1135332Sglebius/*- 2219182Sglebius * Copyright (c) 2010-2011 Alexander V. Chernikov <melifaro@ipfw.ru> 3135400Sglebius * Copyright (c) 2004 Gleb Smirnoff <glebius@FreeBSD.org> 4135332Sglebius * All rights reserved. 5135332Sglebius * 6135332Sglebius * Redistribution and use in source and binary forms, with or without 7135332Sglebius * modification, are permitted provided that the following conditions 8135332Sglebius * are met: 9135332Sglebius * 1. Redistributions of source code must retain the above copyright 10135332Sglebius * notice, this list of conditions and the following disclaimer. 11135332Sglebius * 2. Redistributions in binary form must reproduce the above copyright 12135332Sglebius * notice, this list of conditions and the following disclaimer in the 13135332Sglebius * documentation and/or other materials provided with the distribution. 14135332Sglebius * 15135332Sglebius * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16135332Sglebius * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17135332Sglebius * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18135332Sglebius * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19135332Sglebius * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20135332Sglebius * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21135332Sglebius * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22135332Sglebius * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23135332Sglebius * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24135332Sglebius * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25135332Sglebius * SUCH DAMAGE. 26135332Sglebius * 27135332Sglebius * $SourceForge: netflow.h,v 1.8 2004/09/16 17:05:11 glebius Exp $ 28135332Sglebius * $FreeBSD$ 29135332Sglebius */ 30135332Sglebius 31135332Sglebius/* netflow timeouts in seconds */ 32135332Sglebius 33135332Sglebius#define ACTIVE_TIMEOUT (30*60) /* maximum flow lifetime is 30 min */ 34135332Sglebius#define INACTIVE_TIMEOUT 15 35135332Sglebius 36158028Smaxim/* 37158028Smaxim * More info can be found in these Cisco documents: 38158028Smaxim * 39158028Smaxim * Cisco IOS NetFlow, White Papers. 40158028Smaxim * http://www.cisco.com/en/US/products/ps6601/prod_white_papers_list.html 41158028Smaxim * 42158028Smaxim * Cisco CNS NetFlow Collection Engine User Guide, 5.0.2, NetFlow Export 43158028Smaxim * Datagram Formats. 44158028Smaxim * http://www.cisco.com/en/US/products/sw/netmgtsw/ps1964/products_user_guide_chapter09186a00803f3147.html#wp26453 45158028Smaxim * 46219182Sglebius * Cisco Systems NetFlow Services Export Version 9 47219182Sglebius * http://www.ietf.org/rfc/rfc3954.txt 48219182Sglebius * 49135332Sglebius */ 50135332Sglebius 51135332Sglebius#define NETFLOW_V1 1 52135332Sglebius#define NETFLOW_V5 5 53219182Sglebius#define NETFLOW_V9 9 54135332Sglebius 55135332Sglebiusstruct netflow_v1_header 56135332Sglebius{ 57135332Sglebius uint16_t version; /* NetFlow version */ 58135332Sglebius uint16_t count; /* Number of records in flow */ 59135332Sglebius uint32_t sys_uptime; /* System uptime */ 60135332Sglebius uint32_t unix_secs; /* Current seconds since 0000 UTC 1970 */ 61135332Sglebius uint32_t unix_nsecs; /* Remaining nanoseconds since 0000 UTC 1970 */ 62135332Sglebius} __attribute__((__packed__)); 63135332Sglebius 64135332Sglebiusstruct netflow_v5_header 65135332Sglebius{ 66135332Sglebius uint16_t version; /* NetFlow version */ 67135332Sglebius uint16_t count; /* Number of records in flow */ 68135332Sglebius uint32_t sys_uptime; /* System uptime */ 69135332Sglebius uint32_t unix_secs; /* Current seconds since 0000 UTC 1970 */ 70135332Sglebius uint32_t unix_nsecs; /* Remaining nanoseconds since 0000 UTC 1970 */ 71135332Sglebius uint32_t flow_seq; /* Sequence number of the first record */ 72135332Sglebius uint8_t engine_type; /* Type of flow switching engine (RP,VIP,etc.) */ 73135332Sglebius uint8_t engine_id; /* Slot number of the flow switching engine */ 74135332Sglebius uint16_t pad; /* Pad to word boundary */ 75135332Sglebius} __attribute__((__packed__)); 76135332Sglebius 77219182Sglebiusstruct netflow_v9_header 78219182Sglebius{ 79219182Sglebius uint16_t version; /* NetFlow version */ 80219182Sglebius uint16_t count; /* Total number of records in packet */ 81219182Sglebius uint32_t sys_uptime; /* System uptime */ 82219182Sglebius uint32_t unix_secs; /* Current seconds since 0000 UTC 1970 */ 83219182Sglebius uint32_t seq_num; /* Sequence number */ 84219182Sglebius uint32_t source_id; /* Observation Domain id */ 85219182Sglebius} __attribute__((__packed__)); 86219182Sglebius 87135332Sglebiusstruct netflow_v1_record 88135332Sglebius{ 89135332Sglebius uint32_t src_addr; /* Source IP address */ 90135332Sglebius uint32_t dst_addr; /* Destination IP address */ 91135332Sglebius uint32_t next_hop; /* Next hop IP address */ 92135332Sglebius uint16_t in_ifx; /* Source interface index */ 93135332Sglebius uint16_t out_ifx; /* Destination interface index */ 94135332Sglebius uint32_t packets; /* Number of packets in a flow */ 95135332Sglebius uint32_t octets; /* Number of octets in a flow */ 96135332Sglebius uint32_t first; /* System uptime at start of a flow */ 97135332Sglebius uint32_t last; /* System uptime at end of a flow */ 98135332Sglebius uint16_t s_port; /* Source port */ 99135332Sglebius uint16_t d_port; /* Destination port */ 100135332Sglebius uint16_t pad1; /* Pad to word boundary */ 101158028Smaxim uint8_t prot; /* IP protocol */ 102135332Sglebius uint8_t tos; /* IP type of service */ 103135332Sglebius uint8_t flags; /* Cumulative OR of tcp flags */ 104158028Smaxim uint8_t pad2; /* Pad to word boundary */ 105135332Sglebius uint16_t pad3; /* Pad to word boundary */ 106135332Sglebius uint8_t reserved[5]; /* Reserved for future use */ 107135332Sglebius} __attribute__((__packed__)); 108135332Sglebius 109135332Sglebiusstruct netflow_v5_record 110135332Sglebius{ 111135332Sglebius uint32_t src_addr; /* Source IP address */ 112135332Sglebius uint32_t dst_addr; /* Destination IP address */ 113135332Sglebius uint32_t next_hop; /* Next hop IP address */ 114135332Sglebius uint16_t i_ifx; /* Source interface index */ 115135332Sglebius uint16_t o_ifx; /* Destination interface index */ 116135332Sglebius uint32_t packets; /* Number of packets in a flow */ 117135332Sglebius uint32_t octets; /* Number of octets in a flow */ 118135332Sglebius uint32_t first; /* System uptime at start of a flow */ 119135332Sglebius uint32_t last; /* System uptime at end of a flow */ 120135332Sglebius uint16_t s_port; /* Source port */ 121135332Sglebius uint16_t d_port; /* Destination port */ 122158028Smaxim uint8_t pad1; /* Pad to word boundary */ 123135332Sglebius uint8_t flags; /* Cumulative OR of tcp flags */ 124158028Smaxim uint8_t prot; /* IP protocol */ 125135332Sglebius uint8_t tos; /* IP type of service */ 126135332Sglebius uint16_t src_as; /* Src peer/origin Autonomous System */ 127135332Sglebius uint16_t dst_as; /* Dst peer/origin Autonomous System */ 128135332Sglebius uint8_t src_mask; /* Source route's mask bits */ 129135332Sglebius uint8_t dst_mask; /* Destination route's mask bits */ 130135332Sglebius uint16_t pad2; /* Pad to word boundary */ 131135332Sglebius} __attribute__((__packed__)); 132135332Sglebius 133135332Sglebius#define NETFLOW_V1_MAX_RECORDS 24 134135332Sglebius#define NETFLOW_V5_MAX_RECORDS 30 135135332Sglebius 136135332Sglebius#define NETFLOW_V1_MAX_SIZE (sizeof(netflow_v1_header)+ \ 137135332Sglebius sizeof(netflow_v1_record)*NETFLOW_V1_MAX_RECORDS) 138135332Sglebius#define NETFLOW_V5_MAX_SIZE (sizeof(netflow_v5_header)+ \ 139135332Sglebius sizeof(netflow_v5_record)*NETFLOW_V5_MAX_RECORDS) 140146092Sglebius 141146092Sglebiusstruct netflow_v5_export_dgram { 142146092Sglebius struct netflow_v5_header header; 143146092Sglebius struct netflow_v5_record r[NETFLOW_V5_MAX_RECORDS]; 144146092Sglebius} __attribute__((__packed__)); 145219182Sglebius 146219182Sglebius 147219182Sglebius/* RFC3954 field definitions */ 148219182Sglebius#define NETFLOW_V9_FIELD_IN_BYTES 1 /* Input bytes count for a flow. Default 4, can be 8 */ 149219182Sglebius#define NETFLOW_V9_FIELD_IN_PKTS 2 /* Incoming counter with number of packets associated with an IP Flow. Default 4 */ 150219182Sglebius#define NETFLOW_V9_FIELD_FLOWS 3 /* Number of Flows that were aggregated. Default 4 */ 151219182Sglebius#define NETFLOW_V9_FIELD_PROTOCOL 4 /* IP protocol byte. 1 */ 152219182Sglebius#define NETFLOW_V9_FIELD_TOS 5 /* Type of service byte setting when entering the incoming interface. 1 */ 153219182Sglebius#define NETFLOW_V9_FIELD_TCP_FLAGS 6 /* TCP flags; cumulative of all the TCP flags seen in this Flow. 1 */ 154219182Sglebius#define NETFLOW_V9_FIELD_L4_SRC_PORT 7 /* TCP/UDP source port number. 2 */ 155219182Sglebius#define NETFLOW_V9_FIELD_IPV4_SRC_ADDR 8 /* IPv4 source address. 4 */ 156219182Sglebius#define NETFLOW_V9_FIELD_SRC_MASK 9 /* The number of contiguous bits in the source subnet mask (i.e., the mask in slash notation). 1 */ 157219182Sglebius#define NETFLOW_V9_FIELD_INPUT_SNMP 10 /* Input interface index. Default 2 */ 158219182Sglebius#define NETFLOW_V9_FIELD_L4_DST_PORT 11 /* TCP/UDP destination port number. 2 */ 159219182Sglebius#define NETFLOW_V9_FIELD_IPV4_DST_ADDR 12 /* IPv4 destination address. 4 */ 160219182Sglebius#define NETFLOW_V9_FIELD_DST_MASK 13 /* The number of contiguous bits in the destination subnet mask (i.e., the mask in slash notation). 1 */ 161219182Sglebius#define NETFLOW_V9_FIELD_OUTPUT_SNMP 14 /* Output interface index. Default 2 */ 162219182Sglebius#define NETFLOW_V9_FIELD_IPV4_NEXT_HOP 15 /* IPv4 address of the next-hop router. 4 */ 163219182Sglebius#define NETFLOW_V9_FIELD_SRC_AS 16 /* Source BGP autonomous system number. Default 2, can be 4 */ 164219182Sglebius#define NETFLOW_V9_FIELD_DST_AS 17 /* Destination BGP autonomous system number. Default 2, can be 4 */ 165219182Sglebius#define NETFLOW_V9_FIELD_BGP_IPV4_NEXT_HOP 18 /* Next-hop router's IP address in the BGP domain. 4 */ 166219182Sglebius#define NETFLOW_V9_FIELD_MUL_DST_PKTS 19 /* IP multicast outgoing packet counter for packets associated with IP flow. Default 4 */ 167219182Sglebius#define NETFLOW_V9_FIELD_MUL_DST_BYTES 20 /* IP multicast outgoing Octet (byte) counter for the number of bytes associated with IP flow. Default 4 */ 168219182Sglebius#define NETFLOW_V9_FIELD_LAST_SWITCHED 21 /* sysUptime in msec at which the last packet of this Flow was switched. 4 */ 169219182Sglebius#define NETFLOW_V9_FIELD_FIRST_SWITCHED 22 /* sysUptime in msec at which the first packet of this Flow was switched. 4 */ 170219182Sglebius#define NETFLOW_V9_FIELD_OUT_BYTES 23 /* Outgoing counter for the number of bytes associated with an IP Flow. Default 4 */ 171219182Sglebius#define NETFLOW_V9_FIELD_OUT_PKTS 24 /* Outgoing counter for the number of packets associated with an IP Flow. Default 4 */ 172219182Sglebius#define NETFLOW_V9_FIELD_IPV6_SRC_ADDR 27 /* IPv6 source address. 16 */ 173219182Sglebius#define NETFLOW_V9_FIELD_IPV6_DST_ADDR 28 /* IPv6 destination address. 16 */ 174219182Sglebius#define NETFLOW_V9_FIELD_IPV6_SRC_MASK 29 /* Length of the IPv6 source mask in contiguous bits. 1 */ 175219182Sglebius#define NETFLOW_V9_FIELD_IPV6_DST_MASK 30 /* Length of the IPv6 destination mask in contiguous bits. 1 */ 176219182Sglebius#define NETFLOW_V9_FIELD_IPV6_FLOW_LABEL 31 /* IPv6 flow label as per RFC 2460 definition. 3 */ 177219182Sglebius#define NETFLOW_V9_FIELD_ICMP_TYPE 32 /* Internet Control Message Protocol (ICMP) packet type; reported as ICMP Type * 256 + ICMP code. 2 */ 178219182Sglebius#define NETFLOW_V9_FIELD_MUL_IGMP_TYPE 33 /* Internet Group Management Protocol (IGMP) packet type. 1 */ 179219182Sglebius#define NETFLOW_V9_FIELD_SAMPLING_INTERVAL 34 /* When using sampled NetFlow, the rate at which packets are sampled; for example, a value of 100 indicates that one of every hundred packets is sampled. 4 */ 180219182Sglebius#define NETFLOW_V9_FIELD_SAMPLING_ALGORITHM 35 /* For sampled NetFlow platform-wide: 0x01 deterministic sampling 0x02 random sampling. 1 */ 181219182Sglebius#define NETFLOW_V9_FIELD_FLOW_ACTIVE_TIMEOUT 36 /* Timeout value (in seconds) for active flow entries in the NetFlow cache. 2 */ 182219182Sglebius#define NETFLOW_V9_FIELD_FLOW_INACTIVE_TIMEOUT 37 /* Timeout value (in seconds) for inactive Flow entries in the NetFlow cache. 2 */ 183219182Sglebius#define NETFLOW_V9_FIELD_ENGINE_TYPE 38 /* Type of Flow switching engine (route processor, linecard, etc...). 1 */ 184219182Sglebius#define NETFLOW_V9_FIELD_ENGINE_ID 39 /* ID number of the Flow switching engine. 1 */ 185219182Sglebius#define NETFLOW_V9_FIELD_TOTAL_BYTES_EXP 40 /* Counter with for the number of bytes exported by the Observation Domain. Default 4 */ 186219182Sglebius#define NETFLOW_V9_FIELD_TOTAL_PKTS_EXP 41 /* Counter with for the number of packets exported by the Observation Domain. Default 4 */ 187219182Sglebius#define NETFLOW_V9_FIELD_TOTAL_FLOWS_EXP 42 /* Counter with for the number of flows exported by the Observation Domain. Default 4 */ 188219182Sglebius#define NETFLOW_V9_FIELD_MPLS_TOP_LABEL_TYPE 46 /* MPLS Top Label Type. 1 */ 189219182Sglebius#define NETFLOW_V9_FIELD_MPLS_TOP_LABEL_IP_ADDR 47 /* Forwarding Equivalent Class corresponding to the MPLS Top Label. 4 */ 190219182Sglebius#define NETFLOW_V9_FIELD_FLOW_SAMPLER_ID 48 /* Identifier shown in "show flow-sampler". 1 */ 191219182Sglebius#define NETFLOW_V9_FIELD_FLOW_SAMPLER_MODE 49 /* The type of algorithm used for sampling data. 2 */ 192219182Sglebius#define NETFLOW_V9_FIELD_FLOW_SAMPLER_RANDOM_INTERVAL 50 /* Packet interval at which to sample. 4. */ 193219182Sglebius#define NETFLOW_V9_FIELD_DST_TOS 55 /* Type of Service byte setting when exiting outgoing interface. 1. */ 194219182Sglebius#define NETFLOW_V9_FIELD_SRC_MAC 56 /* Source MAC Address. 6 */ 195219182Sglebius#define NETFLOW_V9_FIELD_DST_MAC 57 /* Destination MAC Address. 6 */ 196219182Sglebius#define NETFLOW_V9_FIELD_SRC_VLAN 58 /* Virtual LAN identifier associated with ingress interface. 2 */ 197219182Sglebius#define NETFLOW_V9_FIELD_DST_VLAN 59 /* Virtual LAN identifier associated with egress interface. 2 */ 198219182Sglebius#define NETFLOW_V9_FIELD_IP_PROTOCOL_VERSION 60 /* Internet Protocol Version. Set to 4 for IPv4, set to 6 for IPv6. If not present in the template, then version 4 is assumed. 1. */ 199219182Sglebius#define NETFLOW_V9_FIELD_DIRECTION 61 /* Flow direction: 0 - ingress flow 1 - egress flow. 1 */ 200219182Sglebius#define NETFLOW_V9_FIELD_IPV6_NEXT_HOP 62 /* IPv6 address of the next-hop router. 16 */ 201219182Sglebius#define NETFLOW_V9_FIELD_BGP_IPV6_NEXT_HOP 63 /* Next-hop router in the BGP domain. 16 */ 202219182Sglebius#define NETFLOW_V9_FIELD_IPV6_OPTION_HEADERS 64 /* Bit-encoded field identifying IPv6 option headers found in the flow */ 203219182Sglebius#define NETFLOW_V9_FIELD_MPLS_LABEL_1 70 /* MPLS label at position 1 in the stack. 3 */ 204219182Sglebius#define NETFLOW_V9_FIELD_MPLS_LABEL_2 71 /* MPLS label at position 2 in the stack. 3 */ 205219182Sglebius#define NETFLOW_V9_FIELD_MPLS_LABEL_3 72 /* MPLS label at position 3 in the stack. 3 */ 206219182Sglebius#define NETFLOW_V9_FIELD_MPLS_LABEL_4 73 /* MPLS label at position 4 in the stack. 3 */ 207219182Sglebius#define NETFLOW_V9_FIELD_MPLS_LABEL_5 74 /* MPLS label at position 5 in the stack. 3 */ 208219182Sglebius#define NETFLOW_V9_FIELD_MPLS_LABEL_6 75 /* MPLS label at position 6 in the stack. 3 */ 209219182Sglebius#define NETFLOW_V9_FIELD_MPLS_LABEL_7 76 /* MPLS label at position 7 in the stack. 3 */ 210219182Sglebius#define NETFLOW_V9_FIELD_MPLS_LABEL_8 77 /* MPLS label at position 8 in the stack. 3 */ 211219182Sglebius#define NETFLOW_V9_FIELD_MPLS_LABEL_9 78 /* MPLS label at position 9 in the stack. 3 */ 212219182Sglebius#define NETFLOW_V9_FIELD_MPLS_LABEL_10 79 /* MPLS label at position 10 in the stack. 3 */ 213219182Sglebius 214219182Sglebius#define NETFLOW_V9_MAX_RESERVED_FLOWSET 0xFF /* Clause 5.2 */ 215