Documentation
¶
Overview ¶
Package netflow9 decodes netflow version v9 packets
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Data ¶
type Data struct {
Template TemplateRecord
Timestamp int64
}
Data represents template records and updated timestamp
type DecodedField ¶
type DecodedField struct {
ID uint16
Value interface{}
}
DecodedField represents a decoded field
type Decoder ¶
type Decoder struct {
// contains filtered or unexported fields
}
Decoder represents Netflow payload and remote address
type MemCache ¶
type MemCache []*TemplatesShard
MemCache represents templates shards
type Message ¶
type Message struct {
AgentID string
Header PacketHeader
DataSets [][]DecodedField
}
Message represents Netflow decoded data
type PacketHeader ¶
type PacketHeader struct {
Version uint16 // Version of Flow Record format exported in this packet
Count uint16 // The total number of records in the Export Packet
SysUpTime uint32 // Time in milliseconds since this device was first booted
UNIXSecs uint32 // Time in seconds since 0000 UTC 197
SeqNum uint32 // Incremental sequence counter of all Export Packets
SrcID uint32 // A 32-bit value that identifies the Exporter
}
PacketHeader represents Netflow v9 packet header
type SetHeader ¶
type SetHeader struct {
FlowSetID uint16 // FlowSet ID value 0:: template, 1:: options template, 255< :: data
Length uint16 // Total length of this FlowSet
}
SetHeader represents netflow v9 data flowset id and length
type TemplateFieldSpecifier ¶
TemplateFieldSpecifier represents field properties
type TemplateHeader ¶
type TemplateHeader struct {
TemplateID uint16 // Template ID
FieldCount uint16 // Number of fields in this Template Record
OptionLen uint16 // The length in bytes of any Scope field definition (Option)
OptionScopeLen uint16 // The length in bytes of any options field definitions (Option)
}
TemplateHeader represents netflow v9 data template id and field count
type TemplateRecord ¶
type TemplateRecord struct {
TemplateID uint16
FieldCount uint16
FieldSpecifiers []TemplateFieldSpecifier
ScopeFieldCount uint16
ScopeFieldSpecifiers []TemplateFieldSpecifier
}
TemplateRecord represents template fields
Click to show internal directories.
Click to hide internal directories.