Go to the documentation of this file.
52 static SCJsonBuilder *CreateEveHeaderFromNetFlow(
const Flow *f,
int dir)
55 char srcip[46] = {0}, dstip[46] = {0};
58 SCJsonBuilder *js = SCJbNewObject();
71 PrintInet(AF_INET, (
const void *)&(f->
src.addr_data32[0]), srcip,
sizeof(srcip));
72 PrintInet(AF_INET, (
const void *)&(f->
dst.addr_data32[0]), dstip,
sizeof(dstip));
74 PrintInet(AF_INET, (
const void *)&(f->
dst.addr_data32[0]), srcip,
sizeof(srcip));
75 PrintInet(AF_INET, (
const void *)&(f->
src.addr_data32[0]), dstip,
sizeof(dstip));
96 SCJbSetString(js,
"timestamp", timebuf);
103 json_object_set_new(js,
"sensor_id", json_integer(sensor_id));
108 SCJbSetString(js,
"in_iface", f->
livedev->
dev);
115 SCJbOpenArray(js,
"vlan");
116 SCJbAppendUint(js, f->
vlan_id[0]);
118 SCJbAppendUint(js, f->
vlan_id[1]);
121 SCJbAppendUint(js, f->
vlan_id[2]);
127 SCJbSetString(js,
"src_ip", srcip);
134 SCJbSetUint(js,
"src_port", sp);
137 SCJbSetString(js,
"dest_ip", dstip);
144 SCJbSetUint(js,
"dest_port", dp);
153 SCJbSetString(js,
"proto",
proto);
158 case IPPROTO_ICMPV6: {
160 uint8_t code = f->
icmp_s.code;
166 SCJbSetUint(js,
"icmp_type",
type);
167 SCJbSetUint(js,
"icmp_code", code);
171 SCJbSetUint(js,
"spi", f->
esp.spi);
178 static void NetFlowLogEveToServer(SCJsonBuilder *js,
Flow *f)
182 SCJbOpenObject(js,
"netflow");
187 char timebuf1[64], timebuf2[64];
192 SCJbSetString(js,
"start", timebuf1);
193 SCJbSetString(js,
"end", timebuf2);
196 SCJbSetUint(js,
"age", age);
205 if (f->
proto == IPPROTO_TCP) {
206 SCJbOpenObject(js,
"tcp");
211 snprintf(hexflags,
sizeof(hexflags),
"%02x",
213 SCJbSetString(js,
"tcp_flags", hexflags);
221 static void NetFlowLogEveToClient(SCJsonBuilder *js,
Flow *f)
225 SCJbOpenObject(js,
"netflow");
230 char timebuf1[64], timebuf2[64];
235 SCJbSetString(js,
"start", timebuf1);
236 SCJbSetString(js,
"end", timebuf2);
239 SCJbSetUint(js,
"age", age);
251 if (f->
proto == IPPROTO_TCP) {
252 SCJbOpenObject(js,
"tcp");
257 snprintf(hexflags,
sizeof(hexflags),
"%02x",
259 SCJbSetString(js,
"tcp_flags", hexflags);
272 SCJsonBuilder *jb = CreateEveHeaderFromNetFlow(f, 0);
275 NetFlowLogEveToServer(jb, f);
282 jb = CreateEveHeaderFromNetFlow(f, 1);
285 NetFlowLogEveToClient(jb, f);
struct Flow_::@118::@124 icmp_s
void CreateIsoTimeString(const SCTime_t ts, char *str, size_t size)
OutputJsonCommonSettings cfg
TmEcode JsonLogThreadInit(ThreadVars *t, const void *initdata, void **data)
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
bool SCProtoNameValid(uint16_t proto)
Function to check if the received protocol number is valid and do we have corresponding name entry fo...
void EveTcpFlags(const uint8_t flags, SCJsonBuilder *js)
jsonify tcp flags field Only add 'true' fields in an attempt to keep things reasonably compact.
const char * known_proto[256]
void OutputJsonBuilderBuffer(ThreadVars *tv, const Packet *p, Flow *f, SCJsonBuilder *js, OutputJsonThreadCtx *ctx)
void CreateEveFlowId(SCJsonBuilder *js, const Flow *f)
OutputInitResult OutputJsonLogInitSub(SCConfNode *conf, OutputCtx *parent_ctx)
void OutputRegisterFlowSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a flow output sub-module.
#define JB_SET_STRING(jb, key, val)
struct Flow_::@120::@126 icmp_d
void EveAddCommonOptions(const OutputJsonCommonSettings *cfg, const Packet *p, const Flow *f, SCJsonBuilder *js, enum SCOutputJsonLogDirection dir)
union FlowAddress_::@117 address
Per thread variable structure.
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
struct Flow_::@118::@125 esp
struct LiveDevice_ * livedev
uint16_t vlan_id[VLAN_MAX_LAYERS]
TmEcode JsonLogThreadDeinit(ThreadVars *t, void *data)
AppProto alproto
application level protocol
#define FLOW_DIR_REVERSED
void JsonNetFlowLogRegister(void)