Examples with NetFlowV9Packet org.graylog.plugins.netflow.v9.NetFlowV9Packet used on opensource projects

Example 1 with NetFlowV9Packet

use of org.graylog.plugins.netflow.v9.NetFlowV9Packet in project graylog2-server by Graylog2.

the class NetflowV9CodecAggregatorTest method pcap_fortinet_NetFlowV9.

@Test
public void pcap_fortinet_NetFlowV9() throws Exception {
    final List<NetFlowV9BaseRecord> allRecords = new ArrayList<>();
    final List<NetFlowV9Template> allTemplates = new ArrayList<>();
    final Collection<NetFlowV9Packet> packets = parseNetflowPcapStream("netflow-data/fgt300d-netflow9.pcap");
    packets.forEach(packet -> {
        List<NetFlowV9BaseRecord> recs = packet.records();
        allRecords.addAll(packet.records());
        allTemplates.addAll(packet.templates());
    });
    assertThat(allRecords).hasSize(146);
    assertThat(allTemplates).hasSize(12);
    NetFlowV9BaseRecord foo = allRecords.iterator().next();
    assertThat(allRecords).contains(NetFlowV9Record.create(ImmutableMap.<String, Object>builder().put("in_bytes", 371L).put("out_bytes", 371L).put("in_pkts", 2L).put("out_pkts", 2L).put("ipv4_src_addr", "98.158.128.103").put("ipv4_dst_addr", "172.30.1.154").put("l4_src_port", 32161).put("l4_dst_port", 38461).put("protocol", (short) 17).put("field_65", 3141).put("forwarding_status", (short) 64).put("flow_end_reason", (short) 2).put("input_snmp", 5).put("output_snmp", 15).put("first_switched", 2056606986L).put("last_switched", 2056787066L).put("xlate_src_addr_ipv4", "0.0.0.0").put("xlate_dst_addr_ipv4", "139.60.168.65").put("xlate_src_port", 0).put("xlate_dst_port", 38461).build()));
}

Example 2 with NetFlowV9Packet

use of org.graylog.plugins.netflow.v9.NetFlowV9Packet in project graylog2-server by Graylog2.

the class NetFlowCodec method decodeV9Packets.

@VisibleForTesting
List<NetFlowV9Packet> decodeV9Packets(ByteBuf buffer) throws InvalidProtocolBufferException {
    byte[] v9JournalEntry = new byte[buffer.readableBytes()];
    buffer.readBytes(v9JournalEntry);
    final NetFlowV9Journal.RawNetflowV9 rawNetflowV9 = NetFlowV9Journal.RawNetflowV9.parseFrom(v9JournalEntry);
    // parse all templates used in the packet
    final Map<Integer, NetFlowV9Template> templateMap = Maps.newHashMap();
    rawNetflowV9.getTemplatesMap().forEach((templateId, byteString) -> {
        final NetFlowV9Template netFlowV9Template = NetFlowV9Parser.parseTemplate(Unpooled.wrappedBuffer(byteString.toByteArray()), typeRegistry);
        templateMap.put(templateId, netFlowV9Template);
    });
    final NetFlowV9OptionTemplate[] optionTemplate = { null };
    rawNetflowV9.getOptionTemplateMap().forEach((templateId, byteString) -> {
        optionTemplate[0] = NetFlowV9Parser.parseOptionTemplate(Unpooled.wrappedBuffer(byteString.toByteArray()), typeRegistry);
    });
    return rawNetflowV9.getPacketsList().stream().map(bytes -> Unpooled.wrappedBuffer(bytes.toByteArray())).map(buf -> NetFlowV9Parser.parsePacket(buf, typeRegistry, templateMap, optionTemplate[0])).collect(Collectors.toList());
}

Example 3 with NetFlowV9Packet

use of org.graylog.plugins.netflow.v9.NetFlowV9Packet in project graylog2-server by Graylog2.

the class NetflowV9CodecAggregatorTest method parseNetflowPcapStream.

private Collection<NetFlowV9Packet> parseNetflowPcapStream(String resourceName) throws IOException {
    final List<NetFlowV9Packet> allPackets = Lists.newArrayList();
    try (InputStream inputStream = Resources.getResource(resourceName).openStream()) {
        final Pcap pcap = Pcap.openStream(inputStream);
        pcap.loop(packet -> {
            if (packet.hasProtocol(Protocol.UDP)) {
                final UDPPacket udp = (UDPPacket) packet.getPacket(Protocol.UDP);
                final InetSocketAddress source = new InetSocketAddress(udp.getParentPacket().getSourceIP(), udp.getSourcePort());
                final CodecAggregator.Result result = codecAggregator.addChunk(Unpooled.copiedBuffer(udp.getPayload().getArray()), source);
                if (result.isValid() && result.getMessage() != null) {
                    final ByteBuf buffer = result.getMessage();
                    // must read the marker byte off the buffer first.
                    buffer.readByte();
                    allPackets.addAll(codec.decodeV9Packets(buffer));
                }
            }
            return true;
        });
    }
    return allPackets;
}