1#! /usr/bin/perl 2# $OpenBSD: template.pl,v 1.3 2013/08/13 08:47:10 florian Exp $ 3 4# Copyright (c) 2013 Florian Obser <florian@openbsd.org> 5# 6# Permission to use, copy, modify, and distribute this software for any 7# purpose with or without fee is hereby granted, provided that the above 8# copyright notice and this permission notice appear in all copies. 9# 10# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 18 19use strict; 20use warnings; 21 22use lib '.'; 23use IO::Socket::INET; 24use Net::Flow; 25 26my $port = 9996; 27 28sub usage 29{ 30 print STDERR "$0 [9|10]\n"; 31 exit(1); 32} 33 34{ 35 my $id2name = { 36 1 => 'octetDeltaCount', 37 2 => 'packetDeltaCount', 38 4 => 'protocolIdentifier', 39 5 => 'ipClassOfService', 40 7 => 'sourceTransportPort', 41 8 => 'sourceIPv4Address', 42 10 => 'ingressInterface', 43 11 => 'destinationTransportPort', 44 12 => 'destinationIPv4Address', 45 14 => 'egressInterface', 46 21 => 'flowEndSysUpTime', 47 22 => 'flowStartSysUpTime', 48 27 => 'sourceIPv6Address', 49 28 => 'destinationIPv6Address', 50 150 => 'flowStartSeconds', 51 151 => 'flowEndSeconds', 52 152 => 'flowStartMilliseconds', 53 153 => 'flowEndMilliseconds', 54 }; 55 sub id2name { return $id2name->{$_[0]} || $_[0]; } 56} 57 58if (scalar(@ARGV) != 1 || ($ARGV[0] != 9 && $ARGV[0] != 10)) { 59 usage(); 60} 61 62if (`ifconfig pflow0 2>&1` ne "pflow0: no such interface\n") { 63 system('ifconfig', 'pflow0', 'destroy'); 64} 65 66 67my $sock = IO::Socket::INET->new( LocalPort =>$port, Proto => 'udp'); 68my $pid = fork(); 69if (!defined $pid) { 70 die 'cannot fork'; 71} elsif ( $pid == 0) { 72 my ($packet, $header_ref, $template_ref, $flow_ref, $errors_ref); 73 $sock->recv($packet,1548); 74 ($header_ref, $template_ref, $flow_ref, $errors_ref) = 75 Net::Flow::decode(\$packet, $template_ref); 76 foreach my $template (@$template_ref) { 77 print('Template Id: ', $template->{TemplateId}, "\n"); 78 foreach my $template_elem (@{$template->{Template}}) { 79 print(id2name($template_elem->{Id}), '(', 80 $template_elem->{Length}, ')', "\n"); 81 } 82 } 83} else { 84 close($sock); 85 system('ifconfig', 'pflow0', 'flowsrc', '127.0.0.1', 'flowdst', 86 '127.0.0.1:9996', 'pflowproto', $ARGV[0]); 87 waitpid($pid, 0); 88 system('ifconfig', 'pflow0', 'destroy'); 89} 90