1 /* Copyright (c) 2002-2009 InMon Corp. Licensed under the terms of either the
2 * Sun Industry Standards Source License 1.1, that is available at:
3 * http://host-sflow.sourceforge.net/sissl.html
4 * or the InMon sFlow License, that is available at:
5 * http://www.inmon.com/technology/sflowlicense.txt
16 SFL_DSCLASS_IFINDEX = 0,
18 SFL_DSCLASS_PHYSICAL_ENTITY = 2,
19 SFL_DSCLASS_LOGICAL_ENTITY = 3
22 enum SFLAddress_type {
23 SFLADDRESSTYPE_IP_V4 = 1,
24 SFLADDRESSTYPE_IP_V6 = 2
35 typedef union _SFLAddress_value {
40 typedef struct _SFLAddress {
41 u_int32_t type; /* enum SFLAddress_type */
42 SFLAddress_value address;
45 /* Packet header data */
47 #define SFL_DEFAULT_HEADER_SIZE 128
48 #define SFL_DEFAULT_COLLECTOR_PORT 6343
49 #define SFL_DEFAULT_SAMPLING_RATE 400
50 #define SFL_DEFAULT_POLLING_INTERVAL 30
52 /* The header protocol describes the format of the sampled header */
53 enum SFLHeader_protocol {
54 SFLHEADER_ETHERNET_ISO8023 = 1,
55 SFLHEADER_ISO88024_TOKENBUS = 2,
56 SFLHEADER_ISO88025_TOKENRING = 3,
58 SFLHEADER_FRAME_RELAY = 5,
63 SFLHEADER_AAL5_IP = 10, /* e.g. Cisco AAL5 mux */
69 /* raw sampled header */
71 typedef struct _SFLSampled_header {
72 u_int32_t header_protocol; /* (enum SFLHeader_protocol) */
73 u_int32_t frame_length; /* Original length of packet before sampling */
74 u_int32_t stripped; /* header/trailer bytes stripped by sender */
75 u_int32_t header_length; /* length of sampled header bytes to follow */
76 u_int8_t *header_bytes; /* Header bytes */
79 /* decoded ethernet header */
81 typedef struct _SFLSampled_ethernet {
82 u_int32_t eth_len; /* The length of the MAC packet excluding
83 lower layer encapsulations */
84 u_int8_t src_mac[8]; /* 6 bytes + 2 pad */
87 } SFLSampled_ethernet;
89 /* decoded IP version 4 header */
91 typedef struct _SFLSampled_ipv4 {
92 u_int32_t length; /* The length of the IP packet
93 excluding lower layer encapsulations */
94 u_int32_t protocol; /* IP Protocol type (for example, TCP = 6, UDP = 17) */
95 SFLIPv4 src_ip; /* Source IP Address */
96 SFLIPv4 dst_ip; /* Destination IP Address */
97 u_int32_t src_port; /* TCP/UDP source port number or equivalent */
98 u_int32_t dst_port; /* TCP/UDP destination port number or equivalent */
99 u_int32_t tcp_flags; /* TCP flags */
100 u_int32_t tos; /* IP type of service */
103 /* decoded IP version 6 data */
105 typedef struct _SFLSampled_ipv6 {
106 u_int32_t length; /* The length of the IP packet
107 excluding lower layer encapsulations */
108 u_int32_t protocol; /* IP Protocol type (for example, TCP = 6, UDP = 17) */
109 SFLIPv6 src_ip; /* Source IP Address */
110 SFLIPv6 dst_ip; /* Destination IP Address */
111 u_int32_t src_port; /* TCP/UDP source port number or equivalent */
112 u_int32_t dst_port; /* TCP/UDP destination port number or equivalent */
113 u_int32_t tcp_flags; /* TCP flags */
114 u_int32_t priority; /* IP priority */
117 /* Extended data types */
119 /* Extended switch data */
121 typedef struct _SFLExtended_switch {
122 u_int32_t src_vlan; /* The 802.1Q VLAN id of incomming frame */
123 u_int32_t src_priority; /* The 802.1p priority */
124 u_int32_t dst_vlan; /* The 802.1Q VLAN id of outgoing frame */
125 u_int32_t dst_priority; /* The 802.1p priority */
126 } SFLExtended_switch;
128 /* Extended router data */
130 typedef struct _SFLExtended_router {
131 SFLAddress nexthop; /* IP address of next hop router */
132 u_int32_t src_mask; /* Source address prefix mask bits */
133 u_int32_t dst_mask; /* Destination address prefix mask bits */
134 } SFLExtended_router;
136 /* Extended gateway data */
137 enum SFLExtended_as_path_segment_type {
138 SFLEXTENDED_AS_SET = 1, /* Unordered set of ASs */
139 SFLEXTENDED_AS_SEQUENCE = 2 /* Ordered sequence of ASs */
142 typedef struct _SFLExtended_as_path_segment {
143 u_int32_t type; /* enum SFLExtended_as_path_segment_type */
144 u_int32_t length; /* number of AS numbers in set/sequence */
149 } SFLExtended_as_path_segment;
151 typedef struct _SFLExtended_gateway {
152 SFLAddress nexthop; /* Address of the border router that should
153 be used for the destination network */
154 u_int32_t as; /* AS number for this gateway */
155 u_int32_t src_as; /* AS number of source (origin) */
156 u_int32_t src_peer_as; /* AS number of source peer */
157 u_int32_t dst_as_path_segments; /* number of segments in path */
158 SFLExtended_as_path_segment *dst_as_path; /* list of seqs or sets */
159 u_int32_t communities_length; /* number of communities */
160 u_int32_t *communities; /* set of communities */
161 u_int32_t localpref; /* LocalPref associated with this route */
162 } SFLExtended_gateway;
164 typedef struct _SFLString {
169 /* Extended user data */
171 typedef struct _SFLExtended_user {
172 u_int32_t src_charset; /* MIBEnum value of character set used to encode a string - See RFC 2978
173 Where possible UTF-8 encoding (MIBEnum=106) should be used. A value
174 of zero indicates an unknown encoding. */
176 u_int32_t dst_charset;
180 /* Extended URL data */
182 enum SFLExtended_url_direction {
183 SFLEXTENDED_URL_SRC = 1, /* URL is associated with source address */
184 SFLEXTENDED_URL_DST = 2 /* URL is associated with destination address */
187 typedef struct _SFLExtended_url {
188 u_int32_t direction; /* enum SFLExtended_url_direction */
189 SFLString url; /* URL associated with the packet flow.
190 Must be URL encoded */
191 SFLString host; /* The host field from the HTTP header */
194 /* Extended MPLS data */
196 typedef struct _SFLLabelStack {
198 u_int32_t *stack; /* first entry is top of stack - see RFC 3032 for encoding */
201 typedef struct _SFLExtended_mpls {
202 SFLAddress nextHop; /* Address of the next hop */
203 SFLLabelStack in_stack;
204 SFLLabelStack out_stack;
208 Packet header records report addresses as seen at the sFlowDataSource.
209 The extended_nat structure reports on translated source and/or destination
210 addesses for this packet. If an address was not translated it should
211 be equal to that reported for the header. */
213 typedef struct _SFLExtended_nat {
214 SFLAddress src; /* Source address */
215 SFLAddress dst; /* Destination address */
218 /* additional Extended MPLS stucts */
220 typedef struct _SFLExtended_mpls_tunnel {
221 SFLString tunnel_lsp_name; /* Tunnel name */
222 u_int32_t tunnel_id; /* Tunnel ID */
223 u_int32_t tunnel_cos; /* Tunnel COS value */
224 } SFLExtended_mpls_tunnel;
226 typedef struct _SFLExtended_mpls_vc {
227 SFLString vc_instance_name; /* VC instance name */
228 u_int32_t vll_vc_id; /* VLL/VC instance ID */
229 u_int32_t vc_label_cos; /* VC Label COS value */
230 } SFLExtended_mpls_vc;
233 - Definitions from MPLS-FTN-STD-MIB mplsFTNTable */
235 typedef struct _SFLExtended_mpls_FTN {
236 SFLString mplsFTNDescr;
237 u_int32_t mplsFTNMask;
238 } SFLExtended_mpls_FTN;
240 /* Extended MPLS LVP FEC
241 - Definition from MPLS-LDP-STD-MIB mplsFecTable
242 Note: mplsFecAddrType, mplsFecAddr information available
243 from packet header */
245 typedef struct _SFLExtended_mpls_LDP_FEC {
246 u_int32_t mplsFecAddrPrefixLength;
247 } SFLExtended_mpls_LDP_FEC;
249 /* Extended VLAN tunnel information
250 Record outer VLAN encapsulations that have
251 been stripped. extended_vlantunnel information
252 should only be reported if all the following conditions are satisfied:
253 1. The packet has nested vlan tags, AND
254 2. The reporting device is VLAN aware, AND
255 3. One or more VLAN tags have been stripped, either
256 because they represent proprietary encapsulations, or
257 because switch hardware automatically strips the outer VLAN
259 Reporting extended_vlantunnel information is not a substitute for
260 reporting extended_switch information. extended_switch data must
261 always be reported to describe the ingress/egress VLAN information
262 for the packet. The extended_vlantunnel information only applies to
263 nested VLAN tags, and then only when one or more tags has been
266 typedef SFLLabelStack SFLVlanStack;
267 typedef struct _SFLExtended_vlan_tunnel {
268 SFLVlanStack stack; /* List of stripped 802.1Q TPID/TCI layers. Each
269 TPID,TCI pair is represented as a single 32 bit
270 integer. Layers listed from outermost to
272 } SFLExtended_vlan_tunnel;
274 typedef struct _SFLExtended_vni {
275 uint32_t vni; /* virtual network identifier */
278 enum SFLFlow_type_tag {
279 /* enterprise = 0, format = ... */
280 SFLFLOW_HEADER = 1, /* Packet headers are sampled */
281 SFLFLOW_ETHERNET = 2, /* MAC layer information */
282 SFLFLOW_IPV4 = 3, /* IP version 4 data */
283 SFLFLOW_IPV6 = 4, /* IP version 6 data */
284 SFLFLOW_EX_SWITCH = 1001, /* Extended switch information */
285 SFLFLOW_EX_ROUTER = 1002, /* Extended router information */
286 SFLFLOW_EX_GATEWAY = 1003, /* Extended gateway router information */
287 SFLFLOW_EX_USER = 1004, /* Extended TACAS/RADIUS user information */
288 SFLFLOW_EX_URL = 1005, /* Extended URL information */
289 SFLFLOW_EX_MPLS = 1006, /* Extended MPLS information */
290 SFLFLOW_EX_NAT = 1007, /* Extended NAT information */
291 SFLFLOW_EX_MPLS_TUNNEL = 1008, /* additional MPLS information */
292 SFLFLOW_EX_MPLS_VC = 1009,
293 SFLFLOW_EX_MPLS_FTN = 1010,
294 SFLFLOW_EX_MPLS_LDP_FEC = 1011,
295 SFLFLOW_EX_VLAN_TUNNEL = 1012, /* VLAN stack */
296 SFLFLOW_EX_IPV4_TUNNEL_EGRESS = 1023, /* http://sflow.org/sflow_tunnels.txt */
297 SFLFLOW_EX_IPV4_TUNNEL_INGRESS = 1024,
298 SFLFLOW_EX_VNI_EGRESS = 1029,
299 SFLFLOW_EX_VNI_INGRESS = 1030,
302 typedef union _SFLFlow_type {
303 SFLSampled_header header;
304 SFLSampled_ethernet ethernet;
305 SFLSampled_ipv4 ipv4;
306 SFLSampled_ipv6 ipv6;
307 SFLExtended_switch sw;
308 SFLExtended_router router;
309 SFLExtended_gateway gateway;
310 SFLExtended_user user;
312 SFLExtended_mpls mpls;
314 SFLExtended_mpls_tunnel mpls_tunnel;
315 SFLExtended_mpls_vc mpls_vc;
316 SFLExtended_mpls_FTN mpls_ftn;
317 SFLExtended_mpls_LDP_FEC mpls_ldp_fec;
318 SFLExtended_vlan_tunnel vlan_tunnel;
319 SFLExtended_vni tunnel_vni;
322 typedef struct _SFLFlow_sample_element {
323 struct _SFLFlow_sample_element *nxt;
324 u_int32_t tag; /* SFLFlow_type_tag */
326 SFLFlow_type flowType;
327 } SFLFlow_sample_element;
329 enum SFL_sample_tag {
330 SFLFLOW_SAMPLE = 1, /* enterprise = 0 : format = 1 */
331 SFLCOUNTERS_SAMPLE = 2, /* enterprise = 0 : format = 2 */
332 SFLFLOW_SAMPLE_EXPANDED = 3, /* enterprise = 0 : format = 3 */
333 SFLCOUNTERS_SAMPLE_EXPANDED = 4 /* enterprise = 0 : format = 4 */
336 /* Format of a single flow sample */
338 typedef struct _SFLFlow_sample {
339 /* u_int32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 1 */
340 /* u_int32_t length; */
341 u_int32_t sequence_number; /* Incremented with each flow sample
343 u_int32_t source_id; /* fsSourceId */
344 u_int32_t sampling_rate; /* fsPacketSamplingRate */
345 u_int32_t sample_pool; /* Total number of packets that could have been
346 sampled (i.e. packets skipped by sampling
347 process + total number of samples) */
348 u_int32_t drops; /* Number of times a packet was dropped due to
350 u_int32_t input; /* SNMP ifIndex of input interface.
351 0 if interface is not known. */
352 u_int32_t output; /* SNMP ifIndex of output interface,
353 0 if interface is not known.
354 Set most significant bit to indicate
355 multiple destination interfaces
356 (i.e. in case of broadcast or multicast)
357 and set lower order bits to indicate
358 number of destination interfaces.
360 0x00000002 indicates ifIndex = 2
361 0x00000000 ifIndex unknown.
362 0x80000007 indicates a packet sent
364 0x80000000 indicates a packet sent to
366 interfaces greater than 1.*/
367 u_int32_t num_elements;
368 SFLFlow_sample_element *elements;
371 /* same thing, but the expanded version (for full 32-bit ifIndex numbers) */
373 typedef struct _SFLFlow_sample_expanded {
374 /* u_int32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 1 */
375 /* u_int32_t length; */
376 u_int32_t sequence_number; /* Incremented with each flow sample
378 u_int32_t ds_class; /* EXPANDED */
379 u_int32_t ds_index; /* EXPANDED */
380 u_int32_t sampling_rate; /* fsPacketSamplingRate */
381 u_int32_t sample_pool; /* Total number of packets that could have been
382 sampled (i.e. packets skipped by sampling
383 process + total number of samples) */
384 u_int32_t drops; /* Number of times a packet was dropped due to
386 u_int32_t inputFormat; /* EXPANDED */
387 u_int32_t input; /* SNMP ifIndex of input interface.
388 0 if interface is not known. */
389 u_int32_t outputFormat; /* EXPANDED */
390 u_int32_t output; /* SNMP ifIndex of output interface,
391 0 if interface is not known. */
392 u_int32_t num_elements;
393 SFLFlow_sample_element *elements;
394 } SFLFlow_sample_expanded;
398 #define SFL_UNDEF_COUNTER(c) c=-1
399 #define SFL_UNDEF_GAUGE(c) c=0
401 /* Generic interface counters - see RFC 1573, 2233 */
403 typedef struct _SFLIf_counters {
407 u_int32_t ifDirection; /* Derived from MAU MIB (RFC 2668)
408 0 = unknown, 1 = full-duplex,
409 2 = half-duplex, 3 = in, 4 = out */
410 u_int32_t ifStatus; /* bit field with the following bits assigned:
411 bit 0 = ifAdminStatus (0 = down, 1 = up)
412 bit 1 = ifOperStatus (0 = down, 1 = up) */
413 u_int64_t ifInOctets;
414 u_int32_t ifInUcastPkts;
415 u_int32_t ifInMulticastPkts;
416 u_int32_t ifInBroadcastPkts;
417 u_int32_t ifInDiscards;
418 u_int32_t ifInErrors;
419 u_int32_t ifInUnknownProtos;
420 u_int64_t ifOutOctets;
421 u_int32_t ifOutUcastPkts;
422 u_int32_t ifOutMulticastPkts;
423 u_int32_t ifOutBroadcastPkts;
424 u_int32_t ifOutDiscards;
425 u_int32_t ifOutErrors;
426 u_int32_t ifPromiscuousMode;
429 #define SFL_CTR_GENERIC_XDR_SIZE 88
431 /* Ethernet interface counters - see RFC 2358 */
432 typedef struct _SFLEthernet_counters {
433 u_int32_t dot3StatsAlignmentErrors;
434 u_int32_t dot3StatsFCSErrors;
435 u_int32_t dot3StatsSingleCollisionFrames;
436 u_int32_t dot3StatsMultipleCollisionFrames;
437 u_int32_t dot3StatsSQETestErrors;
438 u_int32_t dot3StatsDeferredTransmissions;
439 u_int32_t dot3StatsLateCollisions;
440 u_int32_t dot3StatsExcessiveCollisions;
441 u_int32_t dot3StatsInternalMacTransmitErrors;
442 u_int32_t dot3StatsCarrierSenseErrors;
443 u_int32_t dot3StatsFrameTooLongs;
444 u_int32_t dot3StatsInternalMacReceiveErrors;
445 u_int32_t dot3StatsSymbolErrors;
446 } SFLEthernet_counters;
448 #define SFL_CTR_ETHERNET_XDR_SIZE 52
450 /* Token ring counters - see RFC 1748 */
452 typedef struct _SFLTokenring_counters {
453 u_int32_t dot5StatsLineErrors;
454 u_int32_t dot5StatsBurstErrors;
455 u_int32_t dot5StatsACErrors;
456 u_int32_t dot5StatsAbortTransErrors;
457 u_int32_t dot5StatsInternalErrors;
458 u_int32_t dot5StatsLostFrameErrors;
459 u_int32_t dot5StatsReceiveCongestions;
460 u_int32_t dot5StatsFrameCopiedErrors;
461 u_int32_t dot5StatsTokenErrors;
462 u_int32_t dot5StatsSoftErrors;
463 u_int32_t dot5StatsHardErrors;
464 u_int32_t dot5StatsSignalLoss;
465 u_int32_t dot5StatsTransmitBeacons;
466 u_int32_t dot5StatsRecoverys;
467 u_int32_t dot5StatsLobeWires;
468 u_int32_t dot5StatsRemoves;
469 u_int32_t dot5StatsSingles;
470 u_int32_t dot5StatsFreqErrors;
471 } SFLTokenring_counters;
473 /* 100 BaseVG interface counters - see RFC 2020 */
475 typedef struct _SFLVg_counters {
476 u_int32_t dot12InHighPriorityFrames;
477 u_int64_t dot12InHighPriorityOctets;
478 u_int32_t dot12InNormPriorityFrames;
479 u_int64_t dot12InNormPriorityOctets;
480 u_int32_t dot12InIPMErrors;
481 u_int32_t dot12InOversizeFrameErrors;
482 u_int32_t dot12InDataErrors;
483 u_int32_t dot12InNullAddressedFrames;
484 u_int32_t dot12OutHighPriorityFrames;
485 u_int64_t dot12OutHighPriorityOctets;
486 u_int32_t dot12TransitionIntoTrainings;
487 u_int64_t dot12HCInHighPriorityOctets;
488 u_int64_t dot12HCInNormPriorityOctets;
489 u_int64_t dot12HCOutHighPriorityOctets;
492 typedef struct _SFLVlan_counters {
496 u_int32_t multicastPkts;
497 u_int32_t broadcastPkts;
503 u_int64_t datapath_id;
507 #define SFL_CTR_OPENFLOWPORT_XDR_SIZE 12
514 #define SFL_MAX_PORTNAME_LEN 255
516 /* LAG Port Statistics - see http://sflow.org/sflow_lag.txt */
517 /* opaque = counter_data; enterprise = 0; format = 7 */
519 typedef union _SFLLACP_portState {
524 uint8_t partnerAdmin;
529 typedef struct _SFLLACP_counters {
530 uint8_t actorSystemID[8]; /* 6 bytes + 2 pad */
531 uint8_t partnerSystemID[8]; /* 6 bytes + 2 pad */
532 uint32_t attachedAggID;
533 SFLLACP_portState portState;
535 uint32_t markerPDUsRx;
536 uint32_t markerResponsePDUsRx;
540 uint32_t markerPDUsTx;
541 uint32_t markerResponsePDUsTx;
544 #define SFL_CTR_LACP_XDR_SIZE 56
546 /* Application resource counters */
548 typedef struct _SFLAPPResources_counters {
549 uint32_t user_time; /* in milliseconds */
550 uint32_t system_time; /* in milliseconds */
557 } SFLAPPResources_counters;
559 #define SFL_CTR_APP_RESOURCES_XDR_SIZE 40
561 /* OVS datapath stats */
563 typedef struct _SFLOVSDP_counters {
572 #define SFL_CTR_OVSDP_XDR_SIZE 24
576 enum SFLCounters_type_tag {
577 /* enterprise = 0, format = ... */
578 SFLCOUNTERS_GENERIC = 1,
579 SFLCOUNTERS_ETHERNET = 2,
580 SFLCOUNTERS_TOKENRING = 3,
582 SFLCOUNTERS_VLAN = 5,
583 SFLCOUNTERS_LACP = 7,
584 SFLCOUNTERS_OPENFLOWPORT = 1004,
585 SFLCOUNTERS_PORTNAME = 1005,
586 SFLCOUNTERS_APP_RESOURCES = 2203,
587 SFLCOUNTERS_OVSDP = 2207
590 typedef union _SFLCounters_type {
591 SFLIf_counters generic;
592 SFLEthernet_counters ethernet;
593 SFLTokenring_counters tokenring;
595 SFLVlan_counters vlan;
596 SFLLACP_counters lacp;
597 SFLOpenFlowPort ofPort;
598 SFLPortName portName;
599 SFLAPPResources_counters appResources;
600 SFLOVSDP_counters ovsdp;
603 typedef struct _SFLCounters_sample_element {
604 struct _SFLCounters_sample_element *nxt; /* linked list */
605 u_int32_t tag; /* SFLCounters_type_tag */
607 SFLCounters_type counterBlock;
608 } SFLCounters_sample_element;
610 typedef struct _SFLCounters_sample {
611 /* u_int32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 2 */
612 /* u_int32_t length; */
613 u_int32_t sequence_number; /* Incremented with each counters sample
614 generated by this source_id */
615 u_int32_t source_id; /* fsSourceId */
616 u_int32_t num_elements;
617 SFLCounters_sample_element *elements;
618 } SFLCounters_sample;
620 /* same thing, but the expanded version, so ds_index can be a full 32 bits */
621 typedef struct _SFLCounters_sample_expanded {
622 /* u_int32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 2 */
623 /* u_int32_t length; */
624 u_int32_t sequence_number; /* Incremented with each counters sample
625 generated by this source_id */
626 u_int32_t ds_class; /* EXPANDED */
627 u_int32_t ds_index; /* EXPANDED */
628 u_int32_t num_elements;
629 SFLCounters_sample_element *elements;
630 } SFLCounters_sample_expanded;
632 #define SFLADD_ELEMENT(_sm, _el) do { (_el)->nxt = (_sm)->elements; (_sm)->elements = (_el); } while(0)
634 /* Format of a sample datagram */
636 enum SFLDatagram_version {
637 SFLDATAGRAM_VERSION2 = 2,
638 SFLDATAGRAM_VERSION4 = 4,
639 SFLDATAGRAM_VERSION5 = 5
642 typedef struct _SFLSample_datagram_hdr {
643 u_int32_t datagram_version; /* (enum SFLDatagram_version) = VERSION5 = 5 */
644 SFLAddress agent_address; /* IP address of sampling agent */
645 u_int32_t sub_agent_id; /* Used to distinguishing between datagram
646 streams from separate agent sub entities
648 u_int32_t sequence_number; /* Incremented with each sample datagram
650 u_int32_t uptime; /* Current time (in milliseconds since device
651 last booted). Should be set as close to
652 datagram transmission time as possible.*/
653 u_int32_t num_records; /* Number of tag-len-val flow/counter records to follow */
654 } SFLSample_datagram_hdr;
656 #define SFL_MAX_DATAGRAM_SIZE 1500
657 #define SFL_MIN_DATAGRAM_SIZE 200
658 #define SFL_DEFAULT_DATAGRAM_SIZE 1400
660 #define SFL_DATA_PAD 400