osmocom
/
wireshark
14
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity
wireshark/epan/dissectors/packet-sflow.c

2168 lines
67 KiB
C
Raw Normal View History

The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* packeto-sflow.c
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
* Routines for sFlow dissection
* Copyright 2003, Jeff Rizzo <riz@boogers.sf.ca.us>
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
* Copyright 2008, Joerg Mayer (see AUTHORS file)
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
*
Set the svn:eol-style property on all text files to "native", so that they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
2004-07-18 00:24:25 +00:00
* $Id$
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
*
change a whole bunch of ethereal into wireshark svn path=/trunk/; revision=18196
2006-05-21 04:49:01 +00:00
* Wireshark - Network traffic analyzer
* By Gerald Combs <gerald@wireshark.org>
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
* Copyright 1998 Gerald Combs
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
*
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
*
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
*
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*/
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* This file (mostly) implements a dissector for sFlow (RFC3176),
* from the version 4 spec at http://www.sflow.org/SFLOW-DATAGRAM.txt
* and the version 5 http://www.sflow.org/SFLOW-DATAGRAM5.txt.
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
*
* TODO:
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
* Insert more subtrees for some of the headers
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
* Fix the highlighting of the datastream when bits are selected
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
* (user add_item instead of add_text wherever sensible)
* Make naming and filtering more consistent
* Implement expanded flow samples
* Implement expanded counter samples
* Finish extended_user
* Finish extended_url
* Implement non-generic counters sampling
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
*/
#ifdef HAVE_CONFIG_H
# include "config.h"
#endif
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <glib.h>
#include <epan/packet.h>
From Andrew Feren: Add preference to allow user to configure the port(s) to use when identifying sFlow. svn path=/trunk/; revision=23153
2007-10-11 22:19:38 +00:00
#include <epan/prefs.h>
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
#include <epan/ipproto.h>
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
#include <epan/sminmpec.h>
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
From Andrew Feren: Add preference to allow user to configure the port(s) to use when identifying sFlow. svn path=/trunk/; revision=23153
2007-10-11 22:19:38 +00:00
#define SFLOW_UDP_PORTS "6343"
static dissector_handle_t sflow_handle;
/*
* global_sflow_ports : holds the configured range of ports for sflow
*/
static range_t *global_sflow_ports = NULL;
/*
* sflow_ports : holds the currently used range of ports for sflow
*/
static range_t *sflow_ports = NULL;
From Andrew Feren: sFlow datagrams can contain sampled headers from conversations on the network. Often it is convenient to have wireshark dissect these payload headers, but doing so can also have undesirable side effects. Dissected payload headers may match filters looking for header fields that also happen to occur in the payload. This can cause surprising results. Also TCP analysis will almost always flag errors on sampled headers. They are, after all, just a sample and many sequence numbers are sure to be missing. There is probably a more general way to resolve these issues, but adding preferences to enable/disable tcp analysis and dissection of sampled headers will be a good start. This will make it possible to examine the details of sampled headers if desired or to disable dissection if the side effects of dissecting sampled headers cause issues. svn path=/trunk/; revision=23230
2007-10-19 09:50:29 +00:00
static gboolean global_dissect_samp_headers = TRUE;
static gboolean global_analyze_samp_ip_headers = FALSE;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
static const true_false_string yes_no_truth = {
"Yes",
"No"
};
From Andrew Feren: Add preference to allow user to configure the port(s) to use when identifying sFlow. svn path=/trunk/; revision=23153
2007-10-11 22:19:38 +00:00
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
#define ADDRESS_UNKNOWN 0
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
#define ADDRESS_IPV4 1
#define ADDRESS_IPV6 2
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
static const value_string sflow_agent_address_type[] = {
{ ADDRESS_UNKNOWN, "Unknown" },
{ ADDRESS_IPV4, "IP_V4" },
{ ADDRESS_IPV6, "IP_V6"},
{ 0, NULL }
};
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
#define FLOWSAMPLE 1
#define COUNTERSSAMPLE 2
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
static const value_string sflow4_sampletype[] = {
{ FLOWSAMPLE, "Flow sample" },
{ COUNTERSSAMPLE, "Counters sample" },
{ 0, NULL }
};
#define EXPFLOWSAMPLES 3
#define EXPCOUNTERSAMPLES 4
static const value_string sflow5_sampletype[] = {
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
{ FLOWSAMPLE, "Flow sample" },
{ COUNTERSSAMPLE, "Counters sample" },
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ EXPFLOWSAMPLES, "Expanded flow sample" },
{ EXPCOUNTERSAMPLES, "Expanded counters sample" },
{ 0, NULL }
};
static const value_string sflow_sample_sourceidtype[] = {
{ 0, "ifIndex" },
{ 1, "smonVlanDataSource" },
{ 2, "entPhysicalEntry" },
{ 0, NULL }
};
static const value_string if_direction_vals[] = {
{ 0, "unknown" },
{ 1, "full duplex" },
{ 2, "half duplex" },
{ 3, "in" },
{ 4, "out" },
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
{ 0, NULL }
};
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
static const true_false_string if_status_up_down = {
"Down",
"Up"
};
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
/* interface counter types */
#define SFLOW_COUNTERS_GENERIC 1
#define SFLOW_COUNTERS_ETHERNET 2
#define SFLOW_COUNTERS_TOKENRING 3
#define SFLOW_COUNTERS_FDDI 4
#define SFLOW_COUNTERS_VG 5
#define SFLOW_COUNTERS_WAN 6
#define SFLOW_COUNTERS_VLAN 7
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
#define SFLOW_COUNTERS_CPU 1001
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
static const value_string sflow_counterstype_short [] = {
{ SFLOW_COUNTERS_GENERIC, "Generic" },
{ SFLOW_COUNTERS_ETHERNET, "Ethernet" },
{ SFLOW_COUNTERS_FDDI, "FDDI" },
{ SFLOW_COUNTERS_VG, "100baseVG" },
{ SFLOW_COUNTERS_WAN, "WAN" },
{ SFLOW_COUNTERS_VLAN, "VLAN" },
{ SFLOW_COUNTERS_CPU, "CPU" },
{ 0, NULL }
};
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
static const value_string sflow_counterstype [] = {
{ SFLOW_COUNTERS_GENERIC, "Generic counters" },
{ SFLOW_COUNTERS_ETHERNET, "Ethernet counters" },
{ SFLOW_COUNTERS_FDDI, "FDDI counters" },
{ SFLOW_COUNTERS_VG, "100baseVG counters" },
{ SFLOW_COUNTERS_WAN, "WAN counters" },
{ SFLOW_COUNTERS_VLAN, "VLAN counters" },
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ SFLOW_COUNTERS_CPU, "CPU counters" },
{ 0, NULL }
};
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
#define MAX_HEADER_SIZE 256
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
#define SFLOW4_PACKET_DATA_TYPE_HEADER 1
#define SFLOW4_PACKET_DATA_TYPE_IPV4 2
#define SFLOW4_PACKET_DATA_TYPE_IPV6 3
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
static const value_string sflow4_fs_record_type [] = {
{ SFLOW4_PACKET_DATA_TYPE_HEADER, "Packet headers are sampled" },
{ SFLOW4_PACKET_DATA_TYPE_IPV4, "IP Version 4 data" },
{ SFLOW4_PACKET_DATA_TYPE_IPV6, "IP Version 6 data" },
{ 0, NULL}
};
#define SFLOW_EXTENDED_SWITCH 1
#define SFLOW_EXTENDED_ROUTER 2
#define SFLOW_EXTENDED_GATEWAY 3
#define SFLOW_EXTENDED_USER 4
#define SFLOW_EXTENDED_URL 5
static const value_string sflow_extended_data_types[] = {
{ SFLOW_EXTENDED_SWITCH, "Extended switch information" },
{ SFLOW_EXTENDED_ROUTER, "Extended router information" },
{ SFLOW_EXTENDED_GATEWAY, "Extended gateway information" },
{ SFLOW_EXTENDED_USER, "Extended user information" },
{ SFLOW_EXTENDED_URL, "Extended URL information" },
{ 0, NULL }
};
#define SFLOW5_PACKET_DATA_TYPE_RAWHEADER 1
#define SFLOW5_PACKET_DATA_TYPE_ETHERNET 2
#define SFLOW5_PACKET_DATA_TYPE_IPV4 3
#define SFLOW5_PACKET_DATA_TYPE_IPV6 4
#define SFLOW5_PACKET_DATA_TYPE_SWITCH 1001
#define SFLOW5_PACKET_DATA_TYPE_ROUTER 1002
#define SFLOW5_PACKET_DATA_TYPE_GATEWAY 1003
#define SFLOW5_PACKET_DATA_TYPE_USER 1004
#define SFLOW5_PACKET_DATA_TYPE_URL 1005
#define SFLOW5_PACKET_DATA_TYPE_MPLS 1006
#define SFLOW5_PACKET_DATA_TYPE_MPLSTUN 1008
#define SFLOW5_PACKET_DATA_TYPE_MPLSVC 1009
#define SFLOW5_PACKET_DATA_TYPE_MPLSFEC 1010
#define SFLOW5_PACKET_DATA_TYPE_MPLSLVPFEC 1011
#define SFLOW5_PACKET_DATA_TYPE_VLANTUN 1012
static const value_string sflow5_packet_fs_record_type [] = {
{ SFLOW5_PACKET_DATA_TYPE_RAWHEADER, "Raw header" },
{ SFLOW5_PACKET_DATA_TYPE_ETHERNET, "Ethernet header" },
{ SFLOW5_PACKET_DATA_TYPE_IPV4, "IPv4 header" },
{ SFLOW5_PACKET_DATA_TYPE_IPV6, "IPv6 header" },
{ SFLOW5_PACKET_DATA_TYPE_SWITCH, "Switch data" },
{ SFLOW5_PACKET_DATA_TYPE_ROUTER, "Router data" },
{ SFLOW5_PACKET_DATA_TYPE_GATEWAY, "Gateway data" },
{ SFLOW5_PACKET_DATA_TYPE_USER, "User data" },
{ SFLOW5_PACKET_DATA_TYPE_URL, "URL data" },
{ SFLOW5_PACKET_DATA_TYPE_MPLS, "MPLS data" },
{ SFLOW5_PACKET_DATA_TYPE_MPLSTUN, "MPLS tunnel data" },
{ SFLOW5_PACKET_DATA_TYPE_MPLSVC, "MPLS VC data" },
{ SFLOW5_PACKET_DATA_TYPE_MPLSFEC, "MPLS FEC data" },
{ SFLOW5_PACKET_DATA_TYPE_MPLSLVPFEC, "MPLS LVP FEC data" },
{ SFLOW5_PACKET_DATA_TYPE_VLANTUN, "Vlan tunnel data" },
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
{ 0, NULL}
};
#define SFLOW_HEADER_ETHERNET 1
#define SFLOW_HEADER_TOKENBUS 2
#define SFLOW_HEADER_TOKENRING 3
#define SFLOW_HEADER_FDDI 4
#define SFLOW_HEADER_FRAME_RELAY 5
#define SFLOW_HEADER_X25 6
#define SFLOW_HEADER_PPP 7
#define SFLOW_HEADER_SMDS 8
#define SFLOW_HEADER_AAL5 9
#define SFLOW_HEADER_AAL5_IP 10
#define SFLOW_HEADER_IPv4 11
#define SFLOW_HEADER_IPv6 12
#define SFLOW_HEADER_MPLS 13
static const value_string sflow_header_protocol[] = {
{ SFLOW_HEADER_ETHERNET, "Ethernet" },
{ SFLOW_HEADER_TOKENBUS, "Token Bus" },
{ SFLOW_HEADER_TOKENRING, "Token Ring" },
{ SFLOW_HEADER_FDDI, "FDDI" },
{ SFLOW_HEADER_FRAME_RELAY, "Frame Relay" },
{ SFLOW_HEADER_X25, "X.25" },
{ SFLOW_HEADER_PPP, "PPP" },
{ SFLOW_HEADER_SMDS, "SMDS" },
{ SFLOW_HEADER_AAL5, "ATM AAL5" },
{ SFLOW_HEADER_AAL5_IP, "ATM AAL5-IP (e.g., Cisco AAL5 mux)" },
{ SFLOW_HEADER_IPv4, "IPv4" },
{ SFLOW_HEADER_IPv6, "IPv6" },
{ SFLOW_HEADER_MPLS, "MPLS" },
{ 0, NULL }
};
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* extended data types */
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
#define SFLOW_AS_SET 1
#define SFLOW_AS_SEQUENCE 2
static const value_string sflow_as_types[] = {
{ SFLOW_AS_SET, "AS Set" },
{ SFLOW_AS_SEQUENCE, "AS Sequence" },
{ 0, NULL }
};
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
#if 0
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
/* flow sample header */
struct sflow_flow_sample_header {
guint32 sequence_number;
guint32 source_id;
guint32 sampling_rate;
guint32 sample_pool;
guint32 drops;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
guint32 input;
guint32 output;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
};
/* counters sample header */
struct sflow_counters_sample_header {
guint32 sequence_number;
guint32 source_id;
guint32 sampling_interval;
guint32 counters_type;
};
/* generic interface counters */
struct if_counters {
guint32 ifIndex;
guint32 ifType;
guint64 ifSpeed;
guint32 ifDirection;
guint32 ifStatus;
guint64 ifInOctets;
guint32 ifInUcastPkts;
guint32 ifInMulticastPkts;
guint32 ifInBroadcastPkts;
guint32 ifInDiscards;
guint32 ifInErrors;
guint32 ifInUnknownProtos;
guint64 ifOutOctets;
guint32 ifOutUcastPkts;
guint32 ifOutMulticastPkts;
guint32 ifOutBroadcastPkts;
guint32 ifOutDiscards;
guint32 ifOutErrors;
guint32 ifPromiscuousMode;
};
/* ethernet counters. These will be preceded by generic counters. */
struct ethernet_counters {
guint32 dot3StatsAlignmentErrors;
guint32 dot3StatsFCSErrors;
guint32 dot3StatsSingleCollisionFrames;
guint32 dot3StatsMultipleCollisionFrames;
guint32 dot3StatsSQETestErrors;
guint32 dot3StatsDeferredTransmissions;
guint32 dot3StatsLateCollisions;
guint32 dot3StatsExcessiveCollisions;
guint32 dot3StatsInternalMacTransmitErrors;
guint32 dot3StatsCarrierSenseErrors;
guint32 dot3StatsFrameTooLongs;
guint32 dot3StatsInternalMacReceiveErrors;
guint32 dot3StatsSymbolErrors;
};
/* Token Ring counters */
struct token_ring_counters {
guint32 dot5StatsLineErrors;
guint32 dot5StatsBurstErrors;
guint32 dot5StatsACErrors;
guint32 dot5StatsAbortTransErrors;
guint32 dot5StatsInternalErrors;
guint32 dot5StatsLostFrameErrors;
guint32 dot5StatsReceiveCongestions;
guint32 dot5StatsFrameCopiedErrors;
guint32 dot5StatsTokenErrors;
guint32 dot5StatsSoftErrors;
guint32 dot5StatsHardErrors;
guint32 dot5StatsSignalLoss;
guint32 dot5StatsTransmitBeacons;
guint32 dot5StatsRecoverys;
guint32 dot5StatsLobeWires;
guint32 dot5StatsRemoves;
guint32 dot5StatsSingles;
guint32 dot5StatsFreqErrors;
};
/* 100BaseVG counters */
struct vg_counters {
guint32 dot12InHighPriorityFrames;
guint64 dot12InHighPriorityOctets;
guint32 dot12InNormPriorityFrames;
guint64 dot12InNormPriorityOctets;
guint32 dot12InIPMErrors;
guint32 dot12InOversizeFrameErrors;
guint32 dot12InDataErrors;
guint32 dot12InNullAddressedFrames;
guint32 dot12OutHighPriorityFrames;
guint64 dot12OutHighPriorityOctets;
guint32 dot12TransitionIntoTrainings;
guint64 dot12HCInHighPriorityOctets;
guint64 dot12HCInNormPriorityOctets;
guint64 dot12HCOutHighPriorityOctets;
};
/* VLAN counters */
struct vlan_counters {
guint32 vlan_id;
guint32 octets;
guint32 ucastPkts;
guint32 multicastPkts;
guint32 broadcastPkts;
guint32 discards;
};
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* Processor counters */
struct cpu_counters {
guint32 cpuPercentage5s;
guint32 cpuPercentage1m;
guint32 cpuPercentage5m;
guint64 memTotal;
guint64 memFree;
};
#endif
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
/* Initialize the protocol and registered fields */
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* sFlow Datagram */
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
static int proto_sflow = -1;
static int hf_sflow_version = -1;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
static int hf_sflow_agent_address_type = -1;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
static int hf_sflow_agent_address_v4 = -1;
static int hf_sflow_agent_address_v6 = -1;
Handle the packet headeer for sFlow V5, put in a stub dissector for V5 samples, and give the URL of the V5 spec and some hints about how to handle the private enterprise code in those samples. For subtrees that cover structures, make the tree cover the entire structure, not just the first field. Add the flow sample type and extended data type to the protocol tree. Set the protocol column name to capitalize "sFlow" the conventional way, and remove the redundant "sFlow" from the Info column. svn path=/trunk/; revision=13744
2005-03-13 21:42:51 +00:00
static int hf_sflow_sub_agent_id = -1;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
static int hf_sflow_seqnum = -1;
static int hf_sflow_sysuptime = -1;
static int hf_sflow_numsamples = -1;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* Sample header common to all sample types */
static int hf_sflow_sample_type = -1;
static int hf_sflow_sample_type_enterprise = -1;
static int hf_sflow_sample_type_enterprisetype = -1;
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
static int hf_sflow_sample_type_defaulttype = -1;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
static int hf_sflow_sample_length = -1;
/* Flowsample header */
static int hf_sflow_fs_seqno = -1;
static int hf_sflow_fs_sourceid_type = -1;
static int hf_sflow_fs_sourceid_index = -1;
static int hf_sflow_fs_samplingrate = -1;
static int hf_sflow_fs_samplepool = -1;
static int hf_sflow_fs_drops = -1;
static int hf_sflow_fs_ifindexin = -1;
static int hf_sflow_fs_multipleoutputs = -1;
static int hf_sflow_fs_numoutinterfaces = -1;
static int hf_sflow_fs_ifindexout = -1;
static int hf_sflow_fs_numrecords = -1;
static int hf_sflow_fs_recordlength = -1;
/* Countersample header */
static int hf_sflow_cs_seqno = -1;
static int hf_sflow_cs_sourceid_type = -1;
static int hf_sflow_cs_sourceid_index = -1;
static int hf_sflow_cs_samplinginterval = -1;
static int hf_sflow_cs_numrecords = -1;
static int hf_sflow_cs_record_type = -1;
static int hf_sflow_cs_recordlength = -1;
/* Flowsample Raw packet header */
static int hf_sflow_fs_rawheader_protocol = -1;
static int hf_sflow_fs_rawheader_framelength = -1;
static int hf_sflow_fs_rawheader_stripped = -1;
static int hf_sflow_fs_rawheader_headerlength = -1;
static int hf_sflow_fs_rawheader = -1;
/* Flowsample Ethernet packet */
static int hf_sflow_fs_ethernet_framelength = -1;
static int hf_sflow_fs_ethernet_srcmac = -1;
static int hf_sflow_fs_ethernet_dstmac = -1;
static int hf_sflow_fs_ethernet_type = -1;
/* Flowsample IP packet */
static int hf_sflow_fs_ip_length = -1;
static int hf_sflow_fs_ip_protocol = -1;
static int hf_sflow_fs_ip_srcipv4 = -1;
static int hf_sflow_fs_ip_dstipv4 = -1;
static int hf_sflow_fs_ip_srcipv6 = -1;
static int hf_sflow_fs_ip_dstipv6 = -1;
static int hf_sflow_fs_ip_srcport = -1;
static int hf_sflow_fs_ip_dstport = -1;
static int hf_sflow_fs_ip_tcpflags = -1;
static int hf_sflow_fs_ip_tos = -1;
static int hf_sflow_fs_ip_priority = -1;
/* Flowsample Tokenring packet */
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
/* XXX */
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* Flowsample 100BaseVG packet */
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
/* XXX */
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* Flowsample VLAN packet */
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
/* XXX */
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* Flowsample CPU packet */
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
/* XXX */
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* sflow record */
static int hf_sflow4_fs_record_type = -1;
static int hf_sflow5_fs_record_type = -1;
static int hf_sflow4_extended_information_type = -1;
/* stuff used in extended flow records */
Change 802.11f -> F, 802.1d -> D, 802.1x -> X, 802.1q -Q, 802.1P -> p svn path=/trunk/; revision=14321
2005-05-05 17:07:58 +00:00
static int hf_sflow_vlan_in = -1; /* incoming 802.1Q VLAN ID */
static int hf_sflow_vlan_out = -1; /* outgoing 802.1Q VLAN ID */
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
static int hf_sflow_pri_in = -1; /* incominging 802.1p priority */
static int hf_sflow_pri_out = -1; /* outgoing 802.1p priority */
static int hf_sflow_nexthop_v4 = -1; /* nexthop address */
static int hf_sflow_nexthop_v6 = -1; /* nexthop address */
In packet-sflow.c, don't pass a NULL value pointer to proto_tree_add_ipv6(). Add tree items for the extended router source and dest mask, and fix offsets. These changes appear to be correct, but I don't have a valid capture with extended router data. In proto.c, throw a dissector error if we try to pass a NULL value to various proto_tree_set_*() routines. Fixes bug 356. svn path=/trunk/; revision=15375
2005-08-16 16:04:30 +00:00
static int hf_sflow_nexthop_src_mask = -1;
static int hf_sflow_nexthop_dst_mask = -1;
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
/* extended gateway (all versions) */
static int hf_sflow_as = -1;
static int hf_sflow_src_as = -1;
static int hf_sflow_src_peer_as = -1;
static int hf_sflow_dst_as_entries = -1; /* aka length */
static int hf_sflow_dst_as = -1;
/* extended gateway (>= version 4) */
static int hf_sflow_community_entries = -1;
static int hf_sflow_localpref = -1;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* generic counters */
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
static int hf_sflow_ifindex = -1;
static int hf_sflow_iftype = -1;
static int hf_sflow_ifspeed = -1;
static int hf_sflow_ifdirection = -1;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
static int hf_sflow_ifstatus_unused = -1;
static int hf_sflow_ifstatus_admin = -1;
static int hf_sflow_ifstatus_oper = -1;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
static int hf_sflow_ifinoct = -1;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
static int hf_sflow_ifinucast = -1;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
static int hf_sflow_ifinmcast = -1;
static int hf_sflow_ifinbcast = -1;
static int hf_sflow_ifinerr = -1;
static int hf_sflow_ifindisc = -1;
static int hf_sflow_ifinunk = -1;
static int hf_sflow_ifoutoct = -1;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
static int hf_sflow_ifoutucast = -1;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
static int hf_sflow_ifoutmcast = -1;
static int hf_sflow_ifoutbcast = -1;
static int hf_sflow_ifoutdisc = -1;
static int hf_sflow_ifouterr = -1;
static int hf_sflow_ifpromisc = -1;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* ethernet counters */
static int hf_sflow_eth_dot3StatsAlignmentErrors = -1;
static int hf_sflow_eth_dot3StatsFCSErrors = -1;
static int hf_sflow_eth_dot3StatsSingleCollisionFrames = -1;
static int hf_sflow_eth_dot3StatsMultipleCollisionFrames = -1;
static int hf_sflow_eth_dot3StatsSQETestErrors = -1;
static int hf_sflow_eth_dot3StatsDeferredTransmissions = -1;
static int hf_sflow_eth_dot3StatsLateCollisions = -1;
static int hf_sflow_eth_dot3StatsExcessiveCollisions = -1;
static int hf_sflow_eth_dot3StatsInternalMacTransmitErrors = -1;
static int hf_sflow_eth_dot3StatsCarrierSenseErrors = -1;
static int hf_sflow_eth_dot3StatsFrameTooLongs = -1;
static int hf_sflow_eth_dot3StatsInternalMacReceiveErrors = -1;
static int hf_sflow_eth_dot3StatsSymbolErrors = -1;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
/* Initialize the subtree pointers */
static gint ett_sflow = -1;
static gint ett_sflow_sample = -1;
static gint ett_sflow_extended_data = -1;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
static gint ett_sflow_counters_record = -1;
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
static gint ett_sflow_gw_as_dst = -1;
static gint ett_sflow_gw_as_dst_seg = -1;
static gint ett_sflow_gw_community = -1;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
static gint ett_sflow_sampled_header = -1;
/* dissectors for other protocols */
Export two versions of the Ethereal dissector, for use with encapsulated Ethernet frames, one for encapsulated frames that include an FCS and one for encapsulated frames that don't include an FCS. Use the appropriate versions. In the ISL dissector, do the same sort of processing we do in the Ethernet dissector to figure out whether the frame has a trailer or not and whether it has an FCS or not. svn path=/trunk/; revision=12593
2004-11-24 09:13:52 +00:00
static dissector_handle_t eth_withoutfcs_handle;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
static dissector_handle_t tr_handle;
static dissector_handle_t fddi_handle;
static dissector_handle_t fr_handle;
static dissector_handle_t x25_handle;
static dissector_handle_t ppp_handle;
static dissector_handle_t smds_handle;
static dissector_handle_t aal5_handle;
static dissector_handle_t ipv4_handle;
static dissector_handle_t ipv6_handle;
static dissector_handle_t mpls_handle;
From Andrew Feren: sFlow datagrams can contain sampled headers from conversations on the network. Often it is convenient to have wireshark dissect these payload headers, but doing so can also have undesirable side effects. Dissected payload headers may match filters looking for header fields that also happen to occur in the payload. This can cause surprising results. Also TCP analysis will almost always flag errors on sampled headers. They are, after all, just a sample and many sequence numbers are sure to be missing. There is probably a more general way to resolve these issues, but adding preferences to enable/disable tcp analysis and dissection of sampled headers will be a good start. This will make it possible to examine the details of sampled headers if desired or to disable dissection if the side effects of dissecting sampled headers cause issues. svn path=/trunk/; revision=23230
2007-10-19 09:50:29 +00:00
/* don't dissect */
static dissector_handle_t data_handle;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
From Andrew Feren: Add preference to allow user to configure the port(s) to use when identifying sFlow. svn path=/trunk/; revision=23153
2007-10-11 22:19:38 +00:00
void proto_reg_handoff_sflow(void);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
/* dissect a sampled header - layer 2 protocols */
static gint
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
dissect_sflow_sample_rawheaderdata(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
volatile gint offset, guint32 version)
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
{
guint32 header_proto, frame_length;
volatile guint32 header_length;
tvbuff_t *next_tvb;
proto_tree *sflow_header_tree;
proto_item *ti;
/* stuff for saving column state before calling other dissectors.
* Thanks to Guy Harris for the tip. */
From Andrew Feren: sFlow datagrams can contain sampled headers from conversations on the network. Often it is convenient to have wireshark dissect these payload headers, but doing so can also have undesirable side effects. Dissected payload headers may match filters looking for header fields that also happen to occur in the payload. This can cause surprising results. Also TCP analysis will almost always flag errors on sampled headers. They are, after all, just a sample and many sequence numbers are sure to be missing. There is probably a more general way to resolve these issues, but adding preferences to enable/disable tcp analysis and dissection of sampled headers will be a good start. This will make it possible to examine the details of sampled headers if desired or to disable dissection if the side effects of dissecting sampled headers cause issues. svn path=/trunk/; revision=23230
2007-10-19 09:50:29 +00:00
gboolean save_writable;
gboolean save_in_error_pkt;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
volatile address save_dl_src;
volatile address save_dl_dst;
volatile address save_net_src;
volatile address save_net_dst;
volatile address save_src;
volatile address save_dst;
header_proto = tvb_get_ntohl(tvb,offset);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(tree, hf_sflow_fs_rawheader_protocol, tvb, offset, 4, FALSE);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
offset += 4;
frame_length = tvb_get_ntohl(tvb,offset);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(tree, hf_sflow_fs_rawheader_framelength, tvb, offset, 4, FALSE);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
offset += 4;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
if (version == 5) {
proto_tree_add_item(tree, hf_sflow_fs_rawheader_stripped, tvb, offset, 4, FALSE);
offset += 4;
}
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
header_length = tvb_get_ntohl(tvb,offset);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(tree, hf_sflow_fs_rawheader_headerlength, tvb, offset, 4, FALSE);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
offset += 4;
if (header_length % 4) /* XDR requires 4-byte alignment */
header_length += 4 - (header_length % 4);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
ti = proto_tree_add_item(tree, hf_sflow_fs_rawheader, tvb, offset, header_length, FALSE);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
sflow_header_tree = proto_item_add_subtree(ti, ett_sflow_sampled_header);
/* hand the header off to the appropriate dissector. It's probably
* a short frame, so ignore any exceptions. */
next_tvb = tvb_new_subset(tvb, offset, header_length, frame_length);
/* save some state */
save_writable = col_get_writable(pinfo->cinfo);
From Andrew Feren: sFlow datagrams can contain sampled headers from conversations on the network. Often it is convenient to have wireshark dissect these payload headers, but doing so can also have undesirable side effects. Dissected payload headers may match filters looking for header fields that also happen to occur in the payload. This can cause surprising results. Also TCP analysis will almost always flag errors on sampled headers. They are, after all, just a sample and many sequence numbers are sure to be missing. There is probably a more general way to resolve these issues, but adding preferences to enable/disable tcp analysis and dissection of sampled headers will be a good start. This will make it possible to examine the details of sampled headers if desired or to disable dissection if the side effects of dissecting sampled headers cause issues. svn path=/trunk/; revision=23230
2007-10-19 09:50:29 +00:00
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/*
From Andrew Feren: sFlow datagrams can contain sampled headers from conversations on the network. Often it is convenient to have wireshark dissect these payload headers, but doing so can also have undesirable side effects. Dissected payload headers may match filters looking for header fields that also happen to occur in the payload. This can cause surprising results. Also TCP analysis will almost always flag errors on sampled headers. They are, after all, just a sample and many sequence numbers are sure to be missing. There is probably a more general way to resolve these issues, but adding preferences to enable/disable tcp analysis and dissection of sampled headers will be a good start. This will make it possible to examine the details of sampled headers if desired or to disable dissection if the side effects of dissecting sampled headers cause issues. svn path=/trunk/; revision=23230
2007-10-19 09:50:29 +00:00
If sFlow samples a TCP packet it is very likely that the
TCP analysis will flag the packet as having some error with
the sequence numbers. sFlow only report on a "sample" of
traffic so many packets will not be reported on. This is
most obvious if the colorizing rules are on, but will also
cause confusion if you attempt to filter on
"tcp.analysis.flags".
The following only works to suppress IP/TCP errors, but
it is a start anyway. Other protocols carried as payloads
may exhibit similar issues.
I think what is really needed is a more general
"protocol_as_payload" flag. Of course then someone has to
play whack-a-mole and add code to implement it to any
protocols that could be carried as a payload. In the case
of sFlow that pretty much means anything on your network.
*/
save_in_error_pkt = pinfo->in_error_pkt;
if (!global_analyze_samp_ip_headers) {
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
pinfo->in_error_pkt = TRUE;
From Andrew Feren: sFlow datagrams can contain sampled headers from conversations on the network. Often it is convenient to have wireshark dissect these payload headers, but doing so can also have undesirable side effects. Dissected payload headers may match filters looking for header fields that also happen to occur in the payload. This can cause surprising results. Also TCP analysis will almost always flag errors on sampled headers. They are, after all, just a sample and many sequence numbers are sure to be missing. There is probably a more general way to resolve these issues, but adding preferences to enable/disable tcp analysis and dissection of sampled headers will be a good start. This will make it possible to examine the details of sampled headers if desired or to disable dissection if the side effects of dissecting sampled headers cause issues. svn path=/trunk/; revision=23230
2007-10-19 09:50:29 +00:00
}
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
col_set_writable(pinfo->cinfo, FALSE);
save_dl_src = pinfo->dl_src;
save_dl_dst = pinfo->dl_dst;
save_net_src = pinfo->net_src;
save_net_dst = pinfo->net_dst;
save_src = pinfo->src;
save_dst = pinfo->dst;
TRY {
switch (header_proto) {
case SFLOW_HEADER_ETHERNET:
Export two versions of the Ethereal dissector, for use with encapsulated Ethernet frames, one for encapsulated frames that include an FCS and one for encapsulated frames that don't include an FCS. Use the appropriate versions. In the ISL dissector, do the same sort of processing we do in the Ethernet dissector to figure out whether the frame has a trailer or not and whether it has an FCS or not. svn path=/trunk/; revision=12593
2004-11-24 09:13:52 +00:00
call_dissector(eth_withoutfcs_handle, next_tvb, pinfo, sflow_header_tree);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
break;
case SFLOW_HEADER_TOKENRING:
call_dissector(tr_handle, next_tvb, pinfo, sflow_header_tree);
break;
case SFLOW_HEADER_FDDI:
call_dissector(fddi_handle, next_tvb, pinfo, sflow_header_tree);
break;
case SFLOW_HEADER_FRAME_RELAY:
call_dissector(fr_handle, next_tvb, pinfo, sflow_header_tree);
break;
case SFLOW_HEADER_X25:
call_dissector(x25_handle, next_tvb, pinfo, sflow_header_tree);
break;
case SFLOW_HEADER_PPP:
call_dissector(ppp_handle, next_tvb, pinfo, sflow_header_tree);
break;
case SFLOW_HEADER_SMDS:
call_dissector(smds_handle, next_tvb, pinfo, sflow_header_tree);
break;
case SFLOW_HEADER_AAL5:
case SFLOW_HEADER_AAL5_IP:
/* I'll be surprised if this works! I have no AAL5 captures
* to test with, and I'm not sure how the encapsulation goes */
call_dissector(aal5_handle, next_tvb, pinfo, sflow_header_tree);
break;
case SFLOW_HEADER_IPv4:
call_dissector(ipv4_handle, next_tvb, pinfo, sflow_header_tree);
break;
case SFLOW_HEADER_IPv6:
call_dissector(ipv6_handle, next_tvb, pinfo, sflow_header_tree);
break;
case SFLOW_HEADER_MPLS:
call_dissector(mpls_handle, next_tvb, pinfo, sflow_header_tree);
break;
default:
/* some of the protocols, I have no clue where to begin. */
break;
};
}
CATCH2(BoundsError, ReportedBoundsError) {
; /* do nothing */
}
ENDTRY;
/* restore saved state */
col_set_writable(pinfo->cinfo, save_writable);
From Andrew Feren: sFlow datagrams can contain sampled headers from conversations on the network. Often it is convenient to have wireshark dissect these payload headers, but doing so can also have undesirable side effects. Dissected payload headers may match filters looking for header fields that also happen to occur in the payload. This can cause surprising results. Also TCP analysis will almost always flag errors on sampled headers. They are, after all, just a sample and many sequence numbers are sure to be missing. There is probably a more general way to resolve these issues, but adding preferences to enable/disable tcp analysis and dissection of sampled headers will be a good start. This will make it possible to examine the details of sampled headers if desired or to disable dissection if the side effects of dissecting sampled headers cause issues. svn path=/trunk/; revision=23230
2007-10-19 09:50:29 +00:00
pinfo->in_error_pkt = save_in_error_pkt;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
pinfo->dl_src = save_dl_src;
pinfo->dl_dst = save_dl_dst;
pinfo->net_src = save_net_src;
pinfo->net_dst = save_net_dst;
pinfo->src = save_src;
pinfo->dst = save_dst;
offset += header_length;
return offset;
}
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
static gint
dissect_sflow_sample_ethernet(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree,
gint offset)
{
proto_tree_add_item(tree, hf_sflow_fs_ethernet_framelength, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(tree, hf_sflow_fs_ethernet_srcmac, tvb, offset, 4, FALSE);
offset += 8;
proto_tree_add_item(tree, hf_sflow_fs_ethernet_dstmac, tvb, offset, 4, FALSE);
offset += 8;
proto_tree_add_item(tree, hf_sflow_fs_ethernet_type, tvb, offset, 4, FALSE);
offset += 4;
return offset;
}
/* dissect a sampled ipv4 or ipv4 header */
static gint
dissect_sflow_sample_ip(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree,
gint offset, guint32 ipversion)
{
guint32 ip_proto;
proto_tree_add_item(tree, hf_sflow_fs_ip_length, tvb, offset, 4, FALSE);
offset += 4;
ip_proto = tvb_get_ntohl(tvb, offset);
proto_tree_add_uint_format(tree, hf_sflow_fs_ip_protocol, tvb, offset,
4, ip_proto, "Protocol: %s (0x%02x)", ipprotostr(ip_proto), ip_proto);
offset +=4;
if (ipversion == 4) {
proto_tree_add_item(tree, hf_sflow_fs_ip_srcipv4, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(tree, hf_sflow_fs_ip_dstipv4, tvb, offset, 4, FALSE);
offset += 4;
} else {
proto_tree_add_item(tree, hf_sflow_fs_ip_srcipv6, tvb, offset, 16, FALSE);
offset += 16;
proto_tree_add_item(tree, hf_sflow_fs_ip_dstipv6, tvb, offset, 16, FALSE);
offset += 16;
}
proto_tree_add_item(tree, hf_sflow_fs_ip_srcport, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(tree, hf_sflow_fs_ip_dstport, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(tree, hf_sflow_fs_ip_tcpflags, tvb, offset, 4, FALSE);
offset += 4;
if (ipversion == 4) {
proto_tree_add_item(tree, hf_sflow_fs_ip_tos, tvb, offset, 4, FALSE);
offset += 4;
} else {
proto_tree_add_item(tree, hf_sflow_fs_ip_priority, tvb, offset, 4, FALSE);
offset += 4;
}
return offset;
}
/* extended switch data */
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
static gint
dissect_sflow_extended_switch(tvbuff_t *tvb, proto_tree *tree, gint offset)
{
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(tree, hf_sflow_vlan_in, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(tree, hf_sflow_pri_in, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(tree, hf_sflow_vlan_out, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(tree, hf_sflow_pri_out, tvb, offset, 4, FALSE);
offset += 4;
return offset;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
}
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* extended router data */
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
static gint
dissect_sflow_extended_router(tvbuff_t *tvb, proto_tree *tree, gint offset)
{
- Make sure we hanlde arrays with length 0 correctly. - Trivial warning (shadowed variable) fix. svn path=/trunk/; revision=26900
2008-12-02 08:13:20 +00:00
guint32 nh_address_type;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
- Make sure we hanlde arrays with length 0 correctly. - Trivial warning (shadowed variable) fix. svn path=/trunk/; revision=26900
2008-12-02 08:13:20 +00:00
nh_address_type = tvb_get_ntohl(tvb, offset);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
offset += 4;
- Make sure we hanlde arrays with length 0 correctly. - Trivial warning (shadowed variable) fix. svn path=/trunk/; revision=26900
2008-12-02 08:13:20 +00:00
switch (nh_address_type) {
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
case ADDRESS_IPV4:
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(tree, hf_sflow_nexthop_v4, tvb, offset, 4, FALSE);
offset += 4;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
break;
case ADDRESS_IPV6:
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(tree, hf_sflow_nexthop_v6, tvb, offset, 16, FALSE);
offset += 16;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
break;
default:
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_text(tree, tvb, offset - 4, 4,
- Make sure we hanlde arrays with length 0 correctly. - Trivial warning (shadowed variable) fix. svn path=/trunk/; revision=26900
2008-12-02 08:13:20 +00:00
"Unknown address type (%d)", nh_address_type);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
offset += 4; /* not perfect, but what else to do? */
return offset; /* again, this is wrong. but... ? */
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
};
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(tree, hf_sflow_nexthop_src_mask, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(tree, hf_sflow_nexthop_dst_mask, tvb, offset, 4, FALSE);
offset += 4;
return offset;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
}
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* extended gateway data */
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
static gint
dissect_sflow_extended_gateway(tvbuff_t *tvb, proto_tree *tree, gint offset)
{
gint32 i, j, comm_len, dst_len, dst_seg_len;
guint32 path_type;
gint32 kludge;
guint32 version = tvb_get_ntohl(tvb, 0); /* HACK */
proto_item *ti;
proto_tree *sflow_dst_as_tree;
proto_tree *sflow_comm_tree;
proto_tree *sflow_dst_as_seg_tree;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(tree, hf_sflow_as, tvb, offset, 4, FALSE);
offset += 4;
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(tree, hf_sflow_src_as, tvb, offset, 4, FALSE);
offset += 4;
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(tree, hf_sflow_src_peer_as, tvb, offset, 4, FALSE);
offset += 4;
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
dst_len = tvb_get_ntohl(tvb, offset);
ti = proto_tree_add_uint(tree, hf_sflow_dst_as_entries, tvb, offset, 4, dst_len);
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
sflow_dst_as_tree = proto_item_add_subtree(ti, ett_sflow_gw_as_dst);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
offset += 4;
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
- Make sure we hanlde arrays with length 0 correctly. - Trivial warning (shadowed variable) fix. svn path=/trunk/; revision=26900
2008-12-02 08:13:20 +00:00
i = 0;
while (i++ < dst_len) {
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
if( version < 4 ) {
/* Version 2 AS paths are different than versions >= 4 as
follows:
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
There is no type encoded in the packet.
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
The destination ASs are encoded as an array of integers
rather as an array of arrays of integers. I just
pretended they were encoded as an array of arrays with
an implicit length of 1 to not have to do two
completely separate blocks for the different versions.
Having a subtree for "arrays" guaranteed to have only a
single element proved cumbersome to navigate so I moved
the creation of the subtree to only happen for versions
>= 4.
*/
dst_seg_len = 1;
path_type = 0;
kludge = 0;
sflow_dst_as_seg_tree = sflow_dst_as_tree;
} else {
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
path_type = tvb_get_ntohl(tvb, offset);
offset += 4;
dst_seg_len = tvb_get_ntohl(tvb, offset);
offset += 4;
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
kludge = 8;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
ti = proto_tree_add_text(tree, tvb, offset-kludge, kludge,
"%s, (%d entries)",
val_to_str(path_type, sflow_as_types, "Unknown AS type"),
dst_seg_len);
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
sflow_dst_as_seg_tree = proto_item_add_subtree(ti, ett_sflow_gw_as_dst_seg);
}
- Make sure we hanlde arrays with length 0 correctly. - Trivial warning (shadowed variable) fix. svn path=/trunk/; revision=26900
2008-12-02 08:13:20 +00:00
j = 0;
while (j++ < dst_seg_len) {
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(sflow_dst_as_seg_tree, hf_sflow_dst_as,
tvb, offset, 4, FALSE);
offset += 4;
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
}
}
if( version >= 4 ) {
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
comm_len = tvb_get_ntohl(tvb, offset);
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
ti = proto_tree_add_uint(tree, hf_sflow_community_entries, tvb, offset, 4, comm_len);
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
sflow_comm_tree = proto_item_add_subtree(ti, ett_sflow_gw_community);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
offset += 4;
- Make sure we hanlde arrays with length 0 correctly. - Trivial warning (shadowed variable) fix. svn path=/trunk/; revision=26900
2008-12-02 08:13:20 +00:00
i = 0;
while (i++ < comm_len) {
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(sflow_comm_tree, hf_sflow_dst_as, tvb,
offset, 4, FALSE);
offset += 4;
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
}
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(tree, hf_sflow_localpref, tvb, offset, 4, FALSE);
offset += 4;
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
}
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
return offset;
}
/* extended url data */
/* XXX the item stuff is missing */
static gint
dissect_sflow_extended_url(tvbuff_t *tvb, proto_tree *tree _U_, gint offset)
{
guint32 url_string_len, host_string_len;
offset += 4;
url_string_len = tvb_get_ntohl(tvb, offset);
offset += 4;
if (url_string_len & 3)
url_string_len += (4 - (url_string_len & 3));
offset += url_string_len;
host_string_len = tvb_get_ntohl(tvb, offset);
offset += 4;
if (host_string_len & 3)
host_string_len += (4 - (host_string_len & 3));
offset += host_string_len;
return offset;
}
/* extended userdata */
/* XXX the item stuff is missing */
static gint
dissect_sflow_extended_user(tvbuff_t *tvb, proto_tree *tree _U_, gint offset)
{
guint32 src_user_string_len, dst_user_string_len;
offset += 4;
src_user_string_len = tvb_get_ntohl(tvb, offset);
offset += 4;
if (src_user_string_len & 3)
src_user_string_len += (4 - (src_user_string_len & 3));
offset += src_user_string_len;
offset += 4;
dst_user_string_len = tvb_get_ntohl(tvb, offset);
offset += 4;
if (dst_user_string_len & 3)
dst_user_string_len += (4 - (dst_user_string_len & 3));
offset += dst_user_string_len;
return offset;
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
}
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
/* dissect a flow sample */
static gint
dissect_sflow_flow_sample(tvbuff_t *tvb, packet_info *pinfo,
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree *tree, gint offset, proto_item *parent, guint32 version)
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
{
Handle the packet headeer for sFlow V5, put in a stub dissector for V5 samples, and give the URL of the V5 spec and some hints about how to handle the private enterprise code in those samples. For subtrees that cover structures, make the tree cover the entire structure, not just the first field. Add the flow sample type and extended data type to the protocol tree. Set the protocol column name to capitalize "sFlow" the conventional way, and remove the redundant "sFlow" from the Info column. svn path=/trunk/; revision=13744
2005-03-13 21:42:51 +00:00
proto_tree *extended_data_tree;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_item *ti;
guint32 packet_type, extended_data, ext_type, i, j;
guint32 sequence_number;
guint32 output, num_records, record_length, sample_length;
gint return_offset = 0, nextoffset = 0;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
if (version == 5) {
sample_length = tvb_get_ntohl(tvb, offset);
proto_tree_add_item(tree, hf_sflow_sample_length, tvb, offset, 4, FALSE);
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
offset += 4;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
return_offset = offset + sample_length;
}
sequence_number = tvb_get_ntohl(tvb, offset);
proto_tree_add_item(tree, hf_sflow_fs_seqno, tvb, offset, 4, FALSE);
proto_item_append_text(parent, ", seq %u", sequence_number);
offset += 4;
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
proto_tree_add_item(tree, hf_sflow_fs_sourceid_type, tvb, offset, 1, FALSE);
offset += 1;
proto_tree_add_item(tree, hf_sflow_fs_sourceid_index, tvb, offset, 3, FALSE);
offset += 3;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(tree, hf_sflow_fs_samplingrate, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(tree, hf_sflow_fs_samplepool, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(tree, hf_sflow_fs_drops, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(tree, hf_sflow_fs_ifindexin, tvb, offset, 4, FALSE);
offset += 4;
output = tvb_get_ntohl(tvb, offset);
proto_tree_add_item(tree, hf_sflow_fs_multipleoutputs, tvb, offset, 4, FALSE);
if (output >> 31)
proto_tree_add_item(tree, hf_sflow_fs_numoutinterfaces, tvb, offset, 4, FALSE);
else
proto_tree_add_item(tree, hf_sflow_fs_ifindexout, tvb, offset, 4, FALSE);
offset += 4;
if (version == 5) {
num_records = tvb_get_ntohl(tvb, offset);
proto_tree_add_item(tree, hf_sflow_fs_numrecords, tvb, offset, 4, FALSE);
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
offset += 4;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
} else {
num_records = 1;
}
- Make sure we hanlde arrays with length 0 correctly. - Trivial warning (shadowed variable) fix. svn path=/trunk/; revision=26900
2008-12-02 08:13:20 +00:00
j = 0;
while (j++ < num_records) {
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* what kind of flow sample is it? */
packet_type = tvb_get_ntohl(tvb, offset);
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
if (version == 5) {
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(tree, hf_sflow5_fs_record_type, tvb, offset, 4, FALSE);
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
proto_item_append_text(parent, ", %s",
val_to_str(packet_type, sflow5_packet_fs_record_type, "%u"));
} else {
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(tree, hf_sflow4_fs_record_type, tvb, offset, 4, FALSE);
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
}
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
offset += 4;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
if (version == 5) {
record_length = tvb_get_ntohl(tvb, offset);
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
proto_tree_add_item(tree, hf_sflow_fs_recordlength, tvb, offset, 4, FALSE);
extended_data_tree = tree;
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
offset += 4;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
nextoffset = offset + record_length;
switch (packet_type) {
case SFLOW5_PACKET_DATA_TYPE_RAWHEADER:
offset = dissect_sflow_sample_rawheaderdata(tvb, pinfo, tree, offset, version);
break;
case SFLOW5_PACKET_DATA_TYPE_ETHERNET:
offset = dissect_sflow_sample_ethernet(tvb, pinfo, tree, offset);
break;
case SFLOW5_PACKET_DATA_TYPE_IPV4:
offset = dissect_sflow_sample_ip(tvb, pinfo, tree, offset, 4);
break;
case SFLOW5_PACKET_DATA_TYPE_IPV6:
offset = dissect_sflow_sample_ip(tvb, pinfo, tree, offset, 6);
break;
case SFLOW5_PACKET_DATA_TYPE_SWITCH:
offset = dissect_sflow_extended_switch(tvb, extended_data_tree, offset);
break;
case SFLOW5_PACKET_DATA_TYPE_ROUTER:
offset = dissect_sflow_extended_router(tvb, extended_data_tree, offset);
break;
case SFLOW5_PACKET_DATA_TYPE_GATEWAY:
offset = dissect_sflow_extended_gateway(tvb, extended_data_tree, offset);
break;
case SFLOW5_PACKET_DATA_TYPE_URL:
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
offset = dissect_sflow_extended_url(tvb, extended_data_tree, offset);
break;
case SFLOW5_PACKET_DATA_TYPE_USER:
offset = dissect_sflow_extended_user(tvb, extended_data_tree, offset);
break;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
case SFLOW5_PACKET_DATA_TYPE_MPLS:
case SFLOW5_PACKET_DATA_TYPE_MPLSTUN:
case SFLOW5_PACKET_DATA_TYPE_MPLSVC:
case SFLOW5_PACKET_DATA_TYPE_MPLSFEC:
case SFLOW5_PACKET_DATA_TYPE_MPLSLVPFEC:
case SFLOW5_PACKET_DATA_TYPE_VLANTUN:
default:
break;
};
offset = nextoffset;
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
} else {
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
switch (packet_type) {
case SFLOW4_PACKET_DATA_TYPE_IPV4:
offset = dissect_sflow_sample_ip(tvb, pinfo, tree, offset, 4);
break;
case SFLOW4_PACKET_DATA_TYPE_IPV6:
offset = dissect_sflow_sample_ip(tvb, pinfo, tree, offset, 6);
break;
}
/* still need to dissect extended data */
extended_data = tvb_get_ntohl(tvb,offset);
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
offset += 4;
- Make sure we hanlde arrays with length 0 correctly. - Trivial warning (shadowed variable) fix. svn path=/trunk/; revision=26900
2008-12-02 08:13:20 +00:00
i = 0;
while (i++ < extended_data) {
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* figure out what kind of extended data it is */
ext_type = tvb_get_ntohl(tvb,offset);
/* create a subtree. Might want to move this to
* the end, so more info can be correct.
*/
ti = proto_tree_add_text(tree, tvb, offset, -1, "%s",
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
val_to_str(ext_type, sflow_extended_data_types,
"Unknown extended information"));
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
extended_data_tree = proto_item_add_subtree(ti, ett_sflow_extended_data);
proto_tree_add_uint(extended_data_tree,
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
hf_sflow4_extended_information_type, tvb, offset, 4, ext_type);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
offset += 4;
Attempt to fix build errors. svn path=/trunk/; revision=26892
2008-12-01 11:03:28 +00:00
switch (ext_type) {
case SFLOW_EXTENDED_SWITCH:
offset = dissect_sflow_extended_switch(tvb, extended_data_tree, offset);
break;
case SFLOW_EXTENDED_ROUTER:
offset = dissect_sflow_extended_router(tvb, extended_data_tree, offset);
break;
case SFLOW_EXTENDED_GATEWAY:
offset = dissect_sflow_extended_gateway(tvb, extended_data_tree, offset);
break;
case SFLOW_EXTENDED_URL:
offset = dissect_sflow_extended_url(tvb, extended_data_tree, offset);
break;
case SFLOW_EXTENDED_USER:
offset = dissect_sflow_extended_user(tvb, extended_data_tree, offset);
break;
default:
break;
}
proto_item_set_end(ti, tvb, offset);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
}
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
}
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
}
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
if (version == 5)
return return_offset;
else
return offset;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
}
/* dissect a counters sample */
static gint
dissect_sflow_counters_sample(tvbuff_t *tvb, proto_tree *tree,
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
gint offset, proto_item *parent, guint32 version)
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
{
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
guint32 sequence_number, num_records, counters_type, record_length, j;
guint32 sample_length;
gint nextoffset = 0, return_offset = 0;
proto_tree *record_tree;
proto_item *ti; /* tree item */
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
if (version == 5) {
sample_length = tvb_get_ntohl(tvb, offset);
proto_tree_add_item(tree, hf_sflow_sample_length, tvb, offset, 4, FALSE);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
offset += 4;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
return_offset = offset + sample_length;
}
sequence_number = tvb_get_ntohl(tvb, offset);
proto_tree_add_item(tree, hf_sflow_cs_seqno, tvb, offset, 4, FALSE);
proto_item_append_text(parent, ", seq %u", sequence_number);
offset += 4;
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
proto_tree_add_item(tree, hf_sflow_cs_sourceid_type, tvb, offset, 1, FALSE);
offset += 1;
proto_tree_add_item(tree, hf_sflow_cs_sourceid_index, tvb, offset, 3, FALSE);
offset += 3;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
if (version == 5) {
num_records = tvb_get_ntohl(tvb, offset);
proto_tree_add_item(tree, hf_sflow_cs_numrecords, tvb, offset, 4, FALSE);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
offset += 4;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
} else {
num_records = 1;
proto_tree_add_item(tree, hf_sflow_cs_samplinginterval, tvb, offset, 4, FALSE);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
offset += 4;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
}
- Make sure we hanlde arrays with length 0 correctly. - Trivial warning (shadowed variable) fix. svn path=/trunk/; revision=26900
2008-12-02 08:13:20 +00:00
j = 0;
while (j++ < num_records) {
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
counters_type = tvb_get_ntohl(tvb, offset);
if (version == 5) {
/* To put the version 4 stuff also into a subree we'd need to calculate
the record length via a table */
record_length = tvb_get_ntohl(tvb, offset + 4);
ti = proto_tree_add_text(tree, tvb, offset, record_length + 8,
"%s record", val_to_str(counters_type, sflow_counterstype, "%u"));
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
proto_item_append_text(parent, ", %s",
val_to_str(counters_type, sflow_counterstype_short, "%u"));
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
record_tree = proto_item_add_subtree(ti, ett_sflow_counters_record);
} else {
Attempt to fix build errors. svn path=/trunk/; revision=26892
2008-12-01 11:03:28 +00:00
record_length = 0;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
record_tree = tree;
}
proto_tree_add_item(record_tree, hf_sflow_cs_record_type, tvb, offset, 4, FALSE);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
offset += 4;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
if (version == 5) {
proto_tree_add_item(record_tree, hf_sflow_cs_recordlength, tvb, offset, 4, FALSE);
offset += 4;
nextoffset = offset + record_length;
}
/* most counters types have the "generic" counters first */
switch (counters_type) {
case SFLOW_COUNTERS_ETHERNET:
case SFLOW_COUNTERS_TOKENRING:
case SFLOW_COUNTERS_FDDI:
case SFLOW_COUNTERS_VG:
case SFLOW_COUNTERS_WAN:
case SFLOW_COUNTERS_CPU:
if (version == 5)
break;
case SFLOW_COUNTERS_GENERIC:
proto_item_append_text(parent, ", ifIndex %u", tvb_get_ntohl(tvb, offset));
proto_tree_add_item(record_tree, hf_sflow_ifindex, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_iftype, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_ifspeed, tvb, offset, 8, FALSE);
offset += 8;
proto_tree_add_item(record_tree, hf_sflow_ifdirection, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_ifstatus_unused, tvb, offset, 4, FALSE);
proto_tree_add_item(record_tree, hf_sflow_ifstatus_oper, tvb, offset, 4, FALSE);
proto_tree_add_item(record_tree, hf_sflow_ifstatus_admin, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_ifinoct, tvb, offset, 8, FALSE);
offset += 8;
proto_tree_add_item(record_tree, hf_sflow_ifinucast, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_ifinmcast, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_ifinbcast, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_ifindisc, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_ifinerr, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_ifinunk, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_ifoutoct, tvb, offset, 8, FALSE);
offset += 8;
proto_tree_add_item(record_tree, hf_sflow_ifoutucast, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_ifoutmcast, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_ifoutbcast, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_ifoutdisc, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_ifouterr, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_ifpromisc, tvb, offset, 4, FALSE);
offset += 4;
break;
};
/* Some counter types have other info to gather */
switch (counters_type) {
case SFLOW_COUNTERS_ETHERNET:
proto_tree_add_item(record_tree, hf_sflow_eth_dot3StatsAlignmentErrors, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_eth_dot3StatsFCSErrors, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_eth_dot3StatsSingleCollisionFrames, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_eth_dot3StatsMultipleCollisionFrames, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_eth_dot3StatsSQETestErrors, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_eth_dot3StatsDeferredTransmissions, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_eth_dot3StatsLateCollisions, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_eth_dot3StatsExcessiveCollisions, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_eth_dot3StatsInternalMacTransmitErrors, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_eth_dot3StatsCarrierSenseErrors, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_eth_dot3StatsFrameTooLongs, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_eth_dot3StatsInternalMacReceiveErrors, tvb, offset, 4, FALSE);
offset += 4;
proto_tree_add_item(record_tree, hf_sflow_eth_dot3StatsSymbolErrors, tvb, offset, 4, FALSE);
offset += 4;
break;
case SFLOW_COUNTERS_TOKENRING:
offset += 72;
break;
case SFLOW_COUNTERS_VG:
offset += 80;
break;
case SFLOW_COUNTERS_VLAN:
offset += 24;
break;
case SFLOW_COUNTERS_CPU:
offset += 28;
break;
default:
break;
}
if (version == 5)
offset = nextoffset;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
}
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
if (version == 5)
return return_offset;
else
return offset;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
}
/* Code to dissect the sflow samples */
static gint
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
dissect_sflow_samples(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
gint offset, guint32 version)
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
{
proto_tree *sflow_sample_tree;
proto_item *ti; /* tree item */
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
guint32 sample_type, sample_enterprise;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
/* decide what kind of sample it is. */
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
if (version != 5) {
sample_type = tvb_get_ntohl(tvb, offset);
Initialize sample_enterprise. svn path=/trunk/; revision=26895
2008-12-01 20:26:11 +00:00
sample_enterprise = 0;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
ti = proto_tree_add_text(tree, tvb, offset, -1, "%s",
val_to_str(sample_type, sflow4_sampletype,
"Unknown sample type (v4)"));
} else {
sample_type = tvb_get_ntohl(tvb, offset) & 0x00000fff;
sample_enterprise = (tvb_get_ntohl(tvb, offset) & 0xfffff000) >> 12;
if (sample_enterprise == 0) {
ti = proto_tree_add_text(tree, tvb, offset, -1, "%s",
val_to_str(sample_type, sflow5_sampletype,
"Unknown sample type (v5)"));
} else {
ti = proto_tree_add_text(tree, tvb, offset, -1,
"Unsupported Enterprise: %s",
val_to_str(sample_enterprise, sminmpec_values, "%u"));
}
}
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
sflow_sample_tree = proto_item_add_subtree(ti, ett_sflow_sample);
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
if (version != 5) {
proto_tree_add_item(sflow_sample_tree, hf_sflow_sample_type, tvb, offset, 4, FALSE);
} else {
proto_tree_add_item(sflow_sample_tree, hf_sflow_sample_type_enterprise,
tvb, offset, 4, FALSE);
if (sample_enterprise == 0) {
proto_tree_add_item(sflow_sample_tree, hf_sflow_sample_type_defaulttype,
tvb, offset, 4, FALSE);
} else {
proto_tree_add_item(sflow_sample_tree, hf_sflow_sample_type_enterprisetype,
tvb, offset, 4, FALSE);
}
}
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
offset += 4;
switch (sample_type) {
case FLOWSAMPLE:
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
case EXPFLOWSAMPLES:
offset = dissect_sflow_flow_sample(tvb, pinfo, sflow_sample_tree, offset, ti, version);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
break;
case COUNTERSSAMPLE:
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
case EXPCOUNTERSAMPLES:
offset = dissect_sflow_counters_sample(tvb, sflow_sample_tree, offset, ti, version);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
break;
default:
break;
Handle the packet headeer for sFlow V5, put in a stub dissector for V5 samples, and give the URL of the V5 spec and some hints about how to handle the private enterprise code in those samples. For subtrees that cover structures, make the tree cover the entire structure, not just the first field. Add the flow sample type and extended data type to the protocol tree. Set the protocol column name to capitalize "sFlow" the conventional way, and remove the redundant "sFlow" from the Info column. svn path=/trunk/; revision=13744
2005-03-13 21:42:51 +00:00
}
proto_item_set_end(ti, tvb, offset);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
return offset;
}
/* Code to actually dissect the packets */
From Andrew Feren: Add preference to allow user to configure the port(s) to use when identifying sFlow. svn path=/trunk/; revision=23153
2007-10-11 22:19:38 +00:00
static int
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
dissect_sflow(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
/* Set up structures needed to add the protocol subtree and manage it */
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_item *ti;
proto_tree *sflow_tree;
Handle the packet headeer for sFlow V5, put in a stub dissector for V5 samples, and give the URL of the V5 spec and some hints about how to handle the private enterprise code in those samples. For subtrees that cover structures, make the tree cover the entire structure, not just the first field. Add the flow sample type and extended data type to the protocol tree. Set the protocol column name to capitalize "sFlow" the conventional way, and remove the redundant "sFlow" from the Info column. svn path=/trunk/; revision=13744
2005-03-13 21:42:51 +00:00
guint32 version, sub_agent_id, seqnum;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
guint32 agent_address_type;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
guint32 numsamples;
volatile guint offset=0;
guint i=0;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
union {
guint8 v4[4];
guint8 v6[16];
} agent_address;
/* Make entries in Protocol column and Info column on summary display */
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
if (check_col(pinfo->cinfo, COL_PROTOCOL))
Handle the packet headeer for sFlow V5, put in a stub dissector for V5 samples, and give the URL of the V5 spec and some hints about how to handle the private enterprise code in those samples. For subtrees that cover structures, make the tree cover the entire structure, not just the first field. Add the flow sample type and extended data type to the protocol tree. Set the protocol column name to capitalize "sFlow" the conventional way, and remove the redundant "sFlow" from the Info column. svn path=/trunk/; revision=13744
2005-03-13 21:42:51 +00:00
col_set_str(pinfo->cinfo, COL_PROTOCOL, "sFlow");
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
/* create display subtree for the protocol */
ti = proto_tree_add_item(tree, proto_sflow, tvb, 0, -1, FALSE);
sflow_tree = proto_item_add_subtree(ti, ett_sflow);
version = tvb_get_ntohl(tvb, offset);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
if (check_col(pinfo->cinfo, COL_INFO))
Handle the packet headeer for sFlow V5, put in a stub dissector for V5 samples, and give the URL of the V5 spec and some hints about how to handle the private enterprise code in those samples. For subtrees that cover structures, make the tree cover the entire structure, not just the first field. Add the flow sample type and extended data type to the protocol tree. Set the protocol column name to capitalize "sFlow" the conventional way, and remove the redundant "sFlow" from the Info column. svn path=/trunk/; revision=13744
2005-03-13 21:42:51 +00:00
col_add_fstr(pinfo->cinfo, COL_INFO, "V%u",
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
version);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(sflow_tree, hf_sflow_version, tvb, offset, 4, FALSE);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
offset += 4;
agent_address_type = tvb_get_ntohl(tvb, offset);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(sflow_tree, hf_sflow_agent_address_type, tvb, offset, 4, FALSE);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
offset += 4;
switch (agent_address_type) {
case ADDRESS_IPV4:
tvb_memcpy(tvb, agent_address.v4, offset, 4);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
if (check_col(pinfo->cinfo, COL_INFO))
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
col_append_fstr(pinfo->cinfo, COL_INFO, ", agent %s",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
ip_to_str(agent_address.v4));
proto_tree_add_item(sflow_tree, hf_sflow_agent_address_v4,
tvb, offset, 4, FALSE);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
offset += 4;
break;
case ADDRESS_IPV6:
tvb_memcpy(tvb, agent_address.v6, offset, 16);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
if (check_col(pinfo->cinfo, COL_INFO))
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
col_append_fstr(pinfo->cinfo, COL_INFO, ", agent %s",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
ip6_to_str((struct e_in6_addr *)agent_address.v6));
proto_tree_add_item(sflow_tree, hf_sflow_agent_address_v6,
tvb, offset, 16, FALSE);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
offset += 16;
break;
default:
/* unknown address. this will cause a malformed packet. */
Removed even more "statement not reached" warnings. svn path=/trunk/; revision=24286
2008-02-07 15:44:45 +00:00
return 0;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
};
Handle the packet headeer for sFlow V5, put in a stub dissector for V5 samples, and give the URL of the V5 spec and some hints about how to handle the private enterprise code in those samples. For subtrees that cover structures, make the tree cover the entire structure, not just the first field. Add the flow sample type and extended data type to the protocol tree. Set the protocol column name to capitalize "sFlow" the conventional way, and remove the redundant "sFlow" from the Info column. svn path=/trunk/; revision=13744
2005-03-13 21:42:51 +00:00
if (version == 5) {
sub_agent_id = tvb_get_ntohl(tvb, offset);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
if (check_col(pinfo->cinfo, COL_INFO))
Handle the packet headeer for sFlow V5, put in a stub dissector for V5 samples, and give the URL of the V5 spec and some hints about how to handle the private enterprise code in those samples. For subtrees that cover structures, make the tree cover the entire structure, not just the first field. Add the flow sample type and extended data type to the protocol tree. Set the protocol column name to capitalize "sFlow" the conventional way, and remove the redundant "sFlow" from the Info column. svn path=/trunk/; revision=13744
2005-03-13 21:42:51 +00:00
col_append_fstr(pinfo->cinfo, COL_INFO, ", sub-agent ID %u",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
sub_agent_id);
proto_tree_add_item(sflow_tree, hf_sflow_sub_agent_id,
tvb, offset, 4, FALSE);
Handle the packet headeer for sFlow V5, put in a stub dissector for V5 samples, and give the URL of the V5 spec and some hints about how to handle the private enterprise code in those samples. For subtrees that cover structures, make the tree cover the entire structure, not just the first field. Add the flow sample type and extended data type to the protocol tree. Set the protocol column name to capitalize "sFlow" the conventional way, and remove the redundant "sFlow" from the Info column. svn path=/trunk/; revision=13744
2005-03-13 21:42:51 +00:00
offset += 4;
}
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
seqnum = tvb_get_ntohl(tvb, offset);
Handle the packet headeer for sFlow V5, put in a stub dissector for V5 samples, and give the URL of the V5 spec and some hints about how to handle the private enterprise code in those samples. For subtrees that cover structures, make the tree cover the entire structure, not just the first field. Add the flow sample type and extended data type to the protocol tree. Set the protocol column name to capitalize "sFlow" the conventional way, and remove the redundant "sFlow" from the Info column. svn path=/trunk/; revision=13744
2005-03-13 21:42:51 +00:00
if (check_col(pinfo->cinfo, COL_INFO))
col_append_fstr(pinfo->cinfo, COL_INFO, ", seq %u", seqnum);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(sflow_tree, hf_sflow_seqnum, tvb, offset, 4, FALSE);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
offset += 4;
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(sflow_tree, hf_sflow_sysuptime, tvb, offset, 4, FALSE);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
offset += 4;
numsamples = tvb_get_ntohl(tvb,offset);
Handle the packet headeer for sFlow V5, put in a stub dissector for V5 samples, and give the URL of the V5 spec and some hints about how to handle the private enterprise code in those samples. For subtrees that cover structures, make the tree cover the entire structure, not just the first field. Add the flow sample type and extended data type to the protocol tree. Set the protocol column name to capitalize "sFlow" the conventional way, and remove the redundant "sFlow" from the Info column. svn path=/trunk/; revision=13744
2005-03-13 21:42:51 +00:00
if (check_col(pinfo->cinfo, COL_INFO))
col_append_fstr(pinfo->cinfo, COL_INFO, ", %u samples",
numsamples);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
proto_tree_add_item(sflow_tree, hf_sflow_numsamples, tvb, offset, 4, FALSE);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
offset += 4;
/* Ok, we're now at the end of the sflow datagram header;
* everything from here out should be samples. Loop over
* the expected number of samples, and pass them to the appropriate
* dissectors.
*/
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
- Make sure we hanlde arrays with length 0 correctly. - Trivial warning (shadowed variable) fix. svn path=/trunk/; revision=26900
2008-12-02 08:13:20 +00:00
i = 0;
while (i++ < numsamples)
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
offset = dissect_sflow_samples(tvb, pinfo, sflow_tree, offset, version);
From Andrew Feren: Add preference to allow user to configure the port(s) to use when identifying sFlow. svn path=/trunk/; revision=23153
2007-10-11 22:19:38 +00:00
return tvb_length(tvb);
}
static void
sflow_delete_callback(guint32 port)
{
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
if (port) {
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
dissector_delete("udp.port", port, sflow_handle);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
}
From Andrew Feren: Add preference to allow user to configure the port(s) to use when identifying sFlow. svn path=/trunk/; revision=23153
2007-10-11 22:19:38 +00:00
}
static void
sflow_add_callback(guint32 port)
{
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
if (port) {
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
dissector_add("udp.port", port, sflow_handle);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
}
From Andrew Feren: Add preference to allow user to configure the port(s) to use when identifying sFlow. svn path=/trunk/; revision=23153
2007-10-11 22:19:38 +00:00
}
static void
sflow_reinit(void)
{
if (sflow_ports) {
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
range_foreach(sflow_ports, sflow_delete_callback);
g_free(sflow_ports);
From Andrew Feren: Add preference to allow user to configure the port(s) to use when identifying sFlow. svn path=/trunk/; revision=23153
2007-10-11 22:19:38 +00:00
}
sflow_ports = range_copy(global_sflow_ports);
range_foreach(sflow_ports, sflow_add_callback);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
}
change a whole bunch of ethereal into wireshark svn path=/trunk/; revision=18196
2006-05-21 04:49:01 +00:00
/* Register the protocol with Wireshark */
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
/* this format is require because a script is used to build the C function
that calls all the protocol registration.
*/
void
proto_register_sflow(void)
From Andrew Feren: Add preference to allow user to configure the port(s) to use when identifying sFlow. svn path=/trunk/; revision=23153
2007-10-11 22:19:38 +00:00
{
module_t *sflow_module;
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
/* Setup list of header fields See Section 1.6.1 for details*/
static hf_register_info hf[] = {
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* datagram header */
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
{ &hf_sflow_version,
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
{ "datagram version", "sflow.version",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_UINT32, BASE_DEC, NULL, 0x0,
"sFlow datagram version", HFILL }
},
{ &hf_sflow_agent_address_type,
{ "address type", "sflow.agent.addresstype",
FT_UINT32, BASE_DEC, VALS(sflow_agent_address_type), 0x0,
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
"sFlow datagram version", HFILL }
},
{ &hf_sflow_agent_address_v4,
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
{ "agent address", "sflow.agent",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_IPv4, BASE_NONE, NULL, 0x0,
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
"sFlow Agent IP address", HFILL }
},
{ &hf_sflow_agent_address_v6,
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
{ "agent address", "sflow.agent.v6",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_IPv6, BASE_NONE, NULL, 0x0,
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
"sFlow Agent IPv6 address", HFILL }
},
Handle the packet headeer for sFlow V5, put in a stub dissector for V5 samples, and give the URL of the V5 spec and some hints about how to handle the private enterprise code in those samples. For subtrees that cover structures, make the tree cover the entire structure, not just the first field. Add the flow sample type and extended data type to the protocol tree. Set the protocol column name to capitalize "sFlow" the conventional way, and remove the redundant "sFlow" from the Info column. svn path=/trunk/; revision=13744
2005-03-13 21:42:51 +00:00
{ &hf_sflow_sub_agent_id,
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
{ "Sub-agent ID", "sflow.sub_agent_id",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_UINT32, BASE_DEC, NULL, 0x0,
Handle the packet headeer for sFlow V5, put in a stub dissector for V5 samples, and give the URL of the V5 spec and some hints about how to handle the private enterprise code in those samples. For subtrees that cover structures, make the tree cover the entire structure, not just the first field. Add the flow sample type and extended data type to the protocol tree. Set the protocol column name to capitalize "sFlow" the conventional way, and remove the redundant "sFlow" from the Info column. svn path=/trunk/; revision=13744
2005-03-13 21:42:51 +00:00
"sFlow sub-agent ID", HFILL }
},
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
{ &hf_sflow_seqnum,
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
{ "Sequence number", "sflow.sequence_number",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_UINT32, BASE_DEC, NULL, 0x0,
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
"sFlow datagram sequence number", HFILL }
},
{ &hf_sflow_sysuptime,
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
{ "SysUptime", "sflow.sysuptime",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_UINT32, BASE_DEC, NULL, 0x0,
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
"System Uptime", HFILL }
},
{ &hf_sflow_numsamples,
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
{ "NumSamples", "sflow.numsamples",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_UINT32, BASE_DEC, NULL, 0x0,
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
"Number of samples in sFlow datagram", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* Common sample header */
{ &hf_sflow_sample_type,
{ "sFlow sample type", "sflow.sample.type",
FT_UINT32, BASE_DEC, VALS(sflow4_sampletype), 0x0,
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
"Type of sFlow sample", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ &hf_sflow_sample_type_enterprise,
{ "sFlow sample type enterprise", "sflow.sample.enterprise",
FT_UINT32, BASE_DEC, NULL, 0xfffff000,
"Enterprise of sFlow sample", HFILL }
},
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
{ &hf_sflow_sample_type_defaulttype,
{ "sFlow sample type", "sflow.sample.enterprisetype",
FT_UINT32, BASE_DEC, VALS(sflow5_sampletype), 0x00000fff,
"Enterprisetype of sFlow sample", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ &hf_sflow_sample_type_enterprisetype,
{ "sFlow sample type", "sflow.sample.enterprisetype",
FT_UINT32, BASE_DEC, NULL, 0x00000fff,
"Enterprisetype of sFlow sample", HFILL }
},
{ &hf_sflow_sample_length,
{ "Sample length", "sflow.sample.length",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
/* Flowsample */
{ &hf_sflow_fs_seqno,
From Jim Young (bug 3092): The attached patch changes the label for the sflow.fs.seqno from "Sequence number:" to "Sample sequence number:". This change helps differentiate this particular item from the sflow.sequence_number which also uses the label of "Sequence number:". svn path=/trunk/; revision=26902
2008-12-02 09:48:51 +00:00
{ "Sample sequence number", "sflow.fs.seqno",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow_fs_sourceid_type,
{ "Source ID type", "sflow.fs.sourceidtype",
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
FT_UINT8, BASE_DEC, VALS(sflow_sample_sourceidtype), 0x0,
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
NULL, HFILL }
},
{ &hf_sflow_fs_sourceid_index,
{ "Source ID index", "sflow.fs.sourceidindex",
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
FT_UINT24, BASE_DEC, NULL, 0x0,
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
NULL, HFILL }
},
{ &hf_sflow_fs_samplingrate,
{ "Sampling rate", "sflow.fs.samplingrate",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Sample 1 out of N packets", HFILL }
},
{ &hf_sflow_fs_samplepool,
{ "Sample pool", "sflow.fs.pool",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Total number of packets", HFILL }
},
{ &hf_sflow_fs_drops,
{ "Dropped packets", "sflow.fs.pool",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow_fs_ifindexin,
{ "Input interface index", "sflow.fs.ifindexin",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow_fs_multipleoutputs,
{ "Multiple outputs", "sflow.fs.multipleoutputs",
FT_BOOLEAN, 32, TFS(&yes_no_truth), 0x80000000,
"Output to more than one interface", HFILL }
},
{ &hf_sflow_fs_numoutinterfaces,
{ "Number of interfaces", "sflow.fs.numoutinterfaces",
FT_UINT32, BASE_DEC, NULL, 0x7fffffff,
"Number of output interfaces", HFILL }
},
{ &hf_sflow_fs_ifindexout,
{ "Output interface index", "sflow.fs.ifindexout",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow_fs_numrecords,
{ "Number of records", "sflow.fs.numrecords",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Number of flowsample records", HFILL }
},
{ &hf_sflow_fs_recordlength,
{ "Recordlength", "sflow.fs.recordlength",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow4_fs_record_type,
{ "Sample type", "sflow.fs.recordtype",
FT_UINT32, BASE_DEC, VALS(sflow4_fs_record_type), 0x0,
"Type of flowsample", HFILL }
},
{ &hf_sflow5_fs_record_type,
{ "Sample type", "sflow.fs.recordtype",
FT_UINT32, BASE_DEC, VALS(sflow5_packet_fs_record_type), 0x0,
"Type of flowsample", HFILL }
},
/* Countersample */
{ &hf_sflow_cs_seqno,
{ "Sequence number", "sflow.cs.seqno",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow_cs_sourceid_type,
{ "Source ID type", "sflow.cs.sourceidtype",
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
FT_UINT8, BASE_DEC, VALS(sflow_sample_sourceidtype), 0x0,
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
NULL, HFILL }
},
{ &hf_sflow_cs_sourceid_index,
{ "Source ID index", "sflow.cs.sourceidindex",
- Add some detail infos to the parent trees - Improve decoding of the enterprise/type field - Remove some unused code svn path=/trunk/; revision=26894
2008-12-01 20:04:07 +00:00
FT_UINT24, BASE_DEC, NULL, 0x0,
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
NULL, HFILL }
},
{ &hf_sflow_cs_samplinginterval,
{ "Sampling interval", "sflow.cs.samplinginterval",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow_cs_numrecords,
{ "Number of records", "sflow.cs.numrecords",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Number of countersample records", HFILL }
},
{ &hf_sflow_cs_record_type,
{ "Type of counters", "sflow.cs.recordtype",
FT_UINT32, BASE_DEC, VALS(sflow_counterstype), 0x0,
NULL, HFILL }
},
{ &hf_sflow_cs_recordlength,
{ "Recordlength", "sflow.cs.recordlength",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
/* Flow record: raw packet header */
{ &hf_sflow_fs_rawheader_protocol,
{ "Header protocol", "sflow.fs.rawheader.protocol",
FT_UINT32, BASE_DEC, VALS(sflow_header_protocol), 0x0,
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
"Protocol of sampled header", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ &hf_sflow_fs_rawheader_framelength,
{ "Framelength", "sflow.fs.rawheader.framelength",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Total framelength of sampled packet", HFILL }
},
{ &hf_sflow_fs_rawheader_stripped,
{ "Stripped bytes", "sflow.fs.rawheader.stripped",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Bytes stripped from packet", HFILL }
},
{ &hf_sflow_fs_rawheader_headerlength,
{ "Headerlength", "sflow.fs.rawheader.headerlength",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Bytes sampled in packet", HFILL }
},
{ &hf_sflow_fs_rawheader,
{ "Header of sampled packet", "sflow.fs.rawheader",
FT_BYTES, BASE_HEX, NULL, 0x0,
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
"Data from sampled header", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* Flow record: ethernet header */
{ &hf_sflow_fs_ethernet_framelength,
{ "Framelength", "sflow.fs.ethernet.framelength",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Total framelength of sampled packet", HFILL }
},
{ &hf_sflow_fs_ethernet_srcmac,
{ "Ethertype", "sflow.fs.ethernet.srcmac",
FT_ETHER, BASE_NONE, NULL, 0x0,
"Source MAC address of sampled packet", HFILL }
},
{ &hf_sflow_fs_ethernet_dstmac,
{ "Ethertype", "sflow.fs.ethernet.dstmac",
FT_ETHER, BASE_NONE, NULL, 0x0,
"Destination MAC address of sampled packet", HFILL }
},
{ &hf_sflow_fs_ethernet_type,
{ "Ethertype", "sflow.fs.ethernet.type",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Ethertype of sampled packet", HFILL }
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* Flow record: ipv4 and ipv6 headers */
{ &hf_sflow_fs_ip_length,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
{ "IP Packet Length", "sflow.ip_length",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_UINT32, BASE_DEC, NULL, 0x0,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
"Length of IP Packet excluding lower layer encapsulation", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ &hf_sflow_fs_ip_protocol,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
{ "Protocol", "sflow.ip_protocol",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_UINT32, BASE_HEX, NULL, 0x0,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
"IP Protocol", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ &hf_sflow_fs_ip_srcipv4,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
{ "Src IP", "sflow.src_ipv4",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_IPv4, BASE_NONE, NULL, 0x0,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
"Source IPv4 Address", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ &hf_sflow_fs_ip_dstipv4,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
{ "Dst IP", "sflow.dst_ipv4",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_IPv4, BASE_NONE, NULL, 0x0,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
"Destination IPv4 Address", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ &hf_sflow_fs_ip_srcipv6,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
{ "Src IP", "sflow.src_ipv6",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_IPv6, BASE_NONE, NULL, 0x0,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
"Source IPv6 Address", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ &hf_sflow_fs_ip_dstipv6,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
{ "Dst IP", "sflow.dst_ipv6",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_IPv6, BASE_NONE, NULL, 0x0,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
"Destination IPv6 Address", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ &hf_sflow_fs_ip_srcport,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
{ "Src Port", "sflow.src_port",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_UINT32, BASE_DEC, NULL, 0x0,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
"Source Port Number", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ &hf_sflow_fs_ip_dstport,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
{ "Dst Port", "sflow.dst_port",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_UINT32, BASE_DEC, NULL, 0x0,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
"Dst Port Number", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ &hf_sflow_fs_ip_tcpflags,
{ "TCP Flags", "sflow.ip_flags",
FT_UINT32, BASE_HEX, NULL, 0x0,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
"TCP Flags", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ &hf_sflow_fs_ip_tos, /* IPv4 */
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
{ "ToS", "sflow.tos",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_UINT32, BASE_HEX, NULL, 0x0,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
"Type of Service", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ &hf_sflow_fs_ip_priority, /* IPv6 */
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
{ "Priority", "sflow.priority",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_UINT32, BASE_HEX, NULL, 0x0,
From Motonori Shindo: Currently, sFlow dissector only recongnizes "Header" as the packet data type. This patch enhances it to support "IPv4" and "IPv6" packet data type. This patch seems to work well against sFlow packets exported from AlaxalA switch. svn path=/trunk/; revision=25688
2008-07-09 18:37:50 +00:00
"Priority", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* XXX Fix naming for everything between here and hf_sflow_eth_... */
{ &hf_sflow4_extended_information_type,
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
{ "Extended information type", "sflow.extended_information_type",
Handle the packet headeer for sFlow V5, put in a stub dissector for V5 samples, and give the URL of the V5 spec and some hints about how to handle the private enterprise code in those samples. For subtrees that cover structures, make the tree cover the entire structure, not just the first field. Add the flow sample type and extended data type to the protocol tree. Set the protocol column name to capitalize "sFlow" the conventional way, and remove the redundant "sFlow" from the Info column. svn path=/trunk/; revision=13744
2005-03-13 21:42:51 +00:00
FT_UINT32, BASE_DEC, VALS(sflow_extended_data_types), 0x0,
"Type of extended information", HFILL }
},
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
{ &hf_sflow_vlan_in,
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
{ "Incoming 802.1Q VLAN", "sflow.vlan.in",
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
FT_UINT32, BASE_DEC, NULL, 0x0,
"Incoming VLAN ID", HFILL }
},
{ &hf_sflow_vlan_out,
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
{ "Outgoing 802.1Q VLAN", "sflow.vlan.out",
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
FT_UINT32, BASE_DEC, NULL, 0x0,
"Outgoing VLAN ID", HFILL }
},
{ &hf_sflow_pri_in,
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
{ "Incoming 802.1p priority", "sflow.pri.in",
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
FT_UINT32, BASE_DEC, NULL, 0x0,
"Incoming 802.1p priority", HFILL }
},
{ &hf_sflow_pri_out,
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
{ "Outgoing 802.1p priority", "sflow.pri.out",
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
FT_UINT32, BASE_DEC, NULL, 0x0,
"Outgoing 802.1p priority", HFILL }
},
{ &hf_sflow_nexthop_v4,
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
{ "Next hop", "sflow.nexthop",
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
FT_IPv4, BASE_DEC, NULL, 0x0,
In packet-sflow.c, don't pass a NULL value pointer to proto_tree_add_ipv6(). Add tree items for the extended router source and dest mask, and fix offsets. These changes appear to be correct, but I don't have a valid capture with extended router data. In proto.c, throw a dissector error if we try to pass a NULL value to various proto_tree_set_*() routines. Fixes bug 356. svn path=/trunk/; revision=15375
2005-08-16 16:04:30 +00:00
"Next hop address", HFILL }
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
},
{ &hf_sflow_nexthop_v6,
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
{ "Next hop", "sflow.nexthop",
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
FT_IPv6, BASE_HEX, NULL, 0x0,
In packet-sflow.c, don't pass a NULL value pointer to proto_tree_add_ipv6(). Add tree items for the extended router source and dest mask, and fix offsets. These changes appear to be correct, but I don't have a valid capture with extended router data. In proto.c, throw a dissector error if we try to pass a NULL value to various proto_tree_set_*() routines. Fixes bug 356. svn path=/trunk/; revision=15375
2005-08-16 16:04:30 +00:00
"Next hop address", HFILL }
},
{ &hf_sflow_nexthop_src_mask,
{ "Next hop source mask", "sflow.nexthop.src_mask",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Next hop source mask bits", HFILL }
},
{ &hf_sflow_nexthop_dst_mask,
{ "Next hop destination mask", "sflow.nexthop.dst_mask",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Next hop destination mask bits", HFILL }
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
},
{ &hf_sflow_ifindex,
{ "Interface index", "sflow.ifindex",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Interface Index", HFILL }
},
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
{ &hf_sflow_as,
{ "AS Router", "sflow.as",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Autonomous System of Router", HFILL }
},
{ &hf_sflow_src_as,
{ "AS Source", "sflow.srcAS",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Autonomous System of Source", HFILL }
},
{ &hf_sflow_src_peer_as,
{ "AS Peer", "sflow.peerAS",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Autonomous System of Peer", HFILL }
},
{ &hf_sflow_dst_as_entries,
{ "AS Destinations", "sflow.dstASentries",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Autonomous System destinations", HFILL }
},
{ &hf_sflow_dst_as,
{ "AS Destination", "sflow.dstAS",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Autonomous System destination", HFILL }
},
/* Needed for sFlow >= 4. If I had a capture to test... */
{ &hf_sflow_community_entries,
{ "Gateway Communities", "sflow.communityEntries",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Gateway Communities", HFILL }
},
{ &hf_sflow_localpref,
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ "localpref", "sflow.localpref",
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
FT_UINT32, BASE_DEC, NULL, 0x0,
"Local preferences of AS route", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* generic counters */
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
{ &hf_sflow_iftype,
{ "Interface Type", "sflow.iftype",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Interface Type", HFILL }
},
{ &hf_sflow_ifspeed,
{ "Interface Speed", "sflow.ifspeed",
FT_UINT64, BASE_DEC, NULL, 0x0,
"Interface Speed", HFILL }
},
{ &hf_sflow_ifdirection,
{ "Interface Direction", "sflow.ifdirection",
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
FT_UINT32, BASE_DEC, VALS(if_direction_vals), 0x0,
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
"Interface Direction", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ &hf_sflow_ifstatus_unused,
{ "If status (unused)", "sflow.ifstatus.unused",
FT_UINT32, BASE_DEC, NULL, 0xfffffffc,
"Unused interface status bits", HFILL }
},
{ &hf_sflow_ifstatus_admin,
{ "If admin status", "sflow.ifstatus.admin",
FT_UINT32, BASE_DEC, NULL, 0x00000001,
"Interface admin status bit", HFILL }
},
{ &hf_sflow_ifstatus_oper,
{ "If oper status", "sflow.ifstatus.oper",
FT_UINT32, BASE_DEC, NULL, 0x00000002,
"Interface operational status bit", HFILL }
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
},
{ &hf_sflow_ifinoct,
{ "Input Octets", "sflow.ifinoct",
FT_UINT64, BASE_DEC, NULL, 0x0,
"Interface Input Octets", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ &hf_sflow_ifinucast,
{ "Input unicast packets", "sflow.ifinucast",
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
FT_UINT32, BASE_DEC, NULL, 0x0,
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
"Interface Input Unicast Packets", HFILL }
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
},
{ &hf_sflow_ifinmcast,
{ "Input Multicast Packets", "sflow.ifinmcast",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Interface Input Multicast Packets", HFILL }
},
{ &hf_sflow_ifinbcast,
{ "Input Broadcast Packets", "sflow.ifinbcast",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Interface Input Broadcast Packets", HFILL }
},
{ &hf_sflow_ifindisc,
{ "Input Discarded Packets", "sflow.ifindisc",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Interface Input Discarded Packets", HFILL }
},
{ &hf_sflow_ifinerr,
{ "Input Errors", "sflow.ifinerr",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Interface Input Errors", HFILL }
},
{ &hf_sflow_ifinunk,
{ "Input Unknown Protocol Packets", "sflow.ifinunk",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Interface Input Unknown Protocol Packets", HFILL }
},
{ &hf_sflow_ifoutoct,
{ "Output Octets", "sflow.ifoutoct",
FT_UINT64, BASE_DEC, NULL, 0x0,
"Outterface Output Octets", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
{ &hf_sflow_ifoutucast,
{ "Output unicast packets", "sflow.ifoutucast",
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
FT_UINT32, BASE_DEC, NULL, 0x0,
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
"Interface Output Unicast Packets", HFILL }
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
},
{ &hf_sflow_ifoutmcast,
{ "Output Multicast Packets", "sflow.ifoutmcast",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Interface Output Multicast Packets", HFILL }
},
{ &hf_sflow_ifoutbcast,
{ "Output Broadcast Packets", "sflow.ifoutbcast",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Interface Output Broadcast Packets", HFILL }
},
{ &hf_sflow_ifoutdisc,
{ "Output Discarded Packets", "sflow.ifoutdisc",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Interface Output Discarded Packets", HFILL }
},
{ &hf_sflow_ifouterr,
{ "Output Errors", "sflow.ifouterr",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Interface Output Errors", HFILL }
},
{ &hf_sflow_ifpromisc,
{ "Promiscuous Mode", "sflow.ifpromisc",
FT_UINT32, BASE_DEC, NULL, 0x0,
"Interface Promiscuous Mode", HFILL }
},
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/* ethernet counters */
{ &hf_sflow_eth_dot3StatsAlignmentErrors,
{ "dot3StatsAlignmentErrors", "sflow.cs.eth.dot3StatsAlignmentErrors",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow_eth_dot3StatsFCSErrors,
{ "dot3StatsFCSErrors", "sflow.cs.eth.dot3StatsFCSErrors",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow_eth_dot3StatsSingleCollisionFrames,
{ "dot3StatsSingleCollisionFrames", "sflow.cs.eth.dot3StatsSingleCollisionFrames",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow_eth_dot3StatsMultipleCollisionFrames,
{ "dot3StatsMultipleCollisionFrames", "sflow.cs.eth.dot3StatsMultipleCollisionFrames",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow_eth_dot3StatsSQETestErrors,
{ "dot3StatsSQETestErrors", "sflow.cs.eth.dot3StatsSQETestErrors",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow_eth_dot3StatsDeferredTransmissions,
{ "dot3StatsDeferredTransmissions", "sflow.cs.eth.dot3StatsDeferredTransmissions",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow_eth_dot3StatsLateCollisions,
{ "dot3StatsLateCollisions", "sflow.cs.eth.dot3StatsLateCollisions",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow_eth_dot3StatsExcessiveCollisions,
{ "dot3StatsExcessiveCollisions", "sflow.cs.eth.dot3StatsExcessiveCollisions",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow_eth_dot3StatsInternalMacTransmitErrors,
{ "dot3StatsInternalMacTransmitErrors", "sflow.cs.eth.dot3StatsInternalMacTransmitErrors",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow_eth_dot3StatsCarrierSenseErrors,
{ "dot3StatsCarrierSenseErrors", "sflow.cs.eth.dot3StatsCarrierSenseErrors",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow_eth_dot3StatsFrameTooLongs,
{ "dot3StatsFrameTooLongs", "sflow.cs.eth.dot3StatsFrameTooLongs",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow_eth_dot3StatsInternalMacReceiveErrors,
{ "dot3StatsInternalMacReceiveErrors", "sflow.cs.eth.dot3StatsInternalMacReceiveErrors",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
{ &hf_sflow_eth_dot3StatsSymbolErrors,
{ "dot3StatsSymbolErrors", "sflow.cs.eth.dot3StatsSymbolErrors",
FT_UINT32, BASE_DEC, NULL, 0x0,
NULL, HFILL }
},
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
};
/* Setup protocol subtree array */
static gint *ett[] = {
&ett_sflow,
&ett_sflow_sample,
&ett_sflow_extended_data,
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00
&ett_sflow_gw_as_dst,
&ett_sflow_gw_as_dst_seg,
&ett_sflow_gw_community,
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
&ett_sflow_sampled_header,
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
&ett_sflow_counters_record,
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
};
/* Register the protocol name and description */
proto_sflow = proto_register_protocol("InMon sFlow",
"sFlow", "sflow");
/* Required function calls to register the header fields and subtrees used */
proto_register_field_array(proto_sflow, hf, array_length(hf));
proto_register_subtree_array(ett, array_length(ett));
From Andrew Feren: Add preference to allow user to configure the port(s) to use when identifying sFlow. svn path=/trunk/; revision=23153
2007-10-11 22:19:38 +00:00
/* Register our configuration options for sFlow */
sflow_module = prefs_register_protocol(proto_sflow,
proto_reg_handoff_sflow);
From Andrew Ferren (big 2434): While borrowing code from an other dissector I have worked on I realized I previously "borrowed" a comment and typo. Here's a fix. svn path=/trunk/; revision=24928
2008-04-12 09:35:48 +00:00
/* Set default sFlow port(s) */
From Andrew Feren: Add preference to allow user to configure the port(s) to use when identifying sFlow. svn path=/trunk/; revision=23153
2007-10-11 22:19:38 +00:00
range_convert_str(&global_sflow_ports, SFLOW_UDP_PORTS,
MAX_UDP_PORT);
prefs_register_obsolete_preference(sflow_module, "udp.port");
prefs_register_range_preference(sflow_module, "ports",
From Andrew Feren: sFlow datagrams can contain sampled headers from conversations on the network. Often it is convenient to have wireshark dissect these payload headers, but doing so can also have undesirable side effects. Dissected payload headers may match filters looking for header fields that also happen to occur in the payload. This can cause surprising results. Also TCP analysis will almost always flag errors on sampled headers. They are, after all, just a sample and many sequence numbers are sure to be missing. There is probably a more general way to resolve these issues, but adding preferences to enable/disable tcp analysis and dissection of sampled headers will be a good start. This will make it possible to examine the details of sampled headers if desired or to disable dissection if the side effects of dissecting sampled headers cause issues. svn path=/trunk/; revision=23230
2007-10-19 09:50:29 +00:00
"sFlow UDP Port(s)",
From Andrew Feren: Add preference to allow user to configure the port(s) to use when identifying sFlow. svn path=/trunk/; revision=23153
2007-10-11 22:19:38 +00:00
"Set the port(s) for sFlow messages"
" (default: " SFLOW_UDP_PORTS ")",
&global_sflow_ports, MAX_UDP_PORT);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/*
From Andrew Feren: sFlow datagrams can contain sampled headers from conversations on the network. Often it is convenient to have wireshark dissect these payload headers, but doing so can also have undesirable side effects. Dissected payload headers may match filters looking for header fields that also happen to occur in the payload. This can cause surprising results. Also TCP analysis will almost always flag errors on sampled headers. They are, after all, just a sample and many sequence numbers are sure to be missing. There is probably a more general way to resolve these issues, but adding preferences to enable/disable tcp analysis and dissection of sampled headers will be a good start. This will make it possible to examine the details of sampled headers if desired or to disable dissection if the side effects of dissecting sampled headers cause issues. svn path=/trunk/; revision=23230
2007-10-19 09:50:29 +00:00
If I use a filter like "ip.src == 10.1.1.1" this will, in
addition to the usual suspects, find every sFlow packet
where *any* of the payload headers contain 10.1.1.1 as a
src addr. I think this may not be the desired behavior.
It can certainly be confusing since the ip.src being found
is buried about 3 subtrees deep and the subtrees might be
under any one of the sampled (payload) header trees. It is
certainly not quickly obvious why the filter matched.
*/
prefs_register_bool_preference(sflow_module, "enable_dissection",
"Dissect data in sampled headers",
"Enabling dissection makes it easy to view protocol details in each of the sampled headers. Disabling dissection may reduce noise caused when display filters match the contents of any sampled header(s).",
&global_dissect_samp_headers);
The good: - Implement the beginnings of sflow5 support. - Get rid if the inconsistencies regarding return values: Always return the offset. - Make more elements filterable - Make the naming of elements more consistent (not finished) - To see what's missing have a look at the TODO section at the beginning of the file and search for XXX in the code. The not so good: - Only tested with a single sample trace. No extended/expanded data in that trace. - This patch hopefully doesn't break sflow4 support, but I didn't have any traces to test with, so please test. - The names of many filters have changed to make things more consistent. svn path=/trunk/; revision=26891
2008-12-01 10:03:33 +00:00
/*
From Andrew Feren: sFlow datagrams can contain sampled headers from conversations on the network. Often it is convenient to have wireshark dissect these payload headers, but doing so can also have undesirable side effects. Dissected payload headers may match filters looking for header fields that also happen to occur in the payload. This can cause surprising results. Also TCP analysis will almost always flag errors on sampled headers. They are, after all, just a sample and many sequence numbers are sure to be missing. There is probably a more general way to resolve these issues, but adding preferences to enable/disable tcp analysis and dissection of sampled headers will be a good start. This will make it possible to examine the details of sampled headers if desired or to disable dissection if the side effects of dissecting sampled headers cause issues. svn path=/trunk/; revision=23230
2007-10-19 09:50:29 +00:00
It is not clear to me that it *ever* makes sense to enable
this option. However, it was previously the default
behavior so I'll leave it as an option if someone thinks
they have a use for it.
*/
prefs_register_bool_preference(sflow_module, "enable_analysis",
"Analyze data in sampled IP headers",
"This option only makes sense if dissection of sampled headers is enabled and probably not even then.",
&global_analyze_samp_ip_headers );
From Andrew Feren: Add preference to allow user to configure the port(s) to use when identifying sFlow. svn path=/trunk/; revision=23153
2007-10-11 22:19:38 +00:00
register_init_routine(&sflow_reinit);
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
}
From Andrew Feren: Add preference to allow user to configure the port(s) to use when identifying sFlow. svn path=/trunk/; revision=23153
2007-10-11 22:19:38 +00:00
/* If this dissector uses sub-dissector registration add a
registration routine. This format is required because a script is
used to find these routines and create the code that calls these
routines.
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
*/
void
proto_reg_handoff_sflow(void)
{
Minor cleanup (mostly related to proto_reg_handoff...) svn path=/trunk/; revision=26121
2008-09-02 19:08:29 +00:00
static gboolean sflow_prefs_initialized = FALSE;
From Andrew Feren: Add preference to allow user to configure the port(s) to use when identifying sFlow. svn path=/trunk/; revision=23153
2007-10-11 22:19:38 +00:00
if (!sflow_prefs_initialized) {
sflow_handle = new_create_dissector_handle(dissect_sflow,
proto_sflow);
Minor cleanup (mostly related to proto_reg_handoff...) svn path=/trunk/; revision=26121
2008-09-02 19:08:29 +00:00
data_handle = find_dissector("data");
From Andrew Feren: Add preference to allow user to configure the port(s) to use when identifying sFlow. svn path=/trunk/; revision=23153
2007-10-11 22:19:38 +00:00
sflow_prefs_initialized = TRUE;
}
sflow_reinit();
We don't have an SMDS dissector, and it's not clear what dissector should be used for ATM, so just use the data dissector for now. The X.25 dissector registers itself as "x.25", not "x25". svn path=/trunk/; revision=13711
2005-03-11 11:46:48 +00:00
/*
* XXX - should this be done with a dissector table?
*/
From Andrew Feren: sFlow datagrams can contain sampled headers from conversations on the network. Often it is convenient to have wireshark dissect these payload headers, but doing so can also have undesirable side effects. Dissected payload headers may match filters looking for header fields that also happen to occur in the payload. This can cause surprising results. Also TCP analysis will almost always flag errors on sampled headers. They are, after all, just a sample and many sequence numbers are sure to be missing. There is probably a more general way to resolve these issues, but adding preferences to enable/disable tcp analysis and dissection of sampled headers will be a good start. This will make it possible to examine the details of sampled headers if desired or to disable dissection if the side effects of dissecting sampled headers cause issues. svn path=/trunk/; revision=23230
2007-10-19 09:50:29 +00:00
if (global_dissect_samp_headers) {
eth_withoutfcs_handle = find_dissector("eth_withoutfcs");
tr_handle = find_dissector("tr");
fddi_handle = find_dissector("fddi");
fr_handle = find_dissector("fr");
x25_handle = find_dissector("x.25");
ppp_handle = find_dissector("ppp");
We don't have an SMDS dissector, and it's not clear what dissector should be used for ATM, so just use the data dissector for now. The X.25 dissector registers itself as "x.25", not "x25". svn path=/trunk/; revision=13711
2005-03-11 11:46:48 +00:00
#if 0
From Andrew Feren: sFlow datagrams can contain sampled headers from conversations on the network. Often it is convenient to have wireshark dissect these payload headers, but doing so can also have undesirable side effects. Dissected payload headers may match filters looking for header fields that also happen to occur in the payload. This can cause surprising results. Also TCP analysis will almost always flag errors on sampled headers. They are, after all, just a sample and many sequence numbers are sure to be missing. There is probably a more general way to resolve these issues, but adding preferences to enable/disable tcp analysis and dissection of sampled headers will be a good start. This will make it possible to examine the details of sampled headers if desired or to disable dissection if the side effects of dissecting sampled headers cause issues. svn path=/trunk/; revision=23230
2007-10-19 09:50:29 +00:00
smds_handle = find_dissector("smds");
We don't have an SMDS dissector, and it's not clear what dissector should be used for ATM, so just use the data dissector for now. The X.25 dissector registers itself as "x.25", not "x25". svn path=/trunk/; revision=13711
2005-03-11 11:46:48 +00:00
#else
From Andrew Feren: sFlow datagrams can contain sampled headers from conversations on the network. Often it is convenient to have wireshark dissect these payload headers, but doing so can also have undesirable side effects. Dissected payload headers may match filters looking for header fields that also happen to occur in the payload. This can cause surprising results. Also TCP analysis will almost always flag errors on sampled headers. They are, after all, just a sample and many sequence numbers are sure to be missing. There is probably a more general way to resolve these issues, but adding preferences to enable/disable tcp analysis and dissection of sampled headers will be a good start. This will make it possible to examine the details of sampled headers if desired or to disable dissection if the side effects of dissecting sampled headers cause issues. svn path=/trunk/; revision=23230
2007-10-19 09:50:29 +00:00
/* We don't have an SMDS dissector yet */
smds_handle = data_handle;
We don't have an SMDS dissector, and it's not clear what dissector should be used for ATM, so just use the data dissector for now. The X.25 dissector registers itself as "x.25", not "x25". svn path=/trunk/; revision=13711
2005-03-11 11:46:48 +00:00
#endif
#if 0
From Andrew Feren: sFlow datagrams can contain sampled headers from conversations on the network. Often it is convenient to have wireshark dissect these payload headers, but doing so can also have undesirable side effects. Dissected payload headers may match filters looking for header fields that also happen to occur in the payload. This can cause surprising results. Also TCP analysis will almost always flag errors on sampled headers. They are, after all, just a sample and many sequence numbers are sure to be missing. There is probably a more general way to resolve these issues, but adding preferences to enable/disable tcp analysis and dissection of sampled headers will be a good start. This will make it possible to examine the details of sampled headers if desired or to disable dissection if the side effects of dissecting sampled headers cause issues. svn path=/trunk/; revision=23230
2007-10-19 09:50:29 +00:00
aal5_handle = find_dissector("atm");
We don't have an SMDS dissector, and it's not clear what dissector should be used for ATM, so just use the data dissector for now. The X.25 dissector registers itself as "x.25", not "x25". svn path=/trunk/; revision=13711
2005-03-11 11:46:48 +00:00
#else
From Andrew Feren: sFlow datagrams can contain sampled headers from conversations on the network. Often it is convenient to have wireshark dissect these payload headers, but doing so can also have undesirable side effects. Dissected payload headers may match filters looking for header fields that also happen to occur in the payload. This can cause surprising results. Also TCP analysis will almost always flag errors on sampled headers. They are, after all, just a sample and many sequence numbers are sure to be missing. There is probably a more general way to resolve these issues, but adding preferences to enable/disable tcp analysis and dissection of sampled headers will be a good start. This will make it possible to examine the details of sampled headers if desired or to disable dissection if the side effects of dissecting sampled headers cause issues. svn path=/trunk/; revision=23230
2007-10-19 09:50:29 +00:00
/* What dissector should be used here? */
aal5_handle = data_handle;
We don't have an SMDS dissector, and it's not clear what dissector should be used for ATM, so just use the data dissector for now. The X.25 dissector registers itself as "x.25", not "x25". svn path=/trunk/; revision=13711
2005-03-11 11:46:48 +00:00
#endif
From Andrew Feren: sFlow datagrams can contain sampled headers from conversations on the network. Often it is convenient to have wireshark dissect these payload headers, but doing so can also have undesirable side effects. Dissected payload headers may match filters looking for header fields that also happen to occur in the payload. This can cause surprising results. Also TCP analysis will almost always flag errors on sampled headers. They are, after all, just a sample and many sequence numbers are sure to be missing. There is probably a more general way to resolve these issues, but adding preferences to enable/disable tcp analysis and dissection of sampled headers will be a good start. This will make it possible to examine the details of sampled headers if desired or to disable dissection if the side effects of dissecting sampled headers cause issues. svn path=/trunk/; revision=23230
2007-10-19 09:50:29 +00:00
ipv4_handle = find_dissector("ip");
ipv6_handle = find_dissector("ipv6");
mpls_handle = find_dissector("mpls");
} else {
eth_withoutfcs_handle = data_handle;
tr_handle = data_handle;
fddi_handle = data_handle;
fr_handle = data_handle;
x25_handle = data_handle;
ppp_handle = data_handle;
smds_handle = data_handle;
aal5_handle = data_handle;
ipv4_handle = data_handle;
ipv6_handle = data_handle;
mpls_handle = data_handle;
}
From Jeff Rizzo: sFlow support. svn path=/trunk/; revision=7879
2003-06-13 22:31:11 +00:00
}
From Andrew Feren : Decoding extended gateway information not implemented for sFlow svn path=/trunk/; revision=24565
2008-03-05 20:33:19 +00:00