Exemple #1
0
void netflow_send()
{
    BSB hbsb;

    BSB_INIT(hbsb, buf, headerSize);

    uint32_t sys_uptime = (bufTime.tv_sec - initialPacket.tv_sec)*1000; /*+
                          (bufTIme.tv_usec - initialPacket.tv_usec)/1000;*/
                 

    /* Header */
    BSB_EXPORT_u16(hbsb, netflowVersion);
    BSB_EXPORT_u16(hbsb, bufCount); // count
    BSB_EXPORT_u32(hbsb, sys_uptime); // sys_uptime
    BSB_EXPORT_u32(hbsb, bufTime.tv_sec);
    BSB_EXPORT_u32(hbsb, bufTime.tv_usec);

    switch (netflowVersion) {
    case 5:
        BSB_EXPORT_u32(hbsb, totalFlows); // flow_sequence
        BSB_EXPORT_u08(hbsb, 0); // engine_type
        BSB_EXPORT_u08(hbsb, 0); // engine_id
        BSB_EXPORT_u16(hbsb, 0); // mode/interval
        break;
    case 7:
        BSB_EXPORT_u32(hbsb, totalFlows); // flow_sequence
        BSB_EXPORT_u32(hbsb, 0); // reserved
        break;
    }

    int i;
    for (i = 0; i < numDests; i++) {
        int rc;
        
        if ((rc = send(dests[i].fd, buf, BSB_LENGTH(bsb)+headerSize, 0)) < BSB_LENGTH(bsb)+headerSize) {
            LOG("Failed to send rc=%d size=%ld", rc, BSB_LENGTH(bsb)+headerSize);
        }
    }

    totalFlows += bufCount;
    BSB_INIT(bsb, buf + headerSize, sizeof(buf) - headerSize);
    bufCount = 0;
}
Exemple #2
0
void wise_lookup(MolochSession_t *session, WiseRequest_t *request, char *value, int type)
{
    static int lookups = 0;

    if (*value == 0)
        return;

    if (request->numItems >= 256)
        return;

    lookups++;
    if ((lookups % 10000) == 0)
        wise_print_stats();

    stats[type][INTEL_STAT_LOOKUP]++;

    WiseItem_t *wi;
    HASH_FIND(wih_, itemHash[type], value, wi);

    if (wi) {
        // Already being looked up
        if (wi->sessions) {
            if (wi->numSessions < wi->sessionsSize) {
                wi->sessions[wi->numSessions++] = session;
                moloch_nids_incr_outstanding(session);
            }
            stats[type][INTEL_STAT_INPROGRESS]++;
            return;
        }

        struct timeval currentTime;
        gettimeofday(&currentTime, NULL);

        if (wi->loadTime + cacheSecs > currentTime.tv_sec) {
            wise_process_ops(session, wi);
            stats[type][INTEL_STAT_CACHE]++;
            return;
        }

        /* Had it in cache, but it is too old */
        DLL_REMOVE(wil_, &itemList[type], wi);
        wise_free_ops(wi);
    } else {
        // Know nothing about it
        wi = MOLOCH_TYPE_ALLOC0(WiseItem_t);
        wi->key          = g_strdup(value);
        wi->type         = type;
        wi->sessionsSize = 20;
        HASH_ADD(wih_, itemHash[type], wi->key, wi);
    }

    wi->sessions = malloc(sizeof(MolochSession_t *) * wi->sessionsSize);
    wi->sessions[wi->numSessions++] = session;
    moloch_nids_incr_outstanding(session);

    stats[type][INTEL_STAT_REQUEST]++;

    BSB_EXPORT_u08(request->bsb, type);
    int len = strlen(value);
    BSB_EXPORT_u16(request->bsb, len);
    BSB_EXPORT_ptr(request->bsb, value, len);

    request->items[request->numItems++] = wi;
}