void Connection::convertNtp64(uint64_t ntptime, uint64_t& result)
{
	uint64_t hbnum = ntohll(*(uint64_t*)&ntptime);
	if (hbnum>0) {
		timeval t = timentp64(*((ntp64*)(&hbnum)));
		result = (uint64_t)t.tv_sec*1000+(uint64_t)t.tv_usec/1000;
	} else {
		result = 0;
	}
}
/**
 * Prints a string representation of IpfixRecord::Data to stdout.
 */
void printFieldData(IpfixRecord::FieldInfo::Type type, IpfixRecord::Data* pattern) {
	char* s;
	timeval t;
	uint64_t hbnum;

	switch (type.id) {
	case IPFIX_TYPEID_protocolIdentifier:
		printf("protocolIdentifier: ");
		printProtocol(type, pattern);
		break;
	case IPFIX_TYPEID_sourceIPv4Address:
		printf("sourceIPv4Address: ");
		printIPv4(type, pattern);
		break;
	case IPFIX_TYPEID_destinationIPv4Address:
		printf("destinationIPv4Address: ");
		printIPv4(type, pattern);
		break;
	case IPFIX_TYPEID_sourceTransportPort:
		printf("sourceTransportPort: ");
		printPort(type, pattern);
		break;
	case IPFIX_TYPEID_destinationTransportPort:
		printf("destinationTransportPort: ");
		printPort(type, pattern);
		break;
	case IPFIX_TYPEID_flowStartNanoSeconds:
	case IPFIX_TYPEID_flowEndNanoSeconds:
	case IPFIX_ETYPEID_revFlowStartNanoSeconds:
	case IPFIX_ETYPEID_revFlowEndNanoSeconds:
		printf("%s: ", typeid2string(type.id));
		hbnum = ntohll(*(uint64_t*)pattern);
		if (hbnum>0) {
			t = timentp64(*((ntp64*)(&hbnum)));
			printf("%d.%06d seconds", (int32_t)t.tv_sec, (int32_t)t.tv_usec);
		} else {
			printf("no value (only zeroes in field)");
		}
		break;
	case IPFIX_ETYPEID_frontPayload:
	case IPFIX_ETYPEID_revFrontPayload:
		printf("%s: ", typeid2string(type.id));
		printFrontPayload(type, pattern);
		break;
	default:
		s = typeid2string(type.id);
		if (s != NULL) {
			printf("%s: ", s);
			printUint(type, pattern);
		} else {
			DPRINTF("Field with ID %d unparseable\n", type.id);
		}
		break;
	}
}
/**
 * prints a datarecord in a special, easy-to-read data format in one line
 */
void IpfixPrinter::printOneLineRecord(IpfixDataRecord* record)
{
	boost::shared_ptr<IpfixRecord::DataTemplateInfo> dataTemplateInfo = record->templateInfo;
		char buf[100], buf2[100];

		if (linesPrinted==0 || linesPrinted>50) {
			printf("%22s %20s %8s %5s %21s %21s %5s %5s\n", "Flow recvd.", "Flow start", "Duratn", "Prot", "Src IP:Port", "Dst IP:Port", "Pckts", "Bytes");
			printf("-----------------------------------------------------------------------------------------------------------------\n");
			linesPrinted = 0;
		}
		struct tm* tm;
		struct timeval tv;
		gettimeofday(&tv, 0);
		tm = localtime(reinterpret_cast<time_t*>(&tv.tv_sec));
		strftime(buf, ARRAY_SIZE(buf), "%F %T", tm);
		snprintf(buf2, ARRAY_SIZE(buf2), "%s.%03ld", buf, tv.tv_usec/1000);
		printf("%22s ", buf2);

		uint32_t timetype = 0;
		uint32_t starttime = 0;
		IpfixRecord::FieldInfo* fi = dataTemplateInfo->getFieldInfo(IPFIX_TYPEID_flowStartSeconds, 0);
		if (fi != NULL) {
			timetype = IPFIX_TYPEID_flowStartSeconds;
			time_t t = ntohl(*reinterpret_cast<time_t*>(record->data+fi->offset));
			starttime = t;
			tm = localtime(&t);
			strftime(buf, 50, "%F %T", tm);
		} else {
			fi = dataTemplateInfo->getFieldInfo(IPFIX_TYPEID_flowStartMilliSeconds, 0);
			if (fi != NULL) {
				timetype = IPFIX_TYPEID_flowStartMilliSeconds;
				uint64_t t2 = ntohll(*reinterpret_cast<uint64_t*>(record->data+fi->offset));
				time_t t = t2/1000;
				starttime = t;
				tm = localtime(&t);
				strftime(buf, 50, "%F %T", tm);
			} else {
				fi = dataTemplateInfo->getFieldInfo(IPFIX_TYPEID_flowStartSysUpTime, 0);
				if (fi != NULL) {
					timetype = IPFIX_TYPEID_flowStartSysUpTime;
					starttime = ntohl(*reinterpret_cast<uint32_t*>(record->data+fi->offset));
					snprintf(buf, 50, "%u:%02u.%04u", starttime/60000, (starttime%60000)/1000, starttime%1000);
				} else {
					fi = dataTemplateInfo->getFieldInfo(IPFIX_TYPEID_flowStartSeconds, 0);
					if (fi != NULL) {
						timetype = IPFIX_TYPEID_flowStartNanoSeconds;
						uint64_t t2 = ntohll(*reinterpret_cast<uint64_t*>(record->data+fi->offset));
						timeval t = timentp64(*((ntp64*)(&t2)));
						tm = localtime(&t.tv_sec);
						strftime(buf, 50, "%F %T", tm);
						starttime = t.tv_sec;
					}
				}
			}
		}
		if (timetype != 0) {
			printf("%20s ", buf);

			uint32_t dur = 0;
			switch (timetype) {
				case IPFIX_TYPEID_flowStartSeconds:
					fi = dataTemplateInfo->getFieldInfo(IPFIX_TYPEID_flowEndSeconds, 0);
					if (fi != NULL) {
						dur = ntohl(*reinterpret_cast<uint32_t*>(record->data+fi->offset)) - starttime;
						dur *= 1000;
					}
					break;
				case IPFIX_TYPEID_flowStartMilliSeconds:
					fi = dataTemplateInfo->getFieldInfo(IPFIX_TYPEID_flowEndMilliSeconds, 0);
					if (fi != NULL) {
						dur = ntohll(*reinterpret_cast<uint64_t*>(record->data+fi->offset)) - starttime;
						dur *= 1000;
					}
					break;
				case IPFIX_TYPEID_flowStartSysUpTime:
					fi = dataTemplateInfo->getFieldInfo(IPFIX_TYPEID_flowEndSysUpTime, 0);
					if (fi != NULL) {
						dur = ntohl(*reinterpret_cast<uint32_t*>(record->data+fi->offset)) - starttime;
						dur *= 1000;
					}
					break;
				case IPFIX_TYPEID_flowStartNanoSeconds:
					fi = dataTemplateInfo->getFieldInfo(IPFIX_TYPEID_flowEndNanoSeconds, 0);
					if (fi != NULL) {
						uint64_t t2 = ntohll(*reinterpret_cast<uint64_t*>(record->data+fi->offset));
						timeval t = timentp64(*((ntp64*)(&t2)));
						dur = t.tv_sec*1000+t.tv_usec/1000 - starttime;
					}
			}
			snprintf(buf, 50, "%u.%04u", (dur)/1000, dur%1000);
			printf("%8s ", buf);
		}
		else {
			printf("%20s %8s ", "---", "---");
		}

		fi = dataTemplateInfo->getFieldInfo(IPFIX_TYPEID_protocolIdentifier, 0);
		if (fi != NULL && fi->type.length==1) {
			snprintf(buf, ARRAY_SIZE(buf), "%hhu", *reinterpret_cast<uint8_t*>(record->data+fi->offset));
		} else {
			snprintf(buf, ARRAY_SIZE(buf), "---");
		}
		printf("%5s ", buf);

		fi = dataTemplateInfo->getFieldInfo(IPFIX_TYPEID_sourceIPv4Address, 0);
		uint32_t srcip = 0;
		if (fi != NULL && fi->type.length>=4) {
			srcip = *reinterpret_cast<uint32_t*>(record->data+fi->offset);
		}
		fi = dataTemplateInfo->getFieldInfo(IPFIX_TYPEID_sourceTransportPort, 0);
		uint32_t srcport = 0;
		if (fi != NULL && fi->type.length==2) {
			srcport = *reinterpret_cast<uint16_t*>(record->data+fi->offset);
		}
		snprintf(buf, ARRAY_SIZE(buf), "%hhu.%hhu.%hhu.%hhu:%hu", (srcip>>0)&0xFF, (srcip>>8)&0xFF, (srcip>>16)&0xFF, (srcip>>24)&0xFF, srcport);
		printf("%21s ", buf);

		fi = dataTemplateInfo->getFieldInfo(IPFIX_TYPEID_destinationIPv4Address, 0);
		uint32_t dstip = 0;
		if (fi != NULL && fi->type.length>=4) {
			dstip = *reinterpret_cast<uint32_t*>(record->data+fi->offset);
		}
		fi = dataTemplateInfo->getFieldInfo(IPFIX_TYPEID_destinationTransportPort, 0);
		uint32_t dstport = 0;
		if (fi != NULL && fi->type.length==2) {
			dstport = *reinterpret_cast<uint16_t*>(record->data+fi->offset);
		}
		snprintf(buf, ARRAY_SIZE(buf), "%hhu.%hhu.%hhu.%hhu:%hu", (dstip>>0)&0xFF, (dstip>>8)&0xFF, (dstip>>16)&0xFF, (dstip>>24)&0xFF, dstport);
		printf("%21s ", buf);

		fi = dataTemplateInfo->getFieldInfo(IPFIX_TYPEID_packetDeltaCount, 0);
		if (fi != NULL) {
			printUint(buf, fi->type, record->data+fi->offset);
		} else {
			snprintf(buf, ARRAY_SIZE(buf), "---");
		}
		printf("%5s ", buf);

		fi = dataTemplateInfo->getFieldInfo(IPFIX_TYPEID_octetDeltaCount, 0);
		if (fi != NULL) {
			printUint(buf, fi->type, record->data+fi->offset);
		} else {
			snprintf(buf, ARRAY_SIZE(buf), "---");
		}
		printf("%5s \n", buf);
		linesPrinted++;
}
Beispiel #4
0
/**
 * Prints a string representation of IpfixRecord::Data to stdout.
 */
void PrintHelpers::printFieldData(InformationElement::IeInfo type, IpfixRecord::Data* pattern) {

	timeval t;
	uint64_t hbnum;
	string typeStr = type.toString();

	// try to get the values aligned
	if (typeStr.length() < 60)
		fprintf(fh, "%-60s: ", type.toString().c_str());
	else
		fprintf(fh, "%s: ", type.toString().c_str());

	switch (type.enterprise) {
		case 0:
			switch (type.id) {
				case IPFIX_TYPEID_protocolIdentifier:
					printProtocol(type, pattern);
					return;
				case IPFIX_TYPEID_sourceIPv4Address:
					printIPv4(type, pattern);
					return;
				case IPFIX_TYPEID_destinationIPv4Address:
					printIPv4(type, pattern);
					return;
				case IPFIX_TYPEID_sourceTransportPort:
					printPort(type, pattern);
					return;
				case IPFIX_TYPEID_destinationTransportPort:
					printPort(type, pattern);
					return;
				case IPFIX_TYPEID_flowStartSeconds:
				case IPFIX_TYPEID_flowEndSeconds:
				case IPFIX_TYPEID_flowStartMilliSeconds:
				case IPFIX_TYPEID_flowEndMilliSeconds:
				case PSAMP_TYPEID_observationTimeSeconds:
					printLocaltime(type, pattern);
					return;
				case IPFIX_TYPEID_flowStartNanoSeconds:
				case IPFIX_TYPEID_flowEndNanoSeconds:
					hbnum = ntohll(*(uint64_t*)pattern);
					if (hbnum>0) {
						t = timentp64(*((ntp64*)(&hbnum)));
						fprintf(fh, "%u.%06d seconds", (int32_t)t.tv_sec, (int32_t)t.tv_usec);
					} else {
						fprintf(fh, "no value (only zeroes in field)");
					}
					return;
			}
			break;

		case IPFIX_PEN_reverse:
			switch (type.id) {
				case IPFIX_TYPEID_flowStartNanoSeconds:
				case IPFIX_TYPEID_flowEndNanoSeconds:
					hbnum = ntohll(*(uint64_t*)pattern);
					if (hbnum>0) {
						t = timentp64(*((ntp64*)(&hbnum)));
						fprintf(fh, "%u.%06d seconds", (int32_t)t.tv_sec, (int32_t)t.tv_usec);
					} else {
						fprintf(fh, "no value (only zeroes in field)");
					}
					return;
			}
			break;

		default:
		{
			if (type==InformationElement::IeInfo(IPFIX_ETYPEID_frontPayload, IPFIX_PEN_vermont) ||
				type==InformationElement::IeInfo(IPFIX_ETYPEID_frontPayload, IPFIX_PEN_vermont|IPFIX_PEN_reverse)) {
				printFrontPayload(type, pattern);
				return;
			}
		}
	}

	printUint(type, pattern);
}