1 /* Copyright (c) 2002-2009 InMon Corp. Licensed under the terms of the InMon sFlow licence: */
2 /* http://www.inmon.com/technology/sflowlicense.txt */
8 SFLADDRESSTYPE_IP_V4 = 1,
9 SFLADDRESSTYPE_IP_V6 = 2
20 typedef union _SFLAddress_value {
25 typedef struct _SFLAddress {
26 u_int32_t type; /* enum SFLAddress_type */
27 SFLAddress_value address;
30 /* Packet header data */
32 #define SFL_DEFAULT_HEADER_SIZE 128
33 #define SFL_DEFAULT_COLLECTOR_PORT 6343
34 #define SFL_DEFAULT_SAMPLING_RATE 400
35 #define SFL_DEFAULT_POLLING_INTERVAL 30
37 /* The header protocol describes the format of the sampled header */
38 enum SFLHeader_protocol {
39 SFLHEADER_ETHERNET_ISO8023 = 1,
40 SFLHEADER_ISO88024_TOKENBUS = 2,
41 SFLHEADER_ISO88025_TOKENRING = 3,
43 SFLHEADER_FRAME_RELAY = 5,
48 SFLHEADER_AAL5_IP = 10, /* e.g. Cisco AAL5 mux */
54 /* raw sampled header */
56 typedef struct _SFLSampled_header {
57 u_int32_t header_protocol; /* (enum SFLHeader_protocol) */
58 u_int32_t frame_length; /* Original length of packet before sampling */
59 u_int32_t stripped; /* header/trailer bytes stripped by sender */
60 u_int32_t header_length; /* length of sampled header bytes to follow */
61 u_int8_t *header_bytes; /* Header bytes */
64 /* decoded ethernet header */
66 typedef struct _SFLSampled_ethernet {
67 u_int32_t eth_len; /* The length of the MAC packet excluding
68 lower layer encapsulations */
69 u_int8_t src_mac[8]; /* 6 bytes + 2 pad */
72 } SFLSampled_ethernet;
74 /* decoded IP version 4 header */
76 typedef struct _SFLSampled_ipv4 {
77 u_int32_t length; /* The length of the IP packet
78 excluding lower layer encapsulations */
79 u_int32_t protocol; /* IP Protocol type (for example, TCP = 6, UDP = 17) */
80 SFLIPv4 src_ip; /* Source IP Address */
81 SFLIPv4 dst_ip; /* Destination IP Address */
82 u_int32_t src_port; /* TCP/UDP source port number or equivalent */
83 u_int32_t dst_port; /* TCP/UDP destination port number or equivalent */
84 u_int32_t tcp_flags; /* TCP flags */
85 u_int32_t tos; /* IP type of service */
88 /* decoded IP version 6 data */
90 typedef struct _SFLSampled_ipv6 {
91 u_int32_t length; /* The length of the IP packet
92 excluding lower layer encapsulations */
93 u_int32_t protocol; /* IP Protocol type (for example, TCP = 6, UDP = 17) */
94 SFLIPv6 src_ip; /* Source IP Address */
95 SFLIPv6 dst_ip; /* Destination IP Address */
96 u_int32_t src_port; /* TCP/UDP source port number or equivalent */
97 u_int32_t dst_port; /* TCP/UDP destination port number or equivalent */
98 u_int32_t tcp_flags; /* TCP flags */
99 u_int32_t priority; /* IP priority */
102 /* Extended data types */
104 /* Extended switch data */
106 typedef struct _SFLExtended_switch {
107 u_int32_t src_vlan; /* The 802.1Q VLAN id of incomming frame */
108 u_int32_t src_priority; /* The 802.1p priority */
109 u_int32_t dst_vlan; /* The 802.1Q VLAN id of outgoing frame */
110 u_int32_t dst_priority; /* The 802.1p priority */
111 } SFLExtended_switch;
113 /* Extended router data */
115 typedef struct _SFLExtended_router {
116 SFLAddress nexthop; /* IP address of next hop router */
117 u_int32_t src_mask; /* Source address prefix mask bits */
118 u_int32_t dst_mask; /* Destination address prefix mask bits */
119 } SFLExtended_router;
121 /* Extended gateway data */
122 enum SFLExtended_as_path_segment_type {
123 SFLEXTENDED_AS_SET = 1, /* Unordered set of ASs */
124 SFLEXTENDED_AS_SEQUENCE = 2 /* Ordered sequence of ASs */
127 typedef struct _SFLExtended_as_path_segment {
128 u_int32_t type; /* enum SFLExtended_as_path_segment_type */
129 u_int32_t length; /* number of AS numbers in set/sequence */
134 } SFLExtended_as_path_segment;
136 typedef struct _SFLExtended_gateway {
137 SFLAddress nexthop; /* Address of the border router that should
138 be used for the destination network */
139 u_int32_t as; /* AS number for this gateway */
140 u_int32_t src_as; /* AS number of source (origin) */
141 u_int32_t src_peer_as; /* AS number of source peer */
142 u_int32_t dst_as_path_segments; /* number of segments in path */
143 SFLExtended_as_path_segment *dst_as_path; /* list of seqs or sets */
144 u_int32_t communities_length; /* number of communities */
145 u_int32_t *communities; /* set of communities */
146 u_int32_t localpref; /* LocalPref associated with this route */
147 } SFLExtended_gateway;
149 typedef struct _SFLString {
154 /* Extended user data */
156 typedef struct _SFLExtended_user {
157 u_int32_t src_charset; /* MIBEnum value of character set used to encode a string - See RFC 2978
158 Where possible UTF-8 encoding (MIBEnum=106) should be used. A value
159 of zero indicates an unknown encoding. */
161 u_int32_t dst_charset;
165 /* Extended URL data */
167 enum SFLExtended_url_direction {
168 SFLEXTENDED_URL_SRC = 1, /* URL is associated with source address */
169 SFLEXTENDED_URL_DST = 2 /* URL is associated with destination address */
172 typedef struct _SFLExtended_url {
173 u_int32_t direction; /* enum SFLExtended_url_direction */
174 SFLString url; /* URL associated with the packet flow.
175 Must be URL encoded */
176 SFLString host; /* The host field from the HTTP header */
179 /* Extended MPLS data */
181 typedef struct _SFLLabelStack {
183 u_int32_t *stack; /* first entry is top of stack - see RFC 3032 for encoding */
186 typedef struct _SFLExtended_mpls {
187 SFLAddress nextHop; /* Address of the next hop */
188 SFLLabelStack in_stack;
189 SFLLabelStack out_stack;
193 Packet header records report addresses as seen at the sFlowDataSource.
194 The extended_nat structure reports on translated source and/or destination
195 addesses for this packet. If an address was not translated it should
196 be equal to that reported for the header. */
198 typedef struct _SFLExtended_nat {
199 SFLAddress src; /* Source address */
200 SFLAddress dst; /* Destination address */
203 /* additional Extended MPLS stucts */
205 typedef struct _SFLExtended_mpls_tunnel {
206 SFLString tunnel_lsp_name; /* Tunnel name */
207 u_int32_t tunnel_id; /* Tunnel ID */
208 u_int32_t tunnel_cos; /* Tunnel COS value */
209 } SFLExtended_mpls_tunnel;
211 typedef struct _SFLExtended_mpls_vc {
212 SFLString vc_instance_name; /* VC instance name */
213 u_int32_t vll_vc_id; /* VLL/VC instance ID */
214 u_int32_t vc_label_cos; /* VC Label COS value */
215 } SFLExtended_mpls_vc;
218 - Definitions from MPLS-FTN-STD-MIB mplsFTNTable */
220 typedef struct _SFLExtended_mpls_FTN {
221 SFLString mplsFTNDescr;
222 u_int32_t mplsFTNMask;
223 } SFLExtended_mpls_FTN;
225 /* Extended MPLS LVP FEC
226 - Definition from MPLS-LDP-STD-MIB mplsFecTable
227 Note: mplsFecAddrType, mplsFecAddr information available
228 from packet header */
230 typedef struct _SFLExtended_mpls_LDP_FEC {
231 u_int32_t mplsFecAddrPrefixLength;
232 } SFLExtended_mpls_LDP_FEC;
234 /* Extended VLAN tunnel information
235 Record outer VLAN encapsulations that have
236 been stripped. extended_vlantunnel information
237 should only be reported if all the following conditions are satisfied:
238 1. The packet has nested vlan tags, AND
239 2. The reporting device is VLAN aware, AND
240 3. One or more VLAN tags have been stripped, either
241 because they represent proprietary encapsulations, or
242 because switch hardware automatically strips the outer VLAN
244 Reporting extended_vlantunnel information is not a substitute for
245 reporting extended_switch information. extended_switch data must
246 always be reported to describe the ingress/egress VLAN information
247 for the packet. The extended_vlantunnel information only applies to
248 nested VLAN tags, and then only when one or more tags has been
251 typedef SFLLabelStack SFLVlanStack;
252 typedef struct _SFLExtended_vlan_tunnel {
253 SFLVlanStack stack; /* List of stripped 802.1Q TPID/TCI layers. Each
254 TPID,TCI pair is represented as a single 32 bit
255 integer. Layers listed from outermost to
257 } SFLExtended_vlan_tunnel;
259 enum SFLFlow_type_tag {
260 /* enterprise = 0, format = ... */
261 SFLFLOW_HEADER = 1, /* Packet headers are sampled */
262 SFLFLOW_ETHERNET = 2, /* MAC layer information */
263 SFLFLOW_IPV4 = 3, /* IP version 4 data */
264 SFLFLOW_IPV6 = 4, /* IP version 6 data */
265 SFLFLOW_EX_SWITCH = 1001, /* Extended switch information */
266 SFLFLOW_EX_ROUTER = 1002, /* Extended router information */
267 SFLFLOW_EX_GATEWAY = 1003, /* Extended gateway router information */
268 SFLFLOW_EX_USER = 1004, /* Extended TACAS/RADIUS user information */
269 SFLFLOW_EX_URL = 1005, /* Extended URL information */
270 SFLFLOW_EX_MPLS = 1006, /* Extended MPLS information */
271 SFLFLOW_EX_NAT = 1007, /* Extended NAT information */
272 SFLFLOW_EX_MPLS_TUNNEL = 1008, /* additional MPLS information */
273 SFLFLOW_EX_MPLS_VC = 1009,
274 SFLFLOW_EX_MPLS_FTN = 1010,
275 SFLFLOW_EX_MPLS_LDP_FEC = 1011,
276 SFLFLOW_EX_VLAN_TUNNEL = 1012, /* VLAN stack */
279 typedef union _SFLFlow_type {
280 SFLSampled_header header;
281 SFLSampled_ethernet ethernet;
282 SFLSampled_ipv4 ipv4;
283 SFLSampled_ipv6 ipv6;
284 SFLExtended_switch sw;
285 SFLExtended_router router;
286 SFLExtended_gateway gateway;
287 SFLExtended_user user;
289 SFLExtended_mpls mpls;
291 SFLExtended_mpls_tunnel mpls_tunnel;
292 SFLExtended_mpls_vc mpls_vc;
293 SFLExtended_mpls_FTN mpls_ftn;
294 SFLExtended_mpls_LDP_FEC mpls_ldp_fec;
295 SFLExtended_vlan_tunnel vlan_tunnel;
298 typedef struct _SFLFlow_sample_element {
299 struct _SFLFlow_sample_element *nxt;
300 u_int32_t tag; /* SFLFlow_type_tag */
302 SFLFlow_type flowType;
303 } SFLFlow_sample_element;
305 enum SFL_sample_tag {
306 SFLFLOW_SAMPLE = 1, /* enterprise = 0 : format = 1 */
307 SFLCOUNTERS_SAMPLE = 2, /* enterprise = 0 : format = 2 */
308 SFLFLOW_SAMPLE_EXPANDED = 3, /* enterprise = 0 : format = 3 */
309 SFLCOUNTERS_SAMPLE_EXPANDED = 4 /* enterprise = 0 : format = 4 */
312 /* Format of a single flow sample */
314 typedef struct _SFLFlow_sample {
315 /* u_int32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 1 */
316 /* u_int32_t length; */
317 u_int32_t sequence_number; /* Incremented with each flow sample
319 u_int32_t source_id; /* fsSourceId */
320 u_int32_t sampling_rate; /* fsPacketSamplingRate */
321 u_int32_t sample_pool; /* Total number of packets that could have been
322 sampled (i.e. packets skipped by sampling
323 process + total number of samples) */
324 u_int32_t drops; /* Number of times a packet was dropped due to
326 u_int32_t input; /* SNMP ifIndex of input interface.
327 0 if interface is not known. */
328 u_int32_t output; /* SNMP ifIndex of output interface,
329 0 if interface is not known.
330 Set most significant bit to indicate
331 multiple destination interfaces
332 (i.e. in case of broadcast or multicast)
333 and set lower order bits to indicate
334 number of destination interfaces.
336 0x00000002 indicates ifIndex = 2
337 0x00000000 ifIndex unknown.
338 0x80000007 indicates a packet sent
340 0x80000000 indicates a packet sent to
342 interfaces greater than 1.*/
343 u_int32_t num_elements;
344 SFLFlow_sample_element *elements;
347 /* same thing, but the expanded version (for full 32-bit ifIndex numbers) */
349 typedef struct _SFLFlow_sample_expanded {
350 /* u_int32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 1 */
351 /* u_int32_t length; */
352 u_int32_t sequence_number; /* Incremented with each flow sample
354 u_int32_t ds_class; /* EXPANDED */
355 u_int32_t ds_index; /* EXPANDED */
356 u_int32_t sampling_rate; /* fsPacketSamplingRate */
357 u_int32_t sample_pool; /* Total number of packets that could have been
358 sampled (i.e. packets skipped by sampling
359 process + total number of samples) */
360 u_int32_t drops; /* Number of times a packet was dropped due to
362 u_int32_t inputFormat; /* EXPANDED */
363 u_int32_t input; /* SNMP ifIndex of input interface.
364 0 if interface is not known. */
365 u_int32_t outputFormat; /* EXPANDED */
366 u_int32_t output; /* SNMP ifIndex of output interface,
367 0 if interface is not known. */
368 u_int32_t num_elements;
369 SFLFlow_sample_element *elements;
370 } SFLFlow_sample_expanded;
374 /* Generic interface counters - see RFC 1573, 2233 */
376 typedef struct _SFLIf_counters {
380 u_int32_t ifDirection; /* Derived from MAU MIB (RFC 2668)
381 0 = unknown, 1 = full-duplex,
382 2 = half-duplex, 3 = in, 4 = out */
383 u_int32_t ifStatus; /* bit field with the following bits assigned:
384 bit 0 = ifAdminStatus (0 = down, 1 = up)
385 bit 1 = ifOperStatus (0 = down, 1 = up) */
386 u_int64_t ifInOctets;
387 u_int32_t ifInUcastPkts;
388 u_int32_t ifInMulticastPkts;
389 u_int32_t ifInBroadcastPkts;
390 u_int32_t ifInDiscards;
391 u_int32_t ifInErrors;
392 u_int32_t ifInUnknownProtos;
393 u_int64_t ifOutOctets;
394 u_int32_t ifOutUcastPkts;
395 u_int32_t ifOutMulticastPkts;
396 u_int32_t ifOutBroadcastPkts;
397 u_int32_t ifOutDiscards;
398 u_int32_t ifOutErrors;
399 u_int32_t ifPromiscuousMode;
402 /* Ethernet interface counters - see RFC 2358 */
403 typedef struct _SFLEthernet_counters {
404 u_int32_t dot3StatsAlignmentErrors;
405 u_int32_t dot3StatsFCSErrors;
406 u_int32_t dot3StatsSingleCollisionFrames;
407 u_int32_t dot3StatsMultipleCollisionFrames;
408 u_int32_t dot3StatsSQETestErrors;
409 u_int32_t dot3StatsDeferredTransmissions;
410 u_int32_t dot3StatsLateCollisions;
411 u_int32_t dot3StatsExcessiveCollisions;
412 u_int32_t dot3StatsInternalMacTransmitErrors;
413 u_int32_t dot3StatsCarrierSenseErrors;
414 u_int32_t dot3StatsFrameTooLongs;
415 u_int32_t dot3StatsInternalMacReceiveErrors;
416 u_int32_t dot3StatsSymbolErrors;
417 } SFLEthernet_counters;
419 /* Token ring counters - see RFC 1748 */
421 typedef struct _SFLTokenring_counters {
422 u_int32_t dot5StatsLineErrors;
423 u_int32_t dot5StatsBurstErrors;
424 u_int32_t dot5StatsACErrors;
425 u_int32_t dot5StatsAbortTransErrors;
426 u_int32_t dot5StatsInternalErrors;
427 u_int32_t dot5StatsLostFrameErrors;
428 u_int32_t dot5StatsReceiveCongestions;
429 u_int32_t dot5StatsFrameCopiedErrors;
430 u_int32_t dot5StatsTokenErrors;
431 u_int32_t dot5StatsSoftErrors;
432 u_int32_t dot5StatsHardErrors;
433 u_int32_t dot5StatsSignalLoss;
434 u_int32_t dot5StatsTransmitBeacons;
435 u_int32_t dot5StatsRecoverys;
436 u_int32_t dot5StatsLobeWires;
437 u_int32_t dot5StatsRemoves;
438 u_int32_t dot5StatsSingles;
439 u_int32_t dot5StatsFreqErrors;
440 } SFLTokenring_counters;
442 /* 100 BaseVG interface counters - see RFC 2020 */
444 typedef struct _SFLVg_counters {
445 u_int32_t dot12InHighPriorityFrames;
446 u_int64_t dot12InHighPriorityOctets;
447 u_int32_t dot12InNormPriorityFrames;
448 u_int64_t dot12InNormPriorityOctets;
449 u_int32_t dot12InIPMErrors;
450 u_int32_t dot12InOversizeFrameErrors;
451 u_int32_t dot12InDataErrors;
452 u_int32_t dot12InNullAddressedFrames;
453 u_int32_t dot12OutHighPriorityFrames;
454 u_int64_t dot12OutHighPriorityOctets;
455 u_int32_t dot12TransitionIntoTrainings;
456 u_int64_t dot12HCInHighPriorityOctets;
457 u_int64_t dot12HCInNormPriorityOctets;
458 u_int64_t dot12HCOutHighPriorityOctets;
461 typedef struct _SFLVlan_counters {
465 u_int32_t multicastPkts;
466 u_int32_t broadcastPkts;
472 enum SFLCounters_type_tag {
473 /* enterprise = 0, format = ... */
474 SFLCOUNTERS_GENERIC = 1,
475 SFLCOUNTERS_ETHERNET = 2,
476 SFLCOUNTERS_TOKENRING = 3,
481 typedef union _SFLCounters_type {
482 SFLIf_counters generic;
483 SFLEthernet_counters ethernet;
484 SFLTokenring_counters tokenring;
486 SFLVlan_counters vlan;
489 typedef struct _SFLCounters_sample_element {
490 struct _SFLCounters_sample_element *nxt; /* linked list */
491 u_int32_t tag; /* SFLCounters_type_tag */
493 SFLCounters_type counterBlock;
494 } SFLCounters_sample_element;
496 typedef struct _SFLCounters_sample {
497 /* u_int32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 2 */
498 /* u_int32_t length; */
499 u_int32_t sequence_number; /* Incremented with each counters sample
500 generated by this source_id */
501 u_int32_t source_id; /* fsSourceId */
502 u_int32_t num_elements;
503 SFLCounters_sample_element *elements;
504 } SFLCounters_sample;
506 /* same thing, but the expanded version, so ds_index can be a full 32 bits */
507 typedef struct _SFLCounters_sample_expanded {
508 /* u_int32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 2 */
509 /* u_int32_t length; */
510 u_int32_t sequence_number; /* Incremented with each counters sample
511 generated by this source_id */
512 u_int32_t ds_class; /* EXPANDED */
513 u_int32_t ds_index; /* EXPANDED */
514 u_int32_t num_elements;
515 SFLCounters_sample_element *elements;
516 } SFLCounters_sample_expanded;
518 #define SFLADD_ELEMENT(_sm, _el) do { (_el)->nxt = (_sm)->elements; (_sm)->elements = (_el); } while(0)
520 /* Format of a sample datagram */
522 enum SFLDatagram_version {
523 SFLDATAGRAM_VERSION2 = 2,
524 SFLDATAGRAM_VERSION4 = 4,
525 SFLDATAGRAM_VERSION5 = 5
528 typedef struct _SFLSample_datagram_hdr {
529 u_int32_t datagram_version; /* (enum SFLDatagram_version) = VERSION5 = 5 */
530 SFLAddress agent_address; /* IP address of sampling agent */
531 u_int32_t sub_agent_id; /* Used to distinguishing between datagram
532 streams from separate agent sub entities
534 u_int32_t sequence_number; /* Incremented with each sample datagram
536 u_int32_t uptime; /* Current time (in milliseconds since device
537 last booted). Should be set as close to
538 datagram transmission time as possible.*/
539 u_int32_t num_records; /* Number of tag-len-val flow/counter records to follow */
540 } SFLSample_datagram_hdr;
542 #define SFL_MAX_DATAGRAM_SIZE 1500
543 #define SFL_MIN_DATAGRAM_SIZE 200
544 #define SFL_DEFAULT_DATAGRAM_SIZE 1400
546 #define SFL_DATA_PAD 400