/* * Aggreate flows to different ASes see the Intra-AS Traffic * */ #include #include #include #include #include #include #include #include #include #include #include #include "types.h" #include "convert.h" #define FREENODE (struct nodetype *)calloc(sizeof(struct nodetype),1) #define FREELEAF (struct nodetype *)calloc(sizeof(struct leaftype),1) #define MAXAS 65536 struct nodetype { int as; struct nodetype *next[256]; } *root; struct leaftype { int as; } leaf; struct addrtype { unsigned char d[4]; } addr; int matchip(unsigned int ip) { int d1, d2, d3, d4 = 0; int as = 0; d1 = ip >> 24; d2 = (ip >> 16) & 0xff; d3 = (ip >> 8) & 0xff; d4 = ip & 0xff; /* printf("Match:%d.%d.%d.%d\n",d1,d2,d3,d4); */ if (NULL != root->next[d1]) if (NULL != root->next[d1]->next[d2]) if (NULL != root->next[d1]->next[d2]->next[d3]) as = root->next[d1]->next[d2]->next[d3]->as; else as = root->next[d1]->next[d2]->as; else as = root->next[d1]->as; else as = 0; /* * if (8739==as) printf("Match:%d.%d.%d.%d\n",d1,d2,d3,d4); */ return as; } int read_routen() { FILE *in; int ipaddr; int prefix; unsigned int d1, d2, d3, d4; char inet[20]; char as[20]; unsigned int counter, sublevel; in = fopen("routen", "r"); if (!in) { perror("Open routen"); exit(1); } root = FREENODE; while (!feof(in)) { fscanf(in, "%s%s\n", inet, as); d1 = d2 = d3 = d4 = prefix = 0; sscanf(inet, "%d.%d.%d.%d/%d\n", &d1, &d2, &d3, &d4, &prefix); if (prefix > 24) { fprintf(stderr, "%d.%d.%d.%d/%d %s Ignored\n", d1, d2, d3, d4, prefix, as); goto skip; } ipaddr = (d1 << 24) | (d2 << 16) | (d3 << 8) | d4; if (0 == prefix) { /* Default Netzmaske berechnen */ if (IN_CLASSA(ipaddr)) prefix = 8; if (IN_CLASSB(ipaddr)) prefix = 16; if (IN_CLASSC(ipaddr)) prefix = 24; } sublevel = 1 << ((32 - prefix) % 8); /* Insert in Tree */ /* printf("%d.%d.%d.%d/%d %s\n",d1,d2,d3,d4,prefix,as); */ if (NULL == root->next[d1]) { root->next[d1] = FREENODE; if (8 == prefix) { root->next[d1]->as = atol(as); goto skip; } } if ((prefix > 8) && (prefix < 16)) { for (counter = d2; counter < (d2 + sublevel); counter++) { /* printf("%d.%d\n",d1,counter); */ if (NULL == root->next[d1]->next[counter]) { root->next[d1]->next[counter] = FREENODE; root->next[d1]->next[counter]->as = atol(as); /* * printf("Insert:%s * %d.%d.0.0/16\n",as,d1,counter); */ } } } if (NULL == root->next[d1]->next[d2]) { root->next[d1]->next[d2] = FREENODE; if (16 == prefix) { root->next[d1]->next[d2]->as = atol(as); goto skip; } } if ((prefix > 16) && (prefix < 24)) { for (counter = d3; counter < (d3 + sublevel); counter++) { /* printf("%d.%d.%d\n",d1,d2,counter); */ if (NULL == root->next[d1]->next[d2]->next[counter]) { root->next[d1]->next[d2]->next[counter] = FREELEAF; root->next[d1]->next[d2]->next[counter]->as = atol(as); /* * printf("Insert:%s * %d.%d.%d.0/24\n",as,d1,d2,counter); * */ } } } if (NULL == root->next[d1]->next[d2]->next[d3]) { root->next[d1]->next[d2]->next[d3] = FREELEAF; if (24 == prefix) { root->next[d1]->next[d2]->next[d3]->as = atol(as); goto skip; } } skip: { } } return 0; } struct astraffic { long long int in; long long int out; } traffic[MAXAS]; struct accttype { unsigned int from; unsigned int to; unsigned int bytes; } newacct; int goto_hell() { int i; for (i = 0; i < MAXAS; i++) { if ((traffic[i].in > 4096) || (traffic[i].out > 4096)) printf("%d %qd %qd\n", i, traffic[i].in, traffic[i].out); } return 0; } int process_file(char *filename) { int fromas, toas; int i = 0; unsigned int rc; struct v4header hdr; struct v4flow flow; int fd; fd = open(filename, O_RDONLY); if (fd < 1) { perror("open"); exit(1); } if (sizeof(struct v4header) != read(fd, &hdr, sizeof(struct v4header))) { fprintf(stderr, "Couldn't read header\n"); exit(1); } if (4 != hdr.MajVersion) { fprintf(stderr, "No v4 Flowfiles\n"); exit(1); } while ((rc = read(fd, &flow, sizeof(struct v4flow)))) { if (rc != sizeof(struct v4flow)) { fprintf(stderr, "corrupt data goto hell\n"); fprintf(stderr, "Read:%d of %d\n", rc, sizeof(struct v4flow)); perror("Read_data"); goto_hell(); } toas = matchip(ntohl(flow.dst)); fromas = matchip(ntohl(flow.src)); /* From */ traffic[fromas].out += ntohl(flow.sdbytes); traffic[toas].in += ntohl(flow.sdbytes); /* To */ traffic[fromas].in += ntohl(flow.dsbytes); traffic[toas].out += ntohl(flow.dsbytes); i++; if (0 == i % 10000) fprintf(stderr, "%d\n", i); } return 0; } int main(int argc, char **argv) { struct stat sb; DIR *mydir; struct dirent *dp; if (2 != argc) { fprintf(stderr, "%s \n", *argv); exit(1); } if (0 != stat(*(argv + 1), &sb)) { perror("Stat"); exit(1); } bzero(traffic, sizeof(traffic)); read_routen(); if (sb.st_mode & S_IFREG) { printf("Regular File\n"); process_file(*(argv + 1)); } else if (sb.st_mode & S_IFDIR) { printf("Directory:%s\n",*(argv+1)); chdir(*(argv + 1)); mydir = opendir("."); if (!mydir) { perror("Opendir"); exit(1); } while ((dp = readdir(mydir)) != NULL) { if (0 == strncmp("flow.", dp->d_name, 5)) { fprintf(stderr, "Flowfile:%s\n", dp->d_name); fflush(stdout); process_file(dp->d_name); } else { /* Unknown File */ fprintf(stderr, "Uknkown Filetype:%s\n", dp->d_name); } } closedir(mydir); } goto_hell(); return 0; }