diff --git a/src/sflow.h b/src/sflow.h index c1301e5..9d1a816 100644 --- a/src/sflow.h +++ b/src/sflow.h @@ -602,6 +602,14 @@ typedef struct _SFLExtended_decap { uint32_t innerHeaderOffset; } SFLExtended_decap; +/* Software function */ +/* Name of software function generating this event */ +/* opaque = flow_data; enterprise = 0; format = 1038 */ +typedef struct _SFLExtended_function { + SFLString symbol; +} SFLExtended_function; +#define SFL_MAX_FUNCTION_SYMBOL_LEN 64 + enum SFLFlow_type_tag { /* enterprise = 0, format = ... */ SFLFLOW_HEADER = 1, /* Packet headers are sampled */ @@ -635,6 +643,7 @@ enum SFLFlow_type_tag { SFLFLOW_EX_DECAP_IN = 1028, SFLFLOW_EX_VNI_OUT = 1029, SFLFLOW_EX_VNI_IN = 1030, + SFLFLOW_EX_FUNCTION = 1038, SFLFLOW_EX_SOCKET4 = 2100, SFLFLOW_EX_SOCKET6 = 2101, SFLFLOW_EX_PROXYSOCKET4 = 2102, @@ -683,6 +692,7 @@ typedef union _SFLFlow_type { SFLExtended_decap tunnel_decap; SFLExtended_TCP_info tcp_info; SFLExtended_entities entities; + SFLExtended_function function; } SFLFlow_type; typedef struct _SFLFlow_sample_element { diff --git a/src/sflowtool.c b/src/sflowtool.c index dd38c4c..a031317 100644 --- a/src/sflowtool.c +++ b/src/sflowtool.c @@ -3481,6 +3481,20 @@ static void readExtendedEntities(SFSample *sample) sf_log_next32(sample, "entities_dst_index"); } +/*_________________----------------------------__________________ + _________________ readExtendedFunction __________________ + -----------------____________________________------------------ +*/ + +static void readExtendedFunction(SFSample *sample) +{ + sf_logf(sample, "extendedType", "function"); + char fnSymbol[SFL_MAX_FUNCTION_SYMBOL_LEN+1]; + if(getString(sample, fnSymbol, SFL_MAX_FUNCTION_SYMBOL_LEN) > 0) { + sf_logf(sample, "symbol", fnSymbol); + } +} + /*_________________---------------------------__________________ _________________ readFlowSample_v2v4 __________________ -----------------___________________________------------------ @@ -3843,6 +3857,7 @@ static void readDiscardSample(SFSample *sample) // TODO: separate fn for flow-sample elements? switch(tag) { case SFLFLOW_HEADER: readFlowSample_header(sample); break; + case SFLFLOW_EX_FUNCTION: readExtendedFunction(sample); break; default: skipTLVRecord(sample, tag, length, "discard_sample_element"); break; } lengthCheck(sample, "discard_sample_element", start, length);