void ArgusPrintKeyStrokeSrcNStrokeLabel (struct ArgusParserStruct *, char *, int); 700 void ArgusPrintKeyStrokeDstNStrokeLabel (struct ArgusParserStruct *, char *, int); 701 void ArgusPrintKeyStrokeNStrokeLabel (struct ArgusParserStruct *, char *, int); 702 void ArgusPrintSumLabel (struct ArgusParserStruct *, char *, int); 703 void ArgusPrintRunTimeLabel (struct ArgusParserStruct *, char *, int); 704 void ArgusPrintIdleTimeLabel (struct ArgusParserStruct *, char *, int); 705 void ArgusPrintResponseLabel (struct ArgusParserStruct *, char *, int); 706 void ArgusPrintSrcOuiLabel (struct ArgusParserStruct *, char *, int); 707 void ArgusPrintDstOuiLabel (struct ArgusParserStruct *, char *, int); 708 void ArgusPrintCorLabel (struct ArgusParserStruct *, char *, int); 709 710 #define ARGUS_PTYPE_INT 0 711 #define ARGUS_PTYPE_UINT 1 712 #define ARGUS_PTYPE_DOUBLE 2 713 #define ARGUS_PTYPE_STRING 4 714 715 716 struct ArgusPrintFieldStruct 717 RaPrintAlgorithmTable[MAX_PRINT_ALG_TYPES] = { 718 #define ARGUSPRINTSTARTDATE 0 719 { "stime", "%T.%f", 12 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTSTARTDATE, ArgusPrintStartDate, ArgusPrintStartDateLabel, "double(18,6) unsigned not null", 0}, 720 #define ARGUSPRINTLASTDATE 1 721 { "ltime", "%T.%f", 12 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTLASTDATE, ArgusPrintLastDate, ArgusPrintLastDateLabel, "double(18,6) unsigned not null", 0}, 722 #define ARGUSPRINTTRANSACTIONS 2 723 { "trans", "", 6 , 1, ARGUS_PTYPE_INT, ARGUSPRINTTRANSACTIONS, ArgusPrintTransactions, ArgusPrintTransactionsLabel, "int unsigned", 0}, 724 #define ARGUSPRINTDURATION 3 725 { "dur", "", 10 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTDURATION, ArgusPrintDuration, ArgusPrintDurationLabel, "double(18,6) not null", 0}, 726 #define ARGUSPRINTMEAN 4 727 { "mean", "", 10 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTMEAN, ArgusPrintMean, ArgusPrintMeanLabel, "double", 0}, 728 #define ARGUSPRINTMIN 5 729 { "min", "", 10 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTMIN, ArgusPrintMin, ArgusPrintMinLabel, "double", 0}, 730 #define ARGUSPRINTMAX 6 731 { "max", "", 10 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTMAX, ArgusPrintMax, ArgusPrintMaxLabel, "double", 0}, 732 #define ARGUSPRINTSRCADDR 7 733 { "saddr", "", 18 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTSRCADDR, ArgusPrintSrcAddr, ArgusPrintSrcAddrLabel, "varchar(64) not null", 0}, 734 #define ARGUSPRINTDSTADDR 8 735 { "daddr", "", 18 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTDSTADDR, ArgusPrintDstAddr, ArgusPrintDstAddrLabel, "varchar(64) not null", 0}, 736 #define ARGUSPRINTPROTO 9 737 { "proto", "", 6 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTPROTO, ArgusPrintProto, ArgusPrintProtoLabel, "varchar(16) not null", 0}, 738 #define ARGUSPRINTSRCPORT 10 739 { "sport", "", 6 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTSRCPORT, ArgusPrintSrcPort, ArgusPrintSrcPortLabel, "varchar(10) not null", 0}, 740 #define ARGUSPRINTDSTPORT 11 741 { "dport", "", 6 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTDSTPORT, ArgusPrintDstPort, ArgusPrintDstPortLabel, "varchar(10) not null", 0}, 742 #define ARGUSPRINTSRCTOS 12 743 { "stos", "", 5 , 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCTOS, ArgusPrintSrcTos, ArgusPrintSrcTosLabel, "tinyint unsigned", 0}, 744 #define ARGUSPRINTDSTTOS 13 745 { "dtos", "", 5 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTTOS, ArgusPrintDstTos, ArgusPrintDstTosLabel, "tinyint unsigned", 0}, 746 #define ARGUSPRINTSRCDSBYTE 14 747 { "sdsb", "", 5 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTSRCDSBYTE, ArgusPrintSrcDSByte, ArgusPrintSrcDSByteLabel, "varchar(4) not null", 0}, 748 #define ARGUSPRINTDSTDSBYTE 15 749 { "ddsb", "", 5 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTDSTDSBYTE, ArgusPrintDstDSByte, ArgusPrintDstDSByteLabel, "varchar(4) not null", 0}, 750 #define ARGUSPRINTSRCTTL 16 751 { "sttl", "", 4 , 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCTTL, ArgusPrintSrcTtl, ArgusPrintSrcTtlLabel, "tinyint unsigned", 0}, 752 #define ARGUSPRINTDSTTTL 17 753 { "dttl", "", 4 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTTTL, ArgusPrintDstTtl, ArgusPrintDstTtlLabel, "tinyint unsigned", 0}, 754 #define ARGUSPRINTBYTES 18 755 { "bytes", "", 10 , 1, ARGUS_PTYPE_INT, ARGUSPRINTBYTES, ArgusPrintBytes, ArgusPrintBytesLabel, "bigint", 0}, 756 #define ARGUSPRINTSRCBYTES 19 757 { "sbytes", "", 12 , 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCBYTES, ArgusPrintSrcBytes, ArgusPrintSrcBytesLabel, "bigint", 0}, 758 #define ARGUSPRINTDSTBYTES 20 759 { "dbytes", "", 12 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTBYTES, ArgusPrintDstBytes, ArgusPrintDstBytesLabel, "bigint", 0}, 760 #define ARGUSPRINTAPPBYTES 21 761 { "appbytes", "", 10 , 1, ARGUS_PTYPE_INT, ARGUSPRINTAPPBYTES, ArgusPrintAppBytes, ArgusPrintAppBytesLabel, "bigint", 0}, 762 #define ARGUSPRINTSRCAPPBYTES 22 763 { "sappbytes", "", 12 , 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCAPPBYTES, ArgusPrintSrcAppBytes, ArgusPrintSrcAppBytesLabel, "bigint", 0}, 764 #define ARGUSPRINTDSTAPPBYTES 23 765 { "dappbytes", "", 12 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTAPPBYTES, ArgusPrintDstAppBytes, ArgusPrintDstAppBytesLabel, "bigint", 0}, 766 #define ARGUSPRINTPACKETS 24 767 { "pkts", "", 8 , 1, ARGUS_PTYPE_INT, ARGUSPRINTPACKETS, ArgusPrintPackets, ArgusPrintPacketsLabel, "bigint", 0}, 768 #define ARGUSPRINTSRCPACKETS 25 769 { "spkts", "", 8 , 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCPACKETS, ArgusPrintSrcPackets, ArgusPrintSrcPacketsLabel, "bigint", 0}, 770 #define ARGUSPRINTDSTPACKETS 26 771 { "dpkts", "", 8 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTPACKETS, ArgusPrintDstPackets, ArgusPrintDstPacketsLabel, "bigint", 0}, 772 #define ARGUSPRINTLOAD 27 773 { "load", "", 8 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTLOAD, ArgusPrintLoad, ArgusPrintLoadLabel, "double", 0}, 774 #define ARGUSPRINTSRCLOAD 28 775 { "sload", "", 8 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTSRCLOAD, ArgusPrintSrcLoad, ArgusPrintSrcLoadLabel, "double", 0}, 776 #define ARGUSPRINTDSTLOAD 29 777 { "dload", "", 8 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTDSTLOAD, ArgusPrintDstLoad, ArgusPrintDstLoadLabel, "double", 0}, 778 #define ARGUSPRINTLOSS 30 779 { "loss", "", 10 , 1, ARGUS_PTYPE_INT, ARGUSPRINTLOSS, ArgusPrintLoss, ArgusPrintLossLabel, "int", 0}, 780 #define ARGUSPRINTSRCLOSS 31 781 { "sloss", "", 10 , 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCLOSS, ArgusPrintSrcLoss, ArgusPrintSrcLossLabel, "int", 0}, 782 #define ARGUSPRINTDSTLOSS 32 783 { "dloss", "", 10 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTLOSS, ArgusPrintDstLoss, ArgusPrintDstLossLabel, "int", 0}, 784 #define ARGUSPRINTPERCENTLOSS 33 785 { "ploss", "", 8 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTPERCENTLOSS, ArgusPrintPercentLoss, ArgusPrintPercentLossLabel, "double", 0}, 786 #define ARGUSPRINTSRCPERCENTLOSS 34 787 { "sploss", "", 10 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTSRCPERCENTLOSS, ArgusPrintPercentSrcLoss, ArgusPrintPercentSrcLossLabel, "double", 0}, 788 #define ARGUSPRINTDSTPERCENTLOSS 35 789 { "dploss", "", 10 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTDSTPERCENTLOSS, ArgusPrintPercentDstLoss, ArgusPrintPercentDstLossLabel, "double", 0}, 790 #define ARGUSPRINTRATE 36 791 { "rate", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTRATE, ArgusPrintRate, ArgusPrintRateLabel, "double", 0}, 792 #define ARGUSPRINTSRCRATE 37 793 { "srate", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTSRCRATE, ArgusPrintSrcRate, ArgusPrintSrcRateLabel, "double", 0}, 794 #define ARGUSPRINTDSTRATE 38 795 { "drate", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTDSTRATE, ArgusPrintDstRate, ArgusPrintDstRateLabel, "double", 0}, 796 #define ARGUSPRINTSOURCEID 39 797 { "srcid", "", 18 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTSOURCEID, ArgusPrintSourceID, ArgusPrintSourceIDLabel, "varchar(64)", 0}, 798 #define ARGUSPRINTFLAGS 40 799 { "flgs", "", 9 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTFLAGS, ArgusPrintFlags, ArgusPrintFlagsLabel, "varchar(32)", 0}, 800 #define ARGUSPRINTSRCMACADDRESS 41 801 { "smac", "", 18 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTSRCMACADDRESS, ArgusPrintSrcMacAddress, ArgusPrintSrcMacAddressLabel, "varchar(24)", 0}, 802 #define ARGUSPRINTDSTMACADDRESS 42 803 { "dmac", "", 18 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTDSTMACADDRESS, ArgusPrintDstMacAddress, ArgusPrintDstMacAddressLabel, "varchar(24)", 0}, 804 #define ARGUSPRINTDIR 43 805 { "dir", "", 5 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTDIR, ArgusPrintDirection, ArgusPrintDirectionLabel, "varchar(3)", 0}, 806 #define ARGUSPRINTSRCINTPKT 44 807 { "sintpkt", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTSRCINTPKT, ArgusPrintSrcIntPkt, ArgusPrintSrcIntPktLabel, "double", 0}, 808 #define ARGUSPRINTDSTINTPKT 45 809 { "dintpkt", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTDSTINTPKT, ArgusPrintDstIntPkt, ArgusPrintDstIntPktLabel, "double", 0}, 810 #define ARGUSPRINTACTSRCINTPKT 46 811 { "sintpktact", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTACTSRCINTPKT, ArgusPrintActiveSrcIntPkt, ArgusPrintActiveSrcIntPktLabel, "double", 0}, 812 #define ARGUSPRINTACTDSTINTPKT 47 813 { "dintpktact", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTACTDSTINTPKT, ArgusPrintActiveDstIntPkt, ArgusPrintActiveDstIntPktLabel, "double", 0}, 814 #define ARGUSPRINTIDLESRCINTPKT 48 815 { "sintpktidl", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTIDLESRCINTPKT, ArgusPrintIdleSrcIntPkt, ArgusPrintIdleSrcIntPktLabel, "double", 0}, 816 #define ARGUSPRINTIDLEDSTINTPKT 49 817 { "dintpktidl", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTIDLEDSTINTPKT, ArgusPrintIdleDstIntPkt, ArgusPrintIdleDstIntPktLabel, "double", 0}, 818 #define ARGUSPRINTSRCINTPKTMAX 50 819 { "sintpktmax", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTSRCINTPKTMAX, ArgusPrintSrcIntPktMax, ArgusPrintSrcIntPktMaxLabel, "double", 0}, 820 #define ARGUSPRINTSRCINTPKTMIN 51 821 { "sintpktmin", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTSRCINTPKTMIN, ArgusPrintSrcIntPktMin, ArgusPrintSrcIntPktMinLabel, "double", 0}, 822 #define ARGUSPRINTDSTINTPKTMAX 52 823 { "dintpktmax", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTDSTINTPKTMAX, ArgusPrintDstIntPktMax, ArgusPrintDstIntPktMaxLabel, "double", 0}, 824 #define ARGUSPRINTDSTINTPKTMIN 53 825 { "dintpktmin", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTDSTINTPKTMIN, ArgusPrintDstIntPktMin, ArgusPrintDstIntPktMinLabel, "double", 0}, 826 #define ARGUSPRINTACTSRCINTPKTMAX 54 827 { "sintpktactmax", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTACTSRCINTPKTMAX, ArgusPrintActiveSrcIntPktMax, ArgusPrintActiveSrcIntPktMaxLabel, "double", 0}, 828 #define ARGUSPRINTACTSRCINTPKTMIN 55 829 { "sintpktactmin", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTACTSRCINTPKTMIN, ArgusPrintActiveSrcIntPktMin, ArgusPrintActiveSrcIntPktMinLabel, "double", 0}, 830 #define ARGUSPRINTACTDSTINTPKTMAX 56 831 { "dintpktactmax", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTACTDSTINTPKTMAX, ArgusPrintActiveDstIntPktMax, ArgusPrintActiveDstIntPktMaxLabel, "double", 0}, 832 #define ARGUSPRINTACTDSTINTPKTMIN 57 833 { "dintpktactmin", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTACTDSTINTPKTMIN, ArgusPrintActiveDstIntPktMin, ArgusPrintActiveDstIntPktMinLabel, "double", 0}, 834 #define ARGUSPRINTIDLESRCINTPKTMAX 58 835 { "sintpktidlmax", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTIDLESRCINTPKTMAX, ArgusPrintIdleSrcIntPktMax, ArgusPrintIdleSrcIntPktMaxLabel, "double", 0}, 836 #define ARGUSPRINTIDLESRCINTPKTMIN 59 837 { "sintpktidlmin", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTIDLESRCINTPKTMIN, ArgusPrintIdleSrcIntPktMin, ArgusPrintIdleSrcIntPktMinLabel, "double", 0}, 838 #define ARGUSPRINTIDLEDSTINTPKTMAX 60 839 { "dintpktidlmax", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTIDLEDSTINTPKTMAX, ArgusPrintIdleDstIntPktMax, ArgusPrintIdleDstIntPktMaxLabel, "double", 0}, 840 #define ARGUSPRINTIDLEDSTINTPKTMIN 61 841 { "dintpktidlmin", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTIDLEDSTINTPKTMIN, ArgusPrintIdleDstIntPktMin, ArgusPrintIdleDstIntPktMinLabel, "double", 0}, 842 #define ARGUSPRINTSPACER 62 843 { "xxx", "", 12 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTSPACER, NULL, NULL, "varchar(3)", 0}, 844 #define ARGUSPRINTSRCJITTER 63 845 { "sjit", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTSRCJITTER, ArgusPrintSrcJitter, ArgusPrintSrcJitterLabel, "double", 0}, 846 #define ARGUSPRINTDSTJITTER 64 847 { "djit", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTDSTJITTER, ArgusPrintDstJitter, ArgusPrintDstJitterLabel, "double", 0}, 848 #define ARGUSPRINTACTSRCJITTER 65 849 { "sjitact", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTACTSRCJITTER, ArgusPrintActiveSrcJitter, ArgusPrintActiveSrcJitterLabel, "double", 0}, 850 #define ARGUSPRINTACTDSTJITTER 66 851 { "djitact", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTACTDSTJITTER, ArgusPrintActiveDstJitter, ArgusPrintActiveDstJitterLabel, "double", 0}, 852 #define ARGUSPRINTIDLESRCJITTER 67 853 { "sjitidl", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTIDLESRCJITTER, ArgusPrintIdleSrcJitter, ArgusPrintIdleSrcJitterLabel, "double", 0}, 854 #define ARGUSPRINTIDLEDSTJITTER 68 855 { "djitidl", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTIDLEDSTJITTER, ArgusPrintIdleDstJitter, ArgusPrintIdleDstJitterLabel, "double", 0}, 856 #define ARGUSPRINTSTATE 69 857 { "state", "", 5 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTSTATE, ArgusPrintState, ArgusPrintStateLabel, "varchar(32)", 0}, 858 #define ARGUSPRINTDELTADURATION 70 859 { "dldur", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTDELTADURATION, ArgusPrintDeltaDuration, ArgusPrintDeltaDurationLabel, "double", 0}, 860 #define ARGUSPRINTDELTASTARTTIME 71 861 { "dlstime", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTDELTASTARTTIME, ArgusPrintDeltaStartTime, ArgusPrintDeltaStartTimeLabel, "double(18,6)", 0}, 862 #define ARGUSPRINTDELTALASTTIME 72 863 { "dlltime", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTDELTALASTTIME, ArgusPrintDeltaLastTime, ArgusPrintDeltaLastTimeLabel, "double(18,6)", 0}, 864 #define ARGUSPRINTDELTASPKTS 73 865 { "dlspkt", "", 6 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDELTASPKTS, ArgusPrintDeltaSrcPkts, ArgusPrintDeltaSrcPktsLabel, "int", 0}, 866 #define ARGUSPRINTDELTADPKTS 74 867 { "dldpkt", "", 6 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDELTADPKTS, ArgusPrintDeltaDstPkts, ArgusPrintDeltaDstPktsLabel, "int", 0}, 868 #define ARGUSPRINTDELTASRCPKTS 75 869 { "dspkts", "", 12 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDELTASRCPKTS, ArgusPrintDeltaSrcPkts, ArgusPrintDeltaSrcPktsLabel, "int", 0}, 870 #define ARGUSPRINTDELTADSTPKTS 76 871 { "ddpkts", "", 12 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDELTADSTPKTS, ArgusPrintDeltaDstPkts, ArgusPrintDeltaDstPktsLabel, "int", 0}, 872 #define ARGUSPRINTDELTASRCBYTES 77 873 { "dsbytes", "", 12 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDELTASRCBYTES, ArgusPrintDeltaSrcBytes, ArgusPrintDeltaSrcBytesLabel, "int", 0}, 874 #define ARGUSPRINTDELTADSTBYTES 78 875 { "ddbytes", "", 12 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDELTADSTBYTES, ArgusPrintDeltaDstBytes, ArgusPrintDeltaDstBytesLabel, "int", 0}, 876 #define ARGUSPRINTPERCENTDELTASRCPKTS 79 877 { "pdspkts", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTPERCENTDELTASRCPKTS, ArgusPrintPercentDeltaSrcPkts, ArgusPrintPercentDeltaSrcPktsLabel, "double", 0}, 878 #define ARGUSPRINTPERCENTDELTADSTPKTS 80 879 { "pddpkts", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTPERCENTDELTADSTPKTS, ArgusPrintPercentDeltaDstPkts, ArgusPrintPercentDeltaDstPktsLabel, "double", 0}, 880 #define ARGUSPRINTPERCENTDELTASRCBYTES 81 881 { "pdsbytes", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTPERCENTDELTASRCBYTES, ArgusPrintPercentDeltaSrcBytes, ArgusPrintPercentDeltaSrcBytesLabel, "double", 0}, 882 #define ARGUSPRINTPERCENTDELTADSTBYTES 82 883 { "pddbytes", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTPERCENTDELTADSTBYTES, ArgusPrintPercentDeltaDstBytes, ArgusPrintPercentDeltaDstBytesLabel, "double", 0}, 884 #define ARGUSPRINTSRCUSERDATA 83 885 { "suser", "", 16 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTSRCUSERDATA, ArgusPrintSrcUserData, ArgusPrintSrcUserDataLabel, "varbinary(2048)", 0}, 886 #define ARGUSPRINTDSTUSERDATA 84 887 { "duser", "", 16 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTDSTUSERDATA, ArgusPrintDstUserData, ArgusPrintDstUserDataLabel, "varbinary(2048)", 0}, 888 #define ARGUSPRINTTCPEXTENSIONS 85 889 { "tcpext", "", 12 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTTCPEXTENSIONS, ArgusPrintTCPExtensions, ArgusPrintTCPExtensionsLabel, "varchar(64)", 0}, 890 #define ARGUSPRINTSRCWINDOW 86 891 { "swin", "", 6 , 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCWINDOW, ArgusPrintSrcWindow, ArgusPrintSrcWindowLabel, "tinyint unsigned", 0}, 892 #define ARGUSPRINTDSTWINDOW 87 893 { "dwin", "", 6 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTWINDOW, ArgusPrintDstWindow, ArgusPrintDstWindowLabel, "tinyint unsigned", 0}, 894 #define ARGUSPRINTJOINDELAY 88 895 { "jdelay", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTJOINDELAY, ArgusPrintJoinDelay, ArgusPrintJoinDelayLabel, "double", 0}, 896 #define ARGUSPRINTLEAVEDELAY 89 897 { "ldelay", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTLEAVEDELAY, ArgusPrintLeaveDelay, ArgusPrintLeaveDelayLabel, "double", 0}, 898 #define ARGUSPRINTSEQUENCENUMBER 90 899 { "seq", "", 12 , 1, ARGUS_PTYPE_INT, ARGUSPRINTSEQUENCENUMBER, ArgusPrintSequenceNumber, ArgusPrintSequenceNumberLabel, "int unsigned", 0}, 900 #define ARGUSPRINTBINS 91 901 { "bins", "", 6 , 1, ARGUS_PTYPE_INT, ARGUSPRINTBINS, ArgusPrintBins, ArgusPrintBinsLabel, "int unsigned", 0}, 902 #define ARGUSPRINTBINNUMBER 92 903 { "binnum", "", 6 , 1, ARGUS_PTYPE_INT, ARGUSPRINTBINNUMBER, ArgusPrintBinNumber, ArgusPrintBinNumberLabel, "int unsigned", 0}, 904 #define ARGUSPRINTSRCMPLS 93 905 { "smpls", "", 8 , 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCMPLS, ArgusPrintSrcMpls, ArgusPrintSrcMplsLabel, "int unsigned", 0}, 906 #define ARGUSPRINTDSTMPLS 94 907 { "dmpls", "", 8 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTMPLS, ArgusPrintDstMpls, ArgusPrintDstMplsLabel, "int unsigned", 0}, 908 #define ARGUSPRINTSRCVLAN 95 909 { "svlan", "", 8 , 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCVLAN, ArgusPrintSrcVlan, ArgusPrintSrcVlanLabel, "smallint unsigned", 0}, 910 #define ARGUSPRINTDSTVLAN 96 911 { "dvlan", "", 8 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTVLAN, ArgusPrintDstVlan, ArgusPrintDstVlanLabel, "smallint unsigned", 0}, 912 #define ARGUSPRINTSRCVID 97 913 { "svid", "", 6 , 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCVID, ArgusPrintSrcVID, ArgusPrintSrcVIDLabel, "smallint unsigned", 0}, 914 #define ARGUSPRINTDSTVID 98 915 { "dvid", "", 6 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTVID, ArgusPrintDstVID, ArgusPrintDstVIDLabel, "smallint unsigned", 0}, 916 #define ARGUSPRINTSRCVPRI 99 917 { "svpri", "", 6 , 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCVPRI, ArgusPrintSrcVPRI, ArgusPrintSrcVPRILabel, "smallint unsigned", 0}, 918 #define ARGUSPRINTDSTVPRI 100 919 { "dvpri", "", 6 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTVPRI, ArgusPrintDstVPRI, ArgusPrintDstVPRILabel, "smallint unsigned", 0}, 920 #define ARGUSPRINTSRCIPID 101 921 { "sipid", "", 7 , 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCIPID, ArgusPrintSrcIpId, ArgusPrintSrcIpIdLabel, "smallint unsigned", 0}, 922 #define ARGUSPRINTDSTIPID 102 923 { "dipid", "", 7 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTIPID, ArgusPrintDstIpId, ArgusPrintDstIpIdLabel, "smallint unsigned", 0}, 924 #define ARGUSPRINTSTARTRANGE 103 925 { "srng", "", 6 , 1, ARGUS_PTYPE_INT, ARGUSPRINTSTARTRANGE, ArgusPrintStartRange, ArgusPrintStartRangeLabel, "int unsigned", 0}, 926 #define ARGUSPRINTENDRANGE 104 927 { "erng", "", 6 , 1, ARGUS_PTYPE_INT, ARGUSPRINTENDRANGE, ArgusPrintEndRange, ArgusPrintEndRangeLabel, "int unsigned", 0}, 928 #define ARGUSPRINTTCPSRCBASE 105 929 { "stcpb", "", 12 , 1, ARGUS_PTYPE_INT, ARGUSPRINTTCPSRCBASE, ArgusPrintTCPSrcBase, ArgusPrintTCPSrcBaseLabel, "int unsigned", 0}, 930 #define ARGUSPRINTTCPDSTBASE 106 931 { "dtcpb", "", 12 , 1, ARGUS_PTYPE_INT, ARGUSPRINTTCPDSTBASE, ArgusPrintTCPDstBase, ArgusPrintTCPDstBaseLabel, "int unsigned", 0}, 932 #define ARGUSPRINTTCPRTT 107 933 { "tcprtt", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTTCPRTT, ArgusPrintTCPRTT, ArgusPrintTCPRTTLabel, "double", 0}, 934 #define ARGUSPRINTINODE 108 935 { "inode", "", 18, 1, ARGUS_PTYPE_STRING, ARGUSPRINTINODE, ArgusPrintInode, ArgusPrintInodeLabel, "varchar(64)", 0}, 936 #define ARGUSPRINTSTDDEV 109 937 { "stddev", "", 10 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTSTDDEV, ArgusPrintStdDeviation, ArgusPrintStdDeviationLabel, "double unsigned", 0}, 938 #define ARGUSPRINTRELDATE 110 939 { "rtime", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTRELDATE, ArgusPrintRelativeDate, ArgusPrintRelativeDateLabel, "double(18,6)", 0}, 940 #define ARGUSPRINTBYTEOFFSET 111 941 { "offset", "", 12 , 1, ARGUS_PTYPE_INT, ARGUSPRINTBYTEOFFSET, ArgusPrintByteOffset, ArgusPrintByteOffsetLabel, "bigint", 0}, 942 #define ARGUSPRINTSRCNET 112 943 { "snet", "", 18 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTSRCNET, ArgusPrintSrcNet, ArgusPrintSrcNetLabel, "varchar(64)", 0}, 944 #define ARGUSPRINTDSTNET 113 945 { "dnet", "", 18 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTDSTNET, ArgusPrintDstNet, ArgusPrintDstNetLabel, "varchar(64)", 0}, 946 #define ARGUSPRINTSRCDURATION 114 947 { "sdur", "", 10 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTSRCDURATION, ArgusPrintSrcDuration, ArgusPrintSrcDurationLabel, "double", 0}, 948 #define ARGUSPRINTDSTDURATION 115 949 { "ddur", "", 10 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTDSTDURATION, ArgusPrintDstDuration, ArgusPrintDstDurationLabel, "double", 0}, 950 #define ARGUSPRINTTCPSRCMAX 116 951 { "stcpmax", "", 10 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTTCPSRCMAX, ArgusPrintTCPSrcMax, ArgusPrintTCPSrcMaxLabel, "double", 0}, 952 #define ARGUSPRINTTCPDSTMAX 117 953 { "dtcpmax", "", 10 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTTCPDSTMAX, ArgusPrintTCPDstMax, ArgusPrintTCPDstMaxLabel, "double", 0}, 954 #define ARGUSPRINTTCPSYNACK 118 955 { "synack", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTTCPSYNACK, ArgusPrintTCPSynAck, ArgusPrintTCPSynAckLabel, "double", 0}, 956 #define ARGUSPRINTTCPACKDAT 119 957 { "ackdat", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTTCPACKDAT, ArgusPrintTCPAckDat, ArgusPrintTCPAckDatLabel, "double", 0}, 958 #define ARGUSPRINTSRCSTARTDATE 120 959 { "sstime", "%T.%f", 12 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTSRCSTARTDATE, ArgusPrintSrcStartDate, ArgusPrintSrcStartDateLabel, "double(18,6) unsigned not null", 0}, 960 #define ARGUSPRINTSRCLASTDATE 121 961 { "sltime", "%T.%f", 12 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTSRCLASTDATE, ArgusPrintSrcLastDate, ArgusPrintSrcLastDateLabel, "double(18,6) unsigned not null", 0}, 962 #define ARGUSPRINTDSTSTARTDATE 122 963 { "dstime", "%T.%f", 12 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTDSTSTARTDATE, ArgusPrintDstStartDate, ArgusPrintDstStartDateLabel, "double(18,6) unsigned not null", 0}, 964 #define ARGUSPRINTDSTLASTDATE 123 965 { "dltime", "%T.%f", 12 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTDSTLASTDATE, ArgusPrintDstLastDate, ArgusPrintDstLastDateLabel, "double(18,6) unsigned not null", 0}, 966 #define ARGUSPRINTSRCENCAPS 124 967 { "senc", "", 12 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTSRCENCAPS, ArgusPrintSrcEncaps, ArgusPrintSrcEncapsLabel, "varchar(32)", 0}, 968 #define ARGUSPRINTDSTENCAPS 125 969 { "denc", "", 12 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTDSTENCAPS, ArgusPrintDstEncaps, ArgusPrintDstEncapsLabel, "varchar(32)", 0}, 970 #define ARGUSPRINTSRCPKTSIZE 126 971 { "spktsz", "", 12 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTSRCPKTSIZE, ArgusPrintSrcPktSize, ArgusPrintSrcPktSizeLabel, "varchar(32)", 0}, 972 #define ARGUSPRINTSRCMAXPKTSIZE 127 973 { "smaxsz", "", 12 , 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCMAXPKTSIZE, ArgusPrintSrcMaxPktSize, ArgusPrintSrcMaxPktSizeLabel, "smallint unsigned", 0}, 974 #define ARGUSPRINTSRCMINPKTSIZE 128 975 { "sminsz", "", 12 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTSRCMINPKTSIZE, ArgusPrintSrcMinPktSize, ArgusPrintSrcMinPktSizeLabel, "smallint unsigned", 0}, 976 #define ARGUSPRINTDSTPKTSIZE 129 977 { "dpktsz", "", 12 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTDSTPKTSIZE, ArgusPrintDstPktSize, ArgusPrintDstPktSizeLabel, "varchar(32)", 0}, 978 #define ARGUSPRINTDSTMAXPKTSIZE 130 979 { "dmaxsz", "", 12 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTMAXPKTSIZE, ArgusPrintDstMaxPktSize, ArgusPrintDstMaxPktSizeLabel, "smallint unsigned", 0}, 980 #define ARGUSPRINTDSTMINPKTSIZE 131 981 { "dminsz", "", 12 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTMINPKTSIZE, ArgusPrintDstMinPktSize, ArgusPrintDstMinPktSizeLabel, "smallint unsigned", 0}, 982 #define ARGUSPRINTSRCCOUNTRYCODE 132 983 { "sco", "", 3 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTSRCCOUNTRYCODE, ArgusPrintSrcCountryCode, ArgusPrintSrcCountryCodeLabel, "varchar(2)", 0}, 984 #define ARGUSPRINTDSTCOUNTRYCODE 133 985 { "dco", "", 3 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTDSTCOUNTRYCODE, ArgusPrintDstCountryCode, ArgusPrintDstCountryCodeLabel, "varchar(2)", 0}, 986 #define ARGUSPRINTSRCHOPCOUNT 134 987 { "shops", "", 5 , 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCHOPCOUNT, ArgusPrintSrcHopCount, ArgusPrintSrcHopCountLabel, "smallint", 0}, 988 #define ARGUSPRINTDSTHOPCOUNT 135 989 { "dhops", "", 5 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTHOPCOUNT, ArgusPrintDstHopCount, ArgusPrintDstHopCountLabel, "smallint", 0}, 990 #define ARGUSPRINTICMPID 136 991 { "icmpid", "", 6 , 1, ARGUS_PTYPE_INT, ARGUSPRINTICMPID, ArgusPrintIcmpId, ArgusPrintIcmpIdLabel, "smallint unsigned", 0}, 992 #define ARGUSPRINTLABEL 137 993 { "label", "", 5 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTLABEL, ArgusPrintLabel, ArgusPrintLabelLabel, "varchar(4098)", 0}, 994 #define ARGUSPRINTSRCINTPKTDIST 138 995 { "sintdist", "", 8, 1, ARGUS_PTYPE_STRING, ARGUSPRINTSRCINTPKTDIST, ArgusPrintSrcIntPktDist, ArgusPrintSrcIntPktDistLabel, "varchar(8)", 0}, 996 #define ARGUSPRINTDSTINTPKTDIST 139 997 { "dintdist", "", 8, 1, ARGUS_PTYPE_STRING, ARGUSPRINTDSTINTPKTDIST, ArgusPrintDstIntPktDist, ArgusPrintDstIntPktDistLabel, "varchar(8)", 0}, 998 #define ARGUSPRINTACTSRCINTPKTDIST 140 999 { "sintdistact", "", 11, 1, ARGUS_PTYPE_STRING, ARGUSPRINTACTSRCINTPKTDIST, ArgusPrintActiveSrcIntPktDist, ArgusPrintActiveSrcIntPktDistLabel, "varchar(8)", 0}, 1000 #define ARGUSPRINTACTDSTINTPKTDIST 141 1001 { "dintdistact", "", 11, 1, ARGUS_PTYPE_STRING, ARGUSPRINTACTDSTINTPKTDIST, ArgusPrintActiveDstIntPktDist, ArgusPrintActiveDstIntPktDistLabel, "varchar(8)", 0}, 1002 #define ARGUSPRINTIDLESRCINTPKTDIST 142 1003 { "sintdistidl", "", 11, 1, ARGUS_PTYPE_STRING, ARGUSPRINTIDLESRCINTPKTDIST, ArgusPrintIdleSrcIntPktDist, ArgusPrintIdleSrcIntPktDistLabel, "varchar(8)", 0}, 1004 #define ARGUSPRINTIDLEDSTINTPKTDIST 143 1005 { "dintdistidl", "", 11, 1, ARGUS_PTYPE_STRING, ARGUSPRINTIDLEDSTINTPKTDIST, ArgusPrintIdleDstIntPktDist, ArgusPrintIdleDstIntPktDistLabel, "varchar(8)", 0}, 1006 #define ARGUSPRINTRETRANS 144 1007 { "retrans", "", 7, 1, ARGUS_PTYPE_INT, ARGUSPRINTRETRANS, ArgusPrintRetrans, ArgusPrintRetransLabel, "int", 0}, 1008 #define ARGUSPRINTSRCRETRANS 145 1009 { "sretrans", "", 8, 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCRETRANS, ArgusPrintSrcRetrans, ArgusPrintSrcRetransLabel, "int", 0}, 1010 #define ARGUSPRINTDSTRETRANS 146 1011 { "dretrans", "", 8, 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTRETRANS, ArgusPrintDstRetrans, ArgusPrintDstRetransLabel, "int", 0}, 1012 #define ARGUSPRINTPERCENTRETRANS 147 1013 { "pretrans", "", 7, 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTPERCENTRETRANS, ArgusPrintPercentRetrans, ArgusPrintPercentRetransLabel, "double", 0}, 1014 #define ARGUSPRINTPERCENTSRCRETRANS 148 1015 { "spretrans", "", 8, 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTPERCENTSRCRETRANS, ArgusPrintPercentSrcRetrans, ArgusPrintPercentSrcRetransLabel, "double", 0}, 1016 #define ARGUSPRINTPERCENTDSTRETRANS 149 1017 { "dpretrans", "", 8, 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTPERCENTDSTRETRANS, ArgusPrintPercentDstRetrans, ArgusPrintPercentDstRetransLabel, "double", 0}, 1018 #define ARGUSPRINTNACKS 150 1019 { "nacks", "", 7, 1, ARGUS_PTYPE_INT, ARGUSPRINTNACKS, ArgusPrintNacks, ArgusPrintNacksLabel, "int", 0}, 1020 #define ARGUSPRINTSRCNACKS 151 1021 { "snacks", "", 8, 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCNACKS, ArgusPrintSrcNacks, ArgusPrintSrcNacksLabel, "int", 0}, 1022 #define ARGUSPRINTDSTNACKS 152 1023 { "dnacks", "", 8, 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTNACKS, ArgusPrintDstNacks, ArgusPrintDstNacksLabel, "int", 0}, 1024 #define ARGUSPRINTPERCENTNACKS 153 1025 { "pnacks", "", 7, 1, ARGUS_PTYPE_INT, ARGUSPRINTPERCENTNACKS, ArgusPrintPercentNacks, ArgusPrintPercentNacksLabel, "double", 0}, 1026 #define ARGUSPRINTPERCENTSRCNACKS 154 1027 { "spnacks", "", 8, 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTPERCENTSRCNACKS, ArgusPrintPercentSrcNacks, ArgusPrintPercentSrcNacksLabel, "double", 0}, 1028 #define ARGUSPRINTPERCENTDSTNACKS 155 1029 { "dpnacks", "", 8, 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTPERCENTDSTNACKS, ArgusPrintPercentDstNacks, ArgusPrintPercentDstNacksLabel, "double", 0}, 1030 #define ARGUSPRINTSOLO 156 1031 { "solo", "", 7, 1, ARGUS_PTYPE_INT, ARGUSPRINTSOLO, ArgusPrintSolo, ArgusPrintSoloLabel, "int", 0}, 1032 #define ARGUSPRINTSRCSOLO 157 1033 { "ssolo", "", 8, 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCSOLO, ArgusPrintSrcSolo, ArgusPrintSrcSoloLabel, "int", 0}, 1034 #define ARGUSPRINTDSTSOLO 158 1035 { "dsolo", "", 8, 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTSOLO, ArgusPrintDstSolo, ArgusPrintDstSoloLabel, "int", 0}, 1036 #define ARGUSPRINTPERCENTSOLO 159 1037 { "psolo", "", 7, 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTPERCENTSOLO, ArgusPrintPercentSolo, ArgusPrintPercentSoloLabel, "double", 0}, 1038 #define ARGUSPRINTPERCENTSRCSOLO 160 1039 { "spsolo", "", 8, 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTPERCENTSRCSOLO, ArgusPrintPercentSrcSolo, ArgusPrintPercentSrcSoloLabel, "double", 0}, 1040 #define ARGUSPRINTPERCENTDSTSOLO 161 1041 { "dpsolo", "", 8, 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTPERCENTDSTSOLO, ArgusPrintPercentDstSolo, ArgusPrintPercentDstSoloLabel, "double", 0}, 1042 #define ARGUSPRINTFIRST 162 1043 { "first", "", 7, 1, ARGUS_PTYPE_INT, ARGUSPRINTFIRST, ArgusPrintFirst, ArgusPrintFirstLabel, "int", 0}, 1044 #define ARGUSPRINTSRCFIRST 163 1045 { "sfirst", "", 8, 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCFIRST, ArgusPrintSrcFirst, ArgusPrintSrcFirstLabel, "int", 0}, 1046 #define ARGUSPRINTDSTFIRST 164 1047 { "dfirst", "", 8, 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTFIRST, ArgusPrintDstFirst, ArgusPrintDstFirstLabel, "int", 0}, 1048 #define ARGUSPRINTPERCENTFIRST 165 1049 { "pfirst", "", 7, 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTPERCENTFIRST, ArgusPrintPercentFirst, ArgusPrintPercentFirstLabel, "double", 0}, 1050 #define ARGUSPRINTPERCENTSRCFIRST 166 1051 { "spfirst", "", 8, 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTPERCENTSRCFIRST, ArgusPrintPercentSrcFirst, ArgusPrintPercentSrcFirstLabel, "double", 0}, 1052 #define ARGUSPRINTPERCENTDSTFIRST 167 1053 { "dpfirst", "", 8, 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTPERCENTDSTFIRST, ArgusPrintPercentDstFirst, ArgusPrintPercentDstFirstLabel, "double", 0}, 1054 #define ARGUSPRINTAUTOID 168 1055 { "autoid", "", 6, 1, ARGUS_PTYPE_INT, ARGUSPRINTAUTOID, ArgusPrintAutoId, ArgusPrintAutoIdLabel, "int not null auto_increment", 0}, 1056 #define ARGUSPRINTSRCASN 169 1057 { "sas", "", 6 , 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCASN, ArgusPrintSrcAsn, ArgusPrintSrcAsnLabel, "int unsigned", 0}, 1058 #define ARGUSPRINTDSTASN 170 1059 { "das", "", 6 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTASN, ArgusPrintDstAsn, ArgusPrintDstAsnLabel, "int unsigned", 0}, 1060 #define ARGUSPRINTINODEASN 171 1061 { "ias", "", 5 , 1, ARGUS_PTYPE_INT, ARGUSPRINTINODEASN, ArgusPrintInodeAsn, ArgusPrintInodeAsnLabel, "int unsigned", 0}, 1062 #define ARGUSPRINTCAUSE 172 1063 { "cause", "", 7 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTCAUSE, ArgusPrintCause, ArgusPrintCauseLabel, "varchar(8)", 0}, 1064 #define ARGUSPRINTBSSID 173 1065 { "bssid", "", 18 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTBSSID, ArgusPrintBssid, ArgusPrintBssidLabel, "varchar(24)", 0}, 1066 #define ARGUSPRINTSSID 174 1067 { "ssid", "", 9 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTSSID, ArgusPrintSsid, ArgusPrintSsidLabel, "varchar(32)", 0}, 1068 #define ARGUSPRINTKEYSTROKENSTROKE 175 1069 { "nstroke", "", 9 , 1, ARGUS_PTYPE_INT, ARGUSPRINTKEYSTROKENSTROKE, ArgusPrintKeyStrokeNStroke, ArgusPrintKeyStrokeNStrokeLabel, "int unsigned", 0}, 1070 #define ARGUSPRINTKEYSTROKESRCNSTROKE 176 1071 { "snstroke", "", 9 , 1, ARGUS_PTYPE_INT, ARGUSPRINTKEYSTROKESRCNSTROKE, ArgusPrintKeyStrokeSrcNStroke, ArgusPrintKeyStrokeSrcNStrokeLabel, "int unsigned", 0}, 1072 #define ARGUSPRINTKEYSTROKEDSTNSTROKE 177 1073 { "dnstroke", "", 9 , 1, ARGUS_PTYPE_INT, ARGUSPRINTKEYSTROKEDSTNSTROKE, ArgusPrintKeyStrokeDstNStroke, ArgusPrintKeyStrokeDstNStrokeLabel, "int unsigned", 0}, 1074 #define ARGUSPRINTSRCMEANPKTSIZE 178 1075 { "smeansz", "", 12 , 1, ARGUS_PTYPE_INT, ARGUSPRINTSRCMEANPKTSIZE, ArgusPrintSrcMeanPktSize, ArgusPrintSrcMeanPktSizeLabel, "smallint unsigned", 0}, 1076 #define ARGUSPRINTDSTMEANPKTSIZE 179 1077 { "dmeansz", "", 12 , 1, ARGUS_PTYPE_INT, ARGUSPRINTDSTMEANPKTSIZE, ArgusPrintDstMeanPktSize, ArgusPrintDstMeanPktSizeLabel, "smallint unsigned", 0}, 1078 #define ARGUSPRINTRANK 180 1079 { "rank", "", 6 , 1, ARGUS_PTYPE_INT, ARGUSPRINTRANK, ArgusPrintRank, ArgusPrintRankLabel, "int unsigned", 0}, 1080 #define ARGUSPRINTSUM 181 1081 { "sum", "", 10 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTSUM, ArgusPrintSum, ArgusPrintSumLabel, "double", 0}, 1082 #define ARGUSPRINTRUN 182 1083 { "runtime", "", 10 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTRUN, ArgusPrintRunTime, ArgusPrintRunTimeLabel, "double", 0}, 1084 #define ARGUSPRINTIDLETIME 183 1085 { "idle", "", 10 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTIDLETIME, ArgusPrintIdleTime, ArgusPrintIdleTimeLabel, "double", 0}, 1086 #define ARGUSPRINTTCPOPTIONS 184 1087 { "tcpopt", "", 12 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTTCPOPTIONS, ArgusPrintTCPOptions, ArgusPrintTCPOptionsLabel, "varchar(12)", 0}, 1088 #define ARGUSPRINTRESPONSE 185 1089 { "resp", "", 12 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTRESPONSE, ArgusPrintResponse, ArgusPrintResponseLabel, "varchar(12)", 0}, 1090 #define ARGUSPRINTTCPSRCGAP 186 1091 { "sgap", "", 8 , 1, ARGUS_PTYPE_INT, ARGUSPRINTTCPSRCGAP, ArgusPrintSrcGap, ArgusPrintSrcGapLabel, "int unsigned", 0}, 1092 #define ARGUSPRINTTCPDSTGAP 187 1093 { "dgap", "", 8 , 1, ARGUS_PTYPE_INT, ARGUSPRINTTCPDSTGAP, ArgusPrintDstGap, ArgusPrintDstGapLabel, "int unsigned", 0}, 1094 #define ARGUSPRINTSRCOUI 188 1095 { "soui", "", 9 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTSRCOUI, ArgusPrintSrcOui, ArgusPrintSrcOuiLabel, "varchar(9)", 0}, 1096 #define ARGUSPRINTDSTOUI 189 1097 { "doui", "", 9 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTDSTOUI, ArgusPrintDstOui, ArgusPrintDstOuiLabel, "varchar(9)", 0}, 1098 #define ARGUSPRINTCOR 190 1099 { "cor", "", 12 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTCOR, ArgusPrintCor, ArgusPrintCorLabel, "varchar(12)", 0}, 1100 #define ARGUSPRINTLOCALADDR 191 1101 { "laddr", "", 18 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTLOCALADDR, ArgusPrintLocalAddr, ArgusPrintLocalAddrLabel, "varchar(64) not null", 0}, 1102 #define ARGUSPRINTREMOTEADDR 192 1103 { "raddr", "", 18 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTREMOTEADDR, ArgusPrintRemoteAddr, ArgusPrintRemoteAddrLabel, "varchar(64) not null", 0}, 1104 #define ARGUSPRINTLOCALNET 193 1105 { "lnet", "", 18 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTLOCALADDR, ArgusPrintLocalNet, ArgusPrintLocalNetLabel, "varchar(64) not null", 0}, 1106 #define ARGUSPRINTREMOTENET 194 1107 { "rnet", "", 18 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTREMOTEADDR, ArgusPrintRemoteNet, ArgusPrintRemoteNetLabel, "varchar(64) not null", 0}, 1108 #define ARGUSPRINTAPPBYTERATIO 195 1109 { "abr", "", 10 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTAPPBYTERATIO, ArgusPrintAppByteRatio, ArgusPrintAppByteRatioLabel, "double", 0}, 1110 #define ARGUSPRINTPRODUCERCONSUMERRATIO 196 1111 { "pcr", "", 10 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTPRODUCERCONSUMERRATIO, ArgusPrintProducerConsumerRatio, ArgusPrintProducerConsumerRatioLabel, "double", 0}, 1112 #define ARGUSPRINTTRANSEFFICIENCY 197 1113 { "tf", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTTRANSEFFICIENCY, ArgusPrintTransEfficiency, ArgusPrintTransEfficiencyLabel, "double", 0}, 1114 #define ARGUSPRINTSRCTRANSEFFICIENCY 198 1115 { "stf", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTSRCTRANSEFFICIENCY, ArgusPrintSrcTransEfficiency, ArgusPrintSrcTransEfficiencyLabel, "double", 0}, 1116 #define ARGUSPRINTDSTTRANSEFFICIENCY 199 1117 { "dtf", "", 12 , 1, ARGUS_PTYPE_DOUBLE, ARGUSPRINTDSTTRANSEFFICIENCY, ArgusPrintDstTransEfficiency, ArgusPrintDstTransEfficiencyLabel, "double", 0}, 1118 #define ARGUSPRINTINODECOUNTRYCODE 200 1119 { "ico", "", 3 , 1, ARGUS_PTYPE_STRING, ARGUSPRINTINODECOUNTRYCODE, ArgusPrintInodeCountryCode, ArgusPrintInodeCountryCodeLabel, "varchar(2)", 0}, 1120 }; 1121 1122 1123 #define IPPROTOSTR 256 1124 1125 char *ip_proto_string [IPPROTOSTR] = {"ip", "icmp", "igmp", "ggp", 1126 "ipnip", "st2", "tcp", "cbt", "egp", "igp", "bbn-rcc", "nvp", 1127 "pup", "argus", "emcon", "xnet", "chaos", "udp", "mux", "dcn", 1128 "hmp", "prm", "xns-idp", "trunk-1", "trunk-2", "leaf-1", "leaf-2", 1129 "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp", "merit-inp", "sep", 1130 "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++", "il", "ipv6", 1131 "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre", "mhrp", "bna", 1132 "esp", "ah", "i-nlsp", "swipe", "narp", "mobile", "tlsp", "skip", 1133 "ipv6-icmp", "ipv6-no", "ipv6-opts", "any", "cftp", "any", "sat-expak", "kryptolan", 1134 "rvd", "ippc", "any", "sat-mon", "visa", "ipcv", "cpnx", "cphb", "wsn", 1135 "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak", "iso-ip", "vmtp", 1136 "secure-vmtp", "vines", "ttp", "nsfnet-igp", "dgp", "tcf", "eigrp", 1137 "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp", 1138 "aes-sp3-d", "etherip", "encap", "pri-enc", "gmtp", "ifmp", "pnni", 1139 "pim", "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", 1140 "ipx-n-ip", "vrrp", "pgm", "zero", "l2tp", "ddx", "iatp", "stp", "srp", 1141 "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crudp", "sccopmce", "iplt", 1142 "sps", "pipe", "sctp", "fc", "rsvp", NULL, NULL, NULL, NULL, NULL, NULL, 1143 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /*141-150*/ 1144 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /*151-160*/ 1145 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /*161-170*/ 1146 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /*171-180*/ 1147 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /*181-190*/ 1148 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /*191-200*/ 1149 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /*201-210*/ 1150 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /*211-220*/ 1151 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /*221-230*/ 1152 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /*231-240*/ 1153 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, /*241-250*/ 1154 NULL, NULL, "ib", NULL, NULL, /*251-255*/ 1155 }; 1156 1157 char *icmptypestr[ICMP_MAXTYPE] = { 1158 "ECR", " ", " ", "UR" , "SRC", "RED", 1159 "AHA", " ", "ECO", "RTA", "RTS", "TXD", 1160 "PAR", "TST", "TSR", "IRQ", "IRR", "MAS", 1161 "MSR", "SEC", "ROB", "ROB", "ROB", "ROB", 1162 "ROB", "ROB", "ROB", "ROB", "ROB", "ROB", 1163 "TRC", "DCE", "MHR", "WAY", "IAH", "MRQ", 1164 "MRP", "DNQ", "DNP", "SKP", "PHO", "NRS", 1165 "NRA", "NNS", "NNA", "PTB", 1166 }; 1167 1168 struct ArgusTokenStruct llcsap_db[] = { 1169 { LLCSAP_NULL, "null" }, 1170 { LLCSAP_8021B_I, "gsap" }, 1171 { LLCSAP_8021B_G, "isap" }, 1172 { LLCSAP_SNAPATH, "snapath" }, 1173 { LLCSAP_IP, "ipsap" }, 1174 { LLCSAP_SNA1, "sna1" }, 1175 { LLCSAP_SNA2, "sna2" }, 1176 { LLCSAP_PROWAYNM, "p-nm" }, 1177 { LLCSAP_TI, "ti" }, 1178 { LLCSAP_BPDU, "stp" }, 1179 { LLCSAP_RS511, "eia" }, 1180 { LLCSAP_ISO8208, "x25" }, 1181 { LLCSAP_XNS, "xns" }, 1182 { LLCSAP_NESTAR, "nestar" }, 1183 { LLCSAP_PROWAYASLM, "p-aslm" }, 1184 { LLCSAP_ARP, "arp" }, 1185 { LLCSAP_SNAP, "snap" }, 1186 { LLCSAP_VINES1, "vine1" }, 1187 { LLCSAP_VINES2, "vine2" }, 1188 { LLCSAP_NETWARE, "netware" }, 1189 { LLCSAP_NETBIOS, "netbios" }, 1190 { LLCSAP_IBMNM, "ibmnm" }, 1191 { LLCSAP_RPL1, "rpl1" }, 1192 { LLCSAP_UB, "ub" }, 1193 { LLCSAP_RPL2, "rpl2" }, 1194 { LLCSAP_ISONS, "clns" }, 1195 { LLCSAP_GLOBAL, "gbl" }, 1196 { 0, NULL } 1197 }; 1198 1199 void ArgusLoadList(struct ArgusListStruct *, struct ArgusListStruct *); 1200 void ArgusInitAddrtoname(struct ArgusParserStruct *, u_int, u_int); 1201 1202 void ArgusInitServarray(struct ArgusParserStruct *); 1203 void ArgusInitEprotoarray(void); 1204 void ArgusInitProtoidarray(void); 1205 void ArgusInitEtherarray(void); 1206 void ArgusInitLlcsaparray(void); 1207 1208 void ArgusFreeServarray(struct ArgusParserStruct *); 1209 void ArgusFreeProtoidarray(void); 1210 void ArgusFreeEtherarray(void); 1211 void ArgusFreeLlcsaparray(void); 1212 1213 unsigned int ArgusIndexRecord (struct ArgusRecordStruct *); 1214 1215 void ArgusFree (void *buf); 1216 void *ArgusMalloc (int); 1217 void *ArgusCalloc (int, int); 1218 void *ArgusMallocListRecord (struct ArgusParserStruct *, int); 1219 void ArgusFreeListRecord (struct ArgusParserStruct *, void *buf); 1220 int ArgusParseResourceFile (struct ArgusParserStruct *, char *); 1221 int ArgusParserWiresharkManufFile (struct ArgusParserStruct *, char *); 1222 int ArgusParseTimeArg (char **, char **, int, struct tm *); 1223 1224 void ArgusAdjustGlobalTime (struct ArgusParserStruct *parser, struct timeval *now); 1225 void ArgusReverseRecordWithFlag (struct ArgusRecordStruct *, int); 1226 void ArgusReverseRecord (struct ArgusRecordStruct *); 1227 void ArgusReverseDataRecord (struct ArgusRecordStruct *); 1228 void ArgusZeroRecord (struct ArgusRecordStruct *); 1229 void ArgusZeroRecordWithFlag (struct ArgusRecordStruct *, int); 1230 struct ArgusRecordStruct *ArgusSubtractRecord (struct ArgusRecordStruct *, struct ArgusRecordStruct *); 1231 1232 void ArgusProcessDirection (struct ArgusParserStruct *, struct ArgusRecordStruct *); 1233 int RaProcessAddress (struct ArgusParserStruct *, struct ArgusLabelerStruct *, unsigned int *, int, int); 1234 1235 struct ArgusQueueStruct *ArgusNewQueue (void); 1236 void ArgusDeleteQueue (struct ArgusQueueStruct *); 1237 int ArgusGetQueueCount(struct ArgusQueueStruct *); 1238 void ArgusPushQueue(struct ArgusQueueStruct *, struct ArgusQueueHeader *, int); 1239 struct ArgusQueueHeader *ArgusPopQueue (struct ArgusQueueStruct *queue, int); 1240 int ArgusAddToQueue(struct ArgusQueueStruct *, struct ArgusQueueHeader *, int); 1241 struct ArgusQueueHeader *ArgusRemoveFromQueue(struct ArgusQueueStruct *, struct ArgusQueueHeader *, int); 1242 1243 int ArgusConvertInitialWriteStruct (struct WriteStruct *, struct ArgusRecordStruct *); 1244 int ArgusConvertWriteStruct (struct WriteStruct *, struct ArgusRecordStruct *); 1245 1246 struct timeval *RaMinTime (struct timeval *, struct timeval *); 1247 struct timeval *RaMaxTime (struct timeval *, struct timeval *); 1248 1249 long long ArgusDiffTime (struct ArgusTime *, struct ArgusTime *, struct timeval *); 1250 int RaDiffTime (struct timeval *, struct timeval *, struct timeval *); 1251 float RaDeltaFloatTime (struct timeval *, struct timeval *); 1252 1253 void ArgusPrintTime(struct ArgusParserStruct *, char *, struct timeval *); 1254 char *ArgusGenerateLabel(struct ArgusParserStruct *, struct ArgusRecordStruct *); 1255 1256 void ArgusPrintRecord (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *ptr, int); 1257 void ArgusDump (const u_char *, int, char *); 1258 1259 1260 char *RaGetUserDataString (struct ArgusRecordStruct *); 1261 1262 int ArgusEncode (struct ArgusParserStruct *, const char *, const char *, int, char *, int); 1263 int ArgusEncode32 (struct ArgusParserStruct *, const char *, int , char *, int ); 1264 1265 int ArgusEncode64 (struct ArgusParserStruct *, const char *, int, char *, int); 1266 int ArgusEncodeAscii (struct ArgusParserStruct *, const char *, int, char *, int); 1267 1268 void clearArgusWfile(struct ArgusParserStruct *); 1269 extern unsigned int thisnet, localaddr, localnet, netmask; 1270 1271 void ArgusProcessLabelOptions(struct ArgusParserStruct *, char *); 1272 1273 void (*RaPrintAlgorithms[ARGUS_MAX_PRINT_ALG])(struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int) = { 1274 ArgusPrintStartDate, 1275 ArgusPrintFlags, 1276 ArgusPrintProto, 1277 ArgusPrintSrcAddr, 1278 ArgusPrintSrcPort, 1279 ArgusPrintDirection, 1280 ArgusPrintDstAddr, 1281 ArgusPrintDstPort, 1282 ArgusPrintSrcPackets, 1283 ArgusPrintDstPackets, 1284 ArgusPrintSrcBytes, 1285 ArgusPrintDstBytes, 1286 ArgusPrintState, 1287 NULL, 1288 }; 1289 1290 1291 int argus_nametoeproto(char *); 1292 unsigned int __argus_atoin(char *, unsigned int *); 1293 1294 void ArgusNtoH (struct ArgusRecord *); 1295 void ArgusHtoN (struct ArgusRecord *); 1296 1297 void ArgusV2NtoH (struct ArgusV2Record *); 1298 void ArgusV2HtoN (struct ArgusV2Record *); 1299 1300 #else 1301 #define ARGUSPRINTSTARTDATE 0 1302 #define ARGUSPRINTLASTDATE 1 1303 #define ARGUSPRINTTRANSACTIONS 2 1304 #define ARGUSPRINTDURATION 3 1305 #define ARGUSPRINTMEAN 4 1306 #define ARGUSPRINTMIN 5 1307 #define ARGUSPRINTMAX 6 1308 #define ARGUSPRINTSRCADDR 7 1309 #define ARGUSPRINTDSTADDR 8 1310 #define ARGUSPRINTPROTO 9 1311 #define ARGUSPRINTSRCPORT 10 1312 #define ARGUSPRINTDSTPORT 11 1313 #define ARGUSPRINTSRCTOS 12 1314 #define ARGUSPRINTDSTTOS 13 1315 #define ARGUSPRINTSRCDSBYTE 14 1316 #define ARGUSPRINTDSTDSBYTE 15 1317 #define ARGUSPRINTSRCTTL 16 1318 #define ARGUSPRINTDSTTTL 17 1319 #define ARGUSPRINTBYTES 18 1320 #define ARGUSPRINTSRCBYTES 19 1321 #define ARGUSPRINTDSTBYTES 20 1322 #define ARGUSPRINTAPPBYTES 21 1323 #define ARGUSPRINTSRCAPPBYTES 22 1324 #define ARGUSPRINTDSTAPPBYTES 23 1325 #define ARGUSPRINTPACKETS 24 1326 #define ARGUSPRINTSRCPACKETS 25 1327 #define ARGUSPRINTDSTPACKETS 26 1328 #define ARGUSPRINTLOAD 27 1329 #define ARGUSPRINTSRCLOAD 28 1330 #define ARGUSPRINTDSTLOAD 29 1331 #define ARGUSPRINTLOSS 30 1332 #define ARGUSPRINTSRCLOSS 31 1333 #define ARGUSPRINTDSTLOSS 32 1334 #define ARGUSPRINTPERCENTLOSS 33 1335 #define ARGUSPRINTSRCPERCENTLOSS 34 1336 #define ARGUSPRINTDSTPERCENTLOSS 35 1337 #define ARGUSPRINTRATE 36 1338 #define ARGUSPRINTSRCRATE 37 1339 #define ARGUSPRINTDSTRATE 38 1340 #define ARGUSPRINTSOURCEID 39 1341 #define ARGUSPRINTFLAGS 40 1342 #define ARGUSPRINTSRCMACADDRESS 41 1343 #define ARGUSPRINTDSTMACADDRESS 42 1344 #define ARGUSPRINTDIR 43 1345 #define ARGUSPRINTSRCINTPKT 44 1346 #define ARGUSPRINTDSTINTPKT 45 1347 #define ARGUSPRINTACTSRCINTPKT 46 1348 #define ARGUSPRINTACTDSTINTPKT 47 1349 #define ARGUSPRINTIDLESRCINTPKT 48 1350 #define ARGUSPRINTIDLEDSTINTPKT 49 1351 #define ARGUSPRINTSRCINTPKTMAX 50 1352 #define ARGUSPRINTSRCINTPKTMIN 51 1353 #define ARGUSPRINTDSTINTPKTMAX 52 1354 #define ARGUSPRINTDSTINTPKTMIN 53 1355 #define ARGUSPRINTACTSRCINTPKTMAX 54 1356 #define ARGUSPRINTACTSRCINTPKTMIN 55 1357 #define ARGUSPRINTACTDSTINTPKTMAX 56 1358 #define ARGUSPRINTACTDSTINTPKTMIN 57 1359 #define ARGUSPRINTIDLESRCINTPKTMAX 58 1360 #define ARGUSPRINTIDLESRCINTPKTMIN 59 1361 #define ARGUSPRINTIDLEDSTINTPKTMAX 60 1362 #define ARGUSPRINTIDLEDSTINTPKTMIN 61 1363 #define ARGUSPRINTSPACER 62 1364 #define ARGUSPRINTSRCJITTER 63 1365 #define ARGUSPRINTDSTJITTER 64 1366 #define ARGUSPRINTACTSRCJITTER 65 1367 #define ARGUSPRINTACTDSTJITTER 66 1368 #define ARGUSPRINTIDLESRCJITTER 67 1369 #define ARGUSPRINTIDLEDSTJITTER 68 1370 #define ARGUSPRINTSTATE 69 1371 #define ARGUSPRINTDELTADURATION 70 1372 #define ARGUSPRINTDELTASTARTTIME 71 1373 #define ARGUSPRINTDELTALASTTIME 72 1374 #define ARGUSPRINTDELTASPKTS 73 1375 #define ARGUSPRINTDELTADPKTS 74 1376 #define ARGUSPRINTDELTASRCPKTS 75 1377 #define ARGUSPRINTDELTADSTPKTS 76 1378 #define ARGUSPRINTDELTASRCBYTES 77 1379 #define ARGUSPRINTDELTADSTBYTES 78 1380 #define ARGUSPRINTPERCENTDELTASRCPKTS 79 1381 #define ARGUSPRINTPERCENTDELTADSTPKTS 80 1382 #define ARGUSPRINTPERCENTDELTASRCBYTES 81 1383 #define ARGUSPRINTPERCENTDELTADSTBYTES 82 1384 #define ARGUSPRINTSRCUSERDATA 83 1385 #define ARGUSPRINTDSTUSERDATA 84 1386 #define ARGUSPRINTTCPEXTENSIONS 85 1387 #define ARGUSPRINTSRCWINDOW 86 1388 #define ARGUSPRINTDSTWINDOW 87 1389 #define ARGUSPRINTJOINDELAY 88 1390 #define ARGUSPRINTLEAVEDELAY 89 1391 #define ARGUSPRINTSEQUENCENUMBER 90 1392 #define ARGUSPRINTBINS 91 1393 #define ARGUSPRINTBINNUMBER 92 1394 #define ARGUSPRINTSRCMPLS 93 1395 #define ARGUSPRINTDSTMPLS 94 1396 #define ARGUSPRINTSRCVLAN 95 1397 #define ARGUSPRINTDSTVLAN 96 1398 #define ARGUSPRINTSRCVID 97 1399 #define ARGUSPRINTDSTVID 98 1400 #define ARGUSPRINTSRCVPRI 99 1401 #define ARGUSPRINTDSTVPRI 100 1402 #define ARGUSPRINTSRCIPID 101 1403 #define ARGUSPRINTDSTIPID 102 1404 #define ARGUSPRINTSTARTRANGE 103 1405 #define ARGUSPRINTENDRANGE 104 1406 #define ARGUSPRINTTCPSRCBASE 105 1407 #define ARGUSPRINTTCPDSTBASE 106 1408 #define ARGUSPRINTTCPRTT 107 1409 #define ARGUSPRINTINODE 108 1410 #define ARGUSPRINTSTDDEV 109 1411 #define ARGUSPRINTRELDATE 110 1412 #define ARGUSPRINTBYTEOFFSET 111 1413 #define ARGUSPRINTSRCNET 112 1414 #define ARGUSPRINTDSTNET 113 1415 #define ARGUSPRINTSRCDURATION 114 1416 #define ARGUSPRINTDSTDURATION 115 1417 #define ARGUSPRINTTCPSRCMAX 116 1418 #define ARGUSPRINTTCPDSTMAX 117 1419 #define ARGUSPRINTTCPSYNACK 118 1420 #define ARGUSPRINTTCPACKDAT 119 1421 #define ARGUSPRINTSRCSTARTDATE 120 1422 #define ARGUSPRINTSRCLASTDATE 121 1423 #define ARGUSPRINTDSTSTARTDATE 122 1424 #define ARGUSPRINTDSTLASTDATE 123 1425 #define ARGUSPRINTSRCENCAPS 124 1426 #define ARGUSPRINTDSTENCAPS 125 1427 #define ARGUSPRINTSRCPKTSIZE 126 1428 #define ARGUSPRINTSRCMAXPKTSIZE 127 1429 #define ARGUSPRINTSRCMINPKTSIZE 128 1430 #define ARGUSPRINTDSTPKTSIZE 129 1431 #define ARGUSPRINTDSTMAXPKTSIZE 130 1432 #define ARGUSPRINTDSTMINPKTSIZE 131 1433 #define ARGUSPRINTSRCCOUNTRYCODE 132 1434 #define ARGUSPRINTDSTCOUNTRYCODE 133 1435 #define ARGUSPRINTSRCHOPCOUNT 134 1436 #define ARGUSPRINTDSTHOPCOUNT 135 1437 #define ARGUSPRINTICMPID 136 1438 #define ARGUSPRINTLABEL 137 1439 #define ARGUSPRINTSRCINTPKTDIST 138 1440 #define ARGUSPRINTDSTINTPKTDIST 139 1441 #define ARGUSPRINTACTSRCINTPKTDIST 140 1442 #define ARGUSPRINTACTDSTINTPKTDIST 141 1443 #define ARGUSPRINTIDLESRCINTPKTDIST 142 1444 #define ARGUSPRINTIDLEDSTINTPKTDIST 143 1445 #define ARGUSPRINTRETRANS 144 1446 #define ARGUSPRINTSRCRETRANS 145 1447 #define ARGUSPRINTDSTRETRANS 146 1448 #define ARGUSPRINTPERCENTRETRANS 147 1449 #define ARGUSPRINTPERCENTSRCRETRANS 148 1450 #define ARGUSPRINTPERCENTDSTRETRANS 149 1451 #define ARGUSPRINTNACKS 150 1452 #define ARGUSPRINTSRCNACKS 151 1453 #define ARGUSPRINTDSTNACKS 152 1454 #define ARGUSPRINTPERCENTNACKS 153 1455 #define ARGUSPRINTPERCENTSRCNACKS 154 1456 #define ARGUSPRINTPERCENTDSTNACKS 155 1457 #define ARGUSPRINTSOLO 156 1458 #define ARGUSPRINTSRCSOLO 157 1459 #define ARGUSPRINTDSTSOLO 158 1460 #define ARGUSPRINTPERCENTSOLO 159 1461 #define ARGUSPRINTPERCENTSRCSOLO 160 1462 #define ARGUSPRINTPERCENTDSTSOLO 161 1463 #define ARGUSPRINTFIRST 162 1464 #define ARGUSPRINTSRCFIRST 163 1465 #define ARGUSPRINTDSTFIRST 164 1466 #define ARGUSPRINTPERCENTFIRST 165 1467 #define ARGUSPRINTPERCENTSRCFIRST 166 1468 #define ARGUSPRINTPERCENTDSTFIRST 167 1469 #define ARGUSPRINTAUTOID 168 1470 #define ARGUSPRINTSRCASN 169 1471 #define ARGUSPRINTDSTASN 170 1472 #define ARGUSPRINTINODEASN 171 1473 #define ARGUSPRINTCAUSE 172 1474 #define ARGUSPRINTBSSID 173 1475 #define ARGUSPRINTSSID 174 1476 #define ARGUSPRINTKEYSTROKENSTROKE 175 1477 #define ARGUSPRINTKEYSTROKESRCNSTROKE 176 1478 #define ARGUSPRINTKEYSTROKEDSTNSTROKE 177 1479 #define ARGUSPRINTSRCMEANPKTSIZE 178 1480 #define ARGUSPRINTDSTMEANPKTSIZE 179 1481 #define ARGUSPRINTRANK 180 1482 #define ARGUSPRINTSUM 181 1483 #define ARGUSPRINTRUN 182 1484 #define ARGUSPRINTIDLETIME 183 1485 #define ARGUSPRINTTCPOPTIONS 184 1486 #define ARGUSPRINTRESPONSE 185 1487 #define ARGUSPRINTTCPSRCGAP 186 1488 #define ARGUSPRINTTCPDSTGAP 187 1489 #define ARGUSPRINTSRCOUI 188 1490 #define ARGUSPRINTDSTOUI 189 1491 #define ARGUSPRINTCOR 190 1492 #define ARGUSPRINTLOCALADDR 191 1493 #define ARGUSPRINTREMOTEADDR 192 1494 #define ARGUSPRINTLOCALNET 193 1495 #define ARGUSPRINTREMOTENET 194 1496 #define ARGUSPRINTAPPBYTERATIO 195 1497 #define ARGUSPRINTTRANSEFFICIENCY 196 1498 #define ARGUSPRINTSRCTRANSEFFICIENCY 197 1499 #define ARGUSPRINTDSTTRANSEFFICIENCY 198 1500 #define ARGUSPRINTINODECOUNTRYCODE 199 1501 #define ARGUSPRINTSRCDUP 200 1502 #define ARGUSPRINTDSTDUP 201 1503 1504 extern struct ArgusPrintFieldStruct RaPrintAlgorithmTable[MAX_PRINT_ALG_TYPES]; 1505 extern void (*RaPrintAlgorithms[ARGUS_MAX_PRINT_ALG])(struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1506 1507 extern void ArgusProcessLabelOptions(struct ArgusParserStruct *, char *); 1508 1509 extern void ArgusLoadList(struct ArgusListStruct *, struct ArgusListStruct *); 1510 extern void ArgusInitAddrtoname(struct ArgusParserStruct *, u_int, u_int); 1511 1512 extern void ArgusInitServarray(struct ArgusParserStruct *); 1513 extern void ArgusInitEprotoarray(void); 1514 extern void ArgusInitProtoidarray(void); 1515 extern void ArgusInitEtherarray(void); 1516 extern void ArgusInitLlcsaparray(void); 1517 1518 extern void ArgusFreeServarray(struct ArgusParserStruct *); 1519 extern void ArgusFreeProtoidarray(void); 1520 extern void ArgusFreeEtherarray(void); 1521 extern void ArgusFreeLlcsaparray(void); 1522 1523 extern char *ip_proto_string []; 1524 extern char *icmptypestr[]; 1525 1526 extern struct enamemem *lookup_emem(struct enamemem *, const u_char *); 1527 1528 extern unsigned int ArgusIndexRecord (struct ArgusRecordStruct *); 1529 1530 extern void ArgusFree (void *buf); 1531 extern void *ArgusMalloc (int); 1532 extern void *ArgusCalloc (int, int); 1533 extern void *ArgusMallocListRecord (struct ArgusParserStruct *, int); 1534 extern void ArgusFreeListRecord (struct ArgusParserStruct *, void *buf); 1535 extern int ArgusParseResourceFile (struct ArgusParserStruct *, char *); 1536 extern int ArgusParserWiresharkManufFile (struct ArgusParserStruct *, char *); 1537 1538 extern int ArgusParseTimeArg (char **, char **, int, struct tm *); 1539 1540 extern void ArgusAdjustGlobalTime (struct ArgusParserStruct *parser, struct timeval *now); 1541 extern void ArgusReverseRecordWithFlag (struct ArgusRecordStruct *, int); 1542 extern void ArgusReverseRecord (struct ArgusRecordStruct *); 1543 extern void ArgusReverseDataRecord (struct ArgusRecordStruct *); 1544 extern void ArgusZeroRecord (struct ArgusRecordStruct *); 1545 extern void ArgusZeroRecordWithFlag (struct ArgusRecordStruct *, int); 1546 extern struct ArgusRecordStruct *ArgusSubtractRecord (struct ArgusRecordStruct *, struct ArgusRecordStruct *); 1547 1548 extern void ArgusProcessDirection (struct ArgusParserStruct *, struct ArgusRecordStruct *); 1549 extern int RaProcessAddress (struct ArgusParserStruct *, struct ArgusLabelerStruct *, unsigned int *, int, int); 1550 1551 extern struct ArgusQueueStruct *ArgusNewQueue (void); 1552 extern void ArgusDeleteQueue (struct ArgusQueueStruct *); 1553 extern int ArgusGetQueueCount(struct ArgusQueueStruct *); 1554 extern void ArgusPushQueue(struct ArgusQueueStruct *, struct ArgusQueueHeader *, int); 1555 extern struct ArgusQueueHeader *ArgusPopQueue (struct ArgusQueueStruct *queue, int); 1556 extern int ArgusAddToQueue(struct ArgusQueueStruct *, struct ArgusQueueHeader *, int); 1557 extern struct ArgusQueueHeader *ArgusRemoveFromQueue(struct ArgusQueueStruct *, struct ArgusQueueHeader *, int); 1558 1559 extern int ArgusConvertInitialWriteStruct (struct WriteStruct *, struct ArgusRecordStruct *); 1560 extern int ArgusConvertWriteStruct (struct WriteStruct *, struct ArgusRecordStruct *); 1561 1562 extern struct timeval *RaMinTime (struct timeval *, struct timeval *); 1563 extern struct timeval *RaMaxTime (struct timeval *, struct timeval *); 1564 1565 extern long long ArgusDiffTime (struct ArgusTime *, struct ArgusTime *, struct timeval *); 1566 extern int RaDiffTime (struct timeval *, struct timeval *, struct timeval *); 1567 extern float RaDeltaFloatTime (struct timeval *, struct timeval *); 1568 1569 extern char *ArgusGetString (struct ArgusParserStruct *, u_char *, int); 1570 1571 extern void ArgusPrintTime(struct ArgusParserStruct *, char *, struct timeval *); 1572 extern char *ArgusGenerateLabel(struct ArgusParserStruct *, struct ArgusRecordStruct *); 1573 1574 extern void ArgusPrintRecord (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *ptr, int); 1575 extern void ArgusDump (const u_char *, int, char *); 1576 1577 extern void ArgusMainInit (struct ArgusParserStruct *, int, char **); 1578 1579 extern void ArgusPrintCause (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int, int); 1580 extern void ArgusPrintDate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int, int); 1581 extern void ArgusPrintStartDate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1582 extern void ArgusPrintLastDate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1583 extern void ArgusPrintSrcStartDate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1584 extern void ArgusPrintSrcLastDate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1585 extern void ArgusPrintDstStartDate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1586 extern void ArgusPrintDstLastDate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1587 extern void ArgusPrintSourceID (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1588 extern void ArgusPrintFlags (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1589 extern void ArgusPrintMacAddress (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1590 extern void ArgusPrintSrcMacAddress (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1591 extern void ArgusPrintDstMacAddress (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1592 extern void ArgusPrintProto (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1593 extern void ArgusPrintAddr (struct ArgusParserStruct *, char *, int, void *, int, char, int, int); 1594 extern void ArgusPrintSrcNet (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1595 extern void ArgusPrintSrcAddr (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1596 extern void ArgusPrintDstNet (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1597 extern void ArgusPrintDstAddr (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1598 extern void ArgusPrintLocalNet (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1599 extern void ArgusPrintLocalAddr (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1600 extern void ArgusPrintRemoteNet (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1601 extern void ArgusPrintRemoteAddr (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1602 extern void ArgusPrintPort (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int, unsigned char, unsigned int, int, int); 1603 extern void ArgusPrintSrcPort (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1604 extern void ArgusPrintDstPort (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1605 extern void ArgusPrintDirection (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1606 extern void ArgusPrintPackets (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1607 extern void ArgusPrintSrcPackets (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1608 extern void ArgusPrintDstPackets (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1609 extern void ArgusPrintBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1610 extern void ArgusPrintSrcBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1611 extern void ArgusPrintDstBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1612 extern void ArgusPrintAppBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1613 extern void ArgusPrintSrcAppBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1614 extern void ArgusPrintDstAppBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1615 extern void ArgusPrintSrcIntPkt (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1616 extern void ArgusPrintSrcIntPktDist (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1617 extern void ArgusPrintDstIntPkt (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1618 extern void ArgusPrintDstIntPktDist (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1619 extern void ArgusPrintSrcIntPktMax (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1620 extern void ArgusPrintSrcIntPktMin (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1621 extern void ArgusPrintDstIntPktMax (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1622 extern void ArgusPrintDstIntPktMin (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1623 extern void ArgusPrintActiveSrcIntPktMax (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1624 extern void ArgusPrintActiveSrcIntPktMin (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1625 extern void ArgusPrintActiveDstIntPktMax (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1626 extern void ArgusPrintActiveDstIntPktMin (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1627 extern void ArgusPrintIdleSrcIntPkt (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1628 extern void ArgusPrintIdleSrcIntPktMax (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1629 extern void ArgusPrintIdleSrcIntPktMin (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1630 extern void ArgusPrintIdleDstIntPkt (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1631 extern void ArgusPrintIdleDstIntPktMax (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1632 extern void ArgusPrintIdleDstIntPktMin (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1633 extern void ArgusPrintJitter (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1634 extern void ArgusPrintSrcJitter (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1635 extern void ArgusPrintDstJitter (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1636 extern void ArgusPrintState (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1637 extern void ArgusPrintDeltaDuration (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1638 extern void ArgusPrintDeltaStartTime (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1639 extern void ArgusPrintDeltaLastTime (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1640 extern void ArgusPrintDeltaSrcPkts (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1641 extern void ArgusPrintDeltaDstPkts (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1642 extern void ArgusPrintDeltaSrcBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1643 extern void ArgusPrintDeltaDstBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1644 extern void ArgusPrintPercentDeltaSrcPkts (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1645 extern void ArgusPrintPercentDeltaDstPkts (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1646 extern void ArgusPrintPercentDeltaSrcBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1647 extern void ArgusPrintPercentDeltaDstBytes (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1648 extern void ArgusPrintSrcUserData (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1649 extern void ArgusPrintDstUserData (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1650 extern void ArgusPrintTCPExtensions (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1651 extern void ArgusPrintSrcLoad (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1652 extern void ArgusPrintDstLoad (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1653 extern void ArgusPrintLoad (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1654 extern void ArgusPrintSrcLoss (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1655 extern void ArgusPrintDstLoss (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1656 extern void ArgusPrintLoss (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1657 extern void ArgusPrintPercentLoss (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1658 extern void ArgusPrintSrcRate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1659 extern void ArgusPrintDstRate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1660 extern void ArgusPrintRate (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1661 extern void ArgusPrintSrcTos (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1662 extern void ArgusPrintDstTos (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1663 extern void ArgusPrintSrcDSByte (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1664 extern void ArgusPrintDstDSByte (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1665 extern void ArgusPrintSrcIpId (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1666 extern void ArgusPrintDstIpId (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1667 extern void ArgusPrintSrcTtl (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1668 extern void ArgusPrintSrcVlan (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1669 extern void ArgusPrintDstVlan (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1670 extern void ArgusPrintSrcVID (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1671 extern void ArgusPrintDstVID (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1672 extern void ArgusPrintSrcVPRI (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1673 extern void ArgusPrintDstVPRI (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1674 extern void ArgusPrintSrcMpls (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1675 extern void ArgusPrintDstMpls (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1676 extern void ArgusPrintSrcWindow (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1677 extern void ArgusPrintDstWindow (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1678 extern void ArgusPrintJoinDelay (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1679 extern void ArgusPrintLeaveDelay (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1680 extern void ArgusPrintMean (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1681 extern void ArgusPrintStartRange (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1682 extern void ArgusPrintEndRange (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1683 extern void ArgusPrintSrcDuration (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1684 extern void ArgusPrintDstDuration (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1685 extern void ArgusPrintDuration (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1686 extern void ArgusPrintTransactions (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1687 extern void ArgusPrintSequenceNumber (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1688 extern void ArgusPrintRank (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1689 extern void ArgusPrintBinNumber (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1690 extern void ArgusPrintBins (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1691 extern void ArgusPrintTCPSrcBase (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1692 extern void ArgusPrintTCPDstBase (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1693 extern void ArgusPrintTCPRTT (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1694 extern void ArgusPrintTCPSrcMax (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1695 extern void ArgusPrintTCPDstMax (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1696 extern void ArgusPrintTCPSrcGap (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1697 extern void ArgusPrintTCPDstGap (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1698 extern void ArgusPrintInode (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1699 extern void ArgusPrintMin (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1700 extern void ArgusPrintMax (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1701 extern void ArgusPrintStdDeviation (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1702 extern void ArgusPrintRunTime (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1703 extern void ArgusPrintIdleTime (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1704 extern void ArgusPrintLabel (struct ArgusParserStruct *, char *, struct ArgusRecordStruct *, int); 1705 1706 extern void ArgusPrintLabelLabel (struct ArgusParserStruct *, char *, int); 1707 extern void ArgusPrintCauseLabel (struct ArgusParserStruct *, char *, int); 1708 extern void ArgusPrintDateLabel (struct ArgusParserStruct *, char *, int); 1709 extern void ArgusPrintStartDateLabel (struct ArgusParserStruct *, char *, int); 1710 extern void ArgusPrintLastDateLabel (struct ArgusParserStruct *, char *, int); 1711 extern void ArgusPrintSourceIDLabel (struct ArgusParserStruct *, char *, int); 1712 extern void ArgusPrintFlagsLabel (struct ArgusParserStruct *, char *, int); 1713 extern void ArgusPrintSrcMacAddressLabel (struct ArgusParserStruct *, char *, int); 1714 extern void ArgusPrintDstMacAddressLabel (struct ArgusParserStruct *, char *, int); 1715 extern void ArgusPrintProtoLabel (struct ArgusParserStruct *, char *, int); 1716 extern void ArgusPrintSrcAddrLabel (struct ArgusParserStruct *, char *, int); 1717 extern void ArgusPrintDstAddrLabel (struct ArgusParserStruct *, char *, int); 1718 extern void ArgusPrintLocalAddrLabel (struct ArgusParserStruct *, char *, int); 1719 extern void ArgusPrintRemoteAddrLabel (struct ArgusParserStruct *, char *, int); 1720 extern void ArgusPrintSrcPortLabel (struct ArgusParserStruct *, char *, int); 1721 extern void ArgusPrintDstPortLabel (struct ArgusParserStruct *, char *, int); 1722 extern void ArgusPrintSrcIpIdLabel (struct ArgusParserStruct *, char *, int); 1723 extern void ArgusPrintDstIpIdLabel (struct ArgusParserStruct *, char *, int); 1724 extern void ArgusPrintSrcTtlLabel (struct ArgusParserStruct *, char *, int); 1725 extern void ArgusPrintDstTtlLabel (struct ArgusParserStruct *, char *, int); 1726 extern void ArgusPrintDirectionLabel (struct ArgusParserStruct *, char *, int); 1727 extern void ArgusPrintPacketsLabel (struct ArgusParserStruct *, char *, int); 1728 extern void ArgusPrintSrcPacketsLabel (struct ArgusParserStruct *, char *, int); 1729 extern void ArgusPrintDstPacketsLabel (struct ArgusParserStruct *, char *, int); 1730 extern void ArgusPrintBytesLabel (struct ArgusParserStruct *, char *, int); 1731 extern void ArgusPrintSrcBytesLabel (struct ArgusParserStruct *, char *, int); 1732 extern void ArgusPrintDstBytesLabel (struct ArgusParserStruct *, char *, int); 1733 extern void ArgusPrintAppBytesLabel (struct ArgusParserStruct *, char *, int); 1734 extern void ArgusPrintSrcAppBytesLabel (struct ArgusParserStruct *, char *, int); 1735 extern void ArgusPrintDstAppBytesLabel (struct ArgusParserStruct *, char *, int); 1736 extern void ArgusPrintSrcIntPktLabel (struct ArgusParserStruct *, char *, int); 1737 extern void ArgusPrintSrcIntPktDistLabel (struct ArgusParserStruct *, char *, int); 1738 extern void ArgusPrintDstIntPktLabel (struct ArgusParserStruct *, char *, int); 1739 extern void ArgusPrintDstIntPktDistLabel (struct ArgusParserStruct *, char *, int); 1740 extern void ArgusPrintSrcIntPktMaxLabel (struct ArgusParserStruct *, char *, int); 1741 extern void ArgusPrintSrcIntPktMinLabel (struct ArgusParserStruct *, char *, int); 1742 extern void ArgusPrintDstIntPktMaxLabel (struct ArgusParserStruct *, char *, int); 1743 extern void ArgusPrintDstIntPktMinLabel (struct ArgusParserStruct *, char *, int); 1744 extern void ArgusPrintActiveSrcIntPktLabel (struct ArgusParserStruct *, char *, int); 1745 extern void ArgusPrintActiveSrcIntPktDistLabel (struct ArgusParserStruct *, char *, int); 1746 extern void ArgusPrintActiveSrcIntPktMaxLabel (struct ArgusParserStruct *, char *, int); 1747 extern void ArgusPrintActiveSrcIntPktMinLabel (struct ArgusParserStruct *, char *, int); 1748 extern void ArgusPrintActiveDstIntPktMaxLabel (struct ArgusParserStruct *, char *, int); 1749 extern void ArgusPrintActiveDstIntPktMinLabel (struct ArgusParserStruct *, char *, int); 1750 extern void ArgusPrintIdleSrcIntPktLabel (struct ArgusParserStruct *, char *, int); 1751 extern void ArgusPrintIdleSrcIntPktDistLabel (struct ArgusParserStruct *, char *, int); 1752 extern void ArgusPrintIdleSrcIntPktMaxLabel (struct ArgusParserStruct *, char *, int); 1753 extern void ArgusPrintIdleSrcIntPktMinLabel (struct ArgusParserStruct *, char *, int); 1754 extern void ArgusPrintIdleDstIntPktMaxLabel (struct ArgusParserStruct *, char *, int); 1755 extern void ArgusPrintIdleDstIntPktMinLabel (struct ArgusParserStruct *, char *, int); 1756 extern void ArgusPrintJitterLabel (struct ArgusParserStruct *, char *, int); 1757 extern void ArgusPrintSrcJitterLabel (struct ArgusParserStruct *, char *, int); 1758 extern void ArgusPrintDstJitterLabel (struct ArgusParserStruct *, char *, int); 1759 extern void ArgusPrintStateLabel (struct ArgusParserStruct *, char *, int); 1760 extern void ArgusPrintDeltaDurationLabel (struct ArgusParserStruct *, char *, int); 1761 extern void ArgusPrintDeltaStartTimeLabel (struct ArgusParserStruct *, char *, int); 1762 extern void ArgusPrintDeltaLastTimeLabel (struct ArgusParserStruct *, char *, int); 1763 extern void ArgusPrintDeltaSrcPktsLabel (struct ArgusParserStruct *, char *, int); 1764 extern void ArgusPrintDeltaDstPktsLabel (struct ArgusParserStruct *, char *, int); 1765 extern void ArgusPrintDeltaSrcBytesLabel (struct ArgusParserStruct *, char *, int); 1766 extern void ArgusPrintDeltaDstBytesLabel (struct ArgusParserStruct *, char *, int); 1767 extern void ArgusPrintPercentDeltaSrcPktsLabel (struct ArgusParserStruct *, char *, int); 1768 extern void ArgusPrintPercentDeltaDstPktsLabel (struct ArgusParserStruct *, char *, int); 1769 extern void ArgusPrintPercentDeltaSrcBytesLabel (struct ArgusParserStruct *, char *, int); 1770 extern void ArgusPrintPercentDeltaDstBytesLabel (struct ArgusParserStruct *, char *, int); 1771 extern void ArgusPrintSrcUserDataLabel (struct ArgusParserStruct *, char *, int); 1772 extern void ArgusPrintDstUserDataLabel (struct ArgusParserStruct *, char *, int); 1773 1774 extern void ArgusPrintTCPExtensionsLabel (struct ArgusParserStruct *, char *, int); 1775 extern void ArgusPrintSrcLoadLabel (struct ArgusParserStruct *, char *, int); 1776 extern void ArgusPrintDstLoadLabel (struct ArgusParserStruct *, char *, int); 1777 extern void ArgusPrintSrcLoadLabel (struct ArgusParserStruct *, char *, int); 1778 extern void ArgusPrintDstLoadLabel (struct ArgusParserStruct *, char *, int); 1779 extern void ArgusPrintLoadLabel (struct ArgusParserStruct *, char *, int); 1780 extern void ArgusPrintSrcLossLabel (struct ArgusParserStruct *, char *, int); 1781 extern void ArgusPrintDstLossLabel (struct ArgusParserStruct *, char *, int); 1782 extern void ArgusPrintLossLabel (struct ArgusParserStruct *, char *, int); 1783 extern void ArgusPrintPercentLossLabel (struct ArgusParserStruct *, char *, int); 1784 extern void ArgusPrintSrcRateLabel (struct ArgusParserStruct *, char *, int); 1785 extern void ArgusPrintDstRateLabel (struct ArgusParserStruct *, char *, int); 1786 extern void ArgusPrintRateLabel (struct ArgusParserStruct *, char *, int); 1787 1788 extern void ArgusPrintSrcTosLabel (struct ArgusParserStruct *, char *, int); 1789 extern void ArgusPrintDstTosLabel (struct ArgusParserStruct *, char *, int); 1790 1791 extern void ArgusPrintSrcDSByteLabel (struct ArgusParserStruct *, char *, int); 1792 extern void ArgusPrintDstDSByteLabel (struct ArgusParserStruct *, char *, int); 1793 extern void ArgusPrintSrcVlanLabel (struct ArgusParserStruct *, char *, int); 1794 extern void ArgusPrintDstVlanLabel (struct ArgusParserStruct *, char *, int); 1795 1796 extern void ArgusPrintSrcVIDLabel (struct ArgusParserStruct *, char *, int); 1797 extern void ArgusPrintDstVIDLabel (struct ArgusParserStruct *, char *, int); 1798 1799 extern void ArgusPrintSrcVPRILabel (struct ArgusParserStruct *, char *, int); 1800 extern void ArgusPrintDstVPRILabel (struct ArgusParserStruct *, char *, int); 1801 1802 extern void ArgusPrintSrcMplsLabel (struct ArgusParserStruct *, char *, int); 1803 extern void ArgusPrintDstMplsLabel (struct ArgusParserStruct *, char *, int); 1804 1805 extern void ArgusPrintWindowLabel (struct ArgusParserStruct *, char *, int); 1806 extern void ArgusPrintSrcWindowLabel (struct ArgusParserStruct *, char *, int); 1807 extern void ArgusPrintDstWindowLabel (struct ArgusParserStruct *, char *, int); 1808 extern void ArgusPrintJoinDelayLabel (struct ArgusParserStruct *, char *, int); 1809 extern void ArgusPrintLeaveDelayLabel (struct ArgusParserStruct *, char *, int); 1810 extern void ArgusPrintMeanLabel (struct ArgusParserStruct *, char *, int); 1811 extern void ArgusPrintStartRangeLabel (struct ArgusParserStruct *, char *, int); 1812 extern void ArgusPrintEndRangeLabel (struct ArgusParserStruct *, char *, int); 1813 extern void ArgusPrintSrcDurationLabel (struct ArgusParserStruct *, char *, int); 1814 extern void ArgusPrintSrcDurationLabel (struct ArgusParserStruct *, char *, int); 1815 extern void ArgusPrintDurationLabel (struct ArgusParserStruct *, char *, int); 1816 extern void ArgusPrintTransactionsLabel (struct ArgusParserStruct *, char *, int); 1817 extern void ArgusPrintSequenceNumberLabel (struct ArgusParserStruct *, char *, int); 1818 extern void ArgusPrintRankLabel (struct ArgusParserStruct *, char *, int); 1819 extern void ArgusPrintBinNumberLabel (struct ArgusParserStruct *, char *, int); 1820 extern void ArgusPrintBinsLabel (struct ArgusParserStruct *, char *, int); 1821 extern void ArgusPrintTCPSrcBaseLabel (struct ArgusParserStruct *, char *, int); 1822 extern void ArgusPrintTCPDstBaseLabel (struct ArgusParserStruct *, char *, int); 1823 extern void ArgusPrintTCPRTTLabel (struct ArgusParserStruct *, char *, int); 1824 extern void ArgusPrintTCPSrcMaxLabel (struct ArgusParserStruct *, char *, int); 1825 extern void ArgusPrintTCPDstMaxLabel (struct ArgusParserStruct *, char *, int); 1826 extern void ArgusPrintTCPSrcGapLabel (struct ArgusParserStruct *, char *, int); 1827 extern void ArgusPrintTCPDstGapLabel (struct ArgusParserStruct *, char *, int); 1828 extern void ArgusPrintInodeLabel (struct ArgusParserStruct *, char *, int); 1829 extern void ArgusPrintMinLabel (struct ArgusParserStruct *, char *, int); 1830 extern void ArgusPrintMaxLabel (struct ArgusParserStruct *, char *, int); 1831 extern void ArgusPrintStdDeviationLabel (struct ArgusParserStruct *, char *, int); 1832 extern void ArgusPrintRunTimeLabel (struct ArgusParserStruct *, char *, int); 1833 extern void ArgusPrintIdleTimeLabel (struct ArgusParserStruct *, char *, int); 1834 1835 extern void ArgusPrintAutoId (struct ArgusParserStruct *, char *, int); 1836 1837 extern char *RaGetUserDataString (struct ArgusRecordStruct *); 1838 1839 extern int ArgusEncode (struct ArgusParserStruct *, const char *, const char *, int, char *, int); 1840 extern int ArgusEncode32 (struct ArgusParserStruct *, const char *, int , char *, int ); 1841 extern int ArgusEncode64 (const char *, int, char *, int); 1842 extern int ArgusEncodeAscii (const char *, int, char *, int); 1843 1844 extern int argus_nametoeproto(char *); 1845 extern unsigned int __argus_atoin(char *, unsigned int *); 1846 1847 1848 extern void ArgusNtoH (struct ArgusRecord *); 1849 extern void ArgusHtoN (struct ArgusRecord *); 1850 1851 extern void ArgusV2NtoH (struct ArgusV2Record *); 1852 extern void ArgusV2HtoN (struct ArgusV2Record *); 1853 1854 #endif 1855 #ifdef __cplusplus 1856 } 1857 #endif 1858 #endif /* ArgusUtil_h */ 1859