Add types for Juniper inline-monitoring. No decoding yet

phaag · Jun 18, 2023 · 3a810ad · 3a810ad
1 parent 130fafe
commit 3a810ad
Show file tree

Hide file tree

Showing 4 changed files with 32 additions and 2 deletions.
diff --git a/src/lib/nfxV3.h b/src/lib/nfxV3.h
@@ -612,8 +612,22 @@ typedef struct EXpfinfo_s {
 } EXpfinfo_t;
 #define EXpfinfoSize (sizeof(EXpfinfo_t) - 4 + sizeof(elementHeader_t))
 
+typedef struct EXinmon_s {
+#define EXinmonID 38
+    uint16_t frameSize;
+    uint16_t linkType;
+    uint8_t frame[4];
+} EXinmon_t;
+#define OFFframeSize offsetof(EXinmon_t, frameSize)
+#define SIZEframeSize MemberSize(EXinmon_t, frameSize)
+#define OFFlinkType offsetof(EXinmon_t, linkType)
+#define SIZElinkType MemberSize(EXinmon_t, linkType)
+#define OFFframe offsetof(EXinmon_t, frame)
+#define SIZEframe VARLENGTH
+#define EXinmonSize (sizeof(EXinmon_t) - 4 + sizeof(elementHeader_t))
+
 // max possible elements
-#define MAXEXTENSIONS 38
+#define MAXEXTENSIONS 39
 
 // push a fixed length extension to the v3 record
 // h v3 record header
@@ -679,7 +693,7 @@ static const struct extensionTable_s {
     EXTENSION(EXnselXlateIPv4), EXTENSION(EXnselXlateIPv6), EXTENSION(EXnselXlatePort), EXTENSION(EXnselAcl),      EXTENSION(EXnselUser),
     EXTENSION(EXnelCommon),     EXTENSION(EXnelXlatePort),  EXTENSION(EXnbarApp),       EXTENSION(EXlabel),        EXTENSION(EXinPayload),
     EXTENSION(EXoutPayload),    EXTENSION(EXtunIPv4),       EXTENSION(EXtunIPv6),       EXTENSION(EXobservation),  EXTENSION(EXifname),
-    EXTENSION(EXvrfname),       EXTENSION(EXvrf),           EXTENSION(EXpfinfo)};
+    EXTENSION(EXvrfname),       EXTENSION(EXvrf),           EXTENSION(EXpfinfo),        EXTENSION(EXinmon)};
 
 typedef struct record_map_s {
     recordHeaderV3_t *recordHeader;

diff --git a/src/netflow/ipfix.c b/src/netflow/ipfix.c
@@ -219,6 +219,10 @@ static const struct ipfixTranslationMap_s {
     {IPFIX_postNATDestinationIPv4Address, SIZExlateDst4Addr, NumberCopy, EXnselXlateIPv4ID, OFFxlateDst4Addr, STACK_NONE, "xlate dst addr"},
     {IPFIX_postNAPTSourceTransportPort, SIZExlateSrcPort, NumberCopy, EXnselXlatePortID, OFFxlateSrcPort, STACK_NONE, "xlate src port"},
     {IPFIX_postNAPTDestinationTransportPort, SIZExlateDstPort, NumberCopy, EXnselXlatePortID, OFFxlateDstPort, STACK_NONE, "xlate dst port"},
+    // inline-monitoring inmon
+    // {IPFIX_dataLinkFrameSize, SIZEframeSize, NumberCopy, EXinmonID, OFFframeSize, STACK_NONE, "inmon frame size"},
+    // {IPFIX_dataLinkFrameType, SIZElinkType, NumberCopy, EXinmonID, OFFlinkType, STACK_NONE, "inmon link type"},
+    // {IPFIX_dataLinkFrameSection, SIZEframe, ByteCopy, EXinmonID, OFFframe, STACK_NONE, "inmon packet content"},
 
     // payload
     {LOCAL_inPayload, VARLENGTH, NumberCopy, EXinPayloadID, 0, STACK_NONE, "in payload"},

diff --git a/src/netflow/ipfix.h b/src/netflow/ipfix.h
@@ -319,6 +319,11 @@ typedef struct ipfix_template_elements_e_s {
 #define IPFIX_samplingPacketInterval 305
 #define IPFIX_samplingPacketSpace 306
 
+// Juniper inline-monitoring
+#define IPFIX_dataLinkFrameSize 312
+#define IPFIX_dataLinkFrameSection 315
+#define IPFIX_dataLinkFrameType 408
+
 #define IPFIX_observationTimeMilliseconds 323
 
 // Private Enterprise Numbers

diff --git a/src/output/output_raw.c b/src/output/output_raw.c
@@ -656,6 +656,10 @@ static void stringsEXpfinfo(FILE *stream, master_record_t *r) {
 
 }  // End of stringsEXpfinfo
 
+static void stringsEXinmon(FILE *stream, master_record_t *r) {
+    fprintf(stream, "  inmon xxxxxx =             %5s\n", "none");
+}  // End of stringsEXinmon
+
 void raw_prolog(void) {
     // empty prolog
     recordCount = 0;
@@ -829,6 +833,9 @@ void raw_record(FILE *stream, void *record, int tag) {
             case EXpfinfoID:
                 stringsEXpfinfo(stream, r);
                 break;
+            case EXinmonID:
+                stringsEXinmon(stream, r);
+                break;
             default:
                 dbg_printf("Extension %i not decoded\n", r->exElementList[i]);
         }