2 * Copyright (c) 1998-2007 The TCPDUMP project
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that: (1) source code
6 * distributions retain the above copyright notice and this paragraph
7 * in its entirety, and (2) distributions including binary code include
8 * the above copyright notice and this paragraph in its entirety in
9 * the documentation or other materials provided with the distribution.
10 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
11 * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
12 * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
13 * FOR A PARTICULAR PURPOSE.
15 * The SFLOW protocol as per http://www.sflow.org/developers/specifications.php
17 * Original code by Carles Kishimoto <carles.kishimoto@gmail.com>
19 * Expansion and refactoring by Rick Jones <rick.jones2@hp.com>
23 static const char rcsid[] _U_ =
24 "@(#) $Header: /tcpdump/master/tcpdump/print-sflow.c,v 1.1 2007-08-08 17:20:58 hannes Exp $";
31 #include <tcpdump-stdinc.h>
37 #include "interface.h"
39 #include "addrtoname.h"
45 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
46 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
47 * | Sflow version (2,4,5) |
48 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
49 * | IP version (1 for IPv4 | 2 for IPv6) |
50 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
51 * | IP Address AGENT (4 or 16 bytes) |
52 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
54 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
55 * | Datagram sequence number |
56 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
57 * | Switch uptime in ms |
58 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
59 * | num samples in datagram |
60 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
64 struct sflow_datagram_t {
66 u_int8_t ip_version[4];
74 struct sflow_sample_header {
79 #define SFLOW_FLOW_SAMPLE 1
80 #define SFLOW_COUNTER_SAMPLE 2
81 #define SFLOW_EXPANDED_FLOW_SAMPLE 3
82 #define SFLOW_EXPANDED_COUNTER_SAMPLE 4
84 static const struct tok sflow_format_values[] = {
85 { SFLOW_FLOW_SAMPLE, "flow sample" },
86 { SFLOW_COUNTER_SAMPLE, "counter sample" },
87 { SFLOW_EXPANDED_FLOW_SAMPLE, "expanded flow sample" },
88 { SFLOW_EXPANDED_COUNTER_SAMPLE, "expanded counter sample" },
92 struct sflow_flow_sample_t {
94 u_int8_t typesource[4];
98 u_int8_t in_interface[4];
99 u_int8_t out_interface[4];
104 struct sflow_expanded_flow_sample_t {
111 u_int8_t in_interface_format[4];
112 u_int8_t in_interface_value[4];
113 u_int8_t out_interface_format[4];
114 u_int8_t out_interface_value[4];
118 #define SFLOW_FLOW_RAW_PACKET 1
119 #define SFLOW_FLOW_ETHERNET_FRAME 2
120 #define SFLOW_FLOW_IPV4_DATA 3
121 #define SFLOW_FLOW_IPV6_DATA 4
122 #define SFLOW_FLOW_EXTENDED_SWITCH_DATA 1001
123 #define SFLOW_FLOW_EXTENDED_ROUTER_DATA 1002
124 #define SFLOW_FLOW_EXTENDED_GATEWAY_DATA 1003
125 #define SFLOW_FLOW_EXTENDED_USER_DATA 1004
126 #define SFLOW_FLOW_EXTENDED_URL_DATA 1005
127 #define SFLOW_FLOW_EXTENDED_MPLS_DATA 1006
128 #define SFLOW_FLOW_EXTENDED_NAT_DATA 1007
129 #define SFLOW_FLOW_EXTENDED_MPLS_TUNNEL 1008
130 #define SFLOW_FLOW_EXTENDED_MPLS_VC 1009
131 #define SFLOW_FLOW_EXTENDED_MPLS_FEC 1010
132 #define SFLOW_FLOW_EXTENDED_MPLS_LVP_FEC 1011
133 #define SFLOW_FLOW_EXTENDED_VLAN_TUNNEL 1012
135 static const struct tok sflow_flow_type_values[] = {
136 { SFLOW_FLOW_RAW_PACKET, "Raw packet"},
137 { SFLOW_FLOW_ETHERNET_FRAME, "Ethernet frame"},
138 { SFLOW_FLOW_IPV4_DATA, "IPv4 Data"},
139 { SFLOW_FLOW_IPV6_DATA, "IPv6 Data"},
140 { SFLOW_FLOW_EXTENDED_SWITCH_DATA, "Extended Switch data"},
141 { SFLOW_FLOW_EXTENDED_ROUTER_DATA, "Extended Router data"},
142 { SFLOW_FLOW_EXTENDED_GATEWAY_DATA, "Extended Gateway data"},
143 { SFLOW_FLOW_EXTENDED_USER_DATA, "Extended User data"},
144 { SFLOW_FLOW_EXTENDED_URL_DATA, "Extended URL data"},
145 { SFLOW_FLOW_EXTENDED_MPLS_DATA, "Extended MPLS data"},
146 { SFLOW_FLOW_EXTENDED_NAT_DATA, "Extended NAT data"},
147 { SFLOW_FLOW_EXTENDED_MPLS_TUNNEL, "Extended MPLS tunnel"},
148 { SFLOW_FLOW_EXTENDED_MPLS_VC, "Extended MPLS VC"},
149 { SFLOW_FLOW_EXTENDED_MPLS_FEC, "Extended MPLS FEC"},
150 { SFLOW_FLOW_EXTENDED_MPLS_LVP_FEC, "Extended MPLS LVP FEC"},
151 { SFLOW_FLOW_EXTENDED_VLAN_TUNNEL, "Extended VLAN Tunnel"},
155 #define SFLOW_HEADER_PROTOCOL_ETHERNET 1
156 #define SFLOW_HEADER_PROTOCOL_IPV4 11
157 #define SFLOW_HEADER_PROTOCOL_IPV6 12
159 static const struct tok sflow_flow_raw_protocol_values[] = {
160 { SFLOW_HEADER_PROTOCOL_ETHERNET, "Ethernet"},
161 { SFLOW_HEADER_PROTOCOL_IPV4, "IPv4"},
162 { SFLOW_HEADER_PROTOCOL_IPV6, "IPv6"},
166 struct sflow_expanded_flow_raw_t {
167 u_int8_t protocol[4];
169 u_int8_t stripped_bytes[4];
170 u_int8_t header_size[4];
173 struct sflow_ethernet_frame_t {
180 struct sflow_extended_switch_data_t {
181 u_int8_t src_vlan[4];
183 u_int8_t dst_vlan[4];
187 struct sflow_counter_record_t {
192 struct sflow_flow_record_t {
197 struct sflow_counter_sample_t {
199 u_int8_t typesource[4];
203 struct sflow_expanded_counter_sample_t {
210 #define SFLOW_COUNTER_GENERIC 1
211 #define SFLOW_COUNTER_ETHERNET 2
212 #define SFLOW_COUNTER_TOKEN_RING 3
213 #define SFLOW_COUNTER_BASEVG 4
214 #define SFLOW_COUNTER_VLAN 5
215 #define SFLOW_COUNTER_PROCESSOR 1001
217 static const struct tok sflow_counter_type_values[] = {
218 { SFLOW_COUNTER_GENERIC, "Generic counter"},
219 { SFLOW_COUNTER_ETHERNET, "Ethernet counter"},
220 { SFLOW_COUNTER_TOKEN_RING, "Token ring counter"},
221 { SFLOW_COUNTER_BASEVG, "100 BaseVG counter"},
222 { SFLOW_COUNTER_VLAN, "Vlan counter"},
223 { SFLOW_COUNTER_PROCESSOR, "Processor counter"},
227 #define SFLOW_IFACE_DIRECTION_UNKNOWN 0
228 #define SFLOW_IFACE_DIRECTION_FULLDUPLEX 1
229 #define SFLOW_IFACE_DIRECTION_HALFDUPLEX 2
230 #define SFLOW_IFACE_DIRECTION_IN 3
231 #define SFLOW_IFACE_DIRECTION_OUT 4
233 static const struct tok sflow_iface_direction_values[] = {
234 { SFLOW_IFACE_DIRECTION_UNKNOWN, "unknown"},
235 { SFLOW_IFACE_DIRECTION_FULLDUPLEX, "full-duplex"},
236 { SFLOW_IFACE_DIRECTION_HALFDUPLEX, "half-duplex"},
237 { SFLOW_IFACE_DIRECTION_IN, "in"},
238 { SFLOW_IFACE_DIRECTION_OUT, "out"},
242 struct sflow_generic_counter_t {
246 u_int8_t ifdirection[4];
247 u_int8_t ifstatus[4];
248 u_int8_t ifinoctets[8];
249 u_int8_t ifinunicastpkts[4];
250 u_int8_t ifinmulticastpkts[4];
251 u_int8_t ifinbroadcastpkts[4];
252 u_int8_t ifindiscards[4];
253 u_int8_t ifinerrors[4];
254 u_int8_t ifinunkownprotos[4];
255 u_int8_t ifoutoctets[8];
256 u_int8_t ifoutunicastpkts[4];
257 u_int8_t ifoutmulticastpkts[4];
258 u_int8_t ifoutbroadcastpkts[4];
259 u_int8_t ifoutdiscards[4];
260 u_int8_t ifouterrors[4];
261 u_int8_t ifpromiscmode[4];
264 struct sflow_ethernet_counter_t {
265 u_int8_t alignerrors[4];
266 u_int8_t fcserrors[4];
267 u_int8_t single_collision_frames[4];
268 u_int8_t multiple_collision_frames[4];
269 u_int8_t test_errors[4];
270 u_int8_t deferred_transmissions[4];
271 u_int8_t late_collisions[4];
272 u_int8_t excessive_collisions[4];
273 u_int8_t mac_transmit_errors[4];
274 u_int8_t carrier_sense_errors[4];
275 u_int8_t frame_too_longs[4];
276 u_int8_t mac_receive_errors[4];
277 u_int8_t symbol_errors[4];
280 struct sflow_100basevg_counter_t {
281 u_int8_t in_highpriority_frames[4];
282 u_int8_t in_highpriority_octets[8];
283 u_int8_t in_normpriority_frames[4];
284 u_int8_t in_normpriority_octets[8];
285 u_int8_t in_ipmerrors[4];
286 u_int8_t in_oversized[4];
287 u_int8_t in_data_errors[4];
288 u_int8_t in_null_addressed_frames[4];
289 u_int8_t out_highpriority_frames[4];
290 u_int8_t out_highpriority_octets[8];
291 u_int8_t transitioninto_frames[4];
292 u_int8_t hc_in_highpriority_octets[8];
293 u_int8_t hc_in_normpriority_octets[8];
294 u_int8_t hc_out_highpriority_octets[8];
297 struct sflow_vlan_counter_t {
300 u_int8_t unicast_pkt[4];
301 u_int8_t multicast_pkt[4];
302 u_int8_t broadcast_pkt[4];
303 u_int8_t discards[4];
307 print_sflow_counter_generic(const u_char *pointer, u_int len) {
309 const struct sflow_generic_counter_t *sflow_gen_counter;
311 if (len < sizeof(struct sflow_generic_counter_t))
315 sflow_gen_counter = (const struct sflow_generic_counter_t *)pointer;
316 printf("\n\t ifindex %u, iftype %u, ifspeed %" PRIu64 ", ifdirection %u (%s)",
317 EXTRACT_32BITS(sflow_gen_counter->ifindex),
318 EXTRACT_32BITS(sflow_gen_counter->iftype),
319 EXTRACT_64BITS(sflow_gen_counter->ifspeed),
320 EXTRACT_32BITS(sflow_gen_counter->ifdirection),
321 tok2str(sflow_iface_direction_values, "Unknown",
322 EXTRACT_32BITS(sflow_gen_counter->ifdirection)));
323 printf("\n\t ifstatus %u, adminstatus: %s, operstatus: %s",
324 EXTRACT_32BITS(sflow_gen_counter->ifstatus),
325 EXTRACT_32BITS(sflow_gen_counter->ifstatus)&1 ? "up" : "down",
326 (EXTRACT_32BITS(sflow_gen_counter->ifstatus)>>1)&1 ? "up" : "down");
327 printf("\n\t In octets %" PRIu64
328 ", unicast pkts %u, multicast pkts %u, broadcast pkts %u, discards %u",
329 EXTRACT_64BITS(sflow_gen_counter->ifinoctets),
330 EXTRACT_32BITS(sflow_gen_counter->ifinunicastpkts),
331 EXTRACT_32BITS(sflow_gen_counter->ifinmulticastpkts),
332 EXTRACT_32BITS(sflow_gen_counter->ifinbroadcastpkts),
333 EXTRACT_32BITS(sflow_gen_counter->ifindiscards));
334 printf("\n\t In errors %u, unknown protos %u",
335 EXTRACT_32BITS(sflow_gen_counter->ifinerrors),
336 EXTRACT_32BITS(sflow_gen_counter->ifinunkownprotos));
337 printf("\n\t Out octets %" PRIu64
338 ", unicast pkts %u, multicast pkts %u, broadcast pkts %u, discards %u",
339 EXTRACT_64BITS(sflow_gen_counter->ifoutoctets),
340 EXTRACT_32BITS(sflow_gen_counter->ifoutunicastpkts),
341 EXTRACT_32BITS(sflow_gen_counter->ifoutmulticastpkts),
342 EXTRACT_32BITS(sflow_gen_counter->ifoutbroadcastpkts),
343 EXTRACT_32BITS(sflow_gen_counter->ifoutdiscards));
344 printf("\n\t Out errors %u, promisc mode %u",
345 EXTRACT_32BITS(sflow_gen_counter->ifouterrors),
346 EXTRACT_32BITS(sflow_gen_counter->ifpromiscmode));
352 print_sflow_counter_ethernet(const u_char *pointer, u_int len){
354 const struct sflow_ethernet_counter_t *sflow_eth_counter;
356 if (len < sizeof(struct sflow_ethernet_counter_t))
359 sflow_eth_counter = (const struct sflow_ethernet_counter_t *)pointer;
360 printf("\n\t align errors %u, fcs errors %u, single collision %u, multiple collision %u, test error %u",
361 EXTRACT_32BITS(sflow_eth_counter->alignerrors),
362 EXTRACT_32BITS(sflow_eth_counter->fcserrors),
363 EXTRACT_32BITS(sflow_eth_counter->single_collision_frames),
364 EXTRACT_32BITS(sflow_eth_counter->multiple_collision_frames),
365 EXTRACT_32BITS(sflow_eth_counter->test_errors));
366 printf("\n\t deferred %u, late collision %u, excessive collision %u, mac trans error %u",
367 EXTRACT_32BITS(sflow_eth_counter->deferred_transmissions),
368 EXTRACT_32BITS(sflow_eth_counter->late_collisions),
369 EXTRACT_32BITS(sflow_eth_counter->excessive_collisions),
370 EXTRACT_32BITS(sflow_eth_counter->mac_transmit_errors));
371 printf("\n\t carrier error %u, frames too long %u, mac receive errors %u, symbol errors %u",
372 EXTRACT_32BITS(sflow_eth_counter->carrier_sense_errors),
373 EXTRACT_32BITS(sflow_eth_counter->frame_too_longs),
374 EXTRACT_32BITS(sflow_eth_counter->mac_receive_errors),
375 EXTRACT_32BITS(sflow_eth_counter->symbol_errors));
381 print_sflow_counter_token_ring(const u_char *pointer _U_, u_int len _U_) {
387 print_sflow_counter_basevg(const u_char *pointer, u_int len) {
389 const struct sflow_100basevg_counter_t *sflow_100basevg_counter;
391 if (len < sizeof(struct sflow_100basevg_counter_t))
394 sflow_100basevg_counter = (const struct sflow_100basevg_counter_t *)pointer;
395 printf("\n\t in high prio frames %u, in high prio octets %" PRIu64,
396 EXTRACT_32BITS(sflow_100basevg_counter->in_highpriority_frames),
397 EXTRACT_64BITS(sflow_100basevg_counter->in_highpriority_octets));
398 printf("\n\t in norm prio frames %u, in norm prio octets %" PRIu64,
399 EXTRACT_32BITS(sflow_100basevg_counter->in_normpriority_frames),
400 EXTRACT_64BITS(sflow_100basevg_counter->in_normpriority_octets));
401 printf("\n\t in ipm errors %u, oversized %u, in data errors %u, null addressed frames %u",
402 EXTRACT_32BITS(sflow_100basevg_counter->in_ipmerrors),
403 EXTRACT_32BITS(sflow_100basevg_counter->in_oversized),
404 EXTRACT_32BITS(sflow_100basevg_counter->in_data_errors),
405 EXTRACT_32BITS(sflow_100basevg_counter->in_null_addressed_frames));
406 printf("\n\t out high prio frames %u, out high prio octets %" PRIu64
407 ", trans into frames %u",
408 EXTRACT_32BITS(sflow_100basevg_counter->out_highpriority_frames),
409 EXTRACT_64BITS(sflow_100basevg_counter->out_highpriority_octets),
410 EXTRACT_32BITS(sflow_100basevg_counter->transitioninto_frames));
411 printf("\n\t in hc high prio octets %" PRIu64
412 ", in hc norm prio octets %" PRIu64
413 ", out hc high prio octets %" PRIu64,
414 EXTRACT_64BITS(sflow_100basevg_counter->hc_in_highpriority_octets),
415 EXTRACT_64BITS(sflow_100basevg_counter->hc_in_normpriority_octets),
416 EXTRACT_64BITS(sflow_100basevg_counter->hc_out_highpriority_octets));
422 print_sflow_counter_vlan(const u_char *pointer, u_int len) {
424 const struct sflow_vlan_counter_t *sflow_vlan_counter;
426 if (len < sizeof(struct sflow_vlan_counter_t))
429 sflow_vlan_counter = (const struct sflow_vlan_counter_t *)pointer;
430 printf("\n\t vlan_id %u, octets %" PRIu64
431 ", unicast_pkt %u, multicast_pkt %u, broadcast_pkt %u, discards %u",
432 EXTRACT_32BITS(sflow_vlan_counter->vlan_id),
433 EXTRACT_64BITS(sflow_vlan_counter->octets),
434 EXTRACT_32BITS(sflow_vlan_counter->unicast_pkt),
435 EXTRACT_32BITS(sflow_vlan_counter->multicast_pkt),
436 EXTRACT_32BITS(sflow_vlan_counter->broadcast_pkt),
437 EXTRACT_32BITS(sflow_vlan_counter->discards));
442 struct sflow_processor_counter_t {
443 u_int8_t five_sec_util[4];
444 u_int8_t one_min_util[4];
445 u_int8_t five_min_util[4];
446 u_int8_t total_memory[8];
447 u_int8_t free_memory[8];
451 print_sflow_counter_processor(const u_char *pointer, u_int len) {
453 const struct sflow_processor_counter_t *sflow_processor_counter;
455 if (len < sizeof(struct sflow_processor_counter_t))
458 sflow_processor_counter = (const struct sflow_processor_counter_t *)pointer;
459 printf("\n\t 5sec %u, 1min %u, 5min %u, total_mem %" PRIu64
460 ", total_mem %" PRIu64,
461 EXTRACT_32BITS(sflow_processor_counter->five_sec_util),
462 EXTRACT_32BITS(sflow_processor_counter->one_min_util),
463 EXTRACT_32BITS(sflow_processor_counter->five_min_util),
464 EXTRACT_64BITS(sflow_processor_counter->total_memory),
465 EXTRACT_64BITS(sflow_processor_counter->free_memory));
471 sflow_print_counter_records(const u_char *pointer, u_int len, u_int records) {
479 const struct sflow_counter_record_t *sflow_counter_record;
485 while (nrecords > 0) {
486 /* do we have the "header?" */
487 if (tlen < sizeof(struct sflow_counter_record_t))
489 sflow_counter_record = (const struct sflow_counter_record_t *)tptr;
491 enterprise = EXTRACT_32BITS(sflow_counter_record->format);
492 counter_type = enterprise & 0x0FFF;
493 enterprise = enterprise >> 20;
494 counter_len = EXTRACT_32BITS(sflow_counter_record->length);
495 printf("\n\t enterprise %u, %s (%u) length %u",
497 (enterprise == 0) ? tok2str(sflow_counter_type_values,"Unknown",counter_type) : "Unknown",
501 tptr += sizeof(struct sflow_counter_record_t);
502 tlen -= sizeof(struct sflow_counter_record_t);
504 if (tlen < counter_len)
506 if (enterprise == 0) {
507 switch (counter_type) {
508 case SFLOW_COUNTER_GENERIC:
509 if (print_sflow_counter_generic(tptr,tlen))
512 case SFLOW_COUNTER_ETHERNET:
513 if (print_sflow_counter_ethernet(tptr,tlen))
516 case SFLOW_COUNTER_TOKEN_RING:
517 if (print_sflow_counter_token_ring(tptr,tlen))
520 case SFLOW_COUNTER_BASEVG:
521 if (print_sflow_counter_basevg(tptr,tlen))
524 case SFLOW_COUNTER_VLAN:
525 if (print_sflow_counter_vlan(tptr,tlen))
528 case SFLOW_COUNTER_PROCESSOR:
529 if (print_sflow_counter_processor(tptr,tlen))
534 print_unknown_data(tptr, "\n\t\t", counter_len);
549 sflow_print_counter_sample(const u_char *pointer, u_int len) {
551 const struct sflow_counter_sample_t *sflow_counter_sample;
558 if (len < sizeof(struct sflow_counter_sample_t))
561 sflow_counter_sample = (const struct sflow_counter_sample_t *)pointer;
563 typesource = EXTRACT_32BITS(sflow_counter_sample->typesource);
564 nrecords = EXTRACT_32BITS(sflow_counter_sample->records);
565 type = typesource >> 24;
566 index = typesource & 0x0FFF;
568 printf(" seqnum %u, type %u, idx %u, records %u",
569 EXTRACT_32BITS(sflow_counter_sample->seqnum),
574 return sflow_print_counter_records(pointer + sizeof(struct sflow_counter_sample_t),
575 len - sizeof(struct sflow_counter_sample_t),
581 sflow_print_expanded_counter_sample(const u_char *pointer, u_int len) {
583 const struct sflow_expanded_counter_sample_t *sflow_expanded_counter_sample;
587 if (len < sizeof(struct sflow_expanded_counter_sample_t))
590 sflow_expanded_counter_sample = (const struct sflow_expanded_counter_sample_t *)pointer;
592 nrecords = EXTRACT_32BITS(sflow_expanded_counter_sample->records);
594 printf(" seqnum %u, type %u, idx %u, records %u",
595 EXTRACT_32BITS(sflow_expanded_counter_sample->seqnum),
596 EXTRACT_32BITS(sflow_expanded_counter_sample->type),
597 EXTRACT_32BITS(sflow_expanded_counter_sample->index),
600 return sflow_print_counter_records(pointer + sizeof(struct sflow_expanded_counter_sample_t),
601 len - sizeof(struct sflow_expanded_counter_sample_t),
607 print_sflow_raw_packet(const u_char *pointer, u_int len) {
609 const struct sflow_expanded_flow_raw_t *sflow_flow_raw;
611 if (len < sizeof(struct sflow_expanded_flow_raw_t))
614 sflow_flow_raw = (const struct sflow_expanded_flow_raw_t *)pointer;
615 printf("\n\t protocol %s (%u), length %u, stripped bytes %u, header_size %u",
616 tok2str(sflow_flow_raw_protocol_values,"Unknown",EXTRACT_32BITS(sflow_flow_raw->protocol)),
617 EXTRACT_32BITS(sflow_flow_raw->protocol),
618 EXTRACT_32BITS(sflow_flow_raw->length),
619 EXTRACT_32BITS(sflow_flow_raw->stripped_bytes),
620 EXTRACT_32BITS(sflow_flow_raw->header_size));
622 /* QUESTION - should we attempt to print the raw header itself?
623 assuming of course there is wnough data present to do so... */
629 print_sflow_ethernet_frame(const u_char *pointer, u_int len) {
631 const struct sflow_ethernet_frame_t *sflow_ethernet_frame;
633 if (len < sizeof(struct sflow_ethernet_frame_t))
636 sflow_ethernet_frame = (const struct sflow_ethernet_frame_t *)pointer;
638 printf("\n\t frame len %u, type %u",
639 EXTRACT_32BITS(sflow_ethernet_frame->length),
640 EXTRACT_32BITS(sflow_ethernet_frame->type));
646 print_sflow_extended_switch_data(const u_char *pointer, u_int len) {
648 const struct sflow_extended_switch_data_t *sflow_extended_sw_data;
650 if (len < sizeof(struct sflow_extended_switch_data_t))
653 sflow_extended_sw_data = (const struct sflow_extended_switch_data_t *)pointer;
654 printf("\n\t src vlan %u, src pri %u, dst vlan %u, dst pri %u",
655 EXTRACT_32BITS(sflow_extended_sw_data->src_vlan),
656 EXTRACT_32BITS(sflow_extended_sw_data->src_pri),
657 EXTRACT_32BITS(sflow_extended_sw_data->dst_vlan),
658 EXTRACT_32BITS(sflow_extended_sw_data->dst_pri));
664 sflow_print_flow_records(const u_char *pointer, u_int len, u_int records) {
672 const struct sflow_flow_record_t *sflow_flow_record;
678 while (nrecords > 0) {
679 /* do we have the "header?" */
680 if (tlen < sizeof(struct sflow_flow_record_t))
683 sflow_flow_record = (const struct sflow_flow_record_t *)tptr;
685 /* so, the funky encoding means we cannot blythly mask-off
686 bits, we must also check the enterprise. */
688 enterprise = EXTRACT_32BITS(sflow_flow_record->format);
689 flow_type = enterprise & 0x0FFF;
690 enterprise = enterprise >> 12;
691 flow_len = EXTRACT_32BITS(sflow_flow_record->length);
692 printf("\n\t enterprise %u %s (%u) length %u",
694 (enterprise == 0) ? tok2str(sflow_flow_type_values,"Unknown",flow_type) : "Unknown",
698 tptr += sizeof(struct sflow_flow_record_t);
699 tlen -= sizeof(struct sflow_flow_record_t);
704 if (enterprise == 0) {
706 case SFLOW_FLOW_RAW_PACKET:
707 if (print_sflow_raw_packet(tptr,tlen))
710 case SFLOW_FLOW_EXTENDED_SWITCH_DATA:
711 if (print_sflow_extended_switch_data(tptr,tlen))
714 case SFLOW_FLOW_ETHERNET_FRAME:
715 if (print_sflow_ethernet_frame(tptr,tlen))
718 /* FIXME these need a decoder */
719 case SFLOW_FLOW_IPV4_DATA:
720 case SFLOW_FLOW_IPV6_DATA:
721 case SFLOW_FLOW_EXTENDED_ROUTER_DATA:
722 case SFLOW_FLOW_EXTENDED_GATEWAY_DATA:
723 case SFLOW_FLOW_EXTENDED_USER_DATA:
724 case SFLOW_FLOW_EXTENDED_URL_DATA:
725 case SFLOW_FLOW_EXTENDED_MPLS_DATA:
726 case SFLOW_FLOW_EXTENDED_NAT_DATA:
727 case SFLOW_FLOW_EXTENDED_MPLS_TUNNEL:
728 case SFLOW_FLOW_EXTENDED_MPLS_VC:
729 case SFLOW_FLOW_EXTENDED_MPLS_FEC:
730 case SFLOW_FLOW_EXTENDED_MPLS_LVP_FEC:
731 case SFLOW_FLOW_EXTENDED_VLAN_TUNNEL:
735 print_unknown_data(tptr, "\n\t\t", flow_len);
749 sflow_print_flow_sample(const u_char *pointer, u_int len) {
751 const struct sflow_flow_sample_t *sflow_flow_sample;
757 if (len < sizeof(struct sflow_flow_sample_t))
760 sflow_flow_sample = (struct sflow_flow_sample_t *)pointer;
762 typesource = EXTRACT_32BITS(sflow_flow_sample->typesource);
763 nrecords = EXTRACT_32BITS(sflow_flow_sample->records);
764 type = typesource >> 24;
765 index = typesource & 0x0FFF;
767 printf(" seqnum %u, type %u, idx %u, rate %u, pool %u, drops %u, input %u output %u records %u",
768 EXTRACT_32BITS(sflow_flow_sample->seqnum),
771 EXTRACT_32BITS(sflow_flow_sample->rate),
772 EXTRACT_32BITS(sflow_flow_sample->pool),
773 EXTRACT_32BITS(sflow_flow_sample->drops),
774 EXTRACT_32BITS(sflow_flow_sample->in_interface),
775 EXTRACT_32BITS(sflow_flow_sample->out_interface),
778 return sflow_print_flow_records(pointer + sizeof(struct sflow_flow_sample_t),
779 len - sizeof(struct sflow_flow_sample_t),
785 sflow_print_expanded_flow_sample(const u_char *pointer, u_int len) {
787 const struct sflow_expanded_flow_sample_t *sflow_expanded_flow_sample;
790 if (len < sizeof(struct sflow_expanded_flow_sample_t))
793 sflow_expanded_flow_sample = (const struct sflow_expanded_flow_sample_t *)pointer;
795 nrecords = EXTRACT_32BITS(sflow_expanded_flow_sample->records);
797 printf(" seqnum %u, type %u, idx %u, rate %u, pool %u, drops %u, records %u",
798 EXTRACT_32BITS(sflow_expanded_flow_sample->seqnum),
799 EXTRACT_32BITS(sflow_expanded_flow_sample->type),
800 EXTRACT_32BITS(sflow_expanded_flow_sample->index),
801 EXTRACT_32BITS(sflow_expanded_flow_sample->rate),
802 EXTRACT_32BITS(sflow_expanded_flow_sample->pool),
803 EXTRACT_32BITS(sflow_expanded_flow_sample->drops),
804 EXTRACT_32BITS(sflow_expanded_flow_sample->records));
806 return sflow_print_flow_records(pointer + sizeof(struct sflow_expanded_flow_sample_t),
807 len - sizeof(struct sflow_expanded_flow_sample_t),
813 sflow_print(const u_char *pptr, u_int len) {
815 const struct sflow_datagram_t *sflow_datagram;
816 const struct sflow_sample_header *sflow_sample;
820 u_int32_t sflow_sample_type, sflow_sample_len;
826 sflow_datagram = (const struct sflow_datagram_t *)pptr;
827 TCHECK(*sflow_datagram);
830 * Sanity checking of the header.
832 if (EXTRACT_32BITS(sflow_datagram->version) != 5) {
833 printf("sFlow version %u packet not supported",
834 EXTRACT_32BITS(sflow_datagram->version));
839 printf("sFlowv%u, %s agent %s, agent-id %u, length %u",
840 EXTRACT_32BITS(sflow_datagram->version),
841 EXTRACT_32BITS(sflow_datagram->ip_version) == 1 ? "IPv4" : "IPv6",
842 ipaddr_string(sflow_datagram->agent),
843 EXTRACT_32BITS(sflow_datagram->samples),
848 /* ok they seem to want to know everything - lets fully decode it */
849 nsamples=EXTRACT_32BITS(sflow_datagram->samples);
850 printf("sFlowv%u, %s agent %s, agent-id %u, seqnum %u, uptime %u, samples %u, length %u",
851 EXTRACT_32BITS(sflow_datagram->version),
852 EXTRACT_32BITS(sflow_datagram->ip_version) == 1 ? "IPv4" : "IPv6",
853 ipaddr_string(sflow_datagram->agent),
854 EXTRACT_32BITS(sflow_datagram->agent_id),
855 EXTRACT_32BITS(sflow_datagram->seqnum),
856 EXTRACT_32BITS(sflow_datagram->uptime),
860 /* skip Common header */
861 tptr += sizeof(const struct sflow_datagram_t);
862 tlen -= sizeof(const struct sflow_datagram_t);
864 while (nsamples > 0 && tlen > 0) {
865 sflow_sample = (const struct sflow_sample_header *)tptr;
866 TCHECK(*sflow_sample);
868 sflow_sample_type = (EXTRACT_32BITS(sflow_sample->format)&0x0FFF);
869 sflow_sample_len = EXTRACT_32BITS(sflow_sample->len);
871 if (tlen < sizeof(struct sflow_sample_header))
874 tptr += sizeof(struct sflow_sample_header);
875 tlen -= sizeof(struct sflow_sample_header);
877 printf("\n\t%s (%u), length %u,",
878 tok2str(sflow_format_values, "Unknown", sflow_sample_type),
882 /* basic sanity check */
883 if (sflow_sample_type == 0 || sflow_sample_len ==0) {
887 if (tlen < sflow_sample_len)
890 /* did we capture enough for fully decoding the sample ? */
891 TCHECK2(*tptr, sflow_sample_len);
893 switch(sflow_sample_type) {
894 case SFLOW_FLOW_SAMPLE:
895 if (sflow_print_flow_sample(tptr,tlen))
899 case SFLOW_COUNTER_SAMPLE:
900 if (sflow_print_counter_sample(tptr,tlen))
904 case SFLOW_EXPANDED_FLOW_SAMPLE:
905 if (sflow_print_expanded_flow_sample(tptr,tlen))
909 case SFLOW_EXPANDED_COUNTER_SAMPLE:
910 if (sflow_print_expanded_counter_sample(tptr,tlen))
916 print_unknown_data(tptr, "\n\t ", sflow_sample_len);
919 tptr += sflow_sample_len;
920 tlen -= sflow_sample_len;
931 * c-style: whitesmith