CERT/CC
background
background
CERT NetSA Security Suite 
Open Source Tools for Network Monitoring 
News | Downloads | Documentation | Tooltips
SiLK 1.1.2 | YAF 1.0.0 | IPA 0.3.0 | fixbuf 0.8.0 | Portal 0.8.0 | RAVE 1.9.11
NAF Core Library
libnaf 0.6.0 API documentation

Main Page | Data Structures | File List | Data Fields | Globals

_NAFAggConfig Struct Reference

An aggregation configuration structure. More...

#include <exparse.h>


Data Fields

NAFTimeSec horizon
 Horizon in seconds.
uint32_t srcid
 observationDomainID of exported records.
NAFTimeSec binsize
 Bin size in seconds.
uint32_t binalg
 Bin algorithm.
gboolean uniflow_mode
 TRUE to disable biflow matching in naf_mtab_add().
GArray * perimeter
 Rangelist defining the perimeter for perimeter biflow mode.
NAFilter prefilter
 Filter applied to binned flows in the matching stage.
uint32_t fanout
 Fanout.
NAFilter filter [NAFZ_MAX_FANOUT]
 Array of filters to apply to flows before aggregation, for each mask.
NAFSorter sorter [NAFZ_MAX_FANOUT]
 Array of sorters to apply after aggregation, for each mask.
NAFlowMask mask [NAFZ_MAX_FANOUT]
 Array of aggregation masks.
char * label [NAFZ_MAX_FANOUT]
 Array of aggregation labels for each mask.

Detailed Description

An aggregation configuration structure.

Filled in by naf_exparse() and by the application; used by the aggregation and match APIs.


Field Documentation

uint32_t _NAFAggConfig::binalg
 

Bin algorithm.

One of the NAF_BA_* constants from nafcore.h.

uint32_t _NAFAggConfig::fanout
 

Fanout.

Aggregations to perform simultaneously; this is the count of valid entries in each of the filter, sorter, mask, and label arrays.

NAFTimeSec _NAFAggConfig::horizon
 

Horizon in seconds.

The bintable will store flows for this long; this should be larger than the active timeout interval for the flow sensor from which raw flows are generated. This should be an even multiple of binsize, and is NOT filled in by naf_exparse().

uint32_t _NAFAggConfig::srcid
 

observationDomainID of exported records.

NOT filled in by naf_exparse()

gboolean _NAFAggConfig::uniflow_mode
 

TRUE to disable biflow matching in naf_mtab_add().

Not filled in by naf_exparse().


The documentation for this struct was generated from the following file: