1 /* Copyright (c) 2002-2009 InMon Corp. Licensed under the terms of either the
2 * Sun Industry Standards Source License 1.1, that is available at:
3 * http://host-sflow.sourceforge.net/sissl.html
4 * or the InMon sFlow License, that is available at:
5 * http://www.inmon.com/technology/sflowlicense.txt
11 enum SFLAddress_type {
12 SFLADDRESSTYPE_IP_V4 = 1,
13 SFLADDRESSTYPE_IP_V6 = 2
24 typedef union _SFLAddress_value {
29 typedef struct _SFLAddress {
30 u_int32_t type; /* enum SFLAddress_type */
31 SFLAddress_value address;
34 /* Packet header data */
36 #define SFL_DEFAULT_HEADER_SIZE 128
37 #define SFL_DEFAULT_COLLECTOR_PORT 6343
38 #define SFL_DEFAULT_SAMPLING_RATE 400
39 #define SFL_DEFAULT_POLLING_INTERVAL 30
41 /* The header protocol describes the format of the sampled header */
42 enum SFLHeader_protocol {
43 SFLHEADER_ETHERNET_ISO8023 = 1,
44 SFLHEADER_ISO88024_TOKENBUS = 2,
45 SFLHEADER_ISO88025_TOKENRING = 3,
47 SFLHEADER_FRAME_RELAY = 5,
52 SFLHEADER_AAL5_IP = 10, /* e.g. Cisco AAL5 mux */
58 /* raw sampled header */
60 typedef struct _SFLSampled_header {
61 u_int32_t header_protocol; /* (enum SFLHeader_protocol) */
62 u_int32_t frame_length; /* Original length of packet before sampling */
63 u_int32_t stripped; /* header/trailer bytes stripped by sender */
64 u_int32_t header_length; /* length of sampled header bytes to follow */
65 u_int8_t *header_bytes; /* Header bytes */
68 /* decoded ethernet header */
70 typedef struct _SFLSampled_ethernet {
71 u_int32_t eth_len; /* The length of the MAC packet excluding
72 lower layer encapsulations */
73 u_int8_t src_mac[8]; /* 6 bytes + 2 pad */
76 } SFLSampled_ethernet;
78 /* decoded IP version 4 header */
80 typedef struct _SFLSampled_ipv4 {
81 u_int32_t length; /* The length of the IP packet
82 excluding lower layer encapsulations */
83 u_int32_t protocol; /* IP Protocol type (for example, TCP = 6, UDP = 17) */
84 SFLIPv4 src_ip; /* Source IP Address */
85 SFLIPv4 dst_ip; /* Destination IP Address */
86 u_int32_t src_port; /* TCP/UDP source port number or equivalent */
87 u_int32_t dst_port; /* TCP/UDP destination port number or equivalent */
88 u_int32_t tcp_flags; /* TCP flags */
89 u_int32_t tos; /* IP type of service */
92 /* decoded IP version 6 data */
94 typedef struct _SFLSampled_ipv6 {
95 u_int32_t length; /* The length of the IP packet
96 excluding lower layer encapsulations */
97 u_int32_t protocol; /* IP Protocol type (for example, TCP = 6, UDP = 17) */
98 SFLIPv6 src_ip; /* Source IP Address */
99 SFLIPv6 dst_ip; /* Destination IP Address */
100 u_int32_t src_port; /* TCP/UDP source port number or equivalent */
101 u_int32_t dst_port; /* TCP/UDP destination port number or equivalent */
102 u_int32_t tcp_flags; /* TCP flags */
103 u_int32_t priority; /* IP priority */
106 /* Extended data types */
108 /* Extended switch data */
110 typedef struct _SFLExtended_switch {
111 u_int32_t src_vlan; /* The 802.1Q VLAN id of incomming frame */
112 u_int32_t src_priority; /* The 802.1p priority */
113 u_int32_t dst_vlan; /* The 802.1Q VLAN id of outgoing frame */
114 u_int32_t dst_priority; /* The 802.1p priority */
115 } SFLExtended_switch;
117 /* Extended router data */
119 typedef struct _SFLExtended_router {
120 SFLAddress nexthop; /* IP address of next hop router */
121 u_int32_t src_mask; /* Source address prefix mask bits */
122 u_int32_t dst_mask; /* Destination address prefix mask bits */
123 } SFLExtended_router;
125 /* Extended gateway data */
126 enum SFLExtended_as_path_segment_type {
127 SFLEXTENDED_AS_SET = 1, /* Unordered set of ASs */
128 SFLEXTENDED_AS_SEQUENCE = 2 /* Ordered sequence of ASs */
131 typedef struct _SFLExtended_as_path_segment {
132 u_int32_t type; /* enum SFLExtended_as_path_segment_type */
133 u_int32_t length; /* number of AS numbers in set/sequence */
138 } SFLExtended_as_path_segment;
140 typedef struct _SFLExtended_gateway {
141 SFLAddress nexthop; /* Address of the border router that should
142 be used for the destination network */
143 u_int32_t as; /* AS number for this gateway */
144 u_int32_t src_as; /* AS number of source (origin) */
145 u_int32_t src_peer_as; /* AS number of source peer */
146 u_int32_t dst_as_path_segments; /* number of segments in path */
147 SFLExtended_as_path_segment *dst_as_path; /* list of seqs or sets */
148 u_int32_t communities_length; /* number of communities */
149 u_int32_t *communities; /* set of communities */
150 u_int32_t localpref; /* LocalPref associated with this route */
151 } SFLExtended_gateway;
153 typedef struct _SFLString {
158 /* Extended user data */
160 typedef struct _SFLExtended_user {
161 u_int32_t src_charset; /* MIBEnum value of character set used to encode a string - See RFC 2978
162 Where possible UTF-8 encoding (MIBEnum=106) should be used. A value
163 of zero indicates an unknown encoding. */
165 u_int32_t dst_charset;
169 /* Extended URL data */
171 enum SFLExtended_url_direction {
172 SFLEXTENDED_URL_SRC = 1, /* URL is associated with source address */
173 SFLEXTENDED_URL_DST = 2 /* URL is associated with destination address */
176 typedef struct _SFLExtended_url {
177 u_int32_t direction; /* enum SFLExtended_url_direction */
178 SFLString url; /* URL associated with the packet flow.
179 Must be URL encoded */
180 SFLString host; /* The host field from the HTTP header */
183 /* Extended MPLS data */
185 typedef struct _SFLLabelStack {
187 u_int32_t *stack; /* first entry is top of stack - see RFC 3032 for encoding */
190 typedef struct _SFLExtended_mpls {
191 SFLAddress nextHop; /* Address of the next hop */
192 SFLLabelStack in_stack;
193 SFLLabelStack out_stack;
197 Packet header records report addresses as seen at the sFlowDataSource.
198 The extended_nat structure reports on translated source and/or destination
199 addesses for this packet. If an address was not translated it should
200 be equal to that reported for the header. */
202 typedef struct _SFLExtended_nat {
203 SFLAddress src; /* Source address */
204 SFLAddress dst; /* Destination address */
207 /* additional Extended MPLS stucts */
209 typedef struct _SFLExtended_mpls_tunnel {
210 SFLString tunnel_lsp_name; /* Tunnel name */
211 u_int32_t tunnel_id; /* Tunnel ID */
212 u_int32_t tunnel_cos; /* Tunnel COS value */
213 } SFLExtended_mpls_tunnel;
215 typedef struct _SFLExtended_mpls_vc {
216 SFLString vc_instance_name; /* VC instance name */
217 u_int32_t vll_vc_id; /* VLL/VC instance ID */
218 u_int32_t vc_label_cos; /* VC Label COS value */
219 } SFLExtended_mpls_vc;
222 - Definitions from MPLS-FTN-STD-MIB mplsFTNTable */
224 typedef struct _SFLExtended_mpls_FTN {
225 SFLString mplsFTNDescr;
226 u_int32_t mplsFTNMask;
227 } SFLExtended_mpls_FTN;
229 /* Extended MPLS LVP FEC
230 - Definition from MPLS-LDP-STD-MIB mplsFecTable
231 Note: mplsFecAddrType, mplsFecAddr information available
232 from packet header */
234 typedef struct _SFLExtended_mpls_LDP_FEC {
235 u_int32_t mplsFecAddrPrefixLength;
236 } SFLExtended_mpls_LDP_FEC;
238 /* Extended VLAN tunnel information
239 Record outer VLAN encapsulations that have
240 been stripped. extended_vlantunnel information
241 should only be reported if all the following conditions are satisfied:
242 1. The packet has nested vlan tags, AND
243 2. The reporting device is VLAN aware, AND
244 3. One or more VLAN tags have been stripped, either
245 because they represent proprietary encapsulations, or
246 because switch hardware automatically strips the outer VLAN
248 Reporting extended_vlantunnel information is not a substitute for
249 reporting extended_switch information. extended_switch data must
250 always be reported to describe the ingress/egress VLAN information
251 for the packet. The extended_vlantunnel information only applies to
252 nested VLAN tags, and then only when one or more tags has been
255 typedef SFLLabelStack SFLVlanStack;
256 typedef struct _SFLExtended_vlan_tunnel {
257 SFLVlanStack stack; /* List of stripped 802.1Q TPID/TCI layers. Each
258 TPID,TCI pair is represented as a single 32 bit
259 integer. Layers listed from outermost to
261 } SFLExtended_vlan_tunnel;
263 enum SFLFlow_type_tag {
264 /* enterprise = 0, format = ... */
265 SFLFLOW_HEADER = 1, /* Packet headers are sampled */
266 SFLFLOW_ETHERNET = 2, /* MAC layer information */
267 SFLFLOW_IPV4 = 3, /* IP version 4 data */
268 SFLFLOW_IPV6 = 4, /* IP version 6 data */
269 SFLFLOW_EX_SWITCH = 1001, /* Extended switch information */
270 SFLFLOW_EX_ROUTER = 1002, /* Extended router information */
271 SFLFLOW_EX_GATEWAY = 1003, /* Extended gateway router information */
272 SFLFLOW_EX_USER = 1004, /* Extended TACAS/RADIUS user information */
273 SFLFLOW_EX_URL = 1005, /* Extended URL information */
274 SFLFLOW_EX_MPLS = 1006, /* Extended MPLS information */
275 SFLFLOW_EX_NAT = 1007, /* Extended NAT information */
276 SFLFLOW_EX_MPLS_TUNNEL = 1008, /* additional MPLS information */
277 SFLFLOW_EX_MPLS_VC = 1009,
278 SFLFLOW_EX_MPLS_FTN = 1010,
279 SFLFLOW_EX_MPLS_LDP_FEC = 1011,
280 SFLFLOW_EX_VLAN_TUNNEL = 1012, /* VLAN stack */
283 typedef union _SFLFlow_type {
284 SFLSampled_header header;
285 SFLSampled_ethernet ethernet;
286 SFLSampled_ipv4 ipv4;
287 SFLSampled_ipv6 ipv6;
288 SFLExtended_switch sw;
289 SFLExtended_router router;
290 SFLExtended_gateway gateway;
291 SFLExtended_user user;
293 SFLExtended_mpls mpls;
295 SFLExtended_mpls_tunnel mpls_tunnel;
296 SFLExtended_mpls_vc mpls_vc;
297 SFLExtended_mpls_FTN mpls_ftn;
298 SFLExtended_mpls_LDP_FEC mpls_ldp_fec;
299 SFLExtended_vlan_tunnel vlan_tunnel;
302 typedef struct _SFLFlow_sample_element {
303 struct _SFLFlow_sample_element *nxt;
304 u_int32_t tag; /* SFLFlow_type_tag */
306 SFLFlow_type flowType;
307 } SFLFlow_sample_element;
309 enum SFL_sample_tag {
310 SFLFLOW_SAMPLE = 1, /* enterprise = 0 : format = 1 */
311 SFLCOUNTERS_SAMPLE = 2, /* enterprise = 0 : format = 2 */
312 SFLFLOW_SAMPLE_EXPANDED = 3, /* enterprise = 0 : format = 3 */
313 SFLCOUNTERS_SAMPLE_EXPANDED = 4 /* enterprise = 0 : format = 4 */
316 /* Format of a single flow sample */
318 typedef struct _SFLFlow_sample {
319 /* u_int32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 1 */
320 /* u_int32_t length; */
321 u_int32_t sequence_number; /* Incremented with each flow sample
323 u_int32_t source_id; /* fsSourceId */
324 u_int32_t sampling_rate; /* fsPacketSamplingRate */
325 u_int32_t sample_pool; /* Total number of packets that could have been
326 sampled (i.e. packets skipped by sampling
327 process + total number of samples) */
328 u_int32_t drops; /* Number of times a packet was dropped due to
330 u_int32_t input; /* SNMP ifIndex of input interface.
331 0 if interface is not known. */
332 u_int32_t output; /* SNMP ifIndex of output interface,
333 0 if interface is not known.
334 Set most significant bit to indicate
335 multiple destination interfaces
336 (i.e. in case of broadcast or multicast)
337 and set lower order bits to indicate
338 number of destination interfaces.
340 0x00000002 indicates ifIndex = 2
341 0x00000000 ifIndex unknown.
342 0x80000007 indicates a packet sent
344 0x80000000 indicates a packet sent to
346 interfaces greater than 1.*/
347 u_int32_t num_elements;
348 SFLFlow_sample_element *elements;
351 /* same thing, but the expanded version (for full 32-bit ifIndex numbers) */
353 typedef struct _SFLFlow_sample_expanded {
354 /* u_int32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 1 */
355 /* u_int32_t length; */
356 u_int32_t sequence_number; /* Incremented with each flow sample
358 u_int32_t ds_class; /* EXPANDED */
359 u_int32_t ds_index; /* EXPANDED */
360 u_int32_t sampling_rate; /* fsPacketSamplingRate */
361 u_int32_t sample_pool; /* Total number of packets that could have been
362 sampled (i.e. packets skipped by sampling
363 process + total number of samples) */
364 u_int32_t drops; /* Number of times a packet was dropped due to
366 u_int32_t inputFormat; /* EXPANDED */
367 u_int32_t input; /* SNMP ifIndex of input interface.
368 0 if interface is not known. */
369 u_int32_t outputFormat; /* EXPANDED */
370 u_int32_t output; /* SNMP ifIndex of output interface,
371 0 if interface is not known. */
372 u_int32_t num_elements;
373 SFLFlow_sample_element *elements;
374 } SFLFlow_sample_expanded;
378 /* Generic interface counters - see RFC 1573, 2233 */
380 typedef struct _SFLIf_counters {
384 u_int32_t ifDirection; /* Derived from MAU MIB (RFC 2668)
385 0 = unknown, 1 = full-duplex,
386 2 = half-duplex, 3 = in, 4 = out */
387 u_int32_t ifStatus; /* bit field with the following bits assigned:
388 bit 0 = ifAdminStatus (0 = down, 1 = up)
389 bit 1 = ifOperStatus (0 = down, 1 = up) */
390 u_int64_t ifInOctets;
391 u_int32_t ifInUcastPkts;
392 u_int32_t ifInMulticastPkts;
393 u_int32_t ifInBroadcastPkts;
394 u_int32_t ifInDiscards;
395 u_int32_t ifInErrors;
396 u_int32_t ifInUnknownProtos;
397 u_int64_t ifOutOctets;
398 u_int32_t ifOutUcastPkts;
399 u_int32_t ifOutMulticastPkts;
400 u_int32_t ifOutBroadcastPkts;
401 u_int32_t ifOutDiscards;
402 u_int32_t ifOutErrors;
403 u_int32_t ifPromiscuousMode;
406 /* Ethernet interface counters - see RFC 2358 */
407 typedef struct _SFLEthernet_counters {
408 u_int32_t dot3StatsAlignmentErrors;
409 u_int32_t dot3StatsFCSErrors;
410 u_int32_t dot3StatsSingleCollisionFrames;
411 u_int32_t dot3StatsMultipleCollisionFrames;
412 u_int32_t dot3StatsSQETestErrors;
413 u_int32_t dot3StatsDeferredTransmissions;
414 u_int32_t dot3StatsLateCollisions;
415 u_int32_t dot3StatsExcessiveCollisions;
416 u_int32_t dot3StatsInternalMacTransmitErrors;
417 u_int32_t dot3StatsCarrierSenseErrors;
418 u_int32_t dot3StatsFrameTooLongs;
419 u_int32_t dot3StatsInternalMacReceiveErrors;
420 u_int32_t dot3StatsSymbolErrors;
421 } SFLEthernet_counters;
423 /* Token ring counters - see RFC 1748 */
425 typedef struct _SFLTokenring_counters {
426 u_int32_t dot5StatsLineErrors;
427 u_int32_t dot5StatsBurstErrors;
428 u_int32_t dot5StatsACErrors;
429 u_int32_t dot5StatsAbortTransErrors;
430 u_int32_t dot5StatsInternalErrors;
431 u_int32_t dot5StatsLostFrameErrors;
432 u_int32_t dot5StatsReceiveCongestions;
433 u_int32_t dot5StatsFrameCopiedErrors;
434 u_int32_t dot5StatsTokenErrors;
435 u_int32_t dot5StatsSoftErrors;
436 u_int32_t dot5StatsHardErrors;
437 u_int32_t dot5StatsSignalLoss;
438 u_int32_t dot5StatsTransmitBeacons;
439 u_int32_t dot5StatsRecoverys;
440 u_int32_t dot5StatsLobeWires;
441 u_int32_t dot5StatsRemoves;
442 u_int32_t dot5StatsSingles;
443 u_int32_t dot5StatsFreqErrors;
444 } SFLTokenring_counters;
446 /* 100 BaseVG interface counters - see RFC 2020 */
448 typedef struct _SFLVg_counters {
449 u_int32_t dot12InHighPriorityFrames;
450 u_int64_t dot12InHighPriorityOctets;
451 u_int32_t dot12InNormPriorityFrames;
452 u_int64_t dot12InNormPriorityOctets;
453 u_int32_t dot12InIPMErrors;
454 u_int32_t dot12InOversizeFrameErrors;
455 u_int32_t dot12InDataErrors;
456 u_int32_t dot12InNullAddressedFrames;
457 u_int32_t dot12OutHighPriorityFrames;
458 u_int64_t dot12OutHighPriorityOctets;
459 u_int32_t dot12TransitionIntoTrainings;
460 u_int64_t dot12HCInHighPriorityOctets;
461 u_int64_t dot12HCInNormPriorityOctets;
462 u_int64_t dot12HCOutHighPriorityOctets;
465 typedef struct _SFLVlan_counters {
469 u_int32_t multicastPkts;
470 u_int32_t broadcastPkts;
476 enum SFLCounters_type_tag {
477 /* enterprise = 0, format = ... */
478 SFLCOUNTERS_GENERIC = 1,
479 SFLCOUNTERS_ETHERNET = 2,
480 SFLCOUNTERS_TOKENRING = 3,
485 typedef union _SFLCounters_type {
486 SFLIf_counters generic;
487 SFLEthernet_counters ethernet;
488 SFLTokenring_counters tokenring;
490 SFLVlan_counters vlan;
493 typedef struct _SFLCounters_sample_element {
494 struct _SFLCounters_sample_element *nxt; /* linked list */
495 u_int32_t tag; /* SFLCounters_type_tag */
497 SFLCounters_type counterBlock;
498 } SFLCounters_sample_element;
500 typedef struct _SFLCounters_sample {
501 /* u_int32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 2 */
502 /* u_int32_t length; */
503 u_int32_t sequence_number; /* Incremented with each counters sample
504 generated by this source_id */
505 u_int32_t source_id; /* fsSourceId */
506 u_int32_t num_elements;
507 SFLCounters_sample_element *elements;
508 } SFLCounters_sample;
510 /* same thing, but the expanded version, so ds_index can be a full 32 bits */
511 typedef struct _SFLCounters_sample_expanded {
512 /* u_int32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 2 */
513 /* u_int32_t length; */
514 u_int32_t sequence_number; /* Incremented with each counters sample
515 generated by this source_id */
516 u_int32_t ds_class; /* EXPANDED */
517 u_int32_t ds_index; /* EXPANDED */
518 u_int32_t num_elements;
519 SFLCounters_sample_element *elements;
520 } SFLCounters_sample_expanded;
522 #define SFLADD_ELEMENT(_sm, _el) do { (_el)->nxt = (_sm)->elements; (_sm)->elements = (_el); } while(0)
524 /* Format of a sample datagram */
526 enum SFLDatagram_version {
527 SFLDATAGRAM_VERSION2 = 2,
528 SFLDATAGRAM_VERSION4 = 4,
529 SFLDATAGRAM_VERSION5 = 5
532 typedef struct _SFLSample_datagram_hdr {
533 u_int32_t datagram_version; /* (enum SFLDatagram_version) = VERSION5 = 5 */
534 SFLAddress agent_address; /* IP address of sampling agent */
535 u_int32_t sub_agent_id; /* Used to distinguishing between datagram
536 streams from separate agent sub entities
538 u_int32_t sequence_number; /* Incremented with each sample datagram
540 u_int32_t uptime; /* Current time (in milliseconds since device
541 last booted). Should be set as close to
542 datagram transmission time as possible.*/
543 u_int32_t num_records; /* Number of tag-len-val flow/counter records to follow */
544 } SFLSample_datagram_hdr;
546 #define SFL_MAX_DATAGRAM_SIZE 1500
547 #define SFL_MIN_DATAGRAM_SIZE 200
548 #define SFL_DEFAULT_DATAGRAM_SIZE 1400
550 #define SFL_DATA_PAD 400