netflow9.c 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487
  1. /*
  2. * Copyright 2002 Damien Miller <djm@mindrot.org> All rights reserved.
  3. *
  4. * Redistribution and use in source and binary forms, with or without
  5. * modification, are permitted provided that the following conditions
  6. * are met:
  7. * 1. Redistributions of source code must retain the above copyright
  8. * notice, this list of conditions and the following disclaimer.
  9. * 2. Redistributions in binary form must reproduce the above copyright
  10. * notice, this list of conditions and the following disclaimer in the
  11. * documentation and/or other materials provided with the distribution.
  12. *
  13. * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  14. * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  15. * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  16. * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  17. * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  18. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  19. * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  20. * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  21. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  22. * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  23. */
  24. #include "common.h"
  25. #include "log.h"
  26. #include "treetype.h"
  27. #include "softflowd.h"
  28. #include "netflow9.h"
  29. /* Netflow v.9 */
  30. struct NF9_FLOWSET_HEADER_COMMON {
  31. u_int16_t flowset_id, length;
  32. } __packed;
  33. struct NF9_TEMPLATE_FLOWSET_HEADER {
  34. struct NF9_FLOWSET_HEADER_COMMON c;
  35. u_int16_t template_id, count;
  36. } __packed;
  37. struct NF9_OPTION_TEMPLATE_FLOWSET_HEADER {
  38. struct NF9_FLOWSET_HEADER_COMMON c;
  39. u_int16_t template_id, scope_length, option_length;
  40. } __packed;
  41. struct NF9_TEMPLATE_FLOWSET_RECORD {
  42. u_int16_t type, length;
  43. } __packed;
  44. struct NF9_DATA_FLOWSET_HEADER {
  45. struct NF9_FLOWSET_HEADER_COMMON c;
  46. } __packed;
  47. #define NF9_MIN_RECORD_FLOWSET_ID 256
  48. /* Flowset record types the we care about */
  49. #define NF9_IN_BYTES 1
  50. #define NF9_IN_PACKETS 2
  51. /* ... */
  52. #define NF9_PROTOCOL 4
  53. #define NF9_TOS 5
  54. /* ... */
  55. #define NF9_TCP_FLAGS 6
  56. #define NF9_L4_SRC_PORT 7
  57. #define NF9_IPV4_SRC_ADDR 8
  58. /* ... */
  59. #define NF9_IF_INDEX_IN 10
  60. #define NF9_L4_DST_PORT 11
  61. #define NF9_IPV4_DST_ADDR 12
  62. /* ... */
  63. #define NF9_IF_INDEX_OUT 14
  64. /* ... */
  65. #define NF9_LAST_SWITCHED 21
  66. #define NF9_FIRST_SWITCHED 22
  67. /* ... */
  68. #define NF9_IPV6_SRC_ADDR 27
  69. #define NF9_IPV6_DST_ADDR 28
  70. /* ... */
  71. #define NF9_ICMP_TYPE 32
  72. /* ... */
  73. #define NF9_SRC_VLAN 58
  74. /* ... */
  75. #define NF9_IP_PROTOCOL_VERSION 60
  76. /* Stuff pertaining to the templates that softflowd uses */
  77. #define NF9_SOFTFLOWD_TEMPLATE_NRECORDS 16
  78. struct NF9_SOFTFLOWD_TEMPLATE {
  79. struct NF9_TEMPLATE_FLOWSET_HEADER h;
  80. struct NF9_TEMPLATE_FLOWSET_RECORD r[NF9_SOFTFLOWD_TEMPLATE_NRECORDS];
  81. } __packed;
  82. #define NF9_SOFTFLOWD_OPTION_TEMPLATE_SCOPE_RECORDS 1
  83. #define NF9_SOFTFLOWD_OPTION_TEMPLATE_NRECORDS 2
  84. struct NF9_SOFTFLOWD_OPTION_TEMPLATE {
  85. struct NF9_OPTION_TEMPLATE_FLOWSET_HEADER h;
  86. struct NF9_TEMPLATE_FLOWSET_RECORD
  87. s[NF9_SOFTFLOWD_OPTION_TEMPLATE_SCOPE_RECORDS];
  88. struct NF9_TEMPLATE_FLOWSET_RECORD
  89. r[NF9_SOFTFLOWD_OPTION_TEMPLATE_NRECORDS];
  90. } __packed;
  91. /* softflowd data flowset types */
  92. struct NF9_SOFTFLOWD_DATA_COMMON {
  93. u_int32_t last_switched, first_switched;
  94. u_int32_t bytes, packets;
  95. u_int32_t if_index_in, if_index_out;
  96. u_int16_t src_port, dst_port;
  97. u_int8_t protocol, tcp_flags, ipproto, tos;
  98. u_int16_t icmp_type, vlanid;
  99. } __packed;
  100. struct NF9_SOFTFLOWD_DATA_V4 {
  101. u_int32_t src_addr, dst_addr;
  102. struct NF9_SOFTFLOWD_DATA_COMMON c;
  103. } __packed;
  104. struct NF9_SOFTFLOWD_DATA_V6 {
  105. u_int8_t src_addr[16], dst_addr[16];
  106. struct NF9_SOFTFLOWD_DATA_COMMON c;
  107. } __packed;
  108. struct NF9_SOFTFLOWD_OPTION_DATA {
  109. struct NF9_FLOWSET_HEADER_COMMON c;
  110. u_int32_t scope_ifidx;
  111. u_int32_t sampling_interval;
  112. u_int8_t sampling_algorithm;
  113. u_int8_t padding[3];
  114. } __packed;
  115. /* Local data: templates and counters */
  116. #define NF9_SOFTFLOWD_MAX_PACKET_SIZE 512
  117. #define NF9_SOFTFLOWD_V4_TEMPLATE_ID 1024
  118. #define NF9_SOFTFLOWD_V6_TEMPLATE_ID 2048
  119. #define NF9_SOFTFLOWD_OPTION_TEMPLATE_ID 256
  120. #define NF9_DEFAULT_TEMPLATE_INTERVAL 16
  121. /* ... */
  122. #define NF9_OPTION_SCOPE_SYSTEM 1
  123. #define NF9_OPTION_SCOPE_INTERFACE 2
  124. #define NF9_OPTION_SCOPE_LINECARD 3
  125. #define NF9_OPTION_SCOPE_CACHE 4
  126. #define NF9_OPTION_SCOPE_TEMPLATE 5
  127. static struct NF9_SOFTFLOWD_TEMPLATE v4_template;
  128. static struct NF9_SOFTFLOWD_TEMPLATE v6_template;
  129. static struct NF9_SOFTFLOWD_OPTION_TEMPLATE option_template;
  130. static struct NF9_SOFTFLOWD_OPTION_DATA option_data;
  131. static int nf9_pkts_until_template = -1;
  132. static void
  133. nf9_init_template (void) {
  134. bzero (&v4_template, sizeof (v4_template));
  135. v4_template.h.c.flowset_id = htons (NFLOW9_TEMPLATE_SET_ID);
  136. v4_template.h.c.length = htons (sizeof (v4_template));
  137. v4_template.h.template_id = htons (NF9_SOFTFLOWD_V4_TEMPLATE_ID);
  138. v4_template.h.count = htons (NF9_SOFTFLOWD_TEMPLATE_NRECORDS);
  139. v4_template.r[0].type = htons (NF9_IPV4_SRC_ADDR);
  140. v4_template.r[0].length = htons (4);
  141. v4_template.r[1].type = htons (NF9_IPV4_DST_ADDR);
  142. v4_template.r[1].length = htons (4);
  143. v4_template.r[2].type = htons (NF9_LAST_SWITCHED);
  144. v4_template.r[2].length = htons (4);
  145. v4_template.r[3].type = htons (NF9_FIRST_SWITCHED);
  146. v4_template.r[3].length = htons (4);
  147. v4_template.r[4].type = htons (NF9_IN_BYTES);
  148. v4_template.r[4].length = htons (4);
  149. v4_template.r[5].type = htons (NF9_IN_PACKETS);
  150. v4_template.r[5].length = htons (4);
  151. v4_template.r[6].type = htons (NF9_IF_INDEX_IN);
  152. v4_template.r[6].length = htons (4);
  153. v4_template.r[7].type = htons (NF9_IF_INDEX_OUT);
  154. v4_template.r[7].length = htons (4);
  155. v4_template.r[8].type = htons (NF9_L4_SRC_PORT);
  156. v4_template.r[8].length = htons (2);
  157. v4_template.r[9].type = htons (NF9_L4_DST_PORT);
  158. v4_template.r[9].length = htons (2);
  159. v4_template.r[10].type = htons (NF9_PROTOCOL);
  160. v4_template.r[10].length = htons (1);
  161. v4_template.r[11].type = htons (NF9_TCP_FLAGS);
  162. v4_template.r[11].length = htons (1);
  163. v4_template.r[12].type = htons (NF9_IP_PROTOCOL_VERSION);
  164. v4_template.r[12].length = htons (1);
  165. v4_template.r[13].type = htons (NF9_TOS);
  166. v4_template.r[13].length = htons (1);
  167. v4_template.r[14].type = htons (NF9_ICMP_TYPE);
  168. v4_template.r[14].length = htons (2);
  169. v4_template.r[15].type = htons (NF9_SRC_VLAN);
  170. v4_template.r[15].length = htons (2);
  171. bzero (&v6_template, sizeof (v6_template));
  172. v6_template.h.c.flowset_id = htons (NFLOW9_TEMPLATE_SET_ID);
  173. v6_template.h.c.length = htons (sizeof (v6_template));
  174. v6_template.h.template_id = htons (NF9_SOFTFLOWD_V6_TEMPLATE_ID);
  175. v6_template.h.count = htons (NF9_SOFTFLOWD_TEMPLATE_NRECORDS);
  176. v6_template.r[0].type = htons (NF9_IPV6_SRC_ADDR);
  177. v6_template.r[0].length = htons (16);
  178. v6_template.r[1].type = htons (NF9_IPV6_DST_ADDR);
  179. v6_template.r[1].length = htons (16);
  180. v6_template.r[2].type = htons (NF9_LAST_SWITCHED);
  181. v6_template.r[2].length = htons (4);
  182. v6_template.r[3].type = htons (NF9_FIRST_SWITCHED);
  183. v6_template.r[3].length = htons (4);
  184. v6_template.r[4].type = htons (NF9_IN_BYTES);
  185. v6_template.r[4].length = htons (4);
  186. v6_template.r[5].type = htons (NF9_IN_PACKETS);
  187. v6_template.r[5].length = htons (4);
  188. v6_template.r[6].type = htons (NF9_IF_INDEX_IN);
  189. v6_template.r[6].length = htons (4);
  190. v6_template.r[7].type = htons (NF9_IF_INDEX_OUT);
  191. v6_template.r[7].length = htons (4);
  192. v6_template.r[8].type = htons (NF9_L4_SRC_PORT);
  193. v6_template.r[8].length = htons (2);
  194. v6_template.r[9].type = htons (NF9_L4_DST_PORT);
  195. v6_template.r[9].length = htons (2);
  196. v6_template.r[10].type = htons (NF9_PROTOCOL);
  197. v6_template.r[10].length = htons (1);
  198. v6_template.r[11].type = htons (NF9_TCP_FLAGS);
  199. v6_template.r[11].length = htons (1);
  200. v6_template.r[12].type = htons (NF9_IP_PROTOCOL_VERSION);
  201. v6_template.r[12].length = htons (1);
  202. v6_template.r[13].type = htons (NF9_TOS);
  203. v6_template.r[13].length = htons (1);
  204. v6_template.r[14].type = htons (NF9_ICMP_TYPE);
  205. v6_template.r[14].length = htons (2);
  206. v6_template.r[15].type = htons (NF9_SRC_VLAN);
  207. v6_template.r[15].length = htons (2);
  208. }
  209. static void
  210. nf9_init_option (u_int16_t ifidx, struct OPTION *option) {
  211. bzero (&option_template, sizeof (option_template));
  212. option_template.h.c.flowset_id = htons (NFLOW9_OPTION_TEMPLATE_SET_ID);
  213. option_template.h.c.length = htons (sizeof (option_template));
  214. option_template.h.template_id = htons (NF9_SOFTFLOWD_OPTION_TEMPLATE_ID);
  215. option_template.h.scope_length = htons (sizeof (option_template.s));
  216. option_template.h.option_length = htons (sizeof (option_template.r));
  217. option_template.s[0].type = htons (NF9_OPTION_SCOPE_INTERFACE);
  218. option_template.s[0].length = htons (sizeof (option_data.scope_ifidx));
  219. option_template.r[0].type = htons (NFLOW9_SAMPLING_INTERVAL);
  220. option_template.r[0].length =
  221. htons (sizeof (option_data.sampling_interval));
  222. option_template.r[1].type = htons (NFLOW9_SAMPLING_ALGORITHM);
  223. option_template.r[1].length =
  224. htons (sizeof (option_data.sampling_algorithm));
  225. bzero (&option_data, sizeof (option_data));
  226. option_data.c.flowset_id = htons (NF9_SOFTFLOWD_OPTION_TEMPLATE_ID);
  227. option_data.c.length = htons (sizeof (option_data));
  228. option_data.scope_ifidx = htonl (ifidx);
  229. option_data.sampling_interval = htonl (option->sample);
  230. option_data.sampling_algorithm = NFLOW9_SAMPLING_ALGORITHM_DETERMINISTIC;
  231. }
  232. static int
  233. nf_flow_to_flowset (const struct FLOW *flow, u_char * packet, u_int len,
  234. u_int16_t ifidx, const struct timeval *system_boot_time,
  235. u_int * len_used) {
  236. union {
  237. struct NF9_SOFTFLOWD_DATA_V4 d4;
  238. struct NF9_SOFTFLOWD_DATA_V6 d6;
  239. } d[2];
  240. struct NF9_SOFTFLOWD_DATA_COMMON *dc[2];
  241. u_int freclen, ret_len, nflows;
  242. bzero (d, sizeof (d));
  243. *len_used = nflows = ret_len = 0;
  244. switch (flow->af) {
  245. case AF_INET:
  246. freclen = sizeof (struct NF9_SOFTFLOWD_DATA_V4);
  247. memcpy (&d[0].d4.src_addr, &flow->addr[0].v4, 4);
  248. memcpy (&d[0].d4.dst_addr, &flow->addr[1].v4, 4);
  249. memcpy (&d[1].d4.src_addr, &flow->addr[1].v4, 4);
  250. memcpy (&d[1].d4.dst_addr, &flow->addr[0].v4, 4);
  251. dc[0] = &d[0].d4.c;
  252. dc[1] = &d[1].d4.c;
  253. dc[0]->ipproto = dc[1]->ipproto = 4;
  254. break;
  255. case AF_INET6:
  256. freclen = sizeof (struct NF9_SOFTFLOWD_DATA_V6);
  257. memcpy (&d[0].d6.src_addr, &flow->addr[0].v6, 16);
  258. memcpy (&d[0].d6.dst_addr, &flow->addr[1].v6, 16);
  259. memcpy (&d[1].d6.src_addr, &flow->addr[1].v6, 16);
  260. memcpy (&d[1].d6.dst_addr, &flow->addr[0].v6, 16);
  261. dc[0] = &d[0].d6.c;
  262. dc[1] = &d[1].d6.c;
  263. dc[0]->ipproto = dc[1]->ipproto = 6;
  264. break;
  265. default:
  266. return (-1);
  267. }
  268. dc[0]->first_switched = dc[1]->first_switched =
  269. htonl (timeval_sub_ms (&flow->flow_start, system_boot_time));
  270. dc[0]->last_switched = dc[1]->last_switched =
  271. htonl (timeval_sub_ms (&flow->flow_last, system_boot_time));
  272. dc[0]->bytes = htonl (flow->octets[0]);
  273. dc[1]->bytes = htonl (flow->octets[1]);
  274. dc[0]->packets = htonl (flow->packets[0]);
  275. dc[1]->packets = htonl (flow->packets[1]);
  276. dc[0]->if_index_in = dc[0]->if_index_out = htonl (ifidx);
  277. dc[1]->if_index_in = dc[1]->if_index_out = htonl (ifidx);
  278. dc[0]->src_port = dc[1]->dst_port = flow->port[0];
  279. dc[1]->src_port = dc[0]->dst_port = flow->port[1];
  280. dc[0]->protocol = dc[1]->protocol = flow->protocol;
  281. dc[0]->tcp_flags = flow->tcp_flags[0];
  282. dc[1]->tcp_flags = flow->tcp_flags[1];
  283. dc[0]->tos = flow->tos[0];
  284. dc[1]->tos = flow->tos[1];
  285. if (flow->protocol == IPPROTO_ICMP || flow->protocol == IPPROTO_ICMPV6) {
  286. dc[0]->icmp_type = dc[0]->dst_port;
  287. dc[1]->icmp_type = dc[1]->dst_port;
  288. }
  289. dc[0]->vlanid = dc[1]->vlanid = htons (flow->vlanid[0]);
  290. if (flow->octets[0] > 0) {
  291. if (ret_len + freclen > len)
  292. return (-1);
  293. memcpy (packet + ret_len, &d[0], freclen);
  294. ret_len += freclen;
  295. nflows++;
  296. }
  297. if (flow->octets[1] > 0) {
  298. if (ret_len + freclen > len)
  299. return (-1);
  300. memcpy (packet + ret_len, &d[1], freclen);
  301. ret_len += freclen;
  302. nflows++;
  303. }
  304. *len_used = ret_len;
  305. return (nflows);
  306. }
  307. /*
  308. * Given an array of expired flows, send netflow v9 report packets
  309. * Returns number of packets sent or -1 on error
  310. */
  311. #ifdef ENABLE_LEGACY
  312. int
  313. send_netflow_v9 (struct SENDPARAMETER sp) {
  314. struct FLOW **flows = sp.flows;
  315. int num_flows = sp.num_flows;
  316. u_int16_t ifidx = sp.ifidx;
  317. struct FLOWTRACKPARAMETERS *param = sp.param;
  318. int verbose_flag = sp.verbose_flag;
  319. struct NFLOW9_HEADER *nf9;
  320. struct NF9_DATA_FLOWSET_HEADER *dh;
  321. struct timeval now;
  322. u_int offset, last_af, i, j, num_packets, inc, last_valid;
  323. int r;
  324. u_char packet[NF9_SOFTFLOWD_MAX_PACKET_SIZE];
  325. struct timeval *system_boot_time = &param->system_boot_time;
  326. u_int64_t *flows_exported = &param->flows_exported;
  327. u_int64_t *packets_sent = &param->packets_sent;
  328. struct OPTION *option = &param->option;
  329. if (param->adjust_time)
  330. now = param->last_packet_time;
  331. else
  332. gettimeofday (&now, NULL);
  333. if (nf9_pkts_until_template == -1) {
  334. nf9_init_template ();
  335. nf9_pkts_until_template = 0;
  336. if (option != NULL && option->sample > 1) {
  337. nf9_init_option (ifidx, option);
  338. }
  339. }
  340. last_valid = num_packets = 0;
  341. for (j = 0; j < num_flows;) {
  342. bzero (packet, sizeof (packet));
  343. nf9 = (struct NFLOW9_HEADER *) packet;
  344. nf9->version = htons (9);
  345. nf9->flows = 0; /* Filled as we go, htons at end */
  346. nf9->uptime_ms = htonl (timeval_sub_ms (&now, system_boot_time));
  347. nf9->export_time = htonl (time (NULL));
  348. nf9->od_id = 0;
  349. offset = sizeof (*nf9);
  350. /* Refresh template headers if we need to */
  351. if (nf9_pkts_until_template <= 0) {
  352. memcpy (packet + offset, &v4_template, sizeof (v4_template));
  353. offset += sizeof (v4_template);
  354. nf9->flows++;
  355. memcpy (packet + offset, &v6_template, sizeof (v6_template));
  356. offset += sizeof (v6_template);
  357. nf9->flows++;
  358. if (option != NULL && option->sample > 1) {
  359. memcpy (packet + offset, &option_template, sizeof (option_template));
  360. offset += sizeof (option_template);
  361. nf9->flows++;
  362. memcpy (packet + offset, &option_data, sizeof (option_data));
  363. offset += sizeof (option_data);
  364. nf9->flows++;
  365. }
  366. nf9_pkts_until_template = NF9_DEFAULT_TEMPLATE_INTERVAL;
  367. }
  368. dh = NULL;
  369. last_af = 0;
  370. for (i = 0; i + j < num_flows; i++) {
  371. if (dh == NULL || flows[i + j]->af != last_af) {
  372. if (dh != NULL) {
  373. if (offset % 4 != 0) {
  374. /* Pad to multiple of 4 */
  375. dh->c.length += 4 - (offset % 4);
  376. offset += 4 - (offset % 4);
  377. }
  378. /* Finalise last header */
  379. dh->c.length = htons (dh->c.length);
  380. }
  381. if (offset + sizeof (*dh) > sizeof (packet)) {
  382. /* Mark header is finished */
  383. dh = NULL;
  384. break;
  385. }
  386. dh = (struct NF9_DATA_FLOWSET_HEADER *)
  387. (packet + offset);
  388. dh->c.flowset_id =
  389. (flows[i + j]->af == AF_INET) ?
  390. v4_template.h.template_id : v6_template.h.template_id;
  391. last_af = flows[i + j]->af;
  392. last_valid = offset;
  393. dh->c.length = sizeof (*dh); /* Filled as we go */
  394. offset += sizeof (*dh);
  395. }
  396. r = nf_flow_to_flowset (flows[i + j], packet + offset,
  397. sizeof (packet) - offset, ifidx,
  398. system_boot_time, &inc);
  399. if (r <= 0) {
  400. /* yank off data header, if we had to go back */
  401. if (last_valid)
  402. offset = last_valid;
  403. break;
  404. }
  405. offset += inc;
  406. dh->c.length += inc;
  407. nf9->flows += r;
  408. last_valid = 0; /* Don't clobber this header now */
  409. if (verbose_flag) {
  410. logit (LOG_DEBUG, "Flow %d/%d: "
  411. "r %d offset %d type %04x len %d(0x%04x) "
  412. "flows %d", r, i, j, offset,
  413. dh->c.flowset_id, dh->c.length, dh->c.length, nf9->flows);
  414. }
  415. }
  416. /* Don't finish header if it has already been done */
  417. if (dh != NULL) {
  418. if (offset % 4 != 0) {
  419. /* Pad to multiple of 4 */
  420. dh->c.length += 4 - (offset % 4);
  421. offset += 4 - (offset % 4);
  422. }
  423. /* Finalise last header */
  424. dh->c.length = htons (dh->c.length);
  425. }
  426. param->records_sent += nf9->flows;
  427. nf9->flows = htons (nf9->flows);
  428. nf9->sequence = htonl ((u_int32_t)
  429. ((*packets_sent + num_packets +
  430. 1) & 0x00000000ffffffff));
  431. if (verbose_flag)
  432. logit (LOG_DEBUG, "Sending flow packet len = %d", offset);
  433. if (send_multi_destinations
  434. (sp.target->num_destinations, sp.target->destinations,
  435. sp.target->is_loadbalance, packet, offset) < 0)
  436. return (-1);
  437. num_packets++;
  438. nf9_pkts_until_template--;
  439. j += i;
  440. }
  441. *flows_exported += j;
  442. param->packets_sent += num_packets;
  443. #ifdef ENABLE_PTHREAD
  444. if (use_thread)
  445. free (sp.flows);
  446. #endif /* ENABLE_PTHREAD */
  447. return (num_packets);
  448. }
  449. #endif /* ENABLE_LEGACY */
  450. void
  451. netflow9_resend_template (void) {
  452. if (nf9_pkts_until_template > 0)
  453. nf9_pkts_until_template = 0;
  454. }