dynflow.h File Reference

NAF Flow Dynamics routines. More...

#include <naf/autoinc.h>
#include <naf/nafcore.h>


Functions
NAFlowKey *	naf_flowkey_alloc (GMemChunk keychunk, NAFlowKey key)
	Allocate a new flow key in a given memory chunk.
NAFlowVal *	naf_flowval_alloc (GMemChunk valchunk, NAFlowVal val)
	Allocate a new flow value in a given memory chunk.
NAFlowVUC *	naf_flowvuc_alloc (GMemChunk *vucchunk)
	Allocate a new flow value unique counter structure in a given memory chunk.
NAFlow *	naf_flow_alloc (GMemChunk flowchunk, NAFlowKey key, NAFlowVal *val)
	Allocate a new full flow in a given memory chunk.
uint32_t	naf_flowkey_hash (NAFlowKey *key)
	Hash a flow key.
gboolean	naf_flowkey_equal (NAFlowKey a, NAFlowKey b)
	Compare two flow keys for equality.
int	naf_flowkey_cmp (const void a, const void b, void *u)
	Compare two flow keys for order.
void	naf_flowkey_mask (NAFlowKey in, NAFlowKey out, NAFlowMask *mask)
	Copy and mask a flow key.
void	naf_flowkey_reverse (NAFlowKey in, NAFlowKey out)
	Copy and reverse a flow key.
void	naf_flowval_reverse (NAFlowVal in, NAFlowVal out)
	Copy and reverse a flow value.
NAFTimeSec	naf_bin_time (NAFTimeSec tv, NAFTimeSec size)
	Convert a time to a bin number given a bin size.

Detailed Description

NAF Flow Dynamics routines.

Provides dynamic allocation of flow structures and utility routines for manipulating and modifying flows.

Function Documentation

NAFTimeSec naf_bin_time	(	NAFTimeSec	tv,
		NAFTimeSec	size
	)

Convert a time to a bin number given a bin size.

A bin number is simply the largest whole multiple of the bin size in seconds less than the given time.

Parameters:

	tv	time to bin
	size	bin size

Returns:: binned time

NAFlow* naf_flow_alloc	(	GMemChunk *	flowchunk,
		NAFlowKey *	key,
		NAFlowVal *	val
	)

Allocate a new full flow in a given memory chunk.

Optionally copy the given key and value into the new value. Does not deep copy value unique counters; VUC should be NULL.

Parameters:

	flowchunk	GMemChunk to allocate full flow in
	key	key to copy into full flow, or NULL.
	val	value to copy into full flow, or NULL.

Returns:: a new full flow

NAFlowKey* naf_flowkey_alloc	(	GMemChunk *	keychunk,
		NAFlowKey *	key
	)

Allocate a new flow key in a given memory chunk.

Optionally copy the given key into the new key.

Parameters:

	keychunk	GMemChunk to allocate key in
	key	optional key to copy into new key, or NULL.

Returns:: a new flow key

int naf_flowkey_cmp	(	const void *	a,
		const void *	b,
		void *	u
	)

Compare two flow keys for order.

This function enforces standard nafalize output order - in ascending order by bin, source ID, source IP, source IP mask length, destination IP, destination IP mask length, protocol, source transport port, and destination transport port. Pass this to g_tree_new(), g_tree_new_full(), or g_tree_new_with_data() to store flows in balanced binary tree.

Parameters:

	a	flow key to compare
	b	another flow key to compare
	u	comparison context; ignored

Returns:: Positive if a > b, negative if a < b, 0 if a == b.

gboolean naf_flowkey_equal	(	NAFlowKey *	a,
		NAFlowKey *	b
	)

Compare two flow keys for equality.

Pass this to g_hash_table_new() or g_hash_table_new_full() to store flows in a hash table.

Parameters:

	a	flow key to compare
	b	another flow key to compare

Returns:: TRUE if the keys are equal, FALSE otherwise.

uint32_t naf_flowkey_hash ( NAFlowKey * key )

Hash a flow key.

Pass this to g_hash_table_new() or g_hash_table_new_full() to store flows in a hash table.

Parameters:

key

flow key to hash

Returns:: hash of the given flow key.

void naf_flowkey_mask	(	NAFlowKey *	in,
		NAFlowKey *	out,
		NAFlowMask *	mask
	)

Copy and mask a flow key.

Uses the field mask and sip and dip masks of the given mask; all masked out fields in the destination are set to 0. Forces all IP masks in the destination to an upper bound of the ip masks in the mask. May modify the mask to fill in mask bits. May be used to mask a key in place if in and out point to the same key.

Parameters:

	in	pointer to key to mask
	out	pointer to key buffer to copy masked key into
	mask	mask to use

void naf_flowkey_reverse	(	NAFlowKey *	in,
		NAFlowKey *	out
	)

Copy and reverse a flow key.

Swaps source and destination linked fields; does not swap ports if protocol is ICMP, because NAF defines the source port to 0 and the destination port to contain the ICMP type and code for ICMP aggregate flows. May be used to reverse a key in place if in and out point to the same key.

Parameters:

	in	pointer to key to reverse
	out	pointer to key buffer to copy reversed key into

NAFlowVal* naf_flowval_alloc	(	GMemChunk *	valchunk,
		NAFlowVal *	val
	)

Allocate a new flow value in a given memory chunk.

Optionally copy the given value into the new value. Does not deep copy value unique counters; VUC should be NULL.

Parameters:

	valchunk	GMemChunk to allocate value in
	val	optional value to copy into new value, or NULL.

Returns:: a new flow value

void naf_flowval_reverse	(	NAFlowVal *	in,
		NAFlowVal *	out
	)

Copy and reverse a flow value.

Swaps source and destination linked fields; must be used on a value without value unique counters. May be used to reverse a value in place if in and out point to the same value.

Parameters:

	in	pointer to value to reverse
	out	pointer to value buffer to copy reversed value into

NAFlowVUC* naf_flowvuc_alloc ( GMemChunk * vucchunk )

Allocate a new flow value unique counter structure in a given memory chunk.

The returned VUC is initialized to zero.

Parameters:

vucchunk

GMemChunk to allocate value unique counter structure in

Returns:: a new flow value unique counter structure

dynflow.h File Reference

Functions

Detailed Description

Function Documentation