Context Navigation

dataFlowSet.c @ 146

Revision 146, 59.5 KB (checked in by andreu, 12 years ago)
New remote client in python (based on renetcolGUI without GUI)
Property svn:eol-style set to `native`

Rev	Line
[2]	1	/*
	2	* File: dataFlowSet.c
	3	*
[145]	4	* Authors: ANDREU Francois-Xavier
	5	*
	6	* Copyright (C) 2005 - 2010 GIP RENATER
[2]	7	*/
	8
[145]	9	/ This file is part of renetcol.*
[2]	10	*
	11	* renetcol is free software; you can redistribute it and/or modify
	12	* it under the terms of the GNU General Public License as published by
	13	* the Free Software Foundation; either version 2 of the License, or
	14	* (at your option) any later version.
	15	*
	16	* renetcol is distributed in the hope that it will be useful,
	17	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	18	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	19	* GNU General Public License for more details.
	20	*
	21	* You should have received a copy of the GNU General Public License
	22	* along with renetcol; if not, write to the Free Software
	23	* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
	24	*/
	25
	26	#include "dataFlowSet.h"
	27
	28	/*
[145]	29	* Check Data FlowSet
[2]	30	*
	31	*/
[145]	32	short
	33	checkDataFlowSet(short shift,
[80]	34	struct MyPtrs *myPtrs,
[145]	35	int myQueue,
	36	struct PrefixV4 *V4PTab,
[80]	37	size_t nbPV4,
	38	struct PrefixV4 *V4STab,
	39	size_t nbSV4
	40	)
[2]	41	{
[80]	42	TplFlowSetPtr tmp = NULL;
	43	TplOptionPtr tmpOpt = NULL;
	44	FieldPtr pftmp = NULL;
	45	FieldPtr secondPftmp = NULL;
	46	unsigned short data_length = 0;
	47	unsigned short flow_size = 0;
	48	unsigned short oldOffset = *myPtrs->offsetV9Ptr;
	49	unsigned short secondOffset = 0;
	50	unsigned short secondOldOffset = 0;
	51	int moreIsNecessary = 1;
	52	int field_size = 0;
	53	int cpt = 0;
	54	int secondCpt = 0;
	55	int overflow = 0;
	56	int noEnd = 1;
	57	int i = 0;
	58	int j = 0;
	59	int pos = 0;
[145]	60	int jdos = 0;
	61	int posdos = 0;
	62	unsigned char buffer1;
[80]	63	unsigned char buffer2[2];
	64	unsigned char buffer4[4];
	65	RulesPtr tmpRuleList = myPtrs->rulesListPtr;
	66	RulesPtr tmpRL = myPtrs->rulesListPtr;
	67	msgType myMsg;
	68	char *msgTextIndex;
[57]	69
[80]	70	unsigned short tplMsgType = 11;
	71	struct PrefixV4 prefixKey, res, res2, resSub; /* for bsearch /
[60]	72	#if defined(IPV4AGGIDSNMP)
[80]	73	struct PrefixV4 *res3;
[60]	74	#endif
	75	#ifdef ASACC
[80]	76	struct AS asKey, asres; /* for bsearch /
[60]	77	#endif
[80]	78	struct AggCache agCache;
[144]	79	struct DoSCache dosCache;
[80]	80	int bool = 0; / in IPV4 Agg mode enabled, we need to now if it's an IPv4 /
[95]	81	int isIPv6 = 0;
[80]	82	/ flow, we test on the field and then put bool at 1 /
	83	int isMplsFlow = 0;
	84	int paddingCounter = 0;
	85	int crazyCounter = 0;
[111]	86	#ifdef DEBUG
	87	int flowCpt = 0;
	88	#endif
[27]	89
[80]	90	buffer2[1] = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
	91	(*myPtrs->offsetV9Ptr)++;
	92	buffer2[0] = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
	93	(*myPtrs->offsetV9Ptr)++;
	94	(myPtrs->currentFlowsetIdPtr) = ((unsigned short*)&buffer2);
	95	buffer2[1] = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
	96	(*myPtrs->offsetV9Ptr)++;
	97	buffer2[0] = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
	98	(*myPtrs->offsetV9Ptr)++;
	99	data_length = ((unsigned* short*)&buffer2);
	100	if (data_length == 0) {
[145]	101	#ifdef DEBUG
[111]	102	fprintf (stderr, " dlg==0 <--\| ");
	103	#endif
	104	/ syslog(LOG_INFO, "data flowset length null; all next informations of this data flowset are not considered! flowset ID: %hu, from router: %lu.%lu.%lu.%lu", /
	105	/ (myPtrs->currentFlowsetIdPtr), /*
	106	/ (myPtrs->pcktPtr->ipH->srcAdd>>24), /
	107	/ (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), /
	108	/ (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), /
	109	/ (myPtrs->pcktPtr->ipH->srcAdd<<24>>24)); /
[80]	110	return (-1);
[30]	111
[80]	112	}
[74]	113
[145]	114	if ( (tmp=existTplId(myPtrs->currentRouterPtr,
	115	myPtrs->currentHeaderV9Ptr->sourceId,
[80]	116	(*myPtrs->currentFlowsetIdPtr)))!=NULL ) {
[113]	117	myPtrs->currentMIB->dataFlowSetNb += 1;
[29]	118	#ifdef DEBUG
[80]	119	fprintf(stderr,
[145]	120	"{d id: %hu, lg %hu",
	121	(*myPtrs->currentFlowsetIdPtr),
[80]	122	data_length);
	123	if ( (*myPtrs->currentFlowsetIdPtr) > TRESHOLD_TEMPLATE_ID ) {
[111]	124	fprintf(stderr,"Bad TID from router: %lu.%lu.%lu.%lu\n",
	125	(*myPtrs->currentFlowsetIdPtr),
	126	(myPtrs->pcktPtr->ipH->srcAdd>>24),
	127	(myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
	128	(myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
	129	(myPtrs->pcktPtr->ipH->srcAdd<<24>>24));
	130	fprintf(stderr," Bytes : \n");
	131	while ( ( myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr) ) > (myPtrs->ptr_buffer+1416) ){
	132	buffer1= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));(*myPtrs->offsetV9Ptr)++;
	133	tmp = ((unsigned* char*)&buffer1);
	134	fprintf (stderr, " %s ", tmp);
	135	}
	136	exit(-1);
[80]	137	return (data_length+shift);
	138	}
[29]	139	#endif
[80]	140	pftmp = tmp->lastField;
	141	for (; pftmp; pftmp = pftmp->prev) {
	142	flow_size += pftmp->fieldLength;
	143	}
	144	if ( data_length%flow_size >= 9 ) {
	145	(*myPtrs->currentFlowsetNumberPtr) = myPtrs->currentHeaderV9Ptr->count;
[111]	146	syslog(LOG_INFO, "data flowset length not match with length from template definition, wrong template definition suspected; all next informations of this data flowset are not considered! sourceID: %lu flowset ID: %hu, from router: %lu.%lu.%lu.%lu",
	147	myPtrs->currentHeaderV9Ptr->sourceId,
[80]	148	(*myPtrs->currentFlowsetIdPtr),
	149	(myPtrs->pcktPtr->ipH->srcAdd>>24),
	150	(myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
	151	(myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
	152	(myPtrs->pcktPtr->ipH->srcAdd<<24>>24));
[145]	153	#ifdef DEBUG
[111]	154	fprintf (stderr, " dlg%flsz >=9 skip data ");
	155	#endif
[80]	156	return (data_length+shift);
	157	}
	158	if ( data_length >= 1452 ) {
	159	syslog(LOG_INFO, "data flowset length too raised; all next informations of this data flowset are not considered! flowset ID: %hu, from router: %lu.%lu.%lu.%lu",
	160	(*myPtrs->currentFlowsetIdPtr),
	161	(myPtrs->pcktPtr->ipH->srcAdd>>24),
	162	(myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
	163	(myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
	164	(myPtrs->pcktPtr->ipH->srcAdd<<24>>24));
[145]	165	#ifdef DEBUG
[111]	166	fprintf (stderr, " dlg >= 1452 skip pckt ");
	167	#endif
[80]	168	return (-1);
	169	}
[59]	170	#if defined(IPV4AGGIDR) \|\| defined(IPV4AGGIDSNMP)
[145]	171	agCache.routerAd = myPtrs->pcktPtr->ipH->srcAdd;
[22]	172	#endif
[18]	173
[80]	174	pftmp = tmp->lastField;
[145]	175	secondPftmp = tmp->lastField;
[80]	176	secondOffset = *myPtrs->offsetV9Ptr;
	177	secondOldOffset = secondOffset;
[145]	178	while ( (((*myPtrs->offsetV9Ptr)-48-shift) <= data_length)
	179	&& (overflow!=1) ) {
	180	/*
	181	* progression in a data flow Set
[80]	182	* notes:
	183	* 48= IP header size + NetFlow header size
	184	* shift = shift because we have a template declaration
	185	* inside data templates
	186	*/
	187	cpt++;
	188	j = 0;
	189	pos = (pftmp->fieldType)*MAX_RULES_PER_FIELD+j;
	190	field_size = (int) pftmp->fieldLength;
[76]	191
[80]	192	/ special case: check yes on all flows from one router /
	193	/ (phantom field nb 0) /
	194	/ FIXME : this code is repeated, perhaps past before /
	195	while ( ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+j))) != NULL ) {
	196	if ( (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+j)))->value->stor.lvalue)
	197	== myPtrs->pcktPtr->ipH->srcAdd )
	198	{
	199	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+j)))->check = 1;
[145]	200	}
[80]	201	j++;
[145]	202	}
[80]	203	j = 0;
[76]	204
[80]	205	/*
	206	* Comparaison between the field value and the rules
	207	* ... if one rule exist
	208	* FIXME : warning, if no rules, no accounting ?
	209	*/
	210	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos))) != NULL) {
	211	oldOffset = *myPtrs->offsetV9Ptr;
	212	while (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos))) != NULL){
[145]	213	/*
[80]	214	* while on one cache table line
	215	*/
	216	*myPtrs->offsetV9Ptr = oldOffset;
	217	switch ((int)
	218	(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->operator)){
	219	case 2:
[145]	220	/ operator: "=" /
[80]	221	switch (field_size) {
	222	case 1:
[145]	223	buffer1 = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	224	(*myPtrs->offsetV9Ptr)++;
	225	/ rule check /
[145]	226	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.cvalue
[80]	227	== ((unsigned* char*)&buffer1)) {
	228	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
	229	}
	230	/ end rule check /
[59]	231	#if defined(IPV4AGGIDR) \|\| defined(IPV4AGGIDSNMP)
[80]	232	if ((pftmp->fieldType==9)\|\|(pftmp->fieldType==29)){
	233	agCache.maskS = ((unsigned* char*)&buffer1);
	234	}
	235	if ((pftmp->fieldType==13)\|\|(pftmp->fieldType==30)){
	236	agCache.maskD = ((unsigned* char*)&buffer1);
	237	}
	238	if (pftmp->fieldType==60){
	239	agCache.ipProt = ((unsigned* char*)&buffer1);
	240	}
	241	if (pftmp->fieldType==4){
	242	agCache.tProt = ((unsigned* char*)&buffer1);
	243	}
	244	if (pftmp->fieldType==61){
	245	agCache.sens = ((unsigned* char*)&buffer1);
	246	}
	247	if (pftmp->fieldType==5){
	248	agCache.dscp = ((unsigned* char*)&buffer1);
	249	}
[145]	250	#endif
[80]	251	break;
	252	case 2:
[145]	253	buffer2[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	254	(*myPtrs->offsetV9Ptr)++;
[145]	255	buffer2[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	256	(*myPtrs->offsetV9Ptr)++;
[145]	257	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.svalue
[80]	258	== ((unsigned* short*)&buffer2))
	259	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
[114]	260	if (pftmp->fieldType==7){
	261	agCache.sPort = ((unsigned* short*)&buffer2);
[145]	262	}
[114]	263	if (pftmp->fieldType==11){
	264	agCache.dPort = ((unsigned* short*)&buffer2);
	265	}
[59]	266	#if defined(IPV4AGGIDR) \|\| defined(IPV4AGGIDSNMP)
[80]	267	if (pftmp->fieldType==10){
	268	agCache.inputSnmp = ((unsigned* short*)&buffer2);
	269	}
	270	if (pftmp->fieldType==14){
	271	agCache.outputSnmp = ((unsigned* short*)&buffer2);
	272	}
[22]	273	#endif
[60]	274	#ifdef ASACC
[80]	275	if (pftmp->fieldType==16){
	276	agCache.asS = ((unsigned* short*)&buffer2);
[145]	277	}
[80]	278	if (pftmp->fieldType==17){
	279	agCache.asD = ((unsigned* short*)&buffer2);
	280	}
[60]	281	#endif
[80]	282	break;
	283	case 3:
	284	buffer4[3]= 0;
[145]	285	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	286	(*myPtrs->offsetV9Ptr)++;
[145]	287	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	288	(*myPtrs->offsetV9Ptr)++;
[145]	289	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	290	(*myPtrs->offsetV9Ptr)++;
[145]	291	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue
[80]	292	== ((unsigned* long*)&buffer4))
	293	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
	294	/ aggregation /
	295	/ end aggregation /
	296	if (pftmp->fieldType==70){
	297	isMplsFlow = 1;
	298	}
	299	break;
	300	case 4:
[145]	301	buffer4[3]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	302	(*myPtrs->offsetV9Ptr)++;
[145]	303	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	304	(*myPtrs->offsetV9Ptr)++;
[145]	305	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	306	(*myPtrs->offsetV9Ptr)++;
[145]	307	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	308	(*myPtrs->offsetV9Ptr)++;
	309	/ FIXME : here , add a check on the field type /
	310	if ((pftmp->fieldType==8)\|\|(pftmp->fieldType==12)
	311	\|\|(pftmp->fieldType==15)\|\|(pftmp->fieldType==18)){
[145]	312	if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)
[80]	313	== (((unsigned* long)&buffer4))>>(32-((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->mask)<<(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) )
	314	{
	315	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
	316	}
	317	}
	318	if ((pftmp->fieldType==10)\|\|(pftmp->fieldType==14)){
[145]	319	if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.svalue)
[85]	320	== ((unsigned short)((unsigned* long*)&buffer4)))
[80]	321	{
	322	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
	323	}
	324	}
[86]	325	if ((pftmp->fieldType==16)\|\|(pftmp->fieldType==17)){
[145]	326	if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.svalue)
[86]	327	== ((unsigned short)((unsigned* long*)&buffer4)))
	328	{
	329	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
	330	}
	331	}
[80]	332	if (pftmp->fieldType==1){
	333	agCache.bytes = ((unsigned* long*)&buffer4);
	334	if (
[144]	335	((unsigned long)((((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) + ( (((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)/5))
[80]	336	>= (((unsigned* long*)&buffer4)))
	337	&&
[144]	338	( (unsigned long)((((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) - ( (((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)/5))
[80]	339	<= (((unsigned* long*)&buffer4)) )
	340	)
	341	{
	342	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
	343	}
[144]	344	}
[59]	345	#if defined(IPV4AGGIDR) \|\| defined(IPV4AGGIDSNMP)
[85]	346	if (pftmp->fieldType==10){
	347	agCache.inputSnmp = (unsigned short)((unsigned* long*)&buffer4);
	348	}
	349	if (pftmp->fieldType==14){
	350	agCache.outputSnmp = (unsigned short)((unsigned* long*)&buffer4);
[145]	351	}
[80]	352	if ((pftmp->fieldType==8)){
	353	bool = 1; / very important, test if we have an IPv4 flow for Agg /
	354	agCache.v4AdS = ((unsigned* long*)&buffer4);
	355	}
	356	if ((pftmp->fieldType==12)){
	357	agCache.v4AdD = ((unsigned* long*)&buffer4);
	358	}
	359	if (pftmp->fieldType==1){
	360	agCache.bytes = ((unsigned* long*)&buffer4);
	361	}
	362	if (pftmp->fieldType==2){
	363	agCache.pkts = ((unsigned* long*)&buffer4);
	364	}
[22]	365	#endif
[86]	366	#ifdef ASACC
	367	if (pftmp->fieldType==16){
	368	agCache.asS = (unsigned short)((unsigned* long*)&buffer4);
[145]	369	}
[86]	370	if (pftmp->fieldType==17){
	371	agCache.asD = (unsigned short)((unsigned* long*)&buffer4);
	372	}
	373	#endif
[144]	374	if (pftmp->fieldType==1){
	375	dosCache.bytes = ((unsigned* long*)&buffer4);
[145]	376	dosCache.sampling = myPtrs->currentRouterPtr->sampled;
[144]	377	}
	378	if (pftmp->fieldType==2){
[145]	379	dosCache.packets = ((unsigned* long*)&buffer4);
	380	}
	381	if (pftmp->fieldType==21){
	382	dosCache.endTime = ((unsigned* long*)&buffer4);
	383	}
	384	if (pftmp->fieldType==22){
	385	dosCache.startTime = ((unsigned* long*)&buffer4);
	386	}
[80]	387	break;
	388	case 16:
[95]	389	if ((pftmp->fieldType==27)\|\|(pftmp->fieldType==28)){
	390	isIPv6 = 1;
	391	for (i=0; i<4; i++) {
[145]	392	buffer4[3]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[95]	393	(*myPtrs->offsetV9Ptr)++;
[145]	394	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[95]	395	(*myPtrs->offsetV9Ptr)++;
[145]	396	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[95]	397	(*myPtrs->offsetV9Ptr)++;
[145]	398	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[95]	399	(*myPtrs->offsetV9Ptr)++;
	400	if (1==moreIsNecessary){
	401	switch(i){
	402	case 0:
	403	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 32){
[145]	404	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
	405	==
[95]	406	(((unsigned* long)&buffer4))>>(32-((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->mask)<<(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)
	407	)
	408	{
	409	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
	410	moreIsNecessary = 0;
	411	} else {
	412	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
[80]	413	moreIsNecessary = 0;
[95]	414	}
	415	} else {
[145]	416	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
	417	==
[95]	418	(((unsigned* long*)&buffer4))
	419	)
	420	{
	421	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
	422	} else {
	423	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
	424	moreIsNecessary = 0;
	425	}
[80]	426	}
[95]	427	break;
	428	case 1:
	429	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 64){
[145]	430	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
	431	==
[95]	432	(((unsigned* long)&buffer4))>>(64-((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->mask)<<(64-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)
	433	)
	434	{
	435	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
	436	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
	437	moreIsNecessary = 0;
	438	} else {
	439	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
[80]	440	moreIsNecessary = 0;
[95]	441	}
	442	} else {
[145]	443	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
	444	==
[95]	445	(((unsigned* long*)&buffer4))
	446	)
	447	{
[145]	448	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
[95]	449	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
	450	} else {
	451	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
	452	moreIsNecessary = 0;
	453	}
[80]	454	}
[95]	455	break;
	456	case 2:
	457	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 96){
[145]	458	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
	459	==
[95]	460	(((unsigned* long)&buffer4))>>(96-((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->mask)<<(96-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)
	461	)
	462	{
	463	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
	464	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
	465	moreIsNecessary = 0;
	466	} else {
	467	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
[80]	468	moreIsNecessary = 0;
[95]	469	}
	470	} else {
[145]	471	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
	472	==
[95]	473	(((unsigned* long*)&buffer4))
	474	)
	475	{
[145]	476	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
[95]	477	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
	478	} else {
	479	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
	480	moreIsNecessary = 0;
	481	}
[80]	482	}
[95]	483	break;
	484	case 3:
	485	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 128){
[145]	486	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
	487	==
[95]	488	(((unsigned* long)&buffer4))>>(128-((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->mask)<<(128-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)
	489	)
	490	{
	491	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
	492	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
	493	} else {
	494	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
[80]	495	moreIsNecessary = 0;
[95]	496	}
	497	} else {
[145]	498	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
	499	==
[95]	500	(((unsigned* long*)&buffer4))
	501	)
	502	{
[145]	503	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
[95]	504	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
	505	} else {
	506	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
	507	moreIsNecessary = 0;
	508	}
[80]	509	}
[95]	510	break;
	511	default:
	512	break;
	513	} / end of switch(i) /
	514	} / end of if moreIsNecessary /
	515	#if defined IPV6AGGIDSNMP
	516	if ((pftmp->fieldType==27)){
	517	agCache.tabAdd6S[i] = ((unsigned* long*)&buffer4);
	518	} else if ((pftmp->fieldType==28)){
	519	agCache.tabAdd6D[i] = ((unsigned* long*)&buffer4);
	520	}
	521	#endif
	522	}
	523	moreIsNecessary = 1;
	524	/ aggregation for IPv6 flows /
[145]	525
[95]	526	/ end aggregation /
	527	} / end of : if ((pftmp->fieldType==27)\|\|(pftmp->fieldType==28)){ /
[80]	528	break;
	529	default:
[145]	530	syslog(LOG_INFO, "Field size not known: %d\n", field_size);
[80]	531	for (i=0; i<field_size; i++){
	532	(*myPtrs->offsetV9Ptr)++;
	533	}
	534	break;
	535	}
	536	break;
	537	default:
	538	syslog(LOG_INFO, "Operator not known: %d\n",
	539	(int)(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->operator));
	540	break;
	541	}
	542	j++;
[94]	543	pos = (pftmp->fieldType)*MAX_RULES_PER_FIELD+j;
[80]	544	} / end while myPtrs->rulesAddressPtr /
	545	} else {
[145]	546	/*
	547	* no rule within this field type, but we must read the value
[80]	548	*/
	549	switch (field_size) {
	550	case 1:
[145]	551	buffer1 = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	552	(*myPtrs->offsetV9Ptr)++;
[59]	553	#if defined(IPV4AGGIDR) \|\| defined(IPV4AGGIDSNMP)
[80]	554	if ((pftmp->fieldType==9)\|\|(pftmp->fieldType==29)){
	555	agCache.maskS = ((unsigned* char*)&buffer1);
	556	}
	557	if ((pftmp->fieldType==13)\|\|(pftmp->fieldType==30)){
	558	agCache.maskD = ((unsigned* char*)&buffer1);
	559	}
	560	if (pftmp->fieldType==60){
	561	agCache.ipProt = ((unsigned* char*)&buffer1);
	562	}
	563	if (pftmp->fieldType==4){
	564	agCache.tProt = ((unsigned* char*)&buffer1);
	565	}
	566	if (pftmp->fieldType==61){
	567	agCache.sens = ((unsigned* char*)&buffer1);
	568	}
	569	if (pftmp->fieldType==5){
	570	agCache.dscp = ((unsigned* char*)&buffer1);
[145]	571	}
[22]	572	#endif
[80]	573	break;
	574	case 2:
[145]	575	buffer2[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	576	(*myPtrs->offsetV9Ptr)++;
[145]	577	buffer2[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	578	(*myPtrs->offsetV9Ptr)++;
[114]	579	if (pftmp->fieldType==7){
	580	agCache.sPort = ((unsigned* short*)&buffer2);
[145]	581	}
[114]	582	if (pftmp->fieldType==11){
	583	agCache.dPort = ((unsigned* short*)&buffer2);
	584	}
[59]	585	#if defined(IPV4AGGIDR) \|\| defined(IPV4AGGIDSNMP)
[80]	586	if (pftmp->fieldType==10){
	587	agCache.inputSnmp = ((unsigned* short*)&buffer2);
[145]	588	}
[80]	589	if (pftmp->fieldType==14){
	590	agCache.outputSnmp = ((unsigned* short*)&buffer2);
[145]	591	}
[22]	592	#endif
[60]	593	#ifdef ASACC
[80]	594	if (pftmp->fieldType==16){
	595	agCache.asS = ((unsigned* short*)&buffer2);
[145]	596	}
[80]	597	if (pftmp->fieldType==17){
	598	agCache.asD = ((unsigned* short*)&buffer2);
	599	}
[60]	600	#endif
[80]	601	break;
	602	case 3:
	603	buffer4[3]= 0;
[145]	604	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	605	(*myPtrs->offsetV9Ptr)++;
[145]	606	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	607	(*myPtrs->offsetV9Ptr)++;
[145]	608	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	609	(*myPtrs->offsetV9Ptr)++;
	610	/ aggregation /
	611	/ end aggregation /
	612	if (pftmp->fieldType==70){
	613	isMplsFlow = 1;
	614	}
	615	break;
	616	case 4:
[145]	617	buffer4[3]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	618	(*myPtrs->offsetV9Ptr)++;
[145]	619	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	620	(*myPtrs->offsetV9Ptr)++;
[145]	621	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	622	(*myPtrs->offsetV9Ptr)++;
[145]	623	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	624	(*myPtrs->offsetV9Ptr)++;
[59]	625	#if defined(IPV4AGGIDR) \|\| defined(IPV4AGGIDSNMP)
[85]	626	if (pftmp->fieldType==10){
	627	agCache.inputSnmp = (unsigned short)((unsigned* long*)&buffer4);
	628	}
	629	if (pftmp->fieldType==14){
	630	agCache.outputSnmp = (unsigned short)((unsigned* long*)&buffer4);
[145]	631	}
[80]	632	if ((pftmp->fieldType==8)){
	633	bool = 1;
	634	agCache.v4AdS = ((unsigned* long*)&buffer4);
	635	} else if ((pftmp->fieldType==12)){
	636	agCache.v4AdD = ((unsigned* long*)&buffer4);
	637	} else if (pftmp->fieldType==1){
	638	agCache.bytes = ((unsigned* long*)&buffer4);
	639	} else if (pftmp->fieldType==2){
	640	agCache.pkts = ((unsigned* long*)&buffer4);
	641	}
[22]	642	#endif
[86]	643	#ifdef ASACC
	644	if (pftmp->fieldType==16){
	645	agCache.asS = (unsigned short)((unsigned* long*)&buffer4);
[145]	646	}
[86]	647	if (pftmp->fieldType==17){
	648	agCache.asD = (unsigned short)((unsigned* long*)&buffer4);
	649	}
	650	#endif
[144]	651	if (pftmp->fieldType==1){
	652	dosCache.bytes = ((unsigned* long*)&buffer4);
[145]	653	dosCache.sampling = myPtrs->currentRouterPtr->sampled;
	654	}
[144]	655	if (pftmp->fieldType==2){
[145]	656	dosCache.packets = ((unsigned* long*)&buffer4);
[144]	657	}
[145]	658	if (pftmp->fieldType==21){
	659	dosCache.endTime = ((unsigned* long*)&buffer4);
	660	}
	661	if (pftmp->fieldType==22){
	662	dosCache.startTime = ((unsigned* long*)&buffer4);
	663	}
[80]	664	break;
	665	case 16:
[95]	666	if ((pftmp->fieldType==27)\|\|(pftmp->fieldType==28)){
	667	isIPv6 = 1;
	668	}
[80]	669	for (i=0; i<4; i++) {
[145]	670	buffer4[3]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	671	(*myPtrs->offsetV9Ptr)++;
[145]	672	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	673	(*myPtrs->offsetV9Ptr)++;
[145]	674	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	675	(*myPtrs->offsetV9Ptr)++;
[145]	676	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	677	(*myPtrs->offsetV9Ptr)++;
[95]	678	#if defined IPV6AGGIDSNMP
	679	if ((pftmp->fieldType==27)){
	680	agCache.tabAdd6S[i] = ((unsigned* long*)&buffer4);
	681	} else if ((pftmp->fieldType==28)){
	682	agCache.tabAdd6D[i] = ((unsigned* long*)&buffer4);
	683	}
	684	#endif
[80]	685	}
	686	break;
	687	default:
	688	syslog(LOG_INFO,"UNKNOWN FIELDS LENGTH: %d ", field_size);
	689	for (i=0; i<field_size; i++){
	690	(*myPtrs->offsetV9Ptr)++;
	691	}
	692	}
	693	} / end if one cache table line existence /
	694	if (cpt==tmp->fieldCount) {
[145]	695	/*
	696	* end of one flow (not the flowset)
[80]	697	*/
[113]	698	myPtrs->currentMIB->realFlowNb += 1;
[111]	699	#ifdef DEBUG
	700	flowCpt++;
	701	fprintf(stderr," F%d ", flowCpt);
[145]	702	#endif
[80]	703	/ put aggregation cache information to IPv4 Prefixes table /
	704	/ Aggregation mode must be enable in ./configure options /
	705	/ first we must know if the address belong to our prefix /
	706	/*
	707	* AS ACCOUNTING
	708	*/
[60]	709	#if defined(ASACC) && defined(IPV4AGGIDSNMP)
[80]	710	if ( (bool == 1) && (isMplsFlow == 0) ){
	711	asKey.as = agCache.asS;
	712	asres = bsearch(&asKey, myPtrs->currentASTab, myPtrs->asNb, sizeof(struct AS), asGlobalCmp);
	713	if (asres != NULL) {
[86]	714	if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) {
	715	#if defined(MULTISAMPLING)
	716	if (myPtrs->currentRouterPtr->sampled != asres->sampling ){
	717	/ OUT ("traffic from the AS") /
	718	asres->bytesNbOUT += agCache.bytes*myPtrs->currentRouterPtr->sampled/asres->sampling;
	719	asres->pktsNbOUT += agCache.pkts*myPtrs->currentRouterPtr->sampled/asres->sampling;
	720	}else{
	721	asres->bytesNbOUT += agCache.bytes;
	722	asres->pktsNbOUT += agCache.pkts;
	723	(asres->flowNbOUT)++;
	724	}
	725	#else
[80]	726	if (myPtrs->currentRouterPtr->sampled != 0 ){
	727	/ OUT ("traffic from the AS") /
	728	asres->bytesNbOUT += agCache.bytes;
	729	asres->pktsNbOUT += agCache.pkts;
	730	(asres->flowNbOUT)++;
	731	}
[145]	732	if (asres->sampling == 0
[80]	733	&& myPtrs->currentRouterPtr->sampled != 0){
	734	asres->sampling = myPtrs->currentRouterPtr->sampled;
	735	}
[86]	736	#endif
[80]	737	asres = NULL;
	738	asKey.as = agCache.asD;
	739	asres = bsearch(&asKey, myPtrs->currentASTab, myPtrs->asNb, sizeof(struct AS), asGlobalCmp);
	740	if (asres!=NULL){
[86]	741	#if defined(MULTISAMPLING)
	742	if (myPtrs->currentRouterPtr->sampled != asres->sampling ){
	743	/ IN ("traffic to the AS") /
	744	asres->bytesNbIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/asres->sampling;
	745	asres->pktsNbIN += agCache.pkts*myPtrs->currentRouterPtr->sampled/asres->sampling;
	746	}else{
	747	asres->bytesNbIN += agCache.bytes;
	748	asres->pktsNbIN += agCache.pkts;
	749	(asres->flowNbIN)++;
	750	}
	751	#else
[80]	752	if (myPtrs->currentRouterPtr->sampled != 0 ){
	753	/ IN ("traffic to the AS") /
	754	asres->bytesNbIN += agCache.bytes;
	755	asres->pktsNbIN += agCache.pkts;
	756	(asres->flowNbIN)++;
	757	}
[145]	758	if (asres->sampling == 0
[80]	759	&& myPtrs->currentRouterPtr->sampled != 0){
	760	asres->sampling = myPtrs->currentRouterPtr->sampled;
	761	}
[86]	762	#endif
[80]	763	asres = NULL;
	764	}
	765	}
	766	} else {
	767	asres = NULL;
	768	asKey.as = agCache.asD;
	769	asres = bsearch(&asKey, myPtrs->currentASTab, myPtrs->asNb, sizeof(struct AS), asGlobalCmp);
	770	if (asres!=NULL){
	771	if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) {
[86]	772	#if defined(MULTISAMPLING)
	773	if (myPtrs->currentRouterPtr->sampled != asres->sampling ){
	774	/ IN ("traffic to the AS") /
	775	asres->bytesNbIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/asres->sampling;
	776	asres->pktsNbIN += agCache.pkts*myPtrs->currentRouterPtr->sampled/asres->sampling;
	777	}else{
	778	asres->bytesNbIN += agCache.bytes;
	779	asres->pktsNbIN += agCache.pkts;
	780	(asres->flowNbIN)++;
	781	}
	782	#else
[80]	783	if (myPtrs->currentRouterPtr->sampled != 0 ){
	784	/ IN ("traffic to the AS") /
	785	asres->bytesNbIN += agCache.bytes;
	786	asres->pktsNbIN += agCache.pkts;
	787	(asres->flowNbIN)++;
	788	}
[145]	789	if (asres->sampling == 0
[80]	790	&& myPtrs->currentRouterPtr->sampled != 0){
	791	asres->sampling = myPtrs->currentRouterPtr->sampled;
	792	}
[86]	793	#endif
[80]	794	}
	795	}
	796	}
	797	}
[60]	798	#endif
[114]	799	if ( (bool == 1) && (isMplsFlow == 0) ){
	800	/ Update the information db (aka RenetcolMIB) /
	801	myPtrs->currentMIB->ipv4Bytes += agCache.bytes;
	802	myPtrs->currentMIB->ipv4Pckts += agCache.pkts;
	803	myPtrs->currentMIB->ipv4Flow += 1;
	804	switch (agCache.tProt){
	805	case 1:
	806	myPtrs->currentMIB->ipv4IcmpFlowNb += 1;
	807	myPtrs->currentMIB->ipv4IcmpBytesNb += agCache.bytes;
	808	myPtrs->currentMIB->ipv4IcmpPktsNb += agCache.pkts;
	809	break;
	810	case 6:
	811	myPtrs->currentMIB->ipv4TCPFlowNb += 1;
	812	myPtrs->currentMIB->ipv4TCPBytesNb += agCache.bytes;
	813	myPtrs->currentMIB->ipv4TCPPktsNb += agCache.pkts;
	814	break;
	815	case 17:
	816	myPtrs->currentMIB->ipv4UDPFlowNb += 1;
	817	myPtrs->currentMIB->ipv4UDPBytesNb += agCache.bytes;
	818	myPtrs->currentMIB->ipv4UDPPktsNb += agCache.pkts;
	819	break;
	820	default:
	821	myPtrs->currentMIB->ipv4OthersFlowNb += 1;
	822	myPtrs->currentMIB->ipv4OthersBytesNb += agCache.bytes;
	823	myPtrs->currentMIB->ipv4OthersPktsNb += agCache.pkts;
	824	break;
	825	}
	826	if (agCache.pkts==1){
	827	myPtrs->currentMIB->ipv4FlowSizePcktsE1 += 1;
	828	} else if (agCache.pkts<10) {
	829	myPtrs->currentMIB->ipv4FlowSizePcktsLT10 += 1;
	830	} else if (agCache.pkts<100) {
	831	myPtrs->currentMIB->ipv4FlowSizePcktsLT100 += 1;
	832	} else if (agCache.pkts<1000) {
	833	myPtrs->currentMIB->ipv4FlowSizePcktsLT1k += 1;
	834	} else if (agCache.pkts<10000) {
	835	myPtrs->currentMIB->ipv4FlowSizePcktsLT10k += 1;
	836	} else if (agCache.pkts>=10000) {
	837	myPtrs->currentMIB->ipv4FlowSizePcktsMT10k += 1;
	838	}
	839	if (agCache.bytes<50){
	840	myPtrs->currentMIB->ipv4FlowSizeBytesLT50 += 1;
	841	} else if (agCache.bytes<100) {
	842	myPtrs->currentMIB->ipv4FlowSizeBytesLT100 += 1;
	843	} else if (agCache.bytes<1000) {
	844	myPtrs->currentMIB->ipv4FlowSizeBytesLT1k += 1;
	845	} else if (agCache.bytes<10000) {
	846	myPtrs->currentMIB->ipv4FlowSizeBytesLT10k += 1;
	847	} else if (agCache.bytes<100000) {
	848	myPtrs->currentMIB->ipv4FlowSizeBytesLT100k += 1;
	849	} else if (agCache.bytes<1000000) {
	850	myPtrs->currentMIB->ipv4FlowSizeBytesLT1M += 1;
	851	} else if (agCache.bytes<10000000) {
	852	myPtrs->currentMIB->ipv4FlowSizeBytesLT10M += 1;
	853	} else if (agCache.bytes<100000000) {
	854	myPtrs->currentMIB->ipv4FlowSizeBytesLT100M += 1;
	855	} else if (agCache.bytes>=100000000) {
	856	myPtrs->currentMIB->ipv4FlowSizeBytesMT100M += 1;
	857	}
	858	switch (agCache.dPort){
	859	case 53:
	860	myPtrs->currentMIB->ipv4DNSFlowNb += 1;
	861	myPtrs->currentMIB->ipv4DNSBytesNb += agCache.bytes;
	862	myPtrs->currentMIB->ipv4DNSPcktsNb += agCache.pkts;
	863	break;
	864	case 80:
	865	myPtrs->currentMIB->ipv4WebFlowNb += 1;
	866	myPtrs->currentMIB->ipv4WebBytesNb += agCache.bytes;
	867	myPtrs->currentMIB->ipv4WebPcktsNb += agCache.pkts;
	868	break;
	869	default:
	870	myPtrs->currentMIB->ipv4OthersApFlowNb += 1;
	871	myPtrs->currentMIB->ipv4OthersApBytesNb += agCache.bytes;
	872	myPtrs->currentMIB->ipv4OthersApPcktsNb += agCache.pkts;
	873	break;
[145]	874	}
[114]	875	/ end of mib update /
	876	}
[80]	877	/*
	878	* PREFIX &/or MATRIX ACCOUNTING
	879	*/
[59]	880	#if defined(IPV4AGGIDR) \|\| defined(IPV4AGGIDSNMP)
[80]	881	if ( (bool == 1) && (isMplsFlow == 0) ){
[122]	882	/ prefixKey.beginning = agCache.v4AdS>>(32-agCache.maskS)<<(32-agCache.maskS); /
	883	prefixKey.beginning = agCache.v4AdS;
[145]	884	res = bsearch(&prefixKey, V4PTab, nbPV4,
[80]	885	sizeof(struct PrefixV4), prefGlobalCmp);
	886	if (res!=NULL){
[84]	887	/ WE HAVE FOUND SOURCE ADDRESS IN OUR LIST /
[80]	888	if (res->hasSubnet == 1) {
	889	resSub = NULL;
[145]	890	resSub = bsearch(&prefixKey, V4STab, nbSV4,
[80]	891	sizeof(struct PrefixV4), prefGlobalCmp);
	892	if (resSub != NULL) {
	893	res = resSub;
	894	resSub = NULL;
[145]	895	}
[80]	896	}
[84]	897	#ifdef DEBUG
[85]	898	fprintf(stderr,"S %lu.%lu.%lu.%lu/%hu %lu.%lu.%lu.%lu/%hu Rs %lu Ps %lu SNMPin(hu) %hu\n",
[84]	899	(agCache.v4AdS>>24),
[145]	900	(agCache.v4AdS<<8>>24),
	901	(agCache.v4AdS<<16>>24),
	902	(agCache.v4AdS<<24>>24),
[84]	903	(agCache.maskS),
[145]	904	(agCache.v4AdD>>24),
	905	(agCache.v4AdD<<8>>24),
	906	(agCache.v4AdD<<16>>24),
	907	(agCache.v4AdD<<24>>24),
[84]	908	(agCache.maskD),
	909	myPtrs->currentRouterPtr->sampled,
[85]	910	res->sampling,
	911	agCache.inputSnmp);
[84]	912	#endif
[59]	913	#if defined(IPV4AGGIDR)
[145]	914	if ( myPtrs->routersID[res->routerNb] == agCache.routerAd ) {
[59]	915	#elif defined(IPV4AGGIDSNMP)
[145]	916	if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) {
[59]	917	#endif
[83]	918	/ OUT ("traffic from the prefix/subnet") /
	919	#if defined(MULTISAMPLING)
	920	if (myPtrs->currentRouterPtr->sampled != res->sampling ){
	921	res->bytesNbOUT += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	922	res->pktsNbOUT += agCache.pkts*myPtrs->currentRouterPtr->sampled/res->sampling;
	923	/ (res->flowNbOUT)++; FIXME : FIND SOMETHING/
[93]	924	if (agCache.dscp>>2 == FIRST_CoS) {
	925	res->firstCoSOUT += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	926	} else if (agCache.dscp>>2 == SECOND_CoS) {
	927	res->secondCoSOUT += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	928	} else if (agCache.dscp>>2 == THIRD_CoS) {
	929	res->thirdCoSOUT += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	930	} else {
	931	res->fourthCoSOUT += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	932	}
[83]	933	}else{
	934	res->bytesNbOUT += agCache.bytes;
	935	res->pktsNbOUT += agCache.pkts;
[93]	936	(res->flowNbOUT)++;
	937	if (agCache.dscp>>2 == FIRST_CoS) {
	938	res->firstCoSOUT += agCache.bytes;
	939	} else if (agCache.dscp>>2 == SECOND_CoS) {
	940	res->secondCoSOUT += agCache.bytes;
	941	} else if (agCache.dscp>>2 == THIRD_CoS) {
	942	res->thirdCoSOUT += agCache.bytes;
	943	} else {
	944	res->fourthCoSOUT += agCache.bytes;
	945	}
[83]	946	}
	947	#else
[80]	948	if (myPtrs->currentRouterPtr->sampled != 0 ){
	949	res->bytesNbOUT += agCache.bytes;
	950	res->pktsNbOUT += agCache.pkts;
	951	(res->flowNbOUT)++;
[93]	952	if (agCache.dscp>>2 == FIRST_CoS) {
	953	res->firstCoSOUT += agCache.bytes;
	954	} else if (agCache.dscp>>2 == SECOND_CoS) {
	955	res->secondCoSOUT += agCache.bytes;
	956	} else if (agCache.dscp>>2 == THIRD_CoS) {
	957	res->thirdCoSOUT += agCache.bytes;
	958	} else {
	959	res->fourthCoSOUT += agCache.bytes;
	960	}
[80]	961	}
[145]	962	if (res->sampling == 0
[80]	963	&& myPtrs->currentRouterPtr->sampled != 0){
	964	res->sampling = myPtrs->currentRouterPtr->sampled;
	965	}
[83]	966	#endif
[60]	967	#if defined(IPV4AGGIDSNMP)
[122]	968	/ prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD);/
	969	prefixKey.beginning = agCache.v4AdD;
[145]	970	res3 = bsearch(&prefixKey, V4PTab, nbPV4,
[80]	971	sizeof(struct PrefixV4), prefGlobalCmp);
	972	if (res3!=NULL){
	973	/ res is supernet or subnet ? /
	974	if (res3->hasSubnet == 1) {
	975	resSub = NULL;
[145]	976	resSub = bsearch(&prefixKey, V4STab, nbSV4,
[80]	977	sizeof(struct PrefixV4), prefGlobalCmp);
	978	if (resSub != NULL) {
	979	res3 = resSub;
	980	resSub = NULL;
	981	}
	982	}
[84]	983	#ifdef DEBUG
[85]	984	fprintf(stderr,"S&D %lu.%lu.%lu.%lu/%hu %lu.%lu.%lu.%lu/%hu Rs %lu Ps %lu SNMPin %hu\n",
[84]	985	(agCache.v4AdS>>24),
[145]	986	(agCache.v4AdS<<8>>24),
	987	(agCache.v4AdS<<16>>24),
	988	(agCache.v4AdS<<24>>24),
[84]	989	(agCache.maskS),
[145]	990	(agCache.v4AdD>>24),
	991	(agCache.v4AdD<<8>>24),
	992	(agCache.v4AdD<<16>>24),
	993	(agCache.v4AdD<<24>>24),
[84]	994	(agCache.maskD),
	995	myPtrs->currentRouterPtr->sampled,
[85]	996	res3->sampling,
	997	agCache.inputSnmp);
[84]	998	#endif
[83]	999	#if defined(MULTISAMPLING)
	1000	if (myPtrs->currentRouterPtr->sampled != res3->sampling ){
	1001	res3->bytesNbIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res3->sampling;
	1002	res3->pktsNbIN += agCache.pkts*myPtrs->currentRouterPtr->sampled/res3->sampling;
	1003	/ (res3->flowNbIN)++; FIXME : FIND SOMETHING /
[93]	1004	if (agCache.dscp>>2 == FIRST_CoS) {
	1005	res3->firstCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res3->sampling;
	1006	} else if (agCache.dscp>>2 == SECOND_CoS) {
	1007	res3->secondCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res3->sampling;
	1008	} else if (agCache.dscp>>2 == THIRD_CoS) {
	1009	res3->thirdCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res3->sampling;
	1010	} else {
	1011	res3->fourthCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res3->sampling;
	1012	}
[83]	1013	}else{
	1014	res3->bytesNbIN += agCache.bytes;
	1015	res3->pktsNbIN += agCache.pkts;
	1016	(res3->flowNbIN)++;
[93]	1017	if (agCache.dscp>>2 == FIRST_CoS) {
	1018	res3->firstCoSIN += agCache.bytes;
	1019	} else if (agCache.dscp>>2 == SECOND_CoS) {
	1020	res3->secondCoSIN += agCache.bytes;
	1021	} else if (agCache.dscp>>2 == THIRD_CoS) {
	1022	res3->thirdCoSIN += agCache.bytes;
	1023	} else {
	1024	res3->fourthCoSIN += agCache.bytes;
	1025	}
[83]	1026	}
	1027	#else
[121]	1028
[80]	1029	if (myPtrs->currentRouterPtr->sampled != 0 ){
	1030	/ IN ("traffic to the prefix/subnet") /
	1031	res3->bytesNbIN += agCache.bytes;
	1032	res3->pktsNbIN += agCache.pkts;
	1033	(res3->flowNbIN)++;
[93]	1034	if (agCache.dscp>>2 == FIRST_CoS) {
	1035	res3->firstCoSIN += agCache.bytes;
	1036	} else if (agCache.dscp>>2 == SECOND_CoS) {
	1037	res3->secondCoSIN += agCache.bytes;
	1038	} else if (agCache.dscp>>2 == THIRD_CoS) {
	1039	res3->thirdCoSIN += agCache.bytes;
	1040	} else {
	1041	res3->fourthCoSIN += agCache.bytes;
	1042	}
[80]	1043	}
[145]	1044	if (res3->sampling == 0
[80]	1045	&& myPtrs->currentRouterPtr->sampled != 0){
	1046	res3->sampling = myPtrs->currentRouterPtr->sampled;
	1047	}
[83]	1048	#endif
[80]	1049	}
[60]	1050	#endif
[59]	1051	#if defined(MATRIX) && defined(IPV4AGGIDR)
[80]	1052	/ inter-pop matrix Accounting /
[122]	1053	/ prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD);/
	1054	prefixKey.beginning = agCache.v4AdD;
[145]	1055	res2 = bsearch(&prefixKey, V4PTab, nbPV4,
[80]	1056	sizeof(struct PrefixV4), prefGlobalCmp);
[121]	1057	if (res2!=NULL){
	1058	#if defined(MULTISAMPLING)
	1059	if (myPtrs->currentRouterPtr->sampled != res2->sampling ){
	1060	((struct POP *)((myPtrs->matrixPOP)
	1061	+((res->routerNb)*ROUTER_INDEX_MAX)
	1062	+((res2->routerNb))))->pktsNb += agCache.pkts*myPtrs->currentRouterPtr->sampled/res2->sampling;
	1063	((struct POP *)((myPtrs->matrixPOP)
	1064	+((res->routerNb)*ROUTER_INDEX_MAX)
	1065	+((res2->routerNb))))->bytesNb += agCache.bytes*myPtrs->currentRouterPtr->sampled/res2->sampling;
	1066	((struct POP *)((myPtrs->matrixPOP)
	1067	+((res->routerNb)*ROUTER_INDEX_MAX)
	1068	+((res2->routerNb))))->flowNb++;
	1069	} else {
	1070	((struct POP *)((myPtrs->matrixPOP)
	1071	+((res->routerNb)*ROUTER_INDEX_MAX)
	1072	+((res2->routerNb))))->pktsNb += agCache.pkts;
	1073	((struct POP *)((myPtrs->matrixPOP)
	1074	+((res->routerNb)*ROUTER_INDEX_MAX)
[145]	1075	+((res2->routerNb))))->bytesNb += agCache.bytes;
[121]	1076	((struct POP *)((myPtrs->matrixPOP)
	1077	+((res->routerNb)*ROUTER_INDEX_MAX)
	1078	+((res2->routerNb))))->flowNb++;
	1079	}
	1080	#else
[80]	1081	((struct POP *)((myPtrs->matrixPOP)
	1082	+((res->routerNb)*ROUTER_INDEX_MAX)
	1083	+((res2->routerNb))))->pktsNb += agCache.pkts;
	1084	((struct POP *)((myPtrs->matrixPOP)
	1085	+((res->routerNb)*ROUTER_INDEX_MAX)
[145]	1086	+((res2->routerNb))))->bytesNb += agCache.bytes;
[80]	1087	((struct POP *)((myPtrs->matrixPOP)
	1088	+((res->routerNb)*ROUTER_INDEX_MAX)
[145]	1089	+((res2->routerNb))))->flowNb++;
[121]	1090	#endif
[145]	1091	} else {
[121]	1092	/ here we'll make the choice that in multisampling mode,*
[124]	1093	* the virtual POP that represent the reste of world will be
	1094	* recorded in 1:10 packets mode */
[121]	1095	#if defined(MULTISAMPLING)
[80]	1096	(
	1097	((struct POP *)(myPtrs->matrixPOP)
	1098	+((res->routerNb)*ROUTER_INDEX_MAX)
[145]	1099	+((ROUTER_INDEX_MAX-1))))->pktsNb += agCache.pkts*myPtrs->currentRouterPtr->sampled/10;
[121]	1100	(
	1101	((struct POP *)(myPtrs->matrixPOP)
	1102	+((res->routerNb)*ROUTER_INDEX_MAX)
[145]	1103	+((ROUTER_INDEX_MAX-1))))->bytesNb += agCache.bytes*myPtrs->currentRouterPtr->sampled/10;
[121]	1104	(
	1105	((struct POP *)(myPtrs->matrixPOP)
	1106	+((res->routerNb)*ROUTER_INDEX_MAX)
	1107	+((ROUTER_INDEX_MAX-1))))->flowNb++;
	1108	#else
	1109	(
	1110	((struct POP *)(myPtrs->matrixPOP)
	1111	+((res->routerNb)*ROUTER_INDEX_MAX)
[145]	1112	+((ROUTER_INDEX_MAX-1))))->pktsNb += agCache.pkts;
[80]	1113	(
	1114	((struct POP *)(myPtrs->matrixPOP)
	1115	+((res->routerNb)*ROUTER_INDEX_MAX)
[145]	1116	+((ROUTER_INDEX_MAX-1))))->bytesNb += agCache.bytes;
[80]	1117	(
	1118	((struct POP *)(myPtrs->matrixPOP)
	1119	+((res->routerNb)*ROUTER_INDEX_MAX)
[121]	1120	+((ROUTER_INDEX_MAX-1))))->flowNb++;
[145]	1121	#endif
[80]	1122	}
	1123	/ end interpop matrix accounting /
[59]	1124	#endif / matrix /
[80]	1125	} else {
	1126	/ doublon or bad reference in prefix list /
	1127	#if defined(IPV4AGGIDR)
	1128	}
	1129	#elif defined(IPV4AGGIDSNMP)
	1130	}
	1131	#endif
[84]	1132	} else { / SOURCE ADDRESS DOESN'T IN OUR LIST /
[122]	1133	/ prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD); /
	1134	prefixKey.beginning = agCache.v4AdD;
[145]	1135	res = bsearch(&prefixKey, V4PTab, nbPV4,
[80]	1136	sizeof(struct PrefixV4), prefGlobalCmp);
	1137	if (res!=NULL){
[84]	1138	/ DESTINATION ADDRESS IS IN OUR LIST /
[80]	1139	if (res->hasSubnet == 1) {
	1140	resSub = NULL;
[145]	1141	resSub = bsearch(&prefixKey, V4STab, nbSV4,
[80]	1142	sizeof(struct PrefixV4), prefGlobalCmp);
	1143	if (resSub != NULL) {
	1144	res = resSub;
	1145	resSub = NULL;
	1146	}
	1147	}
[84]	1148	#ifdef DEBUG
[85]	1149	fprintf(stderr,"D %lu.%lu.%lu.%lu/%hu %lu.%lu.%lu.%lu/%hu Rs %lu Ps %lu R@ %lu.%lu.%lu.%lu SNMPin %hu\n",
[84]	1150	(agCache.v4AdS>>24),
[145]	1151	(agCache.v4AdS<<8>>24),
	1152	(agCache.v4AdS<<16>>24),
	1153	(agCache.v4AdS<<24>>24),
[84]	1154	(agCache.maskS),
[145]	1155	(agCache.v4AdD>>24),
	1156	(agCache.v4AdD<<8>>24),
	1157	(agCache.v4AdD<<16>>24),
	1158	(agCache.v4AdD<<24>>24),
[84]	1159	(agCache.maskD),
	1160	myPtrs->currentRouterPtr->sampled,
	1161	res->sampling,
[145]	1162	(myPtrs->pcktPtr->ipH->srcAdd>>24),
[84]	1163	(myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
	1164	(myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
[85]	1165	(myPtrs->pcktPtr->ipH->srcAdd<<24>>24),
	1166	agCache.inputSnmp);
[84]	1167	#endif
[80]	1168	#if defined(IPV4AGGIDSNMP)
	1169	if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) {
[84]	1170	#if defined(MULTISAMPLING)
	1171	if (myPtrs->currentRouterPtr->sampled != res->sampling ){
	1172	res->bytesNbIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1173	res->pktsNbIN += agCache.pkts*myPtrs->currentRouterPtr->sampled/res->sampling;
[93]	1174	if (agCache.dscp>>2 == FIRST_CoS) {
	1175	res->firstCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1176	} else if (agCache.dscp>>2 == SECOND_CoS) {
	1177	res->secondCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1178	} else if (agCache.dscp>>2 == THIRD_CoS) {
	1179	res->thirdCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1180	} else {
	1181	res->fourthCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1182	}
[84]	1183	}else{
	1184	res->bytesNbIN += agCache.bytes;
	1185	res->pktsNbIN += agCache.pkts;
	1186	(res->flowNbIN)++;
[93]	1187	if (agCache.dscp>>2 == FIRST_CoS) {
	1188	res->firstCoSIN += agCache.bytes;
	1189	} else if (agCache.dscp>>2 == SECOND_CoS) {
	1190	res->secondCoSIN += agCache.bytes;
	1191	} else if (agCache.dscp>>2 == THIRD_CoS) {
	1192	res->thirdCoSIN += agCache.bytes;
	1193	} else {
	1194	res->fourthCoSIN += agCache.bytes;
	1195	}
[84]	1196	}
	1197	#else
[80]	1198	if (myPtrs->currentRouterPtr->sampled != 0 ){
	1199	/ IN ("traffic to the prefix/subnet") /
	1200	res->bytesNbIN += agCache.bytes;
	1201	res->pktsNbIN += agCache.pkts;
	1202	(res->flowNbIN)++;
[93]	1203	if (agCache.dscp>>2 == FIRST_CoS) {
	1204	res->firstCoSIN += agCache.bytes;
	1205	} else if (agCache.dscp>>2 == SECOND_CoS) {
	1206	res->secondCoSIN += agCache.bytes;
	1207	} else if (agCache.dscp>>2 == THIRD_CoS) {
	1208	res->thirdCoSIN += agCache.bytes;
	1209	} else {
	1210	res->fourthCoSIN += agCache.bytes;
	1211	}
[80]	1212	}
[84]	1213	#endif
[80]	1214	}
	1215	#endif
[145]	1216	#if defined(IPV4AGGIDR)
[80]	1217	if ( myPtrs->routersID[res->routerNb] == agCache.routerAd ) {
[121]	1218	#if defined(MULTISAMPLING)
	1219	if (myPtrs->currentRouterPtr->sampled != res->sampling ){
	1220	res->bytesNbIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1221	res->pktsNbIN += agCache.pkts*myPtrs->currentRouterPtr->sampled/res->sampling;
	1222	if (agCache.dscp>>2 == FIRST_CoS) {
	1223	res->firstCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1224	} else if (agCache.dscp>>2 == SECOND_CoS) {
	1225	res->secondCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1226	} else if (agCache.dscp>>2 == THIRD_CoS) {
	1227	res->thirdCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1228	} else {
	1229	res->fourthCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1230	}
	1231	}else{
	1232	res->bytesNbIN += agCache.bytes;
	1233	res->pktsNbIN += agCache.pkts;
	1234	(res->flowNbIN)++;
	1235	if (agCache.dscp>>2 == FIRST_CoS) {
	1236	res->firstCoSIN += agCache.bytes;
	1237	} else if (agCache.dscp>>2 == SECOND_CoS) {
	1238	res->secondCoSIN += agCache.bytes;
	1239	} else if (agCache.dscp>>2 == THIRD_CoS) {
	1240	res->thirdCoSIN += agCache.bytes;
	1241	} else {
	1242	res->fourthCoSIN += agCache.bytes;
	1243	}
	1244	}
	1245	#else
[80]	1246	if (myPtrs->currentRouterPtr->sampled != 0 ){
	1247	/ IN ("traffic to the prefix") /
	1248	res->bytesNbIN += agCache.bytes;
	1249	res->pktsNbIN += agCache.pkts;
	1250	(res->flowNbIN)++;
[93]	1251	if (agCache.dscp>>2 == FIRST_CoS) {
	1252	res->firstCoSIN += agCache.bytes;
	1253	} else if (agCache.dscp>>2 == SECOND_CoS) {
	1254	res->secondCoSIN += agCache.bytes;
	1255	} else if (agCache.dscp>>2 == THIRD_CoS) {
	1256	res->thirdCoSIN += agCache.bytes;
	1257	} else {
	1258	res->fourthCoSIN += agCache.bytes;
	1259	}
[80]	1260	}
[121]	1261	#endif
[124]	1262	} else {
	1263	#if defined(MULTISAMPLING)
	1264	#if defined(MATRIX)
	1265	(
	1266	((struct POP *)(myPtrs->matrixPOP)
	1267	+((ROUTER_INDEX_MAX-1)*ROUTER_INDEX_MAX)
[145]	1268	+((res->routerNb))))->pktsNb += agCache.pkts*myPtrs->currentRouterPtr->sampled/10;
[124]	1269	(
	1270	((struct POP *)(myPtrs->matrixPOP)
	1271	+((ROUTER_INDEX_MAX-1)*ROUTER_INDEX_MAX)
[145]	1272	+((res->routerNb))))->bytesNb += agCache.bytes*myPtrs->currentRouterPtr->sampled/10;
[124]	1273	(
	1274	((struct POP *)(myPtrs->matrixPOP)
	1275	+((ROUTER_INDEX_MAX-1)*ROUTER_INDEX_MAX)
	1276	+((res->routerNb))))->flowNb++;
	1277	#endif
	1278	#else
	1279	#if defined(MATRIX)
	1280	(
	1281	((struct POP *)(myPtrs->matrixPOP)
	1282	+((ROUTER_INDEX_MAX-1)*ROUTER_INDEX_MAX)
[145]	1283	+((res->routerNb))))->pktsNb += agCache.pkts;
[124]	1284	(
	1285	((struct POP *)(myPtrs->matrixPOP)
	1286	+((ROUTER_INDEX_MAX-1)*ROUTER_INDEX_MAX)
[145]	1287	+((res->routerNb))))->bytesNb += agCache.bytes;
[124]	1288	(
	1289	((struct POP *)(myPtrs->matrixPOP)
	1290	+((ROUTER_INDEX_MAX-1)*ROUTER_INDEX_MAX)
	1291	+((res->routerNb))))->flowNb++;
	1292	#endif
[145]	1293	#endif
[80]	1294	}
[145]	1295	if (res->sampling == 0
[80]	1296	&& myPtrs->currentRouterPtr->sampled != 0 ){
	1297	res->sampling = myPtrs->currentRouterPtr->sampled;
	1298	}
[84]	1299	#endif
[145]	1300	} else { / UNKNOW SUBNET CASE /
[80]	1301	/ UNKNOW SUBNET CASE /
	1302	/ /
	1303	/ HERE : we are in the cases of the address/mask don't /
	1304	/ belong to a prefix listed in the IPv4 prefix file /
	1305	/ possibilities : /
	1306	/ - prefix not referenced but allowed to be routed /
	1307	/ - prefix not referenced but not allowed to be routed /
	1308	/ - spoofing /
[145]	1309	#ifdef PRINTUNKNOWNSUBNET
[80]	1310	fprintf(stderr, "%lu.%lu.%lu.%lu/%hu -> %lu.%lu.%lu.%lu/%hu (R:%lu.%lu.%lu.%lu) \n",
	1311	(agCache.v4AdS>>24),
[145]	1312	(agCache.v4AdS<<8>>24),
	1313	(agCache.v4AdS<<16>>24),
	1314	(agCache.v4AdS<<24>>24),
	1315	(agCache.maskS),
	1316	(agCache.v4AdD>>24),
	1317	(agCache.v4AdD<<8>>24),
	1318	(agCache.v4AdD<<16>>24),
	1319	(agCache.v4AdD<<24>>24),
	1320	(agCache.maskD),
	1321	(myPtrs->pcktPtr->ipH->srcAdd>>24),
[80]	1322	(myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
	1323	(myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
	1324	(myPtrs->pcktPtr->ipH->srcAdd<<24>>24)
	1325	);
[59]	1326	#endif / PRINTUNKNOWNSUBNET /
[80]	1327	}
	1328	} / end of the Destination prefix is in our list /
	1329	} / end of the prefix is in our list /
	1330	bool = 0;
[95]	1331	#endif / (IPV4AGGIDR) \|\| (IPV4AGGIDSNMP) /
[114]	1332	if ( ( isIPv6 == 1 ) && (isMplsFlow == 0) ){
[95]	1333	#ifdef IPV6LINKAGG
	1334	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1335	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1336	+(agCache.inputSnmp)))->routerIPAddress = myPtrs->currentRouterPtr->IpAddress;
[95]	1337	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1338	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
	1339	+(agCache.outputSnmp)))->routerIPAddress = myPtrs->currentRouterPtr->IpAddress;
	1340	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
	1341	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1342	+(agCache.inputSnmp)))->indexSNMP = agCache.inputSnmp;
	1343	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1344	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[145]	1345	+(agCache.outputSnmp)))->indexSNMP = agCache.outputSnmp;
[96]	1346	/ FIXME, error or warning if (indexSNMP != agCache.outputSnmp) /
	1347	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1348	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1349	+(agCache.inputSnmp)))->hasStats = 1;
	1350	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1351	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1352	+(agCache.outputSnmp)))->hasStats = 1;
	1353	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1354	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1355	+(agCache.inputSnmp)))->bytesNbIN += agCache.bytes;
	1356	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1357	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1358	+(agCache.outputSnmp)))->bytesNbOUT += agCache.bytes;
	1359	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1360	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1361	+(agCache.inputSnmp)))->pktsNbIN += agCache.pkts;
	1362	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1363	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1364	+(agCache.outputSnmp)))->pktsNbOUT += agCache.pkts;
	1365	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1366	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1367	+(agCache.inputSnmp)))->flowNbIN++;
	1368	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1369	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1370	+(agCache.outputSnmp)))->flowNbOUT++;
	1371	/ fprintf(stderr,"IPV6LINKAGG;IN;%hu;OUT;%hu;router;%lu;bytes;%lu\n", /
	1372	/ agCache.inputSnmp, /
	1373	/ agCache.outputSnmp, /
	1374	/ myPtrs->currentRouterPtr->IpAddress, /
	1375	/ agCache.bytes /
	1376	/ ); /
[114]	1377	#endif / IPV6LINKAGG /
	1378	/ Update the information db (aka RenetcolMIB) /
	1379	myPtrs->currentMIB->ipv6Bytes += agCache.bytes;
	1380	myPtrs->currentMIB->ipv6Pckts += agCache.pkts;
	1381	myPtrs->currentMIB->ipv6Flow += 1;
	1382	switch (agCache.tProt){
	1383	case 1:
	1384	myPtrs->currentMIB->ipv6IcmpFlowNb += 1;
	1385	myPtrs->currentMIB->ipv6IcmpBytesNb += agCache.bytes;
	1386	myPtrs->currentMIB->ipv6IcmpPktsNb += agCache.pkts;
	1387	break;
	1388	case 6:
	1389	myPtrs->currentMIB->ipv6TCPFlowNb += 1;
	1390	myPtrs->currentMIB->ipv6TCPBytesNb += agCache.bytes;
	1391	myPtrs->currentMIB->ipv6TCPPktsNb += agCache.pkts;
	1392	break;
	1393	case 17:
	1394	myPtrs->currentMIB->ipv6UDPFlowNb += 1;
	1395	myPtrs->currentMIB->ipv6UDPBytesNb += agCache.bytes;
	1396	myPtrs->currentMIB->ipv6UDPPktsNb += agCache.pkts;
	1397	break;
	1398	default:
	1399	myPtrs->currentMIB->ipv6OthersFlowNb += 1;
	1400	myPtrs->currentMIB->ipv6OthersBytesNb += agCache.bytes;
	1401	myPtrs->currentMIB->ipv6OthersPktsNb += agCache.pkts;
	1402	break;
	1403	}
	1404	if (agCache.pkts==1){
	1405	myPtrs->currentMIB->ipv6FlowSizePcktsE1 += 1;
	1406	} else if (agCache.pkts<10) {
	1407	myPtrs->currentMIB->ipv6FlowSizePcktsLT10 += 1;
	1408	} else if (agCache.pkts<100) {
	1409	myPtrs->currentMIB->ipv6FlowSizePcktsLT100 += 1;
	1410	} else if (agCache.pkts<1000) {
	1411	myPtrs->currentMIB->ipv6FlowSizePcktsLT1k += 1;
	1412	} else if (agCache.pkts<10000) {
	1413	myPtrs->currentMIB->ipv6FlowSizePcktsLT10k += 1;
	1414	} else if (agCache.pkts>=10000) {
	1415	myPtrs->currentMIB->ipv6FlowSizePcktsMT10k += 1;
	1416	}
	1417	if (agCache.bytes<50){
	1418	myPtrs->currentMIB->ipv6FlowSizeBytesLT50 += 1;
	1419	} else if (agCache.bytes<100) {
	1420	myPtrs->currentMIB->ipv6FlowSizeBytesLT100 += 1;
	1421	} else if (agCache.bytes<1000) {
	1422	myPtrs->currentMIB->ipv6FlowSizeBytesLT1k += 1;
	1423	} else if (agCache.bytes<10000) {
	1424	myPtrs->currentMIB->ipv6FlowSizeBytesLT10k += 1;
	1425	} else if (agCache.bytes<100000) {
	1426	myPtrs->currentMIB->ipv6FlowSizeBytesLT100k += 1;
	1427	} else if (agCache.bytes<1000000) {
	1428	myPtrs->currentMIB->ipv6FlowSizeBytesLT1M += 1;
	1429	} else if (agCache.bytes<10000000) {
	1430	myPtrs->currentMIB->ipv6FlowSizeBytesLT10M += 1;
	1431	} else if (agCache.bytes<100000000) {
	1432	myPtrs->currentMIB->ipv6FlowSizeBytesLT100M += 1;
	1433	} else if (agCache.bytes>=100000000) {
	1434	myPtrs->currentMIB->ipv6FlowSizeBytesMT100M += 1;
	1435	}
	1436	switch (agCache.dPort){
	1437	case 53:
	1438	myPtrs->currentMIB->ipv6DNSFlowNb += 1;
	1439	myPtrs->currentMIB->ipv6DNSBytesNb += agCache.bytes;
	1440	myPtrs->currentMIB->ipv6DNSPcktsNb += agCache.pkts;
	1441	break;
	1442	case 80:
	1443	myPtrs->currentMIB->ipv6WebFlowNb += 1;
	1444	myPtrs->currentMIB->ipv6WebBytesNb += agCache.bytes;
	1445	myPtrs->currentMIB->ipv6WebPcktsNb += agCache.pkts;
	1446	break;
	1447	default:
	1448	myPtrs->currentMIB->ipv6OthersApFlowNb += 1;
	1449	myPtrs->currentMIB->ipv6OthersApBytesNb += agCache.bytes;
	1450	myPtrs->currentMIB->ipv6OthersApPcktsNb += agCache.pkts;
	1451	break;
[145]	1452	}
[114]	1453	/ end of mib update /
	1454	isIPv6 = 0;
[95]	1455	}
[80]	1456	isMplsFlow = 0;
[144]	1457
	1458	/ DoS DETECTION /
[145]	1459	if ( dosCache.endTime-dosCache.startTime > 1000 ) {
	1460	if ( ( (dosCache.packets*dosCache.sampling)/((dosCache.endTime-dosCache.startTime)/1000) > MAX_PKTS_DOS )
	1461	&& ((dosCache.bytes)/(dosCache.packets) < RATIO_DOS ) ) {
	1462	jdos = 0;
[144]	1463	while ( ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+jdos))) != NULL ) {
[146]	1464	posdos = 69*MAX_RULES_PER_FIELD+jdos;
[145]	1465	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+posdos)))->check = 1;
	1466	jdos++;
	1467	}
	1468	}
	1469	} else { / flow duration <= 1000ms , we divide by 1 (sec) /
	1470	if ( ( (dosCache.packets*dosCache.sampling) > MAX_PKTS_DOS )
	1471	& ((dosCache.bytes)/(dosCache.packets) < RATIO_DOS ) ) {
	1472	jdos = 0;
	1473	while ( ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+jdos))) != NULL ) {
[146]	1474	posdos = 69*MAX_RULES_PER_FIELD+jdos;
[145]	1475	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+posdos)))->check = 1;
	1476	jdos++;
	1477	}
	1478	}
	1479	}
[144]	1480
[145]	1481	/*
[80]	1482	*
	1483	* SOCKET OUTPUT TO A REMOTE CLIENT
	1484	*
[145]	1485	* switch the rules definition (check & fieldToRecord),
[80]	1486	* we send the flow or a part of the flow to a remote host or a file.
	1487	* In a first time (until release 0.0.7, the information was sent via
	1488	* the process renetcolSender with an IPC message queue. But, the perf
	1489	* of IPC Msg was very bad with a default system compilation.
	1490	* So, now, we send information directly from here through sockets.
	1491	*/
	1492	tmpRuleList = myPtrs->rulesListPtr;
	1493	tmpRL = myPtrs->rulesListPtr;
	1494	while (tmpRuleList){
	1495	RuleDefPtr tmpRuleDefList = tmpRuleList->def;
	1496	unsigned short check = 1;
	1497	int s=0;
	1498	secondOffset = secondOldOffset;
	1499	while (tmpRuleDefList){
	1500	check = check && tmpRuleDefList->check;
	1501	tmpRuleDefList->check = 0;
	1502	tmpRuleDefList = tmpRuleDefList->next;
	1503	}
	1504	if ( (tmpRuleList->def != NULL) && (check == 1)) {
	1505	/ msg building /
	1506	secondPftmp = tmp->lastField;
[145]	1507	msgTextIndex = mempcpy(mempcpy(mempcpy(myMsg.text,
	1508	&tplMsgType,
	1509	sizeof(unsigned short)
[80]	1510	),
	1511	&tmpRuleList->id,
	1512	sizeof(tmpRuleList->id)
	1513	),
[145]	1514	&myPtrs->currentRouterPtr->IpAddress,
	1515	sizeof(unsigned long)
[80]	1516	);
[145]	1517	msgTextIndex = mempcpy(mempcpy(mempcpy(msgTextIndex,
	1518	&tmp->sourceId,
	1519	sizeof(unsigned long)
[144]	1520	),
	1521	&tmp->templateFlowSetId,
	1522	sizeof(tmp->templateFlowSetId)
	1523	),
	1524	myPtrs->ptr_buffer+secondOffset,
[80]	1525	flow_size
[145]	1526	);
[80]	1527	myMsg.type = 1;
[57]	1528
[145]	1529
[80]	1530	/ NEW transfert type /
	1531	for ( ; tmpRL; tmpRL=tmpRL->next){
[145]	1532	if (tmpRL->id == tmpRuleList->id){
[80]	1533	s = sendMessage(tmpRL->host->sockId, myMsg.text, sizeof(myMsg.text),
	1534	tmpRL->host->hostAddressPtr);
	1535	}
	1536	}
	1537	/ FIXME : perhaps check "s" /
	1538	noEnd = 1;
	1539	secondCpt=0;
	1540	} / end if check /
	1541	tmpRuleList = tmpRuleList->next;
	1542	tmpRL = myPtrs->rulesListPtr; / ticket #11 /
	1543	secondPftmp = tmp->lastField;
	1544	} / end while tmpRuleList /
[145]	1545	/*
	1546	* end redirection
[80]	1547	*/
	1548	secondOffset = *myPtrs->offsetV9Ptr;
	1549	secondOldOffset = secondOffset;
	1550	pftmp = tmp->lastField;
	1551	cpt=0;
	1552	(myPtrs->currentFlowsetNumberPtr)++; /* pointer on the flows number /
	1553	if (((*myPtrs->offsetV9Ptr)-48-shift+flow_size) > data_length){
	1554	overflow = 1; / buffer index not correct /
	1555	}
	1556	} else {
	1557	/ not the flow end, progress in field list /
	1558	pftmp = pftmp->prev;
[145]	1559	}
[80]	1560	} / end of the while on one flow record /
[145]	1561
[80]	1562	while ( ((*myPtrs->offsetV9Ptr)-48-shift) < data_length ) {
	1563	(myPtrs->offsetV9Ptr)++; /* if padding /
	1564	paddingCounter++;
[111]	1565	#ifdef DEBUG
[112]	1566	fprintf(stderr,", pC: %d ", paddingCounter);
	1567	#endif
[80]	1568	if ( paddingCounter > 8 ) {
	1569	syslog(LOG_INFO,"padding too high: %d ", paddingCounter);
[112]	1570	#ifdef DEBUG
[111]	1571	fprintf(stderr,", pC: %d <--\| ", paddingCounter);
[112]	1572	#endif
[80]	1573	return (-1);
	1574	}
	1575	}
[145]	1576	while ( (*myPtrs->offsetV9Ptr)-48-shift > data_length ) {
[80]	1577	(myPtrs->offsetV9Ptr)--; /* crazy loop (when bug appears in template def) /
	1578	crazyCounter++;
	1579	}
[30]	1580	#ifdef DEBUG
[80]	1581	if (crazyCounter != 0){ fprintf(stderr," crazyCounter: %d ", crazyCounter); }
[112]	1582	#endif
[80]	1583	if (crazyCounter!=0) { syslog(LOG_INFO,"crazyCounter: %d ", crazyCounter);}
[145]	1584
[112]	1585	#ifdef DEBUG
[111]	1586	fprintf(stderr,"(%hu,%hu)}", data_length, data_length+shift);
[29]	1587	#endif
[145]	1588
[80]	1589	return (data_length+shift);
	1590	/ end new place /
[30]	1591
[80]	1592	} else {
	1593	/*
	1594	*
	1595	*
	1596	* OPTIONAL TEMPLATE
	1597	*
	1598	*
	1599	*/
[145]	1600	if ((tmpOpt=existTplOptId(myPtrs->currentRouterPtr, myPtrs->currentHeaderV9Ptr->sourceId,
	1601	(*myPtrs->currentFlowsetIdPtr)))!=NULL) {
[113]	1602
	1603	myPtrs->currentMIB->optDataFlowSetNb += 1;
[30]	1604	#ifdef DEBUG
[80]	1605	fprintf(stderr,"<d id: %hu, lg %hu", (*myPtrs->currentFlowsetIdPtr), data_length);
[84]	1606	#endif
[80]	1607	for ( i=0; i<(tmpOpt->optionScopeLg/4); i++){
[145]	1608	/ FIXME : today we skip the scope fields, it's bad :( /
[80]	1609	if ((pftmp=tmpOpt->lastField)!=NULL) {
	1610	for (j=0; j<pftmp->fieldLength; j++) {
[145]	1611	(*myPtrs->offsetV9Ptr)++;
[80]	1612	}
	1613	pftmp = pftmp->prev;
	1614	}
	1615	}
	1616	while (pftmp != NULL) {
[145]	1617	if (pftmp->fieldLength==1){
[80]	1618	buffer1 = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	1619	}
[145]	1620	if (pftmp->fieldLength==2){
[80]	1621	buffer2[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	1622	buffer2[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	1623	}
[145]	1624	if (pftmp->fieldLength==4){
[80]	1625	buffer4[3]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	1626	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	1627	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	1628	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
[84]	1629	if (pftmp->fieldType==34\|\|pftmp->fieldType==50){
[145]	1630	if ((((unsigned* long*)&buffer4)==1)
[80]	1631	\|\| (((unsigned* long*)&buffer4)==10)
[119]	1632	\|\| (((unsigned* long*)&buffer4)==20)
[80]	1633	\|\| (((unsigned* long*)&buffer4)==100)
	1634	\|\| (((unsigned* long*)&buffer4)==1000)) {
	1635	if (myPtrs->currentRouterPtr->sampled != ((unsigned* long*)&buffer4) ) {
[30]	1636	#ifdef DEBUGAGG
[80]	1637	fprintf(stderr,"\n SV (p) %lu != %lu (r)", ((unsigned* long*)&buffer4),
	1638	myPtrs->currentRouterPtr->sampled);
[84]	1639	#endif
[80]	1640	syslog(LOG_INFO,"Sampling value change for router : %lu.%lu.%lu.%lu, old: %lu, new: %lu",
	1641	(myPtrs->pcktPtr->ipH->srcAdd>>24),
	1642	(myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
	1643	(myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
	1644	(myPtrs->pcktPtr->ipH->srcAdd<<24>>24),
	1645	myPtrs->currentRouterPtr->sampled,
	1646	((unsigned* long*)&buffer4)
	1647	);
	1648	myPtrs->currentRouterPtr->sampled = ((unsigned* long*)&buffer4);
	1649	}
	1650	}else{
	1651	syslog(LOG_INFO,"Sampling value not standard for router : %lu.%lu.%lu.%lu, value : %lu",
	1652	(myPtrs->pcktPtr->ipH->srcAdd>>24),
	1653	(myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
	1654	(myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
	1655	(myPtrs->pcktPtr->ipH->srcAdd<<24>>24),
	1656	((unsigned* long*)&buffer4)
	1657	);
	1658	}
	1659	}
[145]	1660	}
[80]	1661	pftmp = pftmp->prev;
	1662	}
	1663	if ( pftmp == NULL ) {
	1664	while ((*myPtrs->offsetV9Ptr)%4 != 0) {
	1665	(*myPtrs->offsetV9Ptr)++;
[30]	1666	#ifdef DEBUG
[80]	1667	fprintf(stderr," p ");
[30]	1668	#endif
[80]	1669	}
	1670	} else {
	1671	fprintf(stderr,"PB ");
	1672	}
[29]	1673	#ifdef DEBUG
[80]	1674	fprintf(stderr,">");
[29]	1675	#endif
[113]	1676	myPtrs->currentMIB->realFlowNb += 1;
[80]	1677	return (data_length+shift);
	1678	} else {
[145]	1679	/*
	1680	* template unknown, we skip the data
[80]	1681	*/
	1682	(*myPtrs->offsetV9Ptr)+=(data_length-4);
[111]	1683	(*myPtrs->currentFlowsetNumberPtr)+= 1 ;
	1684	/ (myPtrs->currentFlowsetNumberPtr) = myPtrs->currentHeaderV9Ptr->count;/*
[29]	1685	#ifdef DEBUG
[111]	1686	fprintf(stderr, " U, r: %lu.%lu.%lu.%lu, sourceId: %lu, TID: %hu ",
[80]	1687	(myPtrs->pcktPtr->ipH->srcAdd>>24),
	1688	(myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
	1689	(myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
	1690	(myPtrs->pcktPtr->ipH->srcAdd<<24>>24),
[145]	1691	myPtrs->currentHeaderV9Ptr->sourceId,
[80]	1692	(*myPtrs->currentFlowsetIdPtr)
	1693	);
[111]	1694	fprintf(stderr,"(%hu,%hu) ", data_length, data_length+shift);
[29]	1695	#endif
[80]	1696	return (data_length+shift);
	1697	}
	1698	}
	1699	}

Note: See TracBrowser for help on using the browser.

Context Navigation

root/trunk/src/dataFlowSet.c @ 146

Download in other formats: