1 |
|
|
/* $OpenBSD: print-cnfp.c,v 1.9 2015/11/15 20:35:36 mmcc Exp $ */ |
2 |
|
|
|
3 |
|
|
/* |
4 |
|
|
* Copyright (c) 1998 Michael Shalayeff |
5 |
|
|
* All rights reserved. |
6 |
|
|
* |
7 |
|
|
* Redistribution and use in source and binary forms, with or without |
8 |
|
|
* modification, are permitted provided that the following conditions |
9 |
|
|
* are met: |
10 |
|
|
* 1. Redistributions of source code must retain the above copyright |
11 |
|
|
* notice, this list of conditions and the following disclaimer. |
12 |
|
|
* 2. Redistributions in binary form must reproduce the above copyright |
13 |
|
|
* notice, this list of conditions and the following disclaimer in the |
14 |
|
|
* documentation and/or other materials provided with the distribution. |
15 |
|
|
* |
16 |
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR |
17 |
|
|
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES |
18 |
|
|
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. |
19 |
|
|
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, |
20 |
|
|
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
21 |
|
|
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
22 |
|
|
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
23 |
|
|
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
24 |
|
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
25 |
|
|
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
26 |
|
|
*/ |
27 |
|
|
|
28 |
|
|
/* Cisco NetFlow protocol */ |
29 |
|
|
|
30 |
|
|
#include <sys/types.h> |
31 |
|
|
#include <sys/time.h> |
32 |
|
|
#include <sys/socket.h> |
33 |
|
|
#include <netdb.h> |
34 |
|
|
|
35 |
|
|
#include <netinet/in.h> |
36 |
|
|
#include <netinet/tcp.h> |
37 |
|
|
#include <arpa/inet.h> |
38 |
|
|
|
39 |
|
|
#include <stdio.h> |
40 |
|
|
#include <string.h> |
41 |
|
|
|
42 |
|
|
#include "interface.h" |
43 |
|
|
#include "addrtoname.h" |
44 |
|
|
|
45 |
|
|
struct nfhdr { |
46 |
|
|
u_int32_t ver_cnt; /* version [15], and # of records */ |
47 |
|
|
u_int32_t msys_uptime; |
48 |
|
|
u_int32_t utc_sec; |
49 |
|
|
u_int32_t utc_nsec; |
50 |
|
|
u_int32_t sequence; /* v5 flow sequence number */ |
51 |
|
|
u_int32_t reserved; /* v5 only */ |
52 |
|
|
}; |
53 |
|
|
|
54 |
|
|
struct nfrec { |
55 |
|
|
struct in_addr src_ina; |
56 |
|
|
struct in_addr dst_ina; |
57 |
|
|
struct in_addr nhop_ina; |
58 |
|
|
u_int32_t ifaces; /* src,dst ifaces */ |
59 |
|
|
u_int32_t packets; |
60 |
|
|
u_int32_t octets; |
61 |
|
|
u_int32_t start_time; /* sys_uptime value */ |
62 |
|
|
u_int32_t last_time; /* sys_uptime value */ |
63 |
|
|
u_int32_t ports; /* src,dst ports */ |
64 |
|
|
u_int32_t proto_tos; /* proto, tos, pad, flags(v5) */ |
65 |
|
|
u_int32_t asses; /* v1: flags; v5: src,dst AS */ |
66 |
|
|
u_int32_t masks; /* src,dst addr prefix */ |
67 |
|
|
|
68 |
|
|
}; |
69 |
|
|
|
70 |
|
|
void |
71 |
|
|
cnfp_print(const u_char *cp, u_int len, const u_char *bp) |
72 |
|
|
{ |
73 |
|
|
const struct nfhdr *nh; |
74 |
|
|
const struct nfrec *nr; |
75 |
|
|
const struct ip *ip; |
76 |
|
|
int nrecs, ver, proto; |
77 |
|
|
time_t t; |
78 |
|
|
|
79 |
|
|
ip = (struct ip *)bp; |
80 |
|
|
nh = (struct nfhdr *)cp; |
81 |
|
|
|
82 |
|
|
if ((u_char *)(nh + 1) > snapend) |
83 |
|
|
return; |
84 |
|
|
|
85 |
|
|
nrecs = ntohl(nh->ver_cnt) & 0xffff; |
86 |
|
|
ver = (ntohl(nh->ver_cnt) & 0xffff0000) >> 16; |
87 |
|
|
t = ntohl(nh->utc_sec); |
88 |
|
|
/* (p = ctime(&t))[24] = '\0'; */ |
89 |
|
|
|
90 |
|
|
printf("NetFlow v%x, %u.%03u uptime, %u.%09u, ", ver, |
91 |
|
|
ntohl(nh->msys_uptime)/1000, ntohl(nh->msys_uptime)%1000, |
92 |
|
|
ntohl(nh->utc_sec), ntohl(nh->utc_nsec)); |
93 |
|
|
|
94 |
|
|
if (ver == 5) { |
95 |
|
|
printf("#%u, ", htonl(nh->sequence)); |
96 |
|
|
nr = (struct nfrec *)&nh[1]; |
97 |
|
|
} else |
98 |
|
|
nr = (struct nfrec *)&nh->sequence; |
99 |
|
|
|
100 |
|
|
printf("%2u recs", nrecs); |
101 |
|
|
|
102 |
|
|
for (; nrecs-- && (u_char *)(nr + 1) <= snapend; nr++) { |
103 |
|
|
char buf[5]; |
104 |
|
|
char asbuf[7]; |
105 |
|
|
|
106 |
|
|
printf("\n started %u.%03u, last %u.%03u", |
107 |
|
|
ntohl(nr->start_time)/1000, ntohl(nr->start_time)%1000, |
108 |
|
|
ntohl(nr->last_time)/1000, ntohl(nr->last_time)%1000); |
109 |
|
|
|
110 |
|
|
asbuf[0] = buf[0] = '\0'; |
111 |
|
|
if (ver == 5) { |
112 |
|
|
snprintf(buf, sizeof buf, "/%d", |
113 |
|
|
(ntohl(nr->masks) >> 24) & 0xff); |
114 |
|
|
snprintf(asbuf, sizeof asbuf, ":%d", |
115 |
|
|
(ntohl(nr->asses) >> 16) & 0xffff); |
116 |
|
|
} |
117 |
|
|
printf("\n %s%s%s:%u ", inet_ntoa(nr->src_ina), buf, asbuf, |
118 |
|
|
ntohl(nr->ports) >> 16); |
119 |
|
|
|
120 |
|
|
if (ver == 5) { |
121 |
|
|
snprintf(buf, sizeof buf, "/%d", |
122 |
|
|
(ntohl(nr->masks) >> 16) & 0xff); |
123 |
|
|
snprintf(asbuf, sizeof asbuf, ":%d", |
124 |
|
|
ntohl(nr->asses) & 0xffff); |
125 |
|
|
} |
126 |
|
|
printf("> %s%s%s:%u ", inet_ntoa(nr->dst_ina), buf, asbuf, |
127 |
|
|
ntohl(nr->ports) & 0xffff); |
128 |
|
|
|
129 |
|
|
printf(">> %s\n ", inet_ntoa(nr->nhop_ina)); |
130 |
|
|
|
131 |
|
|
proto = (ntohl(nr->proto_tos) >> 8) & 0xff; |
132 |
|
|
printf("%s ", ipproto_string(proto)); |
133 |
|
|
|
134 |
|
|
/* tcp flags for tcp only */ |
135 |
|
|
if (proto == IPPROTO_TCP) { |
136 |
|
|
int flags; |
137 |
|
|
if (ver == 1) |
138 |
|
|
flags = (ntohl(nr->asses) >> 24) & 0xff; |
139 |
|
|
else |
140 |
|
|
flags = (ntohl(nr->proto_tos) >> 16) & 0xff; |
141 |
|
|
if (flags & TH_FIN) putchar('F'); |
142 |
|
|
if (flags & TH_SYN) putchar('S'); |
143 |
|
|
if (flags & TH_RST) putchar('R'); |
144 |
|
|
if (flags & TH_PUSH) putchar('P'); |
145 |
|
|
if (flags & TH_ACK) putchar('A'); |
146 |
|
|
if (flags & TH_URG) putchar('U'); |
147 |
|
|
if (flags) |
148 |
|
|
putchar(' '); |
149 |
|
|
} |
150 |
|
|
printf("tos %u, %u (%u octets)", ntohl(nr->proto_tos) & 0xff, |
151 |
|
|
ntohl(nr->packets), ntohl(nr->octets)); |
152 |
|
|
|
153 |
|
|
|
154 |
|
|
} |
155 |
|
|
|
156 |
|
|
} |
157 |
|
|
|