netflow1

Documentation

Overview

Package netflow1 contains decoders for the NetFlow version 1 protocol.

About

The Version 1 (V1) format is the original format supported in the initial NetFlow releases.

Index

• Constants
• func Dump(p *Packet)
• type Decoder
  • func NewDecoder() *Decoder
  • func (d *Decoder) Read(r io.Reader) error
• type FlowRecord
  • func (f FlowRecord) SampleInterval() int
  • func (r FlowRecord) String() string
  • func (r *FlowRecord) Unmarshal(h io.Reader) error
• type Packet
  • func Read(r io.Reader) (*Packet, error)
  • func (p *Packet) Unmarshal(r io.Reader) error
• type PacketHeader
  • func (h PacketHeader) String() string
  • func (h *PacketHeader) Unmarshal(r io.Reader) error

Constants

const (
	// Version word in the Packet Header
	Version uint16 = 0x0001
)

Functions

func Dump

func Dump(p *Packet)

Types

type Decoder

type Decoder struct {
}

func NewDecoder

func NewDecoder() *Decoder

func (*Decoder) Read

func (d *Decoder) Read(r io.Reader) error

type FlowRecord

type FlowRecord struct {
	// SrcAddr is the Source IP address
	SrcAddr net.IP // 0-3
	// DstAddr is the Destination IP address
	DstAddr net.IP // 4-7
	// NextHop is the IP address of next hop router
	NextHop net.IP // 8-11
	// Input is the SNMP index of input interface
	Input uint16 // 12-13
	// Output is the SNMP index of output interface
	Output uint16 // 14-15
	// Packets is the number of packets in the flow
	Packets uint32 // 16-19
	// Octets is the number of bytes in the flow
	Bytes uint32 // 20-23
	// First is the SysUptime at start of flow
	First uint32 // 24-27
	// Last is the SysUptime at end of flow
	Last uint32 // 28-31
	// SrcPort is the TCP/UDP source port number or equivalent
	SrcPort uint16 // 32-33
	// DstPort is the TCP/UDP destination port number or equivalent
	DstPort uint16 // 34-35
	// Pad1 are unused bytes
	Pad1 uint16 // 36-37
	// Protocol number (IP)
	Protocol uint8 // 38
	// ToS is the IP type of service
	ToS uint8 // 39
	// Flags are cumulative OR TCP flags
	Flags uint8 // 40
	// Pad2 are unused bytes
	Pad2 uint8
	// Pad3 are unused bytes
	Pad3 uint16
	// Reservered are reserved (unused) bytes
	Reserved uint32
}

FlowRecord is a NetFlow v1 Flow Record

func (FlowRecord) SampleInterval

func (f FlowRecord) SampleInterval() int

func (FlowRecord) String

func (r FlowRecord) String() string

func (*FlowRecord) Unmarshal

func (r *FlowRecord) Unmarshal(h io.Reader) error

type Packet

type Packet struct {
	Header  PacketHeader
	Records []*FlowRecord
}

Packet is a NetFlow v1 packet

func Read

func Read(r io.Reader) (*Packet, error)

func (*Packet) Unmarshal

func (p *Packet) Unmarshal(r io.Reader) error

type PacketHeader

type PacketHeader struct {
	Version   uint16
	Count     uint16
	SysUptime time.Duration // 32 bit milliseconds
	Unix      time.Time     // 32 bit seconds + 32 bit nanoseconds
}

PacketHeader is a NetFlow v1 packet

func (PacketHeader) String

func (h PacketHeader) String() string

func (*PacketHeader) Unmarshal

func (h *PacketHeader) Unmarshal(r io.Reader) error