cors-ft-aggregate.c File Reference

Code which uses libcorsaro to convert an corsaro output file to ascii. More...

Go to the source code of this file.

Macros
#define	SRC_IP   0
#define	DST_IP   1
#define	SRC_PORT   2
#define	DST_PORT   3
#define	PROTO   4
#define	TTL   5
#define	TCP_FLAGS   6
#define	IP_LEN   7
#define	VALUE   8
#define	FIELD_CNT   9
#define	FIELD_ENABLED   1

Functions
	KHASH_INIT (sixt_map, corsaro_flowtuple_t *, kh_64xx_t *, 1, corsaro_flowtuple_hash_func, corsaro_flowtuple_hash_equal)
	Initialize the hash functions and datatypes.
	KHASH_INIT (sixt_int, corsaro_flowtuple_t *, char, 0, corsaro_flowtuple_hash_func, corsaro_flowtuple_hash_equal)
	Hash to use when we are aggregating on packets.
static void	clean ()
static int	init_corsaro (char *corsarouri)
static int	add_inc (void *h, corsaro_flowtuple_t *t, uint32_t value)
	Either add the given flowtuple to the hash, or add the value to the map.
static void	dump_hash_map (kh_sixt_map_t *hash)
static void	dump_hash_int (kh_sixt_int_t *hash)
static void	dump_hash ()
static int	process_flowtuple (corsaro_flowtuple_t *tuple)
static void	usage (const char *name)
int	main (int argc, char *argv[])

Variables
static kh_sixt_map_t *	sixt_f = NULL
static kh_sixt_int_t *	sixt_v = NULL
static corsaro_in_t *	corsaro = NULL
static corsaro_in_record_t *	record = NULL
static int	interval = 0
	The amount of time to wait until we dump the hash.
static char *	field_names []
static int	legacy = 0
static int	fields [FIELD_CNT]
static int	value_field = -1
static uint64_t	flowtuple_cnt = 0
	The number of flowtuple records we have processed.
static corsaro_interval_t	last_dump_end
	the END time of the interval that we last dumped data
static int	next_interval = 0
	The time that we need to dump the next interval at.
static corsaro_interval_t	last_interval_end
	The time that the last interval ended.

---

Detailed Description

Code which uses libcorsaro to convert an corsaro output file to ascii.

Author:

Alistair King

Definition in file cors-ft-aggregate.c.

---

Function Documentation

static int add_inc ( void *  h, corsaro_flowtuple_t *  t, uint32_t  value  )

static

Either add the given flowtuple to the hash, or add the value to the map.

Definition at line 165 of file cors-ft-aggregate.c.

KHASH_INIT	(	sixt_map	,
		corsaro_flowtuple_t *	,
		kh_64xx_t *	,
		1	,
		corsaro_flowtuple_hash_func	,
		corsaro_flowtuple_hash_equal
	)

Initialize the hash functions and datatypes.

KHASH_INIT	(	sixt_int	,
		corsaro_flowtuple_t *	,
		char	,
		0	,
		corsaro_flowtuple_hash_func	,
		corsaro_flowtuple_hash_equal
	)

Hash to use when we are aggregating on packets.

int main	(	int	argc,
		char *	argv[]
	)

The name of the file which contains the list of input files

A pointer to the file which contains the list of input files

The file currently being processed by corsaro

Definition at line 410 of file cors-ft-aggregate.c.

References corsaro_flowtuple_free(), corsaro_in_get_record_data(), corsaro_in_read_record(), CORSARO_IN_RECORD_TYPE_FLOWTUPLE_FLOWTUPLE, CORSARO_IN_RECORD_TYPE_IO_INTERVAL_END, CORSARO_IN_RECORD_TYPE_IO_INTERVAL_START, CORSARO_IN_RECORD_TYPE_NULL, interval, and corsaro_interval::time.

---

Variable Documentation

char* field_names[]

static

Initial value:

 {
  "src_ip",
  "dst_ip",
  "src_port",
  "dst_port",
  "protocol",
  "ttl",
  "tcp_flags",
  "ip_len",
  "packet_cnt",
}

Definition at line 82 of file cors-ft-aggregate.c.

uint64_t flowtuple_cnt = 0

static

The number of flowtuple records we have processed.

Definition at line 101 of file cors-ft-aggregate.c.

int interval = 0

static

The amount of time to wait until we dump the hash.

Definition at line 66 of file cors-ft-aggregate.c.

Referenced by main().

corsaro_interval_t last_dump_end

static

Initial value:

 {
  CORSARO_MAGIC,
  CORSARO_MAGIC_INTERVAL,
  0,
  0
}

the END time of the interval that we last dumped data

Definition at line 104 of file cors-ft-aggregate.c.

corsaro_interval_t last_interval_end

static

Initial value:

 {
  CORSARO_MAGIC,
  CORSARO_MAGIC_INTERVAL,
  0,
  0
}

The time that the last interval ended.

Definition at line 114 of file cors-ft-aggregate.c.

int next_interval = 0

static

The time that we need to dump the next interval at.

Definition at line 112 of file cors-ft-aggregate.c.