Go to the documentation of this file.
65 static JsonBuilder *CreateEveHeaderFromNetFlow(
const Flow *f,
int dir)
68 char srcip[46] = {0}, dstip[46] = {0};
71 JsonBuilder *js = jb_new_object();
76 memset(&
tv, 0x00,
sizeof(
tv));
86 PrintInet(AF_INET, (
const void *)&(f->
src.addr_data32[0]), srcip,
sizeof(srcip));
87 PrintInet(AF_INET, (
const void *)&(f->
dst.addr_data32[0]), dstip,
sizeof(dstip));
89 PrintInet(AF_INET, (
const void *)&(f->
dst.addr_data32[0]), srcip,
sizeof(srcip));
90 PrintInet(AF_INET, (
const void *)&(f->
src.addr_data32[0]), dstip,
sizeof(dstip));
111 jb_set_string(js,
"timestamp", timebuf);
118 json_object_set_new(js,
"sensor_id", json_integer(sensor_id));
123 jb_set_string(js,
"in_iface", f->
livedev->
dev);
130 jb_open_array(js,
"vlan");
131 jb_append_uint(js, f->
vlan_id[0]);
133 jb_append_uint(js, f->
vlan_id[1]);
139 jb_set_string(js,
"src_ip", srcip);
146 jb_set_uint(js,
"src_port", sp);
149 jb_set_string(js,
"dest_ip", dstip);
156 jb_set_uint(js,
"dest_port", dp);
165 jb_set_string(js,
"proto",
proto);
170 case IPPROTO_ICMPV6: {
178 jb_set_uint(js,
"icmp_type",
type);
179 jb_set_uint(js,
"icmp_code",
code);
189 jb_set_string(js,
"app_proto",
192 jb_open_object(js,
"netflow");
197 char timebuf1[64], timebuf2[64];
202 jb_set_string(js,
"start", timebuf1);
203 jb_set_string(js,
"end", timebuf2);
206 jb_set_uint(js,
"age", age);
215 if (f->
proto == IPPROTO_TCP) {
216 jb_open_object(js,
"tcp");
221 snprintf(hexflags,
sizeof(hexflags),
"%02x",
223 jb_set_string(js,
"tcp_flags", hexflags);
233 jb_set_string(js,
"app_proto",
236 jb_open_object(js,
"netflow");
241 char timebuf1[64], timebuf2[64];
246 jb_set_string(js,
"start", timebuf1);
247 jb_set_string(js,
"end", timebuf2);
250 jb_set_uint(js,
"age", age);
262 if (f->
proto == IPPROTO_TCP) {
263 jb_open_object(js,
"tcp");
268 snprintf(hexflags,
sizeof(hexflags),
"%02x",
270 jb_set_string(js,
"tcp_flags", hexflags);
286 JsonBuilder *jb = CreateEveHeaderFromNetFlow(f, 0);
289 NetFlowLogEveToServer(jhl, jb, f);
298 jb = CreateEveHeaderFromNetFlow(f, 1);
301 NetFlowLogEveToClient(jhl, jb, f);
309 static void OutputNetFlowLogDeinitSub(
OutputCtx *output_ctx)
334 output_ctx->
data = flow_ctx;
335 output_ctx->
DeInit = OutputNetFlowLogDeinitSub;
337 result.
ctx = output_ctx;
342 static TmEcode JsonNetFlowLogThreadInit(
ThreadVars *t,
const void *initdata,
void **data)
348 if(initdata == NULL) {
349 SCLogDebug(
"Error getting context for EveLogNetflow. \"initdata\" argument NULL");
357 if (aft->
buffer == NULL) {
370 if (aft->
buffer != NULL) {
396 "eve-log.netflow", OutputNetFlowLogInitSub, JsonNetFlowLogger,
397 JsonNetFlowLogThreadInit, JsonNetFlowLogThreadDeinit, NULL);
struct Flow_::@122::@127 icmp_d
struct JsonNetFlowLogThread_ JsonNetFlowLogThread
void CreateIsoTimeString(const struct timeval *ts, char *str, size_t size)
OutputJsonCommonSettings cfg
struct LogJsonFileCtx_ LogJsonFileCtx
#define JSON_OUTPUT_BUFFER_SIZE
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
bool SCProtoNameValid(uint16_t proto)
Function to check if the received protocol number is valid and do we have corresponding name entry fo...
int OutputJsonBuilderBuffer(JsonBuilder *js, LogFileCtx *file_ctx, MemBuffer **buffer)
void EveAddCommonOptions(const OutputJsonCommonSettings *cfg, const Packet *p, const Flow *f, JsonBuilder *js)
#define JB_SET_STRING(jb, key, val)
Per thread variable structure.
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
LogFileCtx * LogFileEnsureExists(LogFileCtx *parent_ctx, int thread_id)
LogFileEnsureExists() Ensure a log file context for the thread exists.
void EveTcpFlags(const uint8_t flags, JsonBuilder *js)
jsonify tcp flags field Only add 'true' fields in an attempt to keep things reasonably compact.
LogJsonFileCtx * flowlog_ctx
union FlowAddress_::@119 address
#define MemBufferReset(mem_buffer)
Reset the mem buffer.
void(* DeInit)(struct OutputCtx_ *)
void MemBufferFree(MemBuffer *buffer)
struct LiveDevice_ * livedev
OutputJsonCommonSettings cfg
void CreateEveFlowId(JsonBuilder *js, const Flow *f)
void OutputRegisterFlowSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a flow output sub-module.
void TimeGet(struct timeval *tv)
AppProto alproto
application level protocol
#define FLOW_DIR_REVERSED
struct Flow_::@120::@126 icmp_s
MemBuffer * MemBufferCreateNew(uint32_t size)
void JsonNetFlowLogRegister(void)