void sfl_receiver_tick(SFLReceiver *receiver, time_t now)
{
// if there are any samples to send, flush them now
if(receiver->sampleCollector.numSamples > 0) sendSample(receiver);
// check the timeout
if(receiver->sFlowRcvrTimeout && (uint32_t)receiver->sFlowRcvrTimeout != 0xFFFFFFFF) {
// count down one tick and reset if we reach 0
if(--receiver->sFlowRcvrTimeout == 0) reset(receiver);
}
}
int sfl_receiver_writeCountersSample(SFLReceiver *receiver, SFL_COUNTERS_SAMPLE_TYPE *cs)
{
int packedSize;
SFLCounters_sample_element *elem;
if(cs == NULL) return -1;
// if the sample pkt is full enough so that this sample might put
// it over the limit, then we should send it now.
if((packedSize = computeCountersSampleSize(receiver, cs)) == -1) return -1;
// check in case this one sample alone is too big for the datagram
// in fact - if it is even half as big then we should ditch it. Very
// important to avoid overruning the packet buffer.
if(packedSize > (int)(receiver->sFlowRcvrMaximumDatagramSize / 2)) {
sflError(receiver, "counters sample too big for datagram");
return -1;
}
if((receiver->sampleCollector.pktlen + packedSize) >= receiver->sFlowRcvrMaximumDatagramSize)
sendSample(receiver);
receiver->sampleCollector.numSamples++;
#ifdef SFL_USE_32BIT_INDEX
putNet32(receiver, SFLCOUNTERS_SAMPLE_EXPANDED);
#else
putNet32(receiver, SFLCOUNTERS_SAMPLE);
#endif
putNet32(receiver, packedSize - 8); // tag and length not included
putNet32(receiver, cs->sequence_number);
#ifdef SFL_USE_32BIT_INDEX
putNet32(receiver, cs->ds_class);
putNet32(receiver, cs->ds_index);
#else
putNet32(receiver, cs->source_id);
#endif
putNet32(receiver, cs->num_elements);
for(elem = cs->elements; elem != NULL; elem = elem->nxt) {
putNet32(receiver, elem->tag);
putNet32(receiver, elem->length); // length cached in computeCountersSampleSize()
switch(elem->tag) {
case SFLCOUNTERS_GENERIC:
putGenericCounters(receiver, &(elem->counterBlock.generic));
break;
case SFLCOUNTERS_ETHERNET:
// all these counters are 32-bit
putNet32_run(receiver, &elem->counterBlock.ethernet, sizeof(elem->counterBlock.ethernet) / 4);
break;
case SFLCOUNTERS_TOKENRING:
// all these counters are 32-bit
putNet32_run(receiver, &elem->counterBlock.tokenring, sizeof(elem->counterBlock.tokenring) / 4);
break;
case SFLCOUNTERS_VG:
putNet32(receiver, elem->counterBlock.vg.dot12InHighPriorityFrames);
putNet64(receiver, elem->counterBlock.vg.dot12InHighPriorityOctets);
putNet32(receiver, elem->counterBlock.vg.dot12InNormPriorityFrames);
putNet64(receiver, elem->counterBlock.vg.dot12InNormPriorityOctets);
putNet32(receiver, elem->counterBlock.vg.dot12InIPMErrors);
putNet32(receiver, elem->counterBlock.vg.dot12InOversizeFrameErrors);
putNet32(receiver, elem->counterBlock.vg.dot12InDataErrors);
putNet32(receiver, elem->counterBlock.vg.dot12InNullAddressedFrames);
putNet32(receiver, elem->counterBlock.vg.dot12OutHighPriorityFrames);
putNet64(receiver, elem->counterBlock.vg.dot12OutHighPriorityOctets);
putNet32(receiver, elem->counterBlock.vg.dot12TransitionIntoTrainings);
putNet64(receiver, elem->counterBlock.vg.dot12HCInHighPriorityOctets);
putNet64(receiver, elem->counterBlock.vg.dot12HCInNormPriorityOctets);
putNet64(receiver, elem->counterBlock.vg.dot12HCOutHighPriorityOctets);
break;
case SFLCOUNTERS_VLAN:
putNet32(receiver, elem->counterBlock.vlan.vlan_id);
putNet64(receiver, elem->counterBlock.vlan.octets);
putNet32(receiver, elem->counterBlock.vlan.ucastPkts);
putNet32(receiver, elem->counterBlock.vlan.multicastPkts);
putNet32(receiver, elem->counterBlock.vlan.broadcastPkts);
putNet32(receiver, elem->counterBlock.vlan.discards);
break;
case SFLCOUNTERS_PROCESSOR:
putNet32(receiver, elem->counterBlock.processor.five_sec_cpu);
putNet32(receiver, elem->counterBlock.processor.one_min_cpu);
putNet32(receiver, elem->counterBlock.processor.five_min_cpu);
putNet64(receiver, elem->counterBlock.processor.total_memory);
putNet64(receiver, elem->counterBlock.processor.free_memory);
break;
case SFLCOUNTERS_HOST_HID:
putString(receiver, &elem->counterBlock.host_hid.hostname);
put128(receiver, elem->counterBlock.host_hid.uuid);
putNet32(receiver, elem->counterBlock.host_hid.machine_type);
putNet32(receiver, elem->counterBlock.host_hid.os_name);
putString(receiver, &elem->counterBlock.host_hid.os_release);
break;
case SFLCOUNTERS_HOST_PAR:
putNet32(receiver, elem->counterBlock.host_par.dsClass);
putNet32(receiver, elem->counterBlock.host_par.dsIndex);
break;
case SFLCOUNTERS_ADAPTORS:
putAdaptorList(receiver, elem->counterBlock.adaptors);
break;
case SFLCOUNTERS_HOST_CPU:
putNetFloat(receiver, elem->counterBlock.host_cpu.load_one);
putNetFloat(receiver, elem->counterBlock.host_cpu.load_five);
putNetFloat(receiver, elem->counterBlock.host_cpu.load_fifteen);
putNet32(receiver, elem->counterBlock.host_cpu.proc_run);
putNet32(receiver, elem->counterBlock.host_cpu.proc_total);
putNet32(receiver, elem->counterBlock.host_cpu.cpu_num);
putNet32(receiver, elem->counterBlock.host_cpu.cpu_speed);
putNet32(receiver, elem->counterBlock.host_cpu.uptime);
putNet32(receiver, elem->counterBlock.host_cpu.cpu_user);
putNet32(receiver, elem->counterBlock.host_cpu.cpu_nice);
putNet32(receiver, elem->counterBlock.host_cpu.cpu_system);
putNet32(receiver, elem->counterBlock.host_cpu.cpu_idle);
putNet32(receiver, elem->counterBlock.host_cpu.cpu_wio);
putNet32(receiver, elem->counterBlock.host_cpu.cpu_intr);
putNet32(receiver, elem->counterBlock.host_cpu.cpu_sintr);
putNet32(receiver, elem->counterBlock.host_cpu.interrupts);
putNet32(receiver, elem->counterBlock.host_cpu.contexts);
break;
case SFLCOUNTERS_HOST_MEM:
putNet64(receiver, elem->counterBlock.host_mem.mem_total);
putNet64(receiver, elem->counterBlock.host_mem.mem_free);
putNet64(receiver, elem->counterBlock.host_mem.mem_shared);
putNet64(receiver, elem->counterBlock.host_mem.mem_buffers);
putNet64(receiver, elem->counterBlock.host_mem.mem_cached);
putNet64(receiver, elem->counterBlock.host_mem.swap_total);
putNet64(receiver, elem->counterBlock.host_mem.swap_free);
putNet32(receiver, elem->counterBlock.host_mem.page_in);
putNet32(receiver, elem->counterBlock.host_mem.page_out);
putNet32(receiver, elem->counterBlock.host_mem.swap_in);
putNet32(receiver, elem->counterBlock.host_mem.swap_out);
break;
case SFLCOUNTERS_HOST_DSK:
putNet64(receiver, elem->counterBlock.host_dsk.disk_total);
putNet64(receiver, elem->counterBlock.host_dsk.disk_free);
putNet32(receiver, elem->counterBlock.host_dsk.part_max_used);
putNet32(receiver, elem->counterBlock.host_dsk.reads);
putNet64(receiver, elem->counterBlock.host_dsk.bytes_read);
putNet32(receiver, elem->counterBlock.host_dsk.read_time);
putNet32(receiver, elem->counterBlock.host_dsk.writes);
putNet64(receiver, elem->counterBlock.host_dsk.bytes_written);
putNet32(receiver, elem->counterBlock.host_dsk.write_time);
break;
case SFLCOUNTERS_HOST_NIO:
putNet64(receiver, elem->counterBlock.host_nio.bytes_in);
putNet32(receiver, elem->counterBlock.host_nio.pkts_in);
putNet32(receiver, elem->counterBlock.host_nio.errs_in);
putNet32(receiver, elem->counterBlock.host_nio.drops_in);
putNet64(receiver, elem->counterBlock.host_nio.bytes_out);
putNet32(receiver, elem->counterBlock.host_nio.pkts_out);
putNet32(receiver, elem->counterBlock.host_nio.errs_out);
putNet32(receiver, elem->counterBlock.host_nio.drops_out);
break;
case SFLCOUNTERS_HOST_VRT_NODE:
putNet32(receiver, elem->counterBlock.host_vrt_node.mhz);
putNet32(receiver, elem->counterBlock.host_vrt_node.cpus);
putNet64(receiver, elem->counterBlock.host_vrt_node.memory);
putNet64(receiver, elem->counterBlock.host_vrt_node.memory_free);
putNet32(receiver, elem->counterBlock.host_vrt_node.num_domains);
break;
case SFLCOUNTERS_HOST_VRT_CPU:
putNet32(receiver, elem->counterBlock.host_vrt_cpu.state);
putNet32(receiver, elem->counterBlock.host_vrt_cpu.cpuTime);
putNet32(receiver, elem->counterBlock.host_vrt_cpu.nrVirtCpu);
break;
case SFLCOUNTERS_HOST_VRT_MEM:
putNet64(receiver, elem->counterBlock.host_vrt_mem.memory);
putNet64(receiver, elem->counterBlock.host_vrt_mem.maxMemory);
break;
case SFLCOUNTERS_HOST_VRT_DSK:
putNet64(receiver, elem->counterBlock.host_vrt_dsk.capacity);
putNet64(receiver, elem->counterBlock.host_vrt_dsk.allocation);
putNet64(receiver, elem->counterBlock.host_vrt_dsk.available);
putNet32(receiver, elem->counterBlock.host_vrt_dsk.rd_req);
putNet64(receiver, elem->counterBlock.host_vrt_dsk.rd_bytes);
putNet32(receiver, elem->counterBlock.host_vrt_dsk.wr_req);
putNet64(receiver, elem->counterBlock.host_vrt_dsk.wr_bytes);
putNet32(receiver, elem->counterBlock.host_vrt_dsk.errs);
break;
case SFLCOUNTERS_HOST_VRT_NIO:
putNet64(receiver, elem->counterBlock.host_vrt_nio.bytes_in);
putNet32(receiver, elem->counterBlock.host_vrt_nio.pkts_in);
putNet32(receiver, elem->counterBlock.host_vrt_nio.errs_in);
putNet32(receiver, elem->counterBlock.host_vrt_nio.drops_in);
putNet64(receiver, elem->counterBlock.host_vrt_nio.bytes_out);
putNet32(receiver, elem->counterBlock.host_vrt_nio.pkts_out);
putNet32(receiver, elem->counterBlock.host_vrt_nio.errs_out);
putNet32(receiver, elem->counterBlock.host_vrt_nio.drops_out);
break;
default:
{
char errm[128];
sprintf(errm, "unexpected counters tag (%u)", elem->tag);
sflError(receiver, errm);
return -1;
}
break;
}
}
// sanity check
assert(((u_char *)receiver->sampleCollector.datap
- (u_char *)receiver->sampleCollector.data
- receiver->sampleCollector.pktlen) == (uint32_t)packedSize);
// update the pktlen
receiver->sampleCollector.pktlen = (u_char *)receiver->sampleCollector.datap - (u_char *)receiver->sampleCollector.data;
return packedSize;
}
int sfl_receiver_writeFlowSample(SFLReceiver *receiver, SFL_FLOW_SAMPLE_TYPE *fs)
{
int packedSize;
SFLFlow_sample_element *elem;
if(fs == NULL) return -1;
if((packedSize = computeFlowSampleSize(receiver, fs)) == -1) return -1;
// check in case this one sample alone is too big for the datagram
// in fact - if it is even half as big then we should ditch it. Very
// important to avoid overruning the packet buffer.
if(packedSize > (int)(receiver->sFlowRcvrMaximumDatagramSize / 2)) {
sflError(receiver, "flow sample too big for datagram");
return -1;
}
// if the sample pkt is full enough so that this sample might put
// it over the limit, then we should send it now before going on.
if((receiver->sampleCollector.pktlen + packedSize) >= receiver->sFlowRcvrMaximumDatagramSize)
sendSample(receiver);
receiver->sampleCollector.numSamples++;
#ifdef SFL_USE_32BIT_INDEX
putNet32(receiver, SFLFLOW_SAMPLE_EXPANDED);
#else
putNet32(receiver, SFLFLOW_SAMPLE);
#endif
putNet32(receiver, packedSize - 8); // don't include tag and len
putNet32(receiver, fs->sequence_number);
#ifdef SFL_USE_32BIT_INDEX
putNet32(receiver, fs->ds_class);
putNet32(receiver, fs->ds_index);
#else
putNet32(receiver, fs->source_id);
#endif
putNet32(receiver, fs->sampling_rate);
putNet32(receiver, fs->sample_pool);
putNet32(receiver, fs->drops);
#ifdef SFL_USE_32BIT_INDEX
putNet32(receiver, fs->inputFormat);
putNet32(receiver, fs->input);
putNet32(receiver, fs->outputFormat);
putNet32(receiver, fs->output);
#else
putNet32(receiver, fs->input);
putNet32(receiver, fs->output);
#endif
putNet32(receiver, fs->num_elements);
for(elem = fs->elements; elem != NULL; elem = elem->nxt) {
putNet32(receiver, elem->tag);
putNet32(receiver, elem->length); // length cached in computeFlowSampleSize()
switch(elem->tag) {
case SFLFLOW_HEADER:
putNet32(receiver, elem->flowType.header.header_protocol);
putNet32(receiver, elem->flowType.header.frame_length);
putNet32(receiver, elem->flowType.header.stripped);
putNet32(receiver, elem->flowType.header.header_length);
/* the header */
memcpy(receiver->sampleCollector.datap, elem->flowType.header.header_bytes, elem->flowType.header.header_length);
/* round up to multiple of 4 to preserve alignment */
receiver->sampleCollector.datap += ((elem->flowType.header.header_length + 3) / 4);
break;
case SFLFLOW_ETHERNET:
putNet32(receiver, elem->flowType.ethernet.eth_len);
putMACAddress(receiver, elem->flowType.ethernet.src_mac);
putMACAddress(receiver, elem->flowType.ethernet.dst_mac);
putNet32(receiver, elem->flowType.ethernet.eth_type);
break;
case SFLFLOW_IPV4:
putNet32(receiver, elem->flowType.ipv4.length);
putNet32(receiver, elem->flowType.ipv4.protocol);
put32(receiver, elem->flowType.ipv4.src_ip.addr);
put32(receiver, elem->flowType.ipv4.dst_ip.addr);
putNet32(receiver, elem->flowType.ipv4.src_port);
putNet32(receiver, elem->flowType.ipv4.dst_port);
putNet32(receiver, elem->flowType.ipv4.tcp_flags);
putNet32(receiver, elem->flowType.ipv4.tos);
break;
case SFLFLOW_IPV6:
putNet32(receiver, elem->flowType.ipv6.length);
putNet32(receiver, elem->flowType.ipv6.protocol);
put128(receiver, elem->flowType.ipv6.src_ip.addr);
put128(receiver, elem->flowType.ipv6.dst_ip.addr);
putNet32(receiver, elem->flowType.ipv6.src_port);
putNet32(receiver, elem->flowType.ipv6.dst_port);
putNet32(receiver, elem->flowType.ipv6.tcp_flags);
putNet32(receiver, elem->flowType.ipv6.priority);
break;
case SFLFLOW_EX_SWITCH: putSwitch(receiver, &elem->flowType.sw); break;
case SFLFLOW_EX_ROUTER: putRouter(receiver, &elem->flowType.router); break;
case SFLFLOW_EX_GATEWAY: putGateway(receiver, &elem->flowType.gateway); break;
case SFLFLOW_EX_USER: putUser(receiver, &elem->flowType.user); break;
case SFLFLOW_EX_URL: putUrl(receiver, &elem->flowType.url); break;
case SFLFLOW_EX_MPLS: putMpls(receiver, &elem->flowType.mpls); break;
case SFLFLOW_EX_NAT: putNat(receiver, &elem->flowType.nat); break;
case SFLFLOW_EX_MPLS_TUNNEL: putMplsTunnel(receiver, &elem->flowType.mpls_tunnel); break;
case SFLFLOW_EX_MPLS_VC: putMplsVc(receiver, &elem->flowType.mpls_vc); break;
case SFLFLOW_EX_MPLS_FTN: putMplsFtn(receiver, &elem->flowType.mpls_ftn); break;
case SFLFLOW_EX_MPLS_LDP_FEC: putMplsLdpFec(receiver, &elem->flowType.mpls_ldp_fec); break;
case SFLFLOW_EX_VLAN_TUNNEL: putVlanTunnel(receiver, &elem->flowType.vlan_tunnel); break;
default:
sflError(receiver, "unexpected packet_data_tag");
return -1;
break;
}
}
// sanity check
assert(((u_char *)receiver->sampleCollector.datap
- (u_char *)receiver->sampleCollector.data
- receiver->sampleCollector.pktlen) == (uint32_t)packedSize);
// update the pktlen
receiver->sampleCollector.pktlen = (u_char *)receiver->sampleCollector.datap - (u_char *)receiver->sampleCollector.data;
return packedSize;
}
int sfl_receiver_writeCountersSample(SFLReceiver *receiver, SFL_COUNTERS_SAMPLE_TYPE *cs)
{
int packedSize;
if(cs == NULL) return -1;
// if the sample pkt is full enough so that this sample might put
// it over the limit, then we should send it now.
if((packedSize = computeCountersSampleSize(receiver, cs)) == -1) return -1;
// check in case this one sample alone is too big for the datagram
// in fact - if it is even half as big then we should ditch it. Very
// important to avoid overruning the packet buffer.
if(packedSize > (int)(receiver->sFlowRcvrMaximumDatagramSize / 2)) {
sflError(receiver, "counters sample too big for datagram");
return -1;
}
if((receiver->sampleCollector.pktlen + packedSize) >= receiver->sFlowRcvrMaximumDatagramSize)
sendSample(receiver);
receiver->sampleCollector.numSamples++;
#ifdef SFL_USE_32BIT_INDEX
putNet32(receiver, SFLCOUNTERS_SAMPLE_EXPANDED);
#else
putNet32(receiver, SFLCOUNTERS_SAMPLE);
#endif
putNet32(receiver, packedSize - 8); // tag and length not included
putNet32(receiver, cs->sequence_number);
#ifdef SFL_USE_32BIT_INDEX
putNet32(receiver, cs->ds_class);
putNet32(receiver, cs->ds_index);
#else
putNet32(receiver, cs->source_id);
#endif
putNet32(receiver, cs->num_elements);
{
SFLCounters_sample_element *elem = cs->elements;
for(; elem != NULL; elem = elem->nxt) {
putNet32(receiver, elem->tag);
putNet32(receiver, elem->length); // length cached in computeCountersSampleSize()
switch(elem->tag) {
case SFLCOUNTERS_GENERIC:
putGenericCounters(receiver, &(elem->counterBlock.generic));
break;
case SFLCOUNTERS_ETHERNET:
// all these counters are 32-bit
putNet32_run(receiver, &elem->counterBlock.ethernet, sizeof(elem->counterBlock.ethernet) / 4);
break;
case SFLCOUNTERS_TOKENRING:
// all these counters are 32-bit
putNet32_run(receiver, &elem->counterBlock.tokenring, sizeof(elem->counterBlock.tokenring) / 4);
break;
case SFLCOUNTERS_VG:
// mixed sizes
putNet32(receiver, elem->counterBlock.vg.dot12InHighPriorityFrames);
putNet64(receiver, elem->counterBlock.vg.dot12InHighPriorityOctets);
putNet32(receiver, elem->counterBlock.vg.dot12InNormPriorityFrames);
putNet64(receiver, elem->counterBlock.vg.dot12InNormPriorityOctets);
putNet32(receiver, elem->counterBlock.vg.dot12InIPMErrors);
putNet32(receiver, elem->counterBlock.vg.dot12InOversizeFrameErrors);
putNet32(receiver, elem->counterBlock.vg.dot12InDataErrors);
putNet32(receiver, elem->counterBlock.vg.dot12InNullAddressedFrames);
putNet32(receiver, elem->counterBlock.vg.dot12OutHighPriorityFrames);
putNet64(receiver, elem->counterBlock.vg.dot12OutHighPriorityOctets);
putNet32(receiver, elem->counterBlock.vg.dot12TransitionIntoTrainings);
putNet64(receiver, elem->counterBlock.vg.dot12HCInHighPriorityOctets);
putNet64(receiver, elem->counterBlock.vg.dot12HCInNormPriorityOctets);
putNet64(receiver, elem->counterBlock.vg.dot12HCOutHighPriorityOctets);
break;
case SFLCOUNTERS_VLAN:
// mixed sizes
putNet32(receiver, elem->counterBlock.vlan.vlan_id);
putNet64(receiver, elem->counterBlock.vlan.octets);
putNet32(receiver, elem->counterBlock.vlan.ucastPkts);
putNet32(receiver, elem->counterBlock.vlan.multicastPkts);
putNet32(receiver, elem->counterBlock.vlan.broadcastPkts);
putNet32(receiver, elem->counterBlock.vlan.discards);
break;
default:
sflError(receiver, "unexpected counters_tag");
return -1;
break;
}
}
}
// sanity check
assert(((u_char *)receiver->sampleCollector.datap
- (u_char *)receiver->sampleCollector.data
- receiver->sampleCollector.pktlen) == (u_int32_t)packedSize);
// update the pktlen
receiver->sampleCollector.pktlen = (u_char *)receiver->sampleCollector.datap - (u_char *)receiver->sampleCollector.data;
return packedSize;
}
