1 /* $OpenBSD: print-cnfp.c,v 1.2 1998/06/25 20:26:59 mickey Exp $ */
2
3 /*
4 * Copyright (c) 1998 Michael Shalayeff
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. All advertising materials mentioning features or use of this software
16 * must display the following acknowledgement:
17 * This product includes software developed by Michael Shalayeff.
18 * 4. The name of the author may not be used to endorse or promote products
19 * derived from this software without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31 */
32
33 /* \summary: Cisco NetFlow protocol printer */
34
35 /*
36 * Cisco NetFlow protocol
37 *
38 * See
39 *
40 * http://www.cisco.com/c/en/us/td/docs/net_mgmt/netflow_collection_engine/3-6/user/guide/format.html#wp1005892
41 */
42
43 #ifdef HAVE_CONFIG_H
44 #include "config.h"
45 #endif
46
47 #include <netdissect-stdinc.h>
48
49 #include <stdio.h>
50 #include <string.h>
51
52 #include "netdissect.h"
53 #include "addrtoname.h"
54 #include "extract.h"
55
56 #include "tcp.h"
57 #include "ipproto.h"
58
59 struct nfhdr_v1 {
60 uint16_t version; /* version number */
61 uint16_t count; /* # of records */
62 uint32_t msys_uptime;
63 uint32_t utc_sec;
64 uint32_t utc_nsec;
65 };
66
67 struct nfrec_v1 {
68 struct in_addr src_ina;
69 struct in_addr dst_ina;
70 struct in_addr nhop_ina;
71 uint16_t input; /* SNMP index of input interface */
72 uint16_t output; /* SNMP index of output interface */
73 uint32_t packets; /* packets in the flow */
74 uint32_t octets; /* layer 3 octets in the packets of the flow */
75 uint32_t start_time; /* sys_uptime value at start of flow */
76 uint32_t last_time; /* sys_uptime value when last packet of flow was received */
77 uint16_t srcport; /* TCP/UDP source port or equivalent */
78 uint16_t dstport; /* TCP/UDP source port or equivalent */
79 uint16_t pad1; /* pad */
80 uint8_t proto; /* IP protocol type */
81 uint8_t tos; /* IP type of service */
82 uint8_t tcp_flags; /* cumulative OR of TCP flags */
83 uint8_t pad[3]; /* padding */
84 uint32_t reserved; /* unused */
85 };
86
87 struct nfhdr_v5 {
88 uint16_t version; /* version number */
89 uint16_t count; /* # of records */
90 uint32_t msys_uptime;
91 uint32_t utc_sec;
92 uint32_t utc_nsec;
93 uint32_t sequence; /* flow sequence number */
94 uint8_t engine_type; /* type of flow-switching engine */
95 uint8_t engine_id; /* slot number of the flow-switching engine */
96 uint16_t sampling_interval; /* sampling mode and interval */
97 };
98
99 struct nfrec_v5 {
100 struct in_addr src_ina;
101 struct in_addr dst_ina;
102 struct in_addr nhop_ina;
103 uint16_t input; /* SNMP index of input interface */
104 uint16_t output; /* SNMP index of output interface */
105 uint32_t packets; /* packets in the flow */
106 uint32_t octets; /* layer 3 octets in the packets of the flow */
107 uint32_t start_time; /* sys_uptime value at start of flow */
108 uint32_t last_time; /* sys_uptime value when last packet of flow was received */
109 uint16_t srcport; /* TCP/UDP source port or equivalent */
110 uint16_t dstport; /* TCP/UDP source port or equivalent */
111 uint8_t pad1; /* pad */
112 uint8_t tcp_flags; /* cumulative OR of TCP flags */
113 uint8_t proto; /* IP protocol type */
114 uint8_t tos; /* IP type of service */
115 uint16_t src_as; /* AS number of the source */
116 uint16_t dst_as; /* AS number of the destination */
117 uint8_t src_mask; /* source address mask bits */
118 uint8_t dst_mask; /* destination address prefix mask bits */
119 uint16_t pad2;
120 struct in_addr peer_nexthop; /* v6: IP address of the nexthop within the peer (FIB)*/
121 };
122
123 struct nfhdr_v6 {
124 uint16_t version; /* version number */
125 uint16_t count; /* # of records */
126 uint32_t msys_uptime;
127 uint32_t utc_sec;
128 uint32_t utc_nsec;
129 uint32_t sequence; /* v5 flow sequence number */
130 uint32_t reserved; /* v5 only */
131 };
132
133 struct nfrec_v6 {
134 struct in_addr src_ina;
135 struct in_addr dst_ina;
136 struct in_addr nhop_ina;
137 uint16_t input; /* SNMP index of input interface */
138 uint16_t output; /* SNMP index of output interface */
139 uint32_t packets; /* packets in the flow */
140 uint32_t octets; /* layer 3 octets in the packets of the flow */
141 uint32_t start_time; /* sys_uptime value at start of flow */
142 uint32_t last_time; /* sys_uptime value when last packet of flow was received */
143 uint16_t srcport; /* TCP/UDP source port or equivalent */
144 uint16_t dstport; /* TCP/UDP source port or equivalent */
145 uint8_t pad1; /* pad */
146 uint8_t tcp_flags; /* cumulative OR of TCP flags */
147 uint8_t proto; /* IP protocol type */
148 uint8_t tos; /* IP type of service */
149 uint16_t src_as; /* AS number of the source */
150 uint16_t dst_as; /* AS number of the destination */
151 uint8_t src_mask; /* source address mask bits */
152 uint8_t dst_mask; /* destination address prefix mask bits */
153 uint16_t flags;
154 struct in_addr peer_nexthop; /* v6: IP address of the nexthop within the peer (FIB)*/
155 };
156
157 static void
cnfp_v1_print(netdissect_options * ndo,const u_char * cp)158 cnfp_v1_print(netdissect_options *ndo, const u_char *cp)
159 {
160 register const struct nfhdr_v1 *nh;
161 register const struct nfrec_v1 *nr;
162 const char *p_name;
163 int nrecs, ver;
164 #if 0
165 time_t t;
166 #endif
167
168 nh = (const struct nfhdr_v1 *)cp;
169 ND_TCHECK(*nh);
170
171 ver = EXTRACT_16BITS(&nh->version);
172 nrecs = EXTRACT_32BITS(&nh->count);
173 #if 0
174 /*
175 * This is seconds since the UN*X epoch, and is followed by
176 * nanoseconds. XXX - format it, rather than just dumping the
177 * raw seconds-since-the-Epoch.
178 */
179 t = EXTRACT_32BITS(&nh->utc_sec);
180 #endif
181
182 ND_PRINT((ndo, "NetFlow v%x, %u.%03u uptime, %u.%09u, ", ver,
183 EXTRACT_32BITS(&nh->msys_uptime)/1000,
184 EXTRACT_32BITS(&nh->msys_uptime)%1000,
185 EXTRACT_32BITS(&nh->utc_sec), EXTRACT_32BITS(&nh->utc_nsec)));
186
187 nr = (const struct nfrec_v1 *)&nh[1];
188
189 ND_PRINT((ndo, "%2u recs", nrecs));
190
191 for (; nrecs != 0; nr++, nrecs--) {
192 char buf[20];
193 char asbuf[20];
194
195 /*
196 * Make sure we have the entire record.
197 */
198 ND_TCHECK(*nr);
199 ND_PRINT((ndo, "\n started %u.%03u, last %u.%03u",
200 EXTRACT_32BITS(&nr->start_time)/1000,
201 EXTRACT_32BITS(&nr->start_time)%1000,
202 EXTRACT_32BITS(&nr->last_time)/1000,
203 EXTRACT_32BITS(&nr->last_time)%1000));
204
205 asbuf[0] = buf[0] = '\0';
206 ND_PRINT((ndo, "\n %s%s%s:%u ", intoa(nr->src_ina.s_addr), buf, asbuf,
207 EXTRACT_16BITS(&nr->srcport)));
208
209 ND_PRINT((ndo, "> %s%s%s:%u ", intoa(nr->dst_ina.s_addr), buf, asbuf,
210 EXTRACT_16BITS(&nr->dstport)));
211
212 ND_PRINT((ndo, ">> %s\n ", intoa(nr->nhop_ina.s_addr)));
213
214 if (!ndo->ndo_nflag && (p_name = netdb_protoname(nr->proto)) != NULL)
215 ND_PRINT((ndo, "%s ", p_name));
216 else
217 ND_PRINT((ndo, "%u ", nr->proto));
218
219 /* tcp flags for tcp only */
220 if (nr->proto == IPPROTO_TCP) {
221 int flags;
222 flags = nr->tcp_flags;
223 ND_PRINT((ndo, "%s%s%s%s%s%s%s",
224 flags & TH_FIN ? "F" : "",
225 flags & TH_SYN ? "S" : "",
226 flags & TH_RST ? "R" : "",
227 flags & TH_PUSH ? "P" : "",
228 flags & TH_ACK ? "A" : "",
229 flags & TH_URG ? "U" : "",
230 flags ? " " : ""));
231 }
232
233 buf[0]='\0';
234 ND_PRINT((ndo, "tos %u, %u (%u octets) %s",
235 nr->tos,
236 EXTRACT_32BITS(&nr->packets),
237 EXTRACT_32BITS(&nr->octets), buf));
238 }
239 return;
240
241 trunc:
242 ND_PRINT((ndo, "[|cnfp]"));
243 return;
244 }
245
246 static void
cnfp_v5_print(netdissect_options * ndo,const u_char * cp)247 cnfp_v5_print(netdissect_options *ndo, const u_char *cp)
248 {
249 register const struct nfhdr_v5 *nh;
250 register const struct nfrec_v5 *nr;
251 const char *p_name;
252 int nrecs, ver;
253 #if 0
254 time_t t;
255 #endif
256
257 nh = (const struct nfhdr_v5 *)cp;
258 ND_TCHECK(*nh);
259
260 ver = EXTRACT_16BITS(&nh->version);
261 nrecs = EXTRACT_32BITS(&nh->count);
262 #if 0
263 /*
264 * This is seconds since the UN*X epoch, and is followed by
265 * nanoseconds. XXX - format it, rather than just dumping the
266 * raw seconds-since-the-Epoch.
267 */
268 t = EXTRACT_32BITS(&nh->utc_sec);
269 #endif
270
271 ND_PRINT((ndo, "NetFlow v%x, %u.%03u uptime, %u.%09u, ", ver,
272 EXTRACT_32BITS(&nh->msys_uptime)/1000,
273 EXTRACT_32BITS(&nh->msys_uptime)%1000,
274 EXTRACT_32BITS(&nh->utc_sec), EXTRACT_32BITS(&nh->utc_nsec)));
275
276 ND_PRINT((ndo, "#%u, ", EXTRACT_32BITS(&nh->sequence)));
277 nr = (const struct nfrec_v5 *)&nh[1];
278
279 ND_PRINT((ndo, "%2u recs", nrecs));
280
281 for (; nrecs != 0; nr++, nrecs--) {
282 char buf[20];
283 char asbuf[20];
284
285 /*
286 * Make sure we have the entire record.
287 */
288 ND_TCHECK(*nr);
289 ND_PRINT((ndo, "\n started %u.%03u, last %u.%03u",
290 EXTRACT_32BITS(&nr->start_time)/1000,
291 EXTRACT_32BITS(&nr->start_time)%1000,
292 EXTRACT_32BITS(&nr->last_time)/1000,
293 EXTRACT_32BITS(&nr->last_time)%1000));
294
295 asbuf[0] = buf[0] = '\0';
296 snprintf(buf, sizeof(buf), "/%u", nr->src_mask);
297 snprintf(asbuf, sizeof(asbuf), ":%u",
298 EXTRACT_16BITS(&nr->src_as));
299 ND_PRINT((ndo, "\n %s%s%s:%u ", intoa(nr->src_ina.s_addr), buf, asbuf,
300 EXTRACT_16BITS(&nr->srcport)));
301
302 snprintf(buf, sizeof(buf), "/%d", nr->dst_mask);
303 snprintf(asbuf, sizeof(asbuf), ":%u",
304 EXTRACT_16BITS(&nr->dst_as));
305 ND_PRINT((ndo, "> %s%s%s:%u ", intoa(nr->dst_ina.s_addr), buf, asbuf,
306 EXTRACT_16BITS(&nr->dstport)));
307
308 ND_PRINT((ndo, ">> %s\n ", intoa(nr->nhop_ina.s_addr)));
309
310 if (!ndo->ndo_nflag && (p_name = netdb_protoname(nr->proto)) != NULL)
311 ND_PRINT((ndo, "%s ", p_name));
312 else
313 ND_PRINT((ndo, "%u ", nr->proto));
314
315 /* tcp flags for tcp only */
316 if (nr->proto == IPPROTO_TCP) {
317 int flags;
318 flags = nr->tcp_flags;
319 ND_PRINT((ndo, "%s%s%s%s%s%s%s",
320 flags & TH_FIN ? "F" : "",
321 flags & TH_SYN ? "S" : "",
322 flags & TH_RST ? "R" : "",
323 flags & TH_PUSH ? "P" : "",
324 flags & TH_ACK ? "A" : "",
325 flags & TH_URG ? "U" : "",
326 flags ? " " : ""));
327 }
328
329 buf[0]='\0';
330 ND_PRINT((ndo, "tos %u, %u (%u octets) %s",
331 nr->tos,
332 EXTRACT_32BITS(&nr->packets),
333 EXTRACT_32BITS(&nr->octets), buf));
334 }
335 return;
336
337 trunc:
338 ND_PRINT((ndo, "[|cnfp]"));
339 return;
340 }
341
342 static void
cnfp_v6_print(netdissect_options * ndo,const u_char * cp)343 cnfp_v6_print(netdissect_options *ndo, const u_char *cp)
344 {
345 register const struct nfhdr_v6 *nh;
346 register const struct nfrec_v6 *nr;
347 const char *p_name;
348 int nrecs, ver;
349 #if 0
350 time_t t;
351 #endif
352
353 nh = (const struct nfhdr_v6 *)cp;
354 ND_TCHECK(*nh);
355
356 ver = EXTRACT_16BITS(&nh->version);
357 nrecs = EXTRACT_32BITS(&nh->count);
358 #if 0
359 /*
360 * This is seconds since the UN*X epoch, and is followed by
361 * nanoseconds. XXX - format it, rather than just dumping the
362 * raw seconds-since-the-Epoch.
363 */
364 t = EXTRACT_32BITS(&nh->utc_sec);
365 #endif
366
367 ND_PRINT((ndo, "NetFlow v%x, %u.%03u uptime, %u.%09u, ", ver,
368 EXTRACT_32BITS(&nh->msys_uptime)/1000,
369 EXTRACT_32BITS(&nh->msys_uptime)%1000,
370 EXTRACT_32BITS(&nh->utc_sec), EXTRACT_32BITS(&nh->utc_nsec)));
371
372 ND_PRINT((ndo, "#%u, ", EXTRACT_32BITS(&nh->sequence)));
373 nr = (const struct nfrec_v6 *)&nh[1];
374
375 ND_PRINT((ndo, "%2u recs", nrecs));
376
377 for (; nrecs != 0; nr++, nrecs--) {
378 char buf[20];
379 char asbuf[20];
380
381 /*
382 * Make sure we have the entire record.
383 */
384 ND_TCHECK(*nr);
385 ND_PRINT((ndo, "\n started %u.%03u, last %u.%03u",
386 EXTRACT_32BITS(&nr->start_time)/1000,
387 EXTRACT_32BITS(&nr->start_time)%1000,
388 EXTRACT_32BITS(&nr->last_time)/1000,
389 EXTRACT_32BITS(&nr->last_time)%1000));
390
391 asbuf[0] = buf[0] = '\0';
392 snprintf(buf, sizeof(buf), "/%u", nr->src_mask);
393 snprintf(asbuf, sizeof(asbuf), ":%u",
394 EXTRACT_16BITS(&nr->src_as));
395 ND_PRINT((ndo, "\n %s%s%s:%u ", intoa(nr->src_ina.s_addr), buf, asbuf,
396 EXTRACT_16BITS(&nr->srcport)));
397
398 snprintf(buf, sizeof(buf), "/%d", nr->dst_mask);
399 snprintf(asbuf, sizeof(asbuf), ":%u",
400 EXTRACT_16BITS(&nr->dst_as));
401 ND_PRINT((ndo, "> %s%s%s:%u ", intoa(nr->dst_ina.s_addr), buf, asbuf,
402 EXTRACT_16BITS(&nr->dstport)));
403
404 ND_PRINT((ndo, ">> %s\n ", intoa(nr->nhop_ina.s_addr)));
405
406 if (!ndo->ndo_nflag && (p_name = netdb_protoname(nr->proto)) != NULL)
407 ND_PRINT((ndo, "%s ", p_name));
408 else
409 ND_PRINT((ndo, "%u ", nr->proto));
410
411 /* tcp flags for tcp only */
412 if (nr->proto == IPPROTO_TCP) {
413 int flags;
414 flags = nr->tcp_flags;
415 ND_PRINT((ndo, "%s%s%s%s%s%s%s",
416 flags & TH_FIN ? "F" : "",
417 flags & TH_SYN ? "S" : "",
418 flags & TH_RST ? "R" : "",
419 flags & TH_PUSH ? "P" : "",
420 flags & TH_ACK ? "A" : "",
421 flags & TH_URG ? "U" : "",
422 flags ? " " : ""));
423 }
424
425 buf[0]='\0';
426 snprintf(buf, sizeof(buf), "(%u<>%u encaps)",
427 (EXTRACT_16BITS(&nr->flags) >> 8) & 0xff,
428 (EXTRACT_16BITS(&nr->flags)) & 0xff);
429 ND_PRINT((ndo, "tos %u, %u (%u octets) %s",
430 nr->tos,
431 EXTRACT_32BITS(&nr->packets),
432 EXTRACT_32BITS(&nr->octets), buf));
433 }
434 return;
435
436 trunc:
437 ND_PRINT((ndo, "[|cnfp]"));
438 return;
439 }
440
441 void
cnfp_print(netdissect_options * ndo,const u_char * cp)442 cnfp_print(netdissect_options *ndo, const u_char *cp)
443 {
444 int ver;
445
446 /*
447 * First 2 bytes are the version number.
448 */
449 ND_TCHECK2(*cp, 2);
450 ver = EXTRACT_16BITS(cp);
451 switch (ver) {
452
453 case 1:
454 cnfp_v1_print(ndo, cp);
455 break;
456
457 case 5:
458 cnfp_v5_print(ndo, cp);
459 break;
460
461 case 6:
462 cnfp_v6_print(ndo, cp);
463 break;
464
465 default:
466 ND_PRINT((ndo, "NetFlow v%x", ver));
467 break;
468 }
469 return;
470
471 trunc:
472 ND_PRINT((ndo, "[|cnfp]"));
473 return;
474 }
475