div class highlight pre span class c1 usr bin perl span span class c1

  • Anonymous
  • Text only
  • 09 Oct 2009 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
<div class="highlight"><pre><span class="c1">#!/usr/bin/perl</span>



<span class="c1">###################################</span>

<span class="c1">#                                 #</span>

<span class="c1"># Simple NetFlow v5 packet parser #</span>

<span class="c1"># for ipt_NETFLOW                 #</span>

<span class="c1">#            by Alexander Ptitsyn #</span>

<span class="c1">#                  modified by Fd #</span>

<span class="c1"># v0.001                 (c) 2009 #</span>

<span class="c1">#                                 #</span>

<span class="c1">###################################</span>



<span class="k">use</span> <span class="n">strict</span><span class="p">;</span>

<span class="k">use</span> <span class="n">warnings</span><span class="p">;</span>

<span class="k">use</span> <span class="nn">IO::</span><span class="n">Socket</span><span class="p">;</span>



<span class="k">my</span> <span class="p">(</span><span class="nv">$packet</span><span class="p">,</span> <span class="nv">$sourceAddress</span><span class="p">,</span> <span class="nv">$sourcePort</span><span class="p">,</span> <span class="nv">$sourceMaskPrefix</span><span class="p">,</span> <span class="nv">$destinationAddress</span><span class="p">,</span> <span class="nv">$destinationPort</span><span class="p">,</span>

	<span class="nv">$destinationMaskPrefix</span><span class="p">,</span> <span class="nv">$packets</span><span class="p">,</span> <span class="nv">$octets</span><span class="p">,</span> <span class="nv">$proto</span><span class="p">,</span> <span class="nv">$tcpFlags</span><span class="p">,</span> <span class="nv">$typeOfService</span><span class="p">,</span> <span class="nv">$sourceAS</span><span class="p">,</span>

	<span class="nv">$destinationAS</span><span class="p">,</span> <span class="nv">$nextHop</span><span class="p">,</span> <span class="nv">$snmpIn</span><span class="p">,</span> <span class="nv">$snmpOut</span><span class="p">,</span> <span class="nv">$systemUptimeFlowStart</span><span class="p">,</span> <span class="nv">$systemUptimeFlowStop</span><span class="p">);</span>





<span class="k">my</span> <span class="nv">%config</span> <span class="o">=</span> <span class="p">(</span>

				<span class="n">hostname</span> <span class="o">=&gt;</span> <span class="s">&#39;localhost&#39;</span><span class="p">,</span>

				<span class="n">port</span>	 <span class="o">=&gt;</span> <span class="mi">2055</span><span class="p">,</span>

				<span class="n">proto</span>	 <span class="o">=&gt;</span> <span class="s">&#39;udp&#39;</span><span class="p">,</span>



				<span class="n">headerTemplate</span> <span class="o">=&gt;</span> <span class="s">&#39;nnNNNNCCn&#39;</span><span class="p">,</span>

				<span class="n">footerTemplate</span> <span class="o">=&gt;</span> <span class="s">&#39;NNNnnNNNNnnCCCCnnCCn&#39;</span><span class="p">,</span>

			<span class="p">);</span>



<span class="k">my</span> <span class="nv">$sockObj</span> <span class="o">=</span> <span class="nn">IO::Socket::</span><span class="n">INET</span><span class="o">-&gt;</span><span class="k">new</span><span class="p">(</span>

						<span class="n">LocalHost</span>	<span class="o">=&gt;</span> <span class="nv">$config</span><span class="p">{</span><span class="n">hostname</span><span class="p">},</span>

						<span class="n">LocalPort</span>	<span class="o">=&gt;</span> <span class="nv">$config</span><span class="p">{</span><span class="n">port</span><span class="p">},</span>

						<span class="n">Proto</span>		<span class="o">=&gt;</span> <span class="nv">$config</span><span class="p">{</span><span class="n">proto</span><span class="p">},</span>

				<span class="p">)</span> <span class="o">||</span> <span class="nb">die</span> <span class="s">&quot;Can&#39;t open socket: $!&quot;</span><span class="p">;</span>



<span class="k">while</span> <span class="p">(</span><span class="nv">$sockObj</span><span class="o">-&gt;</span><span class="nb">recv</span><span class="p">(</span><span class="nv">$packet</span><span class="p">,</span><span class="mi">1464</span><span class="p">))</span> <span class="p">{</span>



        <span class="k">my</span> <span class="nv">@header</span> <span class="o">=</span> <span class="nb">unpack</span> <span class="nv">$config</span><span class="p">{</span><span class="n">headerTemplate</span><span class="p">},</span> <span class="nv">$packet</span><span class="p">;</span>



        <span class="k">my</span> <span class="p">(</span><span class="nv">$flowVersion</span><span class="p">,</span> <span class="nv">$flowCount</span><span class="p">,</span> <span class="nv">$flowSysUptime</span><span class="p">,</span> <span class="nv">$flowUnixSeconds</span><span class="p">,</span> <span class="nv">$flowUnixNanoseconds</span><span class="p">,</span>

        	<span class="nv">$flowSequence</span><span class="p">,</span> <span class="nv">$flowEngineType</span><span class="p">,</span> <span class="nv">$flowEngineID</span><span class="p">,</span> <span class="nv">$flowSamplingInterval</span><span class="p">)</span> <span class="o">=</span> <span class="p">(</span><span class="nv">@header</span><span class="p">)[</span><span class="mi">0</span><span class="o">..</span><span class="mi">8</span><span class="p">];</span>



        <span class="nb">die</span> <span class="vg">$!</span> <span class="k">if</span> <span class="nv">$flowVersion</span> <span class="o">!=</span> <span class="mi">5</span> <span class="o">&amp;&amp;</span> <span class="p">(</span><span class="nv">$flowCount</span> <span class="o">&lt;</span> <span class="mi">0</span> <span class="o">||</span> <span class="nv">$flowCount</span> <span class="o">&gt;</span> <span class="mi">30</span><span class="p">);</span>



        <span class="k">my</span> <span class="nv">$Template</span> <span class="o">=</span> <span class="nv">$config</span><span class="p">{</span><span class="n">headerTemplate</span><span class="p">};</span>

        <span class="nv">$Template</span> <span class="o">.=</span> <span class="nv">$config</span><span class="p">{</span><span class="n">footerTemplate</span><span class="p">}</span> <span class="k">for</span> <span class="mi">0</span> <span class="o">..</span> <span class="nv">$flowCount</span><span class="p">;</span>



        <span class="k">my</span> <span class="nv">@flow</span> <span class="o">=</span> <span class="nb">unpack</span> <span class="nv">$Template</span><span class="p">,</span> <span class="nv">$packet</span><span class="p">;</span>



        <span class="k">if</span> <span class="p">(</span><span class="nv">$flowCount</span> <span class="o">&gt;</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>

                <span class="k">for</span> <span class="p">(</span><span class="k">my</span> <span class="nv">$i</span> <span class="o">=</span> <span class="mi">0</span><span class="p">;</span> <span class="nv">$i</span> <span class="o">&lt;</span> <span class="nv">$flowCount</span><span class="p">;</span> <span class="nv">$i</span><span class="o">++</span><span class="p">)</span> <span class="p">{</span>

                        <span class="nv">$sourceAddress</span> 			<span class="o">=</span> <span class="n">ip_to_str</span><span class="p">(</span><span class="nv">$flow</span><span class="p">[</span><span class="mi">9</span><span class="o">+</span><span class="nv">$i</span><span class="o">*</span><span class="mi">20</span><span class="p">]);</span>

                        <span class="nv">$sourcePort</span> 			<span class="o">=</span> <span class="nv">$flow</span><span class="p">[</span><span class="mi">18</span><span class="o">+</span><span class="nv">$i</span><span class="o">*</span><span class="mi">20</span><span class="p">];</span>

                        <span class="nv">$sourceMaskPrefix</span> 		<span class="o">=</span> <span class="nv">$flow</span><span class="p">[</span><span class="mi">26</span><span class="o">+</span><span class="nv">$i</span><span class="o">*</span><span class="mi">20</span><span class="p">];</span>



                        <span class="nv">$destinationAddress</span> 		<span class="o">=</span> <span class="n">ip_to_str</span><span class="p">(</span><span class="nv">$flow</span><span class="p">[</span><span class="mi">10</span><span class="o">+</span><span class="nv">$i</span><span class="o">*</span><span class="mi">20</span><span class="p">]);</span>

                        <span class="nv">$destinationPort</span> 		<span class="o">=</span> <span class="nv">$flow</span><span class="p">[</span><span class="mi">19</span><span class="o">+</span><span class="nv">$i</span><span class="o">*</span><span class="mi">20</span><span class="p">];</span>

                        <span class="nv">$destinationMaskPrefix</span> 		<span class="o">=</span> <span class="nv">$flow</span><span class="p">[</span><span class="mi">27</span><span class="o">+</span><span class="nv">$i</span><span class="o">*</span><span class="mi">20</span><span class="p">];</span>



                        <span class="nv">$packets</span> 			<span class="o">=</span> <span class="nv">$flow</span><span class="p">[</span><span class="mi">14</span><span class="o">+</span><span class="nv">$i</span><span class="o">*</span><span class="mi">20</span><span class="p">];</span>

                        <span class="nv">$octets</span> 			<span class="o">=</span> <span class="nv">$flow</span><span class="p">[</span><span class="mi">15</span><span class="o">+</span><span class="nv">$i</span><span class="o">*</span><span class="mi">20</span><span class="p">];</span>



                        <span class="nv">$proto</span> 				<span class="o">=</span> <span class="nv">$flow</span><span class="p">[</span><span class="mi">22</span><span class="o">+</span><span class="nv">$i</span><span class="o">*</span><span class="mi">20</span><span class="p">];</span>

                        <span class="nv">$tcpFlags</span> 			<span class="o">=</span> <span class="nv">$flow</span><span class="p">[</span><span class="mi">21</span><span class="o">+</span><span class="nv">$i</span><span class="o">*</span><span class="mi">20</span><span class="p">];</span>

                        <span class="nv">$typeOfService</span> 			<span class="o">=</span> <span class="nv">$flow</span><span class="p">[</span><span class="mi">23</span><span class="o">+</span><span class="nv">$i</span><span class="o">*</span><span class="mi">20</span><span class="p">];</span>



                        <span class="nv">$sourceAS</span> 			<span class="o">=</span> <span class="nv">$flow</span><span class="p">[</span><span class="mi">24</span><span class="o">+</span><span class="nv">$i</span><span class="o">*</span><span class="mi">20</span><span class="p">];</span>

                        <span class="nv">$destinationAS</span> 			<span class="o">=</span> <span class="nv">$flow</span><span class="p">[</span><span class="mi">25</span><span class="o">+</span><span class="nv">$i</span><span class="o">*</span><span class="mi">20</span><span class="p">];</span>



                        <span class="nv">$nextHop</span> 			<span class="o">=</span> <span class="nv">$flow</span><span class="p">[</span><span class="mi">11</span><span class="o">+</span><span class="nv">$i</span><span class="o">*</span><span class="mi">20</span><span class="p">];</span>

                        <span class="nv">$snmpIn</span> 			<span class="o">=</span> <span class="nv">$flow</span><span class="p">[</span><span class="mi">12</span><span class="o">+</span><span class="nv">$i</span><span class="o">*</span><span class="mi">20</span><span class="p">];</span>

                        <span class="nv">$snmpOut</span> 			<span class="o">=</span> <span class="nv">$flow</span><span class="p">[</span><span class="mi">13</span><span class="o">+</span><span class="nv">$i</span><span class="o">*</span><span class="mi">20</span><span class="p">];</span>



                        <span class="nv">$systemUptimeFlowStart</span> 		<span class="o">=</span> <span class="nv">$flow</span><span class="p">[</span><span class="mi">16</span><span class="o">+</span><span class="nv">$i</span><span class="o">*</span><span class="mi">20</span><span class="p">];</span>

                        <span class="nv">$systemUptimeFlowStop</span> 		<span class="o">=</span> <span class="nv">$flow</span><span class="p">[</span><span class="mi">17</span><span class="o">+</span><span class="nv">$i</span><span class="o">*</span><span class="mi">20</span><span class="p">];</span>

                <span class="p">}</span>

        <span class="p">}</span>

<span class="p">}</span>



<span class="k">sub </span><span class="nf">ip_to_str</span> <span class="p">{</span> <span class="n">inet_ntoa</span><span class="p">(</span> <span class="nb">pack</span><span class="p">(</span> <span class="s">&#39;N&#39;</span><span class="p">,</span> <span class="nb">shift</span> <span class="p">));</span> <span class="p">}</span>





<span class="cp">__END__</span>



<span class="cp">Bytes		Contents		Description</span>



<span class="cp">0-1		version			NetFlow export format version number</span>

<span class="cp">2-3		count			Number of flows exported in this packet (1-30)</span>

<span class="cp">4-7		sys_uptime		Current time in milliseconds since the export device booted</span>

<span class="cp">8-11		unix_secs		Current count of seconds since 0000 UTC 1970</span>

<span class="cp">12-15		unix_nsecs		Residual nanoseconds since 0000 UTC 1970</span>

<span class="cp">16-19		flow_sequence		Sequence counter of total flows seen</span>

<span class="cp">20		engine_type		Type of flow-switching engine</span>

<span class="cp">21		engine_id		Slot number of the flow-switching engine</span>

<span class="cp">22-23		sampling_interval	First two bits hold the sampling mode; remaining 14 bits hold value of sampling interval</span>



<span class="cp">Flow record format</span>

<span class="cp">Bytes		Contents		Description</span>



<span class="cp">0-3		srcaddr			Source IP address</span>

<span class="cp">4-7		dstaddr			Destination IP address</span>

<span class="cp">8-11		nexthop			IP address of next hop router</span>

<span class="cp">12-13		input			SNMP index of input interface</span>

<span class="cp">14-15		output			SNMP index of output interface</span>

<span class="cp">16-19		dPkts			Packets in the flow</span>

<span class="cp">20-23		dOctets			Total number of Layer 3 bytes in the packets of the flow</span>

<span class="cp">24-27		first			SysUptime at start of flow</span>

<span class="cp">28-31		last			SysUptime at the time the last packet of the flow was received</span>

<span class="cp">32-33		srcport			TCP/UDP source port number or equivalent</span>

<span class="cp">34-35		dstport			TCP/UDP destination port number or equivalent</span>

<span class="cp">36		pad1			Unused (zero) bytes</span>

<span class="cp">37		tcp_flags		Cumulative OR of TCP flags</span>

<span class="cp">38		prot			IP protocol type (for example, TCP = 6; UDP = 17)</span>

<span class="cp">39		tos			IP type of service (ToS)</span>

<span class="cp">40-41		src_as			Autonomous system number of the source, either origin or peer</span>

<span class="cp">42-43		dst_as			Autonomous system number of the destination, either origin or peer</span>

<span class="cp">44		src_mask		Source address prefix mask bits</span>

<span class="cp">45		dst_mask		Destination address prefix mask bits</span>

<span class="cp">46-47		pad2			Unused (zero) bytes</span>

</pre></div>
← newer dump
older dump →