示例#1
0
文件: packet.go 项目: nyxtom/netflow
func (h *PacketHeader) Unmarshal(r io.Reader) error {
	if err := read.Uint16(&h.Version, r); err != nil {
		return err
	}
	if err := read.Uint16(&h.Count, r); err != nil {
		return err
	}
	// The spec says at most 24 flows in one packet, but reality disagrees.
	if h.Count < 1 || h.Count > 32 {
		return fmt.Errorf("protocol error: %d flows out of bounds", h.Count)
	}
	var u uint32
	if err := read.Uint32(&u, r); err != nil {
		return err
	}
	h.SysUptime = time.Duration(u)
	var t uint64
	if err := read.Uint64(&t, r); err != nil {
		return err
	}
	h.Unix = time.Unix(int64(t>>32), int64(t&0xffffffff))
	if err := read.Uint32(&h.FlowSequence, r); err != nil {
		return err
	}
	if err := read.Uint8(&h.EngineType, r); err != nil {
		return err
	}
	if err := read.Uint8(&h.EngineID, r); err != nil {
		return err
	}
	if err := read.Uint16(&h.SamplingInterval, r); err != nil {
		return err
	}
	return nil
}
示例#2
0
文件: packet.go 项目: tehmaze/netflow
func (otr *OptionsTemplateRecord) Unmarshal(r io.Reader) error {
	if err := read.Uint16(&otr.TemplateID, r); err != nil {
		return err
	}
	if err := read.Uint16(&otr.FieldCount, r); err != nil {
		return err
	}
	if err := read.Uint16(&otr.ScopeFieldCount, r); err != nil {
		return err
	}

	if otr.ScopeFieldCount > otr.FieldCount {
		return errProtocol(fmt.Sprintf("scope field count %d higher than field count %d", otr.ScopeFieldCount, otr.FieldCount))
	}

	buffer := new(bytes.Buffer)
	buffer.ReadFrom(r)
	if debug {
		hexdump(buffer.Bytes())
	}

	otr.ScopeFields = make(FieldSpecifiers, otr.ScopeFieldCount)
	if err := otr.ScopeFields.Unmarshal(buffer); err != nil {
		return err
	}

	otr.Fields = make(FieldSpecifiers, otr.FieldCount-otr.ScopeFieldCount)
	if err := otr.Fields.Unmarshal(buffer); err != nil {
		return err
	}

	return nil
}
示例#3
0
文件: packet.go 项目: tehmaze/netflow
func (fs *FieldSpecifier) Unmarshal(r io.Reader) error {
	if err := read.Uint16(&fs.InformationElementID, r); err != nil {
		if debug {
			debugLog.Println("error reading information element id", err)
		}
		return err
	}
	if err := read.Uint16(&fs.Length, r); err != nil {
		if debug {
			debugLog.Println("error reading length", err)
		}
		return err
	}
	// If the Enterprise bit is one, the Information Element identifier
	// identifies an enterprise-specific Information Element, and the Enterprise
	// Number field MUST be present.
	if fs.InformationElementID&EnterpriseBit > 0 {
		fs.EnterpriseBitSet = true
		fs.InformationElementID ^= EnterpriseBit
		if err := read.Uint32(&fs.EnterpriseNumber, r); err != nil {
			if debug {
				debugLog.Println("error reading enterprise number", err)
			}
			return err
		}
	}

	return nil
}
示例#4
0
文件: packet.go 项目: jrossi/netflow
func (f *FieldSpecifier) Unmarshal(r io.Reader) error {
	if err := read.Uint16(&f.Type, r); err != nil {
		return err
	}
	if err := read.Uint16(&f.Length, r); err != nil {
		return err
	}

	return nil
}
示例#5
0
文件: packet.go 项目: jrossi/netflow
func (h *FlowSetHeader) Unmarshal(r io.Reader) error {
	if err := read.Uint16(&h.ID, r); err != nil {
		return err
	}
	if err := read.Uint16(&h.Length, r); err != nil {
		return err
	}

	return nil
}
示例#6
0
文件: packet.go 项目: jrossi/netflow
func (tr *TemplateRecord) Unmarshal(r io.Reader) error {
	if err := read.Uint16(&tr.TemplateID, r); err != nil {
		return err
	}
	if err := read.Uint16(&tr.FieldCount, r); err != nil {
		return err
	}

	tr.Fields = make(FieldSpecifiers, tr.FieldCount)
	if err := tr.Fields.Unmarshal(r); err != nil {
		return err
	}

	return nil
}
示例#7
0
文件: packet.go 项目: tehmaze/netflow
// Unmarshal a message header from a reader.
func (h *MessageHeader) Unmarshal(r io.Reader) error {
	if err := read.Uint16(&h.Version, r); err != nil {
		return err
	}
	if err := read.Uint16(&h.Length, r); err != nil {
		return err
	}
	if err := read.Uint32(&h.ExportTime, r); err != nil {
		return err
	}
	if err := read.Uint32(&h.SequenceNumber, r); err != nil {
		return err
	}
	if err := read.Uint32(&h.ObservationDomainID, r); err != nil {
		return err
	}

	return nil
}
示例#8
0
文件: packet.go 项目: jrossi/netflow
func (h *PacketHeader) Unmarshal(r io.Reader) error {
	if err := read.Uint16(&h.Version, r); err != nil {
		return err
	}
	if err := read.Uint16(&h.Count, r); err != nil {
		return err
	}
	if err := read.Uint32(&h.SysUpTime, r); err != nil {
		return err
	}
	if err := read.Uint32(&h.UnixSecs, r); err != nil {
		return err
	}
	if err := read.Uint32(&h.SequenceNumber, r); err != nil {
		return err
	}
	if err := read.Uint32(&h.SourceID, r); err != nil {
		return err
	}

	return nil
}
示例#9
0
文件: packet.go 项目: nyxtom/netflow
func (r *FlowRecord) Unmarshal(h io.Reader) error {
	r.SrcAddr = make(net.IP, 4)
	if _, err := h.Read(r.SrcAddr); err != nil { // 0-3
		return err
	}
	r.DstAddr = make(net.IP, 4)
	if _, err := h.Read(r.DstAddr); err != nil { // 4-7
		return err
	}
	r.NextHop = make(net.IP, 4)
	if _, err := h.Read(r.NextHop); err != nil { // 8-11
		return err
	}
	if err := read.Uint16(&r.Input, h); err != nil { // 12-13
		return err
	}
	if err := read.Uint16(&r.Output, h); err != nil { // 14-15
		return err
	}
	if err := read.Uint32(&r.Packets, h); err != nil { // 16-19
		return err
	}
	if err := read.Uint32(&r.Bytes, h); err != nil { // 20-23
		return err
	}
	if err := read.Uint32(&r.First, h); err != nil { // 24-27
		return err
	}
	if err := read.Uint32(&r.Last, h); err != nil { // 28-31
		return err
	}
	if err := read.Uint16(&r.SrcPort, h); err != nil { // 32-33
		return err
	}
	if err := read.Uint16(&r.DstPort, h); err != nil { // 34-35
		return err
	}
	if err := read.Uint8(&r.Pad1, h); err != nil { // 36
		return err
	}
	if err := read.Uint8(&r.TCPFlags, h); err != nil { // 37
		return err
	}
	if err := read.Uint8(&r.Protocol, h); err != nil { // 38
		return err
	}
	if err := read.Uint8(&r.ToS, h); err != nil { // 39
		return err
	}
	if err := read.Uint16(&r.SrcAS, h); err != nil { // 40-41
		return err
	}
	if err := read.Uint16(&r.DstAS, h); err != nil { // 42-43
		return err
	}
	if err := read.Uint8(&r.SrcMask, h); err != nil { // 44
		return err
	}
	if err := read.Uint8(&r.DstMask, h); err != nil { // 45
		return err
	}
	if err := read.Uint16(&r.Pad2, h); err != nil { // 46-47
		return err
	}

	return nil
}
示例#10
0
文件: packet.go 项目: nyxtom/netflow
func (r *FlowRecord) Unmarshal(h io.Reader) error {
	r.SrcAddr = make(net.IP, 4)
	if _, err := h.Read(r.SrcAddr); err != nil {
		return err
	}
	r.DstAddr = make(net.IP, 4)
	if _, err := h.Read(r.DstAddr); err != nil {
		return err
	}
	r.NextHop = make(net.IP, 4)
	if _, err := h.Read(r.NextHop); err != nil {
		return err
	}
	if err := read.Uint16(&r.Input, h); err != nil {
		return err
	}
	if err := read.Uint16(&r.Output, h); err != nil {
		return err
	}
	if err := read.Uint32(&r.Packets, h); err != nil {
		return err
	}
	if err := read.Uint32(&r.Bytes, h); err != nil {
		return err
	}
	if err := read.Uint32(&r.First, h); err != nil {
		return err
	}
	if err := read.Uint32(&r.Last, h); err != nil {
		return err
	}
	if err := read.Uint16(&r.SrcPort, h); err != nil {
		return err
	}
	if err := read.Uint16(&r.DstPort, h); err != nil {
		return err
	}
	if err := read.Uint16(&r.Pad1, h); err != nil {
		return err
	}
	if err := read.Uint8(&r.Protocol, h); err != nil {
		return err
	}
	if err := read.Uint8(&r.ToS, h); err != nil {
		return err
	}
	if err := read.Uint8(&r.Flags, h); err != nil {
		return err
	}
	if err := read.Uint8(&r.Pad2, h); err != nil {
		return err
	}
	if err := read.Uint16(&r.Pad3, h); err != nil {
		return err
	}
	if err := read.Uint32(&r.Reserved, h); err != nil {
		return err
	}

	return nil
}