The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 1 | /* $OpenBSD: print-cnfp.c,v 1.2 1998/06/25 20:26:59 mickey Exp $ */ |
| 2 | |
| 3 | /* |
| 4 | * Copyright (c) 1998 Michael Shalayeff |
| 5 | * All rights reserved. |
| 6 | * |
| 7 | * Redistribution and use in source and binary forms, with or without |
| 8 | * modification, are permitted provided that the following conditions |
| 9 | * are met: |
| 10 | * 1. Redistributions of source code must retain the above copyright |
| 11 | * notice, this list of conditions and the following disclaimer. |
| 12 | * 2. Redistributions in binary form must reproduce the above copyright |
| 13 | * notice, this list of conditions and the following disclaimer in the |
| 14 | * documentation and/or other materials provided with the distribution. |
| 15 | * 3. All advertising materials mentioning features or use of this software |
| 16 | * must display the following acknowledgement: |
| 17 | * This product includes software developed by Michael Shalayeff. |
| 18 | * 4. The name of the author may not be used to endorse or promote products |
| 19 | * derived from this software without specific prior written permission. |
| 20 | * |
| 21 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR |
| 22 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES |
| 23 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. |
| 24 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, |
| 25 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
| 26 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
| 27 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
| 28 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| 29 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
| 30 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 31 | */ |
| 32 | |
| 33 | /* Cisco NetFlow protocol */ |
| 34 | |
| 35 | #ifndef lint |
| 36 | static const char rcsid[] _U_ = |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 37 | "@(#) $Header: /tcpdump/master/tcpdump/print-cnfp.c,v 1.17 2005-04-20 20:53:18 guy Exp $"; |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 38 | #endif |
| 39 | |
| 40 | #ifdef HAVE_CONFIG_H |
| 41 | #include "config.h" |
| 42 | #endif |
| 43 | |
| 44 | #include <tcpdump-stdinc.h> |
| 45 | |
| 46 | #include <stdio.h> |
| 47 | #include <string.h> |
| 48 | |
| 49 | #include "interface.h" |
| 50 | #include "addrtoname.h" |
| 51 | #include "extract.h" |
| 52 | |
| 53 | #include "tcp.h" |
| 54 | #include "ipproto.h" |
| 55 | |
| 56 | struct nfhdr { |
| 57 | u_int32_t ver_cnt; /* version [15], and # of records */ |
| 58 | u_int32_t msys_uptime; |
| 59 | u_int32_t utc_sec; |
| 60 | u_int32_t utc_nsec; |
| 61 | u_int32_t sequence; /* v5 flow sequence number */ |
| 62 | u_int32_t reserved; /* v5 only */ |
| 63 | }; |
| 64 | |
| 65 | struct nfrec { |
| 66 | struct in_addr src_ina; |
| 67 | struct in_addr dst_ina; |
| 68 | struct in_addr nhop_ina; |
| 69 | u_int32_t ifaces; /* src,dst ifaces */ |
| 70 | u_int32_t packets; |
| 71 | u_int32_t octets; |
| 72 | u_int32_t start_time; /* sys_uptime value */ |
| 73 | u_int32_t last_time; /* sys_uptime value */ |
| 74 | u_int32_t ports; /* src,dst ports */ |
| 75 | u_int32_t proto_tos; /* proto, tos, pad, flags(v5) */ |
| 76 | u_int32_t asses; /* v1: flags; v5: src,dst AS */ |
| 77 | u_int32_t masks; /* src,dst addr prefix; v6: encaps */ |
| 78 | struct in_addr peer_nexthop; /* v6: IP address of the nexthop within the peer (FIB)*/ |
| 79 | }; |
| 80 | |
| 81 | void |
| 82 | cnfp_print(const u_char *cp, const u_char *bp _U_) |
| 83 | { |
| 84 | register const struct nfhdr *nh; |
| 85 | register const struct nfrec *nr; |
| 86 | struct protoent *pent; |
| 87 | int nrecs, ver; |
| 88 | #if 0 |
| 89 | time_t t; |
| 90 | #endif |
| 91 | |
| 92 | nh = (const struct nfhdr *)cp; |
| 93 | |
| 94 | if ((const u_char *)(nh + 1) > snapend) |
| 95 | return; |
| 96 | |
| 97 | nrecs = EXTRACT_32BITS(&nh->ver_cnt) & 0xffff; |
| 98 | ver = (EXTRACT_32BITS(&nh->ver_cnt) & 0xffff0000) >> 16; |
| 99 | #if 0 |
| 100 | /* |
| 101 | * This is seconds since the UN*X epoch, and is followed by |
| 102 | * nanoseconds. XXX - format it, rather than just dumping the |
| 103 | * raw seconds-since-the-Epoch. |
| 104 | */ |
| 105 | t = EXTRACT_32BITS(&nh->utc_sec); |
| 106 | #endif |
| 107 | |
| 108 | printf("NetFlow v%x, %u.%03u uptime, %u.%09u, ", ver, |
| 109 | EXTRACT_32BITS(&nh->msys_uptime)/1000, |
| 110 | EXTRACT_32BITS(&nh->msys_uptime)%1000, |
| 111 | EXTRACT_32BITS(&nh->utc_sec), EXTRACT_32BITS(&nh->utc_nsec)); |
| 112 | |
| 113 | if (ver == 5 || ver == 6) { |
| 114 | printf("#%u, ", EXTRACT_32BITS(&nh->sequence)); |
| 115 | nr = (const struct nfrec *)&nh[1]; |
| 116 | snaplen -= 24; |
| 117 | } else { |
| 118 | nr = (const struct nfrec *)&nh->sequence; |
| 119 | snaplen -= 16; |
| 120 | } |
| 121 | |
| 122 | printf("%2u recs", nrecs); |
| 123 | |
| 124 | for (; nrecs-- && (const u_char *)(nr + 1) <= snapend; nr++) { |
| 125 | char buf[20]; |
| 126 | char asbuf[20]; |
| 127 | |
| 128 | printf("\n started %u.%03u, last %u.%03u", |
| 129 | EXTRACT_32BITS(&nr->start_time)/1000, |
| 130 | EXTRACT_32BITS(&nr->start_time)%1000, |
| 131 | EXTRACT_32BITS(&nr->last_time)/1000, |
| 132 | EXTRACT_32BITS(&nr->last_time)%1000); |
| 133 | |
| 134 | asbuf[0] = buf[0] = '\0'; |
| 135 | if (ver == 5 || ver == 6) { |
| 136 | snprintf(buf, sizeof(buf), "/%u", |
| 137 | (EXTRACT_32BITS(&nr->masks) >> 24) & 0xff); |
| 138 | snprintf(asbuf, sizeof(asbuf), ":%u", |
| 139 | (EXTRACT_32BITS(&nr->asses) >> 16) & 0xffff); |
| 140 | } |
| 141 | printf("\n %s%s%s:%u ", intoa(nr->src_ina.s_addr), buf, asbuf, |
| 142 | EXTRACT_32BITS(&nr->ports) >> 16); |
| 143 | |
| 144 | if (ver == 5 || ver ==6) { |
| 145 | snprintf(buf, sizeof(buf), "/%d", |
| 146 | (EXTRACT_32BITS(&nr->masks) >> 16) & 0xff); |
| 147 | snprintf(asbuf, sizeof(asbuf), ":%u", |
| 148 | EXTRACT_32BITS(&nr->asses) & 0xffff); |
| 149 | } |
| 150 | printf("> %s%s%s:%u ", intoa(nr->dst_ina.s_addr), buf, asbuf, |
| 151 | EXTRACT_32BITS(&nr->ports) & 0xffff); |
| 152 | |
| 153 | printf(">> %s\n ", intoa(nr->nhop_ina.s_addr)); |
| 154 | |
| 155 | pent = getprotobynumber((EXTRACT_32BITS(&nr->proto_tos) >> 8) & 0xff); |
| 156 | if (!pent || nflag) |
| 157 | printf("%u ", |
| 158 | (EXTRACT_32BITS(&nr->proto_tos) >> 8) & 0xff); |
| 159 | else |
| 160 | printf("%s ", pent->p_name); |
| 161 | |
| 162 | /* tcp flags for tcp only */ |
| 163 | if (pent && pent->p_proto == IPPROTO_TCP) { |
| 164 | int flags; |
| 165 | if (ver == 1) |
| 166 | flags = (EXTRACT_32BITS(&nr->asses) >> 24) & 0xff; |
| 167 | else |
| 168 | flags = (EXTRACT_32BITS(&nr->proto_tos) >> 16) & 0xff; |
| 169 | if (flags & TH_FIN) putchar('F'); |
| 170 | if (flags & TH_SYN) putchar('S'); |
| 171 | if (flags & TH_RST) putchar('R'); |
| 172 | if (flags & TH_PUSH) putchar('P'); |
| 173 | if (flags & TH_ACK) putchar('A'); |
| 174 | if (flags & TH_URG) putchar('U'); |
| 175 | if (flags) |
| 176 | putchar(' '); |
| 177 | } |
| 178 | |
| 179 | buf[0]='\0'; |
| 180 | if (ver == 6) { |
| 181 | snprintf(buf, sizeof(buf), "(%u<>%u encaps)", |
| 182 | (EXTRACT_32BITS(&nr->masks) >> 8) & 0xff, |
| 183 | (EXTRACT_32BITS(&nr->masks)) & 0xff); |
| 184 | } |
| 185 | printf("tos %u, %u (%u octets) %s", |
| 186 | EXTRACT_32BITS(&nr->proto_tos) & 0xff, |
| 187 | EXTRACT_32BITS(&nr->packets), |
| 188 | EXTRACT_32BITS(&nr->octets), buf); |
| 189 | } |
| 190 | } |