Context Navigation

dataFlowSet.c @ 158

Revision 158, 60.0 KB (checked in by andreu, 11 years ago)
renetcol mib update
Property svn:eol-style set to `native`

Rev	Line
[2]	1	/*
	2	* File: dataFlowSet.c
	3	*
[145]	4	* Authors: ANDREU Francois-Xavier
	5	*
[154]	6	* Copyright (C) 2005-2011 GIP RENATER
[2]	7	*/
	8
[145]	9	/ This file is part of renetcol.*
[2]	10	*
	11	* renetcol is free software; you can redistribute it and/or modify
	12	* it under the terms of the GNU General Public License as published by
	13	* the Free Software Foundation; either version 2 of the License, or
	14	* (at your option) any later version.
	15	*
	16	* renetcol is distributed in the hope that it will be useful,
	17	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	18	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	19	* GNU General Public License for more details.
	20	*
	21	* You should have received a copy of the GNU General Public License
	22	* along with renetcol; if not, write to the Free Software
	23	* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
	24	*/
	25
	26	#include "dataFlowSet.h"
	27
	28	/*
[145]	29	* Check Data FlowSet
[2]	30	*
	31	*/
[145]	32	short
	33	checkDataFlowSet(short shift,
[80]	34	struct MyPtrs *myPtrs,
[145]	35	int myQueue,
	36	struct PrefixV4 *V4PTab,
[80]	37	size_t nbPV4,
	38	struct PrefixV4 *V4STab,
	39	size_t nbSV4
	40	)
[2]	41	{
[80]	42	TplFlowSetPtr tmp = NULL;
	43	TplOptionPtr tmpOpt = NULL;
	44	FieldPtr pftmp = NULL;
	45	FieldPtr secondPftmp = NULL;
	46	unsigned short data_length = 0;
	47	unsigned short flow_size = 0;
	48	unsigned short oldOffset = *myPtrs->offsetV9Ptr;
	49	unsigned short secondOffset = 0;
	50	unsigned short secondOldOffset = 0;
	51	int moreIsNecessary = 1;
	52	int field_size = 0;
	53	int cpt = 0;
	54	int secondCpt = 0;
	55	int overflow = 0;
	56	int noEnd = 1;
	57	int i = 0;
	58	int j = 0;
	59	int pos = 0;
[145]	60	int jdos = 0;
	61	int posdos = 0;
	62	unsigned char buffer1;
[80]	63	unsigned char buffer2[2];
	64	unsigned char buffer4[4];
	65	RulesPtr tmpRuleList = myPtrs->rulesListPtr;
	66	RulesPtr tmpRL = myPtrs->rulesListPtr;
	67	msgType myMsg;
	68	char *msgTextIndex;
[57]	69
[80]	70	unsigned short tplMsgType = 11;
	71	struct PrefixV4 prefixKey, res, res2, resSub; /* for bsearch /
[60]	72	#if defined(IPV4AGGIDSNMP)
[80]	73	struct PrefixV4 *res3;
[60]	74	#endif
	75	#ifdef ASACC
[80]	76	struct AS asKey, asres; /* for bsearch /
[60]	77	#endif
[80]	78	struct AggCache agCache;
[147]	79	struct DoSCache dosCache;
	80	dosCache.packets = 1;
	81	dosCache.bytes = 1;
	82	dosCache.endTime = 1;
	83	dosCache.startTime = 1;
	84	dosCache.sampling = myPtrs->currentRouterPtr->sampled;
[80]	85	int bool = 0; / in IPV4 Agg mode enabled, we need to now if it's an IPv4 /
[95]	86	int isIPv6 = 0;
[80]	87	/ flow, we test on the field and then put bool at 1 /
	88	int isMplsFlow = 0;
	89	int paddingCounter = 0;
	90	int crazyCounter = 0;
[111]	91	#ifdef DEBUG
	92	int flowCpt = 0;
	93	#endif
[27]	94
[80]	95	buffer2[1] = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
	96	(*myPtrs->offsetV9Ptr)++;
	97	buffer2[0] = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
	98	(*myPtrs->offsetV9Ptr)++;
	99	(myPtrs->currentFlowsetIdPtr) = ((unsigned short*)&buffer2);
	100	buffer2[1] = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
	101	(*myPtrs->offsetV9Ptr)++;
	102	buffer2[0] = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
	103	(*myPtrs->offsetV9Ptr)++;
	104	data_length = ((unsigned* short*)&buffer2);
	105	if (data_length == 0) {
[145]	106	#ifdef DEBUG
[111]	107	fprintf (stderr, " dlg==0 <--\| ");
	108	#endif
	109	/ syslog(LOG_INFO, "data flowset length null; all next informations of this data flowset are not considered! flowset ID: %hu, from router: %lu.%lu.%lu.%lu", /
	110	/ (myPtrs->currentFlowsetIdPtr), /*
	111	/ (myPtrs->pcktPtr->ipH->srcAdd>>24), /
	112	/ (myPtrs->pcktPtr->ipH->srcAdd<<8>>24), /
	113	/ (myPtrs->pcktPtr->ipH->srcAdd<<16>>24), /
	114	/ (myPtrs->pcktPtr->ipH->srcAdd<<24>>24)); /
[80]	115	return (-1);
[30]	116
[80]	117	}
[74]	118
[145]	119	if ( (tmp=existTplId(myPtrs->currentRouterPtr,
	120	myPtrs->currentHeaderV9Ptr->sourceId,
[80]	121	(*myPtrs->currentFlowsetIdPtr)))!=NULL ) {
[113]	122	myPtrs->currentMIB->dataFlowSetNb += 1;
[29]	123	#ifdef DEBUG
[80]	124	fprintf(stderr,
[145]	125	"{d id: %hu, lg %hu",
	126	(*myPtrs->currentFlowsetIdPtr),
[80]	127	data_length);
	128	if ( (*myPtrs->currentFlowsetIdPtr) > TRESHOLD_TEMPLATE_ID ) {
[111]	129	fprintf(stderr,"Bad TID from router: %lu.%lu.%lu.%lu\n",
	130	(*myPtrs->currentFlowsetIdPtr),
	131	(myPtrs->pcktPtr->ipH->srcAdd>>24),
	132	(myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
	133	(myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
	134	(myPtrs->pcktPtr->ipH->srcAdd<<24>>24));
	135	fprintf(stderr," Bytes : \n");
	136	while ( ( myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr) ) > (myPtrs->ptr_buffer+1416) ){
	137	buffer1= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));(*myPtrs->offsetV9Ptr)++;
	138	tmp = ((unsigned* char*)&buffer1);
	139	fprintf (stderr, " %s ", tmp);
	140	}
	141	exit(-1);
[80]	142	return (data_length+shift);
	143	}
[29]	144	#endif
[80]	145	pftmp = tmp->lastField;
	146	for (; pftmp; pftmp = pftmp->prev) {
	147	flow_size += pftmp->fieldLength;
	148	}
	149	if ( data_length%flow_size >= 9 ) {
	150	(*myPtrs->currentFlowsetNumberPtr) = myPtrs->currentHeaderV9Ptr->count;
[111]	151	syslog(LOG_INFO, "data flowset length not match with length from template definition, wrong template definition suspected; all next informations of this data flowset are not considered! sourceID: %lu flowset ID: %hu, from router: %lu.%lu.%lu.%lu",
	152	myPtrs->currentHeaderV9Ptr->sourceId,
[80]	153	(*myPtrs->currentFlowsetIdPtr),
	154	(myPtrs->pcktPtr->ipH->srcAdd>>24),
	155	(myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
	156	(myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
	157	(myPtrs->pcktPtr->ipH->srcAdd<<24>>24));
[145]	158	#ifdef DEBUG
[111]	159	fprintf (stderr, " dlg%flsz >=9 skip data ");
	160	#endif
[80]	161	return (data_length+shift);
	162	}
	163	if ( data_length >= 1452 ) {
	164	syslog(LOG_INFO, "data flowset length too raised; all next informations of this data flowset are not considered! flowset ID: %hu, from router: %lu.%lu.%lu.%lu",
	165	(*myPtrs->currentFlowsetIdPtr),
	166	(myPtrs->pcktPtr->ipH->srcAdd>>24),
	167	(myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
	168	(myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
	169	(myPtrs->pcktPtr->ipH->srcAdd<<24>>24));
[145]	170	#ifdef DEBUG
[111]	171	fprintf (stderr, " dlg >= 1452 skip pckt ");
	172	#endif
[80]	173	return (-1);
	174	}
[59]	175	#if defined(IPV4AGGIDR) \|\| defined(IPV4AGGIDSNMP)
[145]	176	agCache.routerAd = myPtrs->pcktPtr->ipH->srcAdd;
[22]	177	#endif
[18]	178
[80]	179	pftmp = tmp->lastField;
[145]	180	secondPftmp = tmp->lastField;
[80]	181	secondOffset = *myPtrs->offsetV9Ptr;
	182	secondOldOffset = secondOffset;
[145]	183	while ( (((*myPtrs->offsetV9Ptr)-48-shift) <= data_length)
	184	&& (overflow!=1) ) {
	185	/*
	186	* progression in a data flow Set
[80]	187	* notes:
	188	* 48= IP header size + NetFlow header size
	189	* shift = shift because we have a template declaration
	190	* inside data templates
	191	*/
	192	cpt++;
	193	j = 0;
	194	pos = (pftmp->fieldType)*MAX_RULES_PER_FIELD+j;
	195	field_size = (int) pftmp->fieldLength;
[76]	196
[80]	197	/ special case: check yes on all flows from one router /
	198	/ (phantom field nb 0) /
	199	/ FIXME : this code is repeated, perhaps past before /
	200	while ( ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+j))) != NULL ) {
	201	if ( (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+j)))->value->stor.lvalue)
	202	== myPtrs->pcktPtr->ipH->srcAdd )
	203	{
	204	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+j)))->check = 1;
[145]	205	}
[80]	206	j++;
[145]	207	}
[80]	208	j = 0;
[76]	209
[80]	210	/*
	211	* Comparaison between the field value and the rules
	212	* ... if one rule exist
	213	* FIXME : warning, if no rules, no accounting ?
	214	*/
	215	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos))) != NULL) {
	216	oldOffset = *myPtrs->offsetV9Ptr;
	217	while (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos))) != NULL){
[145]	218	/*
[80]	219	* while on one cache table line
	220	*/
	221	*myPtrs->offsetV9Ptr = oldOffset;
	222	switch ((int)
	223	(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->operator)){
	224	case 2:
[145]	225	/ operator: "=" /
[80]	226	switch (field_size) {
	227	case 1:
[145]	228	buffer1 = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	229	(*myPtrs->offsetV9Ptr)++;
	230	/ rule check /
[145]	231	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.cvalue
[80]	232	== ((unsigned* char*)&buffer1)) {
	233	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
	234	}
	235	/ end rule check /
[59]	236	#if defined(IPV4AGGIDR) \|\| defined(IPV4AGGIDSNMP)
[80]	237	if ((pftmp->fieldType==9)\|\|(pftmp->fieldType==29)){
	238	agCache.maskS = ((unsigned* char*)&buffer1);
	239	}
	240	if ((pftmp->fieldType==13)\|\|(pftmp->fieldType==30)){
	241	agCache.maskD = ((unsigned* char*)&buffer1);
	242	}
	243	if (pftmp->fieldType==60){
	244	agCache.ipProt = ((unsigned* char*)&buffer1);
	245	}
	246	if (pftmp->fieldType==4){
	247	agCache.tProt = ((unsigned* char*)&buffer1);
	248	}
	249	if (pftmp->fieldType==61){
	250	agCache.sens = ((unsigned* char*)&buffer1);
	251	}
	252	if (pftmp->fieldType==5){
	253	agCache.dscp = ((unsigned* char*)&buffer1);
	254	}
[145]	255	#endif
[80]	256	break;
	257	case 2:
[145]	258	buffer2[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	259	(*myPtrs->offsetV9Ptr)++;
[145]	260	buffer2[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	261	(*myPtrs->offsetV9Ptr)++;
[145]	262	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.svalue
[80]	263	== ((unsigned* short*)&buffer2))
	264	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
[114]	265	if (pftmp->fieldType==7){
	266	agCache.sPort = ((unsigned* short*)&buffer2);
[145]	267	}
[114]	268	if (pftmp->fieldType==11){
	269	agCache.dPort = ((unsigned* short*)&buffer2);
	270	}
[59]	271	#if defined(IPV4AGGIDR) \|\| defined(IPV4AGGIDSNMP)
[80]	272	if (pftmp->fieldType==10){
	273	agCache.inputSnmp = ((unsigned* short*)&buffer2);
	274	}
	275	if (pftmp->fieldType==14){
	276	agCache.outputSnmp = ((unsigned* short*)&buffer2);
	277	}
[22]	278	#endif
[60]	279	#ifdef ASACC
[80]	280	if (pftmp->fieldType==16){
	281	agCache.asS = ((unsigned* short*)&buffer2);
[145]	282	}
[80]	283	if (pftmp->fieldType==17){
	284	agCache.asD = ((unsigned* short*)&buffer2);
	285	}
[60]	286	#endif
[80]	287	break;
	288	case 3:
	289	buffer4[3]= 0;
[145]	290	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	291	(*myPtrs->offsetV9Ptr)++;
[145]	292	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	293	(*myPtrs->offsetV9Ptr)++;
[145]	294	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	295	(*myPtrs->offsetV9Ptr)++;
[145]	296	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue
[80]	297	== ((unsigned* long*)&buffer4))
	298	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
	299	/ aggregation /
	300	/ end aggregation /
	301	if (pftmp->fieldType==70){
	302	isMplsFlow = 1;
	303	}
	304	break;
	305	case 4:
[145]	306	buffer4[3]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	307	(*myPtrs->offsetV9Ptr)++;
[145]	308	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	309	(*myPtrs->offsetV9Ptr)++;
[145]	310	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	311	(*myPtrs->offsetV9Ptr)++;
[145]	312	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	313	(*myPtrs->offsetV9Ptr)++;
	314	/ FIXME : here , add a check on the field type /
	315	if ((pftmp->fieldType==8)\|\|(pftmp->fieldType==12)
	316	\|\|(pftmp->fieldType==15)\|\|(pftmp->fieldType==18)){
[145]	317	if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)
[80]	318	== (((unsigned* long)&buffer4))>>(32-((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->mask)<<(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) )
	319	{
	320	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
	321	}
	322	}
	323	if ((pftmp->fieldType==10)\|\|(pftmp->fieldType==14)){
[145]	324	if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.svalue)
[85]	325	== ((unsigned short)((unsigned* long*)&buffer4)))
[80]	326	{
	327	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
	328	}
	329	}
[86]	330	if ((pftmp->fieldType==16)\|\|(pftmp->fieldType==17)){
[145]	331	if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.svalue)
[86]	332	== ((unsigned short)((unsigned* long*)&buffer4)))
	333	{
	334	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
	335	}
	336	}
[80]	337	if (pftmp->fieldType==1){
	338	agCache.bytes = ((unsigned* long*)&buffer4);
	339	if (
[144]	340	((unsigned long)((((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) + ( (((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)/5))
[80]	341	>= (((unsigned* long*)&buffer4)))
	342	&&
[144]	343	( (unsigned long)((((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) - ( (((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)/5))
[80]	344	<= (((unsigned* long*)&buffer4)) )
	345	)
	346	{
	347	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
	348	}
[144]	349	}
[59]	350	#if defined(IPV4AGGIDR) \|\| defined(IPV4AGGIDSNMP)
[85]	351	if (pftmp->fieldType==10){
	352	agCache.inputSnmp = (unsigned short)((unsigned* long*)&buffer4);
	353	}
	354	if (pftmp->fieldType==14){
	355	agCache.outputSnmp = (unsigned short)((unsigned* long*)&buffer4);
[145]	356	}
[80]	357	if ((pftmp->fieldType==8)){
	358	bool = 1; / very important, test if we have an IPv4 flow for Agg /
	359	agCache.v4AdS = ((unsigned* long*)&buffer4);
	360	}
	361	if ((pftmp->fieldType==12)){
	362	agCache.v4AdD = ((unsigned* long*)&buffer4);
	363	}
	364	if (pftmp->fieldType==1){
	365	agCache.bytes = ((unsigned* long*)&buffer4);
	366	}
	367	if (pftmp->fieldType==2){
	368	agCache.pkts = ((unsigned* long*)&buffer4);
	369	}
[22]	370	#endif
[86]	371	#ifdef ASACC
	372	if (pftmp->fieldType==16){
	373	agCache.asS = (unsigned short)((unsigned* long*)&buffer4);
[145]	374	}
[86]	375	if (pftmp->fieldType==17){
	376	agCache.asD = (unsigned short)((unsigned* long*)&buffer4);
	377	}
	378	#endif
[144]	379	if (pftmp->fieldType==1){
	380	dosCache.bytes = ((unsigned* long*)&buffer4);
[145]	381	dosCache.sampling = myPtrs->currentRouterPtr->sampled;
[144]	382	}
	383	if (pftmp->fieldType==2){
[145]	384	dosCache.packets = ((unsigned* long*)&buffer4);
	385	}
	386	if (pftmp->fieldType==21){
	387	dosCache.endTime = ((unsigned* long*)&buffer4);
	388	}
	389	if (pftmp->fieldType==22){
	390	dosCache.startTime = ((unsigned* long*)&buffer4);
	391	}
[80]	392	break;
	393	case 16:
[95]	394	if ((pftmp->fieldType==27)\|\|(pftmp->fieldType==28)){
	395	isIPv6 = 1;
	396	for (i=0; i<4; i++) {
[145]	397	buffer4[3]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[95]	398	(*myPtrs->offsetV9Ptr)++;
[145]	399	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[95]	400	(*myPtrs->offsetV9Ptr)++;
[145]	401	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[95]	402	(*myPtrs->offsetV9Ptr)++;
[145]	403	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[95]	404	(*myPtrs->offsetV9Ptr)++;
	405	if (1==moreIsNecessary){
	406	switch(i){
	407	case 0:
	408	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 32){
[145]	409	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
	410	==
[95]	411	(((unsigned* long)&buffer4))>>(32-((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->mask)<<(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)
	412	)
	413	{
	414	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
	415	moreIsNecessary = 0;
	416	} else {
	417	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
[80]	418	moreIsNecessary = 0;
[95]	419	}
	420	} else {
[145]	421	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
	422	==
[95]	423	(((unsigned* long*)&buffer4))
	424	)
	425	{
	426	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
	427	} else {
	428	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
	429	moreIsNecessary = 0;
	430	}
[80]	431	}
[95]	432	break;
	433	case 1:
	434	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 64){
[145]	435	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
	436	==
[95]	437	(((unsigned* long)&buffer4))>>(64-((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->mask)<<(64-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)
	438	)
	439	{
	440	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
	441	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
	442	moreIsNecessary = 0;
	443	} else {
	444	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
[80]	445	moreIsNecessary = 0;
[95]	446	}
	447	} else {
[145]	448	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
	449	==
[95]	450	(((unsigned* long*)&buffer4))
	451	)
	452	{
[145]	453	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
[95]	454	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
	455	} else {
	456	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
	457	moreIsNecessary = 0;
	458	}
[80]	459	}
[95]	460	break;
	461	case 2:
	462	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 96){
[145]	463	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
	464	==
[95]	465	(((unsigned* long)&buffer4))>>(96-((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->mask)<<(96-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)
	466	)
	467	{
	468	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
	469	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
	470	moreIsNecessary = 0;
	471	} else {
	472	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
[80]	473	moreIsNecessary = 0;
[95]	474	}
	475	} else {
[145]	476	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
	477	==
[95]	478	(((unsigned* long*)&buffer4))
	479	)
	480	{
[145]	481	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
[95]	482	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
	483	} else {
	484	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
	485	moreIsNecessary = 0;
	486	}
[80]	487	}
[95]	488	break;
	489	case 3:
	490	if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 128){
[145]	491	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
	492	==
[95]	493	(((unsigned* long)&buffer4))>>(128-((RuleDefPtr)((myPtrs->rulesAddressPtr+pos)))->value->mask)<<(128-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)
	494	)
	495	{
	496	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
	497	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
	498	} else {
	499	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
[80]	500	moreIsNecessary = 0;
[95]	501	}
	502	} else {
[145]	503	if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
	504	==
[95]	505	(((unsigned* long*)&buffer4))
	506	)
	507	{
[145]	508	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
[95]	509	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
	510	} else {
	511	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 0;
	512	moreIsNecessary = 0;
	513	}
[80]	514	}
[95]	515	break;
	516	default:
	517	break;
	518	} / end of switch(i) /
	519	} / end of if moreIsNecessary /
	520	#if defined IPV6AGGIDSNMP
	521	if ((pftmp->fieldType==27)){
	522	agCache.tabAdd6S[i] = ((unsigned* long*)&buffer4);
	523	} else if ((pftmp->fieldType==28)){
	524	agCache.tabAdd6D[i] = ((unsigned* long*)&buffer4);
	525	}
	526	#endif
	527	}
	528	moreIsNecessary = 1;
	529	/ aggregation for IPv6 flows /
[145]	530
[95]	531	/ end aggregation /
	532	} / end of : if ((pftmp->fieldType==27)\|\|(pftmp->fieldType==28)){ /
[80]	533	break;
	534	default:
[145]	535	syslog(LOG_INFO, "Field size not known: %d\n", field_size);
[80]	536	for (i=0; i<field_size; i++){
	537	(*myPtrs->offsetV9Ptr)++;
	538	}
	539	break;
	540	}
	541	break;
	542	default:
	543	syslog(LOG_INFO, "Operator not known: %d\n",
	544	(int)(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->operator));
	545	break;
	546	}
	547	j++;
[94]	548	pos = (pftmp->fieldType)*MAX_RULES_PER_FIELD+j;
[80]	549	} / end while myPtrs->rulesAddressPtr /
	550	} else {
[145]	551	/*
	552	* no rule within this field type, but we must read the value
[80]	553	*/
	554	switch (field_size) {
	555	case 1:
[145]	556	buffer1 = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	557	(*myPtrs->offsetV9Ptr)++;
[59]	558	#if defined(IPV4AGGIDR) \|\| defined(IPV4AGGIDSNMP)
[80]	559	if ((pftmp->fieldType==9)\|\|(pftmp->fieldType==29)){
	560	agCache.maskS = ((unsigned* char*)&buffer1);
	561	}
	562	if ((pftmp->fieldType==13)\|\|(pftmp->fieldType==30)){
	563	agCache.maskD = ((unsigned* char*)&buffer1);
	564	}
	565	if (pftmp->fieldType==60){
	566	agCache.ipProt = ((unsigned* char*)&buffer1);
	567	}
	568	if (pftmp->fieldType==4){
	569	agCache.tProt = ((unsigned* char*)&buffer1);
	570	}
	571	if (pftmp->fieldType==61){
	572	agCache.sens = ((unsigned* char*)&buffer1);
	573	}
	574	if (pftmp->fieldType==5){
	575	agCache.dscp = ((unsigned* char*)&buffer1);
[145]	576	}
[22]	577	#endif
[80]	578	break;
	579	case 2:
[145]	580	buffer2[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	581	(*myPtrs->offsetV9Ptr)++;
[145]	582	buffer2[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	583	(*myPtrs->offsetV9Ptr)++;
[114]	584	if (pftmp->fieldType==7){
	585	agCache.sPort = ((unsigned* short*)&buffer2);
[145]	586	}
[114]	587	if (pftmp->fieldType==11){
	588	agCache.dPort = ((unsigned* short*)&buffer2);
	589	}
[59]	590	#if defined(IPV4AGGIDR) \|\| defined(IPV4AGGIDSNMP)
[80]	591	if (pftmp->fieldType==10){
	592	agCache.inputSnmp = ((unsigned* short*)&buffer2);
[145]	593	}
[80]	594	if (pftmp->fieldType==14){
	595	agCache.outputSnmp = ((unsigned* short*)&buffer2);
[145]	596	}
[22]	597	#endif
[60]	598	#ifdef ASACC
[80]	599	if (pftmp->fieldType==16){
	600	agCache.asS = ((unsigned* short*)&buffer2);
[145]	601	}
[80]	602	if (pftmp->fieldType==17){
	603	agCache.asD = ((unsigned* short*)&buffer2);
	604	}
[60]	605	#endif
[80]	606	break;
	607	case 3:
	608	buffer4[3]= 0;
[145]	609	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	610	(*myPtrs->offsetV9Ptr)++;
[145]	611	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	612	(*myPtrs->offsetV9Ptr)++;
[145]	613	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	614	(*myPtrs->offsetV9Ptr)++;
	615	/ aggregation /
	616	/ end aggregation /
	617	if (pftmp->fieldType==70){
	618	isMplsFlow = 1;
	619	}
	620	break;
	621	case 4:
[145]	622	buffer4[3]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	623	(*myPtrs->offsetV9Ptr)++;
[145]	624	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	625	(*myPtrs->offsetV9Ptr)++;
[145]	626	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	627	(*myPtrs->offsetV9Ptr)++;
[145]	628	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	629	(*myPtrs->offsetV9Ptr)++;
[59]	630	#if defined(IPV4AGGIDR) \|\| defined(IPV4AGGIDSNMP)
[85]	631	if (pftmp->fieldType==10){
	632	agCache.inputSnmp = (unsigned short)((unsigned* long*)&buffer4);
	633	}
	634	if (pftmp->fieldType==14){
	635	agCache.outputSnmp = (unsigned short)((unsigned* long*)&buffer4);
[145]	636	}
[80]	637	if ((pftmp->fieldType==8)){
	638	bool = 1;
	639	agCache.v4AdS = ((unsigned* long*)&buffer4);
	640	} else if ((pftmp->fieldType==12)){
	641	agCache.v4AdD = ((unsigned* long*)&buffer4);
	642	} else if (pftmp->fieldType==1){
	643	agCache.bytes = ((unsigned* long*)&buffer4);
	644	} else if (pftmp->fieldType==2){
	645	agCache.pkts = ((unsigned* long*)&buffer4);
	646	}
[22]	647	#endif
[86]	648	#ifdef ASACC
	649	if (pftmp->fieldType==16){
	650	agCache.asS = (unsigned short)((unsigned* long*)&buffer4);
[145]	651	}
[86]	652	if (pftmp->fieldType==17){
	653	agCache.asD = (unsigned short)((unsigned* long*)&buffer4);
	654	}
	655	#endif
[144]	656	if (pftmp->fieldType==1){
	657	dosCache.bytes = ((unsigned* long*)&buffer4);
[145]	658	dosCache.sampling = myPtrs->currentRouterPtr->sampled;
	659	}
[144]	660	if (pftmp->fieldType==2){
[145]	661	dosCache.packets = ((unsigned* long*)&buffer4);
[144]	662	}
[145]	663	if (pftmp->fieldType==21){
	664	dosCache.endTime = ((unsigned* long*)&buffer4);
	665	}
	666	if (pftmp->fieldType==22){
	667	dosCache.startTime = ((unsigned* long*)&buffer4);
	668	}
[80]	669	break;
	670	case 16:
[95]	671	if ((pftmp->fieldType==27)\|\|(pftmp->fieldType==28)){
	672	isIPv6 = 1;
	673	}
[80]	674	for (i=0; i<4; i++) {
[145]	675	buffer4[3]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	676	(*myPtrs->offsetV9Ptr)++;
[145]	677	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	678	(*myPtrs->offsetV9Ptr)++;
[145]	679	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	680	(*myPtrs->offsetV9Ptr)++;
[145]	681	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr));
[80]	682	(*myPtrs->offsetV9Ptr)++;
[95]	683	#if defined IPV6AGGIDSNMP
	684	if ((pftmp->fieldType==27)){
	685	agCache.tabAdd6S[i] = ((unsigned* long*)&buffer4);
	686	} else if ((pftmp->fieldType==28)){
	687	agCache.tabAdd6D[i] = ((unsigned* long*)&buffer4);
	688	}
	689	#endif
[80]	690	}
	691	break;
	692	default:
	693	syslog(LOG_INFO,"UNKNOWN FIELDS LENGTH: %d ", field_size);
	694	for (i=0; i<field_size; i++){
	695	(*myPtrs->offsetV9Ptr)++;
	696	}
	697	}
	698	} / end if one cache table line existence /
	699	if (cpt==tmp->fieldCount) {
[145]	700	/*
	701	* end of one flow (not the flowset)
[80]	702	*/
[113]	703	myPtrs->currentMIB->realFlowNb += 1;
[111]	704	#ifdef DEBUG
	705	flowCpt++;
	706	fprintf(stderr," F%d ", flowCpt);
[145]	707	#endif
[80]	708	/ put aggregation cache information to IPv4 Prefixes table /
	709	/ Aggregation mode must be enable in ./configure options /
	710	/ first we must know if the address belong to our prefix /
	711	/*
	712	* AS ACCOUNTING
	713	*/
[60]	714	#if defined(ASACC) && defined(IPV4AGGIDSNMP)
[80]	715	if ( (bool == 1) && (isMplsFlow == 0) ){
	716	asKey.as = agCache.asS;
	717	asres = bsearch(&asKey, myPtrs->currentASTab, myPtrs->asNb, sizeof(struct AS), asGlobalCmp);
	718	if (asres != NULL) {
[86]	719	if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) {
	720	#if defined(MULTISAMPLING)
	721	if (myPtrs->currentRouterPtr->sampled != asres->sampling ){
	722	/ OUT ("traffic from the AS") /
	723	asres->bytesNbOUT += agCache.bytes*myPtrs->currentRouterPtr->sampled/asres->sampling;
	724	asres->pktsNbOUT += agCache.pkts*myPtrs->currentRouterPtr->sampled/asres->sampling;
	725	}else{
	726	asres->bytesNbOUT += agCache.bytes;
	727	asres->pktsNbOUT += agCache.pkts;
	728	(asres->flowNbOUT)++;
	729	}
	730	#else
[80]	731	if (myPtrs->currentRouterPtr->sampled != 0 ){
	732	/ OUT ("traffic from the AS") /
	733	asres->bytesNbOUT += agCache.bytes;
	734	asres->pktsNbOUT += agCache.pkts;
	735	(asres->flowNbOUT)++;
	736	}
[145]	737	if (asres->sampling == 0
[80]	738	&& myPtrs->currentRouterPtr->sampled != 0){
	739	asres->sampling = myPtrs->currentRouterPtr->sampled;
	740	}
[86]	741	#endif
[80]	742	asres = NULL;
	743	asKey.as = agCache.asD;
	744	asres = bsearch(&asKey, myPtrs->currentASTab, myPtrs->asNb, sizeof(struct AS), asGlobalCmp);
	745	if (asres!=NULL){
[86]	746	#if defined(MULTISAMPLING)
	747	if (myPtrs->currentRouterPtr->sampled != asres->sampling ){
	748	/ IN ("traffic to the AS") /
	749	asres->bytesNbIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/asres->sampling;
	750	asres->pktsNbIN += agCache.pkts*myPtrs->currentRouterPtr->sampled/asres->sampling;
	751	}else{
	752	asres->bytesNbIN += agCache.bytes;
	753	asres->pktsNbIN += agCache.pkts;
	754	(asres->flowNbIN)++;
	755	}
	756	#else
[80]	757	if (myPtrs->currentRouterPtr->sampled != 0 ){
	758	/ IN ("traffic to the AS") /
	759	asres->bytesNbIN += agCache.bytes;
	760	asres->pktsNbIN += agCache.pkts;
	761	(asres->flowNbIN)++;
	762	}
[145]	763	if (asres->sampling == 0
[80]	764	&& myPtrs->currentRouterPtr->sampled != 0){
	765	asres->sampling = myPtrs->currentRouterPtr->sampled;
	766	}
[86]	767	#endif
[80]	768	asres = NULL;
	769	}
	770	}
	771	} else {
	772	asres = NULL;
	773	asKey.as = agCache.asD;
	774	asres = bsearch(&asKey, myPtrs->currentASTab, myPtrs->asNb, sizeof(struct AS), asGlobalCmp);
	775	if (asres!=NULL){
	776	if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) {
[86]	777	#if defined(MULTISAMPLING)
	778	if (myPtrs->currentRouterPtr->sampled != asres->sampling ){
	779	/ IN ("traffic to the AS") /
	780	asres->bytesNbIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/asres->sampling;
	781	asres->pktsNbIN += agCache.pkts*myPtrs->currentRouterPtr->sampled/asres->sampling;
	782	}else{
	783	asres->bytesNbIN += agCache.bytes;
	784	asres->pktsNbIN += agCache.pkts;
	785	(asres->flowNbIN)++;
	786	}
	787	#else
[80]	788	if (myPtrs->currentRouterPtr->sampled != 0 ){
	789	/ IN ("traffic to the AS") /
	790	asres->bytesNbIN += agCache.bytes;
	791	asres->pktsNbIN += agCache.pkts;
	792	(asres->flowNbIN)++;
	793	}
[145]	794	if (asres->sampling == 0
[80]	795	&& myPtrs->currentRouterPtr->sampled != 0){
	796	asres->sampling = myPtrs->currentRouterPtr->sampled;
	797	}
[86]	798	#endif
[80]	799	}
	800	}
	801	}
	802	}
[60]	803	#endif
[114]	804	if ( (bool == 1) && (isMplsFlow == 0) ){
	805	/ Update the information db (aka RenetcolMIB) /
	806	myPtrs->currentMIB->ipv4Bytes += agCache.bytes;
	807	myPtrs->currentMIB->ipv4Pckts += agCache.pkts;
	808	myPtrs->currentMIB->ipv4Flow += 1;
	809	switch (agCache.tProt){
	810	case 1:
	811	myPtrs->currentMIB->ipv4IcmpFlowNb += 1;
	812	myPtrs->currentMIB->ipv4IcmpBytesNb += agCache.bytes;
	813	myPtrs->currentMIB->ipv4IcmpPktsNb += agCache.pkts;
	814	break;
	815	case 6:
	816	myPtrs->currentMIB->ipv4TCPFlowNb += 1;
	817	myPtrs->currentMIB->ipv4TCPBytesNb += agCache.bytes;
	818	myPtrs->currentMIB->ipv4TCPPktsNb += agCache.pkts;
	819	break;
	820	case 17:
	821	myPtrs->currentMIB->ipv4UDPFlowNb += 1;
	822	myPtrs->currentMIB->ipv4UDPBytesNb += agCache.bytes;
	823	myPtrs->currentMIB->ipv4UDPPktsNb += agCache.pkts;
	824	break;
	825	default:
	826	myPtrs->currentMIB->ipv4OthersFlowNb += 1;
	827	myPtrs->currentMIB->ipv4OthersBytesNb += agCache.bytes;
	828	myPtrs->currentMIB->ipv4OthersPktsNb += agCache.pkts;
	829	break;
	830	}
	831	if (agCache.pkts==1){
	832	myPtrs->currentMIB->ipv4FlowSizePcktsE1 += 1;
	833	} else if (agCache.pkts<10) {
	834	myPtrs->currentMIB->ipv4FlowSizePcktsLT10 += 1;
	835	} else if (agCache.pkts<100) {
	836	myPtrs->currentMIB->ipv4FlowSizePcktsLT100 += 1;
	837	} else if (agCache.pkts<1000) {
	838	myPtrs->currentMIB->ipv4FlowSizePcktsLT1k += 1;
	839	} else if (agCache.pkts<10000) {
	840	myPtrs->currentMIB->ipv4FlowSizePcktsLT10k += 1;
	841	} else if (agCache.pkts>=10000) {
	842	myPtrs->currentMIB->ipv4FlowSizePcktsMT10k += 1;
	843	}
	844	if (agCache.bytes<50){
	845	myPtrs->currentMIB->ipv4FlowSizeBytesLT50 += 1;
	846	} else if (agCache.bytes<100) {
	847	myPtrs->currentMIB->ipv4FlowSizeBytesLT100 += 1;
	848	} else if (agCache.bytes<1000) {
	849	myPtrs->currentMIB->ipv4FlowSizeBytesLT1k += 1;
	850	} else if (agCache.bytes<10000) {
	851	myPtrs->currentMIB->ipv4FlowSizeBytesLT10k += 1;
	852	} else if (agCache.bytes<100000) {
	853	myPtrs->currentMIB->ipv4FlowSizeBytesLT100k += 1;
	854	} else if (agCache.bytes<1000000) {
	855	myPtrs->currentMIB->ipv4FlowSizeBytesLT1M += 1;
	856	} else if (agCache.bytes<10000000) {
	857	myPtrs->currentMIB->ipv4FlowSizeBytesLT10M += 1;
	858	} else if (agCache.bytes<100000000) {
	859	myPtrs->currentMIB->ipv4FlowSizeBytesLT100M += 1;
	860	} else if (agCache.bytes>=100000000) {
	861	myPtrs->currentMIB->ipv4FlowSizeBytesMT100M += 1;
	862	}
	863	switch (agCache.dPort){
[158]	864	case 25:
	865	myPtrs->currentMIB->ipv4MailFlowNb += 1;
	866	myPtrs->currentMIB->ipv4MailBytesNb += agCache.bytes;
	867	myPtrs->currentMIB->ipv4MailPcktsNb += agCache.pkts;
	868	break;
[114]	869	case 53:
	870	myPtrs->currentMIB->ipv4DNSFlowNb += 1;
	871	myPtrs->currentMIB->ipv4DNSBytesNb += agCache.bytes;
	872	myPtrs->currentMIB->ipv4DNSPcktsNb += agCache.pkts;
	873	break;
	874	case 80:
	875	myPtrs->currentMIB->ipv4WebFlowNb += 1;
	876	myPtrs->currentMIB->ipv4WebBytesNb += agCache.bytes;
	877	myPtrs->currentMIB->ipv4WebPcktsNb += agCache.pkts;
	878	break;
	879	default:
	880	myPtrs->currentMIB->ipv4OthersApFlowNb += 1;
	881	myPtrs->currentMIB->ipv4OthersApBytesNb += agCache.bytes;
	882	myPtrs->currentMIB->ipv4OthersApPcktsNb += agCache.pkts;
	883	break;
[145]	884	}
[114]	885	/ end of mib update /
	886	}
[80]	887	/*
	888	* PREFIX &/or MATRIX ACCOUNTING
	889	*/
[59]	890	#if defined(IPV4AGGIDR) \|\| defined(IPV4AGGIDSNMP)
[80]	891	if ( (bool == 1) && (isMplsFlow == 0) ){
[122]	892	/ prefixKey.beginning = agCache.v4AdS>>(32-agCache.maskS)<<(32-agCache.maskS); /
	893	prefixKey.beginning = agCache.v4AdS;
[145]	894	res = bsearch(&prefixKey, V4PTab, nbPV4,
[80]	895	sizeof(struct PrefixV4), prefGlobalCmp);
	896	if (res!=NULL){
[84]	897	/ WE HAVE FOUND SOURCE ADDRESS IN OUR LIST /
[80]	898	if (res->hasSubnet == 1) {
	899	resSub = NULL;
[145]	900	resSub = bsearch(&prefixKey, V4STab, nbSV4,
[80]	901	sizeof(struct PrefixV4), prefGlobalCmp);
	902	if (resSub != NULL) {
	903	res = resSub;
	904	resSub = NULL;
[145]	905	}
[80]	906	}
[84]	907	#ifdef DEBUG
[85]	908	fprintf(stderr,"S %lu.%lu.%lu.%lu/%hu %lu.%lu.%lu.%lu/%hu Rs %lu Ps %lu SNMPin(hu) %hu\n",
[84]	909	(agCache.v4AdS>>24),
[145]	910	(agCache.v4AdS<<8>>24),
	911	(agCache.v4AdS<<16>>24),
	912	(agCache.v4AdS<<24>>24),
[84]	913	(agCache.maskS),
[145]	914	(agCache.v4AdD>>24),
	915	(agCache.v4AdD<<8>>24),
	916	(agCache.v4AdD<<16>>24),
	917	(agCache.v4AdD<<24>>24),
[84]	918	(agCache.maskD),
	919	myPtrs->currentRouterPtr->sampled,
[85]	920	res->sampling,
	921	agCache.inputSnmp);
[84]	922	#endif
[59]	923	#if defined(IPV4AGGIDR)
[145]	924	if ( myPtrs->routersID[res->routerNb] == agCache.routerAd ) {
[59]	925	#elif defined(IPV4AGGIDSNMP)
[145]	926	if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) {
[59]	927	#endif
[83]	928	/ OUT ("traffic from the prefix/subnet") /
	929	#if defined(MULTISAMPLING)
	930	if (myPtrs->currentRouterPtr->sampled != res->sampling ){
	931	res->bytesNbOUT += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	932	res->pktsNbOUT += agCache.pkts*myPtrs->currentRouterPtr->sampled/res->sampling;
	933	/ (res->flowNbOUT)++; FIXME : FIND SOMETHING/
[93]	934	if (agCache.dscp>>2 == FIRST_CoS) {
	935	res->firstCoSOUT += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	936	} else if (agCache.dscp>>2 == SECOND_CoS) {
	937	res->secondCoSOUT += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	938	} else if (agCache.dscp>>2 == THIRD_CoS) {
	939	res->thirdCoSOUT += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	940	} else {
	941	res->fourthCoSOUT += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	942	}
[83]	943	}else{
	944	res->bytesNbOUT += agCache.bytes;
	945	res->pktsNbOUT += agCache.pkts;
[93]	946	(res->flowNbOUT)++;
	947	if (agCache.dscp>>2 == FIRST_CoS) {
	948	res->firstCoSOUT += agCache.bytes;
	949	} else if (agCache.dscp>>2 == SECOND_CoS) {
	950	res->secondCoSOUT += agCache.bytes;
	951	} else if (agCache.dscp>>2 == THIRD_CoS) {
	952	res->thirdCoSOUT += agCache.bytes;
	953	} else {
	954	res->fourthCoSOUT += agCache.bytes;
	955	}
[83]	956	}
	957	#else
[80]	958	if (myPtrs->currentRouterPtr->sampled != 0 ){
	959	res->bytesNbOUT += agCache.bytes;
	960	res->pktsNbOUT += agCache.pkts;
	961	(res->flowNbOUT)++;
[93]	962	if (agCache.dscp>>2 == FIRST_CoS) {
	963	res->firstCoSOUT += agCache.bytes;
	964	} else if (agCache.dscp>>2 == SECOND_CoS) {
	965	res->secondCoSOUT += agCache.bytes;
	966	} else if (agCache.dscp>>2 == THIRD_CoS) {
	967	res->thirdCoSOUT += agCache.bytes;
	968	} else {
	969	res->fourthCoSOUT += agCache.bytes;
	970	}
[80]	971	}
[145]	972	if (res->sampling == 0
[80]	973	&& myPtrs->currentRouterPtr->sampled != 0){
	974	res->sampling = myPtrs->currentRouterPtr->sampled;
	975	}
[83]	976	#endif
[60]	977	#if defined(IPV4AGGIDSNMP)
[122]	978	/ prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD);/
	979	prefixKey.beginning = agCache.v4AdD;
[145]	980	res3 = bsearch(&prefixKey, V4PTab, nbPV4,
[80]	981	sizeof(struct PrefixV4), prefGlobalCmp);
	982	if (res3!=NULL){
	983	/ res is supernet or subnet ? /
	984	if (res3->hasSubnet == 1) {
	985	resSub = NULL;
[145]	986	resSub = bsearch(&prefixKey, V4STab, nbSV4,
[80]	987	sizeof(struct PrefixV4), prefGlobalCmp);
	988	if (resSub != NULL) {
	989	res3 = resSub;
	990	resSub = NULL;
	991	}
	992	}
[84]	993	#ifdef DEBUG
[85]	994	fprintf(stderr,"S&D %lu.%lu.%lu.%lu/%hu %lu.%lu.%lu.%lu/%hu Rs %lu Ps %lu SNMPin %hu\n",
[84]	995	(agCache.v4AdS>>24),
[145]	996	(agCache.v4AdS<<8>>24),
	997	(agCache.v4AdS<<16>>24),
	998	(agCache.v4AdS<<24>>24),
[84]	999	(agCache.maskS),
[145]	1000	(agCache.v4AdD>>24),
	1001	(agCache.v4AdD<<8>>24),
	1002	(agCache.v4AdD<<16>>24),
	1003	(agCache.v4AdD<<24>>24),
[84]	1004	(agCache.maskD),
	1005	myPtrs->currentRouterPtr->sampled,
[85]	1006	res3->sampling,
	1007	agCache.inputSnmp);
[84]	1008	#endif
[83]	1009	#if defined(MULTISAMPLING)
	1010	if (myPtrs->currentRouterPtr->sampled != res3->sampling ){
	1011	res3->bytesNbIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res3->sampling;
	1012	res3->pktsNbIN += agCache.pkts*myPtrs->currentRouterPtr->sampled/res3->sampling;
	1013	/ (res3->flowNbIN)++; FIXME : FIND SOMETHING /
[93]	1014	if (agCache.dscp>>2 == FIRST_CoS) {
	1015	res3->firstCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res3->sampling;
	1016	} else if (agCache.dscp>>2 == SECOND_CoS) {
	1017	res3->secondCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res3->sampling;
	1018	} else if (agCache.dscp>>2 == THIRD_CoS) {
	1019	res3->thirdCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res3->sampling;
	1020	} else {
	1021	res3->fourthCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res3->sampling;
	1022	}
[83]	1023	}else{
	1024	res3->bytesNbIN += agCache.bytes;
	1025	res3->pktsNbIN += agCache.pkts;
	1026	(res3->flowNbIN)++;
[93]	1027	if (agCache.dscp>>2 == FIRST_CoS) {
	1028	res3->firstCoSIN += agCache.bytes;
	1029	} else if (agCache.dscp>>2 == SECOND_CoS) {
	1030	res3->secondCoSIN += agCache.bytes;
	1031	} else if (agCache.dscp>>2 == THIRD_CoS) {
	1032	res3->thirdCoSIN += agCache.bytes;
	1033	} else {
	1034	res3->fourthCoSIN += agCache.bytes;
	1035	}
[83]	1036	}
	1037	#else
[121]	1038
[80]	1039	if (myPtrs->currentRouterPtr->sampled != 0 ){
	1040	/ IN ("traffic to the prefix/subnet") /
	1041	res3->bytesNbIN += agCache.bytes;
	1042	res3->pktsNbIN += agCache.pkts;
	1043	(res3->flowNbIN)++;
[93]	1044	if (agCache.dscp>>2 == FIRST_CoS) {
	1045	res3->firstCoSIN += agCache.bytes;
	1046	} else if (agCache.dscp>>2 == SECOND_CoS) {
	1047	res3->secondCoSIN += agCache.bytes;
	1048	} else if (agCache.dscp>>2 == THIRD_CoS) {
	1049	res3->thirdCoSIN += agCache.bytes;
	1050	} else {
	1051	res3->fourthCoSIN += agCache.bytes;
	1052	}
[80]	1053	}
[145]	1054	if (res3->sampling == 0
[80]	1055	&& myPtrs->currentRouterPtr->sampled != 0){
	1056	res3->sampling = myPtrs->currentRouterPtr->sampled;
	1057	}
[83]	1058	#endif
[80]	1059	}
[60]	1060	#endif
[59]	1061	#if defined(MATRIX) && defined(IPV4AGGIDR)
[80]	1062	/ inter-pop matrix Accounting /
[122]	1063	/ prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD);/
	1064	prefixKey.beginning = agCache.v4AdD;
[145]	1065	res2 = bsearch(&prefixKey, V4PTab, nbPV4,
[80]	1066	sizeof(struct PrefixV4), prefGlobalCmp);
[121]	1067	if (res2!=NULL){
	1068	#if defined(MULTISAMPLING)
	1069	if (myPtrs->currentRouterPtr->sampled != res2->sampling ){
	1070	((struct POP *)((myPtrs->matrixPOP)
	1071	+((res->routerNb)*ROUTER_INDEX_MAX)
	1072	+((res2->routerNb))))->pktsNb += agCache.pkts*myPtrs->currentRouterPtr->sampled/res2->sampling;
	1073	((struct POP *)((myPtrs->matrixPOP)
	1074	+((res->routerNb)*ROUTER_INDEX_MAX)
	1075	+((res2->routerNb))))->bytesNb += agCache.bytes*myPtrs->currentRouterPtr->sampled/res2->sampling;
	1076	((struct POP *)((myPtrs->matrixPOP)
	1077	+((res->routerNb)*ROUTER_INDEX_MAX)
	1078	+((res2->routerNb))))->flowNb++;
	1079	} else {
	1080	((struct POP *)((myPtrs->matrixPOP)
	1081	+((res->routerNb)*ROUTER_INDEX_MAX)
	1082	+((res2->routerNb))))->pktsNb += agCache.pkts;
	1083	((struct POP *)((myPtrs->matrixPOP)
	1084	+((res->routerNb)*ROUTER_INDEX_MAX)
[145]	1085	+((res2->routerNb))))->bytesNb += agCache.bytes;
[121]	1086	((struct POP *)((myPtrs->matrixPOP)
	1087	+((res->routerNb)*ROUTER_INDEX_MAX)
	1088	+((res2->routerNb))))->flowNb++;
	1089	}
	1090	#else
[80]	1091	((struct POP *)((myPtrs->matrixPOP)
	1092	+((res->routerNb)*ROUTER_INDEX_MAX)
	1093	+((res2->routerNb))))->pktsNb += agCache.pkts;
	1094	((struct POP *)((myPtrs->matrixPOP)
	1095	+((res->routerNb)*ROUTER_INDEX_MAX)
[145]	1096	+((res2->routerNb))))->bytesNb += agCache.bytes;
[80]	1097	((struct POP *)((myPtrs->matrixPOP)
	1098	+((res->routerNb)*ROUTER_INDEX_MAX)
[145]	1099	+((res2->routerNb))))->flowNb++;
[121]	1100	#endif
[145]	1101	} else {
[121]	1102	/ here we'll make the choice that in multisampling mode,*
[124]	1103	* the virtual POP that represent the reste of world will be
	1104	* recorded in 1:10 packets mode */
[121]	1105	#if defined(MULTISAMPLING)
[80]	1106	(
	1107	((struct POP *)(myPtrs->matrixPOP)
	1108	+((res->routerNb)*ROUTER_INDEX_MAX)
[145]	1109	+((ROUTER_INDEX_MAX-1))))->pktsNb += agCache.pkts*myPtrs->currentRouterPtr->sampled/10;
[121]	1110	(
	1111	((struct POP *)(myPtrs->matrixPOP)
	1112	+((res->routerNb)*ROUTER_INDEX_MAX)
[145]	1113	+((ROUTER_INDEX_MAX-1))))->bytesNb += agCache.bytes*myPtrs->currentRouterPtr->sampled/10;
[121]	1114	(
	1115	((struct POP *)(myPtrs->matrixPOP)
	1116	+((res->routerNb)*ROUTER_INDEX_MAX)
	1117	+((ROUTER_INDEX_MAX-1))))->flowNb++;
	1118	#else
	1119	(
	1120	((struct POP *)(myPtrs->matrixPOP)
	1121	+((res->routerNb)*ROUTER_INDEX_MAX)
[145]	1122	+((ROUTER_INDEX_MAX-1))))->pktsNb += agCache.pkts;
[80]	1123	(
	1124	((struct POP *)(myPtrs->matrixPOP)
	1125	+((res->routerNb)*ROUTER_INDEX_MAX)
[145]	1126	+((ROUTER_INDEX_MAX-1))))->bytesNb += agCache.bytes;
[80]	1127	(
	1128	((struct POP *)(myPtrs->matrixPOP)
	1129	+((res->routerNb)*ROUTER_INDEX_MAX)
[121]	1130	+((ROUTER_INDEX_MAX-1))))->flowNb++;
[145]	1131	#endif
[80]	1132	}
	1133	/ end interpop matrix accounting /
[59]	1134	#endif / matrix /
[80]	1135	} else {
	1136	/ doublon or bad reference in prefix list /
	1137	#if defined(IPV4AGGIDR)
	1138	}
	1139	#elif defined(IPV4AGGIDSNMP)
	1140	}
	1141	#endif
[84]	1142	} else { / SOURCE ADDRESS DOESN'T IN OUR LIST /
[122]	1143	/ prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD); /
	1144	prefixKey.beginning = agCache.v4AdD;
[145]	1145	res = bsearch(&prefixKey, V4PTab, nbPV4,
[80]	1146	sizeof(struct PrefixV4), prefGlobalCmp);
	1147	if (res!=NULL){
[84]	1148	/ DESTINATION ADDRESS IS IN OUR LIST /
[80]	1149	if (res->hasSubnet == 1) {
	1150	resSub = NULL;
[145]	1151	resSub = bsearch(&prefixKey, V4STab, nbSV4,
[80]	1152	sizeof(struct PrefixV4), prefGlobalCmp);
	1153	if (resSub != NULL) {
	1154	res = resSub;
	1155	resSub = NULL;
	1156	}
	1157	}
[84]	1158	#ifdef DEBUG
[85]	1159	fprintf(stderr,"D %lu.%lu.%lu.%lu/%hu %lu.%lu.%lu.%lu/%hu Rs %lu Ps %lu R@ %lu.%lu.%lu.%lu SNMPin %hu\n",
[84]	1160	(agCache.v4AdS>>24),
[145]	1161	(agCache.v4AdS<<8>>24),
	1162	(agCache.v4AdS<<16>>24),
	1163	(agCache.v4AdS<<24>>24),
[84]	1164	(agCache.maskS),
[145]	1165	(agCache.v4AdD>>24),
	1166	(agCache.v4AdD<<8>>24),
	1167	(agCache.v4AdD<<16>>24),
	1168	(agCache.v4AdD<<24>>24),
[84]	1169	(agCache.maskD),
	1170	myPtrs->currentRouterPtr->sampled,
	1171	res->sampling,
[145]	1172	(myPtrs->pcktPtr->ipH->srcAdd>>24),
[84]	1173	(myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
	1174	(myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
[85]	1175	(myPtrs->pcktPtr->ipH->srcAdd<<24>>24),
	1176	agCache.inputSnmp);
[84]	1177	#endif
[80]	1178	#if defined(IPV4AGGIDSNMP)
	1179	if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1 ) {
[84]	1180	#if defined(MULTISAMPLING)
	1181	if (myPtrs->currentRouterPtr->sampled != res->sampling ){
	1182	res->bytesNbIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1183	res->pktsNbIN += agCache.pkts*myPtrs->currentRouterPtr->sampled/res->sampling;
[93]	1184	if (agCache.dscp>>2 == FIRST_CoS) {
	1185	res->firstCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1186	} else if (agCache.dscp>>2 == SECOND_CoS) {
	1187	res->secondCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1188	} else if (agCache.dscp>>2 == THIRD_CoS) {
	1189	res->thirdCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1190	} else {
	1191	res->fourthCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1192	}
[84]	1193	}else{
	1194	res->bytesNbIN += agCache.bytes;
	1195	res->pktsNbIN += agCache.pkts;
	1196	(res->flowNbIN)++;
[93]	1197	if (agCache.dscp>>2 == FIRST_CoS) {
	1198	res->firstCoSIN += agCache.bytes;
	1199	} else if (agCache.dscp>>2 == SECOND_CoS) {
	1200	res->secondCoSIN += agCache.bytes;
	1201	} else if (agCache.dscp>>2 == THIRD_CoS) {
	1202	res->thirdCoSIN += agCache.bytes;
	1203	} else {
	1204	res->fourthCoSIN += agCache.bytes;
	1205	}
[84]	1206	}
	1207	#else
[80]	1208	if (myPtrs->currentRouterPtr->sampled != 0 ){
	1209	/ IN ("traffic to the prefix/subnet") /
	1210	res->bytesNbIN += agCache.bytes;
	1211	res->pktsNbIN += agCache.pkts;
	1212	(res->flowNbIN)++;
[93]	1213	if (agCache.dscp>>2 == FIRST_CoS) {
	1214	res->firstCoSIN += agCache.bytes;
	1215	} else if (agCache.dscp>>2 == SECOND_CoS) {
	1216	res->secondCoSIN += agCache.bytes;
	1217	} else if (agCache.dscp>>2 == THIRD_CoS) {
	1218	res->thirdCoSIN += agCache.bytes;
	1219	} else {
	1220	res->fourthCoSIN += agCache.bytes;
	1221	}
[80]	1222	}
[84]	1223	#endif
[80]	1224	}
	1225	#endif
[145]	1226	#if defined(IPV4AGGIDR)
[80]	1227	if ( myPtrs->routersID[res->routerNb] == agCache.routerAd ) {
[121]	1228	#if defined(MULTISAMPLING)
	1229	if (myPtrs->currentRouterPtr->sampled != res->sampling ){
	1230	res->bytesNbIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1231	res->pktsNbIN += agCache.pkts*myPtrs->currentRouterPtr->sampled/res->sampling;
	1232	if (agCache.dscp>>2 == FIRST_CoS) {
	1233	res->firstCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1234	} else if (agCache.dscp>>2 == SECOND_CoS) {
	1235	res->secondCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1236	} else if (agCache.dscp>>2 == THIRD_CoS) {
	1237	res->thirdCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1238	} else {
	1239	res->fourthCoSIN += agCache.bytes*myPtrs->currentRouterPtr->sampled/res->sampling;
	1240	}
	1241	}else{
	1242	res->bytesNbIN += agCache.bytes;
	1243	res->pktsNbIN += agCache.pkts;
	1244	(res->flowNbIN)++;
	1245	if (agCache.dscp>>2 == FIRST_CoS) {
	1246	res->firstCoSIN += agCache.bytes;
	1247	} else if (agCache.dscp>>2 == SECOND_CoS) {
	1248	res->secondCoSIN += agCache.bytes;
	1249	} else if (agCache.dscp>>2 == THIRD_CoS) {
	1250	res->thirdCoSIN += agCache.bytes;
	1251	} else {
	1252	res->fourthCoSIN += agCache.bytes;
	1253	}
	1254	}
	1255	#else
[80]	1256	if (myPtrs->currentRouterPtr->sampled != 0 ){
	1257	/ IN ("traffic to the prefix") /
	1258	res->bytesNbIN += agCache.bytes;
	1259	res->pktsNbIN += agCache.pkts;
	1260	(res->flowNbIN)++;
[93]	1261	if (agCache.dscp>>2 == FIRST_CoS) {
	1262	res->firstCoSIN += agCache.bytes;
	1263	} else if (agCache.dscp>>2 == SECOND_CoS) {
	1264	res->secondCoSIN += agCache.bytes;
	1265	} else if (agCache.dscp>>2 == THIRD_CoS) {
	1266	res->thirdCoSIN += agCache.bytes;
	1267	} else {
	1268	res->fourthCoSIN += agCache.bytes;
	1269	}
[80]	1270	}
[121]	1271	#endif
[124]	1272	} else {
	1273	#if defined(MULTISAMPLING)
	1274	#if defined(MATRIX)
	1275	(
	1276	((struct POP *)(myPtrs->matrixPOP)
	1277	+((ROUTER_INDEX_MAX-1)*ROUTER_INDEX_MAX)
[145]	1278	+((res->routerNb))))->pktsNb += agCache.pkts*myPtrs->currentRouterPtr->sampled/10;
[124]	1279	(
	1280	((struct POP *)(myPtrs->matrixPOP)
	1281	+((ROUTER_INDEX_MAX-1)*ROUTER_INDEX_MAX)
[145]	1282	+((res->routerNb))))->bytesNb += agCache.bytes*myPtrs->currentRouterPtr->sampled/10;
[124]	1283	(
	1284	((struct POP *)(myPtrs->matrixPOP)
	1285	+((ROUTER_INDEX_MAX-1)*ROUTER_INDEX_MAX)
	1286	+((res->routerNb))))->flowNb++;
	1287	#endif
	1288	#else
	1289	#if defined(MATRIX)
	1290	(
	1291	((struct POP *)(myPtrs->matrixPOP)
	1292	+((ROUTER_INDEX_MAX-1)*ROUTER_INDEX_MAX)
[145]	1293	+((res->routerNb))))->pktsNb += agCache.pkts;
[124]	1294	(
	1295	((struct POP *)(myPtrs->matrixPOP)
	1296	+((ROUTER_INDEX_MAX-1)*ROUTER_INDEX_MAX)
[145]	1297	+((res->routerNb))))->bytesNb += agCache.bytes;
[124]	1298	(
	1299	((struct POP *)(myPtrs->matrixPOP)
	1300	+((ROUTER_INDEX_MAX-1)*ROUTER_INDEX_MAX)
	1301	+((res->routerNb))))->flowNb++;
	1302	#endif
[145]	1303	#endif
[80]	1304	}
[145]	1305	if (res->sampling == 0
[80]	1306	&& myPtrs->currentRouterPtr->sampled != 0 ){
	1307	res->sampling = myPtrs->currentRouterPtr->sampled;
	1308	}
[84]	1309	#endif
[145]	1310	} else { / UNKNOW SUBNET CASE /
[80]	1311	/ UNKNOW SUBNET CASE /
	1312	/ /
	1313	/ HERE : we are in the cases of the address/mask don't /
	1314	/ belong to a prefix listed in the IPv4 prefix file /
	1315	/ possibilities : /
	1316	/ - prefix not referenced but allowed to be routed /
	1317	/ - prefix not referenced but not allowed to be routed /
	1318	/ - spoofing /
[145]	1319	#ifdef PRINTUNKNOWNSUBNET
[80]	1320	fprintf(stderr, "%lu.%lu.%lu.%lu/%hu -> %lu.%lu.%lu.%lu/%hu (R:%lu.%lu.%lu.%lu) \n",
	1321	(agCache.v4AdS>>24),
[145]	1322	(agCache.v4AdS<<8>>24),
	1323	(agCache.v4AdS<<16>>24),
	1324	(agCache.v4AdS<<24>>24),
	1325	(agCache.maskS),
	1326	(agCache.v4AdD>>24),
	1327	(agCache.v4AdD<<8>>24),
	1328	(agCache.v4AdD<<16>>24),
	1329	(agCache.v4AdD<<24>>24),
	1330	(agCache.maskD),
	1331	(myPtrs->pcktPtr->ipH->srcAdd>>24),
[80]	1332	(myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
	1333	(myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
	1334	(myPtrs->pcktPtr->ipH->srcAdd<<24>>24)
	1335	);
[59]	1336	#endif / PRINTUNKNOWNSUBNET /
[80]	1337	}
	1338	} / end of the Destination prefix is in our list /
	1339	} / end of the prefix is in our list /
	1340	bool = 0;
[95]	1341	#endif / (IPV4AGGIDR) \|\| (IPV4AGGIDSNMP) /
[114]	1342	if ( ( isIPv6 == 1 ) && (isMplsFlow == 0) ){
[95]	1343	#ifdef IPV6LINKAGG
	1344	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1345	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1346	+(agCache.inputSnmp)))->routerIPAddress = myPtrs->currentRouterPtr->IpAddress;
[95]	1347	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1348	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
	1349	+(agCache.outputSnmp)))->routerIPAddress = myPtrs->currentRouterPtr->IpAddress;
	1350	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
	1351	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1352	+(agCache.inputSnmp)))->indexSNMP = agCache.inputSnmp;
	1353	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1354	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[145]	1355	+(agCache.outputSnmp)))->indexSNMP = agCache.outputSnmp;
[96]	1356	/ FIXME, error or warning if (indexSNMP != agCache.outputSnmp) /
	1357	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1358	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1359	+(agCache.inputSnmp)))->hasStats = 1;
	1360	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1361	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1362	+(agCache.outputSnmp)))->hasStats = 1;
	1363	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1364	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1365	+(agCache.inputSnmp)))->bytesNbIN += agCache.bytes;
	1366	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1367	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1368	+(agCache.outputSnmp)))->bytesNbOUT += agCache.bytes;
	1369	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1370	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1371	+(agCache.inputSnmp)))->pktsNbIN += agCache.pkts;
	1372	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1373	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1374	+(agCache.outputSnmp)))->pktsNbOUT += agCache.pkts;
	1375	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1376	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1377	+(agCache.inputSnmp)))->flowNbIN++;
	1378	((struct IndexV6 *)((myPtrs->currentV6IndexTab)
[97]	1379	+((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
[96]	1380	+(agCache.outputSnmp)))->flowNbOUT++;
	1381	/ fprintf(stderr,"IPV6LINKAGG;IN;%hu;OUT;%hu;router;%lu;bytes;%lu\n", /
	1382	/ agCache.inputSnmp, /
	1383	/ agCache.outputSnmp, /
	1384	/ myPtrs->currentRouterPtr->IpAddress, /
	1385	/ agCache.bytes /
	1386	/ ); /
[114]	1387	#endif / IPV6LINKAGG /
	1388	/ Update the information db (aka RenetcolMIB) /
	1389	myPtrs->currentMIB->ipv6Bytes += agCache.bytes;
	1390	myPtrs->currentMIB->ipv6Pckts += agCache.pkts;
	1391	myPtrs->currentMIB->ipv6Flow += 1;
	1392	switch (agCache.tProt){
	1393	case 1:
	1394	myPtrs->currentMIB->ipv6IcmpFlowNb += 1;
	1395	myPtrs->currentMIB->ipv6IcmpBytesNb += agCache.bytes;
	1396	myPtrs->currentMIB->ipv6IcmpPktsNb += agCache.pkts;
	1397	break;
	1398	case 6:
	1399	myPtrs->currentMIB->ipv6TCPFlowNb += 1;
	1400	myPtrs->currentMIB->ipv6TCPBytesNb += agCache.bytes;
	1401	myPtrs->currentMIB->ipv6TCPPktsNb += agCache.pkts;
	1402	break;
	1403	case 17:
	1404	myPtrs->currentMIB->ipv6UDPFlowNb += 1;
	1405	myPtrs->currentMIB->ipv6UDPBytesNb += agCache.bytes;
	1406	myPtrs->currentMIB->ipv6UDPPktsNb += agCache.pkts;
	1407	break;
	1408	default:
	1409	myPtrs->currentMIB->ipv6OthersFlowNb += 1;
	1410	myPtrs->currentMIB->ipv6OthersBytesNb += agCache.bytes;
	1411	myPtrs->currentMIB->ipv6OthersPktsNb += agCache.pkts;
	1412	break;
	1413	}
	1414	if (agCache.pkts==1){
	1415	myPtrs->currentMIB->ipv6FlowSizePcktsE1 += 1;
	1416	} else if (agCache.pkts<10) {
	1417	myPtrs->currentMIB->ipv6FlowSizePcktsLT10 += 1;
	1418	} else if (agCache.pkts<100) {
	1419	myPtrs->currentMIB->ipv6FlowSizePcktsLT100 += 1;
	1420	} else if (agCache.pkts<1000) {
	1421	myPtrs->currentMIB->ipv6FlowSizePcktsLT1k += 1;
	1422	} else if (agCache.pkts<10000) {
	1423	myPtrs->currentMIB->ipv6FlowSizePcktsLT10k += 1;
	1424	} else if (agCache.pkts>=10000) {
	1425	myPtrs->currentMIB->ipv6FlowSizePcktsMT10k += 1;
	1426	}
	1427	if (agCache.bytes<50){
	1428	myPtrs->currentMIB->ipv6FlowSizeBytesLT50 += 1;
	1429	} else if (agCache.bytes<100) {
	1430	myPtrs->currentMIB->ipv6FlowSizeBytesLT100 += 1;
	1431	} else if (agCache.bytes<1000) {
	1432	myPtrs->currentMIB->ipv6FlowSizeBytesLT1k += 1;
	1433	} else if (agCache.bytes<10000) {
	1434	myPtrs->currentMIB->ipv6FlowSizeBytesLT10k += 1;
	1435	} else if (agCache.bytes<100000) {
	1436	myPtrs->currentMIB->ipv6FlowSizeBytesLT100k += 1;
	1437	} else if (agCache.bytes<1000000) {
	1438	myPtrs->currentMIB->ipv6FlowSizeBytesLT1M += 1;
	1439	} else if (agCache.bytes<10000000) {
	1440	myPtrs->currentMIB->ipv6FlowSizeBytesLT10M += 1;
	1441	} else if (agCache.bytes<100000000) {
	1442	myPtrs->currentMIB->ipv6FlowSizeBytesLT100M += 1;
	1443	} else if (agCache.bytes>=100000000) {
	1444	myPtrs->currentMIB->ipv6FlowSizeBytesMT100M += 1;
	1445	}
	1446	switch (agCache.dPort){
	1447	case 53:
	1448	myPtrs->currentMIB->ipv6DNSFlowNb += 1;
	1449	myPtrs->currentMIB->ipv6DNSBytesNb += agCache.bytes;
	1450	myPtrs->currentMIB->ipv6DNSPcktsNb += agCache.pkts;
	1451	break;
	1452	case 80:
	1453	myPtrs->currentMIB->ipv6WebFlowNb += 1;
	1454	myPtrs->currentMIB->ipv6WebBytesNb += agCache.bytes;
	1455	myPtrs->currentMIB->ipv6WebPcktsNb += agCache.pkts;
	1456	break;
	1457	default:
	1458	myPtrs->currentMIB->ipv6OthersApFlowNb += 1;
	1459	myPtrs->currentMIB->ipv6OthersApBytesNb += agCache.bytes;
	1460	myPtrs->currentMIB->ipv6OthersApPcktsNb += agCache.pkts;
	1461	break;
[145]	1462	}
[114]	1463	/ end of mib update /
	1464	isIPv6 = 0;
[95]	1465	}
[80]	1466	isMplsFlow = 0;
[144]	1467
	1468	/ DoS DETECTION /
[145]	1469	if ( dosCache.endTime-dosCache.startTime > 1000 ) {
	1470	if ( ( (dosCache.packets*dosCache.sampling)/((dosCache.endTime-dosCache.startTime)/1000) > MAX_PKTS_DOS )
	1471	&& ((dosCache.bytes)/(dosCache.packets) < RATIO_DOS ) ) {
	1472	jdos = 0;
[147]	1473	posdos = 69*MAX_RULES_PER_FIELD+jdos;
	1474	while ( ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+posdos))) != NULL ) {
[145]	1475	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+posdos)))->check = 1;
	1476	jdos++;
[147]	1477	posdos = 69*MAX_RULES_PER_FIELD+jdos;
[145]	1478	}
	1479	}
	1480	} else { / flow duration <= 1000ms , we divide by 1 (sec) /
	1481	if ( ( (dosCache.packets*dosCache.sampling) > MAX_PKTS_DOS )
	1482	& ((dosCache.bytes)/(dosCache.packets) < RATIO_DOS ) ) {
	1483	jdos = 0;
[147]	1484	posdos = 69*MAX_RULES_PER_FIELD+jdos;
	1485	while ( ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+posdos))) != NULL ) {
[145]	1486	((RuleDefPtr)(*(myPtrs->rulesAddressPtr+posdos)))->check = 1;
	1487	jdos++;
[147]	1488	posdos = 69*MAX_RULES_PER_FIELD+jdos;
[145]	1489	}
	1490	}
	1491	}
[147]	1492	dosCache.packets = 1;
	1493	dosCache.bytes = 1;
	1494	dosCache.endTime = 1;
	1495	dosCache.startTime = 1;
[144]	1496
[145]	1497	/*
[80]	1498	*
	1499	* SOCKET OUTPUT TO A REMOTE CLIENT
	1500	*
[145]	1501	* switch the rules definition (check & fieldToRecord),
[80]	1502	* we send the flow or a part of the flow to a remote host or a file.
	1503	* In a first time (until release 0.0.7, the information was sent via
	1504	* the process renetcolSender with an IPC message queue. But, the perf
	1505	* of IPC Msg was very bad with a default system compilation.
	1506	* So, now, we send information directly from here through sockets.
	1507	*/
	1508	tmpRuleList = myPtrs->rulesListPtr;
	1509	tmpRL = myPtrs->rulesListPtr;
	1510	while (tmpRuleList){
	1511	RuleDefPtr tmpRuleDefList = tmpRuleList->def;
	1512	unsigned short check = 1;
	1513	int s=0;
	1514	secondOffset = secondOldOffset;
	1515	while (tmpRuleDefList){
	1516	check = check && tmpRuleDefList->check;
	1517	tmpRuleDefList->check = 0;
	1518	tmpRuleDefList = tmpRuleDefList->next;
	1519	}
	1520	if ( (tmpRuleList->def != NULL) && (check == 1)) {
	1521	/ msg building /
	1522	secondPftmp = tmp->lastField;
[145]	1523	msgTextIndex = mempcpy(mempcpy(mempcpy(myMsg.text,
	1524	&tplMsgType,
	1525	sizeof(unsigned short)
[80]	1526	),
	1527	&tmpRuleList->id,
	1528	sizeof(tmpRuleList->id)
	1529	),
[145]	1530	&myPtrs->currentRouterPtr->IpAddress,
	1531	sizeof(unsigned long)
[80]	1532	);
[145]	1533	msgTextIndex = mempcpy(mempcpy(mempcpy(msgTextIndex,
	1534	&tmp->sourceId,
	1535	sizeof(unsigned long)
[144]	1536	),
	1537	&tmp->templateFlowSetId,
	1538	sizeof(tmp->templateFlowSetId)
	1539	),
	1540	myPtrs->ptr_buffer+secondOffset,
[80]	1541	flow_size
[145]	1542	);
[80]	1543	myMsg.type = 1;
[57]	1544
[145]	1545
[80]	1546	/ NEW transfert type /
	1547	for ( ; tmpRL; tmpRL=tmpRL->next){
[145]	1548	if (tmpRL->id == tmpRuleList->id){
[80]	1549	s = sendMessage(tmpRL->host->sockId, myMsg.text, sizeof(myMsg.text),
	1550	tmpRL->host->hostAddressPtr);
	1551	}
	1552	}
	1553	/ FIXME : perhaps check "s" /
	1554	noEnd = 1;
	1555	secondCpt=0;
	1556	} / end if check /
	1557	tmpRuleList = tmpRuleList->next;
	1558	tmpRL = myPtrs->rulesListPtr; / ticket #11 /
	1559	secondPftmp = tmp->lastField;
	1560	} / end while tmpRuleList /
[145]	1561	/*
	1562	* end redirection
[80]	1563	*/
	1564	secondOffset = *myPtrs->offsetV9Ptr;
	1565	secondOldOffset = secondOffset;
	1566	pftmp = tmp->lastField;
	1567	cpt=0;
	1568	(myPtrs->currentFlowsetNumberPtr)++; /* pointer on the flows number /
	1569	if (((*myPtrs->offsetV9Ptr)-48-shift+flow_size) > data_length){
	1570	overflow = 1; / buffer index not correct /
	1571	}
	1572	} else {
	1573	/ not the flow end, progress in field list /
	1574	pftmp = pftmp->prev;
[145]	1575	}
[80]	1576	} / end of the while on one flow record /
[145]	1577
[80]	1578	while ( ((*myPtrs->offsetV9Ptr)-48-shift) < data_length ) {
	1579	(myPtrs->offsetV9Ptr)++; /* if padding /
	1580	paddingCounter++;
[111]	1581	#ifdef DEBUG
[112]	1582	fprintf(stderr,", pC: %d ", paddingCounter);
	1583	#endif
[80]	1584	if ( paddingCounter > 8 ) {
	1585	syslog(LOG_INFO,"padding too high: %d ", paddingCounter);
[112]	1586	#ifdef DEBUG
[111]	1587	fprintf(stderr,", pC: %d <--\| ", paddingCounter);
[112]	1588	#endif
[80]	1589	return (-1);
	1590	}
	1591	}
[145]	1592	while ( (*myPtrs->offsetV9Ptr)-48-shift > data_length ) {
[80]	1593	(myPtrs->offsetV9Ptr)--; /* crazy loop (when bug appears in template def) /
	1594	crazyCounter++;
	1595	}
[30]	1596	#ifdef DEBUG
[80]	1597	if (crazyCounter != 0){ fprintf(stderr," crazyCounter: %d ", crazyCounter); }
[112]	1598	#endif
[80]	1599	if (crazyCounter!=0) { syslog(LOG_INFO,"crazyCounter: %d ", crazyCounter);}
[145]	1600
[112]	1601	#ifdef DEBUG
[111]	1602	fprintf(stderr,"(%hu,%hu)}", data_length, data_length+shift);
[29]	1603	#endif
[145]	1604
[80]	1605	return (data_length+shift);
	1606	/ end new place /
[30]	1607
[80]	1608	} else {
	1609	/*
	1610	*
	1611	*
	1612	* OPTIONAL TEMPLATE
	1613	*
	1614	*
	1615	*/
[145]	1616	if ((tmpOpt=existTplOptId(myPtrs->currentRouterPtr, myPtrs->currentHeaderV9Ptr->sourceId,
	1617	(*myPtrs->currentFlowsetIdPtr)))!=NULL) {
[113]	1618
	1619	myPtrs->currentMIB->optDataFlowSetNb += 1;
[30]	1620	#ifdef DEBUG
[80]	1621	fprintf(stderr,"<d id: %hu, lg %hu", (*myPtrs->currentFlowsetIdPtr), data_length);
[84]	1622	#endif
[80]	1623	for ( i=0; i<(tmpOpt->optionScopeLg/4); i++){
[145]	1624	/ FIXME : today we skip the scope fields, it's bad :( /
[80]	1625	if ((pftmp=tmpOpt->lastField)!=NULL) {
	1626	for (j=0; j<pftmp->fieldLength; j++) {
[145]	1627	(*myPtrs->offsetV9Ptr)++;
[80]	1628	}
	1629	pftmp = pftmp->prev;
	1630	}
	1631	}
	1632	while (pftmp != NULL) {
[145]	1633	if (pftmp->fieldLength==1){
[80]	1634	buffer1 = (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	1635	}
[145]	1636	if (pftmp->fieldLength==2){
[80]	1637	buffer2[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	1638	buffer2[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	1639	}
[145]	1640	if (pftmp->fieldLength==4){
[80]	1641	buffer4[3]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	1642	buffer4[2]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	1643	buffer4[1]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
	1644	buffer4[0]= (myPtrs->ptr_buffer+(myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
[84]	1645	if (pftmp->fieldType==34\|\|pftmp->fieldType==50){
[145]	1646	if ((((unsigned* long*)&buffer4)==1)
[80]	1647	\|\| (((unsigned* long*)&buffer4)==10)
[119]	1648	\|\| (((unsigned* long*)&buffer4)==20)
[80]	1649	\|\| (((unsigned* long*)&buffer4)==100)
	1650	\|\| (((unsigned* long*)&buffer4)==1000)) {
	1651	if (myPtrs->currentRouterPtr->sampled != ((unsigned* long*)&buffer4) ) {
[30]	1652	#ifdef DEBUGAGG
[80]	1653	fprintf(stderr,"\n SV (p) %lu != %lu (r)", ((unsigned* long*)&buffer4),
	1654	myPtrs->currentRouterPtr->sampled);
[84]	1655	#endif
[80]	1656	syslog(LOG_INFO,"Sampling value change for router : %lu.%lu.%lu.%lu, old: %lu, new: %lu",
	1657	(myPtrs->pcktPtr->ipH->srcAdd>>24),
	1658	(myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
	1659	(myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
	1660	(myPtrs->pcktPtr->ipH->srcAdd<<24>>24),
	1661	myPtrs->currentRouterPtr->sampled,
	1662	((unsigned* long*)&buffer4)
	1663	);
	1664	myPtrs->currentRouterPtr->sampled = ((unsigned* long*)&buffer4);
	1665	}
	1666	}else{
	1667	syslog(LOG_INFO,"Sampling value not standard for router : %lu.%lu.%lu.%lu, value : %lu",
	1668	(myPtrs->pcktPtr->ipH->srcAdd>>24),
	1669	(myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
	1670	(myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
	1671	(myPtrs->pcktPtr->ipH->srcAdd<<24>>24),
	1672	((unsigned* long*)&buffer4)
	1673	);
	1674	}
	1675	}
[145]	1676	}
[80]	1677	pftmp = pftmp->prev;
	1678	}
	1679	if ( pftmp == NULL ) {
	1680	while ((*myPtrs->offsetV9Ptr)%4 != 0) {
	1681	(*myPtrs->offsetV9Ptr)++;
[30]	1682	#ifdef DEBUG
[80]	1683	fprintf(stderr," p ");
[30]	1684	#endif
[80]	1685	}
	1686	} else {
	1687	fprintf(stderr,"PB ");
	1688	}
[29]	1689	#ifdef DEBUG
[80]	1690	fprintf(stderr,">");
[29]	1691	#endif
[113]	1692	myPtrs->currentMIB->realFlowNb += 1;
[80]	1693	return (data_length+shift);
	1694	} else {
[145]	1695	/*
	1696	* template unknown, we skip the data
[80]	1697	*/
	1698	(*myPtrs->offsetV9Ptr)+=(data_length-4);
[111]	1699	(*myPtrs->currentFlowsetNumberPtr)+= 1 ;
	1700	/ (myPtrs->currentFlowsetNumberPtr) = myPtrs->currentHeaderV9Ptr->count;/*
[29]	1701	#ifdef DEBUG
[111]	1702	fprintf(stderr, " U, r: %lu.%lu.%lu.%lu, sourceId: %lu, TID: %hu ",
[80]	1703	(myPtrs->pcktPtr->ipH->srcAdd>>24),
	1704	(myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
	1705	(myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
	1706	(myPtrs->pcktPtr->ipH->srcAdd<<24>>24),
[145]	1707	myPtrs->currentHeaderV9Ptr->sourceId,
[80]	1708	(*myPtrs->currentFlowsetIdPtr)
	1709	);
[111]	1710	fprintf(stderr,"(%hu,%hu) ", data_length, data_length+shift);
[29]	1711	#endif
[80]	1712	return (data_length+shift);
	1713	}
	1714	}
	1715	}

Note: See TracBrowser for help on using the browser.

Context Navigation

root/trunk/src/dataFlowSet.c @ 158

Download in other formats: