## This file is part of Scapy
|
## See http://www.secdev.org/projects/scapy for more informations
|
## Copyright (C) Philippe Biondi <phil@secdev.org>
|
## This program is published under a GPLv2 license
|
## Netflow V5 appended by spaceB0x and Guillaume Valadon
|
## Netflow V9 appended ny Gabriel Potter
|
|
"""
|
Cisco NetFlow protocol v1, v5 and v9
|
|
|
|
- NetflowV9 build example:
|
|
pkt = NetflowHeader()/\
|
NetflowHeaderV9()/\
|
NetflowFlowsetV9(templates=[
|
NetflowTemplateV9(templateID=258, template_fields=[
|
NetflowTemplateFieldV9(fieldType=1),
|
NetflowTemplateFieldV9(fieldType=62),
|
]),
|
NetflowTemplateV9(templateID=257, template_fields=[
|
NetflowTemplateFieldV9(fieldType=1),
|
NetflowTemplateFieldV9(fieldType=62),
|
]),
|
])/NetflowDataflowsetV9(templateID=258, records=[
|
NetflowRecordV9(fieldValue=b"\x01\x02\x03\x05"),
|
NetflowRecordV9(fieldValue=b"\x05\x03\x02\x01\x04\x03\x02\x01\x04\x03\x02\x01\x04\x03\x02\x01"),
|
])/NetflowDataflowsetV9(templateID=257, records=[
|
NetflowRecordV9(fieldValue=b"\x01\x02\x03\x04"),
|
NetflowRecordV9(fieldValue=b"\x04\x03\x02\x01\x04\x03\x02\x01\x04\x03\x02\x01\x04\x03\x02\x01"),
|
])/NetflowOptionsFlowsetV9(templateID=256, scopes=[NetflowOptionsFlowsetScopeV9(scopeFieldType=1, scopeFieldlength=4),
|
NetflowOptionsFlowsetScopeV9(scopeFieldType=1, scopeFieldlength=3)],
|
options=[NetflowOptionsFlowsetOptionV9(optionFieldType=1, optionFieldlength=2),
|
NetflowOptionsFlowsetOptionV9(optionFieldType=1, optionFieldlength=1)])/\
|
NetflowOptionsDataRecordV9(templateID=256, records=[NetflowOptionsRecordScopeV9(fieldValue=b"\x01\x02\x03\x04"),
|
NetflowOptionsRecordScopeV9(fieldValue=b"\x01\x02\x03"),
|
NetflowOptionsRecordOptionV9(fieldValue=b"\x01\x02"),
|
NetflowOptionsRecordOptionV9(fieldValue=b"\x01")])
|
"""
|
|
|
from scapy.fields import *
|
from scapy.packet import *
|
from scapy.data import IP_PROTOS
|
from scapy.layers.inet import UDP
|
|
|
class NetflowHeader(Packet):
|
name = "Netflow Header"
|
fields_desc = [ ShortField("version", 1) ]
|
|
|
###########################################
|
### Netflow Version 1
|
###########################################
|
|
|
class NetflowHeaderV1(Packet):
|
name = "Netflow Header v1"
|
fields_desc = [ ShortField("count", 0),
|
IntField("sysUptime", 0),
|
UTCTimeField("unixSecs", 0),
|
UTCTimeField("unixNanoSeconds", 0, use_nano=True) ]
|
|
|
class NetflowRecordV1(Packet):
|
name = "Netflow Record v1"
|
fields_desc = [ IPField("ipsrc", "0.0.0.0"),
|
IPField("ipdst", "0.0.0.0"),
|
IPField("nexthop", "0.0.0.0"),
|
ShortField("inputIfIndex", 0),
|
ShortField("outpuIfIndex", 0),
|
IntField("dpkts", 0),
|
IntField("dbytes", 0),
|
IntField("starttime", 0),
|
IntField("endtime", 0),
|
ShortField("srcport", 0),
|
ShortField("dstport", 0),
|
ShortField("padding", 0),
|
ByteField("proto", 0),
|
ByteField("tos", 0),
|
IntField("padding1", 0),
|
IntField("padding2", 0) ]
|
|
|
bind_layers( NetflowHeader, NetflowHeaderV1, version=1)
|
bind_layers( NetflowHeaderV1, NetflowRecordV1 )
|
bind_layers( NetflowRecordV1, NetflowRecordV1 )
|
|
|
#########################################
|
### Netflow Version 5
|
#########################################
|
|
|
class NetflowHeaderV5(Packet):
|
name = "Netflow Header v5"
|
fields_desc = [ ShortField("count", 0),
|
IntField("sysUptime", 0),
|
UTCTimeField("unixSecs", 0),
|
UTCTimeField("unixNanoSeconds", 0, use_nano=True),
|
IntField("flowSequence",0),
|
ByteField("engineType", 0),
|
ByteField("engineID", 0),
|
ShortField("samplingInterval", 0) ]
|
|
|
class NetflowRecordV5(Packet):
|
name = "Netflow Record v5"
|
fields_desc = [ IPField("src", "127.0.0.1"),
|
IPField("dst", "127.0.0.1"),
|
IPField("nexthop", "0.0.0.0"),
|
ShortField("input", 0),
|
ShortField("output", 0),
|
IntField("dpkts", 1),
|
IntField("dOctets", 60),
|
IntField("first", 0),
|
IntField("last", 0),
|
ShortField("srcport", 0),
|
ShortField("dstport", 0),
|
ByteField("pad1", 0),
|
FlagsField("tcpFlags", 0x2, 8, "FSRPAUEC"),
|
ByteEnumField("prot", IP_PROTOS["tcp"], IP_PROTOS),
|
ByteField("tos",0),
|
ShortField("src_as", 0),
|
ShortField("dst_as", 0),
|
ByteField("src_mask", 0),
|
ByteField("dst_mask", 0),
|
ShortField("pad2", 0)]
|
|
|
bind_layers( NetflowHeader, NetflowHeaderV5, version=5)
|
bind_layers( NetflowHeaderV5, NetflowRecordV5 )
|
bind_layers( NetflowRecordV5, NetflowRecordV5 )
|
|
#########################################
|
### Netflow Version 9
|
#########################################
|
|
# https://www.ietf.org/rfc/rfc3954.txt
|
|
NetflowV9TemplateFieldTypes = {
|
1: "IN_BYTES",
|
2: "IN_PKTS",
|
3: "FLOWS",
|
4: "PROTOCOL",
|
5: "TOS",
|
6: "TCP_FLAGS",
|
7: "L4_SRC_PORT",
|
8: "IPV4_SRC_ADDR",
|
9: "SRC_MASK",
|
10: "INPUT_SNMP",
|
11: "L4_DST_PORT",
|
12: "IPV4_DST_ADDR",
|
13: "DST_MASK",
|
14: "OUTPUT_SNMP",
|
15: "IPV4_NEXT_HOP",
|
16: "SRC_AS",
|
17: "DST_AS",
|
18: "BGP_IPV4_NEXT_HOP",
|
19: "MUL_DST_PKTS",
|
20: "MUL_DST_BYTES",
|
21: "LAST_SWITCHED",
|
22: "FIRST_SWITCHED",
|
23: "OUT_BYTES",
|
24: "OUT_PKTS",
|
27: "IPV6_SRC_ADDR",
|
28: "IPV6_DST_ADDR",
|
29: "IPV6_SRC_MASK",
|
30: "IPV6_DST_MASK",
|
31: "IPV6_FLOW_LABEL",
|
32: "ICMP_TYPE",
|
33: "MUL_IGMP_TYPE",
|
34: "SAMPLING_INTERVAL",
|
35: "SAMPLING_ALGORITHM",
|
36: "FLOW_ACTIVE_TIMEOUT",
|
37: "FLOW_INACTIVE_TIMEOUT",
|
38: "ENGINE_TYPE",
|
39: "ENGINE_ID",
|
40: "TOTAL_BYTES_EXP",
|
41: "TOTAL_PKTS_EXP",
|
42: "TOTAL_FLOWS_EXP",
|
46: "MPLS_TOP_LABEL_TYPE",
|
47: "MPLS_TOP_LABEL_IP_ADDR",
|
48: "FLOW_SAMPLER_ID",
|
49: "FLOW_SAMPLER_MODE",
|
50: "FLOW_SAMPLER_RANDOM_INTERVAL",
|
55: "DST_TOS",
|
56: "SRC_MAC",
|
57: "DST_MAC",
|
58: "SRC_VLAN",
|
59: "DST_VLAN",
|
60: "IP_PROTOCOL_VERSION",
|
61: "DIRECTION",
|
62: "IPV6_NEXT_HOP",
|
63: "BGP_IPV6_NEXT_HOP",
|
64: "IPV6_OPTION_HEADERS",
|
70: "MPLS_LABEL_1",
|
71: "MPLS_LABEL_2",
|
72: "MPLS_LABEL_3",
|
73: "MPLS_LABEL_4",
|
74: "MPLS_LABEL_5",
|
75: "MPLS_LABEL_6",
|
76: "MPLS_LABEL_7",
|
77: "MPLS_LABEL_8",
|
78: "MPLS_LABEL_9",
|
79: "MPLS_LABEL_10",
|
}
|
|
ScopeFieldTypes = {
|
1: "System",
|
2: "Interface",
|
3: "Line card",
|
4: "Cache",
|
5: "Template",
|
}
|
|
NetflowV9TemplateFieldDefaultLengths = {
|
1: 4,
|
2: 4,
|
3: 4,
|
4: 1,
|
5: 1,
|
6: 1,
|
7: 2,
|
8: 4,
|
9: 1,
|
10: 2,
|
11: 2,
|
12: 4,
|
13: 1,
|
14: 2,
|
15: 4,
|
16: 2,
|
17: 2,
|
18: 4,
|
19: 4,
|
20: 4,
|
21: 4,
|
22: 4,
|
23: 4,
|
24: 4,
|
27: 16,
|
28: 16,
|
29: 1,
|
30: 1,
|
31: 3,
|
32: 2,
|
33: 1,
|
34: 4,
|
35: 1,
|
36: 2,
|
37: 2,
|
38: 1,
|
39: 1,
|
40: 4,
|
41: 4,
|
42: 4,
|
46: 1,
|
47: 4,
|
48: 1,
|
49: 1,
|
50: 4,
|
55: 1,
|
56: 6,
|
57: 6,
|
58: 2,
|
59: 2,
|
60: 1,
|
61: 1,
|
62: 16,
|
63: 16,
|
64: 4,
|
70: 3,
|
71: 3,
|
72: 3,
|
73: 3,
|
74: 3,
|
75: 3,
|
76: 3,
|
77: 3,
|
78: 3,
|
79: 3,
|
}
|
|
class NetflowHeaderV9(Packet):
|
name = "Netflow Header V9"
|
fields_desc = [ ShortField("count", 0),
|
IntField("sysUptime", 0),
|
UTCTimeField("unixSecs", 0),
|
IntField("packageSequence",0),
|
IntField("SourceID", 0) ]
|
|
class NetflowTemplateFieldV9(Packet):
|
name = "Netflow Flowset Template Field V9"
|
fields_desc = [ ShortEnumField("fieldType", None, NetflowV9TemplateFieldTypes),
|
ShortField("fieldLength", 0) ]
|
def __init__(self, *args, **kwargs):
|
Packet.__init__(self, *args, **kwargs)
|
if self.fieldType != None:
|
self.fieldLength = NetflowV9TemplateFieldDefaultLengths[self.fieldType]
|
|
def default_payload_class(self, p):
|
return conf.padding_layer
|
|
class NetflowTemplateV9(Packet):
|
name = "Netflow Flowset Template V9"
|
fields_desc = [ ShortField("templateID", 255),
|
FieldLenField("fieldCount", None, count_of="template_fields"),
|
PacketListField("template_fields", [], NetflowTemplateFieldV9,
|
count_from = lambda pkt: pkt.fieldCount) ]
|
|
def default_payload_class(self, p):
|
return conf.padding_layer
|
|
class NetflowFlowsetV9(Packet):
|
name = "Netflow FlowSet V9"
|
fields_desc = [ ShortField("flowSetID", 0),
|
FieldLenField("length", None, length_of="templates", adjust=lambda pkt,x:x+4),
|
PacketListField("templates", [], NetflowTemplateV9,
|
length_from = lambda pkt: pkt.length-4) ]
|
|
class NetflowRecordV9(Packet):
|
name = "Netflow DataFlowset Record V9"
|
fields_desc = [ StrField("fieldValue", "") ]
|
|
def default_payload_class(self, p):
|
return conf.padding_layer
|
|
class NetflowDataflowsetV9(Packet):
|
name = "Netflow DataFlowSet V9"
|
fields_desc = [ ShortField("templateID", 255),
|
FieldLenField("length", None, length_of="records", adjust = lambda pkt,x:x+4),
|
PadField(PacketListField("records", [], NetflowRecordV9,
|
length_from = lambda pkt: pkt.length-4),
|
4, padwith=b"\x00") ]
|
|
@classmethod
|
def dispatch_hook(cls, _pkt=None, *args, **kargs):
|
if _pkt:
|
if _pkt[:2] == b"\x00\x01":
|
return NetflowOptionsFlowsetV9
|
return cls
|
|
def post_dissection(self, pkt):
|
# We need the whole packet to be dissected to access field def in NetflowFlowsetV9
|
root = pkt.firstlayer()
|
current = root
|
# Get all linked NetflowFlowsetV9
|
while current.payload.haslayer(NetflowFlowsetV9):
|
current = current.payload[NetflowFlowsetV9]
|
for ntv9 in current.templates:
|
current_ftl = root.getlayer(NetflowDataflowsetV9, templateID=ntv9.templateID)
|
if current_ftl:
|
# Matched
|
if len(current_ftl.records) > 1:
|
# post_dissection is not necessary
|
return
|
# All data is stored in one record, awaiting to be splitted
|
data = current_ftl.records.pop(0).fieldValue
|
res = []
|
# Now, according to the NetflowFlowsetV9 data, re-dissect NetflowDataflowsetV9
|
for template in ntv9.template_fields:
|
_l = template.fieldLength
|
if _l:
|
res.append(NetflowRecordV9(data[:_l]))
|
data = data[_l:]
|
if data:
|
res.append(Raw(data))
|
# Inject dissected data
|
current_ftl.records = res
|
else:
|
warning("[NetflowFlowsetV9 templateID=%s]: No matching NetflowDataflowsetV9 !" % ntv9.templateID)
|
|
class NetflowOptionsFlowsetScopeV9(Packet):
|
name = "Netflow Options Template FlowSet V9 - Scope"
|
fields_desc = [ ShortEnumField("scopeFieldType", None, ScopeFieldTypes),
|
ShortField("scopeFieldlength", 0) ]
|
|
def default_payload_class(self, p):
|
return conf.padding_layer
|
|
class NetflowOptionsRecordScopeV9(NetflowRecordV9):
|
name = "Netflow Options Template Record V9 - Scope"
|
|
class NetflowOptionsRecordOptionV9(NetflowRecordV9):
|
name = "Netflow Options Template Record V9 - Option"
|
|
class NetflowOptionsFlowsetOptionV9(Packet):
|
name = "Netflow Options Template FlowSet V9 - Option"
|
fields_desc = [ ShortEnumField("optionFieldType", None, NetflowV9TemplateFieldTypes),
|
ShortField("optionFieldlength", 0) ]
|
|
def default_payload_class(self, p):
|
return conf.padding_layer
|
|
class NetflowOptionsFlowsetV9(Packet):
|
name = "Netflow Options Template FlowSet V9"
|
fields_desc = [ ShortField("flowSetID", 1),
|
LenField("length", None),
|
ShortField("templateID", 255),
|
FieldLenField("option_scope_length", None, length_of="scopes"),
|
FieldLenField("option_field_length", None, length_of="options"),
|
PacketListField("scopes", [], NetflowOptionsFlowsetScopeV9,
|
length_from = lambda pkt: pkt.option_scope_length),
|
PadField(PacketListField("options", [], NetflowOptionsFlowsetOptionV9,
|
length_from = lambda pkt: pkt.option_field_length),
|
4, padwith=b"\x00") ]
|
|
class NetflowOptionsDataRecordV9(NetflowDataflowsetV9):
|
name = "Netflow Options Data Record V9"
|
fields_desc = [ ShortField("templateID", 255),
|
FieldLenField("length", None, length_of="records", adjust = lambda pkt,x:x+4),
|
PadField(PacketListField("records", [], NetflowRecordV9,
|
length_from = lambda pkt: pkt.length-4),
|
4, padwith=b"\x00") ]
|
|
def post_dissection(self, pkt):
|
options_data_record = pkt[NetflowOptionsDataRecordV9]
|
if pkt.haslayer(NetflowOptionsFlowsetV9):
|
options_flowset = pkt[NetflowOptionsFlowsetV9]
|
data = options_data_record.records.pop(0).fieldValue
|
res = []
|
# Now, according to the NetflowOptionsFlowsetV9 data, re-dissect NetflowOptionsDataRecordV9
|
for scope in options_flowset.scopes:
|
_l = scope.scopeFieldlength
|
if _l:
|
res.append(NetflowOptionsRecordScopeV9(data[:_l]))
|
data = data[_l:]
|
|
# Now, according to the NetflowOptionsFlowsetV9 data, re-dissect NetflowOptionsDataRecordV9
|
for option in options_flowset.options:
|
_l = option.optionFieldlength
|
if _l:
|
res.append(NetflowOptionsRecordOptionV9(data[:_l]))
|
data = data[_l:]
|
if data:
|
res.append(Raw(data))
|
# Inject dissected data
|
options_data_record.records = res
|
|
bind_layers( NetflowHeader, NetflowHeaderV9, version=9 )
|
bind_layers( NetflowHeaderV9, NetflowFlowsetV9 )
|
bind_layers( NetflowFlowsetV9, NetflowDataflowsetV9 )
|
bind_layers( NetflowDataflowsetV9, NetflowDataflowsetV9 )
|
|
bind_layers( NetflowOptionsFlowsetV9, NetflowOptionsDataRecordV9 )
|
