This repository has been archived by the owner on Jan 30, 2021. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 11
/
Copy pathglobals-structtypes.h
2179 lines (1790 loc) · 67.3 KB
/
globals-structtypes.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/*
* -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
* http://www.ntop.org
*
* Copyright (C) 1998-2012 Luca Deri <[email protected]>
*
* -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software Foundation,
* Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*/
/* *******************************
Some nice links:
http://www.sockets.com/protocol.htm
http://www.iana.org/assignments/protocol-numbers
Courtesy of Helmut Schneider <[email protected]>
******************************* */
/*
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
*
* This file, included from ntop.h, contains the structure and typedef definitions.
*
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
*/
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
/*
* fallbacks for essential typedefs
*/
#ifdef WIN32
#ifndef __GNUC__
typedef unsigned char u_char;
typedef unsigned short u_short;
typedef unsigned int u_int;
typedef unsigned long u_long;
#endif
#if !defined(HAVE_u_int8_T)
typedef u_char u_int8_t;
#endif
#if !defined(HAVE_u_int16_T)
typedef u_short u_int16_t;
#endif
#if !defined(HAVE_u_int32_T)
typedef u_int u_int32_t;
#endif
#endif /* WIN32 */
#if !defined(HAVE_U_INT64_T)
#if defined(WIN32)
/* typedef _int64 u_int64_t; */
#else
#if defined(HAVE_u_int64_T)
#define u_int64_t u_int64_t
#else
#if defined(HAVE_UINT64_T)
#define u_int64_t uint64_t
#else
#error "Sorry, I'm unable to define u_int64_t on your platform"
#endif
#endif
#endif
#endif
#if !defined(HAVE_U_INT32_T)
#if defined(HAVE_UINT32_T)
#define u_int32_t uint32_t
#else
typedef unsigned int u_int32_t;
#endif
#endif
#if !defined(HAVE_U_INT16_T)
#if defined(HAVE_UINT16_T)
#define u_int16_t uint16_t
#else
typedef unsigned short u_int16_t;
#endif
#endif
#if !defined(HAVE_U_INT8_T)
#if defined(HAVE_UINT8_T)
#define u_int8_t uint8_t
#else
typedef unsigned char u_int8_t;
#endif
#endif
#if !defined(HAVE_INT32_T)
typedef int int32_t;
#endif
#if !defined(HAVE_INT16_T)
typedef short int16_t;
#endif
#if !defined(HAVE_INT8_T)
typedef char int8_t;
#endif
#ifndef bool
#define bool u_int8_t
#endif
typedef struct ether80211q {
u_int16_t vlanId;
u_int16_t protoType;
} Ether80211q;
/* PPPoE - Courtesy of Andreas Pfaller Feb2003 */
#ifdef HAVE_LINUX_IF_PPPOX_H
#include <linux/if_pppox.h>
#else
/* Extracted and modified from the Linux header for other systems - BMS Mar2003 */
/* And for Linux systems without if_pppox.h - BMS Apr2003 */
struct pppoe_tag {
u_int16_t tag_type;
u_int16_t tag_len;
char tag_data;
};
struct pppoe_hdr {
#ifdef CFG_LITTLE_ENDIAN
u_int8_t ver : 4;
u_int8_t type : 4;
#else
u_int8_t type : 4;
u_int8_t ver : 4;
#endif
u_int8_t code;
u_int16_t sid;
u_int16_t length;
struct pppoe_tag tag;
};
#endif
typedef struct _mac_t {
u_int8_t mact_octet[6];
} mac_t;
typedef struct hostAddr {
u_int hostFamily; /* AF_INET AF_INET6 */
union {
struct in_addr _hostIp4Address;
struct in6_addr _hostIp6Address;
} addr;
} HostAddr;
#define Ip4Address addr._hostIp4Address
#define Ip6Address addr._hostIp6Address
#define SIZEOF_HOSTSERIAL 8
#define UNKNOWN_SERIAL_INDEX 0
#define SERIAL_NONE 0
#define SERIAL_MAC 1
#define SERIAL_IPV4 2
#define SERIAL_IPV6 3
typedef struct _ethSerial {
u_char ethAddress[LEN_ETHERNET_ADDRESS];
u_int16_t vlanId;
} EthSerial;
typedef struct _ipSerial {
HostAddr ipAddress;
u_int16_t vlanId;
} IpSerial;
typedef struct hostSerial {
u_int8_t serialType; /* 0 == empty */
union {
EthSerial ethSerial; /* hostSerial == SERIAL_MAC */
IpSerial ipSerial; /* hostSerial == SERIAL_IPV4/SERIAL_IPV6 */
} value;
} HostSerial;
typedef u_int32_t HostSerialIndex;
typedef struct {
time_t dump_date;
HostSerialIndex idx;
} HostSerialIndexDump;
typedef struct {
time_t dump_date;
HostSerial serial;
} HostSerialDump;
/*
extern int emptySerial(HostSerialIndex *a);
extern int cmpSerial(HostSerialIndex *a, HostSerialIndex *b);
extern int copySerial(HostSerialIndex *a, HostSerialIndex *b);
*/
#define emptySerial(a) (*a == UNKNOWN_SERIAL_INDEX)
#define cmpSerial(a, b) (*a == *b)
#define copySerial(a, b) { *a = *b; }
#define setEmptySerial(a) { *a = UNKNOWN_SERIAL_INDEX; }
#ifdef WIN32
#define pid_t unsigned int
#ifndef RETSIGTYPE
#define RETSIGTYPE void
#endif
#endif
#ifdef MAKE_WITH_SYSLOG
/* Now, if we don't have gcc, we haven't created the facilitynames table, so do it
* manually
*/
typedef struct my_code {
char *c_name;
int c_val;
} MYCODE;
#endif
#ifdef HAVE_OPENSSL
typedef struct ssl_connection {
SSL* ctx;
int socketId;
} SSL_connection;
#endif /* HAVE_OPENSSL */
#ifdef MAKE_NTOP_PACKETSZ_DECLARATIONS /* Missing declarations */
typedef struct {
unsigned id :16; /* query identification number */
/* fields in third byte */
unsigned rd :1; /* recursion desired */
unsigned tc :1; /* truncated message */
unsigned aa :1; /* authoritive answer */
unsigned opcode :4; /* purpose of message */
unsigned qr :1; /* response flag */
/* fields in fourth byte */
unsigned rcode :4; /* response code */
unsigned unused :3; /* unused bits (MBZ as of 4.9.3a3) */
unsigned ra :1; /* recursion available */
/* remaining bytes */
unsigned qdcount :16; /* number of question entries */
unsigned ancount :16; /* number of answer entries */
unsigned nscount :16; /* number of authority entries */
unsigned arcount :16; /* number of resource entries */
} HEADER;
#endif /* MAKE_NTOP_PACKETSZ_DECLARATIONS */
typedef struct portProtoMapper {
u_int portProto; /* Port/proto to map */
u_int mappedPortProto; /* Mapped port/proto */
u_char dummyEntry; /* Set to 1 if this entry is dummy */
} PortProtoMapper;
typedef struct portProtoMapperHandler {
u_short numElements; /* numIpPortsToHandle */
int numSlots;/* numIpPortMapperSlots */
PortProtoMapper *theMapper;
} PortProtoMapperHandler;
typedef struct protocolsList {
char *protocolName;
u_int16_t protocolId, protocolIdAlias; /* I know it's ugly however this
should be enough for most of
the situations
*/
struct protocolsList *next;
} ProtocolsList;
#ifndef HAVE_RW_LOCK
#ifndef WIN32
#define pthread_rwlock_t pthread_mutex_t
#define pthread_rwlock_init pthread_mutex_init
#define pthread_rwlock_wrlock pthread_mutex_lock
#define pthread_rwlock_unlock pthread_mutex_unlock
#define pthread_rwlock_destroy pthread_mutex_destroy
/* Fix courtesy of Mark Gibbons <[email protected]> */
#define pthread_rwlock_trywrlock pthread_mutex_trylock
#endif
#endif
#ifndef WIN32
typedef struct conditionalVariable {
pthread_mutex_t mutex;
pthread_cond_t condvar;
int predicate;
} ConditionalVariable;
#else
#define pthread_t HANDLE
#define pthread_mutex_t HANDLE
#define pthread_cond_t HANDLE
#define pthread_rwlock_t HANDLE
typedef struct conditionalVariable {
HANDLE condVar;
CRITICAL_SECTION criticalSection;
} ConditionalVariable;
extern int pthread_create(pthread_t *threadId, void* notUsed, void *(*__start_routine) (void *), char* userParm);
extern void pthread_detach(pthread_t *threadId);
extern int pthread_mutex_init(pthread_mutex_t *mutex, char* notused);
extern void pthread_mutex_destroy(pthread_mutex_t *mutex);
extern int pthread_mutex_lock(pthread_mutex_t *mutex);
extern int pthread_mutex_trylock(pthread_mutex_t *mutex);
extern int pthread_mutex_unlock(pthread_mutex_t *mutex);
#endif /* WIN32 */
typedef struct holder {
struct timeval time;
pid_t pid;
pthread_t thread;
int line;
char file[5];
} Holder;
typedef struct pthreadMutex {
u_int8_t isInitialized;
#ifdef MUTEX_DEBUG
pthread_mutex_t mutex, statedatamutex;
u_int8_t isLocked;
u_int numLocks, numReleases;
Holder attempt, lock, unlock, max;
float maxLockedDuration;
#else
pthread_rwlock_t mutex;
#endif
} PthreadMutex;
typedef struct packetInformation {
unsigned short deviceId;
struct pcap_pkthdr h;
u_char p[MAX_PACKET_LEN];
} PacketInformation;
typedef struct hash_list {
u_int16_t idx; /* Index of this entry in hostTraffic */
struct hash_list *next;
} HashList;
#ifdef WIN32
typedef __int64 Counter;
#else
typedef unsigned long long Counter;
#endif
typedef struct trafficCounter {
Counter value;
u_char modified;
} TrafficCounter;
/* ******************************** */
inline static void incrementTrafficCounter(TrafficCounter *ctr, Counter value) { if(value > 0) ctr->value += value, ctr->modified = 1; }
inline static void resetTrafficCounter(TrafficCounter *ctr) { ctr->value = 0, ctr->modified = 0; }
/* ************* Types Definition ********************* */
typedef struct thptEntry {
float trafficValue;
/* ****** */
HostSerialIndex topHostSentSerial, secondHostSentSerial, thirdHostSentSerial;
TrafficCounter topSentTraffic, secondSentTraffic, thirdSentTraffic;
/* ****** */
HostSerialIndex topHostRcvdSerial, secondHostRcvdSerial, thirdHostRcvdSerial;
TrafficCounter topRcvdTraffic, secondRcvdTraffic, thirdRcvdTraffic;
} ThptEntry;
/* *********************** */
typedef struct packetStats {
TrafficCounter upTo64, upTo128, upTo256;
TrafficCounter upTo512, upTo1024, upTo1518;
#ifdef MAKE_WITH_JUMBO_FRAMES
TrafficCounter upTo2500, upTo6500, upTo9000, above9000;
#else
TrafficCounter above1518;
#endif
TrafficCounter shortest, longest;
TrafficCounter tooLong;
} PacketStats;
/* *********************** */
typedef struct ttlStats {
TrafficCounter upTo32, upTo64, upTo96;
TrafficCounter upTo128, upTo160, upTo192, upTo224, upTo255;
} TTLstats;
/* *********************** */
typedef struct simpleProtoTrafficInfo {
TrafficCounter local, local2remote, remote, remote2local; /* Bytes */
TrafficCounter totalFlows;
} SimpleProtoTrafficInfo;
/* *********************** */
typedef struct usageCounter {
TrafficCounter value;
HostSerialIndex peersSerials[MAX_NUM_CONTACTED_PEERS]; /* host serial */
} UsageCounter;
/* *********************** */
typedef struct routingCounter {
TrafficCounter routedPkts, routedBytes;
} RoutingCounter;
/* *********************** */
/* NOTE: anything added here must be also added in the SecurityDeviceProbes structure */
typedef struct securityHostProbes {
UsageCounter synPktsSent, rstPktsSent, rstAckPktsSent,
synFinPktsSent, finPushUrgPktsSent, nullPktsSent;
UsageCounter synPktsRcvd, rstPktsRcvd, rstAckPktsRcvd,
synFinPktsRcvd, finPushUrgPktsRcvd, nullPktsRcvd;
UsageCounter ackXmasFinSynNullScanSent, ackXmasFinSynNullScanRcvd;
UsageCounter rejectedTCPConnSent, rejectedTCPConnRcvd;
UsageCounter establishedTCPConnSent, establishedTCPConnRcvd;
UsageCounter terminatedTCPConnServer, terminatedTCPConnClient;
/* ********* */
UsageCounter udpToClosedPortSent, udpToClosedPortRcvd;
UsageCounter udpToDiagnosticPortSent, udpToDiagnosticPortRcvd,
tcpToDiagnosticPortSent, tcpToDiagnosticPortRcvd;
UsageCounter tinyFragmentSent, tinyFragmentRcvd;
UsageCounter icmpFragmentSent, icmpFragmentRcvd;
UsageCounter overlappingFragmentSent, overlappingFragmentRcvd;
UsageCounter closedEmptyTCPConnSent, closedEmptyTCPConnRcvd;
UsageCounter icmpPortUnreachSent, icmpPortUnreachRcvd;
UsageCounter icmpHostNetUnreachSent, icmpHostNetUnreachRcvd;
UsageCounter icmpProtocolUnreachSent, icmpProtocolUnreachRcvd;
UsageCounter icmpAdminProhibitedSent, icmpAdminProhibitedRcvd;
UsageCounter malformedPktsSent, malformedPktsRcvd;
} SecurityHostProbes;
/* NOTE: anything added here must be also added in the SecurityHostProbes structure */
typedef struct securityDeviceProbes {
TrafficCounter synPkts, rstPkts, rstAckPkts,
synFinPkts, finPushUrgPkts, nullPkts;
TrafficCounter rejectedTCPConn;
TrafficCounter establishedTCPConn;
TrafficCounter terminatedTCPConn;
TrafficCounter ackXmasFinSynNullScan;
/* ********* */
TrafficCounter udpToClosedPort;
TrafficCounter udpToDiagnosticPort, tcpToDiagnosticPort;
TrafficCounter tinyFragment;
TrafficCounter icmpFragment;
TrafficCounter overlappingFragment;
TrafficCounter closedEmptyTCPConn;
TrafficCounter malformedPkts;
TrafficCounter icmpPortUnreach;
TrafficCounter icmpHostNetUnreach;
TrafficCounter icmpProtocolUnreach;
TrafficCounter icmpAdminProhibited;
} SecurityDeviceProbes;
/* *********************** */
typedef struct sapType {
u_char dsap, ssap;
} SapType;
\
/* *********************** */
typedef struct unknownProto {
u_char protoType; /* 0=notUsed, 1=Ethernet, 2=SAP, 3=IP */
union {
u_int16_t ethType;
SapType sapType;
u_int16_t ipType;
} proto;
} UnknownProto;
/* *********************** */
typedef struct nonIPTraffic {
/* NetBIOS */
char nbNodeType, *nbHostName, *nbAccountName, *nbDomainName, *nbDescr;
/* Non IP */
TrafficCounter stpSent, stpRcvd; /* Spanning Tree */
TrafficCounter arp_rarpSent, arp_rarpRcvd;
TrafficCounter arpReqPktsSent, arpReplyPktsSent, arpReplyPktsRcvd;
TrafficCounter netbiosSent, netbiosRcvd;
TrafficCounter otherSent, otherRcvd; /* Other traffic we cannot classify */
UnknownProto *unknownProtoSent, *unknownProtoRcvd; /* List of MAX_NUM_UNKNOWN_PROTOS elements */
} NonIPTraffic;
/* *********************** */
typedef struct trafficDistribution {
TrafficCounter lastCounterBytesSent, last24HoursBytesSent[25], lastDayBytesSent;
TrafficCounter lastCounterBytesRcvd, last24HoursBytesRcvd[25], lastDayBytesRcvd;
} TrafficDistribution;
/* *********************** */
typedef struct portUsage {
u_short port, clientUses, serverUses;
HostSerialIndex clientUsesLastPeer, serverUsesLastPeer;
TrafficCounter clientTraffic, serverTraffic;
struct portUsage *next;
} PortUsage;
/* *********************** */
typedef struct hostTalker {
HostSerialIndex hostSerial;
float bps /* bytes/sec */;
} HostTalker;
/* *********************** */
typedef struct hostTalkerSeries {
HostSerialIndex hostSerial;
float total_bps /* bytes/sec */;
float bps_series[60 /* 1 x minute */];
} HostTalkerSeries;
/* *********************** */
typedef struct topTalkers {
time_t when;
HostTalker senders[MAX_NUM_TOP_TALKERS], receivers[MAX_NUM_TOP_TALKERS];
} TopTalkers;
/* *********************** */
typedef struct virtualHostList {
char *virtualHostName;
TrafficCounter bytesSent, bytesRcvd; /* ... by the virtual host */
struct virtualHostList *next;
} VirtualHostList;
/* *********************** */
typedef struct userList {
char *userName;
fd_set userFlags;
struct userList *next;
} UserList;
/* *********************** */
typedef struct fileList {
pcap_t *pcapPtr;
char *fileName;
fd_set fileFlags;
struct fileList *next;
} FileList;
/* *********************** */
typedef struct storedAddress {
char symAddress[MAX_LEN_SYM_HOST_NAME];
time_t recordCreationTime;
short symAddressType;
char pad; /* Quiet valgrind */
} StoredAddress;
/* *********************** */
typedef struct macInfo {
u_char isSpecial;
char vendorName[MAX_LEN_VENDOR_NAME];
} MACInfo;
/* *********************** */
typedef struct serviceStats {
TrafficCounter numLocalReqSent, numRemReqSent;
TrafficCounter numPositiveReplSent, numNegativeReplSent;
TrafficCounter numLocalReqRcvd, numRemReqRcvd;
TrafficCounter numPositiveReplRcvd, numNegativeReplRcvd;
time_t fastestMicrosecLocalReqMade, slowestMicrosecLocalReqMade;
time_t fastestMicrosecLocalReqServed, slowestMicrosecLocalReqServed;
time_t fastestMicrosecRemReqMade, slowestMicrosecRemReqMade;
time_t fastestMicrosecRemReqServed, slowestMicrosecRemReqServed;
} ServiceStats;
/* *********************** */
typedef struct dhcpStats {
struct in_addr dhcpServerIpAddress; /* DHCP server that assigned the address */
struct in_addr previousIpAddress; /* Previous IP address is any */
time_t assignTime; /* when the address was assigned */
time_t renewalTime; /* when the address has to be renewed */
time_t leaseTime; /* when the address lease will expire */
TrafficCounter dhcpMsgSent[MAX_NUM_DHCP_MSG + 1], dhcpMsgRcvd[MAX_NUM_DHCP_MSG + 1];
} DHCPStats;
/* *********************** */
#ifndef ICMP6_MAXTYPE
#define ICMP6_MAXTYPE 142
#endif
/* *********************** */
typedef struct icmpHostInfo {
TrafficCounter icmpMsgSent[ICMP6_MAXTYPE+1];
TrafficCounter icmpMsgRcvd[ICMP6_MAXTYPE+1];
time_t lastUpdated;
} IcmpHostInfo;
/* *********************** */
typedef struct protocolInfo {
/* HTTP */
VirtualHostList *httpVirtualHosts;
/* POP3/SMTP... */
UserList *userList;
ServiceStats *dnsStats, *httpStats;
DHCPStats *dhcpStats;
} ProtocolInfo;
/* *********************** */
typedef struct shortProtoTrafficInfo {
TrafficCounter sent, rcvd; /* Bytes */
} ShortProtoTrafficInfo;
/* *********************** */
typedef struct protoTrafficInfo {
TrafficCounter sentLoc, sentRem;
TrafficCounter rcvdLoc, rcvdFromRem;
TrafficCounter pktSent, pktRcvd;
TrafficCounter totalFlows;
} ProtoTrafficInfo;
/* *********************** */
#define MAX_NUM_NON_IP_PROTO_TRAFFIC_INFO 8
typedef struct nonIpProtoTrafficInfo {
u_int16_t protocolId;
TrafficCounter sentBytes, rcvdBytes;
TrafficCounter sentPkts, rcvdPkts;
struct nonIpProtoTrafficInfo *next;
} NonIpProtoTrafficInfo;
/* **************************** */
typedef struct networkDelay {
struct timeval last_update;
u_long min_nw_delay, max_nw_delay;
u_int num_samples;
double total_delay;
u_int16_t peer_port;
HostSerialIndex last_peer;
} NetworkDelay;
/* **************************** */
typedef struct {
Counter bytesSent, bytesRcvd;
} ProtoTraffic;
#define hostIp4Address hostIpAddress.Ip4Address
#define hostIp6Address hostIpAddress.Ip6Address
/* Host Traffic */
typedef struct hostTraffic {
u_int8_t to_be_deleted; /* 1 = the host will be deleted in the next purge loop */
u_short magic;
u_int8_t l2Host; /* 1 = Ethernet, 0 = IP and above */
u_int hostTrafficBucket; /* Index in the **hash_hostTraffic list */
u_short refCount; /* Reference counter */
HostSerial hostSerial;
HostSerialIndex serialHostIndex; /* Stored in myGlobals.serialFile and valid until ntop restart */
HostAddr hostIpAddress;
u_int16_t vlanId; /* VLAN Id (-1 if not set) */
u_int16_t ifId; /* Interface Id [e.g. for NetFlow] (-1 if not set) */
u_int16_t hostAS; /* AS to which the host belongs to */
char *hostASDescr; /* Description of the host AS */
time_t firstSeen, lastSeen; /* time when this host has sent/rcvd some data */
u_char ethAddress[LEN_ETHERNET_ADDRESS];
u_char lastEthAddress[LEN_ETHERNET_ADDRESS]; /* used for remote addresses */
char ethAddressString[LEN_ETHERNET_ADDRESS_DISPLAY];
char hostNumIpAddress[20] /* xxx.xxx.xxx.xxx */, *dnsDomainValue, *dnsTLDValue;
u_int8_t network_mask; /* IPv6 notation e.g. /24 */
int8_t known_subnet_id; /* UNKNOWN_SUBNET_ID if the host does not belong to a known subnet */
char *hwModel, *description, *community, *fingerprint;
char hostResolvedName[MAX_LEN_SYM_HOST_NAME];
short hostResolvedNameType;
u_short minTTL, maxTTL; /* IP TTL (Time-To-Live) */
struct timeval minLatency, maxLatency;
GeoIPRecord *geo_ip;
TrafficCounter greSent, greRcvd, grePktSent, grePktRcvd, lastGrePktSent, lastGrePktRcvd;
TrafficCounter ipsecSent, ipsecRcvd, ipsecPktSent, ipsecPktRcvd, lastIpsecPktSent, lastIpsecPktRcvd;
/* Sketches */
CM_type *sent_to_matrix, *recv_from_matrix;
NonIPTraffic *nonIPTraffic;
NonIpProtoTrafficInfo *nonIpProtoTrafficInfos; /* Info about further non IP protos */
fd_set flags;
TrafficCounter pktsSent, pktsRcvd, pktsSentSession, pktsRcvdSession;
TrafficCounter pktsDuplicatedAckSent, pktsDuplicatedAckRcvd;
TrafficCounter pktsBroadcastSent, bytesBroadcastSent;
TrafficCounter pktsMulticastSent, bytesMulticastSent;
TrafficCounter pktsMulticastRcvd, bytesMulticastRcvd;
TrafficCounter lastBytesSent, lastHourBytesSent;
TrafficCounter bytesSent, bytesSentLoc, bytesSentRem, bytesSentSession;
TrafficCounter lastBytesRcvd, lastHourBytesRcvd, bytesRcvd;
TrafficCounter bytesRcvdLoc, bytesRcvdFromRem, bytesRcvdSession;
float actualRcvdThpt, lastHourRcvdThpt, averageRcvdThpt, peakRcvdThpt;
float actualSentThpt, lastHourSentThpt, averageSentThpt, peakSentThpt;
float actualThpt, averageThpt /* REMOVE */, peakThpt;
unsigned short actBandwidthUsage, actBandwidthUsageS, actBandwidthUsageR;
TrafficDistribution *trafficDistribution;
u_int32_t numHostSessions;
/* Routing */
RoutingCounter *routedTraffic;
/* IP */
PortUsage *portsUsage; /* 0...MAX_ASSIGNED_IP_PORTS */
/* NetworkDelay Stats */
NetworkDelay *clientDelay /* 0..MAX_NUM_NET_DELAY_STATS-1 */, *serverDelay /* 0 ..MAX_NUM_NET_DELAY_STATS-1 */;
/* Don't change the recentl... to unsigned ! */
int recentlyUsedClientPorts[MAX_NUM_RECENT_PORTS], recentlyUsedServerPorts[MAX_NUM_RECENT_PORTS];
int otherIpPortsRcvd[MAX_NUM_RECENT_PORTS], otherIpPortsSent[MAX_NUM_RECENT_PORTS];
TrafficCounter ipv4BytesSent, ipv4BytesRcvd, ipv6BytesSent, ipv6BytesRcvd;
TrafficCounter tcpSentLoc, tcpSentRem, udpSentLoc, udpSentRem, icmpSent,icmp6Sent;
TrafficCounter tcpRcvdLoc, tcpRcvdFromRem, udpRcvdLoc, udpRcvdFromRem, icmpRcvd, icmp6Rcvd;
TrafficCounter tcpFragmentsSent, tcpFragmentsRcvd, udpFragmentsSent, udpFragmentsRcvd,
icmpFragmentsSent, icmpFragmentsRcvd, icmp6FragmentsSent, icmp6FragmentsRcvd;
/* Protocol decoders */
ProtocolInfo *protocolInfo;
/* Interesting Packets */
SecurityHostProbes *secHostPkts;
IcmpHostInfo *icmpInfo;
ShortProtoTrafficInfo **ipProtosList; /* List of myGlobals.numIpProtosList entries */
Counter totContactedSentPeers, totContactedRcvdPeers; /* # of different contacted peers */
struct hostTraffic *next; /* pointer to the next element */
UsageCounter contactedSentPeers; /* peers that talked with this host */
UsageCounter contactedRcvdPeers; /* peers that talked with this host */
struct {
ProtoTraffic *traffic;
} l7;
} HostTraffic;
/* **************************** */
typedef struct domainStats {
HostTraffic *domainHost; /* ptr to a host that belongs to the domain */
char *communityName;
int8_t known_subnet_id;
TrafficCounter bytesSent, bytesRcvd;
TrafficCounter tcpSent, udpSent;
TrafficCounter icmpSent,icmp6Sent;
TrafficCounter tcpRcvd, udpRcvd;
TrafficCounter icmpRcvd,icmp6Rcvd;
} DomainStats;
/* *********************** */
typedef struct ipFragment {
struct hostTraffic *src, *dest;
char fragmentOrder;
u_int fragmentId, lastOffset, lastDataLength;
u_int totalDataLength, expectedDataLength;
u_int totalPacketLength;
u_short sport, dport;
time_t firstSeen;
struct ipFragment *prev, *next;
} IpFragment;
/* **************************** */
typedef struct trafficEntry {
TrafficCounter pktsSent, bytesSent;
TrafficCounter pktsRcvd, bytesRcvd;
u_short vsanId;
} TrafficEntry;
typedef struct serviceEntry {
u_short port;
char* name;
} ServiceEntry;
typedef struct portCounter {
u_short port;
Counter sent, rcvd;
} PortCounter;
/* IP Session Information */
typedef struct ipSession {
u_short magic;
u_int8_t proto; /* IPPROTO_TCP / IPPROTO_UDP... */
u_char isP2P; /* Set to 1 if this is a P2P session */
u_int8_t knownProtocolIdx; /* Mark this as a special protocol session */
HostTraffic* initiator; /* initiator address */
HostAddr initiatorRealIp; /* Real IP address (if masqueraded and known) */
u_short sport; /* initiator address (port) */
HostTraffic *remotePeer; /* remote peer address */
HostAddr remotePeerRealIp; /* Real IP address (if masqueraded and known) */
char *virtualPeerName; /* Name of a virtual host (e.g. HTTP virtual host) */
u_short dport; /* remote peer address (port) */
time_t firstSeen; /* time when the session has been initiated */
time_t lastSeen; /* time when the session has been closed */
u_long pktSent, pktRcvd;
TrafficCounter bytesSent; /* # bytes sent (initiator -> peer) [IP] */
TrafficCounter bytesRcvd; /* # bytes rcvd (peer -> initiator)[IP] */
TrafficCounter bytesProtoSent; /* # bytes sent (Protocol [e.g. HTTP]) */
TrafficCounter bytesProtoRcvd; /* # bytes rcvd (Protocol [e.g. HTTP]) */
u_int minWindow, maxWindow; /* TCP window size */
struct timeval synTime, synAckTime, ackTime; /* Used to calcolate nw delay */
struct timeval clientNwDelay, serverNwDelay; /* Network Delay/Latency */
u_short numFin; /* # FIN pkts rcvd */
u_short numFinAcked; /* # ACK pkts rcvd */
u_int32_t lastAckIdI2R; /* ID of the last ACK rcvd */
u_int32_t lastAckIdR2I; /* ID of the last ACK rcvd */
TrafficCounter bytesRetranI2R; /* # bytes retransmitted (due to duplicated ACKs) */
TrafficCounter bytesRetranR2I; /* # bytes retransmitted (due to duplicated ACKs) */
u_int32_t finId[MAX_NUM_FIN]; /* ACK ids we're waiting for */
u_long lastFlags; /* flags of the last TCP packet */
u_int32_t lastCSAck, lastSCAck; /* they store the last ACK ids C->S/S->C */
u_int32_t lastCSFin, lastSCFin; /* they store the last FIN ids C->S/S->C */
u_char lastInitiator2RemFlags[MAX_NUM_STORED_FLAGS]; /* TCP flags */
u_char lastRem2InitiatorFlags[MAX_NUM_STORED_FLAGS]; /* TCP flags */
u_char sessionState; /* actual session state */
u_char passiveFtpSession; /* checked if this is a passive FTP session */
u_char voipSession; /* checked if this is a VoIP session */
char *session_info; /* Info about this session (if any) */
struct ipSession *next;
struct {
u_int8_t proto_guessed;
u_int16_t major_proto;
struct ipoque_flow_struct *flow;
struct ipoque_id_struct *src, *dst;
} l7;
} IPSession;
/* ************************************* */
typedef struct ntopIfaceAddrInet {
struct in_addr ifAddr;
struct in_addr network;
struct in_addr netmask;
} NtopIfaceAddrInet;
typedef struct ntopIfaceAddrInet6 {
struct in6_addr ifAddr;
int prefixlen;
} NtopIfaceAddrInet6;
typedef struct ntopIfaceaddr{
int family;
struct ntopIfaceaddr *next;
union {
NtopIfaceAddrInet inet;
NtopIfaceAddrInet6 inet6;
} af;
} NtopIfaceAddr;
/* ************************************* */
/* Flow aggregation */
typedef enum {
noAggregation = 0,
portAggregation,
hostAggregation,
protocolAggregation,
asAggregation
} AggregationType;
typedef enum {
noDnsResolution = 0,
dnsResolutionForLocalHostsOnly = 1,
dnsResolutionForLocalRemoteOnly = 2,
dnsResolutionForAll = 3
} DnsResolutionMode;
typedef struct probeInfo {
struct in_addr probeAddr;
u_int16_t probePort;
u_int32_t pkts;
u_int32_t lastSequenceNumber, lowestSequenceNumber, highestSequenceNumber, totNumFlows;
u_int32_t lostFlows;
} ProbeInfo;
/* Flow aggregation */
typedef enum {
hostCreation = 1,
hostDeletion = 1 << 2,
sessionCreation = 1 << 3,
sessionDeletion = 1 << 4,
hostFlagged = 1 << 5,
hostUnflagged = 1 << 6
} EventType;
/* *************************** */
#define CONST_FLOW_VERSION_1 1
#define CONST_V1FLOWS_PER_PAK 30
#define CONST_FLOW_VERSION_5 5
#define CONST_V5FLOWS_PER_PAK 30
#define CONST_FLOW_VERSION_7 7
#define CONST_V7FLOWS_PER_PAK 28
/*
For more info see:
http://www.cisco.com/warp/public/cc/pd/iosw/ioft/neflct/tech/napps_wp.htm
ftp://ftp.net.ohio-state.edu/users/maf/cisco/
*/
/* ********************************* */
struct flow_ver1_hdr {
u_int16_t version; /* Current version = 1*/
u_int16_t count; /* The number of records in PDU. */
u_int32_t sysUptime; /* Current time in msecs since router booted */
u_int32_t unix_secs; /* Current seconds since 0000 UTC 1970 */
u_int32_t unix_nsecs; /* Residual nanoseconds since 0000 UTC 1970 */
};
struct flow_ver1_rec {
u_int32_t srcaddr; /* Source IP Address */
u_int32_t dstaddr; /* Destination IP Address */
u_int32_t nexthop; /* Next hop router's IP Address */
u_int16_t input; /* Input interface index */
u_int16_t output; /* Output interface index */
u_int32_t dPkts; /* Packets sent in Duration */
u_int32_t dOctets; /* Octets sent in Duration */
u_int32_t first; /* SysUptime at start of flow */
u_int32_t last; /* and of last packet of the flow */
u_int16_t srcport; /* TCP/UDP source port number (.e.g, FTP, Telnet, etc.,or equivalent) */
u_int16_t dstport; /* TCP/UDP destination port number (.e.g, FTP, Telnet, etc.,or equivalent) */
u_int16_t pad; /* pad to word boundary */
u_int8_t proto; /* IP protocol, e.g., 6=TCP, 17=UDP, etc... */
u_int8_t tos; /* IP Type-of-Service */
u_int8_t pad2[7]; /* pad to word boundary */
};
typedef struct single_flow_ver1_rec {
struct flow_ver1_hdr flowHeader;
struct flow_ver1_rec flowRecord[CONST_V1FLOWS_PER_PAK+1 /* safe against buffer overflows */];
} NetFlow1Record;
/* ********************************* */
struct flow_ver5_hdr {
u_int16_t version; /* Current version=5*/
u_int16_t count; /* The number of records in PDU. */
u_int32_t sysUptime; /* Current time in msecs since router booted */
u_int32_t unix_secs; /* Current seconds since 0000 UTC 1970 */
u_int32_t unix_nsecs; /* Residual nanoseconds since 0000 UTC 1970 */
u_int32_t flow_sequence; /* Sequence number of total flows seen */
u_int8_t engine_type; /* Type of flow switching engine (RP,VIP,etc.)*/
u_int8_t engine_id; /* Slot number of the flow switching engine */
};
struct flow_ver5_rec {
u_int32_t srcaddr; /* Source IP Address */
u_int32_t dstaddr; /* Destination IP Address */
u_int32_t nexthop; /* Next hop router's IP Address */
u_int16_t input; /* Input interface index */