netflow: log ttl fields

Netflow entry collects the minimum and maximum
time to live during the life of the incoming flow.

This adds those field to a netflow event.

Signed-off-by: Eric Leblond <eric@regit.org>

diff --git a/src/flow-util.c b/src/flow-util.c
index dae4194bd55d7778a0bb387dadd0acafd96d82f5..eadce4769b639e3223d77c0baf2498d14b773abe 100644 (file)
--- a/src/flow-util.c
+++ b/src/flow-util.c
@@ -137,10 +137,12 @@ void FlowInit(Flow *f, const Packet *p)
     if (PKT_IS_IPV4(p)) {
         FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(p, &f->src);
         FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(p, &f->dst);
+        FLOW_SET_IPV4_TTL_FROM_PACKET(p, f);
         f->flags |= FLOW_IPV4;
     } else if (PKT_IS_IPV6(p)) {
         FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET(p, &f->src);
         FLOW_SET_IPV6_DST_ADDR_FROM_PACKET(p, &f->dst);
+        FLOW_SET_IPV6_HLIM_FROM_PACKET(p, f);
         f->flags |= FLOW_IPV6;
     }
 #ifdef DEBUG

diff --git a/src/flow.c b/src/flow.c
index c371b54e16e76620a5eacce92fc55638caec2d81..b859d970553488696a67129bd2c332216df31355 100644 (file)
--- a/src/flow.c
+++ b/src/flow.c
@@ -344,6 +344,24 @@ void FlowHandlePacketUpdate(Flow *f, Packet *p)
         SCLogDebug("setting FLOW_NOPAYLOAD_INSPECTION flag on flow %p", f);
         DecodeSetNoPayloadInspectionFlag(p);
     }
+
+
+    /* update flow's ttl fields if needed */
+    if (PKT_IS_IPV4(p)) {
+        uint8_t ttl = IPV4_GET_IPTTL(p);
+        if (ttl < f->min_ttl) {
+            f->min_ttl = ttl;
+        } else if (ttl > f->max_ttl) {
+            f->max_ttl = ttl;
+        }
+    } else if (PKT_IS_IPV6(p)) {
+        uint8_t ttl = IPV6_GET_HLIM(p);
+        if (ttl < f->min_ttl) {
+            f->min_ttl = ttl;
+        } else if (ttl > f->max_ttl) {
+            f->max_ttl = ttl;
+        }
+    }
 }
 
 /** \brief Entry point for packet flow handling

diff --git a/src/flow.h b/src/flow.h
index 93ca7afc659768466188712e1fc47ad0545541cb..0ecedeee9c63c67d04b2ee4e38e43f485a554d4d 100644 (file)
--- a/src/flow.h
+++ b/src/flow.h
@@ -183,6 +183,16 @@ typedef struct AppLayerParserState_ AppLayerParserState;
         (a)->addr_data32[3] = (p)->ip6h->s_ip6_dst[3];  \
     } while (0)
 
+#define FLOW_SET_IPV4_TTL_FROM_PACKET(p, f) do {    \
+        (f)->min_ttl = IPV4_GET_IPTTL((p));         \
+        (f)->max_ttl = IPV4_GET_IPTTL((p));         \
+    } while (0)
+
+#define FLOW_SET_IPV6_HLIM_FROM_PACKET(p, f) do {   \
+        (f)->min_ttl = IPV6_GET_HLIM((p));          \
+        (f)->max_ttl = IPV6_GET_HLIM((p));          \
+    } while (0)
+
 /* pkt flow flags */
 #define FLOW_PKT_TOSERVER               0x01
 #define FLOW_PKT_TOCLIENT               0x02
@@ -330,6 +340,8 @@ typedef struct Flow_
     };
     uint8_t proto;
     uint8_t recursion_level;
+    uint8_t min_ttl;
+    uint8_t max_ttl;
     uint16_t vlan_id[2];
 
     /** flow hash - the flow hash before hash table size mod. */

diff --git a/src/output-json-netflow.c b/src/output-json-netflow.c
index 9464a15a3f8b70e5c50db80356d820a04bb1fa21..59457b42078a9885fcbaa1e6a6f44a2904fa360d 100644 (file)
--- a/src/output-json-netflow.c
+++ b/src/output-json-netflow.c
@@ -214,6 +214,9 @@ static void JsonNetFlowLogJSONToServer(JsonNetFlowLogThread *aft, json_t *js, Fl
     json_object_set_new(hjs, "age",
             json_integer(age));
 
+    json_object_set_new(hjs, "min_ttl", json_integer(f->min_ttl));
+    json_object_set_new(hjs, "max_ttl", json_integer(f->max_ttl));
+
     json_object_set_new(js, "netflow", hjs);
 
     /* TCP */