sflow

package module
v0.0.0-...-cbacc16 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 20, 2017 License: BSD-3-Clause Imports: 6 Imported by: 0

README

SFlow Travis GoDoc Coverage Status

Info

Parsing sFlow for packetbeat plug-ins

This is struct to decode sflow 5 layers and datagram info together
Fork on part of gopacket's sFlow data structure

Sample

Only decoder five layers of sflow sample

SFlowRawPacketFlowRecord
SFlowExtendedSwitchFlowRecord
SFlowExtendedRouterFlowRecord
SFlowExtendedGatewayFlowRecord
SFlowExtendedUserFlow

Counter

decoder all of layers

SFlowGenericInterfaceCounters
SFlowEthernetCounters
SFlowProcessorCounters

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func DecodeSflow 

func DecodeSflow(tuple *Datagram, payload []byte) (*[]FlowSamples, *[]SFlowCounterSample, error)

decode sflow V5 struct contains sample and counter info

Types

type Data 

type Data struct {
	Type            string
	Datagram        Datagram
	DatagramVersion uint32
	AgentAddress    net.IP
	SubAgentID      uint32
	SequenceNumber  uint32
	AgentUptime     uint32
	SampleCount     uint32
}

func NewData 

func NewData() *Data

func (*Data) DecodeDataFromBytes 

func (this *Data) DecodeDataFromBytes(data []byte) error

func (*Data) Init 

func (this *Data) Init(payload []byte) error

func (*Data) InitDatagram 

func (this *Data) InitDatagram(tuple *Datagram) error

type Datagram 

type Datagram struct {
	IPLength         int
	SrcIP, DstIP     net.IP
	SrcPort, DstPort uint16
}

origin datagram info

type FlowSamples 

type FlowSamples struct {
	Data                           *Data
	EnterpriseID                   string
	Format                         string
	SampleLength                   uint32
	SequenceNumber                 uint32
	SourceIDClass                  string
	SourceIDIndex                  string
	SamplingRate                   uint32
	SamplePool                     uint32
	Dropped                        uint32
	InputInterfaceFormat           uint32
	InputInterface                 uint32
	OutputInterfaceFormat          uint32
	OutputInterface                uint32
	RecordCount                    uint32
	SFlowRawPacketFlowRecord       SFlowRawPacketFlowRecord
	SFlowExtendedSwitchFlowRecord  SFlowExtendedSwitchFlowRecord
	SFlowExtendedRouterFlowRecord  SFlowExtendedRouterFlowRecord
	SFlowExtendedGatewayFlowRecord SFlowExtendedGatewayFlowRecord
	SFlowExtendedUserFlow          SFlowExtendedUserFlow
}

func DecodeSample 

func DecodeSample(tuple *Datagram, payload []byte) ([]*FlowSamples, error)

only decode and return sample

func NewFlowSamples 

func NewFlowSamples() *FlowSamples

func (*FlowSamples) InitFlowSampleData 

func (this *FlowSamples) InitFlowSampleData(p layers.SFlowFlowSample) error

func (*FlowSamples) ParseLayers 

func (this *FlowSamples) ParseLayers(p gopacket.Packet) error

func (*FlowSamples) SendUdp 

func (this *FlowSamples) SendUdp(result, CounterHost, Host string, counter bool) error
type Header struct {
	FlowRecords   uint32 //flow流数据量
	Packets       int    //包个数
	Bytes         uint32 //字节大小
	RateBytes     uint32 //自动采样率计算
	SrcMac        string
	DstMac        string
	SrcIP         string
	DstIP         string
	Ipv4_version  uint8
	Ipv4_ihl      uint8
	Ipv4_tos      uint8
	Ipv4_ttl      uint8
	Ipv4_protocol string
	SrcPort       string //如果是icmp的就只把数据写入这个
	DstPort       string
}

flow流详细信息

type SFlowBaseCounterRecord 

type SFlowBaseCounterRecord struct {
	EnterpriseID   string
	Format         string
	FlowDataLength uint32
}

type SFlowBaseFlowRecord 

type SFlowBaseFlowRecord struct {
	EnterpriseID   string
	Format         string
	FlowDataLength uint32
}

SFlowBaseFlowRecord holds the fields common to all records of type SFlowFlowRecordType

type SFlowCounterSample 

type SFlowCounterSample struct {
	Data                          Data
	EnterpriseID                  string
	Format                        string
	SampleLength                  uint32
	SequenceNumber                uint32
	SourceIDClass                 string
	SourceIDIndex                 string
	RecordCount                   uint32
	SFlowGenericInterfaceCounters SFlowGenericInterfaceCounters
	SFlowEthernetCounters         SFlowEthernetCounters
	SFlowProcessorCounters        SFlowProcessorCounters
}

Counter samples report information about various counter objects. Typically these are items like IfInOctets, or CPU / Memory stats, etc. SFlow will report these at regular intervals as configured on the agent. If one were sufficiently industrious, this could be used to replace the typical SNMP polling used for such things.

func NewCounterFlow 

func NewCounterFlow() *SFlowCounterSample

func (*SFlowCounterSample) InitCounterSample 

func (this *SFlowCounterSample) InitCounterSample(p layers.SFlowCounterSample) error

func (*SFlowCounterSample) InitCounterSampleStruct 

func (this *SFlowCounterSample) InitCounterSampleStruct(p *layers.SFlowDatagram) error

func (*SFlowCounterSample) InitDatagram 

func (this *SFlowCounterSample) InitDatagram(tuple *Datagram) error

func (*SFlowCounterSample) InitOriginData 

func (this *SFlowCounterSample) InitOriginData(Payload []byte) error

type SFlowEthernetCounters 

type SFlowEthernetCounters struct {
	SFlowBaseCounterRecord    SFlowBaseCounterRecord
	AlignmentErrors           uint32
	FCSErrors                 uint32
	SingleCollisionFrames     uint32
	MultipleCollisionFrames   uint32
	SQETestErrors             uint32
	DeferredTransmissions     uint32
	LateCollisions            uint32
	ExcessiveCollisions       uint32
	InternalMacTransmitErrors uint32
	CarrierSenseErrors        uint32
	FrameTooLongs             uint32
	InternalMacReceiveErrors  uint32
	SymbolErrors              uint32
}

type SFlowEthernetFrameRecord 

type SFlowEthernetFrameRecord struct {
	//为2代表是Ethernet Frame Data字段
	Format uint32
	//总的字节数（不包含tag和length字段）
	Length uint32
	//源mac地址8字节
	SrcMac []byte
	//目的mac地址8字节
	DstMac []byte
	Type   uint32
}

0 15 31 +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ | Tag | +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ | Length | +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ | Length Bytes | +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ | Src Mac | Dst Mac | +--+--+--+--+--+--+--+--+

type SFlowExtendedGatewayFlowRecord 

type SFlowExtendedGatewayFlowRecord struct {
	SFlowBaseFlowRecord SFlowBaseFlowRecord
	NextHop             net.IP
	AS                  uint32
	SourceAS            uint32
	PeerAS              uint32
	ASPathCount         uint32
	ASPath              []layers.SFlowASDestination
	Communities         []uint32
	LocalPref           uint32
}

type SFlowExtendedRouterFlowRecord 

type SFlowExtendedRouterFlowRecord struct {
	SFlowBaseFlowRecord    SFlowBaseFlowRecord
	NextHop                net.IP
	NextHopSourceMask      uint32
	NextHopDestinationMask uint32
}

SFlowExtendedRouterFlowRecord gives additional information about the layer 3 routing information used to forward the packet

type SFlowExtendedSwitchFlowRecord 

type SFlowExtendedSwitchFlowRecord struct {
	SFlowBaseFlowRecord  SFlowBaseFlowRecord
	IncomingVLAN         uint32
	IncomingVLANPriority uint32
	OutgoingVLAN         uint32
	OutgoingVLANPriority uint32
}

SFlowExtendedSwitchFlowRecord give additional information about the sampled packet if it's available. It's mainly useful for getting at the incoming and outgoing VLANs An agent may or may not provide this information.

type SFlowExtendedUserFlow 

type SFlowExtendedUserFlow struct {
	SFlowBaseFlowRecord SFlowBaseFlowRecord
	SourceCharSet       string
	SourceUserID        string
	DestinationCharSet  string
	DestinationUserID   string
}

type SFlowGenericInterfaceCounters 

type SFlowGenericInterfaceCounters struct {
	SFlowBaseCounterRecord SFlowBaseCounterRecord
	IfIndex                uint32
	IfType                 uint32
	IfSpeed                uint64
	IfDirection            uint32
	IfStatus               uint32
	IfInOctets             uint64
	IfInUcastPkts          uint32
	IfInMulticastPkts      uint32
	IfInBroadcastPkts      uint32
	IfInDiscards           uint32
	IfInErrors             uint32
	IfInUnknownProtos      uint32
	IfOutOctets            uint64
	IfOutUcastPkts         uint32
	IfOutMulticastPkts     uint32
	IfOutBroadcastPkts     uint32
	IfOutDiscards          uint32
	IfOutErrors            uint32
	IfPromiscuousMode      uint32
}

type SFlowProcessorCounters 

type SFlowProcessorCounters struct {
	SFlowBaseCounterRecord SFlowBaseCounterRecord
	FiveSecCpu             uint32 // 5 second average CPU utilization
	OneMinCpu              uint32 // 1 minute average CPU utilization
	FiveMinCpu             uint32 // 5 minute average CPU utilization
	TotalMemory            uint64 // total memory (in bytes)
	FreeMemory             uint64 // free memory (in bytes)
}

type SFlowRawPacketFlowRecord 

type SFlowRawPacketFlowRecord struct {
	SFlowBaseFlowRecord SFlowBaseFlowRecord
	HeaderProtocol      string
	FrameLength         uint32
	PayloadRemoved      uint32
	HeaderLength        uint32
	Header              Header
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.