1 /* Copyright (c) 2002-2009 InMon Corp. Licensed under the terms of either the
2 * Sun Industry Standards Source License 1.1, that is available at:
3 * http://host-sflow.sourceforge.net/sissl.html
4 * or the InMon sFlow License, that is available at:
5 * http://www.inmon.com/technology/sflowlicense.txt
12 SFL_DSCLASS_IFINDEX = 0,
14 SFL_DSCLASS_PHYSICAL_ENTITY = 2,
15 SFL_DSCLASS_LOGICAL_ENTITY = 3
18 enum SFLAddress_type {
19 SFLADDRESSTYPE_IP_V4 = 1,
20 SFLADDRESSTYPE_IP_V6 = 2
31 typedef union _SFLAddress_value {
36 typedef struct _SFLAddress {
37 u_int32_t type; /* enum SFLAddress_type */
38 SFLAddress_value address;
41 /* Packet header data */
43 #define SFL_DEFAULT_HEADER_SIZE 128
44 #define SFL_DEFAULT_COLLECTOR_PORT 6343
45 #define SFL_DEFAULT_SAMPLING_RATE 400
46 #define SFL_DEFAULT_POLLING_INTERVAL 30
48 /* The header protocol describes the format of the sampled header */
49 enum SFLHeader_protocol {
50 SFLHEADER_ETHERNET_ISO8023 = 1,
51 SFLHEADER_ISO88024_TOKENBUS = 2,
52 SFLHEADER_ISO88025_TOKENRING = 3,
54 SFLHEADER_FRAME_RELAY = 5,
59 SFLHEADER_AAL5_IP = 10, /* e.g. Cisco AAL5 mux */
65 /* raw sampled header */
67 typedef struct _SFLSampled_header {
68 u_int32_t header_protocol; /* (enum SFLHeader_protocol) */
69 u_int32_t frame_length; /* Original length of packet before sampling */
70 u_int32_t stripped; /* header/trailer bytes stripped by sender */
71 u_int32_t header_length; /* length of sampled header bytes to follow */
72 u_int8_t *header_bytes; /* Header bytes */
75 /* decoded ethernet header */
77 typedef struct _SFLSampled_ethernet {
78 u_int32_t eth_len; /* The length of the MAC packet excluding
79 lower layer encapsulations */
80 u_int8_t src_mac[8]; /* 6 bytes + 2 pad */
83 } SFLSampled_ethernet;
85 /* decoded IP version 4 header */
87 typedef struct _SFLSampled_ipv4 {
88 u_int32_t length; /* The length of the IP packet
89 excluding lower layer encapsulations */
90 u_int32_t protocol; /* IP Protocol type (for example, TCP = 6, UDP = 17) */
91 SFLIPv4 src_ip; /* Source IP Address */
92 SFLIPv4 dst_ip; /* Destination IP Address */
93 u_int32_t src_port; /* TCP/UDP source port number or equivalent */
94 u_int32_t dst_port; /* TCP/UDP destination port number or equivalent */
95 u_int32_t tcp_flags; /* TCP flags */
96 u_int32_t tos; /* IP type of service */
99 /* decoded IP version 6 data */
101 typedef struct _SFLSampled_ipv6 {
102 u_int32_t length; /* The length of the IP packet
103 excluding lower layer encapsulations */
104 u_int32_t protocol; /* IP Protocol type (for example, TCP = 6, UDP = 17) */
105 SFLIPv6 src_ip; /* Source IP Address */
106 SFLIPv6 dst_ip; /* Destination IP Address */
107 u_int32_t src_port; /* TCP/UDP source port number or equivalent */
108 u_int32_t dst_port; /* TCP/UDP destination port number or equivalent */
109 u_int32_t tcp_flags; /* TCP flags */
110 u_int32_t priority; /* IP priority */
113 /* Extended data types */
115 /* Extended switch data */
117 typedef struct _SFLExtended_switch {
118 u_int32_t src_vlan; /* The 802.1Q VLAN id of incomming frame */
119 u_int32_t src_priority; /* The 802.1p priority */
120 u_int32_t dst_vlan; /* The 802.1Q VLAN id of outgoing frame */
121 u_int32_t dst_priority; /* The 802.1p priority */
122 } SFLExtended_switch;
124 /* Extended router data */
126 typedef struct _SFLExtended_router {
127 SFLAddress nexthop; /* IP address of next hop router */
128 u_int32_t src_mask; /* Source address prefix mask bits */
129 u_int32_t dst_mask; /* Destination address prefix mask bits */
130 } SFLExtended_router;
132 /* Extended gateway data */
133 enum SFLExtended_as_path_segment_type {
134 SFLEXTENDED_AS_SET = 1, /* Unordered set of ASs */
135 SFLEXTENDED_AS_SEQUENCE = 2 /* Ordered sequence of ASs */
138 typedef struct _SFLExtended_as_path_segment {
139 u_int32_t type; /* enum SFLExtended_as_path_segment_type */
140 u_int32_t length; /* number of AS numbers in set/sequence */
145 } SFLExtended_as_path_segment;
147 typedef struct _SFLExtended_gateway {
148 SFLAddress nexthop; /* Address of the border router that should
149 be used for the destination network */
150 u_int32_t as; /* AS number for this gateway */
151 u_int32_t src_as; /* AS number of source (origin) */
152 u_int32_t src_peer_as; /* AS number of source peer */
153 u_int32_t dst_as_path_segments; /* number of segments in path */
154 SFLExtended_as_path_segment *dst_as_path; /* list of seqs or sets */
155 u_int32_t communities_length; /* number of communities */
156 u_int32_t *communities; /* set of communities */
157 u_int32_t localpref; /* LocalPref associated with this route */
158 } SFLExtended_gateway;
160 typedef struct _SFLString {
165 /* Extended user data */
167 typedef struct _SFLExtended_user {
168 u_int32_t src_charset; /* MIBEnum value of character set used to encode a string - See RFC 2978
169 Where possible UTF-8 encoding (MIBEnum=106) should be used. A value
170 of zero indicates an unknown encoding. */
172 u_int32_t dst_charset;
176 /* Extended URL data */
178 enum SFLExtended_url_direction {
179 SFLEXTENDED_URL_SRC = 1, /* URL is associated with source address */
180 SFLEXTENDED_URL_DST = 2 /* URL is associated with destination address */
183 typedef struct _SFLExtended_url {
184 u_int32_t direction; /* enum SFLExtended_url_direction */
185 SFLString url; /* URL associated with the packet flow.
186 Must be URL encoded */
187 SFLString host; /* The host field from the HTTP header */
190 /* Extended MPLS data */
192 typedef struct _SFLLabelStack {
194 u_int32_t *stack; /* first entry is top of stack - see RFC 3032 for encoding */
197 typedef struct _SFLExtended_mpls {
198 SFLAddress nextHop; /* Address of the next hop */
199 SFLLabelStack in_stack;
200 SFLLabelStack out_stack;
204 Packet header records report addresses as seen at the sFlowDataSource.
205 The extended_nat structure reports on translated source and/or destination
206 addesses for this packet. If an address was not translated it should
207 be equal to that reported for the header. */
209 typedef struct _SFLExtended_nat {
210 SFLAddress src; /* Source address */
211 SFLAddress dst; /* Destination address */
214 /* additional Extended MPLS stucts */
216 typedef struct _SFLExtended_mpls_tunnel {
217 SFLString tunnel_lsp_name; /* Tunnel name */
218 u_int32_t tunnel_id; /* Tunnel ID */
219 u_int32_t tunnel_cos; /* Tunnel COS value */
220 } SFLExtended_mpls_tunnel;
222 typedef struct _SFLExtended_mpls_vc {
223 SFLString vc_instance_name; /* VC instance name */
224 u_int32_t vll_vc_id; /* VLL/VC instance ID */
225 u_int32_t vc_label_cos; /* VC Label COS value */
226 } SFLExtended_mpls_vc;
229 - Definitions from MPLS-FTN-STD-MIB mplsFTNTable */
231 typedef struct _SFLExtended_mpls_FTN {
232 SFLString mplsFTNDescr;
233 u_int32_t mplsFTNMask;
234 } SFLExtended_mpls_FTN;
236 /* Extended MPLS LVP FEC
237 - Definition from MPLS-LDP-STD-MIB mplsFecTable
238 Note: mplsFecAddrType, mplsFecAddr information available
239 from packet header */
241 typedef struct _SFLExtended_mpls_LDP_FEC {
242 u_int32_t mplsFecAddrPrefixLength;
243 } SFLExtended_mpls_LDP_FEC;
245 /* Extended VLAN tunnel information
246 Record outer VLAN encapsulations that have
247 been stripped. extended_vlantunnel information
248 should only be reported if all the following conditions are satisfied:
249 1. The packet has nested vlan tags, AND
250 2. The reporting device is VLAN aware, AND
251 3. One or more VLAN tags have been stripped, either
252 because they represent proprietary encapsulations, or
253 because switch hardware automatically strips the outer VLAN
255 Reporting extended_vlantunnel information is not a substitute for
256 reporting extended_switch information. extended_switch data must
257 always be reported to describe the ingress/egress VLAN information
258 for the packet. The extended_vlantunnel information only applies to
259 nested VLAN tags, and then only when one or more tags has been
262 typedef SFLLabelStack SFLVlanStack;
263 typedef struct _SFLExtended_vlan_tunnel {
264 SFLVlanStack stack; /* List of stripped 802.1Q TPID/TCI layers. Each
265 TPID,TCI pair is represented as a single 32 bit
266 integer. Layers listed from outermost to
268 } SFLExtended_vlan_tunnel;
270 enum SFLFlow_type_tag {
271 /* enterprise = 0, format = ... */
272 SFLFLOW_HEADER = 1, /* Packet headers are sampled */
273 SFLFLOW_ETHERNET = 2, /* MAC layer information */
274 SFLFLOW_IPV4 = 3, /* IP version 4 data */
275 SFLFLOW_IPV6 = 4, /* IP version 6 data */
276 SFLFLOW_EX_SWITCH = 1001, /* Extended switch information */
277 SFLFLOW_EX_ROUTER = 1002, /* Extended router information */
278 SFLFLOW_EX_GATEWAY = 1003, /* Extended gateway router information */
279 SFLFLOW_EX_USER = 1004, /* Extended TACAS/RADIUS user information */
280 SFLFLOW_EX_URL = 1005, /* Extended URL information */
281 SFLFLOW_EX_MPLS = 1006, /* Extended MPLS information */
282 SFLFLOW_EX_NAT = 1007, /* Extended NAT information */
283 SFLFLOW_EX_MPLS_TUNNEL = 1008, /* additional MPLS information */
284 SFLFLOW_EX_MPLS_VC = 1009,
285 SFLFLOW_EX_MPLS_FTN = 1010,
286 SFLFLOW_EX_MPLS_LDP_FEC = 1011,
287 SFLFLOW_EX_VLAN_TUNNEL = 1012, /* VLAN stack */
290 typedef union _SFLFlow_type {
291 SFLSampled_header header;
292 SFLSampled_ethernet ethernet;
293 SFLSampled_ipv4 ipv4;
294 SFLSampled_ipv6 ipv6;
295 SFLExtended_switch sw;
296 SFLExtended_router router;
297 SFLExtended_gateway gateway;
298 SFLExtended_user user;
300 SFLExtended_mpls mpls;
302 SFLExtended_mpls_tunnel mpls_tunnel;
303 SFLExtended_mpls_vc mpls_vc;
304 SFLExtended_mpls_FTN mpls_ftn;
305 SFLExtended_mpls_LDP_FEC mpls_ldp_fec;
306 SFLExtended_vlan_tunnel vlan_tunnel;
309 typedef struct _SFLFlow_sample_element {
310 struct _SFLFlow_sample_element *nxt;
311 u_int32_t tag; /* SFLFlow_type_tag */
313 SFLFlow_type flowType;
314 } SFLFlow_sample_element;
316 enum SFL_sample_tag {
317 SFLFLOW_SAMPLE = 1, /* enterprise = 0 : format = 1 */
318 SFLCOUNTERS_SAMPLE = 2, /* enterprise = 0 : format = 2 */
319 SFLFLOW_SAMPLE_EXPANDED = 3, /* enterprise = 0 : format = 3 */
320 SFLCOUNTERS_SAMPLE_EXPANDED = 4 /* enterprise = 0 : format = 4 */
323 /* Format of a single flow sample */
325 typedef struct _SFLFlow_sample {
326 /* u_int32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 1 */
327 /* u_int32_t length; */
328 u_int32_t sequence_number; /* Incremented with each flow sample
330 u_int32_t source_id; /* fsSourceId */
331 u_int32_t sampling_rate; /* fsPacketSamplingRate */
332 u_int32_t sample_pool; /* Total number of packets that could have been
333 sampled (i.e. packets skipped by sampling
334 process + total number of samples) */
335 u_int32_t drops; /* Number of times a packet was dropped due to
337 u_int32_t input; /* SNMP ifIndex of input interface.
338 0 if interface is not known. */
339 u_int32_t output; /* SNMP ifIndex of output interface,
340 0 if interface is not known.
341 Set most significant bit to indicate
342 multiple destination interfaces
343 (i.e. in case of broadcast or multicast)
344 and set lower order bits to indicate
345 number of destination interfaces.
347 0x00000002 indicates ifIndex = 2
348 0x00000000 ifIndex unknown.
349 0x80000007 indicates a packet sent
351 0x80000000 indicates a packet sent to
353 interfaces greater than 1.*/
354 u_int32_t num_elements;
355 SFLFlow_sample_element *elements;
358 /* same thing, but the expanded version (for full 32-bit ifIndex numbers) */
360 typedef struct _SFLFlow_sample_expanded {
361 /* u_int32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 1 */
362 /* u_int32_t length; */
363 u_int32_t sequence_number; /* Incremented with each flow sample
365 u_int32_t ds_class; /* EXPANDED */
366 u_int32_t ds_index; /* EXPANDED */
367 u_int32_t sampling_rate; /* fsPacketSamplingRate */
368 u_int32_t sample_pool; /* Total number of packets that could have been
369 sampled (i.e. packets skipped by sampling
370 process + total number of samples) */
371 u_int32_t drops; /* Number of times a packet was dropped due to
373 u_int32_t inputFormat; /* EXPANDED */
374 u_int32_t input; /* SNMP ifIndex of input interface.
375 0 if interface is not known. */
376 u_int32_t outputFormat; /* EXPANDED */
377 u_int32_t output; /* SNMP ifIndex of output interface,
378 0 if interface is not known. */
379 u_int32_t num_elements;
380 SFLFlow_sample_element *elements;
381 } SFLFlow_sample_expanded;
385 /* Generic interface counters - see RFC 1573, 2233 */
387 typedef struct _SFLIf_counters {
391 u_int32_t ifDirection; /* Derived from MAU MIB (RFC 2668)
392 0 = unknown, 1 = full-duplex,
393 2 = half-duplex, 3 = in, 4 = out */
394 u_int32_t ifStatus; /* bit field with the following bits assigned:
395 bit 0 = ifAdminStatus (0 = down, 1 = up)
396 bit 1 = ifOperStatus (0 = down, 1 = up) */
397 u_int64_t ifInOctets;
398 u_int32_t ifInUcastPkts;
399 u_int32_t ifInMulticastPkts;
400 u_int32_t ifInBroadcastPkts;
401 u_int32_t ifInDiscards;
402 u_int32_t ifInErrors;
403 u_int32_t ifInUnknownProtos;
404 u_int64_t ifOutOctets;
405 u_int32_t ifOutUcastPkts;
406 u_int32_t ifOutMulticastPkts;
407 u_int32_t ifOutBroadcastPkts;
408 u_int32_t ifOutDiscards;
409 u_int32_t ifOutErrors;
410 u_int32_t ifPromiscuousMode;
413 /* Ethernet interface counters - see RFC 2358 */
414 typedef struct _SFLEthernet_counters {
415 u_int32_t dot3StatsAlignmentErrors;
416 u_int32_t dot3StatsFCSErrors;
417 u_int32_t dot3StatsSingleCollisionFrames;
418 u_int32_t dot3StatsMultipleCollisionFrames;
419 u_int32_t dot3StatsSQETestErrors;
420 u_int32_t dot3StatsDeferredTransmissions;
421 u_int32_t dot3StatsLateCollisions;
422 u_int32_t dot3StatsExcessiveCollisions;
423 u_int32_t dot3StatsInternalMacTransmitErrors;
424 u_int32_t dot3StatsCarrierSenseErrors;
425 u_int32_t dot3StatsFrameTooLongs;
426 u_int32_t dot3StatsInternalMacReceiveErrors;
427 u_int32_t dot3StatsSymbolErrors;
428 } SFLEthernet_counters;
430 /* Token ring counters - see RFC 1748 */
432 typedef struct _SFLTokenring_counters {
433 u_int32_t dot5StatsLineErrors;
434 u_int32_t dot5StatsBurstErrors;
435 u_int32_t dot5StatsACErrors;
436 u_int32_t dot5StatsAbortTransErrors;
437 u_int32_t dot5StatsInternalErrors;
438 u_int32_t dot5StatsLostFrameErrors;
439 u_int32_t dot5StatsReceiveCongestions;
440 u_int32_t dot5StatsFrameCopiedErrors;
441 u_int32_t dot5StatsTokenErrors;
442 u_int32_t dot5StatsSoftErrors;
443 u_int32_t dot5StatsHardErrors;
444 u_int32_t dot5StatsSignalLoss;
445 u_int32_t dot5StatsTransmitBeacons;
446 u_int32_t dot5StatsRecoverys;
447 u_int32_t dot5StatsLobeWires;
448 u_int32_t dot5StatsRemoves;
449 u_int32_t dot5StatsSingles;
450 u_int32_t dot5StatsFreqErrors;
451 } SFLTokenring_counters;
453 /* 100 BaseVG interface counters - see RFC 2020 */
455 typedef struct _SFLVg_counters {
456 u_int32_t dot12InHighPriorityFrames;
457 u_int64_t dot12InHighPriorityOctets;
458 u_int32_t dot12InNormPriorityFrames;
459 u_int64_t dot12InNormPriorityOctets;
460 u_int32_t dot12InIPMErrors;
461 u_int32_t dot12InOversizeFrameErrors;
462 u_int32_t dot12InDataErrors;
463 u_int32_t dot12InNullAddressedFrames;
464 u_int32_t dot12OutHighPriorityFrames;
465 u_int64_t dot12OutHighPriorityOctets;
466 u_int32_t dot12TransitionIntoTrainings;
467 u_int64_t dot12HCInHighPriorityOctets;
468 u_int64_t dot12HCInNormPriorityOctets;
469 u_int64_t dot12HCOutHighPriorityOctets;
472 typedef struct _SFLVlan_counters {
476 u_int32_t multicastPkts;
477 u_int32_t broadcastPkts;
483 enum SFLCounters_type_tag {
484 /* enterprise = 0, format = ... */
485 SFLCOUNTERS_GENERIC = 1,
486 SFLCOUNTERS_ETHERNET = 2,
487 SFLCOUNTERS_TOKENRING = 3,
492 typedef union _SFLCounters_type {
493 SFLIf_counters generic;
494 SFLEthernet_counters ethernet;
495 SFLTokenring_counters tokenring;
497 SFLVlan_counters vlan;
500 typedef struct _SFLCounters_sample_element {
501 struct _SFLCounters_sample_element *nxt; /* linked list */
502 u_int32_t tag; /* SFLCounters_type_tag */
504 SFLCounters_type counterBlock;
505 } SFLCounters_sample_element;
507 typedef struct _SFLCounters_sample {
508 /* u_int32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 2 */
509 /* u_int32_t length; */
510 u_int32_t sequence_number; /* Incremented with each counters sample
511 generated by this source_id */
512 u_int32_t source_id; /* fsSourceId */
513 u_int32_t num_elements;
514 SFLCounters_sample_element *elements;
515 } SFLCounters_sample;
517 /* same thing, but the expanded version, so ds_index can be a full 32 bits */
518 typedef struct _SFLCounters_sample_expanded {
519 /* u_int32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 2 */
520 /* u_int32_t length; */
521 u_int32_t sequence_number; /* Incremented with each counters sample
522 generated by this source_id */
523 u_int32_t ds_class; /* EXPANDED */
524 u_int32_t ds_index; /* EXPANDED */
525 u_int32_t num_elements;
526 SFLCounters_sample_element *elements;
527 } SFLCounters_sample_expanded;
529 #define SFLADD_ELEMENT(_sm, _el) do { (_el)->nxt = (_sm)->elements; (_sm)->elements = (_el); } while(0)
531 /* Format of a sample datagram */
533 enum SFLDatagram_version {
534 SFLDATAGRAM_VERSION2 = 2,
535 SFLDATAGRAM_VERSION4 = 4,
536 SFLDATAGRAM_VERSION5 = 5
539 typedef struct _SFLSample_datagram_hdr {
540 u_int32_t datagram_version; /* (enum SFLDatagram_version) = VERSION5 = 5 */
541 SFLAddress agent_address; /* IP address of sampling agent */
542 u_int32_t sub_agent_id; /* Used to distinguishing between datagram
543 streams from separate agent sub entities
545 u_int32_t sequence_number; /* Incremented with each sample datagram
547 u_int32_t uptime; /* Current time (in milliseconds since device
548 last booted). Should be set as close to
549 datagram transmission time as possible.*/
550 u_int32_t num_records; /* Number of tag-len-val flow/counter records to follow */
551 } SFLSample_datagram_hdr;
553 #define SFL_MAX_DATAGRAM_SIZE 1500
554 #define SFL_MIN_DATAGRAM_SIZE 200
555 #define SFL_DEFAULT_DATAGRAM_SIZE 1400
557 #define SFL_DATA_PAD 400