| // Copyright 2014 Google, Inc. All rights reserved. |
| // |
| // Use of this source code is governed by a BSD-style license |
| // that can be found in the LICENSE file in the root of the source |
| // tree. |
| |
| /* |
| This layer decodes SFlow version 5 datagrams. |
| |
| The specification can be found here: http://sflow.org/sflow_version_5.txt |
| |
| Additional developer information about sflow can be found at: |
| http://sflow.org/developers/specifications.php |
| |
| And SFlow in general: |
| http://sflow.org/index.php |
| |
| Two forms of sample data are defined: compact and expanded. The |
| Specification has this to say: |
| |
| Compact and expand forms of counter and flow samples are defined. |
| An agent must not mix compact/expanded encodings. If an agent |
| will never use ifIndex numbers >= 2^24 then it must use compact |
| encodings for all interfaces. Otherwise the expanded formats must |
| be used for all interfaces. |
| |
| This decoder only supports the compact form, because that is the only |
| one for which data was available. |
| |
| The datagram is composed of one or more samples of type flow or counter, |
| and each sample is composed of one or more records describing the sample. |
| A sample is a single instance of sampled inforamtion, and each record in |
| the sample gives additional / supplimentary information about the sample. |
| |
| The following sample record types are supported: |
| |
| Raw Packet Header |
| opaque = flow_data; enterprise = 0; format = 1 |
| |
| Extended Switch Data |
| opaque = flow_data; enterprise = 0; format = 1001 |
| |
| Extended Router Data |
| opaque = flow_data; enterprise = 0; format = 1002 |
| |
| Extended Gateway Data |
| opaque = flow_data; enterprise = 0; format = 1003 |
| |
| Extended User Data |
| opaque = flow_data; enterprise = 0; format = 1004 |
| |
| Extended URL Data |
| opaque = flow_data; enterprise = 0; format = 1005 |
| |
| The following types of counter records are supported: |
| |
| Generic Interface Counters - see RFC 2233 |
| opaque = counter_data; enterprise = 0; format = 1 |
| |
| Ethernet Interface Counters - see RFC 2358 |
| opaque = counter_data; enterprise = 0; format = 2 |
| |
| SFlow is encoded using XDR (RFC4506). There are a few places |
| where the standard 4-byte fields are partitioned into two |
| bitfields of different lengths. I'm not sure why the designers |
| chose to pack together two values like this in some places, and |
| in others they use the entire 4-byte value to store a number that |
| will never be more than a few bits. In any case, there are a couple |
| of types defined to handle the decoding of these bitfields, and |
| that's why they're there. */ |
| |
| package layers |
| |
| import ( |
| "encoding/binary" |
| "errors" |
| "fmt" |
| "net" |
| |
| "github.com/google/gopacket" |
| ) |
| |
| // SFlowRecord holds both flow sample records and counter sample records. |
| // A Record is the structure that actually holds the sampled data |
| // and / or counters. |
| type SFlowRecord interface { |
| } |
| |
| // SFlowDataSource encodes a 2-bit SFlowSourceFormat in its most significant |
| // 2 bits, and an SFlowSourceValue in its least significant 30 bits. |
| // These types and values define the meaning of the inteface information |
| // presented in the sample metadata. |
| type SFlowDataSource int32 |
| |
| func (sdc SFlowDataSource) decode() (SFlowSourceFormat, SFlowSourceValue) { |
| leftField := sdc >> 30 |
| rightField := uint32(0x3FFFFFFF) & uint32(sdc) |
| return SFlowSourceFormat(leftField), SFlowSourceValue(rightField) |
| } |
| |
| type SFlowDataSourceExpanded struct { |
| SourceIDClass SFlowSourceFormat |
| SourceIDIndex SFlowSourceValue |
| } |
| |
| func (sdce SFlowDataSourceExpanded) decode() (SFlowSourceFormat, SFlowSourceValue) { |
| leftField := sdce.SourceIDClass >> 30 |
| rightField := uint32(0x3FFFFFFF) & uint32(sdce.SourceIDIndex) |
| return SFlowSourceFormat(leftField), SFlowSourceValue(rightField) |
| } |
| |
| type SFlowSourceFormat uint32 |
| |
| type SFlowSourceValue uint32 |
| |
| const ( |
| SFlowTypeSingleInterface SFlowSourceFormat = 0 |
| SFlowTypePacketDiscarded SFlowSourceFormat = 1 |
| SFlowTypeMultipleDestinations SFlowSourceFormat = 2 |
| ) |
| |
| func (sdf SFlowSourceFormat) String() string { |
| switch sdf { |
| case SFlowTypeSingleInterface: |
| return "Single Interface" |
| case SFlowTypePacketDiscarded: |
| return "Packet Discarded" |
| case SFlowTypeMultipleDestinations: |
| return "Multiple Destinations" |
| default: |
| return "UNKNOWN" |
| } |
| } |
| |
| func decodeSFlow(data []byte, p gopacket.PacketBuilder) error { |
| s := &SFlowDatagram{} |
| err := s.DecodeFromBytes(data, p) |
| if err != nil { |
| return err |
| } |
| p.AddLayer(s) |
| p.SetApplicationLayer(s) |
| return nil |
| } |
| |
| // SFlowDatagram is the outermost container which holds some basic information |
| // about the reporting agent, and holds at least one sample record |
| type SFlowDatagram struct { |
| BaseLayer |
| |
| DatagramVersion uint32 |
| AgentAddress net.IP |
| SubAgentID uint32 |
| SequenceNumber uint32 |
| AgentUptime uint32 |
| SampleCount uint32 |
| FlowSamples []SFlowFlowSample |
| CounterSamples []SFlowCounterSample |
| } |
| |
| // An SFlow datagram's outer container has the following |
| // structure: |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int sFlow version (2|4|5) | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int IP version of the Agent (1=v4|2=v6) | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // / Agent IP address (v4=4byte|v6=16byte) / |
| // / / |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int sub agent id | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int datagram sequence number | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int switch uptime in ms | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int n samples in datagram | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // / n samples / |
| // / / |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| |
| // SFlowDataFormat encodes the EnterpriseID in the most |
| // significant 12 bits, and the SampleType in the least significant |
| // 20 bits. |
| type SFlowDataFormat uint32 |
| |
| func (sdf SFlowDataFormat) decode() (SFlowEnterpriseID, SFlowSampleType) { |
| leftField := sdf >> 12 |
| rightField := uint32(0xFFF) & uint32(sdf) |
| return SFlowEnterpriseID(leftField), SFlowSampleType(rightField) |
| } |
| |
| // SFlowEnterpriseID is used to differentiate between the |
| // official SFlow standard, and other, vendor-specific |
| // types of flow data. (Similiar to SNMP's enterprise MIB |
| // OIDs) Only the office SFlow Enterprise ID is decoded |
| // here. |
| type SFlowEnterpriseID uint32 |
| |
| const ( |
| SFlowStandard SFlowEnterpriseID = 0 |
| ) |
| |
| func (eid SFlowEnterpriseID) String() string { |
| switch eid { |
| case SFlowStandard: |
| return "Standard SFlow" |
| default: |
| return "" |
| } |
| } |
| |
| func (eid SFlowEnterpriseID) GetType() SFlowEnterpriseID { |
| return SFlowStandard |
| } |
| |
| // SFlowSampleType specifies the type of sample. Only flow samples |
| // and counter samples are supported |
| type SFlowSampleType uint32 |
| |
| const ( |
| SFlowTypeFlowSample SFlowSampleType = 1 |
| SFlowTypeCounterSample SFlowSampleType = 2 |
| SFlowTypeExpandedFlowSample SFlowSampleType = 3 |
| SFlowTypeExpandedCounterSample SFlowSampleType = 4 |
| ) |
| |
| func (st SFlowSampleType) GetType() SFlowSampleType { |
| switch st { |
| case SFlowTypeFlowSample: |
| return SFlowTypeFlowSample |
| case SFlowTypeCounterSample: |
| return SFlowTypeCounterSample |
| case SFlowTypeExpandedFlowSample: |
| return SFlowTypeExpandedFlowSample |
| case SFlowTypeExpandedCounterSample: |
| return SFlowTypeExpandedCounterSample |
| default: |
| panic("Invalid Sample Type") |
| } |
| } |
| |
| func (st SFlowSampleType) String() string { |
| switch st { |
| case SFlowTypeFlowSample: |
| return "Flow Sample" |
| case SFlowTypeCounterSample: |
| return "Counter Sample" |
| case SFlowTypeExpandedFlowSample: |
| return "Expanded Flow Sample" |
| case SFlowTypeExpandedCounterSample: |
| return "Expanded Counter Sample" |
| default: |
| return "" |
| } |
| } |
| |
| func (s *SFlowDatagram) LayerType() gopacket.LayerType { return LayerTypeSFlow } |
| |
| func (d *SFlowDatagram) Payload() []byte { return nil } |
| |
| func (d *SFlowDatagram) CanDecode() gopacket.LayerClass { return LayerTypeSFlow } |
| |
| func (d *SFlowDatagram) NextLayerType() gopacket.LayerType { return gopacket.LayerTypePayload } |
| |
| // SFlowIPType determines what form the IP address being decoded will |
| // take. This is an XDR union type allowing for both IPv4 and IPv6 |
| type SFlowIPType uint32 |
| |
| const ( |
| SFlowIPv4 SFlowIPType = 1 |
| SFlowIPv6 SFlowIPType = 2 |
| ) |
| |
| func (s SFlowIPType) String() string { |
| switch s { |
| case SFlowIPv4: |
| return "IPv4" |
| case SFlowIPv6: |
| return "IPv6" |
| default: |
| return "" |
| } |
| } |
| |
| func (s SFlowIPType) Length() int { |
| switch s { |
| case SFlowIPv4: |
| return 4 |
| case SFlowIPv6: |
| return 16 |
| default: |
| return 0 |
| } |
| } |
| |
| func (s *SFlowDatagram) DecodeFromBytes(data []byte, df gopacket.DecodeFeedback) error { |
| var agentAddressType SFlowIPType |
| |
| data, s.DatagramVersion = data[4:], binary.BigEndian.Uint32(data[:4]) |
| data, agentAddressType = data[4:], SFlowIPType(binary.BigEndian.Uint32(data[:4])) |
| data, s.AgentAddress = data[agentAddressType.Length():], data[:agentAddressType.Length()] |
| data, s.SubAgentID = data[4:], binary.BigEndian.Uint32(data[:4]) |
| data, s.SequenceNumber = data[4:], binary.BigEndian.Uint32(data[:4]) |
| data, s.AgentUptime = data[4:], binary.BigEndian.Uint32(data[:4]) |
| data, s.SampleCount = data[4:], binary.BigEndian.Uint32(data[:4]) |
| |
| if s.SampleCount < 1 { |
| return fmt.Errorf("SFlow Datagram has invalid sample length: %d", s.SampleCount) |
| } |
| for i := uint32(0); i < s.SampleCount; i++ { |
| sdf := SFlowDataFormat(binary.BigEndian.Uint32(data[:4])) |
| _, sampleType := sdf.decode() |
| switch sampleType { |
| case SFlowTypeFlowSample: |
| if flowSample, err := decodeFlowSample(&data, false); err == nil { |
| s.FlowSamples = append(s.FlowSamples, flowSample) |
| } else { |
| return err |
| } |
| case SFlowTypeCounterSample: |
| if counterSample, err := decodeCounterSample(&data, false); err == nil { |
| s.CounterSamples = append(s.CounterSamples, counterSample) |
| } else { |
| return err |
| } |
| case SFlowTypeExpandedFlowSample: |
| if flowSample, err := decodeFlowSample(&data, true); err == nil { |
| s.FlowSamples = append(s.FlowSamples, flowSample) |
| } else { |
| return err |
| } |
| case SFlowTypeExpandedCounterSample: |
| if counterSample, err := decodeCounterSample(&data, true); err == nil { |
| s.CounterSamples = append(s.CounterSamples, counterSample) |
| } else { |
| return err |
| } |
| |
| default: |
| return fmt.Errorf("Unsupported SFlow sample type %d", sampleType) |
| } |
| } |
| return nil |
| } |
| |
| // SFlowFlowSample represents a sampled packet and contains |
| // one or more records describing the packet |
| type SFlowFlowSample struct { |
| EnterpriseID SFlowEnterpriseID |
| Format SFlowSampleType |
| SampleLength uint32 |
| SequenceNumber uint32 |
| SourceIDClass SFlowSourceFormat |
| SourceIDIndex SFlowSourceValue |
| SamplingRate uint32 |
| SamplePool uint32 |
| Dropped uint32 |
| InputInterfaceFormat uint32 |
| InputInterface uint32 |
| OutputInterfaceFormat uint32 |
| OutputInterface uint32 |
| RecordCount uint32 |
| Records []SFlowRecord |
| } |
| |
| // Flow samples have the following structure. Note |
| // the bit fields to encode the Enterprise ID and the |
| // Flow record format: type 1 |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | sample length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int sample sequence number | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // |id type | src id index value | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int sampling rate | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int sample pool | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int drops | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int input ifIndex | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int output ifIndex | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int number of records | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // / flow records / |
| // / / |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| |
| // Flow samples have the following structure. |
| // Flow record format: type 3 |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | sample length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int sample sequence number | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int src id type | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int src id index value | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int sampling rate | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int sample pool | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int drops | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int input interface format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int input interface value | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int output interface format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int output interface value | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int number of records | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // / flow records / |
| // / / |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| |
| type SFlowFlowDataFormat uint32 |
| |
| func (fdf SFlowFlowDataFormat) decode() (SFlowEnterpriseID, SFlowFlowRecordType) { |
| leftField := fdf >> 12 |
| rightField := uint32(0xFFF) & uint32(fdf) |
| return SFlowEnterpriseID(leftField), SFlowFlowRecordType(rightField) |
| } |
| |
| func (fs SFlowFlowSample) GetRecords() []SFlowRecord { |
| return fs.Records |
| } |
| |
| func (fs SFlowFlowSample) GetType() SFlowSampleType { |
| return SFlowTypeFlowSample |
| } |
| |
| func skipRecord(data *[]byte) { |
| recordLength := int(binary.BigEndian.Uint32((*data)[4:])) |
| *data = (*data)[(recordLength+((4-recordLength)%4))+8:] |
| } |
| |
| func decodeFlowSample(data *[]byte, expanded bool) (SFlowFlowSample, error) { |
| s := SFlowFlowSample{} |
| var sdf SFlowDataFormat |
| *data, sdf = (*data)[4:], SFlowDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| var sdc SFlowDataSource |
| |
| s.EnterpriseID, s.Format = sdf.decode() |
| if len(*data) < 4 { |
| return SFlowFlowSample{}, errors.New("ethernet counters too small") |
| } |
| *data, s.SampleLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowFlowSample{}, errors.New("ethernet counters too small") |
| } |
| *data, s.SequenceNumber = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if expanded { |
| if len(*data) < 4 { |
| return SFlowFlowSample{}, errors.New("ethernet counters too small") |
| } |
| *data, s.SourceIDClass = (*data)[4:], SFlowSourceFormat(binary.BigEndian.Uint32((*data)[:4])) |
| if len(*data) < 4 { |
| return SFlowFlowSample{}, errors.New("ethernet counters too small") |
| } |
| *data, s.SourceIDIndex = (*data)[4:], SFlowSourceValue(binary.BigEndian.Uint32((*data)[:4])) |
| } else { |
| if len(*data) < 4 { |
| return SFlowFlowSample{}, errors.New("ethernet counters too small") |
| } |
| *data, sdc = (*data)[4:], SFlowDataSource(binary.BigEndian.Uint32((*data)[:4])) |
| s.SourceIDClass, s.SourceIDIndex = sdc.decode() |
| } |
| if len(*data) < 4 { |
| return SFlowFlowSample{}, errors.New("ethernet counters too small") |
| } |
| *data, s.SamplingRate = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowFlowSample{}, errors.New("ethernet counters too small") |
| } |
| *data, s.SamplePool = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowFlowSample{}, errors.New("ethernet counters too small") |
| } |
| *data, s.Dropped = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| |
| if expanded { |
| if len(*data) < 4 { |
| return SFlowFlowSample{}, errors.New("ethernet counters too small") |
| } |
| *data, s.InputInterfaceFormat = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowFlowSample{}, errors.New("ethernet counters too small") |
| } |
| *data, s.InputInterface = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowFlowSample{}, errors.New("ethernet counters too small") |
| } |
| *data, s.OutputInterfaceFormat = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowFlowSample{}, errors.New("ethernet counters too small") |
| } |
| *data, s.OutputInterface = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| } else { |
| if len(*data) < 4 { |
| return SFlowFlowSample{}, errors.New("ethernet counters too small") |
| } |
| *data, s.InputInterface = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowFlowSample{}, errors.New("ethernet counters too small") |
| } |
| *data, s.OutputInterface = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| } |
| if len(*data) < 4 { |
| return SFlowFlowSample{}, errors.New("ethernet counters too small") |
| } |
| *data, s.RecordCount = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| |
| for i := uint32(0); i < s.RecordCount; i++ { |
| rdf := SFlowFlowDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| enterpriseID, flowRecordType := rdf.decode() |
| |
| // Try to decode when EnterpriseID is 0 signaling |
| // default sflow structs are used according specification |
| // Unexpected behavior detected for e.g. with pmacct |
| if enterpriseID == 0 { |
| switch flowRecordType { |
| case SFlowTypeRawPacketFlow: |
| if record, err := decodeRawPacketFlowRecord(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeExtendedUserFlow: |
| if record, err := decodeExtendedUserFlow(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeExtendedUrlFlow: |
| if record, err := decodeExtendedURLRecord(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeExtendedSwitchFlow: |
| if record, err := decodeExtendedSwitchFlowRecord(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeExtendedRouterFlow: |
| if record, err := decodeExtendedRouterFlowRecord(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeExtendedGatewayFlow: |
| if record, err := decodeExtendedGatewayFlowRecord(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeEthernetFrameFlow: |
| if record, err := decodeEthernetFrameFlowRecord(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeIpv4Flow: |
| if record, err := decodeSFlowIpv4Record(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeIpv6Flow: |
| if record, err := decodeSFlowIpv6Record(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeExtendedMlpsFlow: |
| // TODO |
| skipRecord(data) |
| return s, errors.New("skipping TypeExtendedMlpsFlow") |
| case SFlowTypeExtendedNatFlow: |
| // TODO |
| skipRecord(data) |
| return s, errors.New("skipping TypeExtendedNatFlow") |
| case SFlowTypeExtendedMlpsTunnelFlow: |
| // TODO |
| skipRecord(data) |
| return s, errors.New("skipping TypeExtendedMlpsTunnelFlow") |
| case SFlowTypeExtendedMlpsVcFlow: |
| // TODO |
| skipRecord(data) |
| return s, errors.New("skipping TypeExtendedMlpsVcFlow") |
| case SFlowTypeExtendedMlpsFecFlow: |
| // TODO |
| skipRecord(data) |
| return s, errors.New("skipping TypeExtendedMlpsFecFlow") |
| case SFlowTypeExtendedMlpsLvpFecFlow: |
| // TODO |
| skipRecord(data) |
| return s, errors.New("skipping TypeExtendedMlpsLvpFecFlow") |
| case SFlowTypeExtendedVlanFlow: |
| // TODO |
| skipRecord(data) |
| return s, errors.New("skipping TypeExtendedVlanFlow") |
| case SFlowTypeExtendedIpv4TunnelEgressFlow: |
| if record, err := decodeExtendedIpv4TunnelEgress(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeExtendedIpv4TunnelIngressFlow: |
| if record, err := decodeExtendedIpv4TunnelIngress(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeExtendedIpv6TunnelEgressFlow: |
| if record, err := decodeExtendedIpv6TunnelEgress(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeExtendedIpv6TunnelIngressFlow: |
| if record, err := decodeExtendedIpv6TunnelIngress(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeExtendedDecapsulateEgressFlow: |
| if record, err := decodeExtendedDecapsulateEgress(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeExtendedDecapsulateIngressFlow: |
| if record, err := decodeExtendedDecapsulateIngress(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeExtendedVniEgressFlow: |
| if record, err := decodeExtendedVniEgress(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeExtendedVniIngressFlow: |
| if record, err := decodeExtendedVniIngress(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| default: |
| return s, fmt.Errorf("Unsupported flow record type: %d", flowRecordType) |
| } |
| } else { |
| skipRecord(data) |
| } |
| } |
| return s, nil |
| } |
| |
| // Counter samples report information about various counter |
| // objects. Typically these are items like IfInOctets, or |
| // CPU / Memory stats, etc. SFlow will report these at regular |
| // intervals as configured on the agent. If one were sufficiently |
| // industrious, this could be used to replace the typical |
| // SNMP polling used for such things. |
| type SFlowCounterSample struct { |
| EnterpriseID SFlowEnterpriseID |
| Format SFlowSampleType |
| SampleLength uint32 |
| SequenceNumber uint32 |
| SourceIDClass SFlowSourceFormat |
| SourceIDIndex SFlowSourceValue |
| RecordCount uint32 |
| Records []SFlowRecord |
| } |
| |
| // Counter samples have the following structure: |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int sample sequence number | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // |id type | src id index value | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | int number of records | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // / counter records / |
| // / / |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| |
| type SFlowCounterDataFormat uint32 |
| |
| func (cdf SFlowCounterDataFormat) decode() (SFlowEnterpriseID, SFlowCounterRecordType) { |
| leftField := cdf >> 12 |
| rightField := uint32(0xFFF) & uint32(cdf) |
| return SFlowEnterpriseID(leftField), SFlowCounterRecordType(rightField) |
| } |
| |
| // GetRecords will return a slice of interface types |
| // representing records. A type switch can be used to |
| // get at the underlying SFlowCounterRecordType. |
| func (cs SFlowCounterSample) GetRecords() []SFlowRecord { |
| return cs.Records |
| } |
| |
| // GetType will report the type of sample. Only the |
| // compact form of counter samples is supported |
| func (cs SFlowCounterSample) GetType() SFlowSampleType { |
| return SFlowTypeCounterSample |
| } |
| |
| type SFlowCounterRecordType uint32 |
| |
| const ( |
| SFlowTypeGenericInterfaceCounters SFlowCounterRecordType = 1 |
| SFlowTypeEthernetInterfaceCounters SFlowCounterRecordType = 2 |
| SFlowTypeTokenRingInterfaceCounters SFlowCounterRecordType = 3 |
| SFlowType100BaseVGInterfaceCounters SFlowCounterRecordType = 4 |
| SFlowTypeVLANCounters SFlowCounterRecordType = 5 |
| SFlowTypeLACPCounters SFlowCounterRecordType = 7 |
| SFlowTypeProcessorCounters SFlowCounterRecordType = 1001 |
| SFlowTypeOpenflowPortCounters SFlowCounterRecordType = 1004 |
| SFlowTypePORTNAMECounters SFlowCounterRecordType = 1005 |
| SFLowTypeAPPRESOURCESCounters SFlowCounterRecordType = 2203 |
| SFlowTypeOVSDPCounters SFlowCounterRecordType = 2207 |
| ) |
| |
| func (cr SFlowCounterRecordType) String() string { |
| switch cr { |
| case SFlowTypeGenericInterfaceCounters: |
| return "Generic Interface Counters" |
| case SFlowTypeEthernetInterfaceCounters: |
| return "Ethernet Interface Counters" |
| case SFlowTypeTokenRingInterfaceCounters: |
| return "Token Ring Interface Counters" |
| case SFlowType100BaseVGInterfaceCounters: |
| return "100BaseVG Interface Counters" |
| case SFlowTypeVLANCounters: |
| return "VLAN Counters" |
| case SFlowTypeLACPCounters: |
| return "LACP Counters" |
| case SFlowTypeProcessorCounters: |
| return "Processor Counters" |
| case SFlowTypeOpenflowPortCounters: |
| return "Openflow Port Counters" |
| case SFlowTypePORTNAMECounters: |
| return "PORT NAME Counters" |
| case SFLowTypeAPPRESOURCESCounters: |
| return "App Resources Counters" |
| case SFlowTypeOVSDPCounters: |
| return "OVSDP Counters" |
| default: |
| return "" |
| |
| } |
| } |
| |
| func decodeCounterSample(data *[]byte, expanded bool) (SFlowCounterSample, error) { |
| s := SFlowCounterSample{} |
| var sdc SFlowDataSource |
| var sdce SFlowDataSourceExpanded |
| var sdf SFlowDataFormat |
| |
| *data, sdf = (*data)[4:], SFlowDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| s.EnterpriseID, s.Format = sdf.decode() |
| *data, s.SampleLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, s.SequenceNumber = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if expanded { |
| *data, sdce = (*data)[8:], SFlowDataSourceExpanded{SFlowSourceFormat(binary.BigEndian.Uint32((*data)[:4])), SFlowSourceValue(binary.BigEndian.Uint32((*data)[4:8]))} |
| s.SourceIDClass, s.SourceIDIndex = sdce.decode() |
| } else { |
| *data, sdc = (*data)[4:], SFlowDataSource(binary.BigEndian.Uint32((*data)[:4])) |
| s.SourceIDClass, s.SourceIDIndex = sdc.decode() |
| } |
| *data, s.RecordCount = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| |
| for i := uint32(0); i < s.RecordCount; i++ { |
| cdf := SFlowCounterDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| _, counterRecordType := cdf.decode() |
| switch counterRecordType { |
| case SFlowTypeGenericInterfaceCounters: |
| if record, err := decodeGenericInterfaceCounters(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeEthernetInterfaceCounters: |
| if record, err := decodeEthernetCounters(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeTokenRingInterfaceCounters: |
| skipRecord(data) |
| return s, errors.New("skipping TypeTokenRingInterfaceCounters") |
| case SFlowType100BaseVGInterfaceCounters: |
| skipRecord(data) |
| return s, errors.New("skipping Type100BaseVGInterfaceCounters") |
| case SFlowTypeVLANCounters: |
| if record, err := decodeVLANCounters(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeLACPCounters: |
| if record, err := decodeLACPCounters(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeProcessorCounters: |
| if record, err := decodeProcessorCounters(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeOpenflowPortCounters: |
| if record, err := decodeOpenflowportCounters(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypePORTNAMECounters: |
| if record, err := decodePortnameCounters(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFLowTypeAPPRESOURCESCounters: |
| if record, err := decodeAppresourcesCounters(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| case SFlowTypeOVSDPCounters: |
| if record, err := decodeOVSDPCounters(data); err == nil { |
| s.Records = append(s.Records, record) |
| } else { |
| return s, err |
| } |
| default: |
| return s, fmt.Errorf("Invalid counter record type: %d", counterRecordType) |
| } |
| } |
| return s, nil |
| } |
| |
| // SFlowBaseFlowRecord holds the fields common to all records |
| // of type SFlowFlowRecordType |
| type SFlowBaseFlowRecord struct { |
| EnterpriseID SFlowEnterpriseID |
| Format SFlowFlowRecordType |
| FlowDataLength uint32 |
| } |
| |
| func (bfr SFlowBaseFlowRecord) GetType() SFlowFlowRecordType { |
| return bfr.Format |
| } |
| |
| // SFlowFlowRecordType denotes what kind of Flow Record is |
| // represented. See RFC 3176 |
| type SFlowFlowRecordType uint32 |
| |
| const ( |
| SFlowTypeRawPacketFlow SFlowFlowRecordType = 1 |
| SFlowTypeEthernetFrameFlow SFlowFlowRecordType = 2 |
| SFlowTypeIpv4Flow SFlowFlowRecordType = 3 |
| SFlowTypeIpv6Flow SFlowFlowRecordType = 4 |
| SFlowTypeExtendedSwitchFlow SFlowFlowRecordType = 1001 |
| SFlowTypeExtendedRouterFlow SFlowFlowRecordType = 1002 |
| SFlowTypeExtendedGatewayFlow SFlowFlowRecordType = 1003 |
| SFlowTypeExtendedUserFlow SFlowFlowRecordType = 1004 |
| SFlowTypeExtendedUrlFlow SFlowFlowRecordType = 1005 |
| SFlowTypeExtendedMlpsFlow SFlowFlowRecordType = 1006 |
| SFlowTypeExtendedNatFlow SFlowFlowRecordType = 1007 |
| SFlowTypeExtendedMlpsTunnelFlow SFlowFlowRecordType = 1008 |
| SFlowTypeExtendedMlpsVcFlow SFlowFlowRecordType = 1009 |
| SFlowTypeExtendedMlpsFecFlow SFlowFlowRecordType = 1010 |
| SFlowTypeExtendedMlpsLvpFecFlow SFlowFlowRecordType = 1011 |
| SFlowTypeExtendedVlanFlow SFlowFlowRecordType = 1012 |
| SFlowTypeExtendedIpv4TunnelEgressFlow SFlowFlowRecordType = 1023 |
| SFlowTypeExtendedIpv4TunnelIngressFlow SFlowFlowRecordType = 1024 |
| SFlowTypeExtendedIpv6TunnelEgressFlow SFlowFlowRecordType = 1025 |
| SFlowTypeExtendedIpv6TunnelIngressFlow SFlowFlowRecordType = 1026 |
| SFlowTypeExtendedDecapsulateEgressFlow SFlowFlowRecordType = 1027 |
| SFlowTypeExtendedDecapsulateIngressFlow SFlowFlowRecordType = 1028 |
| SFlowTypeExtendedVniEgressFlow SFlowFlowRecordType = 1029 |
| SFlowTypeExtendedVniIngressFlow SFlowFlowRecordType = 1030 |
| ) |
| |
| func (rt SFlowFlowRecordType) String() string { |
| switch rt { |
| case SFlowTypeRawPacketFlow: |
| return "Raw Packet Flow Record" |
| case SFlowTypeEthernetFrameFlow: |
| return "Ethernet Frame Flow Record" |
| case SFlowTypeIpv4Flow: |
| return "IPv4 Flow Record" |
| case SFlowTypeIpv6Flow: |
| return "IPv6 Flow Record" |
| case SFlowTypeExtendedSwitchFlow: |
| return "Extended Switch Flow Record" |
| case SFlowTypeExtendedRouterFlow: |
| return "Extended Router Flow Record" |
| case SFlowTypeExtendedGatewayFlow: |
| return "Extended Gateway Flow Record" |
| case SFlowTypeExtendedUserFlow: |
| return "Extended User Flow Record" |
| case SFlowTypeExtendedUrlFlow: |
| return "Extended URL Flow Record" |
| case SFlowTypeExtendedMlpsFlow: |
| return "Extended MPLS Flow Record" |
| case SFlowTypeExtendedNatFlow: |
| return "Extended NAT Flow Record" |
| case SFlowTypeExtendedMlpsTunnelFlow: |
| return "Extended MPLS Tunnel Flow Record" |
| case SFlowTypeExtendedMlpsVcFlow: |
| return "Extended MPLS VC Flow Record" |
| case SFlowTypeExtendedMlpsFecFlow: |
| return "Extended MPLS FEC Flow Record" |
| case SFlowTypeExtendedMlpsLvpFecFlow: |
| return "Extended MPLS LVP FEC Flow Record" |
| case SFlowTypeExtendedVlanFlow: |
| return "Extended VLAN Flow Record" |
| case SFlowTypeExtendedIpv4TunnelEgressFlow: |
| return "Extended IPv4 Tunnel Egress Record" |
| case SFlowTypeExtendedIpv4TunnelIngressFlow: |
| return "Extended IPv4 Tunnel Ingress Record" |
| case SFlowTypeExtendedIpv6TunnelEgressFlow: |
| return "Extended IPv6 Tunnel Egress Record" |
| case SFlowTypeExtendedIpv6TunnelIngressFlow: |
| return "Extended IPv6 Tunnel Ingress Record" |
| case SFlowTypeExtendedDecapsulateEgressFlow: |
| return "Extended Decapsulate Egress Record" |
| case SFlowTypeExtendedDecapsulateIngressFlow: |
| return "Extended Decapsulate Ingress Record" |
| case SFlowTypeExtendedVniEgressFlow: |
| return "Extended VNI Ingress Record" |
| case SFlowTypeExtendedVniIngressFlow: |
| return "Extended VNI Ingress Record" |
| default: |
| return "" |
| } |
| } |
| |
| // SFlowRawPacketFlowRecords hold information about a sampled |
| // packet grabbed as it transited the agent. This is |
| // perhaps the most useful and interesting record type, |
| // as it holds the headers of the sampled packet and |
| // can be used to build up a complete picture of the |
| // traffic patterns on a network. |
| // |
| // The raw packet header is sent back into gopacket for |
| // decoding, and the resulting gopackt.Packet is stored |
| // in the Header member |
| type SFlowRawPacketFlowRecord struct { |
| SFlowBaseFlowRecord |
| HeaderProtocol SFlowRawHeaderProtocol |
| FrameLength uint32 |
| PayloadRemoved uint32 |
| HeaderLength uint32 |
| Header gopacket.Packet |
| } |
| |
| // Raw packet record types have the following structure: |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | record length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Header Protocol | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Frame Length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Payload Removed | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Header Length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // \ Header \ |
| // \ \ |
| // \ \ |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| |
| type SFlowRawHeaderProtocol uint32 |
| |
| const ( |
| SFlowProtoEthernet SFlowRawHeaderProtocol = 1 |
| SFlowProtoISO88024 SFlowRawHeaderProtocol = 2 |
| SFlowProtoISO88025 SFlowRawHeaderProtocol = 3 |
| SFlowProtoFDDI SFlowRawHeaderProtocol = 4 |
| SFlowProtoFrameRelay SFlowRawHeaderProtocol = 5 |
| SFlowProtoX25 SFlowRawHeaderProtocol = 6 |
| SFlowProtoPPP SFlowRawHeaderProtocol = 7 |
| SFlowProtoSMDS SFlowRawHeaderProtocol = 8 |
| SFlowProtoAAL5 SFlowRawHeaderProtocol = 9 |
| SFlowProtoAAL5_IP SFlowRawHeaderProtocol = 10 /* e.g. Cisco AAL5 mux */ |
| SFlowProtoIPv4 SFlowRawHeaderProtocol = 11 |
| SFlowProtoIPv6 SFlowRawHeaderProtocol = 12 |
| SFlowProtoMPLS SFlowRawHeaderProtocol = 13 |
| SFlowProtoPOS SFlowRawHeaderProtocol = 14 /* RFC 1662, 2615 */ |
| ) |
| |
| func (sfhp SFlowRawHeaderProtocol) String() string { |
| switch sfhp { |
| case SFlowProtoEthernet: |
| return "ETHERNET-ISO88023" |
| case SFlowProtoISO88024: |
| return "ISO88024-TOKENBUS" |
| case SFlowProtoISO88025: |
| return "ISO88025-TOKENRING" |
| case SFlowProtoFDDI: |
| return "FDDI" |
| case SFlowProtoFrameRelay: |
| return "FRAME-RELAY" |
| case SFlowProtoX25: |
| return "X25" |
| case SFlowProtoPPP: |
| return "PPP" |
| case SFlowProtoSMDS: |
| return "SMDS" |
| case SFlowProtoAAL5: |
| return "AAL5" |
| case SFlowProtoAAL5_IP: |
| return "AAL5-IP" |
| case SFlowProtoIPv4: |
| return "IPv4" |
| case SFlowProtoIPv6: |
| return "IPv6" |
| case SFlowProtoMPLS: |
| return "MPLS" |
| case SFlowProtoPOS: |
| return "POS" |
| } |
| return "UNKNOWN" |
| } |
| |
| func decodeRawPacketFlowRecord(data *[]byte) (SFlowRawPacketFlowRecord, error) { |
| rec := SFlowRawPacketFlowRecord{} |
| header := []byte{} |
| var fdf SFlowFlowDataFormat |
| |
| *data, fdf = (*data)[4:], SFlowFlowDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| rec.EnterpriseID, rec.Format = fdf.decode() |
| *data, rec.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, rec.HeaderProtocol = (*data)[4:], SFlowRawHeaderProtocol(binary.BigEndian.Uint32((*data)[:4])) |
| *data, rec.FrameLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, rec.PayloadRemoved = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, rec.HeaderLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| headerLenWithPadding := int(rec.HeaderLength + ((4 - rec.HeaderLength) % 4)) |
| *data, header = (*data)[headerLenWithPadding:], (*data)[:headerLenWithPadding] |
| rec.Header = gopacket.NewPacket(header, LayerTypeEthernet, gopacket.Default) |
| return rec, nil |
| } |
| |
| // SFlowExtendedSwitchFlowRecord give additional information |
| // about the sampled packet if it's available. It's mainly |
| // useful for getting at the incoming and outgoing VLANs |
| // An agent may or may not provide this information. |
| type SFlowExtendedSwitchFlowRecord struct { |
| SFlowBaseFlowRecord |
| IncomingVLAN uint32 |
| IncomingVLANPriority uint32 |
| OutgoingVLAN uint32 |
| OutgoingVLANPriority uint32 |
| } |
| |
| // Extended switch records have the following structure: |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | record length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Incoming VLAN | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Incoming VLAN Priority | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Outgoing VLAN | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Outgoing VLAN Priority | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| |
| func decodeExtendedSwitchFlowRecord(data *[]byte) (SFlowExtendedSwitchFlowRecord, error) { |
| es := SFlowExtendedSwitchFlowRecord{} |
| var fdf SFlowFlowDataFormat |
| |
| *data, fdf = (*data)[4:], SFlowFlowDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| es.EnterpriseID, es.Format = fdf.decode() |
| *data, es.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, es.IncomingVLAN = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, es.IncomingVLANPriority = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, es.OutgoingVLAN = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, es.OutgoingVLANPriority = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| return es, nil |
| } |
| |
| // SFlowExtendedRouterFlowRecord gives additional information |
| // about the layer 3 routing information used to forward |
| // the packet |
| type SFlowExtendedRouterFlowRecord struct { |
| SFlowBaseFlowRecord |
| NextHop net.IP |
| NextHopSourceMask uint32 |
| NextHopDestinationMask uint32 |
| } |
| |
| // Extended router records have the following structure: |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | record length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IP version of next hop router (1=v4|2=v6) | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // / Next Hop address (v4=4byte|v6=16byte) / |
| // / / |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Next Hop Source Mask | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Next Hop Destination Mask | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| |
| func decodeExtendedRouterFlowRecord(data *[]byte) (SFlowExtendedRouterFlowRecord, error) { |
| er := SFlowExtendedRouterFlowRecord{} |
| var fdf SFlowFlowDataFormat |
| var extendedRouterAddressType SFlowIPType |
| |
| *data, fdf = (*data)[4:], SFlowFlowDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| er.EnterpriseID, er.Format = fdf.decode() |
| *data, er.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, extendedRouterAddressType = (*data)[4:], SFlowIPType(binary.BigEndian.Uint32((*data)[:4])) |
| *data, er.NextHop = (*data)[extendedRouterAddressType.Length():], (*data)[:extendedRouterAddressType.Length()] |
| *data, er.NextHopSourceMask = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, er.NextHopDestinationMask = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| return er, nil |
| } |
| |
| // SFlowExtendedGatewayFlowRecord describes information treasured by |
| // nework engineers everywhere: AS path information listing which |
| // BGP peer sent the packet, and various other BGP related info. |
| // This information is vital because it gives a picture of how much |
| // traffic is being sent from / received by various BGP peers. |
| |
| // Extended gateway records have the following structure: |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | record length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IP version of next hop router (1=v4|2=v6) | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // / Next Hop address (v4=4byte|v6=16byte) / |
| // / / |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | AS | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Source AS | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Peer AS | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | AS Path Count | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // / AS Path / Sequence / |
| // / / |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // / Communities / |
| // / / |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Local Pref | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| |
| // AS Path / Sequence: |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | AS Source Type (Path=1 / Sequence=2) | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Path / Sequence length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // / Path / Sequence Members / |
| // / / |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| |
| // Communities: |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | communitiy length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // / communitiy Members / |
| // / / |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| |
| type SFlowExtendedGatewayFlowRecord struct { |
| SFlowBaseFlowRecord |
| NextHop net.IP |
| AS uint32 |
| SourceAS uint32 |
| PeerAS uint32 |
| ASPathCount uint32 |
| ASPath []SFlowASDestination |
| Communities []uint32 |
| LocalPref uint32 |
| } |
| |
| type SFlowASPathType uint32 |
| |
| const ( |
| SFlowASSet SFlowASPathType = 1 |
| SFlowASSequence SFlowASPathType = 2 |
| ) |
| |
| func (apt SFlowASPathType) String() string { |
| switch apt { |
| case SFlowASSet: |
| return "AS Set" |
| case SFlowASSequence: |
| return "AS Sequence" |
| default: |
| return "" |
| } |
| } |
| |
| type SFlowASDestination struct { |
| Type SFlowASPathType |
| Count uint32 |
| Members []uint32 |
| } |
| |
| func (asd SFlowASDestination) String() string { |
| switch asd.Type { |
| case SFlowASSet: |
| return fmt.Sprint("AS Set:", asd.Members) |
| case SFlowASSequence: |
| return fmt.Sprint("AS Sequence:", asd.Members) |
| default: |
| return "" |
| } |
| } |
| |
| func (ad *SFlowASDestination) decodePath(data *[]byte) { |
| *data, ad.Type = (*data)[4:], SFlowASPathType(binary.BigEndian.Uint32((*data)[:4])) |
| *data, ad.Count = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| ad.Members = make([]uint32, ad.Count) |
| for i := uint32(0); i < ad.Count; i++ { |
| var member uint32 |
| *data, member = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| ad.Members[i] = member |
| } |
| } |
| |
| func decodeExtendedGatewayFlowRecord(data *[]byte) (SFlowExtendedGatewayFlowRecord, error) { |
| eg := SFlowExtendedGatewayFlowRecord{} |
| var fdf SFlowFlowDataFormat |
| var extendedGatewayAddressType SFlowIPType |
| var communitiesLength uint32 |
| var community uint32 |
| |
| *data, fdf = (*data)[4:], SFlowFlowDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| eg.EnterpriseID, eg.Format = fdf.decode() |
| *data, eg.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, extendedGatewayAddressType = (*data)[4:], SFlowIPType(binary.BigEndian.Uint32((*data)[:4])) |
| *data, eg.NextHop = (*data)[extendedGatewayAddressType.Length():], (*data)[:extendedGatewayAddressType.Length()] |
| *data, eg.AS = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, eg.SourceAS = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, eg.PeerAS = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, eg.ASPathCount = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| for i := uint32(0); i < eg.ASPathCount; i++ { |
| asPath := SFlowASDestination{} |
| asPath.decodePath(data) |
| eg.ASPath = append(eg.ASPath, asPath) |
| } |
| *data, communitiesLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| eg.Communities = make([]uint32, communitiesLength) |
| for j := uint32(0); j < communitiesLength; j++ { |
| *data, community = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| eg.Communities[j] = community |
| } |
| *data, eg.LocalPref = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| return eg, nil |
| } |
| |
| // ************************************************** |
| // Extended URL Flow Record |
| // ************************************************** |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | record length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | direction | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | URL | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Host | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| |
| type SFlowURLDirection uint32 |
| |
| const ( |
| SFlowURLsrc SFlowURLDirection = 1 |
| SFlowURLdst SFlowURLDirection = 2 |
| ) |
| |
| func (urld SFlowURLDirection) String() string { |
| switch urld { |
| case SFlowURLsrc: |
| return "Source address is the server" |
| case SFlowURLdst: |
| return "Destination address is the server" |
| default: |
| return "" |
| } |
| } |
| |
| type SFlowExtendedURLRecord struct { |
| SFlowBaseFlowRecord |
| Direction SFlowURLDirection |
| URL string |
| Host string |
| } |
| |
| func decodeExtendedURLRecord(data *[]byte) (SFlowExtendedURLRecord, error) { |
| eur := SFlowExtendedURLRecord{} |
| var fdf SFlowFlowDataFormat |
| var urlLen uint32 |
| var urlLenWithPad int |
| var hostLen uint32 |
| var hostLenWithPad int |
| var urlBytes []byte |
| var hostBytes []byte |
| |
| *data, fdf = (*data)[4:], SFlowFlowDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| eur.EnterpriseID, eur.Format = fdf.decode() |
| *data, eur.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, eur.Direction = (*data)[4:], SFlowURLDirection(binary.BigEndian.Uint32((*data)[:4])) |
| *data, urlLen = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| urlLenWithPad = int(urlLen + ((4 - urlLen) % 4)) |
| *data, urlBytes = (*data)[urlLenWithPad:], (*data)[:urlLenWithPad] |
| eur.URL = string(urlBytes[:urlLen]) |
| *data, hostLen = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| hostLenWithPad = int(hostLen + ((4 - hostLen) % 4)) |
| *data, hostBytes = (*data)[hostLenWithPad:], (*data)[:hostLenWithPad] |
| eur.Host = string(hostBytes[:hostLen]) |
| return eur, nil |
| } |
| |
| // ************************************************** |
| // Extended User Flow Record |
| // ************************************************** |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | record length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Source Character Set | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Source User Id | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Destination Character Set | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Destination User ID | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| |
| type SFlowExtendedUserFlow struct { |
| SFlowBaseFlowRecord |
| SourceCharSet SFlowCharSet |
| SourceUserID string |
| DestinationCharSet SFlowCharSet |
| DestinationUserID string |
| } |
| |
| type SFlowCharSet uint32 |
| |
| const ( |
| SFlowCSunknown SFlowCharSet = 2 |
| SFlowCSASCII SFlowCharSet = 3 |
| SFlowCSISOLatin1 SFlowCharSet = 4 |
| SFlowCSISOLatin2 SFlowCharSet = 5 |
| SFlowCSISOLatin3 SFlowCharSet = 6 |
| SFlowCSISOLatin4 SFlowCharSet = 7 |
| SFlowCSISOLatinCyrillic SFlowCharSet = 8 |
| SFlowCSISOLatinArabic SFlowCharSet = 9 |
| SFlowCSISOLatinGreek SFlowCharSet = 10 |
| SFlowCSISOLatinHebrew SFlowCharSet = 11 |
| SFlowCSISOLatin5 SFlowCharSet = 12 |
| SFlowCSISOLatin6 SFlowCharSet = 13 |
| SFlowCSISOTextComm SFlowCharSet = 14 |
| SFlowCSHalfWidthKatakana SFlowCharSet = 15 |
| SFlowCSJISEncoding SFlowCharSet = 16 |
| SFlowCSShiftJIS SFlowCharSet = 17 |
| SFlowCSEUCPkdFmtJapanese SFlowCharSet = 18 |
| SFlowCSEUCFixWidJapanese SFlowCharSet = 19 |
| SFlowCSISO4UnitedKingdom SFlowCharSet = 20 |
| SFlowCSISO11SwedishForNames SFlowCharSet = 21 |
| SFlowCSISO15Italian SFlowCharSet = 22 |
| SFlowCSISO17Spanish SFlowCharSet = 23 |
| SFlowCSISO21German SFlowCharSet = 24 |
| SFlowCSISO60DanishNorwegian SFlowCharSet = 25 |
| SFlowCSISO69French SFlowCharSet = 26 |
| SFlowCSISO10646UTF1 SFlowCharSet = 27 |
| SFlowCSISO646basic1983 SFlowCharSet = 28 |
| SFlowCSINVARIANT SFlowCharSet = 29 |
| SFlowCSISO2IntlRefVersion SFlowCharSet = 30 |
| SFlowCSNATSSEFI SFlowCharSet = 31 |
| SFlowCSNATSSEFIADD SFlowCharSet = 32 |
| SFlowCSNATSDANO SFlowCharSet = 33 |
| SFlowCSNATSDANOADD SFlowCharSet = 34 |
| SFlowCSISO10Swedish SFlowCharSet = 35 |
| SFlowCSKSC56011987 SFlowCharSet = 36 |
| SFlowCSISO2022KR SFlowCharSet = 37 |
| SFlowCSEUCKR SFlowCharSet = 38 |
| SFlowCSISO2022JP SFlowCharSet = 39 |
| SFlowCSISO2022JP2 SFlowCharSet = 40 |
| SFlowCSISO13JISC6220jp SFlowCharSet = 41 |
| SFlowCSISO14JISC6220ro SFlowCharSet = 42 |
| SFlowCSISO16Portuguese SFlowCharSet = 43 |
| SFlowCSISO18Greek7Old SFlowCharSet = 44 |
| SFlowCSISO19LatinGreek SFlowCharSet = 45 |
| SFlowCSISO25French SFlowCharSet = 46 |
| SFlowCSISO27LatinGreek1 SFlowCharSet = 47 |
| SFlowCSISO5427Cyrillic SFlowCharSet = 48 |
| SFlowCSISO42JISC62261978 SFlowCharSet = 49 |
| SFlowCSISO47BSViewdata SFlowCharSet = 50 |
| SFlowCSISO49INIS SFlowCharSet = 51 |
| SFlowCSISO50INIS8 SFlowCharSet = 52 |
| SFlowCSISO51INISCyrillic SFlowCharSet = 53 |
| SFlowCSISO54271981 SFlowCharSet = 54 |
| SFlowCSISO5428Greek SFlowCharSet = 55 |
| SFlowCSISO57GB1988 SFlowCharSet = 56 |
| SFlowCSISO58GB231280 SFlowCharSet = 57 |
| SFlowCSISO61Norwegian2 SFlowCharSet = 58 |
| SFlowCSISO70VideotexSupp1 SFlowCharSet = 59 |
| SFlowCSISO84Portuguese2 SFlowCharSet = 60 |
| SFlowCSISO85Spanish2 SFlowCharSet = 61 |
| SFlowCSISO86Hungarian SFlowCharSet = 62 |
| SFlowCSISO87JISX0208 SFlowCharSet = 63 |
| SFlowCSISO88Greek7 SFlowCharSet = 64 |
| SFlowCSISO89ASMO449 SFlowCharSet = 65 |
| SFlowCSISO90 SFlowCharSet = 66 |
| SFlowCSISO91JISC62291984a SFlowCharSet = 67 |
| SFlowCSISO92JISC62991984b SFlowCharSet = 68 |
| SFlowCSISO93JIS62291984badd SFlowCharSet = 69 |
| SFlowCSISO94JIS62291984hand SFlowCharSet = 70 |
| SFlowCSISO95JIS62291984handadd SFlowCharSet = 71 |
| SFlowCSISO96JISC62291984kana SFlowCharSet = 72 |
| SFlowCSISO2033 SFlowCharSet = 73 |
| SFlowCSISO99NAPLPS SFlowCharSet = 74 |
| SFlowCSISO102T617bit SFlowCharSet = 75 |
| SFlowCSISO103T618bit SFlowCharSet = 76 |
| SFlowCSISO111ECMACyrillic SFlowCharSet = 77 |
| SFlowCSa71 SFlowCharSet = 78 |
| SFlowCSa72 SFlowCharSet = 79 |
| SFlowCSISO123CSAZ24341985gr SFlowCharSet = 80 |
| SFlowCSISO88596E SFlowCharSet = 81 |
| SFlowCSISO88596I SFlowCharSet = 82 |
| SFlowCSISO128T101G2 SFlowCharSet = 83 |
| SFlowCSISO88598E SFlowCharSet = 84 |
| SFlowCSISO88598I SFlowCharSet = 85 |
| SFlowCSISO139CSN369103 SFlowCharSet = 86 |
| SFlowCSISO141JUSIB1002 SFlowCharSet = 87 |
| SFlowCSISO143IECP271 SFlowCharSet = 88 |
| SFlowCSISO146Serbian SFlowCharSet = 89 |
| SFlowCSISO147Macedonian SFlowCharSet = 90 |
| SFlowCSISO150 SFlowCharSet = 91 |
| SFlowCSISO151Cuba SFlowCharSet = 92 |
| SFlowCSISO6937Add SFlowCharSet = 93 |
| SFlowCSISO153GOST1976874 SFlowCharSet = 94 |
| SFlowCSISO8859Supp SFlowCharSet = 95 |
| SFlowCSISO10367Box SFlowCharSet = 96 |
| SFlowCSISO158Lap SFlowCharSet = 97 |
| SFlowCSISO159JISX02121990 SFlowCharSet = 98 |
| SFlowCSISO646Danish SFlowCharSet = 99 |
| SFlowCSUSDK SFlowCharSet = 100 |
| SFlowCSDKUS SFlowCharSet = 101 |
| SFlowCSKSC5636 SFlowCharSet = 102 |
| SFlowCSUnicode11UTF7 SFlowCharSet = 103 |
| SFlowCSISO2022CN SFlowCharSet = 104 |
| SFlowCSISO2022CNEXT SFlowCharSet = 105 |
| SFlowCSUTF8 SFlowCharSet = 106 |
| SFlowCSISO885913 SFlowCharSet = 109 |
| SFlowCSISO885914 SFlowCharSet = 110 |
| SFlowCSISO885915 SFlowCharSet = 111 |
| SFlowCSISO885916 SFlowCharSet = 112 |
| SFlowCSGBK SFlowCharSet = 113 |
| SFlowCSGB18030 SFlowCharSet = 114 |
| SFlowCSOSDEBCDICDF0415 SFlowCharSet = 115 |
| SFlowCSOSDEBCDICDF03IRV SFlowCharSet = 116 |
| SFlowCSOSDEBCDICDF041 SFlowCharSet = 117 |
| SFlowCSISO115481 SFlowCharSet = 118 |
| SFlowCSKZ1048 SFlowCharSet = 119 |
| SFlowCSUnicode SFlowCharSet = 1000 |
| SFlowCSUCS4 SFlowCharSet = 1001 |
| SFlowCSUnicodeASCII SFlowCharSet = 1002 |
| SFlowCSUnicodeLatin1 SFlowCharSet = 1003 |
| SFlowCSUnicodeJapanese SFlowCharSet = 1004 |
| SFlowCSUnicodeIBM1261 SFlowCharSet = 1005 |
| SFlowCSUnicodeIBM1268 SFlowCharSet = 1006 |
| SFlowCSUnicodeIBM1276 SFlowCharSet = 1007 |
| SFlowCSUnicodeIBM1264 SFlowCharSet = 1008 |
| SFlowCSUnicodeIBM1265 SFlowCharSet = 1009 |
| SFlowCSUnicode11 SFlowCharSet = 1010 |
| SFlowCSSCSU SFlowCharSet = 1011 |
| SFlowCSUTF7 SFlowCharSet = 1012 |
| SFlowCSUTF16BE SFlowCharSet = 1013 |
| SFlowCSUTF16LE SFlowCharSet = 1014 |
| SFlowCSUTF16 SFlowCharSet = 1015 |
| SFlowCSCESU8 SFlowCharSet = 1016 |
| SFlowCSUTF32 SFlowCharSet = 1017 |
| SFlowCSUTF32BE SFlowCharSet = 1018 |
| SFlowCSUTF32LE SFlowCharSet = 1019 |
| SFlowCSBOCU1 SFlowCharSet = 1020 |
| SFlowCSWindows30Latin1 SFlowCharSet = 2000 |
| SFlowCSWindows31Latin1 SFlowCharSet = 2001 |
| SFlowCSWindows31Latin2 SFlowCharSet = 2002 |
| SFlowCSWindows31Latin5 SFlowCharSet = 2003 |
| SFlowCSHPRoman8 SFlowCharSet = 2004 |
| SFlowCSAdobeStandardEncoding SFlowCharSet = 2005 |
| SFlowCSVenturaUS SFlowCharSet = 2006 |
| SFlowCSVenturaInternational SFlowCharSet = 2007 |
| SFlowCSDECMCS SFlowCharSet = 2008 |
| SFlowCSPC850Multilingual SFlowCharSet = 2009 |
| SFlowCSPCp852 SFlowCharSet = 2010 |
| SFlowCSPC8CodePage437 SFlowCharSet = 2011 |
| SFlowCSPC8DanishNorwegian SFlowCharSet = 2012 |
| SFlowCSPC862LatinHebrew SFlowCharSet = 2013 |
| SFlowCSPC8Turkish SFlowCharSet = 2014 |
| SFlowCSIBMSymbols SFlowCharSet = 2015 |
| SFlowCSIBMThai SFlowCharSet = 2016 |
| SFlowCSHPLegal SFlowCharSet = 2017 |
| SFlowCSHPPiFont SFlowCharSet = 2018 |
| SFlowCSHPMath8 SFlowCharSet = 2019 |
| SFlowCSHPPSMath SFlowCharSet = 2020 |
| SFlowCSHPDesktop SFlowCharSet = 2021 |
| SFlowCSVenturaMath SFlowCharSet = 2022 |
| SFlowCSMicrosoftPublishing SFlowCharSet = 2023 |
| SFlowCSWindows31J SFlowCharSet = 2024 |
| SFlowCSGB2312 SFlowCharSet = 2025 |
| SFlowCSBig5 SFlowCharSet = 2026 |
| SFlowCSMacintosh SFlowCharSet = 2027 |
| SFlowCSIBM037 SFlowCharSet = 2028 |
| SFlowCSIBM038 SFlowCharSet = 2029 |
| SFlowCSIBM273 SFlowCharSet = 2030 |
| SFlowCSIBM274 SFlowCharSet = 2031 |
| SFlowCSIBM275 SFlowCharSet = 2032 |
| SFlowCSIBM277 SFlowCharSet = 2033 |
| SFlowCSIBM278 SFlowCharSet = 2034 |
| SFlowCSIBM280 SFlowCharSet = 2035 |
| SFlowCSIBM281 SFlowCharSet = 2036 |
| SFlowCSIBM284 SFlowCharSet = 2037 |
| SFlowCSIBM285 SFlowCharSet = 2038 |
| SFlowCSIBM290 SFlowCharSet = 2039 |
| SFlowCSIBM297 SFlowCharSet = 2040 |
| SFlowCSIBM420 SFlowCharSet = 2041 |
| SFlowCSIBM423 SFlowCharSet = 2042 |
| SFlowCSIBM424 SFlowCharSet = 2043 |
| SFlowCSIBM500 SFlowCharSet = 2044 |
| SFlowCSIBM851 SFlowCharSet = 2045 |
| SFlowCSIBM855 SFlowCharSet = 2046 |
| SFlowCSIBM857 SFlowCharSet = 2047 |
| SFlowCSIBM860 SFlowCharSet = 2048 |
| SFlowCSIBM861 SFlowCharSet = 2049 |
| SFlowCSIBM863 SFlowCharSet = 2050 |
| SFlowCSIBM864 SFlowCharSet = 2051 |
| SFlowCSIBM865 SFlowCharSet = 2052 |
| SFlowCSIBM868 SFlowCharSet = 2053 |
| SFlowCSIBM869 SFlowCharSet = 2054 |
| SFlowCSIBM870 SFlowCharSet = 2055 |
| SFlowCSIBM871 SFlowCharSet = 2056 |
| SFlowCSIBM880 SFlowCharSet = 2057 |
| SFlowCSIBM891 SFlowCharSet = 2058 |
| SFlowCSIBM903 SFlowCharSet = 2059 |
| SFlowCSIBBM904 SFlowCharSet = 2060 |
| SFlowCSIBM905 SFlowCharSet = 2061 |
| SFlowCSIBM918 SFlowCharSet = 2062 |
| SFlowCSIBM1026 SFlowCharSet = 2063 |
| SFlowCSIBMEBCDICATDE SFlowCharSet = 2064 |
| SFlowCSEBCDICATDEA SFlowCharSet = 2065 |
| SFlowCSEBCDICCAFR SFlowCharSet = 2066 |
| SFlowCSEBCDICDKNO SFlowCharSet = 2067 |
| SFlowCSEBCDICDKNOA SFlowCharSet = 2068 |
| SFlowCSEBCDICFISE SFlowCharSet = 2069 |
| SFlowCSEBCDICFISEA SFlowCharSet = 2070 |
| SFlowCSEBCDICFR SFlowCharSet = 2071 |
| SFlowCSEBCDICIT SFlowCharSet = 2072 |
| SFlowCSEBCDICPT SFlowCharSet = 2073 |
| SFlowCSEBCDICES SFlowCharSet = 2074 |
| SFlowCSEBCDICESA SFlowCharSet = 2075 |
| SFlowCSEBCDICESS SFlowCharSet = 2076 |
| SFlowCSEBCDICUK SFlowCharSet = 2077 |
| SFlowCSEBCDICUS SFlowCharSet = 2078 |
| SFlowCSUnknown8BiT SFlowCharSet = 2079 |
| SFlowCSMnemonic SFlowCharSet = 2080 |
| SFlowCSMnem SFlowCharSet = 2081 |
| SFlowCSVISCII SFlowCharSet = 2082 |
| SFlowCSVIQR SFlowCharSet = 2083 |
| SFlowCSKOI8R SFlowCharSet = 2084 |
| SFlowCSHZGB2312 SFlowCharSet = 2085 |
| SFlowCSIBM866 SFlowCharSet = 2086 |
| SFlowCSPC775Baltic SFlowCharSet = 2087 |
| SFlowCSKOI8U SFlowCharSet = 2088 |
| SFlowCSIBM00858 SFlowCharSet = 2089 |
| SFlowCSIBM00924 SFlowCharSet = 2090 |
| SFlowCSIBM01140 SFlowCharSet = 2091 |
| SFlowCSIBM01141 SFlowCharSet = 2092 |
| SFlowCSIBM01142 SFlowCharSet = 2093 |
| SFlowCSIBM01143 SFlowCharSet = 2094 |
| SFlowCSIBM01144 SFlowCharSet = 2095 |
| SFlowCSIBM01145 SFlowCharSet = 2096 |
| SFlowCSIBM01146 SFlowCharSet = 2097 |
| SFlowCSIBM01147 SFlowCharSet = 2098 |
| SFlowCSIBM01148 SFlowCharSet = 2099 |
| SFlowCSIBM01149 SFlowCharSet = 2100 |
| SFlowCSBig5HKSCS SFlowCharSet = 2101 |
| SFlowCSIBM1047 SFlowCharSet = 2102 |
| SFlowCSPTCP154 SFlowCharSet = 2103 |
| SFlowCSAmiga1251 SFlowCharSet = 2104 |
| SFlowCSKOI7switched SFlowCharSet = 2105 |
| SFlowCSBRF SFlowCharSet = 2106 |
| SFlowCSTSCII SFlowCharSet = 2107 |
| SFlowCSCP51932 SFlowCharSet = 2108 |
| SFlowCSWindows874 SFlowCharSet = 2109 |
| SFlowCSWindows1250 SFlowCharSet = 2250 |
| SFlowCSWindows1251 SFlowCharSet = 2251 |
| SFlowCSWindows1252 SFlowCharSet = 2252 |
| SFlowCSWindows1253 SFlowCharSet = 2253 |
| SFlowCSWindows1254 SFlowCharSet = 2254 |
| SFlowCSWindows1255 SFlowCharSet = 2255 |
| SFlowCSWindows1256 SFlowCharSet = 2256 |
| SFlowCSWindows1257 SFlowCharSet = 2257 |
| SFlowCSWindows1258 SFlowCharSet = 2258 |
| SFlowCSTIS620 SFlowCharSet = 2259 |
| SFlowCS50220 SFlowCharSet = 2260 |
| SFlowCSreserved SFlowCharSet = 3000 |
| ) |
| |
| func decodeExtendedUserFlow(data *[]byte) (SFlowExtendedUserFlow, error) { |
| eu := SFlowExtendedUserFlow{} |
| var fdf SFlowFlowDataFormat |
| var srcUserLen uint32 |
| var srcUserLenWithPad int |
| var srcUserBytes []byte |
| var dstUserLen uint32 |
| var dstUserLenWithPad int |
| var dstUserBytes []byte |
| |
| *data, fdf = (*data)[4:], SFlowFlowDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| eu.EnterpriseID, eu.Format = fdf.decode() |
| *data, eu.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, eu.SourceCharSet = (*data)[4:], SFlowCharSet(binary.BigEndian.Uint32((*data)[:4])) |
| *data, srcUserLen = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| srcUserLenWithPad = int(srcUserLen + ((4 - srcUserLen) % 4)) |
| *data, srcUserBytes = (*data)[srcUserLenWithPad:], (*data)[:srcUserLenWithPad] |
| eu.SourceUserID = string(srcUserBytes[:srcUserLen]) |
| *data, eu.DestinationCharSet = (*data)[4:], SFlowCharSet(binary.BigEndian.Uint32((*data)[:4])) |
| *data, dstUserLen = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| dstUserLenWithPad = int(dstUserLen + ((4 - dstUserLen) % 4)) |
| *data, dstUserBytes = (*data)[dstUserLenWithPad:], (*data)[:dstUserLenWithPad] |
| eu.DestinationUserID = string(dstUserBytes[:dstUserLen]) |
| return eu, nil |
| } |
| |
| // ************************************************** |
| // Packet IP version 4 Record |
| // ************************************************** |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Protocol | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Source IPv4 | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Destination IPv4 | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Source Port | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Destionation Port | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | TCP Flags | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | TOS | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| type SFlowIpv4Record struct { |
| // The length of the IP packet excluding ower layer encapsulations |
| Length uint32 |
| // IP Protocol type (for example, TCP = 6, UDP = 17) |
| Protocol uint32 |
| // Source IP Address |
| IPSrc net.IP |
| // Destination IP Address |
| IPDst net.IP |
| // TCP/UDP source port number or equivalent |
| PortSrc uint32 |
| // TCP/UDP destination port number or equivalent |
| PortDst uint32 |
| // TCP flags |
| TCPFlags uint32 |
| // IP type of service |
| TOS uint32 |
| } |
| |
| func decodeSFlowIpv4Record(data *[]byte) (SFlowIpv4Record, error) { |
| si := SFlowIpv4Record{} |
| |
| *data, si.Length = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, si.Protocol = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, si.IPSrc = (*data)[4:], net.IP((*data)[:4]) |
| *data, si.IPDst = (*data)[4:], net.IP((*data)[:4]) |
| *data, si.PortSrc = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, si.PortDst = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, si.TCPFlags = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, si.TOS = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| |
| return si, nil |
| } |
| |
| // ************************************************** |
| // Packet IP version 6 Record |
| // ************************************************** |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Protocol | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Source IPv4 | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Destination IPv4 | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Source Port | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Destionation Port | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | TCP Flags | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Priority | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| type SFlowIpv6Record struct { |
| // The length of the IP packet excluding ower layer encapsulations |
| Length uint32 |
| // IP Protocol type (for example, TCP = 6, UDP = 17) |
| Protocol uint32 |
| // Source IP Address |
| IPSrc net.IP |
| // Destination IP Address |
| IPDst net.IP |
| // TCP/UDP source port number or equivalent |
| PortSrc uint32 |
| // TCP/UDP destination port number or equivalent |
| PortDst uint32 |
| // TCP flags |
| TCPFlags uint32 |
| // IP priority |
| Priority uint32 |
| } |
| |
| func decodeSFlowIpv6Record(data *[]byte) (SFlowIpv6Record, error) { |
| si := SFlowIpv6Record{} |
| |
| *data, si.Length = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, si.Protocol = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, si.IPSrc = (*data)[16:], net.IP((*data)[:16]) |
| *data, si.IPDst = (*data)[16:], net.IP((*data)[:16]) |
| *data, si.PortSrc = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, si.PortDst = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, si.TCPFlags = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, si.Priority = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| |
| return si, nil |
| } |
| |
| // ************************************************** |
| // Extended IPv4 Tunnel Egress |
| // ************************************************** |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | record length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // / Packet IP version 4 Record / |
| // / / |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| type SFlowExtendedIpv4TunnelEgressRecord struct { |
| SFlowBaseFlowRecord |
| SFlowIpv4Record SFlowIpv4Record |
| } |
| |
| func decodeExtendedIpv4TunnelEgress(data *[]byte) (SFlowExtendedIpv4TunnelEgressRecord, error) { |
| rec := SFlowExtendedIpv4TunnelEgressRecord{} |
| var fdf SFlowFlowDataFormat |
| |
| *data, fdf = (*data)[4:], SFlowFlowDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| rec.EnterpriseID, rec.Format = fdf.decode() |
| *data, rec.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| rec.SFlowIpv4Record, _ = decodeSFlowIpv4Record(data) |
| |
| return rec, nil |
| } |
| |
| // ************************************************** |
| // Extended IPv4 Tunnel Ingress |
| // ************************************************** |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | record length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // / Packet IP version 4 Record / |
| // / / |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| type SFlowExtendedIpv4TunnelIngressRecord struct { |
| SFlowBaseFlowRecord |
| SFlowIpv4Record SFlowIpv4Record |
| } |
| |
| func decodeExtendedIpv4TunnelIngress(data *[]byte) (SFlowExtendedIpv4TunnelIngressRecord, error) { |
| rec := SFlowExtendedIpv4TunnelIngressRecord{} |
| var fdf SFlowFlowDataFormat |
| |
| *data, fdf = (*data)[4:], SFlowFlowDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| rec.EnterpriseID, rec.Format = fdf.decode() |
| *data, rec.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| rec.SFlowIpv4Record, _ = decodeSFlowIpv4Record(data) |
| |
| return rec, nil |
| } |
| |
| // ************************************************** |
| // Extended IPv6 Tunnel Egress |
| // ************************************************** |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | record length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // / Packet IP version 6 Record / |
| // / / |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| type SFlowExtendedIpv6TunnelEgressRecord struct { |
| SFlowBaseFlowRecord |
| SFlowIpv6Record |
| } |
| |
| func decodeExtendedIpv6TunnelEgress(data *[]byte) (SFlowExtendedIpv6TunnelEgressRecord, error) { |
| rec := SFlowExtendedIpv6TunnelEgressRecord{} |
| var fdf SFlowFlowDataFormat |
| |
| *data, fdf = (*data)[4:], SFlowFlowDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| rec.EnterpriseID, rec.Format = fdf.decode() |
| *data, rec.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| rec.SFlowIpv6Record, _ = decodeSFlowIpv6Record(data) |
| |
| return rec, nil |
| } |
| |
| // ************************************************** |
| // Extended IPv6 Tunnel Ingress |
| // ************************************************** |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | record length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // / Packet IP version 6 Record / |
| // / / |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| type SFlowExtendedIpv6TunnelIngressRecord struct { |
| SFlowBaseFlowRecord |
| SFlowIpv6Record |
| } |
| |
| func decodeExtendedIpv6TunnelIngress(data *[]byte) (SFlowExtendedIpv6TunnelIngressRecord, error) { |
| rec := SFlowExtendedIpv6TunnelIngressRecord{} |
| var fdf SFlowFlowDataFormat |
| |
| *data, fdf = (*data)[4:], SFlowFlowDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| rec.EnterpriseID, rec.Format = fdf.decode() |
| *data, rec.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| rec.SFlowIpv6Record, _ = decodeSFlowIpv6Record(data) |
| |
| return rec, nil |
| } |
| |
| // ************************************************** |
| // Extended Decapsulate Egress |
| // ************************************************** |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | record length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Inner Header Offset | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| type SFlowExtendedDecapsulateEgressRecord struct { |
| SFlowBaseFlowRecord |
| InnerHeaderOffset uint32 |
| } |
| |
| func decodeExtendedDecapsulateEgress(data *[]byte) (SFlowExtendedDecapsulateEgressRecord, error) { |
| rec := SFlowExtendedDecapsulateEgressRecord{} |
| var fdf SFlowFlowDataFormat |
| |
| *data, fdf = (*data)[4:], SFlowFlowDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| rec.EnterpriseID, rec.Format = fdf.decode() |
| *data, rec.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, rec.InnerHeaderOffset = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| |
| return rec, nil |
| } |
| |
| // ************************************************** |
| // Extended Decapsulate Ingress |
| // ************************************************** |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | record length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Inner Header Offset | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| type SFlowExtendedDecapsulateIngressRecord struct { |
| SFlowBaseFlowRecord |
| InnerHeaderOffset uint32 |
| } |
| |
| func decodeExtendedDecapsulateIngress(data *[]byte) (SFlowExtendedDecapsulateIngressRecord, error) { |
| rec := SFlowExtendedDecapsulateIngressRecord{} |
| var fdf SFlowFlowDataFormat |
| |
| *data, fdf = (*data)[4:], SFlowFlowDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| rec.EnterpriseID, rec.Format = fdf.decode() |
| *data, rec.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, rec.InnerHeaderOffset = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| |
| return rec, nil |
| } |
| |
| // ************************************************** |
| // Extended VNI Egress |
| // ************************************************** |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | record length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | VNI | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| type SFlowExtendedVniEgressRecord struct { |
| SFlowBaseFlowRecord |
| VNI uint32 |
| } |
| |
| func decodeExtendedVniEgress(data *[]byte) (SFlowExtendedVniEgressRecord, error) { |
| rec := SFlowExtendedVniEgressRecord{} |
| var fdf SFlowFlowDataFormat |
| |
| *data, fdf = (*data)[4:], SFlowFlowDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| rec.EnterpriseID, rec.Format = fdf.decode() |
| *data, rec.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, rec.VNI = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| |
| return rec, nil |
| } |
| |
| // ************************************************** |
| // Extended VNI Ingress |
| // ************************************************** |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | record length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | VNI | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| type SFlowExtendedVniIngressRecord struct { |
| SFlowBaseFlowRecord |
| VNI uint32 |
| } |
| |
| func decodeExtendedVniIngress(data *[]byte) (SFlowExtendedVniIngressRecord, error) { |
| rec := SFlowExtendedVniIngressRecord{} |
| var fdf SFlowFlowDataFormat |
| |
| *data, fdf = (*data)[4:], SFlowFlowDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| rec.EnterpriseID, rec.Format = fdf.decode() |
| *data, rec.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, rec.VNI = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| |
| return rec, nil |
| } |
| |
| // ************************************************** |
| // Counter Record |
| // ************************************************** |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | counter length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // / counter data / |
| // / / |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| |
| type SFlowBaseCounterRecord struct { |
| EnterpriseID SFlowEnterpriseID |
| Format SFlowCounterRecordType |
| FlowDataLength uint32 |
| } |
| |
| func (bcr SFlowBaseCounterRecord) GetType() SFlowCounterRecordType { |
| switch bcr.Format { |
| case SFlowTypeGenericInterfaceCounters: |
| return SFlowTypeGenericInterfaceCounters |
| case SFlowTypeEthernetInterfaceCounters: |
| return SFlowTypeEthernetInterfaceCounters |
| case SFlowTypeTokenRingInterfaceCounters: |
| return SFlowTypeTokenRingInterfaceCounters |
| case SFlowType100BaseVGInterfaceCounters: |
| return SFlowType100BaseVGInterfaceCounters |
| case SFlowTypeVLANCounters: |
| return SFlowTypeVLANCounters |
| case SFlowTypeLACPCounters: |
| return SFlowTypeLACPCounters |
| case SFlowTypeProcessorCounters: |
| return SFlowTypeProcessorCounters |
| case SFlowTypeOpenflowPortCounters: |
| return SFlowTypeOpenflowPortCounters |
| case SFlowTypePORTNAMECounters: |
| return SFlowTypePORTNAMECounters |
| case SFLowTypeAPPRESOURCESCounters: |
| return SFLowTypeAPPRESOURCESCounters |
| case SFlowTypeOVSDPCounters: |
| return SFlowTypeOVSDPCounters |
| } |
| unrecognized := fmt.Sprint("Unrecognized counter record type:", bcr.Format) |
| panic(unrecognized) |
| } |
| |
| // ************************************************** |
| // Counter Record |
| // ************************************************** |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | counter length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IfIndex | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IfType | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IfSpeed | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IfDirection | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IfStatus | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IFInOctets | |
| // | | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IfInUcastPkts | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IfInMulticastPkts | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IfInBroadcastPkts | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IfInDiscards | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | InInErrors | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IfInUnknownProtos | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IfOutOctets | |
| // | | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IfOutUcastPkts | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IfOutMulticastPkts | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IfOutBroadcastPkts | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IfOutDiscards | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IfOUtErrors | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | IfPromiscouousMode | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| |
| type SFlowGenericInterfaceCounters struct { |
| SFlowBaseCounterRecord |
| IfIndex uint32 |
| IfType uint32 |
| IfSpeed uint64 |
| IfDirection uint32 |
| IfStatus uint32 |
| IfInOctets uint64 |
| IfInUcastPkts uint32 |
| IfInMulticastPkts uint32 |
| IfInBroadcastPkts uint32 |
| IfInDiscards uint32 |
| IfInErrors uint32 |
| IfInUnknownProtos uint32 |
| IfOutOctets uint64 |
| IfOutUcastPkts uint32 |
| IfOutMulticastPkts uint32 |
| IfOutBroadcastPkts uint32 |
| IfOutDiscards uint32 |
| IfOutErrors uint32 |
| IfPromiscuousMode uint32 |
| } |
| |
| func decodeGenericInterfaceCounters(data *[]byte) (SFlowGenericInterfaceCounters, error) { |
| gic := SFlowGenericInterfaceCounters{} |
| var cdf SFlowCounterDataFormat |
| |
| *data, cdf = (*data)[4:], SFlowCounterDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| gic.EnterpriseID, gic.Format = cdf.decode() |
| *data, gic.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, gic.IfIndex = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, gic.IfType = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, gic.IfSpeed = (*data)[8:], binary.BigEndian.Uint64((*data)[:8]) |
| *data, gic.IfDirection = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, gic.IfStatus = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, gic.IfInOctets = (*data)[8:], binary.BigEndian.Uint64((*data)[:8]) |
| *data, gic.IfInUcastPkts = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, gic.IfInMulticastPkts = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, gic.IfInBroadcastPkts = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, gic.IfInDiscards = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, gic.IfInErrors = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, gic.IfInUnknownProtos = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, gic.IfOutOctets = (*data)[8:], binary.BigEndian.Uint64((*data)[:8]) |
| *data, gic.IfOutUcastPkts = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, gic.IfOutMulticastPkts = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, gic.IfOutBroadcastPkts = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, gic.IfOutDiscards = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, gic.IfOutErrors = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, gic.IfPromiscuousMode = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| return gic, nil |
| } |
| |
| // ************************************************** |
| // Counter Record |
| // ************************************************** |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | counter length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // / counter data / |
| // / / |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| |
| type SFlowEthernetCounters struct { |
| SFlowBaseCounterRecord |
| AlignmentErrors uint32 |
| FCSErrors uint32 |
| SingleCollisionFrames uint32 |
| MultipleCollisionFrames uint32 |
| SQETestErrors uint32 |
| DeferredTransmissions uint32 |
| LateCollisions uint32 |
| ExcessiveCollisions uint32 |
| InternalMacTransmitErrors uint32 |
| CarrierSenseErrors uint32 |
| FrameTooLongs uint32 |
| InternalMacReceiveErrors uint32 |
| SymbolErrors uint32 |
| } |
| |
| func decodeEthernetCounters(data *[]byte) (SFlowEthernetCounters, error) { |
| ec := SFlowEthernetCounters{} |
| var cdf SFlowCounterDataFormat |
| |
| *data, cdf = (*data)[4:], SFlowCounterDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| ec.EnterpriseID, ec.Format = cdf.decode() |
| if len(*data) < 4 { |
| return SFlowEthernetCounters{}, errors.New("ethernet counters too small") |
| } |
| *data, ec.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowEthernetCounters{}, errors.New("ethernet counters too small") |
| } |
| *data, ec.AlignmentErrors = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowEthernetCounters{}, errors.New("ethernet counters too small") |
| } |
| *data, ec.FCSErrors = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowEthernetCounters{}, errors.New("ethernet counters too small") |
| } |
| *data, ec.SingleCollisionFrames = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowEthernetCounters{}, errors.New("ethernet counters too small") |
| } |
| *data, ec.MultipleCollisionFrames = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowEthernetCounters{}, errors.New("ethernet counters too small") |
| } |
| *data, ec.SQETestErrors = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowEthernetCounters{}, errors.New("ethernet counters too small") |
| } |
| *data, ec.DeferredTransmissions = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowEthernetCounters{}, errors.New("ethernet counters too small") |
| } |
| *data, ec.LateCollisions = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowEthernetCounters{}, errors.New("ethernet counters too small") |
| } |
| *data, ec.ExcessiveCollisions = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowEthernetCounters{}, errors.New("ethernet counters too small") |
| } |
| *data, ec.InternalMacTransmitErrors = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowEthernetCounters{}, errors.New("ethernet counters too small") |
| } |
| *data, ec.CarrierSenseErrors = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowEthernetCounters{}, errors.New("ethernet counters too small") |
| } |
| *data, ec.FrameTooLongs = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowEthernetCounters{}, errors.New("ethernet counters too small") |
| } |
| *data, ec.InternalMacReceiveErrors = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| if len(*data) < 4 { |
| return SFlowEthernetCounters{}, errors.New("ethernet counters too small") |
| } |
| *data, ec.SymbolErrors = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| return ec, nil |
| } |
| |
| // VLAN Counter |
| |
| type SFlowVLANCounters struct { |
| SFlowBaseCounterRecord |
| VlanID uint32 |
| Octets uint64 |
| UcastPkts uint32 |
| MulticastPkts uint32 |
| BroadcastPkts uint32 |
| Discards uint32 |
| } |
| |
| func decodeVLANCounters(data *[]byte) (SFlowVLANCounters, error) { |
| vc := SFlowVLANCounters{} |
| var cdf SFlowCounterDataFormat |
| |
| *data, cdf = (*data)[4:], SFlowCounterDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| vc.EnterpriseID, vc.Format = cdf.decode() |
| vc.EnterpriseID, vc.Format = cdf.decode() |
| *data, vc.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, vc.VlanID = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, vc.Octets = (*data)[8:], binary.BigEndian.Uint64((*data)[:8]) |
| *data, vc.UcastPkts = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, vc.MulticastPkts = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, vc.BroadcastPkts = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, vc.Discards = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| return vc, nil |
| } |
| |
| //SFLLACPportState : SFlow LACP Port State (All(4) - 32 bit) |
| type SFLLACPPortState struct { |
| PortStateAll uint32 |
| } |
| |
| //LACPcounters : LACP SFlow Counters ( 64 Bytes ) |
| type SFlowLACPCounters struct { |
| SFlowBaseCounterRecord |
| ActorSystemID net.HardwareAddr |
| PartnerSystemID net.HardwareAddr |
| AttachedAggID uint32 |
| LacpPortState SFLLACPPortState |
| LACPDUsRx uint32 |
| MarkerPDUsRx uint32 |
| MarkerResponsePDUsRx uint32 |
| UnknownRx uint32 |
| IllegalRx uint32 |
| LACPDUsTx uint32 |
| MarkerPDUsTx uint32 |
| MarkerResponsePDUsTx uint32 |
| } |
| |
| func decodeLACPCounters(data *[]byte) (SFlowLACPCounters, error) { |
| la := SFlowLACPCounters{} |
| var cdf SFlowCounterDataFormat |
| |
| *data, cdf = (*data)[4:], SFlowCounterDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| la.EnterpriseID, la.Format = cdf.decode() |
| *data, la.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, la.ActorSystemID = (*data)[6:], (*data)[:6] |
| *data = (*data)[2:] // remove padding |
| *data, la.PartnerSystemID = (*data)[6:], (*data)[:6] |
| *data = (*data)[2:] //remove padding |
| *data, la.AttachedAggID = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, la.LacpPortState.PortStateAll = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, la.LACPDUsRx = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, la.MarkerPDUsRx = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, la.MarkerResponsePDUsRx = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, la.UnknownRx = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, la.IllegalRx = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, la.LACPDUsTx = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, la.MarkerPDUsTx = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, la.MarkerResponsePDUsTx = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| |
| return la, nil |
| |
| } |
| |
| // ************************************************** |
| // Processor Counter Record |
| // ************************************************** |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | counter length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | FiveSecCpu | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | OneMinCpu | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | GiveMinCpu | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | TotalMemory | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | FreeMemory | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| |
| type SFlowProcessorCounters struct { |
| SFlowBaseCounterRecord |
| FiveSecCpu uint32 // 5 second average CPU utilization |
| OneMinCpu uint32 // 1 minute average CPU utilization |
| FiveMinCpu uint32 // 5 minute average CPU utilization |
| TotalMemory uint64 // total memory (in bytes) |
| FreeMemory uint64 // free memory (in bytes) |
| } |
| |
| func decodeProcessorCounters(data *[]byte) (SFlowProcessorCounters, error) { |
| pc := SFlowProcessorCounters{} |
| var cdf SFlowCounterDataFormat |
| var high32, low32 uint32 |
| |
| *data, cdf = (*data)[4:], SFlowCounterDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| pc.EnterpriseID, pc.Format = cdf.decode() |
| *data, pc.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| |
| *data, pc.FiveSecCpu = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, pc.OneMinCpu = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, pc.FiveMinCpu = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, high32 = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, low32 = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| pc.TotalMemory = (uint64(high32) << 32) + uint64(low32) |
| *data, high32 = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, low32 = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| pc.FreeMemory = (uint64(high32)) + uint64(low32) |
| |
| return pc, nil |
| } |
| |
| // SFlowEthernetFrameFlowRecord give additional information |
| // about the sampled packet if it's available. |
| // An agent may or may not provide this information. |
| type SFlowEthernetFrameFlowRecord struct { |
| SFlowBaseFlowRecord |
| FrameLength uint32 |
| SrcMac net.HardwareAddr |
| DstMac net.HardwareAddr |
| Type uint32 |
| } |
| |
| // Ethernet frame flow records have the following structure: |
| |
| // 0 15 31 |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | 20 bit Interprise (0) |12 bit format | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | record length | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Source Mac Address | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Destination Mac Address | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| // | Ethernet Packet Type | |
| // +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| |
| func decodeEthernetFrameFlowRecord(data *[]byte) (SFlowEthernetFrameFlowRecord, error) { |
| es := SFlowEthernetFrameFlowRecord{} |
| var fdf SFlowFlowDataFormat |
| |
| *data, fdf = (*data)[4:], SFlowFlowDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| es.EnterpriseID, es.Format = fdf.decode() |
| *data, es.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| |
| *data, es.FrameLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, es.SrcMac = (*data)[8:], net.HardwareAddr((*data)[:6]) |
| *data, es.DstMac = (*data)[8:], net.HardwareAddr((*data)[:6]) |
| *data, es.Type = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| return es, nil |
| } |
| |
| //SFlowOpenflowPortCounters : OVS-Sflow OpenFlow Port Counter ( 20 Bytes ) |
| type SFlowOpenflowPortCounters struct { |
| SFlowBaseCounterRecord |
| DatapathID uint64 |
| PortNo uint32 |
| } |
| |
| func decodeOpenflowportCounters(data *[]byte) (SFlowOpenflowPortCounters, error) { |
| ofp := SFlowOpenflowPortCounters{} |
| var cdf SFlowCounterDataFormat |
| |
| *data, cdf = (*data)[4:], SFlowCounterDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| ofp.EnterpriseID, ofp.Format = cdf.decode() |
| *data, ofp.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, ofp.DatapathID = (*data)[8:], binary.BigEndian.Uint64((*data)[:8]) |
| *data, ofp.PortNo = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| |
| return ofp, nil |
| } |
| |
| //SFlowAppresourcesCounters : OVS_Sflow App Resources Counter ( 48 Bytes ) |
| type SFlowAppresourcesCounters struct { |
| SFlowBaseCounterRecord |
| UserTime uint32 |
| SystemTime uint32 |
| MemUsed uint64 |
| MemMax uint64 |
| FdOpen uint32 |
| FdMax uint32 |
| ConnOpen uint32 |
| ConnMax uint32 |
| } |
| |
| func decodeAppresourcesCounters(data *[]byte) (SFlowAppresourcesCounters, error) { |
| app := SFlowAppresourcesCounters{} |
| var cdf SFlowCounterDataFormat |
| |
| *data, cdf = (*data)[4:], SFlowCounterDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| app.EnterpriseID, app.Format = cdf.decode() |
| *data, app.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, app.UserTime = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, app.SystemTime = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, app.MemUsed = (*data)[8:], binary.BigEndian.Uint64((*data)[:8]) |
| *data, app.MemMax = (*data)[8:], binary.BigEndian.Uint64((*data)[:8]) |
| *data, app.FdOpen = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, app.FdMax = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, app.ConnOpen = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, app.ConnMax = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| |
| return app, nil |
| } |
| |
| //SFlowOVSDPCounters : OVS-Sflow DataPath Counter ( 32 Bytes ) |
| type SFlowOVSDPCounters struct { |
| SFlowBaseCounterRecord |
| NHit uint32 |
| NMissed uint32 |
| NLost uint32 |
| NMaskHit uint32 |
| NFlows uint32 |
| NMasks uint32 |
| } |
| |
| func decodeOVSDPCounters(data *[]byte) (SFlowOVSDPCounters, error) { |
| dp := SFlowOVSDPCounters{} |
| var cdf SFlowCounterDataFormat |
| |
| *data, cdf = (*data)[4:], SFlowCounterDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| dp.EnterpriseID, dp.Format = cdf.decode() |
| *data, dp.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, dp.NHit = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, dp.NMissed = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, dp.NLost = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, dp.NMaskHit = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, dp.NFlows = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| *data, dp.NMasks = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| |
| return dp, nil |
| } |
| |
| //SFlowPORTNAME : OVS-Sflow PORTNAME Counter Sampletype ( 20 Bytes ) |
| type SFlowPORTNAME struct { |
| SFlowBaseCounterRecord |
| Len uint32 |
| Str string |
| } |
| |
| func decodeString(data *[]byte) (len uint32, str string) { |
| *data, len = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| str = string((*data)[:len]) |
| if (len % 4) != 0 { |
| len += 4 - len%4 |
| } |
| *data = (*data)[len:] |
| return |
| } |
| |
| func decodePortnameCounters(data *[]byte) (SFlowPORTNAME, error) { |
| pn := SFlowPORTNAME{} |
| var cdf SFlowCounterDataFormat |
| |
| *data, cdf = (*data)[4:], SFlowCounterDataFormat(binary.BigEndian.Uint32((*data)[:4])) |
| pn.EnterpriseID, pn.Format = cdf.decode() |
| *data, pn.FlowDataLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4]) |
| pn.Len, pn.Str = decodeString(data) |
| |
| return pn, nil |
| } |