Go to the documentation of this file.
52 static JsonBuilder *CreateEveHeaderFromNetFlow(
const Flow *f,
int dir)
55 char srcip[46] = {0}, dstip[46] = {0};
58 JsonBuilder *js = jb_new_object();
71 PrintInet(AF_INET, (
const void *)&(f->
src.addr_data32[0]), srcip,
sizeof(srcip));
72 PrintInet(AF_INET, (
const void *)&(f->
dst.addr_data32[0]), dstip,
sizeof(dstip));
74 PrintInet(AF_INET, (
const void *)&(f->
dst.addr_data32[0]), srcip,
sizeof(srcip));
75 PrintInet(AF_INET, (
const void *)&(f->
src.addr_data32[0]), dstip,
sizeof(dstip));
96 jb_set_string(js,
"timestamp", timebuf);
103 json_object_set_new(js,
"sensor_id", json_integer(sensor_id));
108 jb_set_string(js,
"in_iface", f->
livedev->
dev);
115 jb_open_array(js,
"vlan");
116 jb_append_uint(js, f->
vlan_id[0]);
118 jb_append_uint(js, f->
vlan_id[1]);
121 jb_append_uint(js, f->
vlan_id[2]);
127 jb_set_string(js,
"src_ip", srcip);
134 jb_set_uint(js,
"src_port", sp);
137 jb_set_string(js,
"dest_ip", dstip);
144 jb_set_uint(js,
"dest_port", dp);
153 jb_set_string(js,
"proto",
proto);
158 case IPPROTO_ICMPV6: {
160 uint8_t code = f->
icmp_s.code;
166 jb_set_uint(js,
"icmp_type",
type);
167 jb_set_uint(js,
"icmp_code", code);
171 jb_set_uint(js,
"spi", f->
esp.spi);
178 static void NetFlowLogEveToServer(JsonBuilder *js,
Flow *f)
180 jb_set_string(js,
"app_proto",
183 jb_open_object(js,
"netflow");
188 char timebuf1[64], timebuf2[64];
193 jb_set_string(js,
"start", timebuf1);
194 jb_set_string(js,
"end", timebuf2);
197 jb_set_uint(js,
"age", age);
206 if (f->
proto == IPPROTO_TCP) {
207 jb_open_object(js,
"tcp");
212 snprintf(hexflags,
sizeof(hexflags),
"%02x",
214 jb_set_string(js,
"tcp_flags", hexflags);
222 static void NetFlowLogEveToClient(JsonBuilder *js,
Flow *f)
224 jb_set_string(js,
"app_proto",
227 jb_open_object(js,
"netflow");
232 char timebuf1[64], timebuf2[64];
237 jb_set_string(js,
"start", timebuf1);
238 jb_set_string(js,
"end", timebuf2);
241 jb_set_uint(js,
"age", age);
253 if (f->
proto == IPPROTO_TCP) {
254 jb_open_object(js,
"tcp");
259 snprintf(hexflags,
sizeof(hexflags),
"%02x",
261 jb_set_string(js,
"tcp_flags", hexflags);
274 JsonBuilder *jb = CreateEveHeaderFromNetFlow(f, 0);
277 NetFlowLogEveToServer(jb, f);
284 jb = CreateEveHeaderFromNetFlow(f, 1);
287 NetFlowLogEveToClient(jb, f);
OutputInitResult OutputJsonLogInitSub(ConfNode *conf, OutputCtx *parent_ctx)
void CreateIsoTimeString(const SCTime_t ts, char *str, size_t size)
OutputJsonCommonSettings cfg
TmEcode JsonLogThreadInit(ThreadVars *t, const void *initdata, void **data)
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
int OutputJsonBuilderBuffer(JsonBuilder *js, OutputJsonThreadCtx *ctx)
bool SCProtoNameValid(uint16_t proto)
Function to check if the received protocol number is valid and do we have corresponding name entry fo...
struct Flow_::@116::@122 icmp_d
const char * known_proto[256]
struct Flow_::@114::@120 icmp_s
void OutputRegisterFlowSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a flow output sub-module.
struct Flow_::@114::@121 esp
#define JB_SET_STRING(jb, key, val)
Per thread variable structure.
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
void EveAddCommonOptions(const OutputJsonCommonSettings *cfg, const Packet *p, const Flow *f, JsonBuilder *js, enum OutputJsonLogDirection dir)
void EveTcpFlags(const uint8_t flags, JsonBuilder *js)
jsonify tcp flags field Only add 'true' fields in an attempt to keep things reasonably compact.
struct LiveDevice_ * livedev
void CreateEveFlowId(JsonBuilder *js, const Flow *f)
uint16_t vlan_id[VLAN_MAX_LAYERS]
TmEcode JsonLogThreadDeinit(ThreadVars *t, void *data)
AppProto alproto
application level protocol
#define FLOW_DIR_REVERSED
union FlowAddress_::@113 address
void JsonNetFlowLogRegister(void)