1 /*- 2 * Copyright (c) 2004 Gleb Smirnoff <glebius@FreeBSD.org> 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 * 26 * $SourceForge: netflow.h,v 1.8 2004/09/16 17:05:11 glebius Exp $ 27 * $FreeBSD: src/sys/netgraph/netflow/netflow.h,v 1.4 2006/04/25 20:01:50 maxim Exp $ 28 */ 29 30 /* netflow timeouts in seconds */ 31 32 #define ACTIVE_TIMEOUT (30*60) /* maximum flow lifetime is 30 min */ 33 #define INACTIVE_TIMEOUT 15 34 35 /* 36 * More info can be found in these Cisco documents: 37 * 38 * Cisco IOS NetFlow, White Papers. 39 * http://www.cisco.com/en/US/products/ps6601/prod_white_papers_list.html 40 * 41 * Cisco CNS NetFlow Collection Engine User Guide, 5.0.2, NetFlow Export 42 * Datagram Formats. 43 * http://www.cisco.com/en/US/products/sw/netmgtsw/ps1964/products_user_guide_chapter09186a00803f3147.html#wp26453 44 * 45 */ 46 47 #define NETFLOW_V1 1 48 #define NETFLOW_V5 5 49 50 struct netflow_v1_header 51 { 52 uint16_t version; /* NetFlow version */ 53 uint16_t count; /* Number of records in flow */ 54 uint32_t sys_uptime; /* System uptime */ 55 uint32_t unix_secs; /* Current seconds since 0000 UTC 1970 */ 56 uint32_t unix_nsecs; /* Remaining nanoseconds since 0000 UTC 1970 */ 57 } __attribute__((__packed__)); 58 59 struct netflow_v5_header 60 { 61 uint16_t version; /* NetFlow version */ 62 uint16_t count; /* Number of records in flow */ 63 uint32_t sys_uptime; /* System uptime */ 64 uint32_t unix_secs; /* Current seconds since 0000 UTC 1970 */ 65 uint32_t unix_nsecs; /* Remaining nanoseconds since 0000 UTC 1970 */ 66 uint32_t flow_seq; /* Sequence number of the first record */ 67 uint8_t engine_type; /* Type of flow switching engine (RP,VIP,etc.) */ 68 uint8_t engine_id; /* Slot number of the flow switching engine */ 69 uint16_t pad; /* Pad to word boundary */ 70 } __attribute__((__packed__)); 71 72 struct netflow_v1_record 73 { 74 uint32_t src_addr; /* Source IP address */ 75 uint32_t dst_addr; /* Destination IP address */ 76 uint32_t next_hop; /* Next hop IP address */ 77 uint16_t in_ifx; /* Source interface index */ 78 uint16_t out_ifx; /* Destination interface index */ 79 uint32_t packets; /* Number of packets in a flow */ 80 uint32_t octets; /* Number of octets in a flow */ 81 uint32_t first; /* System uptime at start of a flow */ 82 uint32_t last; /* System uptime at end of a flow */ 83 uint16_t s_port; /* Source port */ 84 uint16_t d_port; /* Destination port */ 85 uint16_t pad1; /* Pad to word boundary */ 86 uint8_t prot; /* IP protocol */ 87 uint8_t tos; /* IP type of service */ 88 uint8_t flags; /* Cumulative OR of tcp flags */ 89 uint8_t pad2; /* Pad to word boundary */ 90 uint16_t pad3; /* Pad to word boundary */ 91 uint8_t reserved[5]; /* Reserved for future use */ 92 } __attribute__((__packed__)); 93 94 struct netflow_v5_record 95 { 96 uint32_t src_addr; /* Source IP address */ 97 uint32_t dst_addr; /* Destination IP address */ 98 uint32_t next_hop; /* Next hop IP address */ 99 uint16_t i_ifx; /* Source interface index */ 100 uint16_t o_ifx; /* Destination interface index */ 101 uint32_t packets; /* Number of packets in a flow */ 102 uint32_t octets; /* Number of octets in a flow */ 103 uint32_t first; /* System uptime at start of a flow */ 104 uint32_t last; /* System uptime at end of a flow */ 105 uint16_t s_port; /* Source port */ 106 uint16_t d_port; /* Destination port */ 107 uint8_t pad1; /* Pad to word boundary */ 108 uint8_t flags; /* Cumulative OR of tcp flags */ 109 uint8_t prot; /* IP protocol */ 110 uint8_t tos; /* IP type of service */ 111 uint16_t src_as; /* Src peer/origin Autonomous System */ 112 uint16_t dst_as; /* Dst peer/origin Autonomous System */ 113 uint8_t src_mask; /* Source route's mask bits */ 114 uint8_t dst_mask; /* Destination route's mask bits */ 115 uint16_t pad2; /* Pad to word boundary */ 116 } __attribute__((__packed__)); 117 118 #define NETFLOW_V1_MAX_RECORDS 24 119 #define NETFLOW_V5_MAX_RECORDS 30 120 121 #define NETFLOW_V1_MAX_SIZE (sizeof(netflow_v1_header)+ \ 122 sizeof(netflow_v1_record)*NETFLOW_V1_MAX_RECORDS) 123 #define NETFLOW_V5_MAX_SIZE (sizeof(netflow_v5_header)+ \ 124 sizeof(netflow_v5_record)*NETFLOW_V5_MAX_RECORDS) 125 126 struct netflow_v5_export_dgram { 127 struct netflow_v5_header header; 128 struct netflow_v5_record r[NETFLOW_V5_MAX_RECORDS]; 129 } __attribute__((__packed__)); 130