Commit Graph

11 Commits

Author SHA1 Message Date
Guy Harris c4cffcaf46 Dynamically allocate the array of field entries in a NetFlow V9
template, rather than allocating a fixed table of 64 entries (and
possibly overflowing that table).

Clear out the hash table of template entries, freeing all the allocated
arrays, when a new capture is opened.

svn path=/trunk/; revision=10356
2004-03-09 20:08:26 +00:00
Guy Harris e4677cd36e Add in some additional Cisco URLs for NetFlow documentation.
According to the V9 documentation at the first of those URLs, the length
field in a data flowset includes the lengths of the flowset ID and
length fields, so subtract that before calling "dissect_v9_data()" - and
don't call "dissect_v9_data()" if the length isn't positive after that's
done.

Don't bother checking whether there's data in the tvbuff in the loop
that dissects V9 data flowsets - if there isn't, we *want* an exception
to be thrown, as that's a short or malformed frame.  Do, however, make
sure we have at least as much data left in the flowset as the template
claims should be there - otherwise, we have padding, not a record.
Display that padding as such.

Make the length argument to "dissect_v9_data()" unsigned, so that we
don't get compiler warnings when comparing it with the unsigned "length"
field of a template.

If we don't find the template for a data flowset, just show the data as
such.

svn path=/trunk/; revision=7306
2003-03-07 00:43:30 +00:00
Guy Harris 82f7e126ec From Matthew Smart:
1. Make NetFlow UDP port user configurable

        2. Cache v9 templates

        3. Decode v9 data

svn path=/trunk/; revision=7270
2003-03-04 03:37:12 +00:00
Guy Harris 778f43ea73 From Matthew Smart: partial NetFlow V9 support.
svn path=/trunk/; revision=7127
2003-02-12 08:36:48 +00:00
Guy Harris 49c1aa93cf From Lutz Jaenicke: use "g_htonl()" rather than "htonl()".
svn path=/trunk/; revision=6381
2002-10-08 19:26:37 +00:00
Guy Harris 7a9e5ffc0b Include <string.h> to declare "memcpy()".
Cast the argument to "ip_to_str()" to eliminate a compiler warning.

svn path=/trunk/; revision=6376
2002-10-08 08:50:04 +00:00
Gerald Combs 4fffe8c0ad Major updates from Bill Fumerola.
Remove packet-netflow.h, since it is no longer needed.

svn path=/trunk/; revision=6314
2002-09-22 16:13:22 +00:00
Guy Harris e70dea7b3e From Matthew Smart:
o Added support for v1 and v7

     o Use proto_tree_add_item() instead of proto_tree_add_text() to
       enable filtering.  Thanks sahlberg AT optushome.com.au for
       pointing that out.

svn path=/trunk/; revision=6236
2002-09-09 20:22:51 +00:00
Jörg Mayer 67a9ecc9b4 Use g_ntohXXX instead of ntohXXX
svn path=/trunk/; revision=6206
2002-09-07 00:08:02 +00:00
Guy Harris 73e1310d82 From Hannes Gredler: decode the sample rate factor in cflowd5 headers.
svn path=/trunk/; revision=6200
2002-09-06 21:22:37 +00:00
Guy Harris 6f25d0da7c From Matthew Smart: Cisco NetFlow protocol support.
svn path=/trunk/; revision=6178
2002-09-04 20:23:55 +00:00