1 /* Copyright (c) 2002-2011 InMon Corp. Licensed under the terms of the InMon sFlow licence: */ 2 /* http://www.inmon.com/technology/sflowlicense.txt */ 3 4 #ifndef SFLOW_V2V4_H 5 #define SFLOW_V2V4_H 1 6 7 #if defined(__cplusplus) 8 extern "C" { 9 #endif 10 11 enum INMAddress_type { 12 INMADDRESSTYPE_IP_V4 = 1, 13 INMADDRESSTYPE_IP_V6 = 2 14 }; 15 16 typedef union _INMAddress_value { 17 SFLIPv4 ip_v4; 18 SFLIPv6 ip_v6; 19 } INMAddress_value; 20 21 typedef struct _INMAddress { 22 uint32_t type; /* enum INMAddress_type */ 23 INMAddress_value address; 24 } INMAddress; 25 26 /* Packet header data */ 27 28 #define INM_MAX_HEADER_SIZE 256 /* The maximum sampled header size. */ 29 #define INM_DEFAULT_HEADER_SIZE 128 30 #define INM_DEFAULT_COLLECTOR_PORT 6343 31 #define INM_DEFAULT_SAMPLING_RATE 400 32 33 /* The header protocol describes the format of the sampled header */ 34 enum INMHeader_protocol { 35 INMHEADER_ETHERNET_ISO8023 = 1, 36 INMHEADER_ISO88024_TOKENBUS = 2, 37 INMHEADER_ISO88025_TOKENRING = 3, 38 INMHEADER_FDDI = 4, 39 INMHEADER_FRAME_RELAY = 5, 40 INMHEADER_X25 = 6, 41 INMHEADER_PPP = 7, 42 INMHEADER_SMDS = 8, 43 INMHEADER_AAL5 = 9, 44 INMHEADER_AAL5_IP = 10, /* e.g. Cisco AAL5 mux */ 45 INMHEADER_IPv4 = 11, 46 INMHEADER_IPv6 = 12 47 }; 48 49 typedef struct _INMSampled_header { 50 uint32_t header_protocol; /* (enum INMHeader_protocol) */ 51 uint32_t frame_length; /* Original length of packet before sampling */ 52 uint32_t header_length; /* length of sampled header bytes to follow */ 53 uint8_t header[INM_MAX_HEADER_SIZE]; /* Header bytes */ 54 } INMSampled_header; 55 56 /* Packet IP version 4 data */ 57 58 typedef struct _INMSampled_ipv4 { 59 uint32_t length; /* The length of the IP packet 60 excluding lower layer encapsulations */ 61 uint32_t protocol; /* IP Protocol type (for example, TCP = 6, UDP = 17) */ 62 SFLIPv4 src_ip; /* Source IP Address */ 63 SFLIPv4 dst_ip; /* Destination IP Address */ 64 uint32_t src_port; /* TCP/UDP source port number or equivalent */ 65 uint32_t dst_port; /* TCP/UDP destination port number or equivalent */ 66 uint32_t tcp_flags; /* TCP flags */ 67 uint32_t tos; /* IP type of service */ 68 } INMSampled_ipv4; 69 70 /* Packet IP version 6 data */ 71 72 typedef struct _INMSampled_ipv6 { 73 uint32_t length; /* The length of the IP packet 74 excluding lower layer encapsulations */ 75 uint32_t protocol; /* IP Protocol type (for example, TCP = 6, UDP = 17) */ 76 SFLIPv6 src_ip; /* Source IP Address */ 77 SFLIPv6 dst_ip; /* Destination IP Address */ 78 uint32_t src_port; /* TCP/UDP source port number or equivalent */ 79 uint32_t dst_port; /* TCP/UDP destination port number or equivalent */ 80 uint32_t tcp_flags; /* TCP flags */ 81 uint32_t tos; /* IP type of service */ 82 } INMSampled_ipv6; 83 84 85 /* Packet data */ 86 87 enum INMPacket_information_type { 88 INMPACKETTYPE_HEADER = 1, /* Packet headers are sampled */ 89 INMPACKETTYPE_IPV4 = 2, /* IP version 4 data */ 90 INMPACKETTYPE_IPV6 = 3 /* IP version 4 data */ 91 }; 92 93 typedef union _INMPacket_data_type { 94 INMSampled_header header; 95 INMSampled_ipv4 ipv4; 96 INMSampled_ipv6 ipv6; 97 } INMPacket_data_type; 98 99 /* Extended data types */ 100 101 /* Extended switch data */ 102 103 typedef struct _INMExtended_switch { 104 uint32_t src_vlan; /* The 802.1Q VLAN id of incomming frame */ 105 uint32_t src_priority; /* The 802.1p priority */ 106 uint32_t dst_vlan; /* The 802.1Q VLAN id of outgoing frame */ 107 uint32_t dst_priority; /* The 802.1p priority */ 108 } INMExtended_switch; 109 110 /* Extended router data */ 111 112 typedef struct _INMExtended_router { 113 INMAddress nexthop; /* IP address of next hop router */ 114 uint32_t src_mask; /* Source address prefix mask bits */ 115 uint32_t dst_mask; /* Destination address prefix mask bits */ 116 } INMExtended_router; 117 118 /* Extended gateway data */ 119 120 enum INMExtended_as_path_segment_type { 121 INMEXTENDED_AS_SET = 1, /* Unordered set of ASs */ 122 INMEXTENDED_AS_SEQUENCE = 2 /* Ordered sequence of ASs */ 123 }; 124 125 typedef struct _INMExtended_as_path_segment { 126 uint32_t type; /* enum INMExtended_as_path_segment_type */ 127 uint32_t length; /* number of AS numbers in set/sequence */ 128 union { 129 uint32_t *set; 130 uint32_t *seq; 131 } as; 132 } INMExtended_as_path_segment; 133 134 /* note: the INMExtended_gateway structure has changed between v2 and v4. 135 Here is the old version first... */ 136 137 typedef struct _INMExtended_gateway_v2 { 138 uint32_t as; /* AS number for this gateway */ 139 uint32_t src_as; /* AS number of source (origin) */ 140 uint32_t src_peer_as; /* AS number of source peer */ 141 uint32_t dst_as_path_length; /* number of AS numbers in path */ 142 uint32_t *dst_as_path; 143 } INMExtended_gateway_v2; 144 145 /* now here is the new version... */ 146 147 typedef struct _INMExtended_gateway_v4 { 148 uint32_t as; /* AS number for this gateway */ 149 uint32_t src_as; /* AS number of source (origin) */ 150 uint32_t src_peer_as; /* AS number of source peer */ 151 uint32_t dst_as_path_segments; /* number of segments in path */ 152 INMExtended_as_path_segment *dst_as_path; /* list of seqs or sets */ 153 uint32_t communities_length; /* number of communities */ 154 uint32_t *communities; /* set of communities */ 155 uint32_t localpref; /* LocalPref associated with this route */ 156 } INMExtended_gateway_v4; 157 158 /* Extended user data */ 159 typedef struct _INMExtended_user { 160 uint32_t src_user_len; 161 char *src_user; 162 uint32_t dst_user_len; 163 char *dst_user; 164 } INMExtended_user; 165 enum INMExtended_url_direction { 166 INMEXTENDED_URL_SRC = 1, /* URL is associated with source address */ 167 INMEXTENDED_URL_DST = 2 /* URL is associated with destination address */ 168 }; 169 170 typedef struct _INMExtended_url { 171 uint32_t direction; /* enum INMExtended_url_direction */ 172 uint32_t url_len; 173 char *url; 174 } INMExtended_url; 175 176 /* Extended data */ 177 178 enum INMExtended_information_type { 179 INMEXTENDED_SWITCH = 1, /* Extended switch information */ 180 INMEXTENDED_ROUTER = 2, /* Extended router information */ 181 INMEXTENDED_GATEWAY = 3, /* Extended gateway router information */ 182 INMEXTENDED_USER = 4, /* Extended TACAS/RADIUS user information */ 183 INMEXTENDED_URL = 5 /* Extended URL information */ 184 }; 185 186 /* Format of a single sample */ 187 188 typedef struct _INMFlow_sample { 189 uint32_t sequence_number; /* Incremented with each flow sample 190 generated */ 191 uint32_t source_id; /* fsSourceId */ 192 uint32_t sampling_rate; /* fsPacketSamplingRate */ 193 uint32_t sample_pool; /* Total number of packets that could have been 194 sampled (i.e. packets skipped by sampling 195 process + total number of samples) */ 196 uint32_t drops; /* Number of times a packet was dropped due to 197 lack of resources */ 198 uint32_t input; /* SNMP ifIndex of input interface. 199 0 if interface is not known. */ 200 uint32_t output; /* SNMP ifIndex of output interface, 201 0 if interface is not known. 202 Set most significant bit to indicate 203 multiple destination interfaces 204 (i.e. in case of broadcast or multicast) 205 and set lower order bits to indicate 206 number of destination interfaces. 207 Examples: 208 0x00000002 indicates ifIndex = 2 209 0x00000000 ifIndex unknown. 210 0x80000007 indicates a packet sent 211 to 7 interfaces. 212 0x80000000 indicates a packet sent to 213 an unknown number of 214 interfaces greater than 1.*/ 215 uint32_t packet_data_tag; /* enum INMPacket_information_type */ 216 INMPacket_data_type packet_data; /* Information about sampled packet */ 217 218 /* in the sFlow packet spec the next field is the number of extended objects 219 followed by the data for each one (tagged with the type). Here we just 220 provide space for each one, and flags to enable them. The correct format 221 is then put together by the serialization code */ 222 int gotSwitch; 223 INMExtended_switch switchDevice; 224 int gotRouter; 225 INMExtended_router router; 226 int gotGateway; 227 union { 228 INMExtended_gateway_v2 v2; /* make the version explicit so that there is */ 229 INMExtended_gateway_v4 v4; /* less danger of mistakes when upgrading code */ 230 } gateway; 231 int gotUser; 232 INMExtended_user user; 233 int gotUrl; 234 INMExtended_url url; 235 } INMFlow_sample; 236 237 /* Counter types */ 238 239 /* Generic interface counters - see RFC 1573, 2233 */ 240 241 typedef struct _INMIf_counters { 242 uint32_t ifIndex; 243 uint32_t ifType; 244 uint64_t ifSpeed; 245 uint32_t ifDirection; /* Derived from MAU MIB (RFC 2239) 246 0 = unknown, 1 = full-duplex, 247 2 = half-duplex, 3 = in, 4 = out */ 248 uint32_t ifStatus; /* bit field with the following bits assigned: 249 bit 0 = ifAdminStatus (0 = down, 1 = up) 250 bit 1 = ifOperStatus (0 = down, 1 = up) */ 251 uint64_t ifInOctets; 252 uint32_t ifInUcastPkts; 253 uint32_t ifInMulticastPkts; 254 uint32_t ifInBroadcastPkts; 255 uint32_t ifInDiscards; 256 uint32_t ifInErrors; 257 uint32_t ifInUnknownProtos; 258 uint64_t ifOutOctets; 259 uint32_t ifOutUcastPkts; 260 uint32_t ifOutMulticastPkts; 261 uint32_t ifOutBroadcastPkts; 262 uint32_t ifOutDiscards; 263 uint32_t ifOutErrors; 264 uint32_t ifPromiscuousMode; 265 } INMIf_counters; 266 267 /* Ethernet interface counters - see RFC 2358 */ 268 typedef struct _INMEthernet_specific_counters { 269 uint32_t dot3StatsAlignmentErrors; 270 uint32_t dot3StatsFCSErrors; 271 uint32_t dot3StatsSingleCollisionFrames; 272 uint32_t dot3StatsMultipleCollisionFrames; 273 uint32_t dot3StatsSQETestErrors; 274 uint32_t dot3StatsDeferredTransmissions; 275 uint32_t dot3StatsLateCollisions; 276 uint32_t dot3StatsExcessiveCollisions; 277 uint32_t dot3StatsInternalMacTransmitErrors; 278 uint32_t dot3StatsCarrierSenseErrors; 279 uint32_t dot3StatsFrameTooLongs; 280 uint32_t dot3StatsInternalMacReceiveErrors; 281 uint32_t dot3StatsSymbolErrors; 282 } INMEthernet_specific_counters; 283 284 typedef struct _INMEthernet_counters { 285 INMIf_counters generic; 286 INMEthernet_specific_counters ethernet; 287 } INMEthernet_counters; 288 289 /* FDDI interface counters - see RFC 1512 */ 290 typedef struct _INMFddi_counters { 291 INMIf_counters generic; 292 } INMFddi_counters; 293 294 /* Token ring counters - see RFC 1748 */ 295 296 typedef struct _INMTokenring_specific_counters { 297 uint32_t dot5StatsLineErrors; 298 uint32_t dot5StatsBurstErrors; 299 uint32_t dot5StatsACErrors; 300 uint32_t dot5StatsAbortTransErrors; 301 uint32_t dot5StatsInternalErrors; 302 uint32_t dot5StatsLostFrameErrors; 303 uint32_t dot5StatsReceiveCongestions; 304 uint32_t dot5StatsFrameCopiedErrors; 305 uint32_t dot5StatsTokenErrors; 306 uint32_t dot5StatsSoftErrors; 307 uint32_t dot5StatsHardErrors; 308 uint32_t dot5StatsSignalLoss; 309 uint32_t dot5StatsTransmitBeacons; 310 uint32_t dot5StatsRecoverys; 311 uint32_t dot5StatsLobeWires; 312 uint32_t dot5StatsRemoves; 313 uint32_t dot5StatsSingles; 314 uint32_t dot5StatsFreqErrors; 315 } INMTokenring_specific_counters; 316 317 typedef struct _INMTokenring_counters { 318 INMIf_counters generic; 319 INMTokenring_specific_counters tokenring; 320 } INMTokenring_counters; 321 322 /* 100 BaseVG interface counters - see RFC 2020 */ 323 324 typedef struct _INMVg_specific_counters { 325 uint32_t dot12InHighPriorityFrames; 326 uint64_t dot12InHighPriorityOctets; 327 uint32_t dot12InNormPriorityFrames; 328 uint64_t dot12InNormPriorityOctets; 329 uint32_t dot12InIPMErrors; 330 uint32_t dot12InOversizeFrameErrors; 331 uint32_t dot12InDataErrors; 332 uint32_t dot12InNullAddressedFrames; 333 uint32_t dot12OutHighPriorityFrames; 334 uint64_t dot12OutHighPriorityOctets; 335 uint32_t dot12TransitionIntoTrainings; 336 uint64_t dot12HCInHighPriorityOctets; 337 uint64_t dot12HCInNormPriorityOctets; 338 uint64_t dot12HCOutHighPriorityOctets; 339 } INMVg_specific_counters; 340 341 typedef struct _INMVg_counters { 342 INMIf_counters generic; 343 INMVg_specific_counters vg; 344 } INMVg_counters; 345 346 /* WAN counters */ 347 348 typedef struct _INMWan_counters { 349 INMIf_counters generic; 350 } INMWan_counters; 351 352 typedef struct _INMVlan_counters { 353 uint32_t vlan_id; 354 uint64_t octets; 355 uint32_t ucastPkts; 356 uint32_t multicastPkts; 357 uint32_t broadcastPkts; 358 uint32_t discards; 359 } INMVlan_counters; 360 361 /* Counters data */ 362 363 enum INMCounters_version { 364 INMCOUNTERSVERSION_GENERIC = 1, 365 INMCOUNTERSVERSION_ETHERNET = 2, 366 INMCOUNTERSVERSION_TOKENRING = 3, 367 INMCOUNTERSVERSION_FDDI = 4, 368 INMCOUNTERSVERSION_VG = 5, 369 INMCOUNTERSVERSION_WAN = 6, 370 INMCOUNTERSVERSION_VLAN = 7 371 }; 372 373 typedef union _INMCounters_type { 374 INMIf_counters generic; 375 INMEthernet_counters ethernet; 376 INMTokenring_counters tokenring; 377 INMFddi_counters fddi; 378 INMVg_counters vg; 379 INMWan_counters wan; 380 INMVlan_counters vlan; 381 } INMCounters_type; 382 383 typedef struct _INMCounters_sample_hdr { 384 uint32_t sequence_number; /* Incremented with each counters sample 385 generated by this source_id */ 386 uint32_t source_id; /* fsSourceId */ 387 uint32_t sampling_interval; /* fsCounterSamplingInterval */ 388 } INMCounters_sample_hdr; 389 390 typedef struct _INMCounters_sample { 391 INMCounters_sample_hdr hdr; 392 uint32_t counters_type_tag; /* Enum INMCounters_version */ 393 INMCounters_type counters; /* Counter set for this interface type */ 394 } INMCounters_sample; 395 396 /* when I turn on optimisation with the Microsoft compiler it seems to change 397 the values of these enumerated types and break the program - not sure why */ 398 enum INMSample_types { 399 FLOWSAMPLE = 1, 400 COUNTERSSAMPLE = 2 401 }; 402 403 typedef union _INMSample_type { 404 INMFlow_sample flowsample; 405 INMCounters_sample counterssample; 406 } INMSample_type; 407 408 /* Format of a sample datagram */ 409 410 enum INMDatagram_version { 411 INMDATAGRAM_VERSION2 = 2, 412 INMDATAGRAM_VERSION4 = 4 413 }; 414 415 typedef struct _INMSample_datagram_hdr { 416 uint32_t datagram_version; /* (enum INMDatagram_version) = VERSION4 */ 417 INMAddress agent_address; /* IP address of sampling agent */ 418 uint32_t sequence_number; /* Incremented with each sample datagram 419 generated */ 420 uint32_t uptime; /* Current time (in milliseconds since device 421 last booted). Should be set as close to 422 datagram transmission time as possible.*/ 423 uint32_t num_samples; /* Number of flow and counters samples to follow */ 424 } INMSample_datagram_hdr; 425 426 #define INM_MAX_DATAGRAM_SIZE 1500 427 #define INM_MIN_DATAGRAM_SIZE 200 428 #define INM_DEFAULT_DATAGRAM_SIZE 1400 429 430 #define INM_DATA_PAD 400 431 432 #if defined(__cplusplus) 433 } /* extern "C" */ 434 #endif 435 436 #endif /* SFLOW_V2V4_H */ 437