1685295f4SBill Fenner /* $OpenBSD: print-cnfp.c,v 1.2 1998/06/25 20:26:59 mickey Exp $ */
2685295f4SBill Fenner
3685295f4SBill Fenner /*
4685295f4SBill Fenner * Copyright (c) 1998 Michael Shalayeff
5685295f4SBill Fenner * All rights reserved.
6685295f4SBill Fenner *
7685295f4SBill Fenner * Redistribution and use in source and binary forms, with or without
8685295f4SBill Fenner * modification, are permitted provided that the following conditions
9685295f4SBill Fenner * are met:
10685295f4SBill Fenner * 1. Redistributions of source code must retain the above copyright
11685295f4SBill Fenner * notice, this list of conditions and the following disclaimer.
12685295f4SBill Fenner * 2. Redistributions in binary form must reproduce the above copyright
13685295f4SBill Fenner * notice, this list of conditions and the following disclaimer in the
14685295f4SBill Fenner * documentation and/or other materials provided with the distribution.
15685295f4SBill Fenner * 3. All advertising materials mentioning features or use of this software
16685295f4SBill Fenner * must display the following acknowledgement:
17685295f4SBill Fenner * This product includes software developed by Michael Shalayeff.
18685295f4SBill Fenner * 4. The name of the author may not be used to endorse or promote products
19685295f4SBill Fenner * derived from this software without specific prior written permission.
20685295f4SBill Fenner *
21685295f4SBill Fenner * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22685295f4SBill Fenner * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23685295f4SBill Fenner * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24685295f4SBill Fenner * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25685295f4SBill Fenner * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26685295f4SBill Fenner * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27685295f4SBill Fenner * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28685295f4SBill Fenner * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29685295f4SBill Fenner * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30685295f4SBill Fenner * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31685295f4SBill Fenner */
32685295f4SBill Fenner
333340d773SGleb Smirnoff /* \summary: Cisco NetFlow protocol printer */
343340d773SGleb Smirnoff
358bdc5a62SPatrick Kelsey /*
368bdc5a62SPatrick Kelsey * Cisco NetFlow protocol
378bdc5a62SPatrick Kelsey *
388bdc5a62SPatrick Kelsey * See
398bdc5a62SPatrick Kelsey *
40ee67461eSJoseph Mingrone * https://www.cisco.com/c/en/us/td/docs/net_mgmt/netflow_collection_engine/3-6/user/guide/format.html#wp1005892
418bdc5a62SPatrick Kelsey */
42685295f4SBill Fenner
43685295f4SBill Fenner #ifdef HAVE_CONFIG_H
44ee67461eSJoseph Mingrone #include <config.h>
45685295f4SBill Fenner #endif
46685295f4SBill Fenner
47ee67461eSJoseph Mingrone #include "netdissect-stdinc.h"
48685295f4SBill Fenner
49685295f4SBill Fenner #include <stdio.h>
50685295f4SBill Fenner
513340d773SGleb Smirnoff #include "netdissect.h"
525b0fe478SBruce M Simpson #include "addrtoname.h"
535b0fe478SBruce M Simpson #include "extract.h"
54685295f4SBill Fenner
55685295f4SBill Fenner #include "tcp.h"
565b0fe478SBruce M Simpson #include "ipproto.h"
57685295f4SBill Fenner
588bdc5a62SPatrick Kelsey struct nfhdr_v1 {
59ee67461eSJoseph Mingrone nd_uint16_t version; /* version number */
60ee67461eSJoseph Mingrone nd_uint16_t count; /* # of records */
61ee67461eSJoseph Mingrone nd_uint32_t msys_uptime;
62ee67461eSJoseph Mingrone nd_uint32_t utc_sec;
63ee67461eSJoseph Mingrone nd_uint32_t utc_nsec;
648bdc5a62SPatrick Kelsey };
658bdc5a62SPatrick Kelsey
668bdc5a62SPatrick Kelsey struct nfrec_v1 {
67ee67461eSJoseph Mingrone nd_ipv4 src_ina;
68ee67461eSJoseph Mingrone nd_ipv4 dst_ina;
69ee67461eSJoseph Mingrone nd_ipv4 nhop_ina;
70ee67461eSJoseph Mingrone nd_uint16_t input; /* SNMP index of input interface */
71ee67461eSJoseph Mingrone nd_uint16_t output; /* SNMP index of output interface */
72ee67461eSJoseph Mingrone nd_uint32_t packets; /* packets in the flow */
73ee67461eSJoseph Mingrone nd_uint32_t octets; /* layer 3 octets in the packets of the flow */
74ee67461eSJoseph Mingrone nd_uint32_t start_time; /* sys_uptime value at start of flow */
75ee67461eSJoseph Mingrone nd_uint32_t last_time; /* sys_uptime value when last packet of flow was received */
76ee67461eSJoseph Mingrone nd_uint16_t srcport; /* TCP/UDP source port or equivalent */
77ee67461eSJoseph Mingrone nd_uint16_t dstport; /* TCP/UDP source port or equivalent */
78ee67461eSJoseph Mingrone nd_byte pad1[2]; /* pad */
79ee67461eSJoseph Mingrone nd_uint8_t proto; /* IP protocol type */
80ee67461eSJoseph Mingrone nd_uint8_t tos; /* IP type of service */
81ee67461eSJoseph Mingrone nd_uint8_t tcp_flags; /* cumulative OR of TCP flags */
82ee67461eSJoseph Mingrone nd_byte pad[3]; /* padding */
83ee67461eSJoseph Mingrone nd_uint32_t reserved; /* unused */
848bdc5a62SPatrick Kelsey };
858bdc5a62SPatrick Kelsey
868bdc5a62SPatrick Kelsey struct nfhdr_v5 {
87ee67461eSJoseph Mingrone nd_uint16_t version; /* version number */
88ee67461eSJoseph Mingrone nd_uint16_t count; /* # of records */
89ee67461eSJoseph Mingrone nd_uint32_t msys_uptime;
90ee67461eSJoseph Mingrone nd_uint32_t utc_sec;
91ee67461eSJoseph Mingrone nd_uint32_t utc_nsec;
92ee67461eSJoseph Mingrone nd_uint32_t sequence; /* flow sequence number */
93ee67461eSJoseph Mingrone nd_uint8_t engine_type; /* type of flow-switching engine */
94ee67461eSJoseph Mingrone nd_uint8_t engine_id; /* slot number of the flow-switching engine */
95ee67461eSJoseph Mingrone nd_uint16_t sampling_interval; /* sampling mode and interval */
968bdc5a62SPatrick Kelsey };
978bdc5a62SPatrick Kelsey
988bdc5a62SPatrick Kelsey struct nfrec_v5 {
99ee67461eSJoseph Mingrone nd_ipv4 src_ina;
100ee67461eSJoseph Mingrone nd_ipv4 dst_ina;
101ee67461eSJoseph Mingrone nd_ipv4 nhop_ina;
102ee67461eSJoseph Mingrone nd_uint16_t input; /* SNMP index of input interface */
103ee67461eSJoseph Mingrone nd_uint16_t output; /* SNMP index of output interface */
104ee67461eSJoseph Mingrone nd_uint32_t packets; /* packets in the flow */
105ee67461eSJoseph Mingrone nd_uint32_t octets; /* layer 3 octets in the packets of the flow */
106ee67461eSJoseph Mingrone nd_uint32_t start_time; /* sys_uptime value at start of flow */
107ee67461eSJoseph Mingrone nd_uint32_t last_time; /* sys_uptime value when last packet of flow was received */
108ee67461eSJoseph Mingrone nd_uint16_t srcport; /* TCP/UDP source port or equivalent */
109ee67461eSJoseph Mingrone nd_uint16_t dstport; /* TCP/UDP source port or equivalent */
110ee67461eSJoseph Mingrone nd_byte pad1; /* pad */
111ee67461eSJoseph Mingrone nd_uint8_t tcp_flags; /* cumulative OR of TCP flags */
112ee67461eSJoseph Mingrone nd_uint8_t proto; /* IP protocol type */
113ee67461eSJoseph Mingrone nd_uint8_t tos; /* IP type of service */
114ee67461eSJoseph Mingrone nd_uint16_t src_as; /* AS number of the source */
115ee67461eSJoseph Mingrone nd_uint16_t dst_as; /* AS number of the destination */
116ee67461eSJoseph Mingrone nd_uint8_t src_mask; /* source address mask bits */
117ee67461eSJoseph Mingrone nd_uint8_t dst_mask; /* destination address prefix mask bits */
118ee67461eSJoseph Mingrone nd_byte pad2[2];
119ee67461eSJoseph Mingrone nd_ipv4 peer_nexthop; /* v6: IP address of the nexthop within the peer (FIB)*/
1208bdc5a62SPatrick Kelsey };
1218bdc5a62SPatrick Kelsey
1228bdc5a62SPatrick Kelsey struct nfhdr_v6 {
123ee67461eSJoseph Mingrone nd_uint16_t version; /* version number */
124ee67461eSJoseph Mingrone nd_uint16_t count; /* # of records */
125ee67461eSJoseph Mingrone nd_uint32_t msys_uptime;
126ee67461eSJoseph Mingrone nd_uint32_t utc_sec;
127ee67461eSJoseph Mingrone nd_uint32_t utc_nsec;
128ee67461eSJoseph Mingrone nd_uint32_t sequence; /* v5 flow sequence number */
129ee67461eSJoseph Mingrone nd_uint32_t reserved; /* v5 only */
130685295f4SBill Fenner };
131685295f4SBill Fenner
1328bdc5a62SPatrick Kelsey struct nfrec_v6 {
133ee67461eSJoseph Mingrone nd_ipv4 src_ina;
134ee67461eSJoseph Mingrone nd_ipv4 dst_ina;
135ee67461eSJoseph Mingrone nd_ipv4 nhop_ina;
136ee67461eSJoseph Mingrone nd_uint16_t input; /* SNMP index of input interface */
137ee67461eSJoseph Mingrone nd_uint16_t output; /* SNMP index of output interface */
138ee67461eSJoseph Mingrone nd_uint32_t packets; /* packets in the flow */
139ee67461eSJoseph Mingrone nd_uint32_t octets; /* layer 3 octets in the packets of the flow */
140ee67461eSJoseph Mingrone nd_uint32_t start_time; /* sys_uptime value at start of flow */
141ee67461eSJoseph Mingrone nd_uint32_t last_time; /* sys_uptime value when last packet of flow was received */
142ee67461eSJoseph Mingrone nd_uint16_t srcport; /* TCP/UDP source port or equivalent */
143ee67461eSJoseph Mingrone nd_uint16_t dstport; /* TCP/UDP source port or equivalent */
144ee67461eSJoseph Mingrone nd_byte pad1; /* pad */
145ee67461eSJoseph Mingrone nd_uint8_t tcp_flags; /* cumulative OR of TCP flags */
146ee67461eSJoseph Mingrone nd_uint8_t proto; /* IP protocol type */
147ee67461eSJoseph Mingrone nd_uint8_t tos; /* IP type of service */
148ee67461eSJoseph Mingrone nd_uint16_t src_as; /* AS number of the source */
149ee67461eSJoseph Mingrone nd_uint16_t dst_as; /* AS number of the destination */
150ee67461eSJoseph Mingrone nd_uint8_t src_mask; /* source address mask bits */
151ee67461eSJoseph Mingrone nd_uint8_t dst_mask; /* destination address prefix mask bits */
152ee67461eSJoseph Mingrone nd_uint16_t flags;
153ee67461eSJoseph Mingrone nd_ipv4 peer_nexthop; /* v6: IP address of the nexthop within the peer (FIB)*/
154685295f4SBill Fenner };
155685295f4SBill Fenner
1568bdc5a62SPatrick Kelsey static void
cnfp_v1_print(netdissect_options * ndo,const u_char * cp)1578bdc5a62SPatrick Kelsey cnfp_v1_print(netdissect_options *ndo, const u_char *cp)
158685295f4SBill Fenner {
159ee67461eSJoseph Mingrone const struct nfhdr_v1 *nh;
160ee67461eSJoseph Mingrone const struct nfrec_v1 *nr;
1610bff6a5aSEd Maste const char *p_name;
162ee67461eSJoseph Mingrone uint8_t proto;
163ee67461eSJoseph Mingrone u_int nrecs, ver;
164f4d0c64aSSam Leffler #if 0
165685295f4SBill Fenner time_t t;
166f4d0c64aSSam Leffler #endif
167685295f4SBill Fenner
1688bdc5a62SPatrick Kelsey nh = (const struct nfhdr_v1 *)cp;
169ee67461eSJoseph Mingrone ND_TCHECK_SIZE(nh);
170685295f4SBill Fenner
171ee67461eSJoseph Mingrone ver = GET_BE_U_2(nh->version);
172ee67461eSJoseph Mingrone nrecs = GET_BE_U_4(nh->count);
173f4d0c64aSSam Leffler #if 0
174f4d0c64aSSam Leffler /*
175f4d0c64aSSam Leffler * This is seconds since the UN*X epoch, and is followed by
176f4d0c64aSSam Leffler * nanoseconds. XXX - format it, rather than just dumping the
177f4d0c64aSSam Leffler * raw seconds-since-the-Epoch.
178f4d0c64aSSam Leffler */
179ee67461eSJoseph Mingrone t = GET_BE_U_4(nh->utc_sec);
180f4d0c64aSSam Leffler #endif
181685295f4SBill Fenner
182ee67461eSJoseph Mingrone ND_PRINT("NetFlow v%x, %u.%03u uptime, %u.%09u, ", ver,
183ee67461eSJoseph Mingrone GET_BE_U_4(nh->msys_uptime)/1000,
184ee67461eSJoseph Mingrone GET_BE_U_4(nh->msys_uptime)%1000,
185ee67461eSJoseph Mingrone GET_BE_U_4(nh->utc_sec), GET_BE_U_4(nh->utc_nsec));
186685295f4SBill Fenner
1878bdc5a62SPatrick Kelsey nr = (const struct nfrec_v1 *)&nh[1];
188685295f4SBill Fenner
189ee67461eSJoseph Mingrone ND_PRINT("%2u recs", nrecs);
190685295f4SBill Fenner
1918bdc5a62SPatrick Kelsey for (; nrecs != 0; nr++, nrecs--) {
192685295f4SBill Fenner char buf[20];
193685295f4SBill Fenner char asbuf[20];
194685295f4SBill Fenner
1958bdc5a62SPatrick Kelsey /*
1968bdc5a62SPatrick Kelsey * Make sure we have the entire record.
1978bdc5a62SPatrick Kelsey */
198ee67461eSJoseph Mingrone ND_TCHECK_SIZE(nr);
199ee67461eSJoseph Mingrone ND_PRINT("\n started %u.%03u, last %u.%03u",
200ee67461eSJoseph Mingrone GET_BE_U_4(nr->start_time)/1000,
201ee67461eSJoseph Mingrone GET_BE_U_4(nr->start_time)%1000,
202ee67461eSJoseph Mingrone GET_BE_U_4(nr->last_time)/1000,
203ee67461eSJoseph Mingrone GET_BE_U_4(nr->last_time)%1000);
204685295f4SBill Fenner
205685295f4SBill Fenner asbuf[0] = buf[0] = '\0';
206ee67461eSJoseph Mingrone ND_PRINT("\n %s%s%s:%u ",
207ee67461eSJoseph Mingrone intoa(GET_IPV4_TO_NETWORK_ORDER(nr->src_ina)),
208ee67461eSJoseph Mingrone buf, asbuf,
209ee67461eSJoseph Mingrone GET_BE_U_2(nr->srcport));
210685295f4SBill Fenner
211ee67461eSJoseph Mingrone ND_PRINT("> %s%s%s:%u ",
212ee67461eSJoseph Mingrone intoa(GET_IPV4_TO_NETWORK_ORDER(nr->dst_ina)),
213ee67461eSJoseph Mingrone buf, asbuf,
214ee67461eSJoseph Mingrone GET_BE_U_2(nr->dstport));
215685295f4SBill Fenner
216ee67461eSJoseph Mingrone ND_PRINT(">> %s\n ",
217ee67461eSJoseph Mingrone intoa(GET_IPV4_TO_NETWORK_ORDER(nr->nhop_ina)));
218685295f4SBill Fenner
219ee67461eSJoseph Mingrone proto = GET_U_1(nr->proto);
220ee67461eSJoseph Mingrone if (!ndo->ndo_nflag && (p_name = netdb_protoname(proto)) != NULL)
221ee67461eSJoseph Mingrone ND_PRINT("%s ", p_name);
222685295f4SBill Fenner else
223ee67461eSJoseph Mingrone ND_PRINT("%u ", proto);
224685295f4SBill Fenner
225685295f4SBill Fenner /* tcp flags for tcp only */
226ee67461eSJoseph Mingrone if (proto == IPPROTO_TCP) {
227ee67461eSJoseph Mingrone u_int flags;
228ee67461eSJoseph Mingrone flags = GET_U_1(nr->tcp_flags);
229ee67461eSJoseph Mingrone ND_PRINT("%s%s%s%s%s%s%s",
2303c602fabSXin LI flags & TH_FIN ? "F" : "",
2313c602fabSXin LI flags & TH_SYN ? "S" : "",
2323c602fabSXin LI flags & TH_RST ? "R" : "",
2333c602fabSXin LI flags & TH_PUSH ? "P" : "",
2343c602fabSXin LI flags & TH_ACK ? "A" : "",
2353c602fabSXin LI flags & TH_URG ? "U" : "",
236ee67461eSJoseph Mingrone flags ? " " : "");
237685295f4SBill Fenner }
238a90e161bSBill Fenner
239a90e161bSBill Fenner buf[0]='\0';
240ee67461eSJoseph Mingrone ND_PRINT("tos %u, %u (%u octets) %s",
241ee67461eSJoseph Mingrone GET_U_1(nr->tos),
242ee67461eSJoseph Mingrone GET_BE_U_4(nr->packets),
243ee67461eSJoseph Mingrone GET_BE_U_4(nr->octets), buf);
244685295f4SBill Fenner }
2458bdc5a62SPatrick Kelsey return;
2468bdc5a62SPatrick Kelsey
2478bdc5a62SPatrick Kelsey trunc:
248ee67461eSJoseph Mingrone nd_print_trunc(ndo);
2498bdc5a62SPatrick Kelsey }
2508bdc5a62SPatrick Kelsey
2518bdc5a62SPatrick Kelsey static void
cnfp_v5_print(netdissect_options * ndo,const u_char * cp)2528bdc5a62SPatrick Kelsey cnfp_v5_print(netdissect_options *ndo, const u_char *cp)
2538bdc5a62SPatrick Kelsey {
254ee67461eSJoseph Mingrone const struct nfhdr_v5 *nh;
255ee67461eSJoseph Mingrone const struct nfrec_v5 *nr;
2560bff6a5aSEd Maste const char *p_name;
257ee67461eSJoseph Mingrone uint8_t proto;
258ee67461eSJoseph Mingrone u_int nrecs, ver;
2598bdc5a62SPatrick Kelsey #if 0
2608bdc5a62SPatrick Kelsey time_t t;
2618bdc5a62SPatrick Kelsey #endif
2628bdc5a62SPatrick Kelsey
2638bdc5a62SPatrick Kelsey nh = (const struct nfhdr_v5 *)cp;
264ee67461eSJoseph Mingrone ND_TCHECK_SIZE(nh);
2658bdc5a62SPatrick Kelsey
266ee67461eSJoseph Mingrone ver = GET_BE_U_2(nh->version);
267ee67461eSJoseph Mingrone nrecs = GET_BE_U_4(nh->count);
2688bdc5a62SPatrick Kelsey #if 0
2698bdc5a62SPatrick Kelsey /*
2708bdc5a62SPatrick Kelsey * This is seconds since the UN*X epoch, and is followed by
2718bdc5a62SPatrick Kelsey * nanoseconds. XXX - format it, rather than just dumping the
2728bdc5a62SPatrick Kelsey * raw seconds-since-the-Epoch.
2738bdc5a62SPatrick Kelsey */
274ee67461eSJoseph Mingrone t = GET_BE_U_4(nh->utc_sec);
2758bdc5a62SPatrick Kelsey #endif
2768bdc5a62SPatrick Kelsey
277ee67461eSJoseph Mingrone ND_PRINT("NetFlow v%x, %u.%03u uptime, %u.%09u, ", ver,
278ee67461eSJoseph Mingrone GET_BE_U_4(nh->msys_uptime)/1000,
279ee67461eSJoseph Mingrone GET_BE_U_4(nh->msys_uptime)%1000,
280ee67461eSJoseph Mingrone GET_BE_U_4(nh->utc_sec), GET_BE_U_4(nh->utc_nsec));
2818bdc5a62SPatrick Kelsey
282ee67461eSJoseph Mingrone ND_PRINT("#%u, ", GET_BE_U_4(nh->sequence));
2838bdc5a62SPatrick Kelsey nr = (const struct nfrec_v5 *)&nh[1];
2848bdc5a62SPatrick Kelsey
285ee67461eSJoseph Mingrone ND_PRINT("%2u recs", nrecs);
2868bdc5a62SPatrick Kelsey
2878bdc5a62SPatrick Kelsey for (; nrecs != 0; nr++, nrecs--) {
2888bdc5a62SPatrick Kelsey char buf[20];
2898bdc5a62SPatrick Kelsey char asbuf[20];
2908bdc5a62SPatrick Kelsey
2918bdc5a62SPatrick Kelsey /*
2928bdc5a62SPatrick Kelsey * Make sure we have the entire record.
2938bdc5a62SPatrick Kelsey */
294ee67461eSJoseph Mingrone ND_TCHECK_SIZE(nr);
295ee67461eSJoseph Mingrone ND_PRINT("\n started %u.%03u, last %u.%03u",
296ee67461eSJoseph Mingrone GET_BE_U_4(nr->start_time)/1000,
297ee67461eSJoseph Mingrone GET_BE_U_4(nr->start_time)%1000,
298ee67461eSJoseph Mingrone GET_BE_U_4(nr->last_time)/1000,
299ee67461eSJoseph Mingrone GET_BE_U_4(nr->last_time)%1000);
3008bdc5a62SPatrick Kelsey
3018bdc5a62SPatrick Kelsey asbuf[0] = buf[0] = '\0';
302ee67461eSJoseph Mingrone snprintf(buf, sizeof(buf), "/%u", GET_U_1(nr->src_mask));
3038bdc5a62SPatrick Kelsey snprintf(asbuf, sizeof(asbuf), ":%u",
304ee67461eSJoseph Mingrone GET_BE_U_2(nr->src_as));
305ee67461eSJoseph Mingrone ND_PRINT("\n %s%s%s:%u ",
306ee67461eSJoseph Mingrone intoa(GET_IPV4_TO_NETWORK_ORDER(nr->src_ina)),
307ee67461eSJoseph Mingrone buf, asbuf,
308ee67461eSJoseph Mingrone GET_BE_U_2(nr->srcport));
3098bdc5a62SPatrick Kelsey
310ee67461eSJoseph Mingrone snprintf(buf, sizeof(buf), "/%u", GET_U_1(nr->dst_mask));
3118bdc5a62SPatrick Kelsey snprintf(asbuf, sizeof(asbuf), ":%u",
312ee67461eSJoseph Mingrone GET_BE_U_2(nr->dst_as));
313ee67461eSJoseph Mingrone ND_PRINT("> %s%s%s:%u ",
314ee67461eSJoseph Mingrone intoa(GET_IPV4_TO_NETWORK_ORDER(nr->dst_ina)),
315ee67461eSJoseph Mingrone buf, asbuf,
316ee67461eSJoseph Mingrone GET_BE_U_2(nr->dstport));
3178bdc5a62SPatrick Kelsey
318ee67461eSJoseph Mingrone ND_PRINT(">> %s\n ",
319ee67461eSJoseph Mingrone intoa(GET_IPV4_TO_NETWORK_ORDER(nr->nhop_ina)));
3208bdc5a62SPatrick Kelsey
321ee67461eSJoseph Mingrone proto = GET_U_1(nr->proto);
322ee67461eSJoseph Mingrone if (!ndo->ndo_nflag && (p_name = netdb_protoname(proto)) != NULL)
323ee67461eSJoseph Mingrone ND_PRINT("%s ", p_name);
3248bdc5a62SPatrick Kelsey else
325ee67461eSJoseph Mingrone ND_PRINT("%u ", proto);
3268bdc5a62SPatrick Kelsey
3278bdc5a62SPatrick Kelsey /* tcp flags for tcp only */
328ee67461eSJoseph Mingrone if (proto == IPPROTO_TCP) {
329ee67461eSJoseph Mingrone u_int flags;
330ee67461eSJoseph Mingrone flags = GET_U_1(nr->tcp_flags);
331ee67461eSJoseph Mingrone ND_PRINT("%s%s%s%s%s%s%s",
3328bdc5a62SPatrick Kelsey flags & TH_FIN ? "F" : "",
3338bdc5a62SPatrick Kelsey flags & TH_SYN ? "S" : "",
3348bdc5a62SPatrick Kelsey flags & TH_RST ? "R" : "",
3358bdc5a62SPatrick Kelsey flags & TH_PUSH ? "P" : "",
3368bdc5a62SPatrick Kelsey flags & TH_ACK ? "A" : "",
3378bdc5a62SPatrick Kelsey flags & TH_URG ? "U" : "",
338ee67461eSJoseph Mingrone flags ? " " : "");
3398bdc5a62SPatrick Kelsey }
3408bdc5a62SPatrick Kelsey
3418bdc5a62SPatrick Kelsey buf[0]='\0';
342ee67461eSJoseph Mingrone ND_PRINT("tos %u, %u (%u octets) %s",
343ee67461eSJoseph Mingrone GET_U_1(nr->tos),
344ee67461eSJoseph Mingrone GET_BE_U_4(nr->packets),
345ee67461eSJoseph Mingrone GET_BE_U_4(nr->octets), buf);
3468bdc5a62SPatrick Kelsey }
3478bdc5a62SPatrick Kelsey return;
3488bdc5a62SPatrick Kelsey
3498bdc5a62SPatrick Kelsey trunc:
350ee67461eSJoseph Mingrone nd_print_trunc(ndo);
3518bdc5a62SPatrick Kelsey }
3528bdc5a62SPatrick Kelsey
3538bdc5a62SPatrick Kelsey static void
cnfp_v6_print(netdissect_options * ndo,const u_char * cp)3548bdc5a62SPatrick Kelsey cnfp_v6_print(netdissect_options *ndo, const u_char *cp)
3558bdc5a62SPatrick Kelsey {
356ee67461eSJoseph Mingrone const struct nfhdr_v6 *nh;
357ee67461eSJoseph Mingrone const struct nfrec_v6 *nr;
3580bff6a5aSEd Maste const char *p_name;
359ee67461eSJoseph Mingrone uint8_t proto;
360ee67461eSJoseph Mingrone u_int nrecs, ver;
3618bdc5a62SPatrick Kelsey #if 0
3628bdc5a62SPatrick Kelsey time_t t;
3638bdc5a62SPatrick Kelsey #endif
3648bdc5a62SPatrick Kelsey
3658bdc5a62SPatrick Kelsey nh = (const struct nfhdr_v6 *)cp;
366ee67461eSJoseph Mingrone ND_TCHECK_SIZE(nh);
3678bdc5a62SPatrick Kelsey
368ee67461eSJoseph Mingrone ver = GET_BE_U_2(nh->version);
369ee67461eSJoseph Mingrone nrecs = GET_BE_U_4(nh->count);
3708bdc5a62SPatrick Kelsey #if 0
3718bdc5a62SPatrick Kelsey /*
3728bdc5a62SPatrick Kelsey * This is seconds since the UN*X epoch, and is followed by
3738bdc5a62SPatrick Kelsey * nanoseconds. XXX - format it, rather than just dumping the
3748bdc5a62SPatrick Kelsey * raw seconds-since-the-Epoch.
3758bdc5a62SPatrick Kelsey */
376ee67461eSJoseph Mingrone t = GET_BE_U_4(nh->utc_sec);
3778bdc5a62SPatrick Kelsey #endif
3788bdc5a62SPatrick Kelsey
379ee67461eSJoseph Mingrone ND_PRINT("NetFlow v%x, %u.%03u uptime, %u.%09u, ", ver,
380ee67461eSJoseph Mingrone GET_BE_U_4(nh->msys_uptime)/1000,
381ee67461eSJoseph Mingrone GET_BE_U_4(nh->msys_uptime)%1000,
382ee67461eSJoseph Mingrone GET_BE_U_4(nh->utc_sec), GET_BE_U_4(nh->utc_nsec));
3838bdc5a62SPatrick Kelsey
384ee67461eSJoseph Mingrone ND_PRINT("#%u, ", GET_BE_U_4(nh->sequence));
3858bdc5a62SPatrick Kelsey nr = (const struct nfrec_v6 *)&nh[1];
3868bdc5a62SPatrick Kelsey
387ee67461eSJoseph Mingrone ND_PRINT("%2u recs", nrecs);
3888bdc5a62SPatrick Kelsey
3898bdc5a62SPatrick Kelsey for (; nrecs != 0; nr++, nrecs--) {
3908bdc5a62SPatrick Kelsey char buf[20];
3918bdc5a62SPatrick Kelsey char asbuf[20];
3928bdc5a62SPatrick Kelsey
3938bdc5a62SPatrick Kelsey /*
3948bdc5a62SPatrick Kelsey * Make sure we have the entire record.
3958bdc5a62SPatrick Kelsey */
396ee67461eSJoseph Mingrone ND_TCHECK_SIZE(nr);
397ee67461eSJoseph Mingrone ND_PRINT("\n started %u.%03u, last %u.%03u",
398ee67461eSJoseph Mingrone GET_BE_U_4(nr->start_time)/1000,
399ee67461eSJoseph Mingrone GET_BE_U_4(nr->start_time)%1000,
400ee67461eSJoseph Mingrone GET_BE_U_4(nr->last_time)/1000,
401ee67461eSJoseph Mingrone GET_BE_U_4(nr->last_time)%1000);
4028bdc5a62SPatrick Kelsey
4038bdc5a62SPatrick Kelsey asbuf[0] = buf[0] = '\0';
404ee67461eSJoseph Mingrone snprintf(buf, sizeof(buf), "/%u", GET_U_1(nr->src_mask));
4058bdc5a62SPatrick Kelsey snprintf(asbuf, sizeof(asbuf), ":%u",
406ee67461eSJoseph Mingrone GET_BE_U_2(nr->src_as));
407ee67461eSJoseph Mingrone ND_PRINT("\n %s%s%s:%u ",
408ee67461eSJoseph Mingrone intoa(GET_IPV4_TO_NETWORK_ORDER(nr->src_ina)),
409ee67461eSJoseph Mingrone buf, asbuf,
410ee67461eSJoseph Mingrone GET_BE_U_2(nr->srcport));
4118bdc5a62SPatrick Kelsey
412ee67461eSJoseph Mingrone snprintf(buf, sizeof(buf), "/%u", GET_U_1(nr->dst_mask));
4138bdc5a62SPatrick Kelsey snprintf(asbuf, sizeof(asbuf), ":%u",
414ee67461eSJoseph Mingrone GET_BE_U_2(nr->dst_as));
415ee67461eSJoseph Mingrone ND_PRINT("> %s%s%s:%u ",
416ee67461eSJoseph Mingrone intoa(GET_IPV4_TO_NETWORK_ORDER(nr->dst_ina)),
417ee67461eSJoseph Mingrone buf, asbuf,
418ee67461eSJoseph Mingrone GET_BE_U_2(nr->dstport));
4198bdc5a62SPatrick Kelsey
420ee67461eSJoseph Mingrone ND_PRINT(">> %s\n ",
421ee67461eSJoseph Mingrone intoa(GET_IPV4_TO_NETWORK_ORDER(nr->nhop_ina)));
4228bdc5a62SPatrick Kelsey
423ee67461eSJoseph Mingrone proto = GET_U_1(nr->proto);
424ee67461eSJoseph Mingrone if (!ndo->ndo_nflag && (p_name = netdb_protoname(proto)) != NULL)
425ee67461eSJoseph Mingrone ND_PRINT("%s ", p_name);
4268bdc5a62SPatrick Kelsey else
427ee67461eSJoseph Mingrone ND_PRINT("%u ", proto);
4288bdc5a62SPatrick Kelsey
4298bdc5a62SPatrick Kelsey /* tcp flags for tcp only */
430ee67461eSJoseph Mingrone if (proto == IPPROTO_TCP) {
431ee67461eSJoseph Mingrone u_int flags;
432ee67461eSJoseph Mingrone flags = GET_U_1(nr->tcp_flags);
433ee67461eSJoseph Mingrone ND_PRINT("%s%s%s%s%s%s%s",
4348bdc5a62SPatrick Kelsey flags & TH_FIN ? "F" : "",
4358bdc5a62SPatrick Kelsey flags & TH_SYN ? "S" : "",
4368bdc5a62SPatrick Kelsey flags & TH_RST ? "R" : "",
4378bdc5a62SPatrick Kelsey flags & TH_PUSH ? "P" : "",
4388bdc5a62SPatrick Kelsey flags & TH_ACK ? "A" : "",
4398bdc5a62SPatrick Kelsey flags & TH_URG ? "U" : "",
440ee67461eSJoseph Mingrone flags ? " " : "");
4418bdc5a62SPatrick Kelsey }
4428bdc5a62SPatrick Kelsey
4438bdc5a62SPatrick Kelsey buf[0]='\0';
4448bdc5a62SPatrick Kelsey snprintf(buf, sizeof(buf), "(%u<>%u encaps)",
445ee67461eSJoseph Mingrone (GET_BE_U_2(nr->flags) >> 8) & 0xff,
446ee67461eSJoseph Mingrone (GET_BE_U_2(nr->flags)) & 0xff);
447ee67461eSJoseph Mingrone ND_PRINT("tos %u, %u (%u octets) %s",
448ee67461eSJoseph Mingrone GET_U_1(nr->tos),
449ee67461eSJoseph Mingrone GET_BE_U_4(nr->packets),
450ee67461eSJoseph Mingrone GET_BE_U_4(nr->octets), buf);
4518bdc5a62SPatrick Kelsey }
4528bdc5a62SPatrick Kelsey return;
4538bdc5a62SPatrick Kelsey
4548bdc5a62SPatrick Kelsey trunc:
455ee67461eSJoseph Mingrone nd_print_trunc(ndo);
4568bdc5a62SPatrick Kelsey }
4578bdc5a62SPatrick Kelsey
4588bdc5a62SPatrick Kelsey void
cnfp_print(netdissect_options * ndo,const u_char * cp)4598bdc5a62SPatrick Kelsey cnfp_print(netdissect_options *ndo, const u_char *cp)
4608bdc5a62SPatrick Kelsey {
4618bdc5a62SPatrick Kelsey int ver;
4628bdc5a62SPatrick Kelsey
4638bdc5a62SPatrick Kelsey /*
4648bdc5a62SPatrick Kelsey * First 2 bytes are the version number.
4658bdc5a62SPatrick Kelsey */
466ee67461eSJoseph Mingrone ndo->ndo_protocol = "cnfp";
467ee67461eSJoseph Mingrone ver = GET_BE_U_2(cp);
4688bdc5a62SPatrick Kelsey switch (ver) {
4698bdc5a62SPatrick Kelsey
4708bdc5a62SPatrick Kelsey case 1:
4718bdc5a62SPatrick Kelsey cnfp_v1_print(ndo, cp);
4728bdc5a62SPatrick Kelsey break;
4738bdc5a62SPatrick Kelsey
4748bdc5a62SPatrick Kelsey case 5:
4758bdc5a62SPatrick Kelsey cnfp_v5_print(ndo, cp);
4768bdc5a62SPatrick Kelsey break;
4778bdc5a62SPatrick Kelsey
4788bdc5a62SPatrick Kelsey case 6:
4798bdc5a62SPatrick Kelsey cnfp_v6_print(ndo, cp);
4808bdc5a62SPatrick Kelsey break;
4818bdc5a62SPatrick Kelsey
4828bdc5a62SPatrick Kelsey default:
483ee67461eSJoseph Mingrone ND_PRINT("NetFlow v%x", ver);
4848bdc5a62SPatrick Kelsey break;
4858bdc5a62SPatrick Kelsey }
486685295f4SBill Fenner }
487