Commit Graph

10 Commits

Author SHA1 Message Date
Guy Harris e4677cd36e Add in some additional Cisco URLs for NetFlow documentation.
According to the V9 documentation at the first of those URLs, the length
field in a data flowset includes the lengths of the flowset ID and
length fields, so subtract that before calling "dissect_v9_data()" - and
don't call "dissect_v9_data()" if the length isn't positive after that's
done.

Don't bother checking whether there's data in the tvbuff in the loop
that dissects V9 data flowsets - if there isn't, we *want* an exception
to be thrown, as that's a short or malformed frame.  Do, however, make
sure we have at least as much data left in the flowset as the template
claims should be there - otherwise, we have padding, not a record.
Display that padding as such.

Make the length argument to "dissect_v9_data()" unsigned, so that we
don't get compiler warnings when comparing it with the unsigned "length"
field of a template.

If we don't find the template for a data flowset, just show the data as
such.

svn path=/trunk/; revision=7306
2003-03-07 00:43:30 +00:00
Guy Harris 82f7e126ec From Matthew Smart:
1. Make NetFlow UDP port user configurable

        2. Cache v9 templates

        3. Decode v9 data

svn path=/trunk/; revision=7270
2003-03-04 03:37:12 +00:00
Guy Harris 778f43ea73 From Matthew Smart: partial NetFlow V9 support.
svn path=/trunk/; revision=7127
2003-02-12 08:36:48 +00:00
Guy Harris 49c1aa93cf From Lutz Jaenicke: use "g_htonl()" rather than "htonl()".
svn path=/trunk/; revision=6381
2002-10-08 19:26:37 +00:00
Guy Harris 7a9e5ffc0b Include <string.h> to declare "memcpy()".
Cast the argument to "ip_to_str()" to eliminate a compiler warning.

svn path=/trunk/; revision=6376
2002-10-08 08:50:04 +00:00
Gerald Combs 4fffe8c0ad Major updates from Bill Fumerola.
Remove packet-netflow.h, since it is no longer needed.

svn path=/trunk/; revision=6314
2002-09-22 16:13:22 +00:00
Guy Harris e70dea7b3e From Matthew Smart:
o Added support for v1 and v7

     o Use proto_tree_add_item() instead of proto_tree_add_text() to
       enable filtering.  Thanks sahlberg AT optushome.com.au for
       pointing that out.

svn path=/trunk/; revision=6236
2002-09-09 20:22:51 +00:00
Jörg Mayer 67a9ecc9b4 Use g_ntohXXX instead of ntohXXX
svn path=/trunk/; revision=6206
2002-09-07 00:08:02 +00:00
Guy Harris 73e1310d82 From Hannes Gredler: decode the sample rate factor in cflowd5 headers.
svn path=/trunk/; revision=6200
2002-09-06 21:22:37 +00:00
Guy Harris 6f25d0da7c From Matthew Smart: Cisco NetFlow protocol support.
svn path=/trunk/; revision=6178
2002-09-04 20:23:55 +00:00