1 /* $OpenBSD: print-cnfp.c,v 1.2 1998/06/25 20:26:59 mickey Exp $ */
2
3 /*
4 * Copyright (c) 1998 Michael Shalayeff
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. All advertising materials mentioning features or use of this software
16 * must display the following acknowledgement:
17 * This product includes software developed by Michael Shalayeff.
18 * 4. The name of the author may not be used to endorse or promote products
19 * derived from this software without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31 */
32
33 /* \summary: Cisco NetFlow protocol printer */
34
35 /*
36 * Cisco NetFlow protocol
37 *
38 * See
39 *
40 * http://www.cisco.com/c/en/us/td/docs/net_mgmt/netflow_collection_engine/3-6/user/guide/format.html#wp1005892
41 */
42
43 #ifdef HAVE_CONFIG_H
44 #include "config.h"
45 #endif
46
47 #include <netdissect-stdinc.h>
48
49 #include <stdio.h>
50 #include <string.h>
51
52 #include "netdissect.h"
53 #include "addrtoname.h"
54 #include "extract.h"
55
56 #include "tcp.h"
57 #include "ipproto.h"
58
59 struct nfhdr_v1 {
60 uint16_t version; /* version number */
61 uint16_t count; /* # of records */
62 uint32_t msys_uptime;
63 uint32_t utc_sec;
64 uint32_t utc_nsec;
65 };
66
67 struct nfrec_v1 {
68 struct in_addr src_ina;
69 struct in_addr dst_ina;
70 struct in_addr nhop_ina;
71 uint16_t input; /* SNMP index of input interface */
72 uint16_t output; /* SNMP index of output interface */
73 uint32_t packets; /* packets in the flow */
74 uint32_t octets; /* layer 3 octets in the packets of the flow */
75 uint32_t start_time; /* sys_uptime value at start of flow */
76 uint32_t last_time; /* sys_uptime value when last packet of flow was received */
77 uint16_t srcport; /* TCP/UDP source port or equivalent */
78 uint16_t dstport; /* TCP/UDP source port or equivalent */
79 uint16_t pad1; /* pad */
80 uint8_t proto; /* IP protocol type */
81 uint8_t tos; /* IP type of service */
82 uint8_t tcp_flags; /* cumulative OR of TCP flags */
83 uint8_t pad[3]; /* padding */
84 uint32_t reserved; /* unused */
85 };
86
87 struct nfhdr_v5 {
88 uint16_t version; /* version number */
89 uint16_t count; /* # of records */
90 uint32_t msys_uptime;
91 uint32_t utc_sec;
92 uint32_t utc_nsec;
93 uint32_t sequence; /* flow sequence number */
94 uint8_t engine_type; /* type of flow-switching engine */
95 uint8_t engine_id; /* slot number of the flow-switching engine */
96 uint16_t sampling_interval; /* sampling mode and interval */
97 };
98
99 struct nfrec_v5 {
100 struct in_addr src_ina;
101 struct in_addr dst_ina;
102 struct in_addr nhop_ina;
103 uint16_t input; /* SNMP index of input interface */
104 uint16_t output; /* SNMP index of output interface */
105 uint32_t packets; /* packets in the flow */
106 uint32_t octets; /* layer 3 octets in the packets of the flow */
107 uint32_t start_time; /* sys_uptime value at start of flow */
108 uint32_t last_time; /* sys_uptime value when last packet of flow was received */
109 uint16_t srcport; /* TCP/UDP source port or equivalent */
110 uint16_t dstport; /* TCP/UDP source port or equivalent */
111 uint8_t pad1; /* pad */
112 uint8_t tcp_flags; /* cumulative OR of TCP flags */
113 uint8_t proto; /* IP protocol type */
114 uint8_t tos; /* IP type of service */
115 uint16_t src_as; /* AS number of the source */
116 uint16_t dst_as; /* AS number of the destination */
117 uint8_t src_mask; /* source address mask bits */
118 uint8_t dst_mask; /* destination address prefix mask bits */
119 uint16_t pad2;
120 struct in_addr peer_nexthop; /* v6: IP address of the nexthop within the peer (FIB)*/
121 };
122
123 struct nfhdr_v6 {
124 uint16_t version; /* version number */
125 uint16_t count; /* # of records */
126 uint32_t msys_uptime;
127 uint32_t utc_sec;
128 uint32_t utc_nsec;
129 uint32_t sequence; /* v5 flow sequence number */
130 uint32_t reserved; /* v5 only */
131 };
132
133 struct nfrec_v6 {
134 struct in_addr src_ina;
135 struct in_addr dst_ina;
136 struct in_addr nhop_ina;
137 uint16_t input; /* SNMP index of input interface */
138 uint16_t output; /* SNMP index of output interface */
139 uint32_t packets; /* packets in the flow */
140 uint32_t octets; /* layer 3 octets in the packets of the flow */
141 uint32_t start_time; /* sys_uptime value at start of flow */
142 uint32_t last_time; /* sys_uptime value when last packet of flow was received */
143 uint16_t srcport; /* TCP/UDP source port or equivalent */
144 uint16_t dstport; /* TCP/UDP source port or equivalent */
145 uint8_t pad1; /* pad */
146 uint8_t tcp_flags; /* cumulative OR of TCP flags */
147 uint8_t proto; /* IP protocol type */
148 uint8_t tos; /* IP type of service */
149 uint16_t src_as; /* AS number of the source */
150 uint16_t dst_as; /* AS number of the destination */
151 uint8_t src_mask; /* source address mask bits */
152 uint8_t dst_mask; /* destination address prefix mask bits */
153 uint16_t flags;
154 struct in_addr peer_nexthop; /* v6: IP address of the nexthop within the peer (FIB)*/
155 };
156
157 static void
cnfp_v1_print(netdissect_options * ndo,const u_char * cp)158 cnfp_v1_print(netdissect_options *ndo, const u_char *cp)
159 {
160 register const struct nfhdr_v1 *nh;
161 register const struct nfrec_v1 *nr;
162 struct protoent *pent;
163 int nrecs, ver;
164 #if 0
165 time_t t;
166 #endif
167
168 nh = (const struct nfhdr_v1 *)cp;
169 ND_TCHECK(*nh);
170
171 ver = EXTRACT_16BITS(&nh->version);
172 nrecs = EXTRACT_32BITS(&nh->count);
173 #if 0
174 /*
175 * This is seconds since the UN*X epoch, and is followed by
176 * nanoseconds. XXX - format it, rather than just dumping the
177 * raw seconds-since-the-Epoch.
178 */
179 t = EXTRACT_32BITS(&nh->utc_sec);
180 #endif
181
182 ND_PRINT((ndo, "NetFlow v%x, %u.%03u uptime, %u.%09u, ", ver,
183 EXTRACT_32BITS(&nh->msys_uptime)/1000,
184 EXTRACT_32BITS(&nh->msys_uptime)%1000,
185 EXTRACT_32BITS(&nh->utc_sec), EXTRACT_32BITS(&nh->utc_nsec)));
186
187 nr = (const struct nfrec_v1 *)&nh[1];
188
189 ND_PRINT((ndo, "%2u recs", nrecs));
190
191 for (; nrecs != 0; nr++, nrecs--) {
192 char buf[20];
193 char asbuf[20];
194
195 /*
196 * Make sure we have the entire record.
197 */
198 ND_TCHECK(*nr);
199 ND_PRINT((ndo, "\n started %u.%03u, last %u.%03u",
200 EXTRACT_32BITS(&nr->start_time)/1000,
201 EXTRACT_32BITS(&nr->start_time)%1000,
202 EXTRACT_32BITS(&nr->last_time)/1000,
203 EXTRACT_32BITS(&nr->last_time)%1000));
204
205 asbuf[0] = buf[0] = '\0';
206 ND_PRINT((ndo, "\n %s%s%s:%u ", intoa(nr->src_ina.s_addr), buf, asbuf,
207 EXTRACT_16BITS(&nr->srcport)));
208
209 ND_PRINT((ndo, "> %s%s%s:%u ", intoa(nr->dst_ina.s_addr), buf, asbuf,
210 EXTRACT_16BITS(&nr->dstport)));
211
212 ND_PRINT((ndo, ">> %s\n ", intoa(nr->nhop_ina.s_addr)));
213
214 pent = getprotobynumber(nr->proto);
215 if (!pent || ndo->ndo_nflag)
216 ND_PRINT((ndo, "%u ", nr->proto));
217 else
218 ND_PRINT((ndo, "%s ", pent->p_name));
219
220 /* tcp flags for tcp only */
221 if (pent && pent->p_proto == IPPROTO_TCP) {
222 int flags;
223 flags = nr->tcp_flags;
224 ND_PRINT((ndo, "%s%s%s%s%s%s%s",
225 flags & TH_FIN ? "F" : "",
226 flags & TH_SYN ? "S" : "",
227 flags & TH_RST ? "R" : "",
228 flags & TH_PUSH ? "P" : "",
229 flags & TH_ACK ? "A" : "",
230 flags & TH_URG ? "U" : "",
231 flags ? " " : ""));
232 }
233
234 buf[0]='\0';
235 ND_PRINT((ndo, "tos %u, %u (%u octets) %s",
236 nr->tos,
237 EXTRACT_32BITS(&nr->packets),
238 EXTRACT_32BITS(&nr->octets), buf));
239 }
240 return;
241
242 trunc:
243 ND_PRINT((ndo, "[|cnfp]"));
244 return;
245 }
246
247 static void
cnfp_v5_print(netdissect_options * ndo,const u_char * cp)248 cnfp_v5_print(netdissect_options *ndo, const u_char *cp)
249 {
250 register const struct nfhdr_v5 *nh;
251 register const struct nfrec_v5 *nr;
252 struct protoent *pent;
253 int nrecs, ver;
254 #if 0
255 time_t t;
256 #endif
257
258 nh = (const struct nfhdr_v5 *)cp;
259 ND_TCHECK(*nh);
260
261 ver = EXTRACT_16BITS(&nh->version);
262 nrecs = EXTRACT_32BITS(&nh->count);
263 #if 0
264 /*
265 * This is seconds since the UN*X epoch, and is followed by
266 * nanoseconds. XXX - format it, rather than just dumping the
267 * raw seconds-since-the-Epoch.
268 */
269 t = EXTRACT_32BITS(&nh->utc_sec);
270 #endif
271
272 ND_PRINT((ndo, "NetFlow v%x, %u.%03u uptime, %u.%09u, ", ver,
273 EXTRACT_32BITS(&nh->msys_uptime)/1000,
274 EXTRACT_32BITS(&nh->msys_uptime)%1000,
275 EXTRACT_32BITS(&nh->utc_sec), EXTRACT_32BITS(&nh->utc_nsec)));
276
277 ND_PRINT((ndo, "#%u, ", EXTRACT_32BITS(&nh->sequence)));
278 nr = (const struct nfrec_v5 *)&nh[1];
279
280 ND_PRINT((ndo, "%2u recs", nrecs));
281
282 for (; nrecs != 0; nr++, nrecs--) {
283 char buf[20];
284 char asbuf[20];
285
286 /*
287 * Make sure we have the entire record.
288 */
289 ND_TCHECK(*nr);
290 ND_PRINT((ndo, "\n started %u.%03u, last %u.%03u",
291 EXTRACT_32BITS(&nr->start_time)/1000,
292 EXTRACT_32BITS(&nr->start_time)%1000,
293 EXTRACT_32BITS(&nr->last_time)/1000,
294 EXTRACT_32BITS(&nr->last_time)%1000));
295
296 asbuf[0] = buf[0] = '\0';
297 snprintf(buf, sizeof(buf), "/%u", nr->src_mask);
298 snprintf(asbuf, sizeof(asbuf), ":%u",
299 EXTRACT_16BITS(&nr->src_as));
300 ND_PRINT((ndo, "\n %s%s%s:%u ", intoa(nr->src_ina.s_addr), buf, asbuf,
301 EXTRACT_16BITS(&nr->srcport)));
302
303 snprintf(buf, sizeof(buf), "/%d", nr->dst_mask);
304 snprintf(asbuf, sizeof(asbuf), ":%u",
305 EXTRACT_16BITS(&nr->dst_as));
306 ND_PRINT((ndo, "> %s%s%s:%u ", intoa(nr->dst_ina.s_addr), buf, asbuf,
307 EXTRACT_16BITS(&nr->dstport)));
308
309 ND_PRINT((ndo, ">> %s\n ", intoa(nr->nhop_ina.s_addr)));
310
311 pent = getprotobynumber(nr->proto);
312 if (!pent || ndo->ndo_nflag)
313 ND_PRINT((ndo, "%u ", nr->proto));
314 else
315 ND_PRINT((ndo, "%s ", pent->p_name));
316
317 /* tcp flags for tcp only */
318 if (pent && pent->p_proto == IPPROTO_TCP) {
319 int flags;
320 flags = nr->tcp_flags;
321 ND_PRINT((ndo, "%s%s%s%s%s%s%s",
322 flags & TH_FIN ? "F" : "",
323 flags & TH_SYN ? "S" : "",
324 flags & TH_RST ? "R" : "",
325 flags & TH_PUSH ? "P" : "",
326 flags & TH_ACK ? "A" : "",
327 flags & TH_URG ? "U" : "",
328 flags ? " " : ""));
329 }
330
331 buf[0]='\0';
332 ND_PRINT((ndo, "tos %u, %u (%u octets) %s",
333 nr->tos,
334 EXTRACT_32BITS(&nr->packets),
335 EXTRACT_32BITS(&nr->octets), buf));
336 }
337 return;
338
339 trunc:
340 ND_PRINT((ndo, "[|cnfp]"));
341 return;
342 }
343
344 static void
cnfp_v6_print(netdissect_options * ndo,const u_char * cp)345 cnfp_v6_print(netdissect_options *ndo, const u_char *cp)
346 {
347 register const struct nfhdr_v6 *nh;
348 register const struct nfrec_v6 *nr;
349 struct protoent *pent;
350 int nrecs, ver;
351 #if 0
352 time_t t;
353 #endif
354
355 nh = (const struct nfhdr_v6 *)cp;
356 ND_TCHECK(*nh);
357
358 ver = EXTRACT_16BITS(&nh->version);
359 nrecs = EXTRACT_32BITS(&nh->count);
360 #if 0
361 /*
362 * This is seconds since the UN*X epoch, and is followed by
363 * nanoseconds. XXX - format it, rather than just dumping the
364 * raw seconds-since-the-Epoch.
365 */
366 t = EXTRACT_32BITS(&nh->utc_sec);
367 #endif
368
369 ND_PRINT((ndo, "NetFlow v%x, %u.%03u uptime, %u.%09u, ", ver,
370 EXTRACT_32BITS(&nh->msys_uptime)/1000,
371 EXTRACT_32BITS(&nh->msys_uptime)%1000,
372 EXTRACT_32BITS(&nh->utc_sec), EXTRACT_32BITS(&nh->utc_nsec)));
373
374 ND_PRINT((ndo, "#%u, ", EXTRACT_32BITS(&nh->sequence)));
375 nr = (const struct nfrec_v6 *)&nh[1];
376
377 ND_PRINT((ndo, "%2u recs", nrecs));
378
379 for (; nrecs != 0; nr++, nrecs--) {
380 char buf[20];
381 char asbuf[20];
382
383 /*
384 * Make sure we have the entire record.
385 */
386 ND_TCHECK(*nr);
387 ND_PRINT((ndo, "\n started %u.%03u, last %u.%03u",
388 EXTRACT_32BITS(&nr->start_time)/1000,
389 EXTRACT_32BITS(&nr->start_time)%1000,
390 EXTRACT_32BITS(&nr->last_time)/1000,
391 EXTRACT_32BITS(&nr->last_time)%1000));
392
393 asbuf[0] = buf[0] = '\0';
394 snprintf(buf, sizeof(buf), "/%u", nr->src_mask);
395 snprintf(asbuf, sizeof(asbuf), ":%u",
396 EXTRACT_16BITS(&nr->src_as));
397 ND_PRINT((ndo, "\n %s%s%s:%u ", intoa(nr->src_ina.s_addr), buf, asbuf,
398 EXTRACT_16BITS(&nr->srcport)));
399
400 snprintf(buf, sizeof(buf), "/%d", nr->dst_mask);
401 snprintf(asbuf, sizeof(asbuf), ":%u",
402 EXTRACT_16BITS(&nr->dst_as));
403 ND_PRINT((ndo, "> %s%s%s:%u ", intoa(nr->dst_ina.s_addr), buf, asbuf,
404 EXTRACT_16BITS(&nr->dstport)));
405
406 ND_PRINT((ndo, ">> %s\n ", intoa(nr->nhop_ina.s_addr)));
407
408 pent = getprotobynumber(nr->proto);
409 if (!pent || ndo->ndo_nflag)
410 ND_PRINT((ndo, "%u ", nr->proto));
411 else
412 ND_PRINT((ndo, "%s ", pent->p_name));
413
414 /* tcp flags for tcp only */
415 if (pent && pent->p_proto == IPPROTO_TCP) {
416 int flags;
417 flags = nr->tcp_flags;
418 ND_PRINT((ndo, "%s%s%s%s%s%s%s",
419 flags & TH_FIN ? "F" : "",
420 flags & TH_SYN ? "S" : "",
421 flags & TH_RST ? "R" : "",
422 flags & TH_PUSH ? "P" : "",
423 flags & TH_ACK ? "A" : "",
424 flags & TH_URG ? "U" : "",
425 flags ? " " : ""));
426 }
427
428 buf[0]='\0';
429 snprintf(buf, sizeof(buf), "(%u<>%u encaps)",
430 (EXTRACT_16BITS(&nr->flags) >> 8) & 0xff,
431 (EXTRACT_16BITS(&nr->flags)) & 0xff);
432 ND_PRINT((ndo, "tos %u, %u (%u octets) %s",
433 nr->tos,
434 EXTRACT_32BITS(&nr->packets),
435 EXTRACT_32BITS(&nr->octets), buf));
436 }
437 return;
438
439 trunc:
440 ND_PRINT((ndo, "[|cnfp]"));
441 return;
442 }
443
444 void
cnfp_print(netdissect_options * ndo,const u_char * cp)445 cnfp_print(netdissect_options *ndo, const u_char *cp)
446 {
447 int ver;
448
449 /*
450 * First 2 bytes are the version number.
451 */
452 ND_TCHECK2(*cp, 2);
453 ver = EXTRACT_16BITS(cp);
454 switch (ver) {
455
456 case 1:
457 cnfp_v1_print(ndo, cp);
458 break;
459
460 case 5:
461 cnfp_v5_print(ndo, cp);
462 break;
463
464 case 6:
465 cnfp_v6_print(ndo, cp);
466 break;
467
468 default:
469 ND_PRINT((ndo, "NetFlow v%x", ver));
470 break;
471 }
472 return;
473
474 trunc:
475 ND_PRINT((ndo, "[|cnfp]"));
476 return;
477 }
478