1*86d7f5d3SJohn Marino /*- 2*86d7f5d3SJohn Marino * Copyright (c) 2004 Gleb Smirnoff <glebius@FreeBSD.org> 3*86d7f5d3SJohn Marino * All rights reserved. 4*86d7f5d3SJohn Marino * 5*86d7f5d3SJohn Marino * Redistribution and use in source and binary forms, with or without 6*86d7f5d3SJohn Marino * modification, are permitted provided that the following conditions 7*86d7f5d3SJohn Marino * are met: 8*86d7f5d3SJohn Marino * 1. Redistributions of source code must retain the above copyright 9*86d7f5d3SJohn Marino * notice, this list of conditions and the following disclaimer. 10*86d7f5d3SJohn Marino * 2. Redistributions in binary form must reproduce the above copyright 11*86d7f5d3SJohn Marino * notice, this list of conditions and the following disclaimer in the 12*86d7f5d3SJohn Marino * documentation and/or other materials provided with the distribution. 13*86d7f5d3SJohn Marino * 14*86d7f5d3SJohn Marino * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15*86d7f5d3SJohn Marino * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16*86d7f5d3SJohn Marino * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17*86d7f5d3SJohn Marino * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18*86d7f5d3SJohn Marino * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19*86d7f5d3SJohn Marino * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20*86d7f5d3SJohn Marino * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21*86d7f5d3SJohn Marino * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22*86d7f5d3SJohn Marino * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23*86d7f5d3SJohn Marino * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24*86d7f5d3SJohn Marino * SUCH DAMAGE. 25*86d7f5d3SJohn Marino * 26*86d7f5d3SJohn Marino * $SourceForge: netflow.h,v 1.8 2004/09/16 17:05:11 glebius Exp $ 27*86d7f5d3SJohn Marino * $FreeBSD: src/sys/netgraph/netflow/netflow.h,v 1.4 2006/04/25 20:01:50 maxim Exp $ 28*86d7f5d3SJohn Marino */ 29*86d7f5d3SJohn Marino 30*86d7f5d3SJohn Marino /* netflow timeouts in seconds */ 31*86d7f5d3SJohn Marino 32*86d7f5d3SJohn Marino #define ACTIVE_TIMEOUT (30*60) /* maximum flow lifetime is 30 min */ 33*86d7f5d3SJohn Marino #define INACTIVE_TIMEOUT 15 34*86d7f5d3SJohn Marino 35*86d7f5d3SJohn Marino /* 36*86d7f5d3SJohn Marino * More info can be found in these Cisco documents: 37*86d7f5d3SJohn Marino * 38*86d7f5d3SJohn Marino * Cisco IOS NetFlow, White Papers. 39*86d7f5d3SJohn Marino * http://www.cisco.com/en/US/products/ps6601/prod_white_papers_list.html 40*86d7f5d3SJohn Marino * 41*86d7f5d3SJohn Marino * Cisco CNS NetFlow Collection Engine User Guide, 5.0.2, NetFlow Export 42*86d7f5d3SJohn Marino * Datagram Formats. 43*86d7f5d3SJohn Marino * http://www.cisco.com/en/US/products/sw/netmgtsw/ps1964/products_user_guide_chapter09186a00803f3147.html#wp26453 44*86d7f5d3SJohn Marino * 45*86d7f5d3SJohn Marino */ 46*86d7f5d3SJohn Marino 47*86d7f5d3SJohn Marino #define NETFLOW_V1 1 48*86d7f5d3SJohn Marino #define NETFLOW_V5 5 49*86d7f5d3SJohn Marino 50*86d7f5d3SJohn Marino struct netflow_v1_header 51*86d7f5d3SJohn Marino { 52*86d7f5d3SJohn Marino uint16_t version; /* NetFlow version */ 53*86d7f5d3SJohn Marino uint16_t count; /* Number of records in flow */ 54*86d7f5d3SJohn Marino uint32_t sys_uptime; /* System uptime */ 55*86d7f5d3SJohn Marino uint32_t unix_secs; /* Current seconds since 0000 UTC 1970 */ 56*86d7f5d3SJohn Marino uint32_t unix_nsecs; /* Remaining nanoseconds since 0000 UTC 1970 */ 57*86d7f5d3SJohn Marino } __attribute__((__packed__)); 58*86d7f5d3SJohn Marino 59*86d7f5d3SJohn Marino struct netflow_v5_header 60*86d7f5d3SJohn Marino { 61*86d7f5d3SJohn Marino uint16_t version; /* NetFlow version */ 62*86d7f5d3SJohn Marino uint16_t count; /* Number of records in flow */ 63*86d7f5d3SJohn Marino uint32_t sys_uptime; /* System uptime */ 64*86d7f5d3SJohn Marino uint32_t unix_secs; /* Current seconds since 0000 UTC 1970 */ 65*86d7f5d3SJohn Marino uint32_t unix_nsecs; /* Remaining nanoseconds since 0000 UTC 1970 */ 66*86d7f5d3SJohn Marino uint32_t flow_seq; /* Sequence number of the first record */ 67*86d7f5d3SJohn Marino uint8_t engine_type; /* Type of flow switching engine (RP,VIP,etc.) */ 68*86d7f5d3SJohn Marino uint8_t engine_id; /* Slot number of the flow switching engine */ 69*86d7f5d3SJohn Marino uint16_t pad; /* Pad to word boundary */ 70*86d7f5d3SJohn Marino } __attribute__((__packed__)); 71*86d7f5d3SJohn Marino 72*86d7f5d3SJohn Marino struct netflow_v1_record 73*86d7f5d3SJohn Marino { 74*86d7f5d3SJohn Marino uint32_t src_addr; /* Source IP address */ 75*86d7f5d3SJohn Marino uint32_t dst_addr; /* Destination IP address */ 76*86d7f5d3SJohn Marino uint32_t next_hop; /* Next hop IP address */ 77*86d7f5d3SJohn Marino uint16_t in_ifx; /* Source interface index */ 78*86d7f5d3SJohn Marino uint16_t out_ifx; /* Destination interface index */ 79*86d7f5d3SJohn Marino uint32_t packets; /* Number of packets in a flow */ 80*86d7f5d3SJohn Marino uint32_t octets; /* Number of octets in a flow */ 81*86d7f5d3SJohn Marino uint32_t first; /* System uptime at start of a flow */ 82*86d7f5d3SJohn Marino uint32_t last; /* System uptime at end of a flow */ 83*86d7f5d3SJohn Marino uint16_t s_port; /* Source port */ 84*86d7f5d3SJohn Marino uint16_t d_port; /* Destination port */ 85*86d7f5d3SJohn Marino uint16_t pad1; /* Pad to word boundary */ 86*86d7f5d3SJohn Marino uint8_t prot; /* IP protocol */ 87*86d7f5d3SJohn Marino uint8_t tos; /* IP type of service */ 88*86d7f5d3SJohn Marino uint8_t flags; /* Cumulative OR of tcp flags */ 89*86d7f5d3SJohn Marino uint8_t pad2; /* Pad to word boundary */ 90*86d7f5d3SJohn Marino uint16_t pad3; /* Pad to word boundary */ 91*86d7f5d3SJohn Marino uint8_t reserved[5]; /* Reserved for future use */ 92*86d7f5d3SJohn Marino } __attribute__((__packed__)); 93*86d7f5d3SJohn Marino 94*86d7f5d3SJohn Marino struct netflow_v5_record 95*86d7f5d3SJohn Marino { 96*86d7f5d3SJohn Marino uint32_t src_addr; /* Source IP address */ 97*86d7f5d3SJohn Marino uint32_t dst_addr; /* Destination IP address */ 98*86d7f5d3SJohn Marino uint32_t next_hop; /* Next hop IP address */ 99*86d7f5d3SJohn Marino uint16_t i_ifx; /* Source interface index */ 100*86d7f5d3SJohn Marino uint16_t o_ifx; /* Destination interface index */ 101*86d7f5d3SJohn Marino uint32_t packets; /* Number of packets in a flow */ 102*86d7f5d3SJohn Marino uint32_t octets; /* Number of octets in a flow */ 103*86d7f5d3SJohn Marino uint32_t first; /* System uptime at start of a flow */ 104*86d7f5d3SJohn Marino uint32_t last; /* System uptime at end of a flow */ 105*86d7f5d3SJohn Marino uint16_t s_port; /* Source port */ 106*86d7f5d3SJohn Marino uint16_t d_port; /* Destination port */ 107*86d7f5d3SJohn Marino uint8_t pad1; /* Pad to word boundary */ 108*86d7f5d3SJohn Marino uint8_t flags; /* Cumulative OR of tcp flags */ 109*86d7f5d3SJohn Marino uint8_t prot; /* IP protocol */ 110*86d7f5d3SJohn Marino uint8_t tos; /* IP type of service */ 111*86d7f5d3SJohn Marino uint16_t src_as; /* Src peer/origin Autonomous System */ 112*86d7f5d3SJohn Marino uint16_t dst_as; /* Dst peer/origin Autonomous System */ 113*86d7f5d3SJohn Marino uint8_t src_mask; /* Source route's mask bits */ 114*86d7f5d3SJohn Marino uint8_t dst_mask; /* Destination route's mask bits */ 115*86d7f5d3SJohn Marino uint16_t pad2; /* Pad to word boundary */ 116*86d7f5d3SJohn Marino } __attribute__((__packed__)); 117*86d7f5d3SJohn Marino 118*86d7f5d3SJohn Marino #define NETFLOW_V1_MAX_RECORDS 24 119*86d7f5d3SJohn Marino #define NETFLOW_V5_MAX_RECORDS 30 120*86d7f5d3SJohn Marino 121*86d7f5d3SJohn Marino #define NETFLOW_V1_MAX_SIZE (sizeof(netflow_v1_header)+ \ 122*86d7f5d3SJohn Marino sizeof(netflow_v1_record)*NETFLOW_V1_MAX_RECORDS) 123*86d7f5d3SJohn Marino #define NETFLOW_V5_MAX_SIZE (sizeof(netflow_v5_header)+ \ 124*86d7f5d3SJohn Marino sizeof(netflow_v5_record)*NETFLOW_V5_MAX_RECORDS) 125*86d7f5d3SJohn Marino 126*86d7f5d3SJohn Marino struct netflow_v5_export_dgram { 127*86d7f5d3SJohn Marino struct netflow_v5_header header; 128*86d7f5d3SJohn Marino struct netflow_v5_record r[NETFLOW_V5_MAX_RECORDS]; 129*86d7f5d3SJohn Marino } __attribute__((__packed__)); 130