Skip to content

Commit 1909b0e

Browse files
mikemiles-devmikemiles-dev
and
mikemiles-dev
authored
031 readme changes (#63)
* Fixed readme changes * Cargo bumo --------- Co-authored-by: mikemiles-dev <[email protected]>
1 parent ecc4e09 commit 1909b0e

File tree

5 files changed

+38
-35
lines changed

5 files changed

+38
-35
lines changed

Cargo.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
[package]
22
name = "netflow_parser"
33
description = "Parser for Netflow Cisco V5, V7, V9, IPFIX"
4-
version = "0.3.1"
4+
version = "0.3.2"
55
edition = "2021"
66
77
license = "MIT OR Apache-2.0"

README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ println!("{}", json!(NetflowParser::default().parse_bytes(&v5_packet)).to_string
3434
## Output:
3535

3636
```json
37-
[{"V5":{"body":{"d_octets":66051,"d_pkts":101124105,"dst_addr":"4.5.6.7","dst_as":515,"dst_mask":5,"dst_port":1029,"first":67438087,"input":515,"last":134807553,"next_hop":"8.9.0.1","output":1029,"pad1":6,"pad2":1543,"protocol":"EGP","src_addr":"0.1.2.3","src_as":1,"src_mask":4,"src_port":515,"tcp_flags":7,"tos":9},"header":{"count":512,"engine_id":7,"engine_type":6,"flow_sequence":33752069,"sampling_interval":2057,"sys_up_time":50332672,"unix_nsecs":134807553,"unix_secs":83887623,"unix_time":{"nanos_since_epoch":134807553,"secs_since_epoch":83887623},"version":5}}}]
37+
[{"V5":{"header":{"count":1,"engine_id":7,"engine_type":6,"flow_sequence":33752069,"sampling_interval":2057,"sys_up_time":{"nanos":672000000,"secs":50332},"unix_nsecs":134807553,"unix_secs":83887623,"version":5},"sets":[{"d_octets":66051,"d_pkts":101124105,"dst_addr":"4.5.6.7","dst_as":515,"dst_mask":5,"dst_port":1029,"first":{"nanos":87000000,"secs":67438},"input":515,"last":{"nanos":553000000,"secs":134807},"next_hop":"8.9.0.1","output":1029,"pad1":6,"pad2":1543,"protocol_number":8,"protocol_type":"Egp","src_addr":"0.1.2.3","src_as":1,"src_mask":4,"src_port":515,"tcp_flags":7,"tos":9}]}}]
3838
```
3939

4040
## Filtering for a specific version
@@ -63,8 +63,8 @@ To access templates flowset of a processed V9/IPFix flowset you can find the `fl
6363

6464
## Features
6565

66-
* unix_timestamp - Current count since 0000 UTC 1970 as Duration.
67-
* parse_unknown_fields - By default fields not listed in the netflow_parser library will not be parsed and an error is thrown for the packet. When set to true the field will be parsed as a vector of bytes.
66+
* unix_timestamp - When enabled a field `unix_time` is provided that uses the flow unix time as a count since 0000 UTC 1970 as Duration.
67+
* parse_unknown_fields - When enabled fields not listed in this library will attempt to be parsed as a Vec of bytes and the field_number listed. When disabled an error is thrown when attempting to parse those fields. Enabled by default.
6868

6969
## Examples
7070

RELEASES.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
# 0.3.2
2+
* Readme changes
3+
14
# 0.3.1
25
* Added 0 length check when parsing template lengths.
36

src/lib.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,8 @@
6161
//!
6262
//! ## Features
6363
//!
64-
//! * unix_timestamp - Current count since 0000 UTC 1970 as Duration.
65-
//! * parse_unknown_fields - By default fields not listed in the netflow_parser library will not be parsed and an error is thrown for the packet. When set to true the field will be parsed as a vector of bytes.
64+
//! * unix_timestamp - When enabled a field `unix_time` is provided that uses the flow unix time as a count since 0000 UTC 1970 as Duration.
65+
//! * parse_unknown_fields - When enabled fields not listed in this library will attempt to be parsed as a Vec of bytes and the field_number listed. When disabled an error is thrown when attempting to parse those fields. Enabled by default.
6666
//!
6767
//! ## Examples
6868
//! Some examples has been included mainly for those who want to use this parser to read from a Socket and parse netflow. In those cases with V9/IPFix it is best to create a new parser for each router. There are both single threaded and multi-threaded examples in the examples directory.
@@ -150,7 +150,7 @@ impl NetflowParser {
150150
/// ## Output:
151151
///
152152
/// ```json
153-
/// [{"V5":{"body":{"d_octets":66051,"d_pkts":101124105,"dst_addr":"4.5.6.7","dst_as":515,"dst_mask":5,"dst_port":1029,"first":67438087,"input":515,"last":134807553,"next_hop":"8.9.0.1","output":1029,"pad1":6,"pad2":1543,"protocol":"EGP","src_addr":"0.1.2.3","src_as":1,"src_mask":4,"src_port":515,"tcp_flags":7,"tos":9},"header":{"count":512,"engine_id":7,"engine_type":6,"flow_sequence":33752069,"sampling_interval":2057,"sys_up_time":50332672,"unix_nsecs":134807553,"unix_secs":83887623,"unix_time":{"nanos_since_epoch":134807553,"secs_since_epoch":83887623},"version":5}}}]
153+
/// [{"V5":{"header":{"count":1,"engine_id":7,"engine_type":6,"flow_sequence":33752069,"sampling_interval":2057,"sys_up_time":{"nanos":672000000,"secs":50332},"unix_nsecs":134807553,"unix_secs":83887623,"version":5},"sets":[{"d_octets":66051,"d_pkts":101124105,"dst_addr":"4.5.6.7","dst_as":515,"dst_mask":5,"dst_port":1029,"first":{"nanos":87000000,"secs":67438},"input":515,"last":{"nanos":553000000,"secs":134807},"next_hop":"8.9.0.1","output":1029,"pad1":6,"pad2":1543,"protocol_number":8,"protocol_type":"Egp","src_addr":"0.1.2.3","src_as":1,"src_mask":4,"src_port":515,"tcp_flags":7,"tos":9}]}}]
154154
/// ```
155155
///
156156
#[inline]

src/variable_versions/v9.rs

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -265,6 +265,34 @@ pub struct Data {
265265
pub data_fields: Vec<BTreeMap<V9Field, FieldValue>>,
266266
}
267267

268+
#[derive(Debug, PartialEq, Clone, Serialize, Nom)]
269+
#[nom(ExtraArgs(field: &TemplateField))]
270+
pub struct OptionDataField {
271+
#[nom(Value(field.field_type))]
272+
pub field_type: V9Field,
273+
#[nom(Map = "|i: &[u8]| i.to_vec()", Take = "field.field_length")]
274+
pub field_value: Vec<u8>,
275+
}
276+
277+
impl Template {
278+
fn get_total_size(&self) -> u16 {
279+
self.fields.iter().fold(0, |acc, i| acc + i.field_length)
280+
}
281+
}
282+
283+
impl FlowSet {
284+
fn is_unparsed(&self) -> bool {
285+
self.body.templates.is_none()
286+
&& self.body.options_templates.is_none()
287+
&& self.body.data.is_none()
288+
&& self.body.options_data.is_none()
289+
}
290+
291+
fn is_empty(&self) -> bool {
292+
self.header.length == 0
293+
}
294+
}
295+
268296
// Custom parse set body function to take only length provided by set header.
269297
fn parse_set_body<'a>(
270298
i: &'a [u8],
@@ -312,34 +340,6 @@ fn parse_flowsets<'a>(
312340
Ok((remaining, flowsets))
313341
}
314342

315-
#[derive(Debug, PartialEq, Clone, Serialize, Nom)]
316-
#[nom(ExtraArgs(field: &TemplateField))]
317-
pub struct OptionDataField {
318-
#[nom(Value(field.field_type))]
319-
pub field_type: V9Field,
320-
#[nom(Map = "|i: &[u8]| i.to_vec()", Take = "field.field_length")]
321-
pub field_value: Vec<u8>,
322-
}
323-
324-
impl Template {
325-
fn get_total_size(&self) -> u16 {
326-
self.fields.iter().fold(0, |acc, i| acc + i.field_length)
327-
}
328-
}
329-
330-
impl FlowSet {
331-
fn is_unparsed(&self) -> bool {
332-
self.body.templates.is_none()
333-
&& self.body.options_templates.is_none()
334-
&& self.body.data.is_none()
335-
&& self.body.options_data.is_none()
336-
}
337-
338-
fn is_empty(&self) -> bool {
339-
self.header.length == 0
340-
}
341-
}
342-
343343
fn parse_options_template_vec(i: &[u8]) -> IResult<&[u8], Vec<OptionsTemplate>> {
344344
let mut fields = vec![];
345345
let mut remaining = i;

0 commit comments

Comments
 (0)