NetFlow ошибка парсинга
От: nikson_svg  
Дата: 30.11.10 00:11
Оценка:
Здравствуйте. Помогите пожалуйста найти ошибку с след. коде.


#include "stdafx.h"

#include "main.h"

struct NF_HEADER
{
    WORD version;                // NetFlow export format version number
    WORD count;                    // Number of flows exported in this packet (1-30)
    DWORD sys_uptime;            // Current time in milliseconds since the export device booted
    DWORD unix_secs;            // Current count of seconds since 0000 UTC 1970
    DWORD unix_nsecs;            // Residual nanoseconds since 0000 UTC 1970
    DWORD flow_sequence;        // Sequence counter of total flows seen
    BYTE engine_type;            // Type of flow-switching engine
    BYTE engine_id;                // Slot number of the flow-switching engine
    WORD sampling_interval;        // First two bits hold the sampling mode; remaining 14 bits hold value of sampling interval
};

struct NF_DATA
{
    DWORD srcaddr;        // Source IP address
    DWORD dstaddr;        // Destination IP address
    DWORD nexthop;        // IP address of next hop router
    WORD input;            // SNMP index of input interface
    WORD output;        // SNMP index of output interface
    DWORD dPkts;        // Packets in the flow
    DWORD dOctets;        // Total number of Layer 3 bytes in the packets of the flow
    DWORD first;        // SysUptime at start of flow
    DWORD last;            // SysUptime at the time the last packet of the flow was received
    WORD srcport;        // TCP/UDP source port number or equivalent
    WORD dstport;        // TCP/UDP destination port number or equivalent
    BYTE pad1;            // Unused (zero) bytes
    BYTE tcp_flags;        // Cumulative OR of TCP flags
    BYTE prot;            // IP protocol type (for example, TCP = 6; UDP = 17)
    BYTE tos;            // IP type of service (ToS)
    WORD src_as;        // Autonomous system number of the source, either origin or peer
    WORD dst_as;        // Autonomous system number of the destination, either origin or peer
    BYTE src_mask;        // Source address prefix mask bits
    BYTE dst_mask;        // Destination address prefix mask bits
    WORD pad2;            // Unused (zero) bytes
};

#define NF_BUF_SIZE (sizeof(NF_HEADER) + 30 * sizeof(NF_DATA))

CMainApp::CMainApp()
{
    //
}

CMainApp theApp;

CMainApp::InitInstance()
{
    AfxSocketInit(NULL);

    BYTE pBuf[NF_BUF_SIZE];
    memset(pBuf, 0, NF_BUF_SIZE);

    CSocket m_WinSock;
    m_WinSock.Create(9996, SOCK_DGRAM);
    m_WinSock.Bind(9996, "62.33.229.107");
    //m_WinSock.Listen();
    //Sleep(10000);
    
    CString str;

    CStdioFile m_File("C:\\file.txt", CFile::modeCreate | CFile::modeWrite | CFile::typeBinary);

    while (true)
    {
        int n = m_WinSock.Receive(pBuf, NF_BUF_SIZE);

        if (n > 0)
        {
            //m_File.Write(pBuf, n);
            
            //NF_HEADER nf_h;
            //memset(&nf_h, 0, sizeof(NF_HEADER));
            //memmove(&nf_h, pBuf, sizeof(NF_HEADER));

            NF_HEADER* nf_h = reinterpret_cast<NF_HEADER*>(pBuf);

            int packets = htons(nf_h->count);

            if (packets < 0 || packets > 30)
                continue;

            if (24 + 48 * packets != n)
                continue;

            for (int i = 0; i < packets; ++i)
            {
                NF_DATA* nf_d = reinterpret_cast<NF_DATA*>(pBuf + 24 + i * 48);

                in_addr adr_s, adr_d;
                
                memset(&adr_s, 0, sizeof(in_addr));
                adr_s.s_addr = nf_d->srcaddr;
                
                memset(&adr_d, 0, sizeof(in_addr));
                adr_d.s_addr = nf_d->dstaddr;
                
                str.Format("SRCADDR = %s:%d - DSTADDR = %s:%d Byte %d\r\n",
                    inet_ntoa(adr_s), ntohs(nf_d->srcport),
                    inet_ntoa(adr_d), ntohs(nf_d->dstport),
                    ntohl(nf_d->dOctets));

                m_File.WriteString(str);

                nf_d = NULL;

                TRACE(str);
            }
        }
    }
}


Вот итог работы

SRCADDR = 189.171.131.180:50372 - DSTADDR = 189.171.131.180:24755 Byte 305
SRCADDR = 10.102.2.1:0 - DSTADDR = 10.102.2.1:0 Byte 1629933
SRCADDR = 58.138.20.156:30924 - DSTADDR = 58.138.20.156:24755 Byte 131
SRCADDR = 85.114.76.110:24755 - DSTADDR = 85.114.76.110:30924 Byte 159
SRCADDR = 77.34.182.83:34479 - DSTADDR = 77.34.182.83:35691 Byte 182
SRCADDR = 172.16.0.224:24755 - DSTADDR = 172.16.0.224:25699 Byte 131
SRCADDR = 93.74.3.140:35691 - DSTADDR = 93.74.3.140:35691 Byte 95
SRCADDR = 85.114.76.110:35691 - DSTADDR = 85.114.76.110:35691 Byte 123
SRCADDR = 172.16.0.224:24755 - DSTADDR = 172.16.0.224:1028 Byte 131
SRCADDR = 172.16.20.16:0 - DSTADDR = 172.16.20.16:0 Byte 140192


Не могу понять почему у меня адрес отправителя и получателя получается одинаковый. Пожалуйста укажите на ошибку.
 
Подождите ...
Wait...
Пока на собственное сообщение не было ответов, его можно удалить.