141c99275SPeter Avalos /* $OpenBSD: print-cnfp.c,v 1.2 1998/06/25 20:26:59 mickey Exp $ */
241c99275SPeter Avalos
341c99275SPeter Avalos /*
441c99275SPeter Avalos * Copyright (c) 1998 Michael Shalayeff
541c99275SPeter Avalos * All rights reserved.
641c99275SPeter Avalos *
741c99275SPeter Avalos * Redistribution and use in source and binary forms, with or without
841c99275SPeter Avalos * modification, are permitted provided that the following conditions
941c99275SPeter Avalos * are met:
1041c99275SPeter Avalos * 1. Redistributions of source code must retain the above copyright
1141c99275SPeter Avalos * notice, this list of conditions and the following disclaimer.
1241c99275SPeter Avalos * 2. Redistributions in binary form must reproduce the above copyright
1341c99275SPeter Avalos * notice, this list of conditions and the following disclaimer in the
1441c99275SPeter Avalos * documentation and/or other materials provided with the distribution.
1541c99275SPeter Avalos * 3. All advertising materials mentioning features or use of this software
1641c99275SPeter Avalos * must display the following acknowledgement:
1741c99275SPeter Avalos * This product includes software developed by Michael Shalayeff.
1841c99275SPeter Avalos * 4. The name of the author may not be used to endorse or promote products
1941c99275SPeter Avalos * derived from this software without specific prior written permission.
2041c99275SPeter Avalos *
2141c99275SPeter Avalos * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
2241c99275SPeter Avalos * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
2341c99275SPeter Avalos * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
2441c99275SPeter Avalos * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
2541c99275SPeter Avalos * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
2641c99275SPeter Avalos * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
2741c99275SPeter Avalos * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
2841c99275SPeter Avalos * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
2941c99275SPeter Avalos * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
3041c99275SPeter Avalos * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
3141c99275SPeter Avalos */
3241c99275SPeter Avalos
33411677aeSAaron LI /* \summary: Cisco NetFlow protocol printer */
3441c99275SPeter Avalos
35411677aeSAaron LI /*
36411677aeSAaron LI * Cisco NetFlow protocol
37411677aeSAaron LI *
38411677aeSAaron LI * See
39411677aeSAaron LI *
40*ed775ee7SAntonio Huete Jimenez * https://www.cisco.com/c/en/us/td/docs/net_mgmt/netflow_collection_engine/3-6/user/guide/format.html#wp1005892
41411677aeSAaron LI */
4241c99275SPeter Avalos
4341c99275SPeter Avalos #ifdef HAVE_CONFIG_H
44*ed775ee7SAntonio Huete Jimenez #include <config.h>
4541c99275SPeter Avalos #endif
4641c99275SPeter Avalos
47*ed775ee7SAntonio Huete Jimenez #include "netdissect-stdinc.h"
4841c99275SPeter Avalos
4941c99275SPeter Avalos #include <stdio.h>
5041c99275SPeter Avalos
51411677aeSAaron LI #include "netdissect.h"
5241c99275SPeter Avalos #include "addrtoname.h"
5341c99275SPeter Avalos #include "extract.h"
5441c99275SPeter Avalos
5541c99275SPeter Avalos #include "tcp.h"
5641c99275SPeter Avalos #include "ipproto.h"
5741c99275SPeter Avalos
58411677aeSAaron LI struct nfhdr_v1 {
59*ed775ee7SAntonio Huete Jimenez nd_uint16_t version; /* version number */
60*ed775ee7SAntonio Huete Jimenez nd_uint16_t count; /* # of records */
61*ed775ee7SAntonio Huete Jimenez nd_uint32_t msys_uptime;
62*ed775ee7SAntonio Huete Jimenez nd_uint32_t utc_sec;
63*ed775ee7SAntonio Huete Jimenez nd_uint32_t utc_nsec;
6441c99275SPeter Avalos };
6541c99275SPeter Avalos
66411677aeSAaron LI struct nfrec_v1 {
67*ed775ee7SAntonio Huete Jimenez nd_ipv4 src_ina;
68*ed775ee7SAntonio Huete Jimenez nd_ipv4 dst_ina;
69*ed775ee7SAntonio Huete Jimenez nd_ipv4 nhop_ina;
70*ed775ee7SAntonio Huete Jimenez nd_uint16_t input; /* SNMP index of input interface */
71*ed775ee7SAntonio Huete Jimenez nd_uint16_t output; /* SNMP index of output interface */
72*ed775ee7SAntonio Huete Jimenez nd_uint32_t packets; /* packets in the flow */
73*ed775ee7SAntonio Huete Jimenez nd_uint32_t octets; /* layer 3 octets in the packets of the flow */
74*ed775ee7SAntonio Huete Jimenez nd_uint32_t start_time; /* sys_uptime value at start of flow */
75*ed775ee7SAntonio Huete Jimenez nd_uint32_t last_time; /* sys_uptime value when last packet of flow was received */
76*ed775ee7SAntonio Huete Jimenez nd_uint16_t srcport; /* TCP/UDP source port or equivalent */
77*ed775ee7SAntonio Huete Jimenez nd_uint16_t dstport; /* TCP/UDP source port or equivalent */
78*ed775ee7SAntonio Huete Jimenez nd_byte pad1[2]; /* pad */
79*ed775ee7SAntonio Huete Jimenez nd_uint8_t proto; /* IP protocol type */
80*ed775ee7SAntonio Huete Jimenez nd_uint8_t tos; /* IP type of service */
81*ed775ee7SAntonio Huete Jimenez nd_uint8_t tcp_flags; /* cumulative OR of TCP flags */
82*ed775ee7SAntonio Huete Jimenez nd_byte pad[3]; /* padding */
83*ed775ee7SAntonio Huete Jimenez nd_uint32_t reserved; /* unused */
84411677aeSAaron LI };
85411677aeSAaron LI
86411677aeSAaron LI struct nfhdr_v5 {
87*ed775ee7SAntonio Huete Jimenez nd_uint16_t version; /* version number */
88*ed775ee7SAntonio Huete Jimenez nd_uint16_t count; /* # of records */
89*ed775ee7SAntonio Huete Jimenez nd_uint32_t msys_uptime;
90*ed775ee7SAntonio Huete Jimenez nd_uint32_t utc_sec;
91*ed775ee7SAntonio Huete Jimenez nd_uint32_t utc_nsec;
92*ed775ee7SAntonio Huete Jimenez nd_uint32_t sequence; /* flow sequence number */
93*ed775ee7SAntonio Huete Jimenez nd_uint8_t engine_type; /* type of flow-switching engine */
94*ed775ee7SAntonio Huete Jimenez nd_uint8_t engine_id; /* slot number of the flow-switching engine */
95*ed775ee7SAntonio Huete Jimenez nd_uint16_t sampling_interval; /* sampling mode and interval */
96411677aeSAaron LI };
97411677aeSAaron LI
98411677aeSAaron LI struct nfrec_v5 {
99*ed775ee7SAntonio Huete Jimenez nd_ipv4 src_ina;
100*ed775ee7SAntonio Huete Jimenez nd_ipv4 dst_ina;
101*ed775ee7SAntonio Huete Jimenez nd_ipv4 nhop_ina;
102*ed775ee7SAntonio Huete Jimenez nd_uint16_t input; /* SNMP index of input interface */
103*ed775ee7SAntonio Huete Jimenez nd_uint16_t output; /* SNMP index of output interface */
104*ed775ee7SAntonio Huete Jimenez nd_uint32_t packets; /* packets in the flow */
105*ed775ee7SAntonio Huete Jimenez nd_uint32_t octets; /* layer 3 octets in the packets of the flow */
106*ed775ee7SAntonio Huete Jimenez nd_uint32_t start_time; /* sys_uptime value at start of flow */
107*ed775ee7SAntonio Huete Jimenez nd_uint32_t last_time; /* sys_uptime value when last packet of flow was received */
108*ed775ee7SAntonio Huete Jimenez nd_uint16_t srcport; /* TCP/UDP source port or equivalent */
109*ed775ee7SAntonio Huete Jimenez nd_uint16_t dstport; /* TCP/UDP source port or equivalent */
110*ed775ee7SAntonio Huete Jimenez nd_byte pad1; /* pad */
111*ed775ee7SAntonio Huete Jimenez nd_uint8_t tcp_flags; /* cumulative OR of TCP flags */
112*ed775ee7SAntonio Huete Jimenez nd_uint8_t proto; /* IP protocol type */
113*ed775ee7SAntonio Huete Jimenez nd_uint8_t tos; /* IP type of service */
114*ed775ee7SAntonio Huete Jimenez nd_uint16_t src_as; /* AS number of the source */
115*ed775ee7SAntonio Huete Jimenez nd_uint16_t dst_as; /* AS number of the destination */
116*ed775ee7SAntonio Huete Jimenez nd_uint8_t src_mask; /* source address mask bits */
117*ed775ee7SAntonio Huete Jimenez nd_uint8_t dst_mask; /* destination address prefix mask bits */
118*ed775ee7SAntonio Huete Jimenez nd_byte pad2[2];
119*ed775ee7SAntonio Huete Jimenez nd_ipv4 peer_nexthop; /* v6: IP address of the nexthop within the peer (FIB)*/
12041c99275SPeter Avalos };
12141c99275SPeter Avalos
122411677aeSAaron LI struct nfhdr_v6 {
123*ed775ee7SAntonio Huete Jimenez nd_uint16_t version; /* version number */
124*ed775ee7SAntonio Huete Jimenez nd_uint16_t count; /* # of records */
125*ed775ee7SAntonio Huete Jimenez nd_uint32_t msys_uptime;
126*ed775ee7SAntonio Huete Jimenez nd_uint32_t utc_sec;
127*ed775ee7SAntonio Huete Jimenez nd_uint32_t utc_nsec;
128*ed775ee7SAntonio Huete Jimenez nd_uint32_t sequence; /* v5 flow sequence number */
129*ed775ee7SAntonio Huete Jimenez nd_uint32_t reserved; /* v5 only */
130411677aeSAaron LI };
131411677aeSAaron LI
132411677aeSAaron LI struct nfrec_v6 {
133*ed775ee7SAntonio Huete Jimenez nd_ipv4 src_ina;
134*ed775ee7SAntonio Huete Jimenez nd_ipv4 dst_ina;
135*ed775ee7SAntonio Huete Jimenez nd_ipv4 nhop_ina;
136*ed775ee7SAntonio Huete Jimenez nd_uint16_t input; /* SNMP index of input interface */
137*ed775ee7SAntonio Huete Jimenez nd_uint16_t output; /* SNMP index of output interface */
138*ed775ee7SAntonio Huete Jimenez nd_uint32_t packets; /* packets in the flow */
139*ed775ee7SAntonio Huete Jimenez nd_uint32_t octets; /* layer 3 octets in the packets of the flow */
140*ed775ee7SAntonio Huete Jimenez nd_uint32_t start_time; /* sys_uptime value at start of flow */
141*ed775ee7SAntonio Huete Jimenez nd_uint32_t last_time; /* sys_uptime value when last packet of flow was received */
142*ed775ee7SAntonio Huete Jimenez nd_uint16_t srcport; /* TCP/UDP source port or equivalent */
143*ed775ee7SAntonio Huete Jimenez nd_uint16_t dstport; /* TCP/UDP source port or equivalent */
144*ed775ee7SAntonio Huete Jimenez nd_byte pad1; /* pad */
145*ed775ee7SAntonio Huete Jimenez nd_uint8_t tcp_flags; /* cumulative OR of TCP flags */
146*ed775ee7SAntonio Huete Jimenez nd_uint8_t proto; /* IP protocol type */
147*ed775ee7SAntonio Huete Jimenez nd_uint8_t tos; /* IP type of service */
148*ed775ee7SAntonio Huete Jimenez nd_uint16_t src_as; /* AS number of the source */
149*ed775ee7SAntonio Huete Jimenez nd_uint16_t dst_as; /* AS number of the destination */
150*ed775ee7SAntonio Huete Jimenez nd_uint8_t src_mask; /* source address mask bits */
151*ed775ee7SAntonio Huete Jimenez nd_uint8_t dst_mask; /* destination address prefix mask bits */
152*ed775ee7SAntonio Huete Jimenez nd_uint16_t flags;
153*ed775ee7SAntonio Huete Jimenez nd_ipv4 peer_nexthop; /* v6: IP address of the nexthop within the peer (FIB)*/
154411677aeSAaron LI };
155411677aeSAaron LI
156411677aeSAaron LI static void
cnfp_v1_print(netdissect_options * ndo,const u_char * cp)157411677aeSAaron LI cnfp_v1_print(netdissect_options *ndo, const u_char *cp)
15841c99275SPeter Avalos {
159*ed775ee7SAntonio Huete Jimenez const struct nfhdr_v1 *nh;
160*ed775ee7SAntonio Huete Jimenez const struct nfrec_v1 *nr;
161411677aeSAaron LI const char *p_name;
162*ed775ee7SAntonio Huete Jimenez uint8_t proto;
163*ed775ee7SAntonio Huete Jimenez u_int nrecs, ver;
16441c99275SPeter Avalos #if 0
16541c99275SPeter Avalos time_t t;
16641c99275SPeter Avalos #endif
16741c99275SPeter Avalos
168411677aeSAaron LI nh = (const struct nfhdr_v1 *)cp;
169*ed775ee7SAntonio Huete Jimenez ND_TCHECK_SIZE(nh);
17041c99275SPeter Avalos
171*ed775ee7SAntonio Huete Jimenez ver = GET_BE_U_2(nh->version);
172*ed775ee7SAntonio Huete Jimenez nrecs = GET_BE_U_4(nh->count);
17341c99275SPeter Avalos #if 0
17441c99275SPeter Avalos /*
17541c99275SPeter Avalos * This is seconds since the UN*X epoch, and is followed by
17641c99275SPeter Avalos * nanoseconds. XXX - format it, rather than just dumping the
17741c99275SPeter Avalos * raw seconds-since-the-Epoch.
17841c99275SPeter Avalos */
179*ed775ee7SAntonio Huete Jimenez t = GET_BE_U_4(nh->utc_sec);
18041c99275SPeter Avalos #endif
18141c99275SPeter Avalos
182*ed775ee7SAntonio Huete Jimenez ND_PRINT("NetFlow v%x, %u.%03u uptime, %u.%09u, ", ver,
183*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nh->msys_uptime)/1000,
184*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nh->msys_uptime)%1000,
185*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nh->utc_sec), GET_BE_U_4(nh->utc_nsec));
18641c99275SPeter Avalos
187411677aeSAaron LI nr = (const struct nfrec_v1 *)&nh[1];
18841c99275SPeter Avalos
189*ed775ee7SAntonio Huete Jimenez ND_PRINT("%2u recs", nrecs);
19041c99275SPeter Avalos
191411677aeSAaron LI for (; nrecs != 0; nr++, nrecs--) {
19241c99275SPeter Avalos char buf[20];
19341c99275SPeter Avalos char asbuf[20];
19441c99275SPeter Avalos
195411677aeSAaron LI /*
196411677aeSAaron LI * Make sure we have the entire record.
197411677aeSAaron LI */
198*ed775ee7SAntonio Huete Jimenez ND_TCHECK_SIZE(nr);
199*ed775ee7SAntonio Huete Jimenez ND_PRINT("\n started %u.%03u, last %u.%03u",
200*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nr->start_time)/1000,
201*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nr->start_time)%1000,
202*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nr->last_time)/1000,
203*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nr->last_time)%1000);
20441c99275SPeter Avalos
20541c99275SPeter Avalos asbuf[0] = buf[0] = '\0';
206*ed775ee7SAntonio Huete Jimenez ND_PRINT("\n %s%s%s:%u ",
207*ed775ee7SAntonio Huete Jimenez intoa(GET_IPV4_TO_NETWORK_ORDER(nr->src_ina)),
208*ed775ee7SAntonio Huete Jimenez buf, asbuf,
209*ed775ee7SAntonio Huete Jimenez GET_BE_U_2(nr->srcport));
21041c99275SPeter Avalos
211*ed775ee7SAntonio Huete Jimenez ND_PRINT("> %s%s%s:%u ",
212*ed775ee7SAntonio Huete Jimenez intoa(GET_IPV4_TO_NETWORK_ORDER(nr->dst_ina)),
213*ed775ee7SAntonio Huete Jimenez buf, asbuf,
214*ed775ee7SAntonio Huete Jimenez GET_BE_U_2(nr->dstport));
21541c99275SPeter Avalos
216*ed775ee7SAntonio Huete Jimenez ND_PRINT(">> %s\n ",
217*ed775ee7SAntonio Huete Jimenez intoa(GET_IPV4_TO_NETWORK_ORDER(nr->nhop_ina)));
21841c99275SPeter Avalos
219*ed775ee7SAntonio Huete Jimenez proto = GET_U_1(nr->proto);
220*ed775ee7SAntonio Huete Jimenez if (!ndo->ndo_nflag && (p_name = netdb_protoname(proto)) != NULL)
221*ed775ee7SAntonio Huete Jimenez ND_PRINT("%s ", p_name);
22241c99275SPeter Avalos else
223*ed775ee7SAntonio Huete Jimenez ND_PRINT("%u ", proto);
22441c99275SPeter Avalos
22541c99275SPeter Avalos /* tcp flags for tcp only */
226*ed775ee7SAntonio Huete Jimenez if (proto == IPPROTO_TCP) {
227*ed775ee7SAntonio Huete Jimenez u_int flags;
228*ed775ee7SAntonio Huete Jimenez flags = GET_U_1(nr->tcp_flags);
229*ed775ee7SAntonio Huete Jimenez ND_PRINT("%s%s%s%s%s%s%s",
230411677aeSAaron LI flags & TH_FIN ? "F" : "",
231411677aeSAaron LI flags & TH_SYN ? "S" : "",
232411677aeSAaron LI flags & TH_RST ? "R" : "",
233411677aeSAaron LI flags & TH_PUSH ? "P" : "",
234411677aeSAaron LI flags & TH_ACK ? "A" : "",
235411677aeSAaron LI flags & TH_URG ? "U" : "",
236*ed775ee7SAntonio Huete Jimenez flags ? " " : "");
23741c99275SPeter Avalos }
23841c99275SPeter Avalos
23941c99275SPeter Avalos buf[0]='\0';
240*ed775ee7SAntonio Huete Jimenez ND_PRINT("tos %u, %u (%u octets) %s",
241*ed775ee7SAntonio Huete Jimenez GET_U_1(nr->tos),
242*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nr->packets),
243*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nr->octets), buf);
24441c99275SPeter Avalos }
245411677aeSAaron LI return;
246411677aeSAaron LI
247411677aeSAaron LI trunc:
248*ed775ee7SAntonio Huete Jimenez nd_print_trunc(ndo);
249411677aeSAaron LI }
250411677aeSAaron LI
251411677aeSAaron LI static void
cnfp_v5_print(netdissect_options * ndo,const u_char * cp)252411677aeSAaron LI cnfp_v5_print(netdissect_options *ndo, const u_char *cp)
253411677aeSAaron LI {
254*ed775ee7SAntonio Huete Jimenez const struct nfhdr_v5 *nh;
255*ed775ee7SAntonio Huete Jimenez const struct nfrec_v5 *nr;
256411677aeSAaron LI const char *p_name;
257*ed775ee7SAntonio Huete Jimenez uint8_t proto;
258*ed775ee7SAntonio Huete Jimenez u_int nrecs, ver;
259411677aeSAaron LI #if 0
260411677aeSAaron LI time_t t;
261411677aeSAaron LI #endif
262411677aeSAaron LI
263411677aeSAaron LI nh = (const struct nfhdr_v5 *)cp;
264*ed775ee7SAntonio Huete Jimenez ND_TCHECK_SIZE(nh);
265411677aeSAaron LI
266*ed775ee7SAntonio Huete Jimenez ver = GET_BE_U_2(nh->version);
267*ed775ee7SAntonio Huete Jimenez nrecs = GET_BE_U_4(nh->count);
268411677aeSAaron LI #if 0
269411677aeSAaron LI /*
270411677aeSAaron LI * This is seconds since the UN*X epoch, and is followed by
271411677aeSAaron LI * nanoseconds. XXX - format it, rather than just dumping the
272411677aeSAaron LI * raw seconds-since-the-Epoch.
273411677aeSAaron LI */
274*ed775ee7SAntonio Huete Jimenez t = GET_BE_U_4(nh->utc_sec);
275411677aeSAaron LI #endif
276411677aeSAaron LI
277*ed775ee7SAntonio Huete Jimenez ND_PRINT("NetFlow v%x, %u.%03u uptime, %u.%09u, ", ver,
278*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nh->msys_uptime)/1000,
279*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nh->msys_uptime)%1000,
280*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nh->utc_sec), GET_BE_U_4(nh->utc_nsec));
281411677aeSAaron LI
282*ed775ee7SAntonio Huete Jimenez ND_PRINT("#%u, ", GET_BE_U_4(nh->sequence));
283411677aeSAaron LI nr = (const struct nfrec_v5 *)&nh[1];
284411677aeSAaron LI
285*ed775ee7SAntonio Huete Jimenez ND_PRINT("%2u recs", nrecs);
286411677aeSAaron LI
287411677aeSAaron LI for (; nrecs != 0; nr++, nrecs--) {
288411677aeSAaron LI char buf[20];
289411677aeSAaron LI char asbuf[20];
290411677aeSAaron LI
291411677aeSAaron LI /*
292411677aeSAaron LI * Make sure we have the entire record.
293411677aeSAaron LI */
294*ed775ee7SAntonio Huete Jimenez ND_TCHECK_SIZE(nr);
295*ed775ee7SAntonio Huete Jimenez ND_PRINT("\n started %u.%03u, last %u.%03u",
296*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nr->start_time)/1000,
297*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nr->start_time)%1000,
298*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nr->last_time)/1000,
299*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nr->last_time)%1000);
300411677aeSAaron LI
301411677aeSAaron LI asbuf[0] = buf[0] = '\0';
302*ed775ee7SAntonio Huete Jimenez snprintf(buf, sizeof(buf), "/%u", GET_U_1(nr->src_mask));
303411677aeSAaron LI snprintf(asbuf, sizeof(asbuf), ":%u",
304*ed775ee7SAntonio Huete Jimenez GET_BE_U_2(nr->src_as));
305*ed775ee7SAntonio Huete Jimenez ND_PRINT("\n %s%s%s:%u ",
306*ed775ee7SAntonio Huete Jimenez intoa(GET_IPV4_TO_NETWORK_ORDER(nr->src_ina)),
307*ed775ee7SAntonio Huete Jimenez buf, asbuf,
308*ed775ee7SAntonio Huete Jimenez GET_BE_U_2(nr->srcport));
309411677aeSAaron LI
310*ed775ee7SAntonio Huete Jimenez snprintf(buf, sizeof(buf), "/%u", GET_U_1(nr->dst_mask));
311411677aeSAaron LI snprintf(asbuf, sizeof(asbuf), ":%u",
312*ed775ee7SAntonio Huete Jimenez GET_BE_U_2(nr->dst_as));
313*ed775ee7SAntonio Huete Jimenez ND_PRINT("> %s%s%s:%u ",
314*ed775ee7SAntonio Huete Jimenez intoa(GET_IPV4_TO_NETWORK_ORDER(nr->dst_ina)),
315*ed775ee7SAntonio Huete Jimenez buf, asbuf,
316*ed775ee7SAntonio Huete Jimenez GET_BE_U_2(nr->dstport));
317411677aeSAaron LI
318*ed775ee7SAntonio Huete Jimenez ND_PRINT(">> %s\n ",
319*ed775ee7SAntonio Huete Jimenez intoa(GET_IPV4_TO_NETWORK_ORDER(nr->nhop_ina)));
320411677aeSAaron LI
321*ed775ee7SAntonio Huete Jimenez proto = GET_U_1(nr->proto);
322*ed775ee7SAntonio Huete Jimenez if (!ndo->ndo_nflag && (p_name = netdb_protoname(proto)) != NULL)
323*ed775ee7SAntonio Huete Jimenez ND_PRINT("%s ", p_name);
324411677aeSAaron LI else
325*ed775ee7SAntonio Huete Jimenez ND_PRINT("%u ", proto);
326411677aeSAaron LI
327411677aeSAaron LI /* tcp flags for tcp only */
328*ed775ee7SAntonio Huete Jimenez if (proto == IPPROTO_TCP) {
329*ed775ee7SAntonio Huete Jimenez u_int flags;
330*ed775ee7SAntonio Huete Jimenez flags = GET_U_1(nr->tcp_flags);
331*ed775ee7SAntonio Huete Jimenez ND_PRINT("%s%s%s%s%s%s%s",
332411677aeSAaron LI flags & TH_FIN ? "F" : "",
333411677aeSAaron LI flags & TH_SYN ? "S" : "",
334411677aeSAaron LI flags & TH_RST ? "R" : "",
335411677aeSAaron LI flags & TH_PUSH ? "P" : "",
336411677aeSAaron LI flags & TH_ACK ? "A" : "",
337411677aeSAaron LI flags & TH_URG ? "U" : "",
338*ed775ee7SAntonio Huete Jimenez flags ? " " : "");
339411677aeSAaron LI }
340411677aeSAaron LI
341411677aeSAaron LI buf[0]='\0';
342*ed775ee7SAntonio Huete Jimenez ND_PRINT("tos %u, %u (%u octets) %s",
343*ed775ee7SAntonio Huete Jimenez GET_U_1(nr->tos),
344*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nr->packets),
345*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nr->octets), buf);
346411677aeSAaron LI }
347411677aeSAaron LI return;
348411677aeSAaron LI
349411677aeSAaron LI trunc:
350*ed775ee7SAntonio Huete Jimenez nd_print_trunc(ndo);
351411677aeSAaron LI }
352411677aeSAaron LI
353411677aeSAaron LI static void
cnfp_v6_print(netdissect_options * ndo,const u_char * cp)354411677aeSAaron LI cnfp_v6_print(netdissect_options *ndo, const u_char *cp)
355411677aeSAaron LI {
356*ed775ee7SAntonio Huete Jimenez const struct nfhdr_v6 *nh;
357*ed775ee7SAntonio Huete Jimenez const struct nfrec_v6 *nr;
358411677aeSAaron LI const char *p_name;
359*ed775ee7SAntonio Huete Jimenez uint8_t proto;
360*ed775ee7SAntonio Huete Jimenez u_int nrecs, ver;
361411677aeSAaron LI #if 0
362411677aeSAaron LI time_t t;
363411677aeSAaron LI #endif
364411677aeSAaron LI
365411677aeSAaron LI nh = (const struct nfhdr_v6 *)cp;
366*ed775ee7SAntonio Huete Jimenez ND_TCHECK_SIZE(nh);
367411677aeSAaron LI
368*ed775ee7SAntonio Huete Jimenez ver = GET_BE_U_2(nh->version);
369*ed775ee7SAntonio Huete Jimenez nrecs = GET_BE_U_4(nh->count);
370411677aeSAaron LI #if 0
371411677aeSAaron LI /*
372411677aeSAaron LI * This is seconds since the UN*X epoch, and is followed by
373411677aeSAaron LI * nanoseconds. XXX - format it, rather than just dumping the
374411677aeSAaron LI * raw seconds-since-the-Epoch.
375411677aeSAaron LI */
376*ed775ee7SAntonio Huete Jimenez t = GET_BE_U_4(nh->utc_sec);
377411677aeSAaron LI #endif
378411677aeSAaron LI
379*ed775ee7SAntonio Huete Jimenez ND_PRINT("NetFlow v%x, %u.%03u uptime, %u.%09u, ", ver,
380*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nh->msys_uptime)/1000,
381*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nh->msys_uptime)%1000,
382*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nh->utc_sec), GET_BE_U_4(nh->utc_nsec));
383411677aeSAaron LI
384*ed775ee7SAntonio Huete Jimenez ND_PRINT("#%u, ", GET_BE_U_4(nh->sequence));
385411677aeSAaron LI nr = (const struct nfrec_v6 *)&nh[1];
386411677aeSAaron LI
387*ed775ee7SAntonio Huete Jimenez ND_PRINT("%2u recs", nrecs);
388411677aeSAaron LI
389411677aeSAaron LI for (; nrecs != 0; nr++, nrecs--) {
390411677aeSAaron LI char buf[20];
391411677aeSAaron LI char asbuf[20];
392411677aeSAaron LI
393411677aeSAaron LI /*
394411677aeSAaron LI * Make sure we have the entire record.
395411677aeSAaron LI */
396*ed775ee7SAntonio Huete Jimenez ND_TCHECK_SIZE(nr);
397*ed775ee7SAntonio Huete Jimenez ND_PRINT("\n started %u.%03u, last %u.%03u",
398*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nr->start_time)/1000,
399*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nr->start_time)%1000,
400*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nr->last_time)/1000,
401*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nr->last_time)%1000);
402411677aeSAaron LI
403411677aeSAaron LI asbuf[0] = buf[0] = '\0';
404*ed775ee7SAntonio Huete Jimenez snprintf(buf, sizeof(buf), "/%u", GET_U_1(nr->src_mask));
405411677aeSAaron LI snprintf(asbuf, sizeof(asbuf), ":%u",
406*ed775ee7SAntonio Huete Jimenez GET_BE_U_2(nr->src_as));
407*ed775ee7SAntonio Huete Jimenez ND_PRINT("\n %s%s%s:%u ",
408*ed775ee7SAntonio Huete Jimenez intoa(GET_IPV4_TO_NETWORK_ORDER(nr->src_ina)),
409*ed775ee7SAntonio Huete Jimenez buf, asbuf,
410*ed775ee7SAntonio Huete Jimenez GET_BE_U_2(nr->srcport));
411411677aeSAaron LI
412*ed775ee7SAntonio Huete Jimenez snprintf(buf, sizeof(buf), "/%u", GET_U_1(nr->dst_mask));
413411677aeSAaron LI snprintf(asbuf, sizeof(asbuf), ":%u",
414*ed775ee7SAntonio Huete Jimenez GET_BE_U_2(nr->dst_as));
415*ed775ee7SAntonio Huete Jimenez ND_PRINT("> %s%s%s:%u ",
416*ed775ee7SAntonio Huete Jimenez intoa(GET_IPV4_TO_NETWORK_ORDER(nr->dst_ina)),
417*ed775ee7SAntonio Huete Jimenez buf, asbuf,
418*ed775ee7SAntonio Huete Jimenez GET_BE_U_2(nr->dstport));
419411677aeSAaron LI
420*ed775ee7SAntonio Huete Jimenez ND_PRINT(">> %s\n ",
421*ed775ee7SAntonio Huete Jimenez intoa(GET_IPV4_TO_NETWORK_ORDER(nr->nhop_ina)));
422411677aeSAaron LI
423*ed775ee7SAntonio Huete Jimenez proto = GET_U_1(nr->proto);
424*ed775ee7SAntonio Huete Jimenez if (!ndo->ndo_nflag && (p_name = netdb_protoname(proto)) != NULL)
425*ed775ee7SAntonio Huete Jimenez ND_PRINT("%s ", p_name);
426411677aeSAaron LI else
427*ed775ee7SAntonio Huete Jimenez ND_PRINT("%u ", proto);
428411677aeSAaron LI
429411677aeSAaron LI /* tcp flags for tcp only */
430*ed775ee7SAntonio Huete Jimenez if (proto == IPPROTO_TCP) {
431*ed775ee7SAntonio Huete Jimenez u_int flags;
432*ed775ee7SAntonio Huete Jimenez flags = GET_U_1(nr->tcp_flags);
433*ed775ee7SAntonio Huete Jimenez ND_PRINT("%s%s%s%s%s%s%s",
434411677aeSAaron LI flags & TH_FIN ? "F" : "",
435411677aeSAaron LI flags & TH_SYN ? "S" : "",
436411677aeSAaron LI flags & TH_RST ? "R" : "",
437411677aeSAaron LI flags & TH_PUSH ? "P" : "",
438411677aeSAaron LI flags & TH_ACK ? "A" : "",
439411677aeSAaron LI flags & TH_URG ? "U" : "",
440*ed775ee7SAntonio Huete Jimenez flags ? " " : "");
441411677aeSAaron LI }
442411677aeSAaron LI
443411677aeSAaron LI buf[0]='\0';
444411677aeSAaron LI snprintf(buf, sizeof(buf), "(%u<>%u encaps)",
445*ed775ee7SAntonio Huete Jimenez (GET_BE_U_2(nr->flags) >> 8) & 0xff,
446*ed775ee7SAntonio Huete Jimenez (GET_BE_U_2(nr->flags)) & 0xff);
447*ed775ee7SAntonio Huete Jimenez ND_PRINT("tos %u, %u (%u octets) %s",
448*ed775ee7SAntonio Huete Jimenez GET_U_1(nr->tos),
449*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nr->packets),
450*ed775ee7SAntonio Huete Jimenez GET_BE_U_4(nr->octets), buf);
451411677aeSAaron LI }
452411677aeSAaron LI return;
453411677aeSAaron LI
454411677aeSAaron LI trunc:
455*ed775ee7SAntonio Huete Jimenez nd_print_trunc(ndo);
456411677aeSAaron LI }
457411677aeSAaron LI
458411677aeSAaron LI void
cnfp_print(netdissect_options * ndo,const u_char * cp)459411677aeSAaron LI cnfp_print(netdissect_options *ndo, const u_char *cp)
460411677aeSAaron LI {
461411677aeSAaron LI int ver;
462411677aeSAaron LI
463411677aeSAaron LI /*
464411677aeSAaron LI * First 2 bytes are the version number.
465411677aeSAaron LI */
466*ed775ee7SAntonio Huete Jimenez ndo->ndo_protocol = "cnfp";
467*ed775ee7SAntonio Huete Jimenez ver = GET_BE_U_2(cp);
468411677aeSAaron LI switch (ver) {
469411677aeSAaron LI
470411677aeSAaron LI case 1:
471411677aeSAaron LI cnfp_v1_print(ndo, cp);
472411677aeSAaron LI break;
473411677aeSAaron LI
474411677aeSAaron LI case 5:
475411677aeSAaron LI cnfp_v5_print(ndo, cp);
476411677aeSAaron LI break;
477411677aeSAaron LI
478411677aeSAaron LI case 6:
479411677aeSAaron LI cnfp_v6_print(ndo, cp);
480411677aeSAaron LI break;
481411677aeSAaron LI
482411677aeSAaron LI default:
483*ed775ee7SAntonio Huete Jimenez ND_PRINT("NetFlow v%x", ver);
484411677aeSAaron LI break;
485411677aeSAaron LI }
48641c99275SPeter Avalos }
487