pkg

package
v0.0.0-...-8e12626 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 23, 2020 License: MIT Imports: 16 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var DataChannel chan string

Functions

func BulkAdd 

func BulkAdd(data []string) error

func CreateEs 

func CreateEs(data, typed, id string) error

func InitEs 

func InitEs(hostUrl, indexName string)

func ParseSflowV5ToEs 

func ParseSflowV5ToEs(sample *FlowSamples, counter *SFlowCounterSample) (string, error)
func Search(index, typs string)

Types

type BinaryRecordV5 

type BinaryRecordV5 struct {
	Ipv4SrcAddrInt uint32 `json:"-" codec:"-"`
	Ipv4DstAddrInt uint32 `json:"-" codec:"-"`
	Ipv4NextHopInt uint32 `json:"-" codec:"-"`

	RecordBaseV5
}

type Collected 

type Collected struct {
	DeviceName      string //设备名称
	SnapShotLen     int32
	SnapShotLenUint uint32
	Promiscuous     bool //是否开启混杂模式
	Timeout         time.Duration
	Udpbool         bool   //是否开启udp sample and netflow传输
	Host            string //udp 发送客户端及端口 127.0.0.1:8888
	CounterHost     string //udp counter 传输
	EsPath          string // elasticsearch address path
	IsEs            bool   // 是否传送到es
	Index           string // es索引名称
}

func (*Collected) CheckInfo 

func (this *Collected) CheckInfo(ppp []byte)

func (*Collected) ListenNetFlowV5 

func (this *Collected) ListenNetFlowV5(protocol, port string)

func (*Collected) ListenSFlowSample 

func (this *Collected) ListenSFlowSample(protocol, port string)

func (*Collected) ListenSflowAll 

func (this *Collected) ListenSflowAll(protocol, port string)

func (*Collected) ListenSflowCounter 

func (this *Collected) ListenSflowCounter(protocol, port string)

func (*Collected) SendUdp 

func (this *Collected) SendUdp(result string, counter bool)

type Data 

type Data struct {
	Datagram        Datagram
	DatagramVersion uint32
	AgentAddress    net.IP
	SubAgentID      uint32
	SequenceNumber  uint32
	AgentUptime     uint32
	SampleCount     uint32
}

func NewData 

func NewData() *Data

func (*Data) Init 

func (this *Data) Init(p gopacket.Packet) error

type Datagram 

type Datagram struct {
	SrcMac  string
	DstMac  string
	SrcIP   string
	DstIP   string
	SrcPort string
	DstPort string
}

原始报文信息即交换机物理设备信息

type FlowSamples 

type FlowSamples struct {
	Data                           *Data
	EnterpriseID                   string
	Format                         string
	SampleLength                   uint32
	SequenceNumber                 uint32
	SourceIDClass                  string
	SourceIDIndex                  string
	SamplingRate                   uint32
	SamplePool                     uint32
	Dropped                        uint32
	InputInterfaceFormat           uint32
	InputInterface                 uint32
	OutputInterfaceFormat          uint32
	OutputInterface                uint32
	RecordCount                    uint32
	SFlowRawPacketFlowRecord       SFlowRawPacketFlowRecord
	SFlowExtendedSwitchFlowRecord  SFlowExtendedSwitchFlowRecord
	SFlowExtendedRouterFlowRecord  SFlowExtendedRouterFlowRecord
	SFlowExtendedGatewayFlowRecord SFlowExtendedGatewayFlowRecord
	SFlowExtendedUserFlow          SFlowExtendedUserFlow
}

func NewFlowSamples 

func NewFlowSamples() *FlowSamples

func (*FlowSamples) InitFlowSampleData 

func (this *FlowSamples) InitFlowSampleData(p layers.SFlowFlowSample) error

func (*FlowSamples) InitOriginData 

func (this *FlowSamples) InitOriginData(p gopacket.Packet) error

func (*FlowSamples) ParseLayers 

func (this *FlowSamples) ParseLayers(p gopacket.Packet) error

func (*FlowSamples) SendUdp 

func (this *FlowSamples) SendUdp(result, CounterHost, Host string, counter bool)
type Header struct {
	FlowRecords   uint32 //flow流数据量
	Packets       int    //包个数
	Bytes         uint32 //字节大小
	RateBytes     uint32 //自动采样率计算
	SrcMac        string
	DstMac        string
	SrcIP         string
	DstIP         string
	Ipv4_version  uint8
	Ipv4_ihl      uint8
	Ipv4_tos      uint8
	Ipv4_ttl      uint8
	Ipv4_protocol string
	SrcPort       string //如果是icmp的就只把数据写入这个
	DstPort       string
}

flow流详细信息

type HeaderV5 

type HeaderV5 struct {
	Version          uint16 `json:"version" codec:"version"`
	FlowRecords      uint16 `json:"flow_records" codec:"flow_records"`
	Uptime           uint32 `json:"uptime" codec:"uptime"`
	UnixSec          uint32 `json:"unix_sec" codec:"unix_sec"`
	UnixNsec         uint32 `json:"unix_nsec" codec:"unix_nsec"`
	FlowSeqNum       uint32 `json:"flow_seq_num" codec:"flow_seq_num"`
	EngineType       uint8  `json:"engine_type" codec:"engine_type"`
	EngineId         uint8  `json:"engine_id" codec:"engine_id"`
	SamplingInterval uint16 `json:"sampling_interval" codec:"sampling_interval"`
}

type NetFlowV5 

type NetFlowV5 struct {
	HeaderV5
	BinaryRecordV5

	Host              string `json:"host" codec:"host"`
	SamplingAlgorithm uint8  `json:"sampling_algorithm" codec:"sampling_algorithm"`
	Ipv4SrcAddr       string `json:"ipv4_src_addr" codec:"ipv4_src_addr"`
	Ipv4DstAddr       string `json:"ipv4_dst_addr" codec:"ipv4_dst_addr"`
	Ipv4NextHop       string `json:"ipv4_next_hop" codec:"ipv4_next_hop"`
}

func (*NetFlowV5) DecodeNetFlowV5 

func (this *NetFlowV5) DecodeNetFlowV5(header *HeaderV5, binRecord *BinaryRecordV5, ip string) NetFlowV5

func (*NetFlowV5) IntToIPv4Addr 

func (this *NetFlowV5) IntToIPv4Addr(intAddr uint32) net.IP

func (*NetFlowV5) PayLoadToNetFlowV5 

func (this *NetFlowV5) PayLoadToNetFlowV5(data []byte, host string) []string

func (this *NetFlowV5) PayLoadToNetFlowV5(data []byte, host string) []NetFlowV5 {

type RecordBaseV5 

type RecordBaseV5 struct {
	InputSnmp     uint16 `json:"input_snmp" codec:"input_snmp"`
	OutputSnmp    uint16 `json:"output_snmp" codec:"output_snmp"`
	InPkts        uint32 `json:"in_pkts" codec:"in_pkts"`
	InBytes       uint32 `json:"in_bytes" codec:"in_bytes"`
	FirstSwitched uint32 `json:"first_switched" codec:"first_switched"`
	LastSwitched  uint32 `json:"last_switched" codec:"last_switched"`
	L4SrcPort     uint16 `json:"l4_src_port" codec:"l4_src_port"`
	L4DstPort     uint16 `json:"l4_dst_port" codec:"l4_dst_port"`

	TcpFlags uint8  `json:"tcp_flags" codec:"tcp_flags"`
	Protocol uint8  `json:"protocol" codec:"protocol"`
	SrcTos   uint8  `json:"src_tos" codec:"src_tos"`
	SrcAs    uint16 `json:"src_as" codec:"src_as"`
	DstAs    uint16 `json:"dst_as" codec:"dst_as"`
	SrcMask  uint8  `json:"src_mask" codec:"src_mask"`
	DstMask  uint8  `json:"dst_mask" codec:"dst_mask"`
	// contains filtered or unexported fields
}

type SFlowBaseCounterRecord 

type SFlowBaseCounterRecord struct {
	EnterpriseID   string
	Format         string
	FlowDataLength uint32
}

type SFlowBaseFlowRecord 

type SFlowBaseFlowRecord struct {
	EnterpriseID   string
	Format         string
	FlowDataLength uint32
}

SFlowBaseFlowRecord holds the fields common to all records of type SFlowFlowRecordType

type SFlowCounterSample 

type SFlowCounterSample struct {
	Data                          Data
	EnterpriseID                  string
	Format                        string
	SampleLength                  uint32
	SequenceNumber                uint32
	SourceIDClass                 string
	SourceIDIndex                 string
	RecordCount                   uint32
	SFlowGenericInterfaceCounters SFlowGenericInterfaceCounters
	SFlowEthernetCounters         SFlowEthernetCounters
	SFlowProcessorCounters        SFlowProcessorCounters
}

Counter samples report information about various counter objects. Typically these are items like IfInOctets, or CPU / Memory stats, etc. SFlow will report these at regular intervals as configured on the agent. If one were sufficiently industrious, this could be used to replace the typical SNMP polling used for such things.

func NewCounterFlow 

func NewCounterFlow() *SFlowCounterSample

func (*SFlowCounterSample) InitCounterSample 

func (this *SFlowCounterSample) InitCounterSample(p layers.SFlowCounterSample) error

func (*SFlowCounterSample) InitCounterSampleStruct 

func (this *SFlowCounterSample) InitCounterSampleStruct(p *layers.SFlowDatagram) error

func (*SFlowCounterSample) InitOriginData 

func (this *SFlowCounterSample) InitOriginData(p gopacket.Packet) error

type SFlowEthernetCounters 

type SFlowEthernetCounters struct {
	SFlowBaseCounterRecord    SFlowBaseCounterRecord
	AlignmentErrors           uint32
	FCSErrors                 uint32
	SingleCollisionFrames     uint32
	MultipleCollisionFrames   uint32
	SQETestErrors             uint32
	DeferredTransmissions     uint32
	LateCollisions            uint32
	ExcessiveCollisions       uint32
	InternalMacTransmitErrors uint32
	CarrierSenseErrors        uint32
	FrameTooLongs             uint32
	InternalMacReceiveErrors  uint32
	SymbolErrors              uint32
}

type SFlowEthernetFrameRecord 

type SFlowEthernetFrameRecord struct {
	//为2代表是Ethernet Frame Data字段
	Format uint32
	//总的字节数（不包含tag和length字段）
	Length uint32
	//源mac地址8字节
	SrcMac []byte
	//目的mac地址8字节
	DstMac []byte
	Type   uint32
}

0 15 31 +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ | Tag | +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ | Length | +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ | Length Bytes | +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ | Src Mac | Dst Mac | +--+--+--+--+--+--+--+--+

type SFlowExtendedGatewayFlowRecord 

type SFlowExtendedGatewayFlowRecord struct {
	SFlowBaseFlowRecord SFlowBaseFlowRecord
	NextHop             net.IP
	AS                  uint32
	SourceAS            uint32
	PeerAS              uint32
	ASPathCount         uint32
	ASPath              []layers.SFlowASDestination
	Communities         []uint32
	LocalPref           uint32
}

type SFlowExtendedRouterFlowRecord 

type SFlowExtendedRouterFlowRecord struct {
	SFlowBaseFlowRecord    SFlowBaseFlowRecord
	NextHop                net.IP
	NextHopSourceMask      uint32
	NextHopDestinationMask uint32
}

SFlowExtendedRouterFlowRecord gives additional information about the layer 3 routing information used to forward the packet

type SFlowExtendedSwitchFlowRecord 

type SFlowExtendedSwitchFlowRecord struct {
	SFlowBaseFlowRecord  SFlowBaseFlowRecord
	IncomingVLAN         uint32
	IncomingVLANPriority uint32
	OutgoingVLAN         uint32
	OutgoingVLANPriority uint32
}

SFlowExtendedSwitchFlowRecord give additional information about the sampled packet if it's available. It's mainly useful for getting at the incoming and outgoing VLANs An agent may or may not provide this information.

type SFlowExtendedUserFlow 

type SFlowExtendedUserFlow struct {
	SFlowBaseFlowRecord SFlowBaseFlowRecord
	SourceCharSet       string
	SourceUserID        string
	DestinationCharSet  string
	DestinationUserID   string
}

type SFlowGenericInterfaceCounters 

type SFlowGenericInterfaceCounters struct {
	SFlowBaseCounterRecord SFlowBaseCounterRecord
	IfIndex                uint32
	IfType                 uint32
	IfSpeed                uint64
	IfDirection            uint32
	IfStatus               uint32
	IfInOctets             uint64
	IfInUcastPkts          uint32
	IfInMulticastPkts      uint32
	IfInBroadcastPkts      uint32
	IfInDiscards           uint32
	IfInErrors             uint32
	IfInUnknownProtos      uint32
	IfOutOctets            uint64
	IfOutUcastPkts         uint32
	IfOutMulticastPkts     uint32
	IfOutBroadcastPkts     uint32
	IfOutDiscards          uint32
	IfOutErrors            uint32
	IfPromiscuousMode      uint32
}

type SFlowProcessorCounters 

type SFlowProcessorCounters struct {
	SFlowBaseCounterRecord SFlowBaseCounterRecord
	FiveSecCpu             uint32 // 5 second average CPU utilization
	OneMinCpu              uint32 // 1 minute average CPU utilization
	FiveMinCpu             uint32 // 5 minute average CPU utilization
	TotalMemory            uint64 // total memory (in bytes)
	FreeMemory             uint64 // free memory (in bytes)
}

type SFlowRawPacketFlowRecord 

type SFlowRawPacketFlowRecord struct {
	SFlowBaseFlowRecord SFlowBaseFlowRecord
	HeaderProtocol      string
	FrameLength         uint32
	PayloadRemoved      uint32
	HeaderLength        uint32
	Header              Header
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.