Changeset 145 for trunk

Timestamp:

12/27/10 15:06:15 (12 years ago)

Author:

andreu

Message:

DoS detection update

Location:

trunk/src

Files:

• dataFlowSet.c (modified) (82 diffs)
• dataFlowSet.h (modified) (4 diffs)

trunk/src/dataFlowSet.c

@@ -1 +1 @@
 /*
  * File: dataFlowSet.c
- * 
- * Authors: ANDREU Francois-Xavier 
  *
- * Copyright (C) 2005 - 2010 GIP RENATER 
+ * Authors: ANDREU Francois-Xavier
+ *
+ * Copyright (C) 2005 - 2010 GIP RENATER
  */
 
-/*  This file is part of renetcol. 
+/*  This file is part of renetcol.
  *
  *  renetcol is free software; you can redistribute it and/or modify
@@ -27 +27 @@
 
 /*
- * Check Data FlowSet 
+ * Check Data FlowSet
  *
  */
-short 
-checkDataFlowSet(short shift, 
+short
+checkDataFlowSet(short shift,
                  struct MyPtrs *myPtrs,
-                 int myQueue, 
-                 struct PrefixV4 *V4PTab, 
+                 int myQueue,
+                 struct PrefixV4 *V4PTab,
                  size_t nbPV4,
                  struct PrefixV4 *V4STab,
@@ -58 +58 @@
   int j = 0;
   int pos = 0;
-        int jdos = 0;
-        int posdos = 0;
-  unsigned char buffer1;  
+  int jdos = 0;
+  int posdos = 0;
+  unsigned char buffer1;
   unsigned char buffer2[2];
   unsigned char buffer4[4];
@@ -99 +99 @@
   data_length = *((unsigned short*)&buffer2);
   if (data_length == 0) {
-#ifdef DEBUG    
+#ifdef DEBUG
     fprintf (stderr, " dlg==0 <--| ");
 #endif
@@ -112 +112 @@
   }
 
-  if ( (tmp=existTplId(myPtrs->currentRouterPtr, 
-                       myPtrs->currentHeaderV9Ptr->sourceId, 
+  if ( (tmp=existTplId(myPtrs->currentRouterPtr,
+                       myPtrs->currentHeaderV9Ptr->sourceId,
                        (*myPtrs->currentFlowsetIdPtr)))!=NULL ) {
     myPtrs->currentMIB->dataFlowSetNb += 1;
 #ifdef DEBUG
     fprintf(stderr,
-            "{d id: %hu, lg %hu", 
-            (*myPtrs->currentFlowsetIdPtr), 
+            "{d id: %hu, lg %hu",
+            (*myPtrs->currentFlowsetIdPtr),
             data_length);
     if ( (*myPtrs->currentFlowsetIdPtr) > TRESHOLD_TEMPLATE_ID ) {
@@ -151 +151 @@
              (myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
              (myPtrs->pcktPtr->ipH->srcAdd<<24>>24));
-#ifdef DEBUG    
+#ifdef DEBUG
     fprintf (stderr, " dlg%flsz >=9 skip data ");
 #endif
@@ -163 +163 @@
              (myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
              (myPtrs->pcktPtr->ipH->srcAdd<<24>>24));
-#ifdef DEBUG    
+#ifdef DEBUG
     fprintf (stderr, " dlg >= 1452 skip pckt ");
 #endif
@@ -169 +169 @@
     }
 #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP)
-    agCache.routerAd = myPtrs->pcktPtr->ipH->srcAdd; 
+    agCache.routerAd = myPtrs->pcktPtr->ipH->srcAdd;
 #endif
 
     pftmp = tmp->lastField;
-    secondPftmp = tmp->lastField;    
+    secondPftmp = tmp->lastField;
     secondOffset = *myPtrs->offsetV9Ptr;
     secondOldOffset = secondOffset;
-    while ( (((*myPtrs->offsetV9Ptr)-48-shift) <= data_length) 
-            && (overflow!=1) ) { 
-      /* 
-       * progression in a data flow Set 
+    while ( (((*myPtrs->offsetV9Ptr)-48-shift) <= data_length)
+            && (overflow!=1) ) {
+      /*
+       * progression in a data flow Set
        * notes:
        *   48= IP header size + NetFlow header size
@@ -198 +198 @@
           {
             ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+j)))->check = 1;
-          }     
+          }
         j++;
-      }    
+      }
       j = 0;
 
@@ -211 +211 @@
         oldOffset = *myPtrs->offsetV9Ptr;
         while (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos))) != NULL){
-          /* 
+          /*
            * while on one cache table line
            */
@@ -218 +218 @@
                   (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->operator)){
           case 2:
-            /* operator: "=" */ 
+            /* operator: "=" */
             switch (field_size) {
             case 1:
-              buffer1 = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+              buffer1 = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
               (*myPtrs->offsetV9Ptr)++;
               /* rule check */
-              if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.cvalue 
+              if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.cvalue
                   == *((unsigned char*)&buffer1)) {
                 ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
@@ -248 +248 @@
                 agCache.dscp = *((unsigned char*)&buffer1);
               }
-#endif        
+#endif
               break;
             case 2:
-              buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+              buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
               (*myPtrs->offsetV9Ptr)++;
-              buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+              buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
               (*myPtrs->offsetV9Ptr)++;
-              if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.svalue 
+              if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.svalue
                   == *((unsigned short*)&buffer2))
                 ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
               if (pftmp->fieldType==7){
                 agCache.sPort = *((unsigned short*)&buffer2);
-              }   
+              }
               if (pftmp->fieldType==11){
                 agCache.dPort = *((unsigned short*)&buffer2);
@@ -275 +275 @@
               if (pftmp->fieldType==16){
                 agCache.asS = *((unsigned short*)&buffer2);
-              }   
+              }
               if (pftmp->fieldType==17){
                 agCache.asD = *((unsigned short*)&buffer2);
@@ -283 +283 @@
             case 3:
               buffer4[3]= 0;
-              buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+              buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
               (*myPtrs->offsetV9Ptr)++;
-              buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+              buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
               (*myPtrs->offsetV9Ptr)++;
-              buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+              buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
               (*myPtrs->offsetV9Ptr)++;
-              if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue 
+              if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue
                   == *((unsigned long*)&buffer4))
                 ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
@@ -299 +299 @@
               break;
             case 4:
-              buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+              buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
               (*myPtrs->offsetV9Ptr)++;
-              buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+              buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
               (*myPtrs->offsetV9Ptr)++;
-              buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+              buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
               (*myPtrs->offsetV9Ptr)++;
-              buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+              buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
               (*myPtrs->offsetV9Ptr)++;
               /* FIXME : here , add a check on the field type */
               if ((pftmp->fieldType==8)||(pftmp->fieldType==12)
                   ||(pftmp->fieldType==15)||(pftmp->fieldType==18)){
-                if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) 
+                if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)
                     == (*((unsigned long*)&buffer4))>>(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask) )
                   {
@@ -317 +317 @@
               }
               if ((pftmp->fieldType==10)||(pftmp->fieldType==14)){
-                if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.svalue) 
+                if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.svalue)
                     == ((unsigned short)*((unsigned long*)&buffer4)))
                   {
@@ -324 +324 @@
               }
               if ((pftmp->fieldType==16)||(pftmp->fieldType==17)){
-                if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.svalue) 
+                if ((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.svalue)
                     == ((unsigned short)*((unsigned long*)&buffer4)))
                   {
@@ -349 +349 @@
               if (pftmp->fieldType==14){
                 agCache.outputSnmp = (unsigned short)*((unsigned long*)&buffer4);
-              } 
+              }
               if ((pftmp->fieldType==8)){
                 bool = 1; /* very important, test if we have an IPv4 flow for Agg */
@@ -367 +367 @@
               if (pftmp->fieldType==16){
                 agCache.asS = (unsigned short)*((unsigned long*)&buffer4);
-              }   
+              }
               if (pftmp->fieldType==17){
                 agCache.asD = (unsigned short)*((unsigned long*)&buffer4);
@@ -374 +374 @@
               if (pftmp->fieldType==1){
                       dosCache.bytes = *((unsigned long*)&buffer4);
-                                        dosCache.sampling = *myPtrs->currentRouterPtr->sampled;
+                      dosCache.sampling = myPtrs->currentRouterPtr->sampled;
               }
               if (pftmp->fieldType==2){
-                      dosCache.pkts = *((unsigned long*)&buffer4);
-                                }
+                      dosCache.packets = *((unsigned long*)&buffer4);
+          }
+          if (pftmp->fieldType==21){
+                      dosCache.endTime = *((unsigned long*)&buffer4);
+          }
+          if (pftmp->fieldType==22){
+                      dosCache.startTime = *((unsigned long*)&buffer4);
+          }
               break;
             case 16:
@@ -384 +390 @@
                 isIPv6 = 1;
                 for (i=0; i<4; i++) {
-                  buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+                  buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
                   (*myPtrs->offsetV9Ptr)++;
-                  buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+                  buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
                   (*myPtrs->offsetV9Ptr)++;
-                  buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+                  buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
                   (*myPtrs->offsetV9Ptr)++;
-                  buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+                  buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
                   (*myPtrs->offsetV9Ptr)++;
                   if (1==moreIsNecessary){
@@ -396 +402 @@
                     case 0:
                       if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 32){
-                        if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) 
-                            == 
+                        if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
+                            ==
                             (*((unsigned long*)&buffer4))>>(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(32-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)
                             )
@@ -408 +414 @@
                         }
                       } else {
-                        if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) 
-                            == 
+                        if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
+                            ==
                             (*((unsigned long*)&buffer4))
                             )
@@ -422 +428 @@
                     case 1:
                       if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 64){
-                        if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) 
-                            == 
+                        if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
+                            ==
                             (*((unsigned long*)&buffer4))>>(64-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(64-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)
                             )
@@ -435 +441 @@
                         }
                       } else {
-                        if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) 
-                            == 
+                        if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
+                            ==
                             (*((unsigned long*)&buffer4))
                             )
                           {
-                            ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 
+                            ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
                               ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
                           } else {
@@ -450 +456 @@
                     case 2:
                       if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 96){
-                        if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) 
-                            == 
+                        if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
+                            ==
                             (*((unsigned long*)&buffer4))>>(96-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(96-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)
                             )
@@ -463 +469 @@
                         }
                       } else {
-                        if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) 
-                            == 
+                        if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
+                            ==
                             (*((unsigned long*)&buffer4))
                             )
                           {
-                            ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 
+                            ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
                               ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
                           } else {
@@ -478 +484 @@
                     case 3:
                       if (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask <= 128){
-                        if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) 
-                            == 
+                        if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
+                            ==
                             (*((unsigned long*)&buffer4))>>(128-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)<<(128-((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->mask)
                             )
@@ -490 +496 @@
                         }
                       } else {
-                        if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i]) 
-                            == 
+                        if (ntohl(((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.tabAdd6[i])
+                            ==
                             (*((unsigned long*)&buffer4))
                             )
                           {
-                            ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 
+                            ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check =
                               ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check && 1;
                           } else {
@@ -517 +523 @@
                 moreIsNecessary = 1;
                 /* aggregation for IPv6 flows */
-                
+
                 /* end aggregation */
               } /* end of : if ((pftmp->fieldType==27)||(pftmp->fieldType==28)){ */
               break;
             default:
-              syslog(LOG_INFO, "Field size not known: %d\n", field_size); 
+              syslog(LOG_INFO, "Field size not known: %d\n", field_size);
               for (i=0; i<field_size; i++){
                 (*myPtrs->offsetV9Ptr)++;
@@ -538 +544 @@
         } /* end while myPtrs->rulesAddressPtr */
       } else {
-        /* 
-         * no rule within this field type, but we must read the value 
+        /*
+         * no rule within this field type, but we must read the value
          */
         switch (field_size) {
         case 1:
-          buffer1 = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+          buffer1 = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
           (*myPtrs->offsetV9Ptr)++;
 #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP)
@@ -563 +569 @@
           if (pftmp->fieldType==5){
             agCache.dscp = *((unsigned char*)&buffer1);
-          }       
+          }
 #endif
           break;
         case 2:
-          buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+          buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
           (*myPtrs->offsetV9Ptr)++;
-          buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+          buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
           (*myPtrs->offsetV9Ptr)++;
           if (pftmp->fieldType==7){
             agCache.sPort = *((unsigned short*)&buffer2);
-          }       
+          }
           if (pftmp->fieldType==11){
             agCache.dPort = *((unsigned short*)&buffer2);
@@ -580 +586 @@
           if (pftmp->fieldType==10){
             agCache.inputSnmp = *((unsigned short*)&buffer2);
-          }       
+          }
           if (pftmp->fieldType==14){
             agCache.outputSnmp = *((unsigned short*)&buffer2);
-          }       
+          }
 #endif
 #ifdef ASACC
           if (pftmp->fieldType==16){
             agCache.asS = *((unsigned short*)&buffer2);
-          }       
+          }
           if (pftmp->fieldType==17){
             agCache.asD = *((unsigned short*)&buffer2);
@@ -596 +602 @@
         case 3:
           buffer4[3]= 0;
-          buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+          buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
           (*myPtrs->offsetV9Ptr)++;
-          buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+          buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
           (*myPtrs->offsetV9Ptr)++;
-          buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+          buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
           (*myPtrs->offsetV9Ptr)++;
           /* aggregation */
@@ -609 +615 @@
           break;
         case 4:
-          buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+          buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
           (*myPtrs->offsetV9Ptr)++;
-          buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+          buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
           (*myPtrs->offsetV9Ptr)++;
-          buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+          buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
           (*myPtrs->offsetV9Ptr)++;
-          buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+          buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
           (*myPtrs->offsetV9Ptr)++;
 #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP)
@@ -623 +629 @@
           if (pftmp->fieldType==14){
             agCache.outputSnmp = (unsigned short)*((unsigned long*)&buffer4);
-          } 
+          }
           if ((pftmp->fieldType==8)){
             bool = 1;
@@ -638 +644 @@
           if (pftmp->fieldType==16){
             agCache.asS = (unsigned short)*((unsigned long*)&buffer4);
-          }       
+          }
           if (pftmp->fieldType==17){
             agCache.asD = (unsigned short)*((unsigned long*)&buffer4);
@@ -645 +651 @@
                 if (pftmp->fieldType==1){
             dosCache.bytes = *((unsigned long*)&buffer4);
-                        dosCache.sampling = *myPtrs->currentRouterPtr->sampled;
-          } 
+                        dosCache.sampling = myPtrs->currentRouterPtr->sampled;
+          }
                 if (pftmp->fieldType==2){
-            dosCache.pkts = *((unsigned long*)&buffer4);
-          }
+            dosCache.packets = *((unsigned long*)&buffer4);
+          }
+      if (pftmp->fieldType==21){
+                dosCache.endTime = *((unsigned long*)&buffer4);
+      }
+      if (pftmp->fieldType==22){
+                dosCache.startTime = *((unsigned long*)&buffer4);
+      }
           break;
         case 16:
@@ -656 +668 @@
           }
           for (i=0; i<4; i++) {
-            buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+            buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
             (*myPtrs->offsetV9Ptr)++;
-            buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+            buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
             (*myPtrs->offsetV9Ptr)++;
-            buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+            buffer4[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
             (*myPtrs->offsetV9Ptr)++;
-            buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); 
+            buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr));
             (*myPtrs->offsetV9Ptr)++;
 #if defined IPV6AGGIDSNMP
@@ -681 +693 @@
       } /* end if one cache table line existence */
       if (cpt==tmp->fieldCount) {
-        /* 
-         * end of one flow (not the flowset) 
+        /*
+         * end of one flow (not the flowset)
          */
         myPtrs->currentMIB->realFlowNb += 1;
@@ -688 +700 @@
         flowCpt++;
         fprintf(stderr," F%d ", flowCpt);
-#endif 
+#endif
         /* put aggregation cache information to IPv4 Prefixes table */
         /* Aggregation mode must be enable in ./configure options   */
@@ -718 +730 @@
                 (asres->flowNbOUT)++;
               }
-              if (asres->sampling == 0 
+              if (asres->sampling == 0
                   && myPtrs->currentRouterPtr->sampled != 0){
                 asres->sampling = myPtrs->currentRouterPtr->sampled;
@@ -744 +756 @@
                   (asres->flowNbIN)++;
                 }
-                if (asres->sampling == 0 
+                if (asres->sampling == 0
                     && myPtrs->currentRouterPtr->sampled != 0){
                   asres->sampling = myPtrs->currentRouterPtr->sampled;
@@ -775 +787 @@
                   (asres->flowNbIN)++;
                 }
-                if (asres->sampling == 0 
+                if (asres->sampling == 0
                     && myPtrs->currentRouterPtr->sampled != 0){
                   asres->sampling = myPtrs->currentRouterPtr->sampled;
@@ -860 +872 @@
             myPtrs->currentMIB->ipv4OthersApPcktsNb += agCache.pkts;
             break;
-          }  
+          }
           /* end of mib update */
         }
@@ -870 +882 @@
           /*      prefixKey.beginning = agCache.v4AdS>>(32-agCache.maskS)<<(32-agCache.maskS); */
           prefixKey.beginning = agCache.v4AdS;
-          res = bsearch(&prefixKey, V4PTab, nbPV4, 
+          res = bsearch(&prefixKey, V4PTab, nbPV4,
                         sizeof(struct PrefixV4), prefGlobalCmp);
           if (res!=NULL){
@@ -876 +888 @@
             if (res->hasSubnet == 1) {
               resSub = NULL;
-              resSub = bsearch(&prefixKey, V4STab, nbSV4, 
+              resSub = bsearch(&prefixKey, V4STab, nbSV4,
                                sizeof(struct PrefixV4), prefGlobalCmp);
               if (resSub != NULL) {
                 res = resSub;
                 resSub = NULL;
-              } 
+              }
             }
 #ifdef DEBUG
             fprintf(stderr,"S %lu.%lu.%lu.%lu/%hu %lu.%lu.%lu.%lu/%hu Rs %lu Ps %lu SNMPin(hu) %hu\n",
                     (agCache.v4AdS>>24),
-                    (agCache.v4AdS<<8>>24), 
-                    (agCache.v4AdS<<16>>24), 
-                    (agCache.v4AdS<<24>>24), 
+                    (agCache.v4AdS<<8>>24),
+                    (agCache.v4AdS<<16>>24),
+                    (agCache.v4AdS<<24>>24),
                     (agCache.maskS),
-                    (agCache.v4AdD>>24), 
-                    (agCache.v4AdD<<8>>24), 
-                    (agCache.v4AdD<<16>>24), 
-                    (agCache.v4AdD<<24>>24), 
+                    (agCache.v4AdD>>24),
+                    (agCache.v4AdD<<8>>24),
+                    (agCache.v4AdD<<16>>24),
+                    (agCache.v4AdD<<24>>24),
                     (agCache.maskD),
                     myPtrs->currentRouterPtr->sampled,
@@ -900 +912 @@
 #endif
 #if defined(IPV4AGGIDR)
-            if ( myPtrs->routersID[res->routerNb] == agCache.routerAd  ) { 
+            if ( myPtrs->routersID[res->routerNb] == agCache.routerAd  ) {
 #elif defined(IPV4AGGIDSNMP)
-              if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1  ) {       
+              if ( myPtrs->currentRouterPtr->snmpIndexList[agCache.inputSnmp] == 1  ) {
 #endif
                 /* OUT ("traffic from the prefix/subnet")  */
@@ -948 +960 @@
                   }
                 }
-                if (res->sampling == 0 
+                if (res->sampling == 0
                     && myPtrs->currentRouterPtr->sampled != 0){
                   res->sampling = myPtrs->currentRouterPtr->sampled;
@@ -956 +968 @@
                 /*              prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD);*/
                 prefixKey.beginning = agCache.v4AdD;
-                res3 = bsearch(&prefixKey, V4PTab, nbPV4, 
+                res3 = bsearch(&prefixKey, V4PTab, nbPV4,
                                sizeof(struct PrefixV4), prefGlobalCmp);
                 if (res3!=NULL){
@@ -962 +974 @@
                   if (res3->hasSubnet == 1) {
                     resSub = NULL;
-                    resSub = bsearch(&prefixKey, V4STab, nbSV4, 
+                    resSub = bsearch(&prefixKey, V4STab, nbSV4,
                                      sizeof(struct PrefixV4), prefGlobalCmp);
                     if (resSub != NULL) {
@@ -972 +984 @@
             fprintf(stderr,"S&D %lu.%lu.%lu.%lu/%hu %lu.%lu.%lu.%lu/%hu Rs %lu Ps %lu SNMPin %hu\n",
                     (agCache.v4AdS>>24),
-                    (agCache.v4AdS<<8>>24), 
-                    (agCache.v4AdS<<16>>24), 
-                    (agCache.v4AdS<<24>>24), 
+                    (agCache.v4AdS<<8>>24),
+                    (agCache.v4AdS<<16>>24),
+                    (agCache.v4AdS<<24>>24),
                     (agCache.maskS),
-                    (agCache.v4AdD>>24), 
-                    (agCache.v4AdD<<8>>24), 
-                    (agCache.v4AdD<<16>>24), 
-                    (agCache.v4AdD<<24>>24), 
+                    (agCache.v4AdD>>24),
+                    (agCache.v4AdD<<8>>24),
+                    (agCache.v4AdD<<16>>24),
+                    (agCache.v4AdD<<24>>24),
                     (agCache.maskD),
                     myPtrs->currentRouterPtr->sampled,
@@ -1030 +1042 @@
                     }
                   }
-                  if (res3->sampling == 0 
+                  if (res3->sampling == 0
                       && myPtrs->currentRouterPtr->sampled != 0){
                     res3->sampling = myPtrs->currentRouterPtr->sampled;
@@ -1041 +1053 @@
                 /*              prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD);*/
                 prefixKey.beginning = agCache.v4AdD;
-                res2 = bsearch(&prefixKey, V4PTab, nbPV4, 
+                res2 = bsearch(&prefixKey, V4PTab, nbPV4,
                                sizeof(struct PrefixV4), prefGlobalCmp);
                 if (res2!=NULL){
@@ -1061 +1073 @@
                     ((struct POP *)((myPtrs->matrixPOP)
                                     +((res->routerNb)*ROUTER_INDEX_MAX)
-                                    +((res2->routerNb))))->bytesNb += agCache.bytes; 
+                                    +((res2->routerNb))))->bytesNb += agCache.bytes;
                     ((struct POP *)((myPtrs->matrixPOP)
                                     +((res->routerNb)*ROUTER_INDEX_MAX)
@@ -1072 +1084 @@
                   ((struct POP *)((myPtrs->matrixPOP)
                                   +((res->routerNb)*ROUTER_INDEX_MAX)
-                                  +((res2->routerNb))))->bytesNb += agCache.bytes; 
+                                  +((res2->routerNb))))->bytesNb += agCache.bytes;
                   ((struct POP *)((myPtrs->matrixPOP)
                                   +((res->routerNb)*ROUTER_INDEX_MAX)
-                                  +((res2->routerNb))))->flowNb++; 
-#endif
-                } else { 
+                                  +((res2->routerNb))))->flowNb++;
+#endif
+                } else {
                   /* here we'll make the choice that in multisampling mode,
                    * the virtual POP that represent the reste of world will be
@@ -1085 +1097 @@
                    ((struct POP *)(myPtrs->matrixPOP)
                     +((res->routerNb)*ROUTER_INDEX_MAX)
-                    +((ROUTER_INDEX_MAX-1))))->pktsNb += agCache.pkts*myPtrs->currentRouterPtr->sampled/10; 
+                    +((ROUTER_INDEX_MAX-1))))->pktsNb += agCache.pkts*myPtrs->currentRouterPtr->sampled/10;
                   (
                    ((struct POP *)(myPtrs->matrixPOP)
                     +((res->routerNb)*ROUTER_INDEX_MAX)
-                    +((ROUTER_INDEX_MAX-1))))->bytesNb += agCache.bytes*myPtrs->currentRouterPtr->sampled/10; 
+                    +((ROUTER_INDEX_MAX-1))))->bytesNb += agCache.bytes*myPtrs->currentRouterPtr->sampled/10;
                   (
                    ((struct POP *)(myPtrs->matrixPOP)
@@ -1098 +1110 @@
                    ((struct POP *)(myPtrs->matrixPOP)
                     +((res->routerNb)*ROUTER_INDEX_MAX)
-                    +((ROUTER_INDEX_MAX-1))))->pktsNb += agCache.pkts; 
+                    +((ROUTER_INDEX_MAX-1))))->pktsNb += agCache.pkts;
                   (
                    ((struct POP *)(myPtrs->matrixPOP)
                     +((res->routerNb)*ROUTER_INDEX_MAX)
-                    +((ROUTER_INDEX_MAX-1))))->bytesNb += agCache.bytes; 
+                    +((ROUTER_INDEX_MAX-1))))->bytesNb += agCache.bytes;
                   (
                    ((struct POP *)(myPtrs->matrixPOP)
                     +((res->routerNb)*ROUTER_INDEX_MAX)
                     +((ROUTER_INDEX_MAX-1))))->flowNb++;
-#endif          
+#endif
                 }
                 /* end interpop matrix accounting */
@@ -1121 +1133 @@
             /*      prefixKey.beginning = agCache.v4AdD>>(32-agCache.maskD)<<(32-agCache.maskD); */
             prefixKey.beginning = agCache.v4AdD;
-            res = bsearch(&prefixKey, V4PTab, nbPV4, 
+            res = bsearch(&prefixKey, V4PTab, nbPV4,
                           sizeof(struct PrefixV4), prefGlobalCmp);
             if (res!=NULL){
@@ -1127 +1139 @@
               if (res->hasSubnet == 1) {
                 resSub = NULL;
-                resSub = bsearch(&prefixKey, V4STab, nbSV4, 
+                resSub = bsearch(&prefixKey, V4STab, nbSV4,
                                  sizeof(struct PrefixV4), prefGlobalCmp);
                 if (resSub != NULL) {
@@ -1137 +1149 @@
             fprintf(stderr,"D %lu.%lu.%lu.%lu/%hu %lu.%lu.%lu.%lu/%hu Rs %lu Ps %lu R@ %lu.%lu.%lu.%lu SNMPin %hu\n",
                     (agCache.v4AdS>>24),
-                    (agCache.v4AdS<<8>>24), 
-                    (agCache.v4AdS<<16>>24), 
-                    (agCache.v4AdS<<24>>24), 
+                    (agCache.v4AdS<<8>>24),
+                    (agCache.v4AdS<<16>>24),
+                    (agCache.v4AdS<<24>>24),
                     (agCache.maskS),
-                    (agCache.v4AdD>>24), 
-                    (agCache.v4AdD<<8>>24), 
-                    (agCache.v4AdD<<16>>24), 
-                    (agCache.v4AdD<<24>>24), 
+                    (agCache.v4AdD>>24),
+                    (agCache.v4AdD<<8>>24),
+                    (agCache.v4AdD<<16>>24),
+                    (agCache.v4AdD<<24>>24),
                     (agCache.maskD),
                     myPtrs->currentRouterPtr->sampled,
                     res->sampling,
-                    (myPtrs->pcktPtr->ipH->srcAdd>>24), 
+                    (myPtrs->pcktPtr->ipH->srcAdd>>24),
                     (myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
                     (myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
@@ -1202 +1214 @@
               }
 #endif
-#if defined(IPV4AGGIDR) 
+#if defined(IPV4AGGIDR)
               if ( myPtrs->routersID[res->routerNb] == agCache.routerAd  ) {
 #if defined(MULTISAMPLING)
@@ -1254 +1266 @@
                    ((struct POP *)(myPtrs->matrixPOP)
                     +((ROUTER_INDEX_MAX-1)*ROUTER_INDEX_MAX)
-                    +((res->routerNb))))->pktsNb += agCache.pkts*myPtrs->currentRouterPtr->sampled/10; 
+                    +((res->routerNb))))->pktsNb += agCache.pkts*myPtrs->currentRouterPtr->sampled/10;
                   (
                    ((struct POP *)(myPtrs->matrixPOP)
                     +((ROUTER_INDEX_MAX-1)*ROUTER_INDEX_MAX)
-                    +((res->routerNb))))->bytesNb += agCache.bytes*myPtrs->currentRouterPtr->sampled/10; 
+                    +((res->routerNb))))->bytesNb += agCache.bytes*myPtrs->currentRouterPtr->sampled/10;
                   (
                    ((struct POP *)(myPtrs->matrixPOP)
@@ -1269 +1281 @@
                    ((struct POP *)(myPtrs->matrixPOP)
                     +((ROUTER_INDEX_MAX-1)*ROUTER_INDEX_MAX)
-                    +((res->routerNb))))->pktsNb += agCache.pkts; 
+                    +((res->routerNb))))->pktsNb += agCache.pkts;
                   (
                    ((struct POP *)(myPtrs->matrixPOP)
                     +((ROUTER_INDEX_MAX-1)*ROUTER_INDEX_MAX)
-                    +((res->routerNb))))->bytesNb += agCache.bytes; 
+                    +((res->routerNb))))->bytesNb += agCache.bytes;
                   (
                    ((struct POP *)(myPtrs->matrixPOP)
@@ -1279 +1291 @@
                     +((res->routerNb))))->flowNb++;
 #endif
-#endif  
-              }
-              if (res->sampling == 0 
+#endif
+              }
+              if (res->sampling == 0
                   && myPtrs->currentRouterPtr->sampled != 0 ){
                 res->sampling = myPtrs->currentRouterPtr->sampled;
               }
 #endif
-            } else {
+            } else { /* UNKNOW SUBNET CASE */
               /* UNKNOW SUBNET CASE                                        */
               /*                                                           */
@@ -1295 +1307 @@
               /*     -  prefix not referenced but not allowed to be routed */
               /*     -  spoofing                                           */
-#ifdef PRINTUNKNOWNSUBNET 
+#ifdef PRINTUNKNOWNSUBNET
               fprintf(stderr, "%lu.%lu.%lu.%lu/%hu -> %lu.%lu.%lu.%lu/%hu (R:%lu.%lu.%lu.%lu) \n",
                       (agCache.v4AdS>>24),
-                      (agCache.v4AdS<<8>>24), 
-                      (agCache.v4AdS<<16>>24), 
-                      (agCache.v4AdS<<24>>24), 
-                      (agCache.maskS), 
-                      (agCache.v4AdD>>24), 
-                      (agCache.v4AdD<<8>>24), 
-                      (agCache.v4AdD<<16>>24), 
-                      (agCache.v4AdD<<24>>24), 
-                      (agCache.maskD), 
-                      (myPtrs->pcktPtr->ipH->srcAdd>>24), 
+                      (agCache.v4AdS<<8>>24),
+                      (agCache.v4AdS<<16>>24),
+                      (agCache.v4AdS<<24>>24),
+                      (agCache.maskS),
+                      (agCache.v4AdD>>24),
+                      (agCache.v4AdD<<8>>24),
+                      (agCache.v4AdD<<16>>24),
+                      (agCache.v4AdD<<24>>24),
+                      (agCache.maskD),
+                      (myPtrs->pcktPtr->ipH->srcAdd>>24),
                       (myPtrs->pcktPtr->ipH->srcAdd<<8>>24),
                       (myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
@@ -1331 +1343 @@
           ((struct IndexV6 *)((myPtrs->currentV6IndexTab)
                               +((myPtrs->currentRouterPtr->ID)*MAX_INDEX_BY_ROUTER)
-                              +(agCache.outputSnmp)))->indexSNMP = agCache.outputSnmp; 
+                              +(agCache.outputSnmp)))->indexSNMP = agCache.outputSnmp;
           /* FIXME, error or warning if (indexSNMP != agCache.outputSnmp) */
           ((struct IndexV6 *)((myPtrs->currentV6IndexTab)
@@ -1438 +1450 @@
             myPtrs->currentMIB->ipv6OthersApPcktsNb += agCache.pkts;
             break;
-          }  
+          }
           /* end of mib update */
           isIPv6 = 0;
@@ -1445 +1457 @@
 
         /* DoS DETECTION */
-        if ( ( dosCache.packets*dosCache.sampling > MAX_PKTS_DOS )  
-                  && ((dosCache.packets)/(dosCache.bytes) < RATIO_DOS ) ) {
-                                jdos = 0;
-        posdos = 69*MAX_RULES_PER_FIELD+jdos;
+    if ( dosCache.endTime-dosCache.startTime > 1000 ) {
+      if ( ( (dosCache.packets*dosCache.sampling)/((dosCache.endTime-dosCache.startTime)/1000) > MAX_PKTS_DOS )
+          && ((dosCache.bytes)/(dosCache.packets) < RATIO_DOS ) ) {
+        jdos = 0;
+        posdos = 69*MAX_RULES_PER_FIELD+jdos;
         while ( ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+jdos))) != NULL ) {
-                                        ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+posdos)))->check = 1;
-                                        jdos++;
-                                }
-        }
-
-        /* 
+          ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+posdos)))->check = 1;
+          jdos++;
+        }
+      }
+    } else { /* flow duration <= 1000ms , we divide by 1 (sec) */
+      if ( ( (dosCache.packets*dosCache.sampling) > MAX_PKTS_DOS )
+          & ((dosCache.bytes)/(dosCache.packets) < RATIO_DOS ) ) {
+        jdos = 0;
+        posdos = 69*MAX_RULES_PER_FIELD+jdos;
+        while ( ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+jdos))) != NULL ) {
+          ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+posdos)))->check = 1;
+          jdos++;
+        }
+      }
+    }
+
+        /*
          *
          * SOCKET OUTPUT TO A REMOTE CLIENT
          *
-         * switch the rules definition (check & fieldToRecord), 
+         * switch the rules definition (check & fieldToRecord),
          * we send the flow or a part of the flow to a remote host or a file.
          * In a first time (until release 0.0.7, the information was sent via
@@ -1481 +1505 @@
             /* msg building */
             secondPftmp = tmp->lastField;
-            msgTextIndex = mempcpy(mempcpy(mempcpy(myMsg.text,   
-                                                   &tplMsgType, 
-                                                   sizeof(unsigned short) 
+            msgTextIndex = mempcpy(mempcpy(mempcpy(myMsg.text,
+                                                   &tplMsgType,
+                                                   sizeof(unsigned short)
                                                    ),
                                            &tmpRuleList->id,
                                            sizeof(tmpRuleList->id)
                                            ),
-                                   &myPtrs->currentRouterPtr->IpAddress, 
-                                   sizeof(unsigned long) 
+                                   &myPtrs->currentRouterPtr->IpAddress,
+                                   sizeof(unsigned long)
                                    );
-            msgTextIndex = mempcpy(mempcpy(mempcpy(msgTextIndex, 
-                                                   &tmp->sourceId, 
-                                                   sizeof(unsigned long) 
+            msgTextIndex = mempcpy(mempcpy(mempcpy(msgTextIndex,
+                                                   &tmp->sourceId,
+                                                   sizeof(unsigned long)
                                                    ),
                                            &tmp->templateFlowSetId,
@@ -1500 +1524 @@
                                    myPtrs->ptr_buffer+secondOffset,
                                    flow_size
-                                   ); 
+                                   );
             myMsg.type = 1;
-              
+
 
             /* NEW transfert type */
             for ( ; tmpRL; tmpRL=tmpRL->next){
-              if (tmpRL->id == tmpRuleList->id){        
+              if (tmpRL->id == tmpRuleList->id){
                 s = sendMessage(tmpRL->host->sockId, myMsg.text, sizeof(myMsg.text),
                                 tmpRL->host->hostAddressPtr);
@@ -1519 +1543 @@
           secondPftmp = tmp->lastField;
         } /* end while tmpRuleList */
-        /* 
-         * end redirection 
+        /*
+         * end redirection
          */
         secondOffset = *myPtrs->offsetV9Ptr;
@@ -1533 +1557 @@
         /* not the flow end, progress in field list */
         pftmp = pftmp->prev;
-      }    
+      }
     } /* end of the while on one flow record */
-       
+
     while ( ((*myPtrs->offsetV9Ptr)-48-shift) < data_length ) {
       (*myPtrs->offsetV9Ptr)++; /* if padding */
@@ -1550 +1574 @@
       }
     }
-    while ( (*myPtrs->offsetV9Ptr)-48-shift > data_length ) { 
+    while ( (*myPtrs->offsetV9Ptr)-48-shift > data_length ) {
       (*myPtrs->offsetV9Ptr)--; /* crazy loop (when bug appears in template def) */
       crazyCounter++;
@@ -1558 +1582 @@
 #endif
     if (crazyCounter!=0) { syslog(LOG_INFO,"crazyCounter: %d ", crazyCounter);}
-      
+
 #ifdef DEBUG
     fprintf(stderr,"(%hu,%hu)}", data_length, data_length+shift);
 #endif
-      
+
     return (data_length+shift);
     /* end new place */
@@ -1574 +1598 @@
      *
      */
-    if ((tmpOpt=existTplOptId(myPtrs->currentRouterPtr, myPtrs->currentHeaderV9Ptr->sourceId, 
-                              (*myPtrs->currentFlowsetIdPtr)))!=NULL) {        
+    if ((tmpOpt=existTplOptId(myPtrs->currentRouterPtr, myPtrs->currentHeaderV9Ptr->sourceId,
+                              (*myPtrs->currentFlowsetIdPtr)))!=NULL) {
 
       myPtrs->currentMIB->optDataFlowSetNb += 1;
@@ -1582 +1606 @@
 #endif
       for ( i=0; i<(tmpOpt->optionScopeLg/4); i++){
-        /* FIXME : today we skip the scope fields, it's bad :( */ 
+        /* FIXME : today we skip the scope fields, it's bad :( */
         if ((pftmp=tmpOpt->lastField)!=NULL) {
           for (j=0; j<pftmp->fieldLength; j++) {
-            (*myPtrs->offsetV9Ptr)++; 
+            (*myPtrs->offsetV9Ptr)++;
           }
           pftmp = pftmp->prev;
@@ -1591 +1615 @@
       }
       while (pftmp != NULL) {
-        if (pftmp->fieldLength==1){ 
+        if (pftmp->fieldLength==1){
           buffer1 = *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
         }
-        if (pftmp->fieldLength==2){ 
+        if (pftmp->fieldLength==2){
           buffer2[1]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
           buffer2[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
         }
-        if (pftmp->fieldLength==4){ 
+        if (pftmp->fieldLength==4){
           buffer4[3]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
           buffer4[2]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
@@ -1604 +1628 @@
           buffer4[0]= *(myPtrs->ptr_buffer+(*myPtrs->offsetV9Ptr)); (*myPtrs->offsetV9Ptr)++;
           if (pftmp->fieldType==34||pftmp->fieldType==50){
-            if ((*((unsigned long*)&buffer4)==1) 
+            if ((*((unsigned long*)&buffer4)==1)
                 || (*((unsigned long*)&buffer4)==10)
                 || (*((unsigned long*)&buffer4)==20)
@@ -1634 +1658 @@
             }
           }
-        }       
+        }
         pftmp = pftmp->prev;
       }
@@ -1653 +1677 @@
       return (data_length+shift);
     } else {
-      /* 
-       * template unknown, we skip the data 
+      /*
+       * template unknown, we skip the data
        */
       (*myPtrs->offsetV9Ptr)+=(data_length-4);
@@ -1665 +1689 @@
               (myPtrs->pcktPtr->ipH->srcAdd<<16>>24),
               (myPtrs->pcktPtr->ipH->srcAdd<<24>>24),
-              myPtrs->currentHeaderV9Ptr->sourceId, 
+              myPtrs->currentHeaderV9Ptr->sourceId,
               (*myPtrs->currentFlowsetIdPtr)
               );

trunk/src/dataFlowSet.h

@@ -1 +1 @@
 /*
  * File: dataFlowSet.h
- * 
- * Authors: ANDREU Francois-Xavier 
  *
- * Copyright (C) 2005 - 2010 GIP RENATER 
+ * Authors: ANDREU Francois-Xavier
+ *
+ * Copyright (C) 2005 - 2010 GIP RENATER
  */
 
-/*  This file is part of renetcol. 
+/*  This file is part of renetcol.
  *
  *  renetcol is free software; you can redistribute it and/or modify
@@ -65 +65 @@
   unsigned long v4AdD;
   uint32_t tabAdd6S[4];
-  uint32_t tabAdd6D[4];  
+  uint32_t tabAdd6D[4];
 };
 
@@ -76 +76 @@
   unsigned char ipProt;
   unsigned short sPort;
-  unsigned short dPort;  
+  unsigned short dPort;
   unsigned char sens; /* In/out field 61 */
   unsigned short inputSnmp;
@@ -97 +97 @@
 struct DoSCache {
   unsigned long bytes;
-        unsigned long pkts;
-        unsigned long sampling;
-}
+  unsigned long packets;
+  unsigned long sampling;
+  unsigned long startTime;
+  unsigned long endTime;
+};
 
-short 
-checkDataFlowSet(short, 
+short
+checkDataFlowSet(short,
                  struct MyPtrs *,
                  int,