YAF - Documentation - Core Library 1.0.0.2 API
Documentation | Downloads

yaftab.h File Reference

Flow generation interface for YAF. More...

#include <yaf/autoinc.h>
#include <yaf/yafcore.h>
#include <yaf/decode.h>

Go to the source code of this file.


Typedefs

typedef struct yfFlowTab_st yfFlowTab_t
 A flow table.

Functions

yfFlowTab_tyfFlowTabAlloc (uint64_t idle_ms, uint64_t active_ms, uint32_t max_flows, uint32_t max_payload, gboolean uniflow, gboolean silkmode, gboolean applabelmode, gboolean entropymode)
 yfFlowTabAlloc
void yfFlowTabFree (yfFlowTab_t *flowtab)
 Free a previously allocated flow table.
void yfFlowPBuf (yfFlowTab_t *flowtab, size_t pbuflen, yfPBuf_t *pbuf)
 Add a decoded packet buffer to a given flow table.
gboolean yfFlowTabFlush (void *yfContext, gboolean close, GError **err)
 Flush closed flows in the given flow table to the given IPFIX Message Buffer.
uint64_t yfFlowTabCurrentTime (yfFlowTab_t *flowtab)
 Get the current packet clock from a flow table.
void yfFlowDumpStats (yfFlowTab_t *flowtab, GTimer *timer)
 Print flow table statistics to the log.

Detailed Description

Flow generation interface for YAF.

[TODO - frontmatter]

This facility is used by YAF to assemble packets into flows.


Typedef Documentation

typedef struct yfFlowTab_st yfFlowTab_t

A flow table.

Opaque. Create with yfFlowTabAlloc() and free with yfFlowTabFree().


Function Documentation

void yfFlowDumpStats ( yfFlowTab_t flowtab,
GTimer *  timer 
)

Print flow table statistics to the log.

Parameters:
flowtab flow table to dump stats for
timer a GTimer containing the runtime (for packet and flow rate logging). May be NULL to suppress rate logging.

void yfFlowPBuf ( yfFlowTab_t flowtab,
size_t  pbuflen,
yfPBuf_t pbuf 
)

Add a decoded packet buffer to a given flow table.

Adds the packet to the flow to which it belongs, creating a new flow if necessary. Causes the flow to which it belongs to time out if it is longer than the active timeout. Closes the flow if the flow closure conditions (TCP RST, TCP FIN four-way teardown) are met.

Parameters:
flowtab flow table to add the packet to
pbuflen size of the packet buffer pbuf
pbuf packet buffer containing decoded packet to add.

yfFlowTab_t* yfFlowTabAlloc ( uint64_t  idle_ms,
uint64_t  active_ms,
uint32_t  max_flows,
uint32_t  max_payload,
gboolean  uniflow,
gboolean  silkmode,
gboolean  applabelmode,
gboolean  entropymode 
)

yfFlowTabAlloc

Allocate a flow table.

Parameters:
idle_ms idle timeout in milliseconds. A flow that receives no packets for the idle timeout is assumed to be complete.
active_ms active timeout in milliseconds. The maximum duration of a flow is the active timeout; additional packets for the same flow will be counted as part of a new flow.
max_flows maximum number of active flows. Flows exceeding this limit will be expired in least-recent order, as if they were idle. Used to limit resource usage of a flow table. A value of 0 disables flow count limits.
max_payload maximum octets of payload to capture per flow direction. Requires at least max_payload octets of payload to be available in each packet buffer passed to yfFlowPBuf(). A value of 0 disables payload capture and export.
uniflow If TRUE, export biflows using record adjacency (two uniflows exported back-to-back. Use this for interoperability with IPFIX collectors that do not implement RFC 5103.
silkmode If TRUE, clamp totalOctetCount and maxTotalOctetCount to 32 bits and force active timeout on overflow. Set high order bit in flowEndReason for each flow created on an overflow or active timeout. Breaks IPFIX interoperability; use for direct export to SiLK rwflowpack or flowcap.
applabelmode If TRUE, then the payload, (as limited by max_payload,) is sent through various plugins and code in order to determine which protocol is running on the flow by doing only payload inspection and exporting payload relevent information.
entropymode If TRUE, then a Shannon Entropy measurement is made over the captured payload (as limited by max_payload). The entropy value is exported as two values one for forward payload and one for reverse payload.
Returns:
a new flow table.

uint64_t yfFlowTabCurrentTime ( yfFlowTab_t flowtab  ) 

Get the current packet clock from a flow table.

Parameters:
flowtab a flow table
Returns:
current packet clock

gboolean yfFlowTabFlush ( void *  yfContext,
gboolean  close,
GError **  err 
)

Flush closed flows in the given flow table to the given IPFIX Message Buffer.

Causes any idle flows to time out, removing them from the active flow table; also enforces the flow table's resource limit. If close is TRUE, additionally closes all active flows and flushes as well.

Parameters:
yfContext YAF thread context structure, holds pointers for the flowtable from which to flush flows and the fbuf, the destination to which the flows should be flushed
close close all active flows before flushing
err An error description pointer; must not be NULL.
Returns:
TRUE on success, FALSE otherwise.

void yfFlowTabFree ( yfFlowTab_t flowtab  ) 

Free a previously allocated flow table.

Discards any outstanding active flows without closing or flushing them; use yfFlowTabFlushAll() before yfFlowFree() to do this.

Parameters:
flowtab a flow table allocated by yfFlowTabAlloc()