Wireshark-bugs: [Wireshark-bugs] [Bug 5083] NetFlow forwarding status and template fixes
Date: Tue, 10 Aug 2010 07:06:42 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5083 --- Comment #7 from Aamer Akhter <aakhter@xxxxxxxxx> 2010-08-10 07:06:36 PDT --- (From update of attachment 5011) Index: epan/dissectors/packet-netflow.c =================================================================== --- epan/dissectors/packet-netflow.c (revision 33704) +++ epan/dissectors/packet-netflow.c (working copy) @@ -63,6 +63,11 @@ ** See also ** ** http://www.cisco.com/en/US/docs/ios/solutions_docs/netflow/nfwhite.html + ** + ***************************************************************************** + ** NetFlow forwarding status and template fixes + ** by Aamer Akhter <aakhter@xxxxxxxxx> + ** Copyright 2010, cisco Systems, Inc. ** ** $Yahoo: //depot/fumerola/packet-netflow/packet-netflow.c#14 $ */ @@ -198,6 +203,410 @@ static struct v9_template v9_template_cache[V9TEMPLATE_CACHE_MAX_ENTRIES]; +static const value_string v9_template_types[] = { + { 1, "BYTES" }, + { 2, "PKTS" }, + { 3, "FLOWS" }, + { 4, "PROTOCOL" }, + { 5, "IP_TOS" }, + { 6, "TCP_FLAGS" }, + { 7, "L4_SRC_PORT" }, + { 8, "IP_SRC_ADDR" }, + { 9, "SRC_MASK" }, + { 10, "INPUT_SNMP" }, + { 11, "L4_DST_PORT" }, + { 12, "IP_DST_ADDR" }, + { 13, "DST_MASK" }, + { 14, "OUTPUT_SNMP" }, + { 15, "IP_NEXT_HOP" }, + { 16, "SRC_AS" }, + { 17, "DST_AS" }, + { 18, "BGP_NEXT_HOP" }, + { 19, "MUL_DPKTS" }, + { 20, "MUL_DOCTETS" }, + { 21, "LAST_SWITCHED" }, + { 22, "FIRST_SWITCHED" }, + { 23, "OUT_BYTES" }, + { 24, "OUT_PKTS" }, + { 25, "IP LENGTH MINIMUM" }, + { 26, "IP LENGTH MAXIMUM" }, + { 27, "IPV6_SRC_ADDR" }, + { 28, "IPV6_DST_ADDR" }, + { 29, "IPV6_SRC_MASK" }, + { 30, "IPV6_DST_MASK" }, + { 31, "FLOW_LABEL" }, + { 32, "ICMP_TYPE" }, + { 33, "IGMP_TYPE" }, + { 34, "SAMPLING_INTERVAL" }, + { 35, "SAMPLING_ALGORITHM" }, + { 36, "FLOW_ACTIVE_TIMEOUT" }, + { 37, "FLOW_INACTIVE_TIMEOUT" }, + { 38, "ENGINE_TYPE" }, + { 39, "ENGINE_ID" }, + { 40, "TOTAL_BYTES_EXP" }, + { 41, "TOTAL_PKTS_EXP" }, + { 42, "TOTAL_FLOWS_EXP" }, + { 44, "IP_SRC_PREFIX" }, + { 45, "IP_DST_PREFIX" }, + { 46, "MPLS_TOP_LABEL_TYPE" }, + { 47, "MPLS_TOP_LABEL_ADDR" }, + { 48, "FLOW_SAMPLER_ID" }, + { 49, "FLOW_SAMPLER_MODE" }, + { 50, "FLOW_SAMPLER_RANDOM_INTERVAL" }, + { 51, "FLOW_CLASS" }, + { 52, "IP TTL MINIMUM" }, + { 53, "IP TTL MAXIMUM" }, + { 54, "IPv4 ID" }, + { 55, "DST_TOS" }, + { 56, "SRC_MAC" }, + { 57, "DST_MAC" }, + { 58, "SRC_VLAN" }, + { 59, "DST_VLAN" }, + { 60, "IP_PROTOCOL_VERSION" }, + { 61, "DIRECTION" }, + { 62, "IPV6_NEXT_HOP" }, + { 63, "BGP_IPV6_NEXT_HOP" }, + { 64, "IPV6_OPTION_HEADERS" }, + { 70, "MPLS_LABEL_1" }, + { 71, "MPLS_LABEL_2" }, + { 72, "MPLS_LABEL_3" }, + { 73, "MPLS_LABEL_4" }, + { 74, "MPLS_LABEL_5" }, + { 75, "MPLS_LABEL_6" }, + { 76, "MPLS_LABEL_7" }, + { 77, "MPLS_LABEL_8" }, + { 78, "MPLS_LABEL_9" }, + { 79, "MPLS_LABEL_10" }, + { 80, "DESTINATION_MAC" }, + { 81, "SOURCE_MAC" }, + { 82, "IF_NAME" }, + { 83, "IF_DESC" }, + { 84, "SAMPLER_NAME" }, + { 85, "BYTES_TOTAL" }, + { 86, "PACKETS_TOTAL" }, + { 88, "FRAGMENT_OFFSET" }, + { 89, "FORWARDING_STATUS" }, + { 90, "VPN_ROUTE_DISTINGUISHER" }, + { 91, "mplsTopLabelPrefixLength" }, + { 92, "SRC_TRAFFIC_INDEX" }, + { 93, "DST_TRAFFIC_INDEX" }, + { 94, "APPLICATION_DESC" }, + { 95, "APPLICATION_ID" }, + { 96, "APPLICATION_NAME" }, + { 98, "postIpDiffServCodePoint" }, + { 99, "multicastReplicationFactor" }, + { 128, "SRC_AS_PEER" }, + { 129, "DST_AS_PEER" }, + { 130, "exporterIPv4Address" }, + { 131, "exporterIPv6Address" }, + { 132, "DROPPED_BYTES" }, + { 133, "DROPPED_PACKETS" }, + { 134, "DROPPED_BYTES_TOTAL" }, + { 135, "DROPPED_PACKETS_TOTAL" }, + { 136, "flowEndReason" }, + { 137, "commonPropertiesId" }, + { 138, "observationPointId" }, + { 139, "icmpTypeCodeIPv6" }, + { 140, "MPLS_TOP_LABEL_IPv6_ADDRESS" }, + { 141, "lineCardId" }, + { 142, "portId" }, + { 143, "meteringProcessId" }, + { 144, "FLOW_EXPORTER" }, + { 145, "templateId" }, + { 146, "wlanChannelId" }, + { 147, "wlanSSID" }, + { 148, "flowId" }, + { 149, "observationDomainId" }, + { 150, "flowStartSeconds" }, + { 151, "flowEndSeconds" }, + { 152, "flowStartMilliseconds" }, + { 153, "flowEndMilliseconds" }, + { 154, "flowStartMicroseconds" }, + { 155, "flowEndMicroseconds" }, + { 156, "flowStartNanoseconds" }, + { 157, "flowEndNanoseconds" }, + { 158, "flowStartDeltaMicroseconds" }, + { 159, "flowEndDeltaMicroseconds" }, + { 160, "systemInitTimeMilliseconds" }, + { 161, "flowDurationMilliseconds" }, + { 162, "flowDurationMicroseconds" }, + { 163, "observedFlowTotalCount" }, + { 164, "ignoredPacketTotalCount" }, + { 165, "ignoredOctetTotalCount" }, + { 166, "notSentFlowTotalCount" }, + { 167, "notSentPacketTotalCount" }, + { 168, "notSentOctetTotalCount" }, + { 169, "destinationIPv6Prefix" }, + { 170, "sourceIPv6Prefix" }, + { 171, "postOctetTotalCount" }, + { 172, "postPacketTotalCount" }, + { 173, "flowKeyIndicator" }, + { 174, "postMCastPacketTotalCount" }, + { 175, "postMCastOctetTotalCount" }, + { 176, "ICMP_IPv4_TYPE" }, + { 177, "ICMP_IPv4_CODE" }, + { 178, "ICMP_IPv6_TYPE" }, + { 179, "ICMP_IPv6_CODE" }, + { 180, "UDP_SRC_PORT" }, + { 181, "UDP_DST_PORT" }, + { 182, "TCP_SRC_PORT" }, + { 183, "TCP_DST_PORT" }, + { 184, "TCP_SEQ_NUM" }, + { 185, "TCP_ACK_NUM" }, + { 186, "TCP_WINDOW_SIZE" }, + { 187, "TCP_URGENT_PTR" }, + { 188, "TCP_HEADER_LEN" }, + { 189, "IP_HEADER_LEN" }, + { 190, "IP_TOTAL_LEN" }, + { 191, "payloadLengthIPv6" }, + { 192, "IP_TTL" }, + { 193, "nextHeaderIPv6" }, + { 194, "IP_TOS" }, + { 195, "IP_DSCP" }, + { 196, "IP_PRECEDENCE" }, + { 197, "IP_FRAGMENT_FLAGS" }, + { 198, "BYTES_SQUARED" }, + { 199, "BYTES_SQUARED_PERMANENT" }, + { 200, "MPLS_TOP_LABEL_TTL" }, + { 201, "MPLS_LABEL_STACK_OCTETS" }, + { 202, "MPLS_LABEL_STACK_DEPTH" }, + { 203, "MPLS_TOP_LABEL_EXP" }, + { 204, "IP_PAYLOAD_LENGTH" }, + { 205, "UDP_LENGTH" }, + { 206, "IS_MULTICAST" }, + { 207, "IP_HEADER_WORDS" }, + { 208, "IP_OPTION_MAP" }, + { 209, "TCP_OPTION_MAP" }, + { 210, "paddingOctets" }, + { 211, "collectorIPv4Address" }, + { 212, "collectorIPv6Address" }, + { 213, "collectorInterface" }, + { 214, "collectorProtocolVersion" }, + { 215, "collectorTransportProtocol" }, + { 216, "collectorTransportPort" }, + { 217, "exporterTransportPort" }, + { 218, "tcpSynTotalCount" }, + { 219, "tcpFinTotalCount" }, + { 220, "tcpRstTotalCount" }, + { 221, "tcpPshTotalCount" }, + { 222, "tcpAckTotalCount" }, + { 223, "tcpUrgTotalCount" }, + { 224, "ipTotalLength" }, + { 225, "postNATSourceIPv4Address" }, + { 226, "postNATDestinationIPv4Address" }, + { 227, "postNAPTSourceTransportPort" }, + { 228, "postNAPTDestinationTransportPort" }, + { 229, "natOriginatingAddressRealm" }, + { 230, "natEvent" }, + { 231, "initiatorOctets" }, + { 232, "responderOctets" }, + { 233, "firewallEvent" }, + { 234, "ingressVRFID" }, + { 235, "egressVRFID" }, + { 236, "VRFname" }, + { 237, "postMplsTopLabelExp" }, + { 238, "tcpWindowScale" }, + { 239, "biflowDirection" }, + { 240, "ethernetHeaderLength" }, + { 241, "ethernetPayloadLength" }, + { 242, "ethernetTotalLength" }, + { 243, "dot1qVlanId" }, + { 244, "dot1qPriority" }, + { 245, "dot1qCustomerVlanId" }, + { 246, "dot1qCustomerPriority" }, + { 247, "metroEvcId" }, + { 248, "metroEvcType" }, + { 249, "pseudoWireId" }, + { 250, "pseudoWireType" }, + { 251, "pseudoWireControlWord" }, + { 252, "ingressPhysicalInterface" }, + { 253, "egressPhysicalInterface" }, + { 254, "postDot1qVlanId" }, + { 255, "postDot1qCustomerVlanId" }, + { 256, "ethernetType" }, + { 257, "postIpPrecedence" }, + { 258, "collectionTimeMilliseconds" }, + { 259, "exportSctpStreamId" }, + { 260, "maxExportSeconds" }, + { 261, "maxFlowEndSeconds" }, + { 262, "messageMD5Checksum" }, + { 263, "messageScope" }, + { 264, "minExportSeconds" }, + { 265, "minFlowStartSeconds" }, + { 266, "opaqueOctets" }, + { 267, "sessionScope" }, + { 268, "maxFlowEndMicroseconds" }, + { 269, "maxFlowEndMilliseconds" }, + { 270, "maxFlowEndNanoseconds" }, + { 271, "minFlowStartMicroseconds" }, + { 272, "minFlowStartMilliseconds" }, + { 273, "minFlowStartNanoseconds" }, + { 274, "collectorCertificate" }, + { 275, "exporterCertificate" }, + { 301, "selectionSequenceId" }, + { 302, "selectorId" }, + { 303, "informationElementId" }, + { 304, "selectorAlgorithm" }, + { 305, "samplingPacketInterval" }, + { 306, "samplingPacketSpace" }, + { 307, "samplingTimeInterval" }, + { 308, "samplingTimeSpace" }, + { 309, "samplingSize" }, + { 310, "samplingPopulation" }, + { 311, "samplingProbability" }, + { 313, "IP_SECTION HEADER" }, + { 314, "IP_SECTION PAYLOAD" }, + { 316, "mplsLabelStackSection" }, + { 317, "mplsPayloadPacketSection" }, + { 318, "selectorIdTotalPktsObserved" }, + { 319, "selectorIdTotalPktsSelected" }, + { 320, "absoluteError" }, + { 321, "relativeError" }, + { 322, "observationTimeSeconds" }, + { 323, "observationTimeMilliseconds" }, + { 324, "observationTimeMicroseconds" }, + { 325, "observationTimeNanoseconds" }, + { 326, "digestHashValue" }, + { 327, "hashIPPayloadOffset" }, + { 328, "hashIPPayloadSize" }, + { 329, "hashOutputRangeMin" }, + { 330, "hashOutputRangeMax" }, + { 331, "hashSelectedRangeMin" }, + { 332, "hashSelectedRangeMax" }, + { 333, "hashDigestOutput" }, + { 334, "hashInitialiserValue" }, + { 335, "selectorName" }, + { 336, "upperCILimit" }, + { 337, "lowerCILimit" }, + { 338, "confidenceLevel" }, + { 339, "informationElementDataType" }, + { 340, "informationElementDescription" }, + { 341, "informationElementName" }, + { 342, "informationElementRangeBegin" }, + { 343, "informationElementRangeEnd" }, + { 344, "informationElementSemantics" }, + { 345, "informationElementUnits" }, + { 346, "privateEnterpriseNumber" }, + /* Cisco ASA5500 Series NetFlow */ + { 33000, "INGRESS_ACL_ID" }, + { 33001, "EGRESS_ACL_ID" }, + { 33002, "FW_EXT_EVENT" }, + { 40000, "AAA_USERNAME" }, + { 40001, "XLATE_SRC_ADDR_IPV4" }, + { 40002, "XLATE_DST_ADDR_IPV4" }, + { 40003, "XLATE_SRC_PORT" }, + { 40004, "XLATE_DST_PORT" }, + { 40005, "FW_EVENT" }, + { 0, NULL } +}; + +static const value_string v9_scope_field_types[] = { + { 1, "System" }, + { 2, "Interface" }, + { 3, "Line Card" }, + { 4, "NetFlow Cache" }, + { 5, "Template" }, + { 0, NULL } +}; + +static const value_string v9_sampler_mode[] = { + { 0, "Determinist" }, + { 1, "Unknown" }, + { 2, "Random" }, + { 0, NULL } +}; +static const value_string v9_direction[] = { + { 0, "Ingress" }, + { 1, "Egress" }, + { 0, NULL } +}; +static const value_string v9_forwarding_status[] = { + { 0, "Unknown"}, /* Observed on IOS-XR 3.2 */ + { 1, "Forward"}, /* Observed on 7200 12.4(9)T */ + { 2, "Drop"}, /* Observed on 7200 12.4(9)T */ + { 3, "Consume"}, /* Observed on 7200 12.4(9)T */ + { 0, NULL } +}; +static const value_string v9_forwarding_status_code[] = { + { 64, "Forwarded (Unknown)" }, + { 65, "Forwarded Fragmented" }, + { 66, "Forwarded not Fragmented" }, + { 128, "Dropped (Unknown)" }, + { 129, "Drop ACL Deny" }, + { 130, "Drop ACL drop" }, + { 131, "Drop Unroutable" }, + { 132, "Drop Adjacency" }, + { 133, "Drop Fragmentation & DF set" }, + { 134, "Drop Bad header checksum" }, + { 135, "Drop Bad total Length" }, + { 136, "Drop Bad Header Length" }, + { 137, "Drop bad TTL" }, + { 138, "Drop Policer" }, + { 139, "Drop WRED" }, + { 140, "Drop RPF" }, + { 141, "Drop For us" }, + { 142, "Drop Bad output interface" }, + { 143, "Drop Hardware" }, + { 192, "Consumed (Unknown)" }, + { 193, "Terminate Punt Adjacency" }, + { 194, "Terminate Incomplete Adjacency" }, + { 195, "Terminate For us" }, + { 0, NULL } +}; +static const value_string v9_firewall_event[] = { + { 0, "Default (ignore)"}, + { 1, "Flow created"}, + { 2, "Flow deleted"}, + { 3, "Flow denied"}, + { 4, "Flow alart"}, + { 0, NULL } +}; + +static const value_string v9_extended_firewall_event[] = { + { 0, "ignore"}, + { 1001, "Flow denied by an ingress ACL"}, + { 1002, "Flow denied by an egress ACL"}, + { 1003, "Flow denied by security appliance"}, + { 1004, "Flow denied (TCP flow beginning with not TCP SYN)"}, + { 0, NULL } +}; +static const value_string engine_type[] = { + { 0, "RP"}, + { 1, "VIP/Linecard"}, + { 2, "PFC/DFC" }, + { 0, NULL } +}; +static const value_string v9_flow_end_reason[] = { + { 0, "Unknown"}, + { 1, "Idle timeout"}, + { 2, "Active timeout" }, + { 3, "End of Flow detected" }, + { 4, "Forced end" }, + { 5, "Lack of resources" }, + { 0, NULL } +}; +static const value_string v9_biflow_direction[] = { + { 0, "Arbitrary"}, + { 1, "Initiator"}, + { 2, "ReverseInitiator" }, + { 3, "Perimeter" }, + { 0, NULL } +}; +static const value_string selector_algorithm[] = { + { 0, "Reserved"}, + { 1, "Systematic count-based Sampling"}, + { 2, "Systematic time-based Sampling"}, + { 3, "Random n-out-of-N Sampling"}, + { 4, "Uniform probabilistic Sampling"}, + { 5, "Property match Filtering"}, + { 6, "Hash based Filtering using BOB"}, + { 7, " Hash based Filtering using IPSX"}, + { 8, "Hash based Filtering using CRC"}, + { 0, NULL } +}; + + + /* * wireshark tree identifiers */ @@ -336,7 +745,6 @@ static int hf_cflow_if_name = -1; static int hf_cflow_if_descr = -1; static int hf_cflow_sampler_name = -1; -static int hf_cflow_forwarding_status_code = -1; static int hf_cflow_forwarding_status = -1; static int hf_cflow_forwarding_code = -1; static int hf_cflow_nbar_appl_desc = -1; @@ -635,8 +1043,6 @@ guint32 src_id); static struct v9_template *v9_template_get(guint16 id, address * net_src, guint32 src_id); -static const char * decode_v9_template_types(int type); - static const gchar *getprefix(const guint32 * address, int prefix); static int flow_process_ints(proto_tree * pdutree, tvbuff_t * tvb, @@ -2160,13 +2566,23 @@ /* Forwarding status is encoded on 1 byte with * the 2 left bits giving the status and the 6 * remaining bits giving the reason code. */ - ti = proto_tree_add_item(pdutree, hf_cflow_forwarding_status_code, - tvb, offset, length, FALSE); + + ti = proto_tree_add_text(pdutree, tvb, offset, length, "Forwarding Status"); + + fwdstattree = proto_item_add_subtree(ti, ett_fwdstat); proto_tree_add_item(fwdstattree, hf_cflow_forwarding_status, tvb, offset, length, FALSE); proto_tree_add_item(fwdstattree, hf_cflow_forwarding_code, tvb, offset, length, FALSE); + + /* add status code to tree summary */ + if (length==1) { + proto_item_append_text(ti, ": %s", val_to_str((tvb_get_guint8(tvb, offset)>>6), + v9_forwarding_status, "Unknown(%d)")); + proto_item_append_text(ti, ": %s", val_to_str((tvb_get_guint8(tvb, offset)&0x3F), + v9_forwarding_status_code, "Unknown(%d)")); + }; break; case 90: /* mplsVpnRouteDistinguisher */ @@ -3398,7 +3814,8 @@ } if (ti && pen == REVPEN) { proto_item_append_text(ti, " (Reverse Type %u %s)", - type & 0x7fff, decode_v9_template_types(type)); + type & 0x7fff, + val_to_str_const(type,v9_template_types,"Unknown")); } offset += length; @@ -3660,6 +4077,8 @@ field_tree = proto_item_add_subtree(field_item, ett_field); type = tvb_get_ntohs(tvb, offset); + proto_item_append_text(field_item, ": %s", val_to_str(type, + v9_template_types, "Unknown(%d)")); entry_length = tvb_get_ntohs(tvb, offset + 2); if ((flowset_id == 2) && (type & 0x8000)) { pen = tvb_get_ntohl(tvb, offset + 4); @@ -3705,415 +4124,8 @@ return (0); } -static const value_string v9_template_types[] = { - { 1, "BYTES" }, - { 2, "PKTS" }, - { 3, "FLOWS" }, - { 4, "PROTOCOL" }, - { 5, "IP_TOS" }, - { 6, "TCP_FLAGS" }, - { 7, "L4_SRC_PORT" }, - { 8, "IP_SRC_ADDR" }, - { 9, "SRC_MASK" }, - { 10, "INPUT_SNMP" }, - { 11, "L4_DST_PORT" }, - { 12, "IP_DST_ADDR" }, - { 13, "DST_MASK" }, - { 14, "OUTPUT_SNMP" }, - { 15, "IP_NEXT_HOP" }, - { 16, "SRC_AS" }, - { 17, "DST_AS" }, - { 18, "BGP_NEXT_HOP" }, - { 19, "MUL_DPKTS" }, - { 20, "MUL_DOCTETS" }, - { 21, "LAST_SWITCHED" }, - { 22, "FIRST_SWITCHED" }, - { 23, "OUT_BYTES" }, - { 24, "OUT_PKTS" }, - { 25, "IP LENGTH MINIMUM" }, - { 26, "IP LENGTH MAXIMUM" }, - { 27, "IPV6_SRC_ADDR" }, - { 28, "IPV6_DST_ADDR" }, - { 29, "IPV6_SRC_MASK" }, - { 30, "IPV6_DST_MASK" }, - { 31, "FLOW_LABEL" }, - { 32, "ICMP_TYPE" }, - { 33, "IGMP_TYPE" }, - { 34, "SAMPLING_INTERVAL" }, - { 35, "SAMPLING_ALGORITHM" }, - { 36, "FLOW_ACTIVE_TIMEOUT" }, - { 37, "FLOW_INACTIVE_TIMEOUT" }, - { 38, "ENGINE_TYPE" }, - { 39, "ENGINE_ID" }, - { 40, "TOTAL_BYTES_EXP" }, - { 41, "TOTAL_PKTS_EXP" }, - { 42, "TOTAL_FLOWS_EXP" }, - { 44, "IP_SRC_PREFIX" }, - { 45, "IP_DST_PREFIX" }, - { 46, "MPLS_TOP_LABEL_TYPE" }, - { 47, "MPLS_TOP_LABEL_ADDR" }, - { 48, "FLOW_SAMPLER_ID" }, - { 49, "FLOW_SAMPLER_MODE" }, - { 50, "FLOW_SAMPLER_RANDOM_INTERVAL" }, - { 51, "FLOW_CLASS" }, - { 52, "IP TTL MINIMUM" }, - { 53, "IP TTL MAXIMUM" }, - { 54, "IPv4 ID" }, - { 55, "DST_TOS" }, - { 56, "SRC_MAC" }, - { 57, "DST_MAC" }, - { 58, "SRC_VLAN" }, - { 59, "DST_VLAN" }, - { 60, "IP_PROTOCOL_VERSION" }, - { 61, "DIRECTION" }, - { 62, "IPV6_NEXT_HOP" }, - { 63, "BGP_IPV6_NEXT_HOP" }, - { 64, "IPV6_OPTION_HEADERS" }, - { 70, "MPLS_LABEL_1" }, - { 71, "MPLS_LABEL_2" }, - { 72, "MPLS_LABEL_3" }, - { 73, "MPLS_LABEL_4" }, - { 74, "MPLS_LABEL_5" }, - { 75, "MPLS_LABEL_6" }, - { 76, "MPLS_LABEL_7" }, - { 77, "MPLS_LABEL_8" }, - { 78, "MPLS_LABEL_9" }, - { 79, "MPLS_LABEL_10" }, - { 80, "DESTINATION_MAC" }, - { 81, "SOURCE_MAC" }, - { 82, "IF_NAME" }, - { 83, "IF_DESC" }, - { 84, "SAMPLER_NAME" }, - { 85, "BYTES_TOTAL" }, - { 86, "PACKETS_TOTAL" }, - { 88, "FRAGMENT_OFFSET" }, - { 89, "FORWARDING_STATUS" }, - { 90, "VPN_ROUTE_DISTINGUISHER" }, - { 91, "mplsTopLabelPrefixLength" }, - { 92, "SRC_TRAFFIC_INDEX" }, - { 93, "DST_TRAFFIC_INDEX" }, - { 94, "APPLICATION_DESC" }, - { 95, "APPLICATION_ID" }, - { 96, "APPLICATION_NAME" }, - { 98, "postIpDiffServCodePoint" }, - { 99, "multicastReplicationFactor" }, - { 128, "SRC_AS_PEER" }, - { 129, "DST_AS_PEER" }, - { 130, "exporterIPv4Address" }, - { 131, "exporterIPv6Address" }, - { 132, "DROPPED_BYTES" }, - { 133, "DROPPED_PACKETS" }, - { 134, "DROPPED_BYTES_TOTAL" }, - { 135, "DROPPED_PACKETS_TOTAL" }, - { 136, "flowEndReason" }, - { 137, "commonPropertiesId" }, - { 138, "observationPointId" }, - { 139, "icmpTypeCodeIPv6" }, - { 140, "MPLS_TOP_LABEL_IPv6_ADDRESS" }, - { 141, "lineCardId" }, - { 142, "portId" }, - { 143, "meteringProcessId" }, - { 144, "FLOW_EXPORTER" }, - { 145, "templateId" }, - { 146, "wlanChannelId" }, - { 147, "wlanSSID" }, - { 148, "flowId" }, - { 149, "observationDomainId" }, - { 150, "flowStartSeconds" }, - { 151, "flowEndSeconds" }, - { 152, "flowStartMilliseconds" }, - { 153, "flowEndMilliseconds" }, - { 154, "flowStartMicroseconds" }, - { 155, "flowEndMicroseconds" }, - { 156, "flowStartNanoseconds" }, - { 157, "flowEndNanoseconds" }, - { 158, "flowStartDeltaMicroseconds" }, - { 159, "flowEndDeltaMicroseconds" }, - { 160, "systemInitTimeMilliseconds" }, - { 161, "flowDurationMilliseconds" }, - { 162, "flowDurationMicroseconds" }, - { 163, "observedFlowTotalCount" }, - { 164, "ignoredPacketTotalCount" }, - { 165, "ignoredOctetTotalCount" }, - { 166, "notSentFlowTotalCount" }, - { 167, "notSentPacketTotalCount" }, - { 168, "notSentOctetTotalCount" }, - { 169, "destinationIPv6Prefix" }, - { 170, "sourceIPv6Prefix" }, - { 171, "postOctetTotalCount" }, - { 172, "postPacketTotalCount" }, - { 173, "flowKeyIndicator" }, - { 174, "postMCastPacketTotalCount" }, - { 175, "postMCastOctetTotalCount" }, - { 176, "ICMP_IPv4_TYPE" }, - { 177, "ICMP_IPv4_CODE" }, - { 178, "ICMP_IPv6_TYPE" }, - { 179, "ICMP_IPv6_CODE" }, - { 180, "UDP_SRC_PORT" }, - { 181, "UDP_DST_PORT" }, - { 182, "TCP_SRC_PORT" }, - { 183, "TCP_DST_PORT" }, - { 184, "TCP_SEQ_NUM" }, - { 185, "TCP_ACK_NUM" }, - { 186, "TCP_WINDOW_SIZE" }, - { 187, "TCP_URGENT_PTR" }, - { 188, "TCP_HEADER_LEN" }, - { 189, "IP_HEADER_LEN" }, - { 190, "IP_TOTAL_LEN" }, - { 191, "payloadLengthIPv6" }, - { 192, "IP_TTL" }, - { 193, "nextHeaderIPv6" }, - { 194, "IP_TOS" }, - { 195, "IP_DSCP" }, - { 196, "IP_PRECEDENCE" }, - { 197, "IP_FRAGMENT_FLAGS" }, - { 198, "BYTES_SQUARED" }, - { 199, "BYTES_SQUARED_PERMANENT" }, - { 200, "MPLS_TOP_LABEL_TTL" }, - { 201, "MPLS_LABEL_STACK_OCTETS" }, - { 202, "MPLS_LABEL_STACK_DEPTH" }, - { 203, "MPLS_TOP_LABEL_EXP" }, - { 204, "IP_PAYLOAD_LENGTH" }, - { 205, "UDP_LENGTH" }, - { 206, "IS_MULTICAST" }, - { 207, "IP_HEADER_WORDS" }, - { 208, "IP_OPTION_MAP" }, - { 209, "TCP_OPTION_MAP" }, - { 210, "paddingOctets" }, - { 211, "collectorIPv4Address" }, - { 212, "collectorIPv6Address" }, - { 213, "collectorInterface" }, - { 214, "collectorProtocolVersion" }, - { 215, "collectorTransportProtocol" }, - { 216, "collectorTransportPort" }, - { 217, "exporterTransportPort" }, - { 218, "tcpSynTotalCount" }, - { 219, "tcpFinTotalCount" }, - { 220, "tcpRstTotalCount" }, - { 221, "tcpPshTotalCount" }, - { 222, "tcpAckTotalCount" }, - { 223, "tcpUrgTotalCount" }, - { 224, "ipTotalLength" }, - { 225, "postNATSourceIPv4Address" }, - { 226, "postNATDestinationIPv4Address" }, - { 227, "postNAPTSourceTransportPort" }, - { 228, "postNAPTDestinationTransportPort" }, - { 229, "natOriginatingAddressRealm" }, - { 230, "natEvent" }, - { 231, "initiatorOctets" }, - { 232, "responderOctets" }, - { 233, "firewallEvent" }, - { 234, "ingressVRFID" }, - { 235, "egressVRFID" }, - { 236, "VRFname" }, - { 237, "postMplsTopLabelExp" }, - { 238, "tcpWindowScale" }, - { 239, "biflowDirection" }, - { 240, "ethernetHeaderLength" }, - { 241, "ethernetPayloadLength" }, - { 242, "ethernetTotalLength" }, - { 243, "dot1qVlanId" }, - { 244, "dot1qPriority" }, - { 245, "dot1qCustomerVlanId" }, - { 246, "dot1qCustomerPriority" }, - { 247, "metroEvcId" }, - { 248, "metroEvcType" }, - { 249, "pseudoWireId" }, - { 250, "pseudoWireType" }, - { 251, "pseudoWireControlWord" }, - { 252, "ingressPhysicalInterface" }, - { 253, "egressPhysicalInterface" }, - { 254, "postDot1qVlanId" }, - { 255, "postDot1qCustomerVlanId" }, - { 256, "ethernetType" }, - { 257, "postIpPrecedence" }, - { 258, "collectionTimeMilliseconds" }, - { 259, "exportSctpStreamId" }, - { 260, "maxExportSeconds" }, - { 261, "maxFlowEndSeconds" }, - { 262, "messageMD5Checksum" }, - { 263, "messageScope" }, - { 264, "minExportSeconds" }, - { 265, "minFlowStartSeconds" }, - { 266, "opaqueOctets" }, - { 267, "sessionScope" }, - { 268, "maxFlowEndMicroseconds" }, - { 269, "maxFlowEndMilliseconds" }, - { 270, "maxFlowEndNanoseconds" }, - { 271, "minFlowStartMicroseconds" }, - { 272, "minFlowStartMilliseconds" }, - { 273, "minFlowStartNanoseconds" }, - { 274, "collectorCertificate" }, - { 275, "exporterCertificate" }, - { 301, "selectionSequenceId" }, - { 302, "selectorId" }, - { 303, "informationElementId" }, - { 304, "selectorAlgorithm" }, - { 305, "samplingPacketInterval" }, - { 306, "samplingPacketSpace" }, - { 307, "samplingTimeInterval" }, - { 308, "samplingTimeSpace" }, - { 309, "samplingSize" }, - { 310, "samplingPopulation" }, - { 311, "samplingProbability" }, - { 313, "IP_SECTION HEADER" }, - { 314, "IP_SECTION PAYLOAD" }, - { 316, "mplsLabelStackSection" }, - { 317, "mplsPayloadPacketSection" }, - { 318, "selectorIdTotalPktsObserved" }, - { 319, "selectorIdTotalPktsSelected" }, - { 320, "absoluteError" }, - { 321, "relativeError" }, - { 322, "observationTimeSeconds" }, - { 323, "observationTimeMilliseconds" }, - { 324, "observationTimeMicroseconds" }, - { 325, "observationTimeNanoseconds" }, - { 326, "digestHashValue" }, - { 327, "hashIPPayloadOffset" }, - { 328, "hashIPPayloadSize" }, - { 329, "hashOutputRangeMin" }, - { 330, "hashOutputRangeMax" }, - { 331, "hashSelectedRangeMin" }, - { 332, "hashSelectedRangeMax" }, - { 333, "hashDigestOutput" }, - { 334, "hashInitialiserValue" }, - { 335, "selectorName" }, - { 336, "upperCILimit" }, - { 337, "lowerCILimit" }, - { 338, "confidenceLevel" }, - { 339, "informationElementDataType" }, - { 340, "informationElementDescription" }, - { 341, "informationElementName" }, - { 342, "informationElementRangeBegin" }, - { 343, "informationElementRangeEnd" }, - { 344, "informationElementSemantics" }, - { 345, "informationElementUnits" }, - { 346, "privateEnterpriseNumber" }, - /* Cisco ASA5500 Series NetFlow */ - { 33000, "INGRESS_ACL_ID" }, - { 33001, "EGRESS_ACL_ID" }, - { 33002, "FW_EXT_EVENT" }, - { 40000, "AAA_USERNAME" }, - { 40001, "XLATE_SRC_ADDR_IPV4" }, - { 40002, "XLATE_DST_ADDR_IPV4" }, - { 40003, "XLATE_SRC_PORT" }, - { 40004, "XLATE_DST_PORT" }, - { 40005, "FW_EVENT" }, - { 0, NULL } -}; -static const value_string v9_scope_field_types[] = { - { 1, "System" }, - { 2, "Interface" }, - { 3, "Line Card" }, - { 4, "NetFlow Cache" }, - { 5, "Template" }, - { 0, NULL } -}; -static const char * -decode_v9_template_types(int type) { - const char *v = match_strval(type, v9_template_types); - return ((v==NULL)?"Unknown" : v); -} - -static const value_string v9_sampler_mode[] = { - { 0, "Determinist" }, - { 1, "Unknown" }, - { 2, "Random" }, - { 0, NULL } -}; -static const value_string v9_direction[] = { - { 0, "Ingress" }, - { 1, "Egress" }, - { 0, NULL } -}; -static const value_string v9_forwarding_status[] = { - { 0, "Unknown"}, /* Observed on IOS-XR 3.2 */ - { 1, "Forward"}, /* Observed on 7200 12.4(9)T */ - { 2, "Drop"}, /* Observed on 7200 12.4(9)T */ - { 3, "Consume"}, /* Observed on 7200 12.4(9)T */ - { 0, NULL } -}; -static const value_string v9_forwarding_status_code[] = { - { 64, "Forwarded (Unknown)" }, - { 65, "Forwarded Fragmented" }, - { 66, "Forwarded not Fragmented" }, - { 128, "Dropped (Unknown)" }, - { 129, "Drop ACL Deny" }, - { 130, "Drop ACL drop" }, - { 131, "Drop Unroutable" }, - { 132, "Drop Adjacency" }, - { 133, "Drop Fragmentation & DF set" }, - { 134, "Drop Bad header checksum" }, - { 135, "Drop Bad total Length" }, - { 136, "Drop Bad Header Length" }, - { 137, "Drop bad TTL" }, - { 138, "Drop Policer" }, - { 139, "Drop WRED" }, - { 140, "Drop RPF" }, - { 141, "Drop For us" }, - { 142, "Drop Bad output interface" }, - { 143, "Drop Hardware" }, - { 192, "Consumed (Unknown)" }, - { 193, "Terminate Punt Adjacency" }, - { 194, "Terminate Incomplete Adjacency" }, - { 195, "Terminate For us" }, - { 0, NULL } -}; -static const value_string v9_firewall_event[] = { - { 0, "Default (ignore)"}, - { 1, "Flow created"}, - { 2, "Flow deleted"}, - { 3, "Flow denied"}, - { 4, "Flow alart"}, - { 0, NULL } -}; - -static const value_string v9_extended_firewall_event[] = { - { 0, "ignore"}, - { 1001, "Flow denied by an ingress ACL"}, - { 1002, "Flow denied by an egress ACL"}, - { 1003, "Flow denied by security appliance"}, - { 1004, "Flow denied (TCP flow beginning with not TCP SYN)"}, - { 0, NULL } -}; -static const value_string engine_type[] = { - { 0, "RP"}, - { 1, "VIP/Linecard"}, - { 2, "PFC/DFC" }, - { 0, NULL } -}; -static const value_string v9_flow_end_reason[] = { - { 0, "Unknown"}, - { 1, "Idle timeout"}, - { 2, "Active timeout" }, - { 3, "End of Flow detected" }, - { 4, "Forced end" }, - { 5, "Lack of resources" }, - { 0, NULL } -}; -static const value_string v9_biflow_direction[] = { - { 0, "Arbitrary"}, - { 1, "Initiator"}, - { 2, "ReverseInitiator" }, - { 3, "Perimeter" }, - { 0, NULL } -}; -static const value_string selector_algorithm[] = { - { 0, "Reserved"}, - { 1, "Systematic count-based Sampling"}, - { 2, "Systematic time-based Sampling"}, - { 3, "Random n-out-of-N Sampling"}, - { 4, "Uniform probabilistic Sampling"}, - { 5, "Property match Filtering"}, - { 6, "Hash based Filtering using BOB"}, - { 7, " Hash based Filtering using IPSX"}, - { 8, "Hash based Filtering using CRC"}, - { 0, NULL } -}; - - static int v9_template_hash(guint16 id, const address * net_src, guint32 src_id) { @@ -4815,7 +4827,7 @@ }, {&hf_cflow_forwarding_code , {"ForwdCode", "cflow.forwarding_code", - FT_UINT8, BASE_DEC, NULL, 0x3F, + FT_UINT8, BASE_DEC, VALS(v9_forwarding_status_code), 0x3F, "Forwarding Code", HFILL} }, {&hf_cflow_nbar_appl_desc, -- Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the assignee for the bug.
- References:
- [Wireshark-bugs] [Bug 5083] New: NetFlow forwarding status and template fixes
- From: bugzilla-daemon
- [Wireshark-bugs] [Bug 5083] New: NetFlow forwarding status and template fixes
- Prev by Date: [Wireshark-bugs] [Bug 5096] New: Buildbot crash output: fuzz-2010-08-10-29078.pcap
- Next by Date: [Wireshark-bugs] [Bug 5083] NetFlow forwarding status and template fixes
- Previous by thread: [Wireshark-bugs] [Bug 5083] NetFlow forwarding status and template fixes
- Next by thread: [Wireshark-bugs] [Bug 5083] NetFlow forwarding status and template fixes
- Index(es):