1 /* Copyright (c) 2008 The Board of Trustees of The Leland Stanford
4 * We are making the OpenFlow specification and associated documentation
5 * (Software) available for public use and benefit with the expectation
6 * that others will use, modify and enhance the Software and contribute
7 * those enhancements back to the community. However, since we would
8 * like to make the Software available for broadest use, with as few
9 * restrictions as possible permission is hereby granted, free of
10 * charge, to any person obtaining a copy of this Software to deal in
11 * the Software under the copyrights without restriction, including
12 * without limitation the rights to use, copy, modify, merge, publish,
13 * distribute, sublicense, and/or sell copies of the Software, and to
14 * permit persons to whom the Software is furnished to do so, subject to
15 * the following conditions:
17 * The above copyright notice and this permission notice shall be
18 * included in all copies or substantial portions of the Software.
20 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
21 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
22 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
23 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
24 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
25 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
26 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
29 * The name and trademarks of copyright holder(s) may NOT be used in
30 * advertising or publicity pertaining to the Software or any
31 * derivatives without specific, written prior permission.
40 #define NETFLOW_V5_VERSION 5
42 /* Every NetFlow v5 message contains the header that follows. This is
43 * followed by up to thirty records that describe a terminating flow.
44 * We only send a single record per NetFlow message.
46 struct netflow_v5_header {
47 uint16_t version; /* NetFlow version is 5. */
48 uint16_t count; /* Number of records in this message. */
49 uint32_t sysuptime; /* System uptime in milliseconds. */
50 uint32_t unix_secs; /* Number of seconds since Unix epoch. */
51 uint32_t unix_nsecs; /* Number of residual nanoseconds
52 after epoch seconds. */
53 uint32_t flow_seq; /* Number of flows since sending
55 uint8_t engine_type; /* Set to zero. */
56 uint8_t engine_id; /* Set to zero. */
57 uint16_t sampling_interval; /* Set to zero. */
59 BUILD_ASSERT_DECL(sizeof(struct netflow_v5_header) == 24);
61 /* A NetFlow v5 description of a terminating flow. It is preceded by a
64 struct netflow_v5_record {
65 uint32_t src_addr; /* Source IP address. */
66 uint32_t dst_addr; /* Destination IP address. */
67 uint32_t nexthop; /* IP address of next hop. Set to 0. */
68 uint16_t input; /* Input interface index. */
69 uint16_t output; /* Output interface index. */
70 uint32_t packet_count; /* Number of packets. */
71 uint32_t byte_count; /* Number of bytes. */
72 uint32_t init_time; /* Value of sysuptime on first packet. */
73 uint32_t used_time; /* Value of sysuptime on last packet. */
75 /* The 'src_port' and 'dst_port' identify the source and destination
76 * port, respectively, for TCP and UDP. For ICMP, the high-order
77 * byte identifies the type and low-order byte identifies the code
78 * in the 'dst_port' field. */
83 uint8_t tcp_flags; /* Union of seen TCP flags. */
84 uint8_t ip_proto; /* IP protocol. */
85 uint8_t ip_tos; /* IP TOS value. */
86 uint16_t src_as; /* Source AS ID. Set to 0. */
87 uint16_t dst_as; /* Destination AS ID. Set to 0. */
88 uint8_t src_mask; /* Source mask bits. Set to 0. */
89 uint8_t dst_mask; /* Destination mask bits. Set to 0. */
92 BUILD_ASSERT_DECL(sizeof(struct netflow_v5_record) == 48);
94 #endif /* netflow.h */