Netanol 201 sflow parser implementation (#79)

* feat(sflow): parse sflow header and samples

Introduces parsing capabilities for sFlow headers and samples, including CounterSample and FlowSample. Restructures the SflowReader logic for better adherence to the specification. Documentation and testing are also added for the sFlow parser. Fixes were made to handle multiple records in a sample and adjust RawPacketHeader initialization for accuracy.

Author: m4lm

Docker/replay/captures/netflow5-1.pcap

@@ -14,10 +14,14 @@
         <PackageProjectUrl>https://github.com/UniStuttgart-VISUS/dotnetflow</PackageProjectUrl>
         <RepositoryUrl>https://github.com/UniStuttgart-VISUS/dotnetflow</RepositoryUrl>
         <PackageTags>netflow ipfix</PackageTags>
+        <LangVersion>8</LangVersion>
     </PropertyGroup>
 
     <ItemGroup>
         <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+        <PackageReference Include="PcapDotNet" Version="0.10.2" />
+        <PackageReference Include="PcapDotNet.Base" Version="1.0.4.1" />
+        <PackageReference Include="PcapDotNet.Packets" Version="1.0.4.1" />
     </ItemGroup>
 
     <ItemGroup>

Packrat/DotNetFlow/DotNetFlow.csproj

@@ -0,0 +1,14 @@
+namespace DotNetFlow.Sflow
+{
+    /// <summary>
+    /// The format of the upcoming counter record.
+    /// Can be extended to include other counter types.
+    /// </summary>
+    public enum CounterFormat
+    {
+        GenericInterfaceCounters = 1,
+        EthernetInterfaceCounters = 2,
+        VlanCounters = 5,
+        InfiniBandCounters = 9
+    }
+}

Packrat/DotNetFlow/Sflow/CounterFormat.cs

@@ -0,0 +1,11 @@
+namespace DotNetFlow.Sflow
+{
+    /// <summary>
+    /// Base class for all counter records.
+    /// </summary>
+    public abstract class CounterRecord : IRecord
+    {
+        public Enterprise Enterprise { get; set; }
+        public CounterFormat Format;
+    }
+}

Packrat/DotNetFlow/Sflow/CounterRecord.cs

@@ -0,0 +1,19 @@
+using System.Collections.Generic;
+
+namespace DotNetFlow.Sflow
+{
+    /// <summary>
+    /// A counter sample containing a set of counter records from a specific data source.
+    /// </summary>
+    public class CounterSample : ISample
+    {
+        public Enterprise Enterprise { get; set; }
+        public SampleType Type { get; set; }
+        public uint SampleLength { get; set; }
+        public uint SequenceNumber { get; set; }
+        public ushort SourceIdType { get; set; }
+        public ushort SourceIdIndex { get; set; }
+        public uint NumRecords { get; set; }
+        public List<CounterRecord> CounterRecords { get; set; }
+    }
+}

Packrat/DotNetFlow/Sflow/CounterSample.cs

@@ -0,0 +1,13 @@
+using System.Collections.Generic;
+
+namespace DotNetFlow.Sflow
+{
+    /// <summary>
+    /// Represents an sFlow datagram.
+    /// </summary>
+    public class Datagram
+    {
+        public Header Header;
+        List<ISample> Samples;
+    }
+}

Packrat/DotNetFlow/Sflow/Datagram.cs

@@ -0,0 +1,10 @@
+namespace DotNetFlow.Sflow
+{
+    /// <summary>
+    /// Represents the sFlow SMI Private Enterprise Code.
+    /// </summary>
+    public enum Enterprise
+    {
+        StandardSflow = 0 // InMon Corporation
+    }
+}

Packrat/DotNetFlow/Sflow/Enterprise.cs

@@ -0,0 +1,18 @@
+namespace DotNetFlow.Sflow
+{
+    /// <summary>
+    /// The format of the upcoming flow record.
+    /// Can be extended to include other flow types.
+    /// </summary>
+    public enum FlowFormat
+    {
+        RawPacketHeader = 1,
+        EthernetFrame = 2,
+        IPv4Header = 3,
+        IPv6Header = 4,
+        ExtendedSwitchData = 1001,
+        ExtendedRouterData = 1002,
+        ExtendedGatewayData = 1003,
+        ExtendedUserFlowData = 1004
+    }
+}

Packrat/DotNetFlow/Sflow/FlowFormat.cs

@@ -0,0 +1,11 @@
+namespace DotNetFlow.Sflow
+{
+    /// <summary>
+    /// Base class for all flow records.
+    /// </summary>
+    public abstract class FlowRecord : IRecord
+    {
+        public Enterprise Enterprise { get; set; }
+        public FlowFormat Format;
+    }
+}

Packrat/DotNetFlow/Sflow/FlowRecord.cs

@@ -0,0 +1,24 @@
+using System.Collections.Generic;
+
+namespace DotNetFlow.Sflow
+{
+    /// <summary>
+    /// A flow sample containing a set of flow records from a specific data source.
+    /// </summary>
+    public class FlowSample : ISample
+    {
+        public Enterprise Enterprise { get; set; }
+        public SampleType Type { get; set; }
+        public uint SampleLength { get; set; }
+        public uint SequenceNumber { get; set; }
+        public ushort SourceIdClass { get; set; }
+        public ushort SourceIdIndex { get; set; }
+        public uint SamplingRate { get; set; }
+        public uint SamplePool { get; set; }
+        public uint Drops { get; set; }
+        public InterfaceInfo InputInterface { get; set; }
+        public InterfaceInfo OutputInterface { get; set; }
+        public uint NumRecords { get; set; }
+        public List<FlowRecord> FlowRecords { get; set; }
+    }
+}

Packrat/DotNetFlow/Sflow/FlowSample.cs

@@ -0,0 +1,45 @@
+namespace DotNetFlow.Sflow
+{
+    /// <summary>
+    /// Represents the direction of the interface.
+    /// More detail can be found in the sFlow v5 specification.
+    /// </summary>
+    public enum IfDirection
+    {
+        Unknown = 0,
+        FullDuplex = 1,
+        HalfDuplex = 2,
+        In = 3,
+        Out = 4
+    }
+    
+    /// <summary>
+    ///  Represents the sFlow Generic Interface Counters record.
+    /// </summary>
+    public class GenericInterfaceCounters : CounterRecord
+    {
+        public Enterprise Enterprise { get; set; }
+        public CounterFormat Format { get; set; }
+        public uint FlowDataLength { get; set; }
+        public uint IfIndex { get; set; }
+        public uint IfType { get; set; }
+        public uint IfSpeed { get; set; }
+        public IfDirection IfDirection { get; set; }
+        public ushort IfAdminStatus { get; set; }
+        public ushort IfOperStatus { get; set; }
+        public ulong InputOctets { get; set; }
+        public uint InputPackets { get; set; }
+        public uint InputMulticastPackets { get; set; }
+        public uint InputBroadcastPackets { get; set; }
+        public uint InputDiscardedPackets { get; set; }
+        public uint InputErrors { get; set; }
+        public uint InputUnknownProtocolPackets { get; set; }
+        public ulong OutputOctets { get; set; }
+        public uint OutputPackets { get; set; }
+        public uint OutputMulticastPackets { get; set; }
+        public uint OutputBroadcastPackets { get; set; }
+        public uint OutputDiscardedPackets { get; set; }
+        public uint OutputErrors { get; set; }
+        public uint PromiscuousMode { get; set; }   
+    }
+}

Packrat/DotNetFlow/Sflow/GenericInterfaceCounters.cs

@@ -0,0 +1,18 @@
+using System.Net;
+
+namespace DotNetFlow.Sflow
+{
+    /// <summary>
+    /// Represents the sFlow header.
+    /// </summary>
+    public class Header
+    {
+        public uint Version; // sFlow version
+        public uint AgentAddressType; // 1 for IPv4, 2 for IPv6
+        public IPAddress AgentAddress; // The address of the sFlow agent
+        public uint SubAgentId;
+        public uint SequenceNumber;
+        public uint SysUpTime; // System uptime in ms
+        public uint NumSamples; // Number of samples in the datagram
+    }
+}

Packrat/DotNetFlow/Sflow/Header.cs

@@ -0,0 +1,14 @@
+namespace DotNetFlow.Sflow
+{
+    /// <summary>
+    /// Represents the first protocol of the sampled packet inside the <see cref="RawPacketHeader"/>.
+    /// </summary>
+    public enum HeaderProtocol
+    {
+        Ethernet = 1,
+        Ppp = 7,
+        Ipv4 = 11,
+        Ipv6 = 12,
+        Mpls = 13,
+    }
+}

Packrat/DotNetFlow/Sflow/HeaderProtocol.cs

@@ -0,0 +1,10 @@
+namespace DotNetFlow.Sflow
+{
+    /// <summary>
+    /// Represents an interface for all sFlow records.
+    /// </summary>
+    public interface IRecord
+    {
+        Enterprise Enterprise { get; set; }
+    }
+}

Packrat/DotNetFlow/Sflow/IRecord.cs

@@ -0,0 +1,23 @@
+namespace DotNetFlow.Sflow
+{
+    /// <summary>
+    /// Interface for all sample types
+    /// </summary>
+    public interface ISample
+    {
+        Enterprise Enterprise { get; set; }
+        SampleType Type { get; set; }
+    }
+
+    /// <summary>
+    /// Enumeration of the different sample types
+    /// These are not all sample types, the most common are FlowSample and CounterSample.
+    /// </summary>
+    public enum SampleType
+    {
+        FlowSample = 1,
+        CounterSample = 2,
+        ExpandedFlowSample = 3,
+        ExpandedCounterSample = 4
+    }
+}

Packrat/DotNetFlow/Sflow/ISample.cs

@@ -0,0 +1,15 @@
+using System.Collections.Generic;
+using System.IO;
+using System.Net;
+using System.Runtime.InteropServices;
+using PcapDotNet.Packets;
+
+namespace DotNetFlow.Sflow
+{
+    public interface ISflowReader
+    {
+        // Datagram BuildDatagram(Stream datagramStream); // not sure if this is necessary
+        Header ReadHeader(Stream datagramStream);
+        IEnumerable<ISample> ReadSamples(Stream datagramStream, uint numSamples);
+    }
+}

Packrat/DotNetFlow/Sflow/ISflowReader.cs

@@ -0,0 +1,12 @@
+namespace DotNetFlow.Sflow
+{
+    /// <summary>
+    /// Represents the sFlow Interface Format.
+    /// </summary>
+    public enum InterfaceFormat
+    {
+        SingleInterface =  0,
+        PacketDiscarded =  1,
+        MultipleDestinationInterfaces =  2
+    }
+}

Packrat/DotNetFlow/Sflow/InterfaceFormat.cs

@@ -0,0 +1,12 @@
+namespace DotNetFlow.Sflow
+{
+    /// <summary>
+    /// Represents the interface information. Either input or output.
+    /// According to the sFlow v5 specification, the input interface can only be <see cref="InterfaceFormat.SingleInterface"/>.
+    /// </summary>
+    public class InterfaceInfo
+    {
+        public InterfaceFormat InterfaceFormat { get; set; }
+        public uint InterfaceValue { get; set; }
+    }
+}

Packrat/DotNetFlow/Sflow/InterfaceInfo.cs

@@ -0,0 +1,19 @@
+using PcapDotNet.Packets;
+
+namespace DotNetFlow.Sflow
+{
+    /// <summary>
+    /// Represents the sFlow Raw Packet Header record.
+    /// </summary>
+    public class RawPacketHeader : FlowRecord
+    {
+        public Enterprise Enterprise { get; set; }
+        public FlowFormat Format { get; set; }
+        public uint FlowDataLength { get; set; }
+        public HeaderProtocol HeaderProtocol { get; set; }
+        public uint FrameLength { get; set; }
+        public uint StrippedBytes { get; set; }
+        public uint SampledHeaderLength { get; set; }
+        public Packet Packet { get; set; }
+    }
+}