Skip to content

Commit

Permalink
Add filter for "min ttl" and "max ttl"
Browse files Browse the repository at this point in the history 
Remove old ttl.
Map old filter ttl into "min ttl or max ttl"
Add min/max TTL in ipfix and netflowv9 module
Replace old TTL in nfpcapd and add min/max TTL.
Closes #580
  • Loading branch information
@phaag
phaag committed Dec 1, 2024
1 parent e221092 commit 21d61fc
Show file tree
Hide file tree
Showing 22 changed files with 111 additions and 60 deletions.
12 changes: 10 additions & 2 deletions man/nfdump.1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -848,8 +848,12 @@ True if source and destination IP of a record are IPv4 IPs.
.It Cm ipv6
True if source and destination IP of a record are IPv6 IPs.
.Pp
.It Cm min ttl Ar comp num
.It Cm max ttl Ar comp num
True if min/max IP ttl matches comparison.
.Pp
.It Cm ttl Ar comp num
True if IP ttl matches comparison.
True if min or max IP ttl matches comparison.
.Pp
.It Cm proto Ar protocol
True if the record protocol field matches
Expand Down Expand Up @@ -1714,8 +1718,12 @@ Destination Address(country code):Port
Source Port
.It Cm %dp
Destination Port
.It Cm %minttl
IP min ttl
.It Cm %maxttl
IP max ttl
.It Cm %ttl
IP ttl
IP min/max ttl
.It Cm %it
ICMP-type
.It Cm %ic
Expand Down
3 changes: 3 additions & 0 deletions src/libnfdump/filter/filter.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,8 @@ typedef enum {
SRC_ROUTER
} direction_t;

typedef enum { PRE_UNKNOWN = 0, PRE_MIN, PRE_MAX } prefix_t;

typedef enum {
CMP_EQ = 0,
CMP_GT,
Expand All @@ -86,6 +88,7 @@ typedef enum {
typedef struct FilterParam {
comparator_t comp;
direction_t direction;
prefix_t prefix;
int32_t self;
} FilterParam_t;

Expand Down
34 changes: 27 additions & 7 deletions src/libnfdump/filter/grammar.y
View file
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ static int AddFlagsString(direction_t direction, char *flags);

static int AddTosNumber(direction_t direction, uint16_t comp, uint64_t tos);

static int AddIPttl(uint16_t comp, uint64_t ttl);
static int AddIPttl(prefix_t prefix, uint16_t comp, uint64_t ttl);

static int AddPackets(direction_t direction, uint16_t comp, uint64_t packets);

Expand Down Expand Up @@ -176,7 +176,7 @@ static int AddASList(direction_t direction, void *U64List);
%token EQ LT GT LE GE
%token ANY NOT IDENT COUNT
%token IP IPV4 IPV6 IPTTL NET
%token SRC DST IN OUT PREV NEXT BGP ROUTER INGRESS EGRESS
%token SRC DST IN OUT MIN MAX PREV NEXT BGP ROUTER INGRESS EGRESS
%token CLIENT SERVER
%token NAT XLATE TUN
%token ENGINE ENGINETYPE ENGINEID EXPORTER
Expand All @@ -189,7 +189,7 @@ static int AddASList(direction_t direction, void *U64List);
%token <s> GEOSTRING
%token <value> NUMBER
%type <value> expr
%type <param> dqual term comp
%type <param> dqual minmax term comp
%type <list> iplist u64list

%left '+' OR
Expand Down Expand Up @@ -280,8 +280,8 @@ term: ANY { /* this is an unconditionally true expression, as a filter applies i
$$.self = AddTosNumber($1.direction, $3.comp, $4); if ( $$.self < 0 ) YYABORT;
}

| IPTTL comp NUMBER {
$$.self = AddIPttl($2.comp, $3); if ( $$.self < 0 ) YYABORT;
| minmax IPTTL comp NUMBER {
$$.self = AddIPttl($1.prefix, $3.comp, $4); if ( $$.self < 0 ) YYABORT;
}

| FWDSTAT comp NUMBER {
Expand Down Expand Up @@ -549,6 +549,11 @@ dqual: { $$.direction = DIR_UNSPEC; }
| EXPORTER { $$.direction = SRC_ROUTER; }
;

minmax: { $$.prefix = PRE_UNKNOWN; }
| MIN { $$.prefix = PRE_MIN; }
| MAX { $$.prefix = PRE_MAX; }
;

expr: term { $$ = $1.self; }
| expr OR expr { $$ = Connect_OR($1, $3); }
| expr AND expr { $$ = Connect_AND($1, $3); }
Expand Down Expand Up @@ -904,13 +909,28 @@ static int AddTosNumber(direction_t direction, uint16_t comp, uint64_t tos) {
return ret;
} // End of AddTosNumber

static int AddIPttl(uint16_t comp, uint64_t ttl) {
static int AddIPttl(prefix_t prefix, uint16_t comp, uint64_t ttl) {
if ( ttl > 255 ) {
yyprintf("TTL number out of range");
return -1;
}

return NewElement(EXipInfoID, OFFipTTL, SIZEipTTL, ttl, comp, FUNC_NONE, NULLPtr);
int ret = 0;
switch (prefix) {
case PRE_UNKNOWN:
ret = Connect_OR(
NewElement(EXipInfoID, OFFminTTL, SIZEminTTL, ttl, comp, FUNC_NONE, NULLPtr),
NewElement(EXipInfoID, OFFmaxTTL, SIZEmaxTTL, ttl, comp, FUNC_NONE, NULLPtr));
break;
case PRE_MIN:
ret = NewElement(EXipInfoID, OFFminTTL, SIZEminTTL, ttl, comp, FUNC_NONE, NULLPtr);
break;
case PRE_MAX:
ret = NewElement(EXipInfoID, OFFmaxTTL, SIZEmaxTTL, ttl, comp, FUNC_NONE, NULLPtr);
break;
}
return ret;

} // End of AddIPttl

static int AddPackets(direction_t direction, uint16_t comp, uint64_t packets) {
Expand Down
2 changes: 2 additions & 0 deletions src/libnfdump/filter/scanner.l
View file
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,8 @@ src { return SRC; }
dst { return DST; }
in { return IN; }
out { return OUT; }
min { return MIN; }
max { return MAX; }
next { return NEXT; }
prev { return PREV; }
bgp { return BGP; }
Expand Down
4 changes: 1 addition & 3 deletions src/libnffile/nfxV3.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -685,9 +685,7 @@ typedef struct EXnokiaNatString_s {

#define EXipInfoID 42
typedef struct EXipInfo_s {
uint8_t ttl;
#define OFFipTTL offsetof(EXipInfo_t, ttl)
#define SIZEipTTL MemberSize(EXipInfo_t, ttl)
uint8_t fill;
#define flagMF 0x20
#define flagDF 0x40
uint8_t fragmentFlags;
Expand Down
2 changes: 1 addition & 1 deletion src/netflow/ipfix.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -189,7 +189,7 @@ static const struct ipfixTranslationMap_s {
{IPFIX_flowDirection, SIZEdir, NumberCopy, EXflowMiscID, OFFdir, STACK_NONE, "flow direction"},
{IPFIX_biflowDirection, SIZEbiFlowDir, NumberCopy, EXflowMiscID, OFFbiFlowDir, STACK_NONE, "biFlow direction"},
{IPFIX_flowEndReason, SIZEflowEndReason, NumberCopy, EXflowMiscID, OFFflowEndReason, STACK_NONE, "Flow end reason"},
{IPFIX_ipTTL, SIZEipTTL, NumberCopy, EXipInfoID, OFFipTTL, STACK_NONE, "IP ttl"},
{IPFIX_ipTTL, SIZEminTTL, NumberCopy, EXipInfoID, OFFminTTL, STACK_NONE, "flow min TTL"},
{IPFIX_fragmentFlags, SIZEfragmentFlags, NumberCopy, EXipInfoID, OFFfragmentFlags, STACK_NONE, "IP fragment flags"},
{IPFIX_ipNextHopIPv6Address, SIZENextHopV6IP, NumberCopy, EXipNextHopV6ID, OFFNextHopV6IP, STACK_NONE, "IPv6 next hop IP"},
{IPFIX_bgpNextHopIPv6Address, SIZEbgp6NextIP, NumberCopy, EXbgpNextHopV6ID, OFFbgp6NextIP, STACK_NONE, "IPv6 bgp next hop IP"},
Expand Down
4 changes: 3 additions & 1 deletion src/netflow/netflow_v9.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -167,11 +167,13 @@ static const struct v9TranslationMap_s {
{NF9_IPV6_SRC_MASK, SIZEsrcMask, NumberCopy, EXflowMiscID, OFFsrcMask, STACK_NONE, "src mask bits"},
{NF9_IPV6_DST_MASK, SIZEdstMask, NumberCopy, EXflowMiscID, OFFdstMask, STACK_NONE, "dst mask bits"},
{NF9_ICMP, Stack_ONLY, NumberCopy, EXgenericFlowID, OFFdstPort, STACK_ICMP, "icmp type/code"},
{NF9_MIN_TTL, SIZEminTTL, NumberCopy, EXipInfoID, OFFminTTL, STACK_NONE, "flow min TTL"},
{NF9_MAX_TTL, SIZEmaxTTL, NumberCopy, EXipInfoID, OFFmaxTTL, STACK_NONE, "flow max TTL"},
{NF9_DST_TOS, SIZEdstTos, NumberCopy, EXflowMiscID, OFFdstTos, STACK_NONE, "post IP class of Service"},
{NF9_MIN_TTL, SIZEminTTL, NumberCopy, EXipInfoID, OFFminTTL, STACK_NONE, "flow min TTL"},
{NF9_MAX_TTL, SIZEmaxTTL, NumberCopy, EXipInfoID, OFFmaxTTL, STACK_NONE, "flow max TTL"},
{NF_F_flowEndReason, SIZEflowEndReason, NumberCopy, EXflowMiscID, OFFflowEndReason, STACK_NONE, "Flow end reason"},
{NF_F_ipTTL, SIZEipTTL, NumberCopy, EXipInfoID, OFFipTTL, STACK_NONE, "IP ttl"},
{NF_F_ipTTL, SIZEminTTL, NumberCopy, EXipInfoID, OFFminTTL, STACK_NONE, "flow min TTL"},
{NF_F_fragmentFlags, SIZEfragmentFlags, NumberCopy, EXipInfoID, OFFfragmentFlags, STACK_NONE, "IP fragment flags"},
{NF9_IN_SRC_MAC, SIZEinSrcMac, NumberCopy, EXmacAddrID, OFFinSrcMac, STACK_NONE, "in src MAC addr"},
{NF9_OUT_DST_MAC, SIZEoutDstMac, NumberCopy, EXmacAddrID, OFFoutDstMac, STACK_NONE, "out dst MAC addr"},
Expand Down
3 changes: 2 additions & 1 deletion src/nfdump/nflowcache.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -149,7 +149,8 @@ static struct aggregationElement_s {
{"srcgeo", {EXlocal, OFFgeoSrcIP, SizeGEOloc, 0}, 0, SRC_GEO, 0, 0, "%sc"},
{"dstgeo", {EXlocal, OFFgeoDstIP, SizeGEOloc, 0}, 0, DST_GEO, 0, 0, "%dc"},
{"ethertype", {EXlayer2ID, OFFetherType, SIZEetherType, 0}, 0, NOPREPROCESS, 0, 0, "%eth"},
{"ttl", {EXipInfoID, OFFipTTL, SIZEipTTL, 0}, 0, NOPREPROCESS, 0, 0, "%ttl"},
{"minttl", {EXipInfoID, OFFminTTL, SIZEminTTL, 0}, 0, NOPREPROCESS, 0, 0, "%minttl"},
{"maxttl", {EXipInfoID, OFFmaxTTL, SIZEmaxTTL, 0}, 0, NOPREPROCESS, 0, 0, "%maxttl"},
{NULL, {0, 0, 0}, 0, NOPREPROCESS, 0, 0, NULL}};

// FlowHash stat record, to aggregate flow counters in -A or -s stat/aggregate mode
Expand Down
3 changes: 2 additions & 1 deletion src/nfdump/nfstat.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -224,7 +224,8 @@ static struct StatParameter_s {
// {"exace", "Egress ACL", {EXnselAclID, OFFegressAcl, SIZEegressAcl, 0}, IS_HEX, NULL},
{"ivrf", "I-vrf ID", {EXvrfID, OFFingressVrf, SIZEingressVrf, 0}, IS_NUMBER, NULL},
{"evrf", "E-vrf ID", {EXvrfID, OFFegressVrf, SIZEegressVrf, 0}, IS_NUMBER, NULL},
{"ttl", "TTL", {EXipInfoID, OFFipTTL, SIZEipTTL, 0}, IS_NUMBER, NULL},
{"minttl", "minTTL", {EXipInfoID, OFFminTTL, SIZEminTTL, 0}, IS_NUMBER, NULL},
{"maxttl", "maxTTL", {EXipInfoID, OFFmaxTTL, SIZEmaxTTL, 0}, IS_NUMBER, NULL},

// header info != NULL
{NULL, "DONE", {0, 0, 0, 0}, 0, NULL}};
Expand Down
3 changes: 2 additions & 1 deletion src/nfpcapd/flowdump.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -136,7 +136,8 @@ static int StorePcapFlow(flowParam_t *flowParam, struct FlowNode *Node) {
if (flowParam->extendedFlow) {
UpdateRecordSize(EXipInfoSize);
PushExtension(recordHeader, EXipInfo, ipInfo);
ipInfo->ttl = Node->ttl;
ipInfo->minTTL = Node->minTTL;
ipInfo->maxTTL = Node->maxTTL;
ipInfo->fragmentFlags = Node->fragmentFlags;

if (Node->vlanID) {
Expand Down
5 changes: 3 additions & 2 deletions src/nfpcapd/flowtree.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -117,9 +117,10 @@ struct FlowNode {
void *pflog;
void *payload; // payload
uint32_t payloadSize; // Size of payload
uint8_t ttl;
uint8_t minTTL;
uint8_t maxTTL;
uint8_t fragmentFlags;
uint16_t align;
uint8_t align;
uint32_t mpls[10];
uint64_t srcMac;
uint64_t dstMac;
Expand Down
15 changes: 12 additions & 3 deletions src/nfpcapd/pcaproc.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -425,8 +425,10 @@ static inline void ProcessTCPFlow(packetParam_t *packetParam, struct FlowNode *N
Node->packets++;
Node->bytes += NewNode->bytes;
Node->t_last = NewNode->t_last;
if (NewNode->minTTL < Node->minTTL) Node->minTTL = NewNode->minTTL;
if (NewNode->maxTTL > Node->maxTTL) Node->maxTTL = NewNode->maxTTL;

// DEVEL RTT - disabled for now
// DEVEL RTT - disabled for now
#if 0
if (NewNode->signal != SIGNAL_FIN && Node->latency.ack && ((NewNode->latency.ack - Node->latency.ack) > 0)) {
uint32_t rtt = NewNode->latency.tsVal - Node->latency.tsVal;
Expand Down Expand Up @@ -487,6 +489,8 @@ static inline void ProcessUDPFlow(packetParam_t *packetParam, struct FlowNode *N
Node->packets++;
Node->bytes += NewNode->bytes;
Node->t_last = NewNode->t_last;
if (NewNode->minTTL < Node->minTTL) Node->minTTL = NewNode->minTTL;
if (NewNode->maxTTL > Node->maxTTL) Node->maxTTL = NewNode->maxTTL;
dbg_printf("Existing UDP flow: Packets: %u, Bytes: %u\n", Node->packets, Node->bytes);

if (Node->payloadSize == 0 && payloadSize > 0 && packetParam->addPayload) {
Expand Down Expand Up @@ -529,6 +533,8 @@ static inline void ProcessOtherFlow(packetParam_t *packetParam, struct FlowNode
Node->packets++;
Node->bytes += NewNode->bytes;
Node->t_last = NewNode->t_last;
if (NewNode->minTTL < Node->minTTL) Node->minTTL = NewNode->minTTL;
if (NewNode->maxTTL > Node->maxTTL) Node->maxTTL = NewNode->maxTTL;
dbg_printf("Existing flow IP proto: %u Packets: %u, Bytes: %u\n", NewNode->flowKey.proto, Node->packets, Node->bytes);

if (Node->payloadSize == 0 && payloadSize > 0 && packetParam->addPayload) {
Expand Down Expand Up @@ -861,7 +867,9 @@ int ProcessPacket(packetParam_t *packetParam, const struct pcap_pkthdr *hdr, con
Node->t_first.tv_usec = hdr->ts.tv_usec;
Node->t_last.tv_usec = hdr->ts.tv_usec;
Node->bytes = ntohs(ip6->ip6_plen) + size_ip;
Node->ttl = ip6->ip6_ctlun.ip6_un1.ip6_un1_hlim;
uint8_t ttl = ip6->ip6_ctlun.ip6_un1.ip6_un1_hlim;
Node->minTTL = ttl;
Node->maxTTL = ttl;
Node->fragmentFlags = 0;

// keep compiler happy - gets optimized out anyway
Expand Down Expand Up @@ -939,7 +947,8 @@ int ProcessPacket(packetParam_t *packetParam, const struct pcap_pkthdr *hdr, con
Node->flowKey.src_addr.v4 = ntohl(ip->ip_src.s_addr);
Node->flowKey.dst_addr.v4 = ntohl(ip->ip_dst.s_addr);
}
Node->ttl = ip->ip_ttl;
Node->minTTL = ip->ip_ttl;
Node->maxTTL = ip->ip_ttl;
} else {
dbg_printf("ProcessPacket() Unsupported protocol version: %i\n", version);
packetParam->proc_stat.unknown++;
Expand Down
20 changes: 4 additions & 16 deletions src/output/output_csv.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -216,8 +216,6 @@ static char *String_BiFlowDir(char *streamPtr, recordHandle_t *recordHandle);

static char *String_FlowEndReason(char *streamPtr, recordHandle_t *recordHandle);

static char *String_ipTTL(char *streamPtr, recordHandle_t *recordHandle);

static char *String_ipminTTL(char *streamPtr, recordHandle_t *recordHandle);

static char *String_ipmaxTTL(char *streamPtr, recordHandle_t *recordHandle);
Expand Down Expand Up @@ -566,7 +564,6 @@ static struct format_entry_s {
{"%lbl", 0, "label", String_Label}, // Flow Label

// EXipInfo
{"%ttl", 0, "TTL", String_ipTTL}, // Flow ip ttl
{"%minttl", 0, "minTTL", String_ipminTTL}, // Flow ip min ttl
{"%maxttl", 0, "maxTTL", String_ipmaxTTL}, // Flow ip max ttl
{"%frag", 0, "Frag", String_ipFrag}, // IP fragment flags
Expand Down Expand Up @@ -1737,29 +1734,20 @@ static char *String_FlowEndReason(char *streamPtr, recordHandle_t *recordHandle)
return streamPtr;
} // End of String_FlowEndReason

static char *String_ipTTL(char *streamPtr, recordHandle_t *recordHandle) {
EXipInfo_t *ipInfo = (EXipInfo_t *)recordHandle->extensionList[EXipInfoID];
uint8_t ttl = ipInfo ? ipInfo->ttl : 0;

AddU32(ttl);

return streamPtr;
} // End of String_ipTTL

static char *String_ipminTTL(char *streamPtr, recordHandle_t *recordHandle) {
EXipInfo_t *ipInfo = (EXipInfo_t *)recordHandle->extensionList[EXipInfoID];
uint8_t ttl = ipInfo ? ipInfo->minTTL : 0;
uint8_t minTTL = ipInfo ? ipInfo->minTTL : 0;

AddU32(ttl);
AddU32(minTTL);

return streamPtr;
} // End of String_ipminTTL

static char *String_ipmaxTTL(char *streamPtr, recordHandle_t *recordHandle) {
EXipInfo_t *ipInfo = (EXipInfo_t *)recordHandle->extensionList[EXipInfoID];
uint8_t ttl = ipInfo ? ipInfo->maxTTL : 0;
uint8_t maxTTL = ipInfo ? ipInfo->maxTTL : 0;

AddU32(ttl);
AddU32(maxTTL);

return streamPtr;
} // End of String_ipminTTL
Expand Down
11 changes: 6 additions & 5 deletions src/output/output_fmt.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -588,9 +588,9 @@ static struct format_entry_s {
{"%lbl", 0, " label", String_Label}, // Flow Label

// EXipInfo
{"%ttl", 0, "TTL", String_ipTTL}, // Flow ip ttl
{"%minttl", 0, "minTTL", String_ipminTTL}, // Flow ip min ttl
{"%maxttl", 0, "maxTTL", String_ipmaxTTL}, // Flow ip max ttl
{"%ttl", 0, "min/maxTTL", String_ipTTL}, // Flow min/max TTL
{"%minttl", 0, "minTTL", String_ipminTTL}, // Flow ip min TTL
{"%maxttl", 0, "maxTTL", String_ipmaxTTL}, // Flow ip max TTL
{"%frag", 0, "Frag", String_ipFrag}, // IP fragment flags

{"%n", 0, "", String_NewLine}, // \n
Expand Down Expand Up @@ -1969,9 +1969,10 @@ static void String_FlowEndReason(FILE *stream, recordHandle_t *recordHandle) {

static void String_ipTTL(FILE *stream, recordHandle_t *recordHandle) {
EXipInfo_t *ipInfo = (EXipInfo_t *)recordHandle->extensionList[EXipInfoID];
uint8_t ttl = ipInfo ? ipInfo->ttl : 0;
EXipInfo_t nullIPinfo = {0};
if (ipInfo == NULL) ipInfo = &nullIPinfo;

fprintf(stream, "%3u", ttl);
fprintf(stream, "%5u %5u", ipInfo->minTTL, ipInfo->maxTTL);
} // End of String_ipTTL

static void String_ipminTTL(FILE *stream, recordHandle_t *recordHandle) {
Expand Down
3 changes: 1 addition & 2 deletions src/output/output_json.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -285,7 +285,7 @@ static char *stringEXflowMisc(char *streamPtr, recordHandle_t *recordHandle, voi
static char *stringEXipInfo(char *streamPtr, void *extensionRecord) {
EXipInfo_t *ipInfo = (EXipInfo_t *)extensionRecord;

if (ipInfo->ttl || ipInfo->fragmentFlags) {
if (ipInfo->fragmentFlags) {
char flags[4] = "--\0";
if (ipInfo->fragmentFlags & flagDF) {
flags[0] = 'D';
Expand All @@ -297,7 +297,6 @@ static char *stringEXipInfo(char *streamPtr, void *extensionRecord) {
}

AddElementString("ip_fragment", flags);
AddElementU32("ip_ttl", (uint32_t)ipInfo->ttl);
}
if (ipInfo->minTTL || ipInfo->maxTTL) {
AddElementU32("ip_minttl", (uint32_t)ipInfo->minTTL);
Expand Down
3 changes: 1 addition & 2 deletions src/output/output_ndjson.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -273,7 +273,7 @@ static char *stringEXflowMisc(char *streamPtr, recordHandle_t *recordHandle, voi
static char *stringEXipInfo(char *streamPtr, void *extensionRecord) {
EXipInfo_t *ipInfo = (EXipInfo_t *)extensionRecord;

if (ipInfo->ttl || ipInfo->fragmentFlags) {
if (ipInfo->fragmentFlags) {
char flags[4] = "--\0";
if (ipInfo->fragmentFlags & flagDF) {
flags[0] = 'D';
Expand All @@ -285,7 +285,6 @@ static char *stringEXipInfo(char *streamPtr, void *extensionRecord) {
}

AddElementString("ip_fragment", flags);
AddElementU32("ip_ttl", (uint32_t)ipInfo->ttl);
}
if (ipInfo->minTTL || ipInfo->maxTTL) {
AddElementU32("ip_minttl", (uint32_t)ipInfo->minTTL);
Expand Down
7 changes: 2 additions & 5 deletions src/output/output_raw.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -306,13 +306,10 @@ static void stringsEXflowMisc(FILE *stream, recordHandle_t *recordHandle, void *
static void stringEXipInfo(FILE *stream, void *extensionRecord) {
EXipInfo_t *ipInfo = (EXipInfo_t *)extensionRecord;

if (ipInfo->ttl || ipInfo->fragmentFlags) {
if (ipInfo->fragmentFlags) {
char *DF = ipInfo->fragmentFlags & flagDF ? "DF" : " ";
char *MF = ipInfo->fragmentFlags & flagMF ? "MF" : " ";
fprintf(stream,
" ip fragment = 0x%.2x %s %s\n"
" ip TTL = %5u\n",
ipInfo->fragmentFlags, DF, MF, ipInfo->ttl);
fprintf(stream, " ip fragment = 0x%.2x %s %s\n", ipInfo->fragmentFlags, DF, MF);
}
if (ipInfo->minTTL || ipInfo->maxTTL) {
fprintf(stream,
Expand Down
Loading

0 comments on commit 21d61fc

Please sign in to comment.