netbrane

type CaptureRecordUnion struct {
	// Rough timestamp for indexing or filtering of data. May be
	// augmented internally.  In UTC since epoch.
	TimestampSeconds     int64                         `protobuf:"varint,1,opt,name=timestamp_seconds,json=timestampSeconds,proto3" json:"timestamp_seconds,omitempty"`
	RecordType           CaptureRecordUnion_RecordType `` /* 136-byte string literal not displayed */
	CaptureSpec          *common.CaptureSpec           `protobuf:"bytes,3,opt,name=capture_spec,json=captureSpec,proto3" json:"capture_spec,omitempty"`
	FlowRecord           *FlowRecord                   `protobuf:"bytes,4,opt,name=flow_record,json=flowRecord,proto3" json:"flow_record,omitempty"`
	BgpUpdateRecord      *bgp.BGPUpdate                `protobuf:"bytes,5,opt,name=bgp_update_record,json=bgpUpdateRecord,proto3" json:"bgp_update_record,omitempty"`
	DnsRecord            *DNSRecord                    `protobuf:"bytes,6,opt,name=dns_record,json=dnsRecord,proto3" json:"dns_record,omitempty"`
	ProbeRecord          *proddle.Probe                `protobuf:"bytes,7,opt,name=probe_record,json=probeRecord,proto3" json:"probe_record,omitempty"`
	ProbeResultRecord    *proddle.ProbeResult          `protobuf:"bytes,8,opt,name=probe_result_record,json=probeResultRecord,proto3" json:"probe_result_record,omitempty"`
	XXX_NoUnkeyedLiteral struct{}                      `json:"-"`
	XXX_unrecognized     []byte                        `json:"-"`
	XXX_sizecache        int32                         `json:"-"`
}

type CaptureRecordUnion_RecordType int32

type DNSRecord struct {
	RequestingHost *common.IPAddressWrapper `protobuf:"bytes,1,opt,name=requesting_host,json=requestingHost,proto3" json:"requesting_host,omitempty"`
	DnsServer      *common.IPAddressWrapper `protobuf:"bytes,2,opt,name=dns_server,json=dnsServer,proto3" json:"dns_server,omitempty"`
	// The replies
	Ips   []*common.IPAddressWrapper `protobuf:"bytes,3,rep,name=ips,proto3" json:"ips,omitempty"`
	Cname []string                   `protobuf:"bytes,4,rep,name=cname,proto3" json:"cname,omitempty"`
	// The original question
	Query string `protobuf:"bytes,5,opt,name=query,proto3" json:"query,omitempty"`
	// Is the reply in DNSSec form
	Dnssec               bool     `protobuf:"varint,6,opt,name=dnssec,proto3" json:"dnssec,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type FlowRecord struct {
	// which capture was responsible for this record.
	CaptureSpecId int32 `protobuf:"varint,1,opt,name=capture_spec_id,json=captureSpecId,proto3" json:"capture_spec_id,omitempty"`
	// seconds since epoch : deprecated use top-level instead
	TimestampSeconds int64 `protobuf:"varint,2,opt,name=timestamp_seconds,json=timestampSeconds,proto3" json:"timestamp_seconds,omitempty"`
	// really required
	TimestampNs uint32 `protobuf:"varint,3,opt,name=timestamp_ns,json=timestampNs,proto3" json:"timestamp_ns,omitempty"`
	// if duration is not set then the flow-record is incomplete, i.e.,
	// the flow was started but hasn't terminated. If the record is
	// an aggregate count of many individual records then we set
	// bucket_duration_us instead of this value.
	// The field is also unset if this is a single packet.
	DurationUs int64              `protobuf:"varint,4,opt,name=duration_us,json=durationUs,proto3" json:"duration_us,omitempty"`
	L2Proto    FlowRecord_L2Proto `protobuf:"varint,5,opt,name=l2_proto,json=l2Proto,proto3,enum=netbrane.FlowRecord_L2Proto" json:"l2_proto,omitempty"`
	// L3 protocol is recorded as ETHERTYPE
	L3Proto     int32   `protobuf:"varint,6,opt,name=l3_proto,json=l3Proto,proto3" json:"l3_proto,omitempty"`
	L4Proto     int32   `protobuf:"varint,7,opt,name=l4_proto,json=l4Proto,proto3" json:"l4_proto,omitempty"`
	Source      *IPFlow `protobuf:"bytes,8,opt,name=source,proto3" json:"source,omitempty"`
	Destination *IPFlow `protobuf:"bytes,9,opt,name=destination,proto3" json:"destination,omitempty"`
	// The number of individual flow records that have
	// been rolled up into this entry.
	NumberOfAggregatedFlows int64 `` /* 136-byte string literal not displayed */
	// If we roll up many individual flows into one single bucket
	// then we need to state the duration of our bucket.
	BucketDurationUs     int64    `protobuf:"varint,11,opt,name=bucket_duration_us,json=bucketDurationUs,proto3" json:"bucket_duration_us,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type FlowRecord_L2Proto int32

type IPFlow struct {
	// really required
	Address *common.IPAddressWrapper `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
	// we may aggregate flows for an entire subnet if we
	// get too fine-grained with individual flow records.
	Mask  *common.IPAddressWrapper `protobuf:"bytes,2,opt,name=mask,proto3" json:"mask,omitempty"`
	Port  int32                    `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"`
	Tos   int32                    `protobuf:"varint,4,opt,name=tos,proto3" json:"tos,omitempty"`
	Ttl   int32                    `protobuf:"varint,5,opt,name=ttl,proto3" json:"ttl,omitempty"`
	Bytes int64                    `protobuf:"varint,6,opt,name=bytes,proto3" json:"bytes,omitempty"`
	// Some sniffers may be able to parse the number of acutal payload bytes
	ApplicationBytes int64   `protobuf:"varint,7,opt,name=application_bytes,json=applicationBytes,proto3" json:"application_bytes,omitempty"`
	Packets          int64   `protobuf:"varint,8,opt,name=packets,proto3" json:"packets,omitempty"`
	Loss             float32 `protobuf:"fixed32,9,opt,name=loss,proto3" json:"loss,omitempty"`
	// ---------- ICMP ----------
	Type            int32 `protobuf:"varint,10,opt,name=type,proto3" json:"type,omitempty"`
	Code            int32 `protobuf:"varint,11,opt,name=code,proto3" json:"code,omitempty"`
	Id              int32 `protobuf:"varint,12,opt,name=id,proto3" json:"id,omitempty"`
	Retransmissions int64 `protobuf:"varint,13,opt,name=retransmissions,proto3" json:"retransmissions,omitempty"`
	// The vlan_id of the packet, empty if no vlan header.
	VlanId int32 `protobuf:"varint,14,opt,name=vlan_id,json=vlanId,proto3" json:"vlan_id,omitempty"`
	// The L2 source addresses on which we observed this flow
	SourceMac [][]byte `protobuf:"bytes,15,rep,name=source_mac,json=sourceMac,proto3" json:"source_mac,omitempty"`
	// The L2 destination addresses that were affixed to this flow
	DestinationMac [][]byte `protobuf:"bytes,16,rep,name=destination_mac,json=destinationMac,proto3" json:"destination_mac,omitempty"`
	// The physical port id(s) on which we received/sent this flow.
	PhysicalPortNumber []int32 `` /* 126-byte string literal not displayed */
	// If the intercepted packet is a gre packet, place the key here.
	GreKey uint32 `protobuf:"varint,18,opt,name=gre_key,json=greKey,proto3" json:"gre_key,omitempty"`
	// If we are looking at a tunneled protocol store the inner flow information
	// here. Note, this is typically the really interesting address.
	InnerAddress *common.IPAddressWrapper `protobuf:"bytes,19,opt,name=inner_address,json=innerAddress,proto3" json:"inner_address,omitempty"`
	InnerPort    *common.IPAddressWrapper `protobuf:"bytes,20,opt,name=inner_port,json=innerPort,proto3" json:"inner_port,omitempty"`
	// as in IPPROTO_*
	InnerProtocol *common.IPAddressWrapper `protobuf:"bytes,21,opt,name=inner_protocol,json=innerProtocol,proto3" json:"inner_protocol,omitempty"`
	// We may get richer flow information, e.g., decorated with pcap info.
	// We store additional information on a per-packet basis in the
	// sequence of pcap_decoration(s) below
	// Timestamps in these are relative to the timestamp of the record.
	// Decoration is most meaningful if the flow describes something
	// like a single connection. But this is not a requirement. If we
	// get netflow records we don't get the pcap information.
	PacketDecor          []*PacketData `protobuf:"bytes,22,rep,name=packet_decor,json=packetDecor,proto3" json:"packet_decor,omitempty"`
	XXX_NoUnkeyedLiteral struct{}      `json:"-"`
	XXX_unrecognized     []byte        `json:"-"`
	XXX_sizecache        int32         `json:"-"`
}

type PacketData struct {
	NanosSinceFlowStart uint64 `protobuf:"varint,1,opt,name=nanos_since_flow_start,json=nanosSinceFlowStart,proto3" json:"nanos_since_flow_start,omitempty"`
	PacketSize          uint32 `protobuf:"varint,2,opt,name=packet_size,json=packetSize,proto3" json:"packet_size,omitempty"`
	// IP per packet see RFC 791
	IpId uint32 `protobuf:"varint,3,opt,name=ip_id,json=ipId,proto3" json:"ip_id,omitempty"`
	// either more fragments after this or offset != 0
	IsFragment bool `protobuf:"varint,4,opt,name=is_fragment,json=isFragment,proto3" json:"is_fragment,omitempty"`
	// TCP related follows RFC 793
	// This is the window advertisement
	// in bytes.
	WindowSize int32  `protobuf:"varint,5,opt,name=window_size,json=windowSize,proto3" json:"window_size,omitempty"`
	Sequence   uint32 `protobuf:"varint,6,opt,name=sequence,proto3" json:"sequence,omitempty"`
	Ack        uint32 `protobuf:"varint,7,opt,name=ack,proto3" json:"ack,omitempty"`
	Syn        bool   `protobuf:"varint,8,opt,name=syn,proto3" json:"syn,omitempty"`
	Fin        bool   `protobuf:"varint,9,opt,name=fin,proto3" json:"fin,omitempty"`
	Reset_     bool   `protobuf:"varint,10,opt,name=reset,proto3" json:"reset,omitempty"`
	// Do we need more understanding of options ip and otherwise
	OptionsL3            bool     `protobuf:"varint,11,opt,name=options_l3,json=optionsL3,proto3" json:"options_l3,omitempty"`
	OptionsL4            bool     `protobuf:"varint,12,opt,name=options_l4,json=optionsL4,proto3" json:"options_l4,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}