wanderer/fastnetmon-rewritten
1
0
Fork 0
mirror of https://github.com/pavel-odintsov/fastnetmon synced 2024-11-23 17:32:59 +01:00
Code Issues Releases Activity

Unify code for processing sflow/mirror and netflow on unified way

Browse Source
This commit is contained in:
Pavel Odintsov 2015-01-26 11:09:03 +03:00
parent 3be86ac823
commit 42f87c3555
3 changed files with 23 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
fastnetmon.cpp
View File

@ -1169,6 +1169,12 @@ void parse_packet_pf_ring(const struct pfring_pkthdr *h, const u_char *p, const
// Описание всех полей: http://www.ntop.org/pfring_api/structpkt__parsing__info.html
simple_packet packet;
// We pass only one packet to processing
current_packet.number_of_packets = 1;
// Now we support only non sampled input from PF_RING
current_packet.sample_ratio = 1;
if (!pf_ring_zc_api_mode) {
if (!we_use_pf_ring_in_kernel_parser) {
// In ZC (zc:eth0) mode you should manually add packet parsing here
@ -1357,8 +1363,15 @@ void process_packet(simple_packet& current_packet) {
}
}
uint32_t sampled_number_of_packets = current_packet.sample_ratio;
uint32_t sampled_number_of_bytes = current_packet.length * current_packet.sample_ratio;
/* Because we support mirroring, sflow and netflow we should support different cases:
- One packet passed for processing (mirror)
- Multiple packets ("flows") passed for processing (netflow)
- One sampled packed passed for processing (netflow)
- Another combinations of this three options
*/
uint32_t sampled_number_of_packets = current_packet.number_of_packets * current_packet.sample_ratio;
uint32_t sampled_number_of_bytes = current_packet.length * current_packet.sample_ratio;
__sync_fetch_and_add(&total_counters[packet_direction].packets, sampled_number_of_packets);
__sync_fetch_and_add(&total_counters[packet_direction].bytes, sampled_number_of_bytes);

13
netflow_plugin/netflow_collector.cpp
View File

@ -60,12 +60,13 @@ void process_netflow_packet_v5(u_int len, u_int8_t *packet) {
current_packet.ts.tv_usec = 0;
current_packet.flags = 0;
#define NTO64(a) (htobe64(ntohl(a)))
current_packet.length = NTO64(nf5_flow->flow_octets);
// TODO: it's COMPLETELY WRONG!!!! WE SHOULD NOT DO IT!!!!
// We should set current_packet = number_of_packets instead!!!
current_packet.sample_ratio = NTO64(nf5_flow->flow_packets);
#undef NTO64
// TODO: we should pass data about "flow" structure of this data
current_packet.length = htobe64(ntohl(nf5_flow->flow_octets));
current_packet.number_of_packets = htobe64(ntohl(nf5_flow->flow_packets));
// netflow did not support sampling
current_packet.sample_ratio = 1;
switch (nf5_flow->protocol) {
case 1: {

1
sflow_plugin/sflow_collector.cpp
View File

@ -612,6 +612,7 @@ void decodeIPLayer4(SFSample *sample, uint8_t *ptr) {
current_packet.ts.tv_sec = 0;
current_packet.ts.tv_usec = 0;
current_packet.flags = 0;
current_packet.number_of_packets = 1;
current_packet.length = sample->sampledPacketSize;
current_packet.sample_ratio = sample->meanSkipCount;