Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add IP ToS support for Flow Handler #649

Merged
merged 2 commits into from
Mar 24, 2023
Merged

Add IP ToS support for Flow Handler #649

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e97ed6c
Add IP ToS support for Flow Handler
Mar 23, 2023
a74ba31
replace tos with dscp top metrics
Mar 23, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 59 additions & 0 deletions src/handlers/flow/Dscp.h
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at https://mozilla.org/MPL/2.0/. */

#pragma once

#include <unordered_map>
namespace visor::handler::flow {

static std::unordered_map<uint8_t, std::string> DscpNames({
{0, "CS0"},
{8, "CS1"},
{16, "CS2"},
{24, "CS3"},
{32, "CS4"},
{40, "CS5"},
{48, "CS6"},
{56, "CS7"},
{10, "AF11"},
{12, "AF12"},
{14, "AF13"},
{18, "AF21"},
{20, "AF22"},
{22, "AF23"},
{26, "AF31"},
{28, "AF32"},
{30, "AF33"},
{34, "AF41"},
{36, "AF42"},
{38, "AF43"},
{46, "EF"},
{43, "VOICE-ADMIT"},
});

static std::unordered_map<std::string, uint8_t> DscpNumbers({
{"CS0", 0},
{"CS1", 8},
{"CS2", 16},
{"CS3", 24},
{"CS4", 32},
{"CS5", 40},
{"CS6", 48},
{"CS7", 56},
{"AF11", 10},
{"AF12", 12},
{"AF13", 14},
{"AF21", 18},
{"AF22", 20},
{"AF23", 22},
{"AF31", 26},
{"AF32", 28},
{"AF33", 30},
{"AF41", 34},
{"AF42", 36},
{"AF43", 38},
{"EF", 46},
{"VOICE-ADMIT", 43},
});
}
37 changes: 37 additions & 0 deletions src/handlers/flow/FlowStreamHandler.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
* file, You can obtain one at https://mozilla.org/MPL/2.0/. */

#include "FlowStreamHandler.h"
#include "Dscp.h"
#include "HandlerModulePlugin.h"
#include <Corrade/Utility/Debug.h>
#include <fmt/format.h>
Expand Down Expand Up @@ -356,6 +357,8 @@ void FlowStreamHandler::process_sflow_cb(const SFSample &payload, [[maybe_unused
flow.payload_size = sample.sampledPacketSize;
}

flow.tos = static_cast<uint8_t>(sample.dcd_ipTos);

flow.src_port = sample.dcd_sport;
flow.dst_port = sample.dcd_dport;
flow.if_in_index = sample.inputPort;
Expand Down Expand Up @@ -431,6 +434,7 @@ void FlowStreamHandler::process_netflow_cb(const std::string &senderIP, const NF

flow.packets = sample.flow_packets;
flow.payload_size = sample.flow_octets;
flow.tos = sample.tos;

flow.src_port = sample.src_port;
flow.dst_port = sample.dst_port;
Expand Down Expand Up @@ -684,6 +688,9 @@ void FlowMetricsBucket::specialized_merge(const AbstractMetricsBucket &o, [[mayb
top_dir.second.topSrcIPPort.merge(interface.second->directionTopN.at(top_dir.first).topSrcIPPort);
top_dir.second.topDstIPPort.merge(interface.second->directionTopN.at(top_dir.first).topDstIPPort);
}
if (group_enabled(group::FlowMetrics::TopTos)) {
leoparente marked this conversation as resolved.
Show resolved Hide resolved
top_dir.second.topTos.merge(interface.second->directionTopN.at(top_dir.first).topTos);
}
}

if (group_enabled(group::FlowMetrics::ByBytes)) {
Expand Down Expand Up @@ -824,6 +831,15 @@ void FlowMetricsBucket::to_prometheus(std::stringstream &out, Metric::LabelMap a
top_dir.second.topSrcIPPort.to_prometheus(out, interface_labels);
top_dir.second.topDstIPPort.to_prometheus(out, interface_labels);
}
if (group_enabled(group::FlowMetrics::TopTos)) {
top_dir.second.topTos.to_prometheus(out, interface_labels, [](const uint8_t &val) {
if (DscpNames.find(val) != DscpNames.end()) {
return DscpNames[val];
} else {
return std::to_string(val);
}
});
}
}

if (group_enabled(group::FlowMetrics::ByBytes)) {
Expand Down Expand Up @@ -979,6 +995,15 @@ void FlowMetricsBucket::to_opentelemetry(metrics::v1::ScopeMetrics &scope, Metri
top_dir.second.topSrcIPPort.to_opentelemetry(scope, start_ts, end_ts, interface_labels);
top_dir.second.topDstIPPort.to_opentelemetry(scope, start_ts, end_ts, interface_labels);
}
if (group_enabled(group::FlowMetrics::TopTos)) {
top_dir.second.topTos.to_opentelemetry(scope, start_ts, end_ts, interface_labels, [](const uint8_t &val) {
if (DscpNames.find(val) != DscpNames.end()) {
return DscpNames[val];
} else {
return std::to_string(val);
}
});
}
}

if (group_enabled(group::FlowMetrics::ByBytes)) {
Expand Down Expand Up @@ -1128,6 +1153,15 @@ void FlowMetricsBucket::to_json(json &j) const
top_dir.second.topSrcIPPort.to_json(j["devices"][deviceId]["interfaces"][interfaceId]);
top_dir.second.topDstIPPort.to_json(j["devices"][deviceId]["interfaces"][interfaceId]);
}
if (group_enabled(group::FlowMetrics::TopTos)) {
top_dir.second.topTos.to_json(j["devices"][deviceId]["interfaces"][interfaceId], [](const uint8_t &val) {
if (DscpNames.find(val) != DscpNames.end()) {
return DscpNames[val];
} else {
return std::to_string(val);
}
});
}
}

if (group_enabled(group::FlowMetrics::ByBytes)) {
Expand Down Expand Up @@ -1302,6 +1336,9 @@ void FlowMetricsBucket::process_interface(bool deep, FlowInterface *iface, const
iface->dstPortCard.update(flow.dst_port);
}
}
if (group_enabled(group::FlowMetrics::TopTos)) {
iface->directionTopN.at(type).topTos.update(flow.tos, aggregator);
}

std::string application_src;
std::string application_dst;
Expand Down
5 changes: 5 additions & 0 deletions src/handlers/flow/FlowStreamHandler.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ enum FlowMetrics : visor::MetricGroupIntType {
TopPorts,
TopIPs,
TopIPPorts,
TopTos,
leoparente marked this conversation as resolved.
Show resolved Hide resolved
TopGeo,
TopInterfaces
};
Expand Down Expand Up @@ -80,6 +81,7 @@ struct FlowData {
IP_PROTOCOL l4;
size_t payload_size;
uint32_t packets;
uint8_t tos;
pcpp::IPv4Address ipv4_in;
pcpp::IPv4Address ipv4_out;
pcpp::IPv6Address ipv6_in;
Expand Down Expand Up @@ -137,6 +139,7 @@ struct FlowDirectionTopN {
TopN<std::string> topDstPort;
TopN<std::string> topSrcIPPort;
TopN<std::string> topDstIPPort;
TopN<uint8_t> topTos;

FlowDirectionTopN(std::string direction, std::string metric)
: topSrcIP(FLOW_SCHEMA, "ip", {"top_" + direction + "_src_ips_" + metric}, "Top " + direction + " source IP addresses by " + metric)
Expand All @@ -145,6 +148,7 @@ struct FlowDirectionTopN {
, topDstPort(FLOW_SCHEMA, "port", {"top_" + direction + "_dst_ports_" + metric}, "Top " + direction + " destination ports by " + metric)
, topSrcIPPort(FLOW_SCHEMA, "ip_port", {"top_" + direction + "_src_ip_ports_" + metric}, "Top " + direction + " source IP addresses and port by " + metric)
, topDstIPPort(FLOW_SCHEMA, "ip_port", {"top_" + direction + "_dst_ip_ports_" + metric}, "Top " + direction + " destination IP addresses and port by " + metric)
, topTos(FLOW_SCHEMA, "tos", {"top_" + direction + "_tos_" + metric}, "Top " + direction + " IP type of service (ToS) by " + metric)
leoparente marked this conversation as resolved.
Show resolved Hide resolved
{
}

Expand Down Expand Up @@ -401,6 +405,7 @@ class FlowStreamHandler final : public visor::StreamMetricsHandler<FlowMetricsMa
{"counters", group::FlowMetrics::Counters},
{"top_ports", group::FlowMetrics::TopPorts},
{"top_ips_ports", group::FlowMetrics::TopIPPorts},
{"top_tos", group::FlowMetrics::TopTos},
{"top_geo", group::FlowMetrics::TopGeo},
{"top_interfaces", group::FlowMetrics::TopInterfaces}};

Expand Down
6 changes: 6 additions & 0 deletions src/handlers/flow/tests/test_flows.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ TEST_CASE("Parse sflow stream", "[sflow][flow]")
auto stream_proxy = stream.add_event_proxy(c);
c.config_set<uint64_t>("num_periods", 1);
FlowStreamHandler flow_handler{"flow-test", stream_proxy, &c};
flow_handler.config_set<visor::Configurable::StringList>("enable", visor::Configurable::StringList({"top_tos"}));

flow_handler.start();
stream.start();
Expand Down Expand Up @@ -45,6 +46,8 @@ TEST_CASE("Parse sflow stream", "[sflow][flow]")
CHECK(j["devices"]["192.168.0.13"]["interfaces"]["52"]["top_in_src_ports_bytes"][0]["name"] == "dynamic-client");
CHECK(j["devices"]["192.168.0.13"]["interfaces"]["52"]["top_in_src_ip_ports_bytes"][0]["estimate"] == 108027400000);
CHECK(j["devices"]["192.168.0.13"]["interfaces"]["52"]["top_in_src_ip_ports_bytes"][0]["name"] == "10.4.1.2:dynamic-client");
CHECK(j["devices"]["192.168.0.13"]["interfaces"]["52"]["top_in_tos_bytes"][0]["estimate"] == 170879120000);
CHECK(j["devices"]["192.168.0.13"]["interfaces"]["52"]["top_in_tos_bytes"][0]["name"] == "2");
}

TEST_CASE("Parse sflow with enrichment", "[sflow][flow]")
Expand Down Expand Up @@ -403,6 +406,7 @@ TEST_CASE("Parse netflow stream", "[netflow][flow]")
auto stream_proxy = stream.add_event_proxy(c);
c.config_set<uint64_t>("num_periods", 1);
FlowStreamHandler flow_handler{"flow-test", stream_proxy, &c};
flow_handler.config_set<visor::Configurable::StringList>("enable", visor::Configurable::StringList({"top_tos"}));

flow_handler.start();
stream.start();
Expand All @@ -425,6 +429,8 @@ TEST_CASE("Parse netflow stream", "[netflow][flow]")
CHECK(j["devices"]["192.168.100.1"]["interfaces"]["800"]["cardinality"]["src_ports_in"] == 0);
CHECK(j["devices"]["192.168.100.1"]["interfaces"]["800"]["top_in_src_ips_bytes"][0]["estimate"] == 6066232);
CHECK(j["devices"]["192.168.100.1"]["interfaces"]["800"]["top_in_src_ips_packets"][0]["estimate"] == 7858);
CHECK(j["devices"]["192.168.100.1"]["interfaces"]["800"]["top_in_tos_bytes"][0]["estimate"] == 142139882);
CHECK(j["devices"]["192.168.100.1"]["interfaces"]["800"]["top_in_tos_bytes"][0]["name"] == "CS0");
}

TEST_CASE("Parse IPFIX stream", "[netflow][flow]")
Expand Down