netflow

README

netflow

Netflow processing code

Documentation

Index

• Constants
• Variables
• type NFv5
  • func (nf *NFv5) Decode(b []byte) (err error)
  • func (nf *NFv5) Read(rdr io.Reader) error
  • func (nf *NFv5) String() (s string)
  • func (nf *NFv5) ValidateSize(b []byte) (n int, err error)
• type NFv5Header
  • func (h *NFv5Header) Decode(b []byte) error
  • func (h *NFv5Header) Read(rdr io.Reader) error
• type NFv5Record
  • func (nr *NFv5Record) Decode(b []byte) error
  • func (nr *NFv5Record) Read(rdr io.Reader) error

Constants

const (
	HeaderSize int = 24
	RecordSize int = 48
)

Variables

var (
	ErrHeaderTooShort      = errors.New("Buffer to small for Netflow V5 header")
	ErrInvalidCount        = errors.New("V5 record count is invalid")
	ErrInvalidRecordBuffer = errors.New("Buffer too small for V5 record")
	ErrInvalidFlowType     = errors.New("Not a valid Netflow V5 flow")
)

Types

type NFv5

type NFv5 struct {
	NFv5Header
	Recs [30]NFv5Record
}

func (*NFv5) Decode

func (nf *NFv5) Decode(b []byte) (err error)

func (*NFv5) Read

func (nf *NFv5) Read(rdr io.Reader) error

Read a netflow 4 entry from a stream reader

func (*NFv5) String

func (nf *NFv5) String() (s string)

TODO - fill this out

func (*NFv5) ValidateSize

func (nf *NFv5) ValidateSize(b []byte) (n int, err error)

type NFv5Header

type NFv5Header struct {
	Version        uint16
	Count          uint16
	Uptime         uint32
	Sec            uint32
	Nsec           uint32
	Sequence       uint32
	EngineType     byte
	EngineID       byte
	SampleMode     byte
	SampleInterval uint16
}

func (*NFv5Header) Decode

func (h *NFv5Header) Decode(b []byte) error

Decode uses the golang standard method of extracting items using the binary package

func (*NFv5Header) Read

func (h *NFv5Header) Read(rdr io.Reader) error

type NFv5Record

type NFv5Record struct {
	Src         net.IP
	Dst         net.IP
	Next        net.IP
	Input       uint16
	Output      uint16
	Pkts        uint32
	Bytes       uint32
	UptimeFirst uint32
	UptimeLast  uint32
	SrcPort     uint16
	DstPort     uint16
	Pad         byte
	Flags       byte
	Protocol    byte
	ToS         byte
	SrcAs       uint16
	DstAs       uint16
	SrcMask     byte
	DstMask     byte
	Pad2        uint16
	// contains filtered or unexported fields
}

func (*NFv5Record) Decode

func (nr *NFv5Record) Decode(b []byte) error

Decode pulls a record out of the provided buffer no pointers are held on the buffer, so it can be reused

func (*NFv5Record) Read

func (nr *NFv5Record) Read(rdr io.Reader) error

Read a netflow 4 record from a stream reader