Skip to content

Expand the ability for specify netflow v9 contents and REST WEB service #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
9nehS wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Expand the ability for specify netflow v9 contents and REST WEB service #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2b1bdd4
Add module for logger and uuid
9nehS Mar 1, 2018
c191457
Add Netflow V9 with template ID 260
9nehS Mar 1, 2018
36906d6
Add ability to specify netflow contents with v9 and REST service
9nehS Mar 1, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 38 additions & 1 deletion rb_netflow/rb_netflow.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,10 @@
## Copyright (C) Philippe Biondi <phil@secdev.org>
## This program is published under a GPLv2 license
## Netflow V5 appended by spaceB0x and Guillaume Valadon
## Netflow V9 with template ID 260 appended by Frank

"""
Cisco NetFlow protocol v1 and v5
Cisco NetFlow protocol v1, v5, v9 and v10
"""


Expand Down Expand Up @@ -283,3 +284,39 @@ class Flow_v9(Packet):
bind_layers( NetFlowTemplatev10Field, NetFlowTemplatev10FieldPEN, version=5)
#bind_layers( NetflowHeaderV5, NetflowRecordV5 )
#bind_layers( NetflowRecordV5, NetflowRecordV5 )


# FlowSet With Template ID 260

class Flow_260_v9(Packet):
name = "Element flow (v9) for template id 260"
fields_desc = [
IntField('Packets', 1),
IntField('Octets', 1000),
IPField('SrcAddr', '11.11.11.11'),
IPField('DstAddr', '22.22.22.22'),
IntField('InputInt', 100),
IntField('OutputInt', 101),
IntField('EndTime', 3569615),
IntField('StartTime', 3569614),
ShortField("SrcPort", 8888),
ShortField("DstPort", 80),
IntField('SrcAS', 0),
IntField('DstAS', 0),
IPField('BGPNextHop', '0.0.0.0'),
ByteField("SrcMask", 24),
ByteField("DstMask", 24),
ByteField("Protocol", 6),
XByteField("TCPFlags", 0x10),
XByteField("IPToS", 0x00),
ByteField("Direction", 0),
XByteField("ForwardingStatus", 0x40),
ShortField("SamplerID", 2),
XIntField("IngressVRFID", 0x60000000),
XIntField("EgressVRFID", 0x60000000)
]


bind_layers(NetFlowTemplatev10Field, NetFlowTemplatev10FieldPEN, version=5)
# bind_layers( NetflowHeaderV5, NetflowRecordV5 )
# bind_layers( NetflowRecordV5, NetflowRecordV5 )
Loading