Skip to main content

flowparser_sflow/flow_records/
sampled_ethernet.rs

1use mac_address::MacAddress;
2use nom::IResult;
3use nom::number::complete::be_u32;
4use serde::{Deserialize, Serialize};
5
6#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
7pub struct SampledEthernet {
8    pub length: u32,
9    pub src_mac: MacAddress,
10    pub dst_mac: MacAddress,
11    pub eth_type: u32,
12}
13
14fn parse_mac(input: &[u8]) -> IResult<&[u8], MacAddress> {
15    if input.len() < 8 {
16        return Err(nom::Err::Error(nom::error::Error::new(
17            input,
18            nom::error::ErrorKind::Eof,
19        )));
20    }
21    // sFlow pads MAC addresses to 8 bytes (6 bytes MAC + 2 bytes padding)
22    let bytes: [u8; 6] = [input[0], input[1], input[2], input[3], input[4], input[5]];
23    Ok((&input[8..], MacAddress::new(bytes)))
24}
25
26pub(crate) fn parse_sampled_ethernet(input: &[u8]) -> IResult<&[u8], SampledEthernet> {
27    // sFlow sampled ethernet: length(4) + src_mac(8) + dst_mac(8) + eth_type(4)
28    let (input, length) = be_u32(input)?;
29    let (input, src_mac) = parse_mac(input)?;
30    let (input, dst_mac) = parse_mac(input)?;
31    let (input, eth_type) = be_u32(input)?;
32
33    Ok((
34        input,
35        SampledEthernet {
36            length,
37            src_mac,
38            dst_mac,
39            eth_type,
40        },
41    ))
42}