1 /* Copyright (c) 2002-2011 InMon Corp. Licensed under the terms of the InMon sFlow licence: */ 2 /* http://www.inmon.com/technology/sflowlicense.txt */ 3 4 /* 5 ///////////////////////////////////////////////////////////////////////////////// 6 /////////////////////// sFlow Sampling Packet Data Types //////////////////////// 7 ///////////////////////////////////////////////////////////////////////////////// 8 */ 9 10 #ifndef SFLOW_H 11 #define SFLOW_H 1 12 13 #if defined(__cplusplus) 14 extern "C" { 15 #endif 16 17 typedef struct { uint32_t addr; } SFLIPv4; 18 19 typedef struct { u_char addr[16]; } SFLIPv6; 20 21 typedef union _SFLAddress_value { 22 SFLIPv4 ip_v4; 23 SFLIPv6 ip_v6; 24 } SFLAddress_value; 25 26 enum SFLAddress_type { 27 SFLADDRESSTYPE_UNDEFINED = 0, 28 SFLADDRESSTYPE_IP_V4 = 1, 29 SFLADDRESSTYPE_IP_V6 = 2 30 }; 31 32 typedef struct _SFLAddress { 33 uint32_t type; /* enum SFLAddress_type */ 34 SFLAddress_value address; 35 } SFLAddress; 36 37 /* Packet header data */ 38 39 #define SFL_DEFAULT_HEADER_SIZE 128 40 #define SFL_DEFAULT_COLLECTOR_PORT 6343 41 #define SFL_DEFAULT_SAMPLING_RATE 400 42 43 /* The header protocol describes the format of the sampled header */ 44 enum SFLHeader_protocol { 45 SFLHEADER_ETHERNET_ISO8023 = 1, 46 SFLHEADER_ISO88024_TOKENBUS = 2, 47 SFLHEADER_ISO88025_TOKENRING = 3, 48 SFLHEADER_FDDI = 4, 49 SFLHEADER_FRAME_RELAY = 5, 50 SFLHEADER_X25 = 6, 51 SFLHEADER_PPP = 7, 52 SFLHEADER_SMDS = 8, 53 SFLHEADER_AAL5 = 9, 54 SFLHEADER_AAL5_IP = 10, /* e.g. Cisco AAL5 mux */ 55 SFLHEADER_IPv4 = 11, 56 SFLHEADER_IPv6 = 12, 57 SFLHEADER_MPLS = 13, 58 SFLHEADER_POS = 14, 59 SFLHEADER_IEEE80211MAC = 15, 60 SFLHEADER_IEEE80211_AMPDU = 16, 61 SFLHEADER_IEEE80211_AMSDU_SUBFRAME = 17 62 }; 63 64 /* raw sampled header */ 65 66 typedef struct _SFLSampled_header { 67 uint32_t header_protocol; /* (enum SFLHeader_protocol) */ 68 uint32_t frame_length; /* Original length of packet before sampling */ 69 uint32_t stripped; /* header/trailer bytes stripped by sender */ 70 uint32_t header_length; /* length of sampled header bytes to follow */ 71 uint8_t* header_bytes; /* Header bytes */ 72 } SFLSampled_header; 73 74 /* decoded ethernet header */ 75 76 typedef struct _SFLSampled_ethernet { 77 uint32_t eth_len; /* The length of the MAC packet excluding 78 lower layer encapsulations */ 79 uint8_t src_mac[8]; /* 6 bytes + 2 pad */ 80 uint8_t dst_mac[8]; 81 uint32_t eth_type; 82 } SFLSampled_ethernet; 83 84 /* decoded IP version 4 header */ 85 86 typedef struct _SFLSampled_ipv4 { 87 uint32_t length; /* The length of the IP packet 88 excluding lower layer encapsulations */ 89 uint32_t protocol; /* IP Protocol type (for example, TCP = 6, UDP = 17) */ 90 SFLIPv4 src_ip; /* Source IP Address */ 91 SFLIPv4 dst_ip; /* Destination IP Address */ 92 uint32_t src_port; /* TCP/UDP source port number or equivalent */ 93 uint32_t dst_port; /* TCP/UDP destination port number or equivalent */ 94 uint32_t tcp_flags; /* TCP flags */ 95 uint32_t tos; /* IP type of service */ 96 } SFLSampled_ipv4; 97 98 /* decoded IP version 6 data */ 99 100 typedef struct _SFLSampled_ipv6 { 101 uint32_t length; /* The length of the IP packet 102 excluding lower layer encapsulations */ 103 uint32_t protocol; /* IP Protocol type (for example, TCP = 6, UDP = 17) */ 104 SFLIPv6 src_ip; /* Source IP Address */ 105 SFLIPv6 dst_ip; /* Destination IP Address */ 106 uint32_t src_port; /* TCP/UDP source port number or equivalent */ 107 uint32_t dst_port; /* TCP/UDP destination port number or equivalent */ 108 uint32_t tcp_flags; /* TCP flags */ 109 uint32_t priority; /* IP priority */ 110 } SFLSampled_ipv6; 111 112 /* Extended data types */ 113 114 /* Extended switch data */ 115 116 typedef struct _SFLExtended_switch { 117 uint32_t src_vlan; /* The 802.1Q VLAN id of incomming frame */ 118 uint32_t src_priority; /* The 802.1p priority */ 119 uint32_t dst_vlan; /* The 802.1Q VLAN id of outgoing frame */ 120 uint32_t dst_priority; /* The 802.1p priority */ 121 } SFLExtended_switch; 122 123 /* Extended router data */ 124 125 typedef struct _SFLExtended_router { 126 SFLAddress nexthop; /* IP address of next hop router */ 127 uint32_t src_mask; /* Source address prefix mask bits */ 128 uint32_t dst_mask; /* Destination address prefix mask bits */ 129 } SFLExtended_router; 130 131 /* Extended gateway data */ 132 enum SFLExtended_as_path_segment_type { 133 SFLEXTENDED_AS_SET = 1, /* Unordered set of ASs */ 134 SFLEXTENDED_AS_SEQUENCE = 2 /* Ordered sequence of ASs */ 135 }; 136 137 typedef struct _SFLExtended_as_path_segment { 138 uint32_t type; /* enum SFLExtended_as_path_segment_type */ 139 uint32_t length; /* number of AS numbers in set/sequence */ 140 union { 141 uint32_t* set; 142 uint32_t* seq; 143 } as; 144 } SFLExtended_as_path_segment; 145 146 typedef struct _SFLExtended_gateway { 147 SFLAddress nexthop; /* Address of the border router that should 148 be used for the destination network */ 149 uint32_t as; /* AS number for this gateway */ 150 uint32_t src_as; /* AS number of source (origin) */ 151 uint32_t src_peer_as; /* AS number of source peer */ 152 uint32_t dst_as_path_segments; /* number of segments in path */ 153 SFLExtended_as_path_segment* dst_as_path; /* list of seqs or sets */ 154 uint32_t communities_length; /* number of communities */ 155 uint32_t* communities; /* set of communities */ 156 uint32_t localpref; /* LocalPref associated with this route */ 157 } SFLExtended_gateway; 158 159 typedef struct _SFLString { 160 uint32_t len; 161 char* str; 162 } SFLString; 163 164 /* Extended user data */ 165 166 typedef struct _SFLExtended_user { 167 uint32_t src_charset; /* MIBEnum value of character set used to encode a string - See RFC 2978 168 Where possible UTF-8 encoding (MIBEnum=106) should be used. A value 169 of zero indicates an unknown encoding. */ 170 SFLString src_user; 171 uint32_t dst_charset; 172 SFLString dst_user; 173 } SFLExtended_user; 174 175 /* Extended URL data */ 176 177 enum SFLExtended_url_direction { 178 SFLEXTENDED_URL_SRC = 1, /* URL is associated with source address */ 179 SFLEXTENDED_URL_DST = 2 /* URL is associated with destination address */ 180 }; 181 182 typedef struct _SFLExtended_url { 183 uint32_t direction; /* enum SFLExtended_url_direction */ 184 SFLString url; /* URL associated with the packet flow. 185 Must be URL encoded */ 186 SFLString host; /* The host field from the HTTP header */ 187 } SFLExtended_url; 188 189 /* Extended MPLS data */ 190 191 typedef struct _SFLLabelStack { 192 uint32_t depth; 193 uint32_t* stack; /* first entry is top of stack - see RFC 3032 for encoding */ 194 } SFLLabelStack; 195 196 typedef struct _SFLExtended_mpls { 197 SFLAddress nextHop; /* Address of the next hop */ 198 SFLLabelStack in_stack; 199 SFLLabelStack out_stack; 200 } SFLExtended_mpls; 201 202 /* Extended NAT data 203 Packet header records report addresses as seen at the sFlowDataSource. 204 The extended_nat structure reports on translated source and/or destination 205 addesses for this packet. If an address was not translated it should 206 be equal to that reported for the header. */ 207 208 typedef struct _SFLExtended_nat { 209 SFLAddress src; /* Source address */ 210 SFLAddress dst; /* Destination address */ 211 } SFLExtended_nat; 212 213 typedef struct _SFLExtended_nat_port { 214 uint32_t src_port; 215 uint32_t dst_port; 216 } SFLExtended_nat_port; 217 218 /* additional Extended MPLS stucts */ 219 220 typedef struct _SFLExtended_mpls_tunnel { 221 SFLString tunnel_lsp_name; /* Tunnel name */ 222 uint32_t tunnel_id; /* Tunnel ID */ 223 uint32_t tunnel_cos; /* Tunnel COS value */ 224 } SFLExtended_mpls_tunnel; 225 226 typedef struct _SFLExtended_mpls_vc { 227 SFLString vc_instance_name; /* VC instance name */ 228 uint32_t vll_vc_id; /* VLL/VC instance ID */ 229 uint32_t vc_label_cos; /* VC Label COS value */ 230 } SFLExtended_mpls_vc; 231 232 /* Extended MPLS FEC 233 - Definitions from MPLS-FTN-STD-MIB mplsFTNTable */ 234 235 typedef struct _SFLExtended_mpls_FTN { 236 SFLString mplsFTNDescr; 237 uint32_t mplsFTNMask; 238 } SFLExtended_mpls_FTN; 239 240 /* Extended MPLS LVP FEC 241 - Definition from MPLS-LDP-STD-MIB mplsFecTable 242 Note: mplsFecAddrType, mplsFecAddr information available 243 from packet header */ 244 245 typedef struct _SFLExtended_mpls_LDP_FEC { 246 uint32_t mplsFecAddrPrefixLength; 247 } SFLExtended_mpls_LDP_FEC; 248 249 /* Extended VLAN tunnel information 250 Record outer VLAN encapsulations that have 251 been stripped. extended_vlantunnel information 252 should only be reported if all the following conditions are satisfied: 253 1. The packet has nested vlan tags, AND 254 2. The reporting device is VLAN aware, AND 255 3. One or more VLAN tags have been stripped, either 256 because they represent proprietary encapsulations, or 257 because switch hardware automatically strips the outer VLAN 258 encapsulation. 259 Reporting extended_vlantunnel information is not a substitute for 260 reporting extended_switch information. extended_switch data must 261 always be reported to describe the ingress/egress VLAN information 262 for the packet. The extended_vlantunnel information only applies to 263 nested VLAN tags, and then only when one or more tags has been 264 stripped. */ 265 266 typedef SFLLabelStack SFLVlanStack; 267 typedef struct _SFLExtended_vlan_tunnel { 268 SFLVlanStack stack; /* List of stripped 802.1Q TPID/TCI layers. Each 269 TPID,TCI pair is represented as a single 32 bit 270 integer. Layers listed from outermost to 271 innermost. */ 272 } SFLExtended_vlan_tunnel; 273 274 /* 275 ////////////////// IEEE 802.11 Extension structs //////////////////// 276 277 The 4-byte cipher_suite identifier follows the format of the cipher suite 278 selector value from the 802.11i (TKIP/CCMP amendment to 802.11i) 279 The most significant three bytes contain the OUI and the least significant 280 byte contains the Suite Type. 281 282 The currently assigned values are: 283 284 OUI |Suite type |Meaning 285 ---------------------------------------------------- 286 00-0F-AC | 0 | Use group cipher suite 287 00-0F-AC | 1 | WEP-40 288 00-0F-AC | 2 | TKIP 289 00-0F-AC | 3 | Reserved 290 00-0F-AC | 4 | CCMP 291 00-0F-AC | 5 | WEP-104 292 00-0F-AC | 6-255 | Reserved 293 Vendor OUI | Other | Vendor specific 294 Other | Any | Reserved 295 ---------------------------------------------------- 296 */ 297 298 typedef uint32_t SFLCipherSuite; 299 300 /* Extended wifi Payload 301 Used to provide unencrypted version of 802.11 MAC data. If the 302 MAC data is not encrypted then the agent must not include an 303 extended_wifi_payload structure. 304 If 802.11 MAC data is encrypted then the sampled_header structure 305 should only contain the MAC header (since encrypted data cannot 306 be decoded by the sFlow receiver). If the sFlow agent has access to 307 the unencrypted payload, it should add an extended_wifi_payload 308 structure containing the unencrypted data bytes from the sampled 309 packet header, starting at the beginning of the 802.2 LLC and not 310 including any trailing encryption footers. */ 311 /* opaque = flow_data; enterprise = 0; format = 1013 */ 312 313 typedef struct _SFLExtended_wifi_payload { 314 SFLCipherSuite cipherSuite; 315 SFLSampled_header header; 316 } SFLExtended_wifi_payload; 317 318 typedef enum { 319 IEEE80211_A = 1, 320 IEEE80211_B = 2, 321 IEEE80211_G = 3, 322 IEEE80211_N = 4, 323 } SFL_IEEE80211_version; 324 325 /* opaque = flow_data; enterprise = 0; format = 1014 */ 326 327 #define SFL_MAX_SSID_LEN 256 328 329 typedef struct _SFLExtended_wifi_rx { 330 uint32_t ssid_len; 331 char* ssid; 332 char bssid[6]; /* BSSID */ 333 SFL_IEEE80211_version version; /* version */ 334 uint32_t channel; /* channel number */ 335 uint64_t speed; 336 uint32_t rsni; /* received signal to noise ratio, see dot11FrameRprtRSNI */ 337 uint32_t rcpi; /* received channel power, see dot11FrameRprtLastRCPI */ 338 uint32_t packet_duration_us; /* amount of time that the successfully received pkt occupied RF 339 medium.*/ 340 } SFLExtended_wifi_rx; 341 342 /* opaque = flow_data; enterprise = 0; format = 1015 */ 343 344 typedef struct _SFLExtended_wifi_tx { 345 uint32_t ssid_len; 346 char* ssid; /* SSID string */ 347 char bssid[6]; /* BSSID */ 348 SFL_IEEE80211_version version; /* version */ 349 uint32_t transmissions; /* number of transmissions for sampled 350 packet. 351 0 = unkown 352 1 = packet was successfully transmitted 353 on first attempt 354 n > 1 = n - 1 retransmissions */ 355 uint32_t packet_duration_us; /* amount of time that the successfully 356 transmitted packet occupied the 357 RF medium */ 358 uint32_t retrans_duration_us; /* amount of time that failed transmission 359 attempts occupied the RF medium */ 360 uint32_t channel; /* channel number */ 361 uint64_t speed; 362 uint32_t power_mw; /* transmit power in mW. */ 363 } SFLExtended_wifi_tx; 364 365 /* Extended 802.11 Aggregation Data */ 366 /* A flow_sample of an aggregated frame would consist of a packet 367 header for the whole frame + any other extended structures that 368 apply (e.g. 80211_tx/rx etc.) + an extended_wifi_aggregation 369 structure which would contain an array of pdu structures (one 370 for each PDU in the aggregate). A pdu is simply an array of 371 flow records, in the simplest case a packet header for each PDU, 372 but extended structures could be included as well. */ 373 374 /* opaque = flow_data; enterprise = 0; format = 1016 */ 375 376 struct _SFLFlow_Pdu; /* forward decl */ 377 378 typedef struct _SFLExtended_aggregation { 379 uint32_t num_pdus; 380 struct _SFFlow_Pdu* pdus; 381 } SFLExtended_aggregation; 382 383 /* Extended socket information, 384 Must be filled in for all application transactions associated with a network socket 385 Omit if transaction associated with non-network IPC */ 386 387 /* IPv4 Socket */ 388 /* opaque = flow_data; enterprise = 0; format = 2100 */ 389 typedef struct _SFLExtended_socket_ipv4 { 390 uint32_t protocol; /* IP Protocol (e.g. TCP = 6, UDP = 17) */ 391 SFLIPv4 local_ip; /* local IP address */ 392 SFLIPv4 remote_ip; /* remote IP address */ 393 uint32_t local_port; /* TCP/UDP local port number or equivalent */ 394 uint32_t remote_port; /* TCP/UDP remote port number of equivalent */ 395 } SFLExtended_socket_ipv4; 396 397 #define XDRSIZ_SFLEXTENDED_SOCKET4 20 398 399 /* IPv6 Socket */ 400 /* opaque = flow_data; enterprise = 0; format = 2101 */ 401 typedef struct _SFLExtended_socket_ipv6 { 402 uint32_t protocol; /* IP Protocol (e.g. TCP = 6, UDP = 17) */ 403 SFLIPv6 local_ip; /* local IP address */ 404 SFLIPv6 remote_ip; /* remote IP address */ 405 uint32_t local_port; /* TCP/UDP local port number or equivalent */ 406 uint32_t remote_port; /* TCP/UDP remote port number of equivalent */ 407 } SFLExtended_socket_ipv6; 408 409 #define XDRSIZ_SFLEXTENDED_SOCKET6 44 410 411 typedef enum { 412 MEMCACHE_PROT_OTHER = 0, 413 MEMCACHE_PROT_ASCII = 1, 414 MEMCACHE_PROT_BINARY = 2, 415 } SFLMemcache_prot; 416 417 typedef enum { 418 MEMCACHE_CMD_OTHER = 0, 419 MEMCACHE_CMD_SET = 1, 420 MEMCACHE_CMD_ADD = 2, 421 MEMCACHE_CMD_REPLACE = 3, 422 MEMCACHE_CMD_APPEND = 4, 423 MEMCACHE_CMD_PREPEND = 5, 424 MEMCACHE_CMD_CAS = 6, 425 MEMCACHE_CMD_GET = 7, 426 MEMCACHE_CMD_GETS = 8, 427 MEMCACHE_CMD_INCR = 9, 428 MEMCACHE_CMD_DECR = 10, 429 MEMCACHE_CMD_DELETE = 11, 430 MEMCACHE_CMD_STATS = 12, 431 MEMCACHE_CMD_FLUSH = 13, 432 MEMCACHE_CMD_VERSION = 14, 433 MEMCACHE_CMD_QUIT = 15, 434 MEMCACHE_CMD_TOUCH = 16, 435 } SFLMemcache_cmd; 436 437 enum SFLMemcache_operation_status { 438 MEMCACHE_OP_UNKNOWN = 0, 439 MEMCACHE_OP_OK = 1, 440 MEMCACHE_OP_ERROR = 2, 441 MEMCACHE_OP_CLIENT_ERROR = 3, 442 MEMCACHE_OP_SERVER_ERROR = 4, 443 MEMCACHE_OP_STORED = 5, 444 MEMCACHE_OP_NOT_STORED = 6, 445 MEMCACHE_OP_EXISTS = 7, 446 MEMCACHE_OP_NOT_FOUND = 8, 447 MEMCACHE_OP_DELETED = 9, 448 }; 449 450 #define SFL_MAX_MEMCACHE_KEY 255 451 452 typedef struct _SFLSampled_memcache { 453 uint32_t protocol; /* SFLMemcache_prot */ 454 uint32_t command; /* SFLMemcache_cmd */ 455 SFLString key; /* up to 255 chars */ 456 uint32_t nkeys; 457 uint32_t value_bytes; 458 uint32_t duration_uS; 459 uint32_t status; /* SFLMemcache_operation_status */ 460 } SFLSampled_memcache; 461 462 typedef enum { 463 SFHTTP_OTHER = 0, 464 SFHTTP_OPTIONS = 1, 465 SFHTTP_GET = 2, 466 SFHTTP_HEAD = 3, 467 SFHTTP_POST = 4, 468 SFHTTP_PUT = 5, 469 SFHTTP_DELETE = 6, 470 SFHTTP_TRACE = 7, 471 SFHTTP_CONNECT = 8, 472 } SFLHTTP_method; 473 474 #define SFL_MAX_HTTP_URI 255 475 #define SFL_MAX_HTTP_HOST 64 476 #define SFL_MAX_HTTP_REFERRER 255 477 #define SFL_MAX_HTTP_USERAGENT 128 478 #define SFL_MAX_HTTP_XFF 64 479 #define SFL_MAX_HTTP_AUTHUSER 32 480 #define SFL_MAX_HTTP_MIMETYPE 64 481 482 typedef struct _SFLSampled_http { 483 SFLHTTP_method method; 484 uint32_t protocol; /* 1.1=1001 */ 485 SFLString uri; /* URI exactly as it came from the client (up to 255 bytes) */ 486 SFLString host; /* Host value from request header (<= 64 bytes) */ 487 SFLString referrer; /* Referer value from request header (<=255 bytes) */ 488 SFLString useragent; /* User-Agent value from request header (<= 128 bytes)*/ 489 SFLString xff; /* X-Forwarded-For value from request header (<= 64 bytes)*/ 490 SFLString authuser; /* RFC 1413 identity of user (<=32 bytes)*/ 491 SFLString mimetype; /* Mime-Type (<=64 bytes) */ 492 uint64_t req_bytes; /* Content-Length of request */ 493 uint64_t resp_bytes; /* Content-Length of response */ 494 uint32_t uS; /* duration of the operation (microseconds) */ 495 uint32_t status; /* HTTP status code */ 496 } SFLSampled_http; 497 498 499 typedef enum { 500 SFLAPP_SUCCESS = 0, 501 SFLAPP_OTHER = 1, 502 SFLAPP_TIMEOUT = 2, 503 SFLAPP_INTERNAL_ERROR = 3, 504 SFLAPP_BAD_REQUEST = 4, 505 SFLAPP_FORBIDDEN = 5, 506 SFLAPP_TOO_LARGE = 6, 507 SFLAPP_NOT_IMPLEMENTED = 7, 508 SFLAPP_NOT_FOUND = 8, 509 SFLAPP_UNAVAILABLE = 9, 510 SFLAPP_UNAUTHORIZED = 10, 511 } EnumSFLAPPStatus; 512 513 static const char* SFL_APP_STATUS_names[] = { "SUCCESS", "OTHER", "TIMEOUT", 514 "INTERNAL_ERROR", "BAD_REQUEST", "FORBIDDEN", 515 "TOO_LARGE", "NOT_IMPLEMENTED", "NOT_FOUND", 516 "UNAVAILABLE", "UNATHORIZED" }; 517 518 /* Operation context */ 519 typedef struct { 520 SFLString application; 521 SFLString operation; /* type of operation (e.g. authorization, payment) */ 522 SFLString attributes; /* specific attributes associated operation */ 523 } SFLSampled_APP_CTXT; 524 525 #define SFLAPP_MAX_APPLICATION_LEN 32 526 #define SFLAPP_MAX_OPERATION_LEN 32 527 #define SFLAPP_MAX_ATTRIBUTES_LEN 255 528 529 /* Sampled Enterprise Operation */ 530 /* opaque = flow_data; enterprise = 0; format = 2202 */ 531 typedef struct { 532 SFLSampled_APP_CTXT context; /* attributes describing the operation */ 533 SFLString status_descr; /* additional text describing status (e.g. "unknown client") */ 534 uint64_t req_bytes; /* size of request body (exclude headers) */ 535 uint64_t resp_bytes; /* size of response body (exclude headers) */ 536 uint32_t duration_uS; /* duration of the operation (microseconds) */ 537 EnumSFLAPPStatus status; /* status code */ 538 } SFLSampled_APP; 539 540 #define SFLAPP_MAX_STATUS_LEN 32 541 542 typedef struct { SFLString actor; } SFLSampled_APP_ACTOR; 543 544 #define SFLAPP_MAX_ACTOR_LEN 64 545 546 typedef struct _SFLExtended_vni { uint32_t vni; /* virtual network identifier */ } SFLExtended_vni; 547 548 typedef struct _SFLExtended_decap { uint32_t innerHeaderOffset; } SFLExtended_decap; 549 550 enum SFLFlow_type_tag { 551 /* enterprise = 0, format = ... */ 552 SFLFLOW_HEADER = 1, /* Packet headers are sampled */ 553 SFLFLOW_ETHERNET = 2, /* MAC layer information */ 554 SFLFLOW_IPV4 = 3, /* IP version 4 data */ 555 SFLFLOW_IPV6 = 4, /* IP version 6 data */ 556 SFLFLOW_EX_SWITCH = 1001, /* Extended switch information */ 557 SFLFLOW_EX_ROUTER = 1002, /* Extended router information */ 558 SFLFLOW_EX_GATEWAY = 1003, /* Extended gateway router information */ 559 SFLFLOW_EX_USER = 1004, /* Extended TACAS/RADIUS user information */ 560 SFLFLOW_EX_URL = 1005, /* Extended URL information */ 561 SFLFLOW_EX_MPLS = 1006, /* Extended MPLS information */ 562 SFLFLOW_EX_NAT = 1007, /* Extended NAT information */ 563 SFLFLOW_EX_MPLS_TUNNEL = 1008, /* additional MPLS information */ 564 SFLFLOW_EX_MPLS_VC = 1009, 565 SFLFLOW_EX_MPLS_FTN = 1010, 566 SFLFLOW_EX_MPLS_LDP_FEC = 1011, 567 SFLFLOW_EX_VLAN_TUNNEL = 1012, /* VLAN stack */ 568 SFLFLOW_EX_80211_PAYLOAD = 1013, 569 SFLFLOW_EX_80211_RX = 1014, 570 SFLFLOW_EX_80211_TX = 1015, 571 SFLFLOW_EX_AGGREGATION = 1016, 572 SFLFLOW_EX_NAT_PORT = 1020, /* Extended NAT port information */ 573 SFLFLOW_EX_L2_TUNNEL_OUT = 1021, /* http://sflow.org/sflow_tunnels.txt */ 574 SFLFLOW_EX_L2_TUNNEL_IN = 1022, 575 SFLFLOW_EX_IPV4_TUNNEL_OUT = 1023, 576 SFLFLOW_EX_IPV4_TUNNEL_IN = 1024, 577 SFLFLOW_EX_IPV6_TUNNEL_OUT = 1025, 578 SFLFLOW_EX_IPV6_TUNNEL_IN = 1026, 579 SFLFLOW_EX_DECAP_OUT = 1027, 580 SFLFLOW_EX_DECAP_IN = 1028, 581 SFLFLOW_EX_VNI_OUT = 1029, 582 SFLFLOW_EX_VNI_IN = 1030, 583 SFLFLOW_EX_SOCKET4 = 2100, 584 SFLFLOW_EX_SOCKET6 = 2101, 585 SFLFLOW_EX_PROXYSOCKET4 = 2102, 586 SFLFLOW_EX_PROXYSOCKET6 = 2103, 587 SFLFLOW_MEMCACHE = 2200, 588 SFLFLOW_HTTP = 2201, 589 SFLFLOW_APP = 2202, /* transaction sample */ 590 SFLFLOW_APP_CTXT = 2203, /* enclosing server context */ 591 SFLFLOW_APP_ACTOR_INIT = 2204, /* initiator */ 592 SFLFLOW_APP_ACTOR_TGT = 2205, /* target */ 593 SFLFLOW_HTTP2 = 2206, 594 }; 595 596 typedef union _SFLFlow_type { 597 SFLSampled_header header; 598 SFLSampled_ethernet ethernet; 599 SFLSampled_ipv4 ipv4; 600 SFLSampled_ipv6 ipv6; 601 SFLSampled_memcache memcache; 602 SFLSampled_http http; 603 SFLSampled_APP app; 604 SFLSampled_APP_CTXT appCtxt; 605 SFLSampled_APP_ACTOR appActor; 606 SFLExtended_switch sw; 607 SFLExtended_router router; 608 SFLExtended_gateway gateway; 609 SFLExtended_user user; 610 SFLExtended_url url; 611 SFLExtended_mpls mpls; 612 SFLExtended_nat nat; 613 SFLExtended_nat_port nat_port; 614 SFLExtended_mpls_tunnel mpls_tunnel; 615 SFLExtended_mpls_vc mpls_vc; 616 SFLExtended_mpls_FTN mpls_ftn; 617 SFLExtended_mpls_LDP_FEC mpls_ldp_fec; 618 SFLExtended_vlan_tunnel vlan_tunnel; 619 SFLExtended_wifi_payload wifi_payload; 620 SFLExtended_wifi_rx wifi_rx; 621 SFLExtended_wifi_tx wifi_tx; 622 SFLExtended_aggregation aggregation; 623 SFLExtended_socket_ipv4 socket4; 624 SFLExtended_socket_ipv6 socket6; 625 SFLExtended_vni tunnel_vni; 626 SFLExtended_decap tunnel_decap; 627 } SFLFlow_type; 628 629 typedef struct _SFLFlow_sample_element { 630 struct _SFLFlow_sample_element* nxt; 631 uint32_t tag; /* SFLFlow_type_tag */ 632 uint32_t length; 633 SFLFlow_type flowType; 634 } SFLFlow_sample_element; 635 636 enum SFL_sample_tag { 637 SFLFLOW_SAMPLE = 1, /* enterprise = 0 : format = 1 */ 638 SFLCOUNTERS_SAMPLE = 2, /* enterprise = 0 : format = 2 */ 639 SFLFLOW_SAMPLE_EXPANDED = 3, /* enterprise = 0 : format = 3 */ 640 SFLCOUNTERS_SAMPLE_EXPANDED = 4 /* enterprise = 0 : format = 4 */ 641 }; 642 643 typedef struct _SFLFlow_Pdu { 644 struct _SFLFlow_Pdu* nxt; 645 uint32_t num_elements; 646 SFLFlow_sample_element* elements; 647 } SFLFlow_Pdu; 648 649 650 /* Format of a single flow sample */ 651 652 typedef struct _SFLFlow_sample { 653 /* uint32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 1 */ 654 /* uint32_t length; */ 655 uint32_t sequence_number; /* Incremented with each flow sample 656 generated */ 657 uint32_t source_id; /* fsSourceId */ 658 uint32_t sampling_rate; /* fsPacketSamplingRate */ 659 uint32_t sample_pool; /* Total number of packets that could have been 660 sampled (i.e. packets skipped by sampling 661 process + total number of samples) */ 662 uint32_t drops; /* Number of times a packet was dropped due to 663 lack of resources */ 664 uint32_t input; /* SNMP ifIndex of input interface. 665 0 if interface is not known. */ 666 uint32_t output; /* SNMP ifIndex of output interface, 667 0 if interface is not known. 668 Set most significant bit to indicate 669 multiple destination interfaces 670 (i.e. in case of broadcast or multicast) 671 and set lower order bits to indicate 672 number of destination interfaces. 673 Examples: 674 0x00000002 indicates ifIndex = 2 675 0x00000000 ifIndex unknown. 676 0x80000007 indicates a packet sent 677 to 7 interfaces. 678 0x80000000 indicates a packet sent to 679 an unknown number of 680 interfaces greater than 1.*/ 681 uint32_t num_elements; 682 SFLFlow_sample_element* elements; 683 } SFLFlow_sample; 684 685 /* same thing, but the expanded version (for full 32-bit ifIndex numbers) */ 686 687 typedef struct _SFLFlow_sample_expanded { 688 /* uint32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 1 */ 689 /* uint32_t length; */ 690 uint32_t sequence_number; /* Incremented with each flow sample 691 generated */ 692 uint32_t ds_class; /* EXPANDED */ 693 uint32_t ds_index; /* EXPANDED */ 694 uint32_t sampling_rate; /* fsPacketSamplingRate */ 695 uint32_t sample_pool; /* Total number of packets that could have been 696 sampled (i.e. packets skipped by sampling 697 process + total number of samples) */ 698 uint32_t drops; /* Number of times a packet was dropped due to 699 lack of resources */ 700 uint32_t inputFormat; /* EXPANDED */ 701 uint32_t input; /* SNMP ifIndex of input interface. 702 0 if interface is not known. */ 703 uint32_t outputFormat; /* EXPANDED */ 704 uint32_t output; /* SNMP ifIndex of output interface, 705 0 if interface is not known. */ 706 uint32_t num_elements; 707 SFLFlow_sample_element* elements; 708 } SFLFlow_sample_expanded; 709 710 /* Counter types */ 711 712 /* Generic interface counters - see RFC 1573, 2233 */ 713 714 typedef struct _SFLIf_counters { 715 uint32_t ifIndex; 716 uint32_t ifType; 717 uint64_t ifSpeed; 718 uint32_t ifDirection; /* Derived from MAU MIB (RFC 2668) 719 0 = unknown, 1 = full-duplex, 720 2 = half-duplex, 3 = in, 4 = out */ 721 uint32_t ifStatus; /* bit field with the following bits assigned: 722 bit 0 = ifAdminStatus (0 = down, 1 = up) 723 bit 1 = ifOperStatus (0 = down, 1 = up) */ 724 uint64_t ifInOctets; 725 uint32_t ifInUcastPkts; 726 uint32_t ifInMulticastPkts; 727 uint32_t ifInBroadcastPkts; 728 uint32_t ifInDiscards; 729 uint32_t ifInErrors; 730 uint32_t ifInUnknownProtos; 731 uint64_t ifOutOctets; 732 uint32_t ifOutUcastPkts; 733 uint32_t ifOutMulticastPkts; 734 uint32_t ifOutBroadcastPkts; 735 uint32_t ifOutDiscards; 736 uint32_t ifOutErrors; 737 uint32_t ifPromiscuousMode; 738 } SFLIf_counters; 739 740 /* Ethernet interface counters - see RFC 2358 */ 741 typedef struct _SFLEthernet_counters { 742 uint32_t dot3StatsAlignmentErrors; 743 uint32_t dot3StatsFCSErrors; 744 uint32_t dot3StatsSingleCollisionFrames; 745 uint32_t dot3StatsMultipleCollisionFrames; 746 uint32_t dot3StatsSQETestErrors; 747 uint32_t dot3StatsDeferredTransmissions; 748 uint32_t dot3StatsLateCollisions; 749 uint32_t dot3StatsExcessiveCollisions; 750 uint32_t dot3StatsInternalMacTransmitErrors; 751 uint32_t dot3StatsCarrierSenseErrors; 752 uint32_t dot3StatsFrameTooLongs; 753 uint32_t dot3StatsInternalMacReceiveErrors; 754 uint32_t dot3StatsSymbolErrors; 755 } SFLEthernet_counters; 756 757 /* Token ring counters - see RFC 1748 */ 758 759 typedef struct _SFLTokenring_counters { 760 uint32_t dot5StatsLineErrors; 761 uint32_t dot5StatsBurstErrors; 762 uint32_t dot5StatsACErrors; 763 uint32_t dot5StatsAbortTransErrors; 764 uint32_t dot5StatsInternalErrors; 765 uint32_t dot5StatsLostFrameErrors; 766 uint32_t dot5StatsReceiveCongestions; 767 uint32_t dot5StatsFrameCopiedErrors; 768 uint32_t dot5StatsTokenErrors; 769 uint32_t dot5StatsSoftErrors; 770 uint32_t dot5StatsHardErrors; 771 uint32_t dot5StatsSignalLoss; 772 uint32_t dot5StatsTransmitBeacons; 773 uint32_t dot5StatsRecoverys; 774 uint32_t dot5StatsLobeWires; 775 uint32_t dot5StatsRemoves; 776 uint32_t dot5StatsSingles; 777 uint32_t dot5StatsFreqErrors; 778 } SFLTokenring_counters; 779 780 /* 100 BaseVG interface counters - see RFC 2020 */ 781 782 typedef struct _SFLVg_counters { 783 uint32_t dot12InHighPriorityFrames; 784 uint64_t dot12InHighPriorityOctets; 785 uint32_t dot12InNormPriorityFrames; 786 uint64_t dot12InNormPriorityOctets; 787 uint32_t dot12InIPMErrors; 788 uint32_t dot12InOversizeFrameErrors; 789 uint32_t dot12InDataErrors; 790 uint32_t dot12InNullAddressedFrames; 791 uint32_t dot12OutHighPriorityFrames; 792 uint64_t dot12OutHighPriorityOctets; 793 uint32_t dot12TransitionIntoTrainings; 794 uint64_t dot12HCInHighPriorityOctets; 795 uint64_t dot12HCInNormPriorityOctets; 796 uint64_t dot12HCOutHighPriorityOctets; 797 } SFLVg_counters; 798 799 typedef struct _SFLVlan_counters { 800 uint32_t vlan_id; 801 uint64_t octets; 802 uint32_t ucastPkts; 803 uint32_t multicastPkts; 804 uint32_t broadcastPkts; 805 uint32_t discards; 806 } SFLVlan_counters; 807 808 typedef struct _SFLWifi_counters { 809 uint32_t dot11TransmittedFragmentCount; 810 uint32_t dot11MulticastTransmittedFrameCount; 811 uint32_t dot11FailedCount; 812 uint32_t dot11RetryCount; 813 uint32_t dot11MultipleRetryCount; 814 uint32_t dot11FrameDuplicateCount; 815 uint32_t dot11RTSSuccessCount; 816 uint32_t dot11RTSFailureCount; 817 uint32_t dot11ACKFailureCount; 818 uint32_t dot11ReceivedFragmentCount; 819 uint32_t dot11MulticastReceivedFrameCount; 820 uint32_t dot11FCSErrorCount; 821 uint32_t dot11TransmittedFrameCount; 822 uint32_t dot11WEPUndecryptableCount; 823 uint32_t dot11QoSDiscardedFragmentCount; 824 uint32_t dot11AssociatedStationCount; 825 uint32_t dot11QoSCFPollsReceivedCount; 826 uint32_t dot11QoSCFPollsUnusedCount; 827 uint32_t dot11QoSCFPollsUnusableCount; 828 uint32_t dot11QoSCFPollsLostCount; 829 } SFLWifi_counters; 830 831 /* Processor Information */ 832 /* opaque = counter_data; enterprise = 0; format = 1001 */ 833 834 typedef struct _SFLProcessor_counters { 835 uint32_t five_sec_cpu; /* 5 second average CPU utilization */ 836 uint32_t one_min_cpu; /* 1 minute average CPU utilization */ 837 uint32_t five_min_cpu; /* 5 minute average CPU utilization */ 838 uint64_t total_memory; /* total memory (in bytes) */ 839 uint64_t free_memory; /* free memory (in bytes) */ 840 } SFLProcessor_counters; 841 842 typedef struct _SFLRadio_counters { 843 uint32_t elapsed_time; /* elapsed time in ms */ 844 uint32_t on_channel_time; /* time in ms spent on channel */ 845 uint32_t on_channel_busy_time; /* time in ms spent on channel and busy */ 846 } SFLRadio_counters; 847 848 /* host sflow */ 849 850 enum SFLMachine_type { 851 SFLMT_unknown = 0, 852 SFLMT_other = 1, 853 SFLMT_x86 = 2, 854 SFLMT_x86_64 = 3, 855 SFLMT_ia64 = 4, 856 SFLMT_sparc = 5, 857 SFLMT_alpha = 6, 858 SFLMT_powerpc = 7, 859 SFLMT_m68k = 8, 860 SFLMT_mips = 9, 861 SFLMT_arm = 10, 862 SFLMT_hppa = 11, 863 SFLMT_s390 = 12 864 }; 865 866 enum SFLOS_name { 867 SFLOS_unknown = 0, 868 SFLOS_other = 1, 869 SFLOS_linux = 2, 870 SFLOS_windows = 3, 871 SFLOS_darwin = 4, 872 SFLOS_hpux = 5, 873 SFLOS_aix = 6, 874 SFLOS_dragonfly = 7, 875 SFLOS_freebsd = 8, 876 SFLOS_netbsd = 9, 877 SFLOS_openbsd = 10, 878 SFLOS_osf = 11, 879 SFLOS_solaris = 12 880 }; 881 882 typedef struct _SFLMacAddress { uint8_t mac[8]; } SFLMacAddress; 883 884 typedef struct _SFLAdaptor { 885 uint32_t ifIndex; 886 uint32_t num_macs; 887 SFLMacAddress macs[1]; 888 } SFLAdaptor; 889 890 typedef struct _SFLAdaptorList { 891 uint32_t capacity; 892 uint32_t num_adaptors; 893 SFLAdaptor** adaptors; 894 } SFLAdaptorList; 895 896 typedef struct _SFLHost_parent { 897 uint32_t dsClass; /* sFlowDataSource class */ 898 uint32_t dsIndex; /* sFlowDataSource index */ 899 } SFLHost_parent; 900 901 902 #define SFL_MAX_HOSTNAME_LEN 64 903 #define SFL_MAX_OSRELEASE_LEN 32 904 905 typedef struct _SFLHostId { 906 SFLString hostname; 907 u_char uuid[16]; 908 uint32_t machine_type; /* enum SFLMachine_type */ 909 uint32_t os_name; /* enum SFLOS_name */ 910 SFLString os_release; /* max len 32 bytes */ 911 } SFLHostId; 912 913 typedef struct _SFLHost_nio_counters { 914 uint64_t bytes_in; 915 uint32_t pkts_in; 916 uint32_t errs_in; 917 uint32_t drops_in; 918 uint64_t bytes_out; 919 uint32_t pkts_out; 920 uint32_t errs_out; 921 uint32_t drops_out; 922 } SFLHost_nio_counters; 923 924 typedef struct _SFLHost_cpu_counters { 925 float load_one; /* 1 minute load avg. */ 926 float load_five; /* 5 minute load avg. */ 927 float load_fifteen; /* 15 minute load avg. */ 928 uint32_t proc_run; /* running threads */ 929 uint32_t proc_total; /* total threads */ 930 uint32_t cpu_num; /* # CPU cores */ 931 uint32_t cpu_speed; /* speed in MHz of CPU */ 932 uint32_t uptime; /* seconds since last reboot */ 933 uint32_t cpu_user; /* time executing in user mode processes (ms) */ 934 uint32_t cpu_nice; /* time executing niced processs (ms) */ 935 uint32_t cpu_system; /* time executing kernel mode processes (ms) */ 936 uint32_t cpu_idle; /* idle time (ms) */ 937 uint32_t cpu_wio; /* time waiting for I/O to complete (ms) */ 938 uint32_t cpu_intr; /* time servicing interrupts (ms) */ 939 uint32_t cpu_sintr; /* time servicing softirqs (ms) */ 940 uint32_t interrupts; /* interrupt count */ 941 uint32_t contexts; /* context switch count */ 942 } SFLHost_cpu_counters; 943 944 typedef struct _SFLHost_mem_counters { 945 uint64_t mem_total; /* total bytes */ 946 uint64_t mem_free; /* free bytes */ 947 uint64_t mem_shared; /* shared bytes */ 948 uint64_t mem_buffers; /* buffers bytes */ 949 uint64_t mem_cached; /* cached bytes */ 950 uint64_t swap_total; /* swap total bytes */ 951 uint64_t swap_free; /* swap free bytes */ 952 uint32_t page_in; /* page in count */ 953 uint32_t page_out; /* page out count */ 954 uint32_t swap_in; /* swap in count */ 955 uint32_t swap_out; /* swap out count */ 956 } SFLHost_mem_counters; 957 958 typedef struct _SFLHost_dsk_counters { 959 uint64_t disk_total; 960 uint64_t disk_free; 961 uint32_t part_max_used; /* as percent * 100, so 100==1% */ 962 uint32_t reads; /* reads issued */ 963 uint64_t bytes_read; /* bytes read */ 964 uint32_t read_time; /* read time (ms) */ 965 uint32_t writes; /* writes completed */ 966 uint64_t bytes_written; /* bytes written */ 967 uint32_t write_time; /* write time (ms) */ 968 } SFLHost_dsk_counters; 969 970 /* Virtual Node Statistics */ 971 /* opaque = counter_data; enterprise = 0; format = 2100 */ 972 973 typedef struct _SFLHost_vrt_node_counters { 974 uint32_t mhz; /* expected CPU frequency */ 975 uint32_t cpus; /* the number of active CPUs */ 976 uint64_t memory; /* memory size in bytes */ 977 uint64_t memory_free; /* unassigned memory in bytes */ 978 uint32_t num_domains; /* number of active domains */ 979 } SFLHost_vrt_node_counters; 980 981 /* Virtual Domain Statistics */ 982 /* opaque = counter_data; enterprise = 0; format = 2101 */ 983 984 /* virDomainState imported from libvirt.h */ 985 enum SFLVirDomainState { 986 SFL_VIR_DOMAIN_NOSTATE = 0, /* no state */ 987 SFL_VIR_DOMAIN_RUNNING = 1, /* the domain is running */ 988 SFL_VIR_DOMAIN_BLOCKED = 2, /* the domain is blocked on resource */ 989 SFL_VIR_DOMAIN_PAUSED = 3, /* the domain is paused by user */ 990 SFL_VIR_DOMAIN_SHUTDOWN = 4, /* the domain is being shut down */ 991 SFL_VIR_DOMAIN_SHUTOFF = 5, /* the domain is shut off */ 992 SFL_VIR_DOMAIN_CRASHED = 6 /* the domain is crashed */ 993 }; 994 995 typedef struct _SFLHost_vrt_cpu_counters { 996 uint32_t state; /* virtDomainState */ 997 uint32_t cpuTime; /* the CPU time used in mS */ 998 uint32_t cpuCount; /* number of virtual CPUs for the domain */ 999 } SFLHost_vrt_cpu_counters; 1000 1001 /* Virtual Domain Memory statistics */ 1002 /* opaque = counter_data; enterprise = 0; format = 2102 */ 1003 1004 typedef struct _SFLHost_vrt_mem_counters { 1005 uint64_t memory; /* memory in bytes used by domain */ 1006 uint64_t maxMemory; /* memory in bytes allowed */ 1007 } SFLHost_vrt_mem_counters; 1008 1009 /* Virtual Domain Disk statistics */ 1010 /* opaque = counter_data; enterprise = 0; format = 2103 */ 1011 1012 typedef struct _SFLHost_vrt_dsk_counters { 1013 uint64_t capacity; /* logical size in bytes */ 1014 uint64_t allocation; /* current allocation in bytes */ 1015 uint64_t available; /* remaining free bytes */ 1016 uint32_t rd_req; /* number of read requests */ 1017 uint64_t rd_bytes; /* number of read bytes */ 1018 uint32_t wr_req; /* number of write requests */ 1019 uint64_t wr_bytes; /* number of written bytes */ 1020 uint32_t errs; /* read/write errors */ 1021 } SFLHost_vrt_dsk_counters; 1022 1023 /* Virtual Domain Network statistics */ 1024 /* opaque = counter_data; enterprise = 0; format = 2104 */ 1025 1026 typedef struct _SFLHost_vrt_nio_counters { 1027 uint64_t bytes_in; 1028 uint32_t pkts_in; 1029 uint32_t errs_in; 1030 uint32_t drops_in; 1031 uint64_t bytes_out; 1032 uint32_t pkts_out; 1033 uint32_t errs_out; 1034 uint32_t drops_out; 1035 } SFLHost_vrt_nio_counters; 1036 1037 /* NVML statistics */ 1038 /* opaque = counter_data; enterprise = 5703, format=1 */ 1039 typedef struct _SFLHost_gpu_nvml { 1040 uint32_t device_count; /* see nvmlGetDeviceCount */ 1041 uint32_t processes; /* see nvmlDeviceGetComputeRunningProcesses */ 1042 uint32_t gpu_time; /* total milliseconds in which one or more kernels was executing on GPU */ 1043 uint32_t mem_time; /* total milliseconds during which global device memory was being 1044 read/written */ 1045 uint64_t mem_total; /* bytes. see nvmlDeviceGetMemoryInfo */ 1046 uint64_t mem_free; /* bytes. see nvmlDeviceGetMemoryInfo */ 1047 uint32_t ecc_errors; /* see nvmlDeviceGetTotalEccErrors */ 1048 uint32_t energy; /* mJ. see nvmlDeviceGetPowerUsage */ 1049 uint32_t temperature; /* C. maximum across devices - see nvmlDeviceGetTemperature */ 1050 uint32_t fan_speed; /* %. maximum across devices - see nvmlDeviceGetFanSpeed */ 1051 } SFLHost_gpu_nvml; 1052 1053 typedef struct _SFLMemcache_counters { 1054 uint32_t uptime; /* not in 2204 */ 1055 uint32_t rusage_user; /* not in 2204 */ 1056 uint32_t rusage_system; /* not in 2204 */ 1057 uint32_t cmd_get; /* not in 2204 */ 1058 uint32_t accepting_conns; /* not in 2204 */ 1059 uint32_t cmd_set; 1060 uint32_t cmd_touch; /* added for 2204 */ 1061 uint32_t cmd_flush; 1062 uint32_t get_hits; 1063 uint32_t get_misses; 1064 uint32_t delete_hits; 1065 uint32_t delete_misses; 1066 uint32_t incr_hits; 1067 uint32_t incr_misses; 1068 uint32_t decr_hits; 1069 uint32_t decr_misses; 1070 uint32_t cas_hits; 1071 uint32_t cas_misses; 1072 uint32_t cas_badval; 1073 uint32_t auth_cmds; 1074 uint32_t auth_errors; 1075 uint32_t threads; 1076 uint32_t conn_yields; 1077 uint32_t listen_disabled_num; 1078 uint32_t curr_connections; 1079 uint32_t rejected_connections; /* added for 2204 */ 1080 uint32_t total_connections; 1081 uint32_t connection_structures; 1082 uint32_t evictions; 1083 uint32_t reclaimed; /* added for 2204 */ 1084 uint32_t curr_items; 1085 uint32_t total_items; 1086 uint64_t bytes_read; 1087 uint64_t bytes_written; 1088 uint64_t bytes; 1089 uint64_t limit_maxbytes; /* converted to 64-bit for structure 2204 */ 1090 } SFLMemcache_counters; 1091 1092 typedef struct _SFLHTTP_counters { 1093 uint32_t method_option_count; 1094 uint32_t method_get_count; 1095 uint32_t method_head_count; 1096 uint32_t method_post_count; 1097 uint32_t method_put_count; 1098 uint32_t method_delete_count; 1099 uint32_t method_trace_count; 1100 uint32_t methd_connect_count; 1101 uint32_t method_other_count; 1102 uint32_t status_1XX_count; 1103 uint32_t status_2XX_count; 1104 uint32_t status_3XX_count; 1105 uint32_t status_4XX_count; 1106 uint32_t status_5XX_count; 1107 uint32_t status_other_count; 1108 } SFLHTTP_counters; 1109 1110 1111 /* Enterprise counters */ 1112 /* opaque = counter_data; enterprise = 0; format = 2202 */ 1113 typedef struct _SFLAPP_counters { 1114 SFLString application; 1115 uint32_t status_OK; 1116 uint32_t errors_OTHER; 1117 uint32_t errors_TIMEOUT; 1118 uint32_t errors_INTERNAL_ERROR; 1119 uint32_t errors_BAD_REQUEST; 1120 uint32_t errors_FORBIDDEN; 1121 uint32_t errors_TOO_LARGE; 1122 uint32_t errors_NOT_IMPLEMENTED; 1123 uint32_t errors_NOT_FOUND; 1124 uint32_t errors_UNAVAILABLE; 1125 uint32_t errors_UNAUTHORIZED; 1126 } SFLAPP_counters; 1127 1128 /* Enterprise resource counters */ 1129 /* opaque = counter_data; enterprise = 0; format = 2203 */ 1130 typedef struct { 1131 uint32_t user_time; /* in milliseconds */ 1132 uint32_t system_time; /* in milliseconds */ 1133 uint64_t mem_used; 1134 uint64_t mem_max; 1135 uint32_t fd_open; 1136 uint32_t fd_max; 1137 uint32_t conn_open; 1138 uint32_t conn_max; 1139 } SFLAPP_resources; 1140 1141 /* Enterprise application workers */ 1142 /* opaque = counter_data; enterprise = 0; format = 2206 */ 1143 1144 typedef struct { 1145 uint32_t workers_active; 1146 uint32_t workers_idle; 1147 uint32_t workers_max; 1148 uint32_t req_delayed; 1149 uint32_t req_dropped; 1150 } SFLAPP_workers; 1151 1152 typedef struct _SFLJVM_ID { 1153 SFLString vm_name; 1154 SFLString vm_vendor; 1155 SFLString vm_version; 1156 } SFLJVM_ID; 1157 1158 #define SFLJVM_MAX_VMNAME_LEN 64 1159 #define SFLJVM_MAX_VENDOR_LEN 32 1160 #define SFLJVM_MAX_VERSION_LEN 32 1161 1162 typedef struct _SFLJMX_counters { 1163 uint64_t hmem_initial; 1164 uint64_t hmem_used; 1165 uint64_t hmem_committed; 1166 uint64_t hmem_max; 1167 uint64_t nhmem_initial; 1168 uint64_t nhmem_used; 1169 uint64_t nhmem_committed; 1170 uint64_t nhmem_max; 1171 uint32_t gc_count; 1172 uint32_t gc_ms; 1173 uint32_t cls_loaded; 1174 uint32_t cls_total; 1175 uint32_t cls_unloaded; 1176 uint32_t comp_ms; 1177 uint32_t thread_live; 1178 uint32_t thread_daemon; 1179 uint32_t thread_started; 1180 uint32_t fds_open; 1181 uint32_t fds_max; 1182 } SFLJMX_counters; 1183 1184 #define XDRSIZ_JMX_COUNTERS 108 1185 1186 typedef struct _SFLVdi_counters { 1187 uint32_t sessions_current; /* number of current sessions */ 1188 uint32_t sessions_total; /* total sessions started */ 1189 uint32_t sessions_duration; /* cumulative session time (in seconds) 1190 across all sessions, such that average 1191 session duration = sessions_duration 1192 / sessions_total */ 1193 uint32_t rx_bytes; /* total bytes received */ 1194 uint32_t tx_bytes; /* total bytes sent */ 1195 uint32_t rx_packets; /* total packet received */ 1196 uint32_t tx_packets; /* total packets sent */ 1197 uint32_t rx_packets_lost; /* total received packets lost */ 1198 uint32_t tx_packets_lost; /* total sent packets lost */ 1199 uint32_t rtt_min_ms; /* minimum round trip latency with client 1200 across all current sessions 1201 measured in milliseconds */ 1202 uint32_t rtt_max_ms; /* maximum round trip latency with client 1203 across all current sessions 1204 measured in millisecond */ 1205 uint32_t rtt_avg_ms; /* average round trip latency with client 1206 across all current sessions 1207 measured in milliseconds */ 1208 uint32_t audio_rx_bytes; /* total bytes of audio data received */ 1209 uint32_t audio_tx_bytes; /* total bytes of audio data sent */ 1210 uint32_t audio_tx_limit; /* administrative limit on audio transmission 1211 bandwidth (in bits per second) */ 1212 uint32_t img_rx_bytes; /* total bytes of imaging data recieved */ 1213 uint32_t img_tx_bytes; /* total bytes of imaging data sent */ 1214 uint32_t img_frames; /* total image frames encoded */ 1215 uint32_t img_qual_min; /* minimum image encoding quality across 1216 current sessions, on a scale of 0 to 100 */ 1217 uint32_t img_qual_max; /* best image encoding quality across 1218 current sessions, on a scale of 0 to 100 */ 1219 uint32_t img_qual_avg; /* average image encoding quality across 1220 current sessions, on a scale of 0 to 100 */ 1221 uint32_t usb_rx_bytes; /* total bytes of usb data received */ 1222 uint32_t usb_tx_bytes; /* total bytes of usb data sent */ 1223 } SFLVdi_counters; 1224 1225 /* LAG Port Statistics - see IEEE8023-LAG-MIB */ 1226 /* opaque = counter_data; enterprise = 0; format = 7 */ 1227 typedef union _SFLLACP_portState { 1228 uint32_t all; 1229 struct { 1230 uint8_t actorAdmin; 1231 uint8_t actorOper; 1232 uint8_t partnerAdmin; 1233 uint8_t partnerOper; 1234 } v; 1235 } SFLLACP_portState; 1236 1237 typedef struct _SFLLACP_counters { 1238 uint8_t actorSystemID[8]; /* 6 bytes + 2 pad */ 1239 uint8_t partnerSystemID[8]; /* 6 bytes + 2 pad */ 1240 uint32_t attachedAggID; 1241 SFLLACP_portState portState; 1242 uint32_t LACPDUsRx; 1243 uint32_t markerPDUsRx; 1244 uint32_t markerResponsePDUsRx; 1245 uint32_t unknownRx; 1246 uint32_t illegalRx; 1247 uint32_t LACPDUsTx; 1248 uint32_t markerPDUsTx; 1249 uint32_t markerResponsePDUsTx; 1250 } SFLLACP_counters; 1251 1252 #define XDRSIZ_LACP_COUNTERS 56 1253 1254 /* port name */ 1255 /* opaque = counter_data; enterprise = 0; format = 1005 */ 1256 typedef struct { SFLString portName; } SFLPortName; 1257 1258 #define SFL_MAX_PORTNAME_LEN 255 1259 1260 /* Counters data */ 1261 1262 enum SFLCounters_type_tag { 1263 /* enterprise = 0, format = ... */ 1264 SFLCOUNTERS_GENERIC = 1, 1265 SFLCOUNTERS_ETHERNET = 2, 1266 SFLCOUNTERS_TOKENRING = 3, 1267 SFLCOUNTERS_VG = 4, 1268 SFLCOUNTERS_VLAN = 5, 1269 SFLCOUNTERS_80211 = 6, 1270 SFLCOUNTERS_LACP = 7, 1271 SFLCOUNTERS_PROCESSOR = 1001, 1272 SFLCOUNTERS_RADIO = 1002, 1273 SFLCOUNTERS_PORTNAME = 1005, 1274 SFLCOUNTERS_HOST_HID = 2000, /* host id */ 1275 SFLCOUNTERS_ADAPTORS = 2001, /* host adaptors */ 1276 SFLCOUNTERS_HOST_PAR = 2002, /* host parent */ 1277 SFLCOUNTERS_HOST_CPU = 2003, /* host cpu */ 1278 SFLCOUNTERS_HOST_MEM = 2004, /* host memory */ 1279 SFLCOUNTERS_HOST_DSK = 2005, /* host storage I/O */ 1280 SFLCOUNTERS_HOST_NIO = 2006, /* host network I/O */ 1281 SFLCOUNTERS_HOST_VRT_NODE = 2100, /* host virt node */ 1282 SFLCOUNTERS_HOST_VRT_CPU = 2101, /* host virt cpu */ 1283 SFLCOUNTERS_HOST_VRT_MEM = 2102, /* host virt mem */ 1284 SFLCOUNTERS_HOST_VRT_DSK = 2103, /* host virt storage */ 1285 SFLCOUNTERS_HOST_VRT_NIO = 2104, /* host virt network I/O */ 1286 SFLCOUNTERS_JVM = 2105, /* java runtime */ 1287 SFLCOUNTERS_JMX = 2106, /* java JMX stats */ 1288 SFLCOUNTERS_MEMCACHE = 2200, /* memcached (deprecated) */ 1289 SFLCOUNTERS_HTTP = 2201, /* http */ 1290 SFLCOUNTERS_APP = 2202, 1291 SFLCOUNTERS_APP_RESOURCE = 2203, 1292 SFLCOUNTERS_MEMCACHE2 = 2204, /* memcached */ 1293 SFLCOUNTERS_VDI = 2205, 1294 SFLCOUNTERS_APP_WORKERS = 2206, 1295 SFLCOUNTERS_HOST_GPU_NVML = (5703 << 12) + 1, /* = 23359489 */ 1296 }; 1297 1298 typedef union _SFLCounters_type { 1299 SFLIf_counters generic; 1300 SFLEthernet_counters ethernet; 1301 SFLTokenring_counters tokenring; 1302 SFLVg_counters vg; 1303 SFLVlan_counters vlan; 1304 SFLWifi_counters wifi; 1305 SFLProcessor_counters processor; 1306 SFLRadio_counters radio; 1307 SFLHostId hostId; 1308 SFLAdaptorList* adaptors; 1309 SFLHost_parent host_par; 1310 SFLHost_cpu_counters host_cpu; 1311 SFLHost_mem_counters host_mem; 1312 SFLHost_dsk_counters host_dsk; 1313 SFLHost_nio_counters host_nio; 1314 SFLHost_vrt_node_counters host_vrt_node; 1315 SFLHost_vrt_cpu_counters host_vrt_cpu; 1316 SFLHost_vrt_mem_counters host_vrt_mem; 1317 SFLHost_vrt_dsk_counters host_vrt_dsk; 1318 SFLHost_vrt_nio_counters host_vrt_nio; 1319 SFLHost_gpu_nvml host_gpu_nvml; 1320 SFLMemcache_counters memcache; 1321 SFLHTTP_counters http; 1322 SFLJVM_ID jvm; 1323 SFLJMX_counters jmx; 1324 SFLAPP_counters app; 1325 SFLAPP_resources appResources; 1326 SFLAPP_workers appWorkers; 1327 SFLVdi_counters vdi; 1328 SFLLACP_counters lacp; 1329 SFLPortName portName; 1330 } SFLCounters_type; 1331 1332 typedef struct _SFLCounters_sample_element { 1333 struct _SFLCounters_sample_element* nxt; /* linked list */ 1334 uint32_t tag; /* SFLCounters_type_tag */ 1335 uint32_t length; 1336 SFLCounters_type counterBlock; 1337 } SFLCounters_sample_element; 1338 1339 typedef struct _SFLCounters_sample { 1340 /* uint32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 2 */ 1341 /* uint32_t length; */ 1342 uint32_t sequence_number; /* Incremented with each counters sample 1343 generated by this source_id */ 1344 uint32_t source_id; /* fsSourceId */ 1345 uint32_t num_elements; 1346 SFLCounters_sample_element* elements; 1347 } SFLCounters_sample; 1348 1349 /* same thing, but the expanded version, so ds_index can be a full 32 bits */ 1350 typedef struct _SFLCounters_sample_expanded { 1351 /* uint32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 2 */ 1352 /* uint32_t length; */ 1353 uint32_t sequence_number; /* Incremented with each counters sample 1354 generated by this source_id */ 1355 uint32_t ds_class; /* EXPANDED */ 1356 uint32_t ds_index; /* EXPANDED */ 1357 uint32_t num_elements; 1358 SFLCounters_sample_element* elements; 1359 } SFLCounters_sample_expanded; 1360 1361 #define SFLADD_ELEMENT(_sm, _el) \ 1362 do { \ 1363 (_el)->nxt = (_sm)->elements; \ 1364 (_sm)->elements = (_el); \ 1365 } while (0) 1366 1367 /* Format of a sample datagram */ 1368 1369 enum SFLDatagram_version { 1370 SFLDATAGRAM_VERSION2 = 2, 1371 SFLDATAGRAM_VERSION4 = 4, 1372 SFLDATAGRAM_VERSION5 = 5 1373 }; 1374 1375 typedef struct _SFLSample_datagram_hdr { 1376 uint32_t datagram_version; /* (enum SFLDatagram_version) = VERSION5 = 5 */ 1377 SFLAddress agent_address; /* IP address of sampling agent */ 1378 uint32_t sub_agent_id; /* Used to distinguishing between datagram 1379 streams from separate agent sub entities 1380 within an device. */ 1381 uint32_t sequence_number; /* Incremented with each sample datagram 1382 generated */ 1383 uint32_t uptime; /* Current time (in milliseconds since device 1384 last booted). Should be set as close to 1385 datagram transmission time as possible.*/ 1386 uint32_t num_records; /* Number of tag-len-val flow/counter records to follow */ 1387 } SFLSample_datagram_hdr; 1388 1389 #define SFL_MAX_DATAGRAM_SIZE 1500 1390 #define SFL_MIN_DATAGRAM_SIZE 200 1391 #define SFL_DEFAULT_DATAGRAM_SIZE 1400 1392 1393 #define SFL_DATA_PAD 400 1394 1395 #if defined(__cplusplus) 1396 } /* extern "C" */ 1397 #endif 1398 1399 #endif /* SFLOW_H */ 1400