Documentation ¶
Overview ¶
Package nfdump this libraries purpose is to allow a Go program to natively proess NFDump files without the need for CLI tools.
Index ¶
Constants ¶
const ( ExtensionMapRecordHeadType = 2 ExporterInfoRecordHeadType = 7 ExporterStatRecordHeadType = 8 SamplerInfoRecordHeadType = 9 EmptyRecordHeadType = 0 )
Variables ¶
var ( // ErrBadMagic file magic does not match expected value ErrBadMagic = fmt.Errorf("bad file magic") ErrUnsupportedFileVersion = fmt.Errorf("Unsupported File Version") ErrFailedReadStatRecord = fmt.Errorf("Failed read StatRecord") ErrFailedReadBlockHeader = fmt.Errorf("Failed read BlockHeader") ErrFailedReadFileHeader = fmt.Errorf("Failed read NFFile Header") )
Functions ¶
This section is empty.
Types ¶
type NFBlockHeader ¶
NFBlockHeader NFDump Block Header
type NFExporterInfoRecord ¶
type NFExporterInfoRecord struct { // exporter version Version uint32 // IP address IPAddr net.IP SAFamily uint16 // internal assigned ID SysID uint16 // exporter ID/Domain ID/Observation Domain ID assigned by the device ID uint32 }
NFExporterInfoRecord exporter info record
type NFExporterStatRecord ¶
type NFExporterStatRecord struct { // internal assigned ID SysID uint32 // total sequence failures/drops SequenceFailures uint32 // packets per exporter Packets uint64 // flows per exporter Flows uint64 }
NFExporterStatRecord exporter stats record
type NFFile ¶
type NFFile struct { Header NFHeader StatRecord NFStatRecord Records []NFRecord Meta NFMeta Exporters map[uint16]NFExporterInfoRecord ExporterStats map[uint32]NFExporterStatRecord SamplerInfo map[uint16]NFSamplerInfoRecord }
NFFile NFDump Go structure representation
type NFMeta ¶
type NFMeta struct { RecordIDCount map[uint16]int BlockIDCount map[uint16]int IPv6Count int IPv4Count int ExtUsage map[uint16]int }
NFMeta store extra meta data/stats about NFDump file contents
type NFRecord ¶
type NFRecord struct { // Common Record Type Flags uint16 // MsecFirst Flow Start Time Milliseconds MsecFirst uint16 // MsecLast Flow End Time Milliseconds MsecLast uint16 // First Flow Start Time Seconds since epoch First uint32 // Last Flow End Time Seconds since epoch Last uint32 FwdStatus uint8 TCPFlags uint8 Proto uint8 Tos uint8 SrcPort uint16 DstPort uint16 ExporterSysID uint16 Reserved uint16 ICMPType uint8 ICMPCode uint8 // Required Extension 1 SrcIP net.IP DstIP net.IP // Required Extension 2 PacketCount uint64 // Required Extension 3 ByteCount uint64 // Extension 4 & 5 Input uint32 Output uint32 // Extension 6 & 7 SrcAS uint32 DstAS uint32 // Extension 8 DstTos uint8 Dir uint8 SrcMask uint8 DstMask uint8 // Extension 9 & 10 NextHopIP net.IP // Extension 11 & 12 BGPNextIP net.IP // Extension 13 SrcVlan uint16 DstVLan uint16 // Extension 14 & 15 OutPkts uint64 // Extension 16 & 17 OutBytes uint64 // Extension 18 & 19 AggeFlows uint64 // Extension 23 RouterIP net.IP // Sending router IP // Extension 27 // Received Received Time Milliseconds Received uint64 }
NFRecord Size 32 bytes Most appear to be size 96 bytes (remainder 64)
func (NFRecord) DurationMilliseconds ¶
DurationMilliseconds returns duration in milliseconds (better for high performance)
func (NFRecord) ReceivedTime ¶
ReceivedTime return Go time.Time representation of flow Received Time
func (NFRecord) StartTimeMS ¶
StartTimeMS return end time in milliseconds (better for high performance)
type NFRecordHeader ¶
NFRecordHeader NFDump record header Size 4 bytes
type NFSamplerInfoRecord ¶
type NFSamplerInfoRecord struct { // sampler data // id assigned by the exporting device ID uint32 // sampling interval Interval uint32 // sampling mode Mode uint16 // internal reference to exporter ExporterSysID uint16 }
NFSamplerInfoRecord store router sampling information
type NFStatRecord ¶
type NFStatRecord struct { NumFlows uint64 NumBytes uint64 NumPackets uint64 NumFlowsTCP uint64 NumFlowsUDP uint64 NumFlowsICMP uint64 NumFlowsOther uint64 NumBytesTCP uint64 NumBytesUDP uint64 NumBytesICMP uint64 NumBytesOther uint64 NumPacketsTCP uint64 NumPacketsUDP uint64 NumPacketsICMP uint64 NumPacketsOther uint64 FirstSeen uint32 LastSeen uint32 MSecFirst uint16 MSecLast uint16 SequenceFailure uint32 }
NFStatRecord NFDump file aggregate stats
type NFStream ¶
type NFStream struct { Header NFHeader StatRecord NFStatRecord Exporters map[uint16]NFExporterInfoRecord ExporterStats map[uint32]NFExporterStatRecord SamplerInfo map[uint16]NFSamplerInfoRecord // contains filtered or unexported fields }
NFStream keeps track of non record fields while stream processing file
func StreamReader ¶
StreamReader read nfdump file record by record with minimal memory usage