yaftab.h
Go to the documentation of this file.
1/*
2 * Copyright 2006-2023 Carnegie Mellon University
3 * See license information in LICENSE.txt.
4 */
5/*
6 * yaftab.h
7 * YAF Active Flow Table
8 *
9 * ------------------------------------------------------------------------
10 * Authors: Brian Trammell
11 * ------------------------------------------------------------------------
12 * @DISTRIBUTION_STATEMENT_BEGIN@
13 * YAF 2.14.0
14 *
15 * Copyright 2023 Carnegie Mellon University.
16 *
17 * NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING
18 * INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON
19 * UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED,
20 * AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR
21 * PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF
22 * THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF
23 * ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT
24 * INFRINGEMENT.
25 *
26 * Released under a GNU GPL 2.0-style license, please see LICENSE.txt or
27 * contact permission@sei.cmu.edu for full terms.
28 *
29 * [DISTRIBUTION STATEMENT A] This material has been approved for public
30 * release and unlimited distribution. Please see Copyright notice for
31 * non-US Government use and distribution.
32 *
33 * GOVERNMENT PURPOSE RIGHTS - Software and Software Documentation
34 *
35 * Contract No.: FA8702-15-D-0002
36 *
37 * Contractor Name: Carnegie Mellon University
38 *
39 * Contractor Address: 4500 Fifth Avenue, Pittsburgh, PA 15213
40 *
41 * The Government's rights to use, modify, reproduce, release, perform,
42 * display, or disclose this software are restricted by paragraph (b)(2) of
43 * the Rights in Noncommercial Computer Software and Noncommercial Computer
44 * Software Documentation clause contained in the above identified
45 * contract. No restrictions apply after the expiration date shown
46 * above. Any reproduction of the software or portions thereof marked with
47 * this legend must also reproduce the markings.
48 *
49 * Carnegie Mellon(R) and CERT(R) are registered in the U.S. Patent and
50 * Trademark Office by Carnegie Mellon University.
51 *
52 * This Software includes and/or makes use of Third-Party Software each
53 * subject to its own license.
54 *
55 * DM23-0544
56 * @DISTRIBUTION_STATEMENT_END@
57 * ------------------------------------------------------------------------
58 */
59
60/*
61 * This is the documentation for the _old_ yaftab.h; it is no longer current,
62 * and should not be read by anyone.
63 *
64 * Flow generation interface for YAF. This facility works by maintaining a
65 * current flow table. Packets may be added to the active flows within this
66 * table using the yfFlowPkt() call. Completed flows may be written to an
67 * IPFIX message buffer using yfFlowFlush().
68 *
69 * The flow table is configured by a number of global variables.
70 *
71 * <tt>yaf_idle</tt> sets
72 * the idle timeout in seconds. A flow that receives no packets for the idle
73 * timeout is assumed to be complete. The idle timeout is set to 300 seconds
74 * (five minutes) by default.
75 *
76 * <tt>yaf_active</tt> sets the active timeout in seconds.
77 * The maximum duration of a flow is the active timeout; additional packets
78 * for the same flow will be counted as part of a new flow. The active timeout
79 * is set to 1800 seconds (half an hour) by default.
80 *
81 * <tt>yaf_flowlim</tt> sets the maximum size of the flow table; flows
82 * exceeding
83 * this limit will be expired in least-recent order, as if they were idle. The
84 * flow limit defaults to zero, for no limit. Use this global to limit resource
85 * usage by the flow table.
86 *
87 * <tt>yaf_paylen</tt> sets the number of bytes of payload to capture from the
88 * start of each flow. The payload length defaults to zero, which disables
89 * payload capture.
90 *
91 * <tt>yaf_uniflow</tt>, if TRUE, exports flows in uniflow mode, using the
92 * record adjacency export method described in section 3 of
93 * draft-ietf-ipfix-biflow. Defaults to FALSE.
94 *
95 * <tt>yaf_macmode</tt>, if TRUE, exports layer 2 information with each flow;
96 * presently this is limited to VLAN tags but may be expanded to include the
97 * MPLS stack and MAC addresses in the future. Defaults to FALSE.
98 *
99 * <tt>yaf_silkmode</tt>, if TRUE, enables SiLK compatibility mode. In this
100 * mode, totalOctetCount and reverseTotalOctetCount are clamped to 32 bits.
101 * Any packet that would cause either of these counters to overflow 32 bits
102 * will force an active timeout. The high-order bit of the flowEndReason IE
103 * is set on any flow created on a counter overflow, as above, or on an active
104 * timeout. Defaults to FALSE.
105 *
106 * <tt>yaf_reqtype</tt> limits the flow table to collecting IPv4 or IPv6 flows
107 * only. Set to YF_TYPE_IPv4 for IPv4 flows only, YF_TYPE_IPv6 for IPv6 flows
108 * only, or YF_TYPE_IPANY (the default) to collect both IPv4 and IPv6 flows.
109 *
110 * This facility is used by YAF to assemble packets into flows.
111 */
112
121#ifndef _YAF_TAB_H_
122#define _YAF_TAB_H_
123
124#include <yaf/autoinc.h>
125#include <yaf/yafcore.h>
126#include <yaf/decode.h>
127
128
129struct yfFlowTab_st;
134typedef struct yfFlowTab_st yfFlowTab_t;
135
226 uint64_t idle_ms,
227 uint64_t active_ms,
228 uint32_t max_flows,
229 uint32_t max_payload,
230 gboolean uniflow,
231 gboolean silkmode,
232 gboolean macmode,
233 gboolean applabelmode,
234 gboolean entropymode,
235 gboolean fingerprintmode,
236 gboolean fpExportMode,
237 gboolean udp_max_payload,
238 uint16_t udp_uniflow_port,
239 char *pcap_dir,
240 char *pcap_meta_file,
241 uint64_t max_pcap,
242 gboolean pcap_per_flow,
243 gboolean force_read_all,
244 gboolean stats_mode,
245 gboolean index_pcap,
246 gboolean no_vlan_in_key,
247 gboolean ndpi,
248 char *ndpi_proto_file,
249 char *hash,
250 char *stime,
251 void **hfctx);
252
260void
262 yfFlowTab_t *flowtab);
263
264
271void
273 yfFlowTab_t *flowtab,
274 char *new_file_name);
275
287void
289 yfFlowTab_t *flowtab,
290 uint64_t *packets,
291 uint64_t *flows,
292 uint64_t *rej_pkts,
293 uint32_t *peak,
294 uint32_t *flush);
295
307void
309 yfFlowTab_t *flowtab,
310 size_t pbuflen,
311 yfPBuf_t *pbuf);
312
326gboolean
328 void *yfContext,
329 gboolean close,
330 GError **err);
331
338uint64_t
340 yfFlowTab_t *flowtab);
341
350uint64_t
352 yfFlowTab_t *flowtab,
353 GTimer *timer);
354
355#endif /* ifndef _YAF_TAB_H_ */
Full packet information structure.
Definition: decode.h:152
YAF Core Library.
uint64_t yfFlowTabCurrentTime(yfFlowTab_t *flowtab)
Get the current packet clock from a flow table.
void yfUpdateRollingPcapFile(yfFlowTab_t *flowtab, char *new_file_name)
Update the Pcap Filename in the Flowtab for pcap meta data output.
void yfFlowTabFree(yfFlowTab_t *flowtab)
Free a previously allocated flow table.
gboolean yfFlowTabFlush(void *yfContext, gboolean close, GError **err)
Flush closed flows in the given flow table to the given IPFIX Message Buffer.
yfFlowTab_t * yfFlowTabAlloc(uint64_t idle_ms, uint64_t active_ms, uint32_t max_flows, uint32_t max_payload, gboolean uniflow, gboolean silkmode, gboolean macmode, gboolean applabelmode, gboolean entropymode, gboolean fingerprintmode, gboolean fpExportMode, gboolean udp_max_payload, uint16_t udp_uniflow_port, char *pcap_dir, char *pcap_meta_file, uint64_t max_pcap, gboolean pcap_per_flow, gboolean force_read_all, gboolean stats_mode, gboolean index_pcap, gboolean no_vlan_in_key, gboolean ndpi, char *ndpi_proto_file, char *hash, char *stime, void **hfctx)
yfFlowTabAlloc
void yfGetFlowTabStats(yfFlowTab_t *flowtab, uint64_t *packets, uint64_t *flows, uint64_t *rej_pkts, uint32_t *peak, uint32_t *flush)
yfGetFlowTabStats Get Flow Table Stats for Export
void yfFlowPBuf(yfFlowTab_t *flowtab, size_t pbuflen, yfPBuf_t *pbuf)
Add a decoded packet buffer to a given flow table.
uint64_t yfFlowDumpStats(yfFlowTab_t *flowtab, GTimer *timer)
Print flow table statistics to the log.
struct yfFlowTab_st yfFlowTab_t
A flow table.
Definition: yaftab.h:134