netflow5

Documentation

Overview

Package netflow5 contains decoders for the NetFlow version 5 protocol.

About

The Version 5 (V5) format is an enhancement that adds Border Gateway Protocol (BGP) autonomous system information and flow sequence numbers.

Index

• Constants
• func Dump(p *Packet)
• type Decoder
  • func NewDecoder() *Decoder
  • func (d *Decoder) Read(r io.Reader) error
• type FlowRecord
  • func (f FlowRecord) SampleInterval() int
  • func (r FlowRecord) String() string
  • func (r *FlowRecord) Unmarshal(h io.Reader) error
• type Packet
  • func Read(r io.Reader) (*Packet, error)
  • func (p *Packet) Unmarshal(r io.Reader) error
• type PacketHeader
  • func (h PacketHeader) String() string
  • func (h *PacketHeader) Unmarshal(r io.Reader) error

Constants

const (
	// Version word in the Packet Header
	Version uint16 = 0x0005
)

Functions

func Dump

func Dump(p *Packet)

Types

type Decoder

type Decoder struct {
}

func NewDecoder

func NewDecoder() *Decoder

func (*Decoder) Read

func (d *Decoder) Read(r io.Reader) error

type FlowRecord

type FlowRecord struct {
	// SrcAddr is the Source IP address
	SrcAddr net.IP // 0-3
	// DstAddr is the Destination IP address
	DstAddr net.IP // 4-7
	// NextHop is the IP address of next hop router
	NextHop net.IP // 8-11
	// Input is the SNMP index of input interface
	Input uint16 // 12-13
	// Output is the SNMP index of output interface
	Output uint16 // 14-15
	// Packets is the number of packets in the flow
	Packets uint32 // 16-19
	// Octets is the number of bytes in the flow
	Bytes uint32 // 20-23
	// First is the SysUptime at start of flow
	First uint32 // 24-27
	// Last is the SysUptime at end of flow
	Last uint32 // 28-31
	// SrcPort is the TCP/UDP source port number or equivalent
	SrcPort uint16 // 32-33
	// DstPort is the TCP/UDP destination port number or equivalent
	DstPort uint16 // 34-35
	// Pad1 are unused bytes
	Pad1 uint8 // 36
	// TCP Flags
	TCPFlags uint8 // 37
	// Protocol number
	Protocol uint8 // 38
	// ToS is the IP type of service
	ToS uint8 // 39
	// SrcAS is the source Autonomous System Number
	SrcAS uint16 // 40-41
	// DstAS is the source Autonomous System Number
	DstAS uint16 // 42-43
	// SrcMask is the source network mask
	SrcMask uint8 // 44
	// DstMask is the destination network mask
	DstMask uint8 // 45
	// Pad2 are unused bytes
	Pad2 uint16 // 46-47
}

FlowRecord is a NetFlow v1 Flow Record

func (FlowRecord) SampleInterval

func (f FlowRecord) SampleInterval() int

func (FlowRecord) String

func (r FlowRecord) String() string

func (*FlowRecord) Unmarshal

func (r *FlowRecord) Unmarshal(h io.Reader) error

type Packet

type Packet struct {
	Header  PacketHeader
	Records []*FlowRecord
}

Packet is a NetFlow v1 packet

func Read

func Read(r io.Reader) (*Packet, error)

func (*Packet) Unmarshal

func (p *Packet) Unmarshal(r io.Reader) error

type PacketHeader

type PacketHeader struct {
	Version          uint16
	Count            uint16
	SysUptime        time.Duration // 32 bit milliseconds
	Unix             time.Time     // 32 bit seconds + 32 bit nanoseconds
	FlowSequence     uint32
	EngineType       uint8
	EngineID         uint8
	SamplingInterval uint16
}

PacketHeader is a NetFlow v1 packet

func (PacketHeader) String

func (h PacketHeader) String() string

func (*PacketHeader) Unmarshal

func (h *PacketHeader) Unmarshal(r io.Reader) error