yaftab.h
Go to the documentation of this file.00001 /* 00002 ** yaftab.h 00003 ** YAF Active Flow Table 00004 ** 00005 ** ------------------------------------------------------------------------ 00006 ** Copyright (C) 2006-2007 Carnegie Mellon University. All Rights Reserved. 00007 ** ------------------------------------------------------------------------ 00008 ** Authors: Brian Trammell <bht@cert.org> 00009 ** ------------------------------------------------------------------------ 00010 ** GNU General Public License (GPL) Rights pursuant to Version 2, June 1991 00011 ** Government Purpose License Rights (GPLR) pursuant to DFARS 252.225-7013 00012 ** ------------------------------------------------------------------------ 00013 */ 00014 00015 /* 00016 * This is the documentation for the _old_ yaftab.h; it is no longer current, 00017 * and should not be read by anyone. 00018 * 00019 * Flow generation interface for YAF. This facility works by maintaining a 00020 * current flow table. Packets may be added to the active flows within this 00021 * table using the yfFlowPkt() call. Completed flows may be written to an 00022 * IPFIX message buffer using yfFlowFlush(). 00023 * 00024 * The flow table is configured by a number of global variables. 00025 * 00026 * <tt>yaf_idle</tt> sets 00027 * the idle timeout in seconds. A flow that receives no packets for the idle 00028 * timeout is assumed to be complete. The idle timeout is set to 300 seconds 00029 * (five minutes) by default. 00030 * 00031 * <tt>yaf_active</tt> sets the active timeout in seconds. 00032 * The maximum duration of a flow is the active timeout; additional packets 00033 * for the same flow will be counted as part of a new flow. The active timeout 00034 * is set to 1800 seconds (half an hour) by default. 00035 * 00036 * <tt>yaf_flowlim</tt> sets the maximum size of the flow table; flows exceeding 00037 * this limit will be expired in least-recent order, as if they were idle. The 00038 * flow limit defaults to zero, for no limit. Use this global to limit resource 00039 * usage by the flow table. 00040 * 00041 * <tt>yaf_paylen</tt> sets the number of bytes of payload to capture from the 00042 * start of each flow. The payload length defaults to zero, which disables 00043 * payload capture. 00044 * 00045 * <tt>yaf_uniflow</tt>, if TRUE, exports flows in uniflow mode, using the 00046 * record adjacency export method described in section 3 of 00047 * draft-ietf-ipfix-biflow. Defaults to FALSE. 00048 * 00049 * <tt>yaf_macmode</tt>, if TRUE, exports layer 2 information with each flow; 00050 * presently this is limited to VLAN tags but may be expanded to include the 00051 * MPLS stack and MAC addresses in the future. Defaults to FALSE. 00052 * 00053 * <tt>yaf_silkmode</tt>, if TRUE, enables SiLK compatibility mode. In this 00054 * mode, totalOctetCount and reverseTotalOctetCount are clamped to 32 bits. 00055 * Any packet that would cause either of these counters to overflow 32 bits 00056 * will force an active timeout. The high-order bit of the flowEndReason IE 00057 * is set on any flow created on a counter overflow, as above, or on an active 00058 * timeout. Defaults to FALSE. 00059 * 00060 * <tt>yaf_reqtype</tt> limits the flow table to collecting IPv4 or IPv6 flows 00061 * only. Set to YF_TYPE_IPv4 for IPv4 flows only, YF_TYPE_IPv6 for IPv6 flows 00062 * only, or YF_TYPE_IPANY (the default) to collect both IPv4 and IPv6 flows. 00063 * 00064 * This facility is used by YAF to assemble packets into flows. 00065 */ 00066 00075 #ifndef _YAF_TAB_H_ 00076 #define _YAF_TAB_H_ 00077 00078 #include <yaf/autoinc.h> 00079 #include <yaf/yafcore.h> 00080 #include <yaf/decode.h> 00081 00082 00083 struct yfFlowTab_st; 00088 typedef struct yfFlowTab_st yfFlowTab_t; 00089 00130 yfFlowTab_t *yfFlowTabAlloc( 00131 uint64_t idle_ms, 00132 uint64_t active_ms, 00133 uint32_t max_flows, 00134 uint32_t max_payload, 00135 gboolean uniflow, 00136 gboolean silkmode, 00137 gboolean applabelmode, 00138 gboolean entropymode); 00139 00148 void yfFlowTabFree( 00149 yfFlowTab_t *flowtab); 00150 00163 void yfFlowPBuf( 00164 yfFlowTab_t *flowtab, 00165 size_t pbuflen, 00166 yfPBuf_t *pbuf); 00167 00182 gboolean yfFlowTabFlush( 00183 void *yfContext, 00184 gboolean close, 00185 GError **err); 00186 00194 uint64_t yfFlowTabCurrentTime( 00195 yfFlowTab_t *flowtab); 00196 00206 void yfFlowDumpStats( 00207 yfFlowTab_t *flowtab, 00208 GTimer *timer); 00209 00210 #endif