void netflow_send() { BSB hbsb; BSB_INIT(hbsb, buf, headerSize); uint32_t sys_uptime = (bufTime.tv_sec - initialPacket.tv_sec)*1000; /*+ (bufTIme.tv_usec - initialPacket.tv_usec)/1000;*/ /* Header */ BSB_EXPORT_u16(hbsb, netflowVersion); BSB_EXPORT_u16(hbsb, bufCount); // count BSB_EXPORT_u32(hbsb, sys_uptime); // sys_uptime BSB_EXPORT_u32(hbsb, bufTime.tv_sec); BSB_EXPORT_u32(hbsb, bufTime.tv_usec); switch (netflowVersion) { case 5: BSB_EXPORT_u32(hbsb, totalFlows); // flow_sequence BSB_EXPORT_u08(hbsb, 0); // engine_type BSB_EXPORT_u08(hbsb, 0); // engine_id BSB_EXPORT_u16(hbsb, 0); // mode/interval break; case 7: BSB_EXPORT_u32(hbsb, totalFlows); // flow_sequence BSB_EXPORT_u32(hbsb, 0); // reserved break; } int i; for (i = 0; i < numDests; i++) { int rc; if ((rc = send(dests[i].fd, buf, BSB_LENGTH(bsb)+headerSize, 0)) < BSB_LENGTH(bsb)+headerSize) { LOG("Failed to send rc=%d size=%ld", rc, BSB_LENGTH(bsb)+headerSize); } } totalFlows += bufCount; BSB_INIT(bsb, buf + headerSize, sizeof(buf) - headerSize); bufCount = 0; }
void wise_lookup(MolochSession_t *session, WiseRequest_t *request, char *value, int type) { static int lookups = 0; if (*value == 0) return; if (request->numItems >= 256) return; lookups++; if ((lookups % 10000) == 0) wise_print_stats(); stats[type][INTEL_STAT_LOOKUP]++; WiseItem_t *wi; HASH_FIND(wih_, itemHash[type], value, wi); if (wi) { // Already being looked up if (wi->sessions) { if (wi->numSessions < wi->sessionsSize) { wi->sessions[wi->numSessions++] = session; moloch_nids_incr_outstanding(session); } stats[type][INTEL_STAT_INPROGRESS]++; return; } struct timeval currentTime; gettimeofday(¤tTime, NULL); if (wi->loadTime + cacheSecs > currentTime.tv_sec) { wise_process_ops(session, wi); stats[type][INTEL_STAT_CACHE]++; return; } /* Had it in cache, but it is too old */ DLL_REMOVE(wil_, &itemList[type], wi); wise_free_ops(wi); } else { // Know nothing about it wi = MOLOCH_TYPE_ALLOC0(WiseItem_t); wi->key = g_strdup(value); wi->type = type; wi->sessionsSize = 20; HASH_ADD(wih_, itemHash[type], wi->key, wi); } wi->sessions = malloc(sizeof(MolochSession_t *) * wi->sessionsSize); wi->sessions[wi->numSessions++] = session; moloch_nids_incr_outstanding(session); stats[type][INTEL_STAT_REQUEST]++; BSB_EXPORT_u08(request->bsb, type); int len = strlen(value); BSB_EXPORT_u16(request->bsb, len); BSB_EXPORT_ptr(request->bsb, value, len); request->items[request->numItems++] = wi; }