beater

Documentation

Index

• func New(b *beat.Beat, cfg *common.Config) (beat.Beater, error)
• type Config
• type FlowDirection
  • func (d FlowDirection) String() string
• type FlowEvent
• type FlowType
  • func (t FlowType) String() string
• type Flowbeat
  • func (bt *Flowbeat) Run(b *beat.Beat) error
  • func (bt *Flowbeat) Stop()
• type IPProtocol
  • func (p IPProtocol) String() string
• type Locality
  • func (l Locality) String() string
• type TCPFlag
  • func (f TCPFlag) String() string
  • func (f TCPFlag) Strings() []string

Functions

func New

func New(b *beat.Beat, cfg *common.Config) (beat.Beater, error)

New creates an instance of flowbeat.

Types

type Config

type Config struct {
	NetflowAddr       string `config:"netflow.address"`
	NetflowReadBuffer uint32 `config:"netflow.read_buffer"`
}

type FlowDirection

type FlowDirection uint8

const (
	Ingress FlowDirection = iota
	Egress
)

func (FlowDirection) String

func (d FlowDirection) String() string

type FlowEvent

type FlowEvent struct {
	TimeReceived time.Time // Time packet was read off socket.
	TimeCreated  time.Time // Time record was generated by "router".
	SequenceNum  uint32    // Message sequence number.
	Type         FlowType  // Flow type (e.g. Netflow v9, IPFIX)

	// Flow exporter's address.
	DeviceAddr net.IP

	// Flow times.
	StartTime time.Time
	LastTime  time.Time
	Duration  time.Duration

	// Flow volume.
	Bytes   uint64
	Packets uint64

	Direction *FlowDirection

	// Layer 3 info.
	SrcMAC net.HardwareAddr
	DstMAC net.HardwareAddr

	// IP version. https://www.iana.org/assignments/version-numbers/version-numbers.xhtml
	IPVersion        uint8 // 4 = ipv4, 6=ipv6
	IPClassOfTraffic uint8 // TOS for IPv4, Traffic Class for IPv6.
	SrcIP            net.IP
	DstIP            net.IP
	SrcLocality      Locality
	DstLocality      Locality
	SrcPort          uint16
	DstPort          uint16
	Locality         Locality
	TCPFlags         TCPFlag

	// Layer 4 protocol (transport). Comes from the IPv4 and IPv6 headers.
	// Netflow fields: protocolIdentifier (IPv4) and nextHeaderIPv6.
	TransportProtocol IPProtocol

	// Stable 5-tuple that's the same for both flow dirs.
	FiveTuple     string
	FiveTupleHash string

	// VLANs
	IngressVLAN uint16
	EgressVLAN  uint16

	// Raw Netflow fields.
	Netflow map[string]interface{}
}

type FlowType

type FlowType uint8

const (
	NetFlowV1 FlowType = 1
	NetFlowV5 FlowType = 5
	NetFlowV6 FlowType = 6
	NetFlowV7 FlowType = 7
	NetFlowV9 FlowType = 9
	IPFIX     FlowType = 10
)

func (FlowType) String

func (t FlowType) String() string

type Flowbeat

type Flowbeat struct {
	// contains filtered or unexported fields
}

Flowbeat configuration.

func (*Flowbeat) Run

func (bt *Flowbeat) Run(b *beat.Beat) error

Run starts flowbeat.

func (*Flowbeat) Stop

func (bt *Flowbeat) Stop()

Stop stops flowbeat.

type IPProtocol

type IPProtocol uint8

const (
	ICMP     IPProtocol = 1
	TCP      IPProtocol = 6
	UDP      IPProtocol = 17
	IPv6ICMP IPProtocol = 58
)

func (IPProtocol) String

func (p IPProtocol) String() string

type Locality

type Locality uint8

const (
	LocalityPrivate Locality = iota + 1
	LocalityPublic
)

func (Locality) String

func (l Locality) String() string

type TCPFlag

type TCPFlag uint32

const (
	NS  TCPFlag = 0x0100
	CWR TCPFlag = 0x0080
	ECE TCPFlag = 0x0040
	URG TCPFlag = 0x0020
	ACK TCPFlag = 0x0010
	PSH TCPFlag = 0x0008
	RST TCPFlag = 0x0004
	SYN TCPFlag = 0x0002
	FIN TCPFlag = 0x0001
)

func (TCPFlag) String

func (f TCPFlag) String() string

func (TCPFlag) Strings

func (f TCPFlag) Strings() []string