#include #include #include #include #include #include #include "types.h" #include "flowfile.h" void saveflow_print( struct saveflow* sf, uint32 starttime ) { char sip[ 16 ], dip[ 16 ]; char time[ 9 ]; time_t flowtime; uint16 duration; float bwsd; float bwds; printip(sip, sf->sip); printip(dip, sf->dip); switch( sf->typenr ) { case TCPTYPE: printf( "TCP(6) %s:%-u",sip, sf->tcp_sport ); printf( " %s:%-u", dip, sf->tcp_dport ); break; case UDPTYPE: printf( "UDP(17) %s:%-u", sip, sf->udp_sport ); printf( " %s:%-u", dip, sf->udp_dport ); break; case ICMPTYPE: printf( "ICMP(1) %s %s %u %u", sip, dip, sf->icmp_type , sf->icmp_subcode ); break; default: printf( "OTHER(%u) %s %s",sf->typenr, sip, dip); break; } duration = sf->endoffset - sf->startoffset; flowtime = htonl(starttime)+sf->startoffset; strftime( time, sizeof time, "%T", localtime( &flowtime )); if(duration>2) { bwsd=.0078*sf->sdbytes/duration; bwds=.0078*sf->dsbytes/duration; }else { bwds=bwsd=0; } printf( " %lu %lu %.2f %lu %lu %.2f %s %u\n", sf->sdpkts, sf->sdbytes, bwsd, sf->dspkts, sf->dsbytes, bwds, time, duration); } int main(int argc,char **argv) { int fd; struct flowfileheader header; int r; struct saveflow sflow; if( argc != 2 ) exit(1); fd=open(argv[1],O_RDONLY); if ( fd < 0 ) { perror("Open File"); exit(1); } read( fd, &header, sizeof(struct flowfileheader) ); printf("Start:%lu Stop:%lu\n",ntohl(header.starttime), ntohl(header.stoptime ) ); printf("Flows:%lu Pkts:%lu Bytes:%qu\n", ntohl( header.flows ), ntohl( header.pkts ), ntohq( header.bytes ) ); while( ( r = read(fd, &sflow, sizeof( struct saveflow ) ) ) ) { if( !r ) break; sflow.startoffset = htons( sflow.startoffset ); sflow.endoffset = htons( sflow.endoffset ); sflow.sdbytes = htonl( sflow.sdbytes ); sflow.sdpkts = htonl( sflow.sdpkts ); sflow.dsbytes = htonl( sflow.dsbytes ); sflow.dspkts = htonl( sflow.dspkts ); switch ( sflow.typenr) { case TCPTYPE: sflow.tcp_sport = ntohs( sflow.tcp_sport ); sflow.tcp_dport = ntohs( sflow.tcp_dport ); break; case UDPTYPE: sflow.udp_sport = ntohs( sflow.udp_sport ); sflow.udp_dport = ntohs( sflow.udp_dport ); break; } saveflow_print( &sflow, header.starttime ); } return 0; }