sflow_parser/models/
record_flows.rs

1//! Flow record data structures
2//!
3//! These represent the actual packet data captured in flow samples.
4//! Enterprise = 0 (sFlow.org standard formats)
5
6use std::net::{Ipv4Addr, Ipv6Addr};
7
8/// Header protocol types for sampled headers
9#[derive(Debug, Clone, Copy, PartialEq, Eq)]
10pub enum HeaderProtocol {
11    EthernetIso88023 = 1,
12    Iso88024TokenBus = 2,
13    Iso88025TokenRing = 3,
14    Fddi = 4,
15    FrameRelay = 5,
16    X25 = 6,
17    Ppp = 7,
18    Smds = 8,
19    Aal5 = 9,
20    Aal5Ip = 10,
21    Ipv4 = 11,
22    Ipv6 = 12,
23    Mpls = 13,
24    Pos = 14,
25    Ieee80211Mac = 15,
26    Ieee80211Ampdu = 16,
27    Ieee80211Amsdu = 17,
28}
29
30impl HeaderProtocol {
31    /// Convert from u32 value to HeaderProtocol enum
32    pub fn from_u32(value: u32) -> Option<Self> {
33        match value {
34            1 => Some(HeaderProtocol::EthernetIso88023),
35            2 => Some(HeaderProtocol::Iso88024TokenBus),
36            3 => Some(HeaderProtocol::Iso88025TokenRing),
37            4 => Some(HeaderProtocol::Fddi),
38            5 => Some(HeaderProtocol::FrameRelay),
39            6 => Some(HeaderProtocol::X25),
40            7 => Some(HeaderProtocol::Ppp),
41            8 => Some(HeaderProtocol::Smds),
42            9 => Some(HeaderProtocol::Aal5),
43            10 => Some(HeaderProtocol::Aal5Ip),
44            11 => Some(HeaderProtocol::Ipv4),
45            12 => Some(HeaderProtocol::Ipv6),
46            13 => Some(HeaderProtocol::Mpls),
47            14 => Some(HeaderProtocol::Pos),
48            15 => Some(HeaderProtocol::Ieee80211Mac),
49            16 => Some(HeaderProtocol::Ieee80211Ampdu),
50            17 => Some(HeaderProtocol::Ieee80211Amsdu),
51            _ => None,
52        }
53    }
54}
55
56impl std::fmt::Display for HeaderProtocol {
57    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
58        match self {
59            HeaderProtocol::EthernetIso88023 => write!(f, "Ethernet (ISO 802.3)"),
60            HeaderProtocol::Iso88024TokenBus => write!(f, "ISO 802.4 Token Bus"),
61            HeaderProtocol::Iso88025TokenRing => write!(f, "ISO 802.5 Token Ring"),
62            HeaderProtocol::Fddi => write!(f, "FDDI"),
63            HeaderProtocol::FrameRelay => write!(f, "Frame Relay"),
64            HeaderProtocol::X25 => write!(f, "X.25"),
65            HeaderProtocol::Ppp => write!(f, "PPP"),
66            HeaderProtocol::Smds => write!(f, "SMDS"),
67            HeaderProtocol::Aal5 => write!(f, "AAL5"),
68            HeaderProtocol::Aal5Ip => write!(f, "AAL5 IP"),
69            HeaderProtocol::Ipv4 => write!(f, "IPv4"),
70            HeaderProtocol::Ipv6 => write!(f, "IPv6"),
71            HeaderProtocol::Mpls => write!(f, "MPLS"),
72            HeaderProtocol::Pos => write!(f, "POS"),
73            HeaderProtocol::Ieee80211Mac => write!(f, "IEEE 802.11 MAC"),
74            HeaderProtocol::Ieee80211Ampdu => write!(f, "IEEE 802.11 A-MPDU"),
75            HeaderProtocol::Ieee80211Amsdu => write!(f, "IEEE 802.11 A-MSDU"),
76        }
77    }
78}
79
80/// Sampled Header - Format (0,1)
81///
82/// Raw packet header captured from the wire
83///
84/// # XDR Definition (sFlow v5)
85///
86/// ```text
87/// /* Raw Packet Header */
88/// /* opaque = flow_data; enterprise = 0; format = 1 */
89///
90/// struct sampled_header {
91///     header_protocol protocol;  /* Format of sampled header */
92///     unsigned int frame_length; /* Original length of packet before sampling */
93///     unsigned int stripped;     /* Number of octets removed from packet */
94///     opaque header<>;           /* Header bytes */
95/// }
96/// ```
97#[derive(Debug, Clone, PartialEq, Eq)]
98pub struct SampledHeader {
99    /// Protocol of the sampled packet
100    pub protocol: HeaderProtocol,
101
102    /// Original length of the packet (before sampling)
103    pub frame_length: u32,
104
105    /// Number of bytes stripped from the packet before sampling
106    pub stripped: u32,
107
108    /// Raw header bytes
109    pub header: Vec<u8>,
110}
111
112/// Sampled Ethernet Frame - Format (0,2)
113///
114/// Ethernet frame header information
115///
116/// # XDR Definition (sFlow v5)
117///
118/// ```text
119/// /* Ethernet Frame Data */
120/// /* opaque = flow_data; enterprise = 0; format = 2 */
121///
122/// struct sampled_ethernet {
123///     unsigned int length;   /* The length of the MAC packet received on the
124///                               network, excluding lower layer encapsulations
125///                               and framing bits but including FCS octets */
126///     mac src_mac;           /* Source MAC address */
127///     mac dst_mac;           /* Destination MAC address */
128///     unsigned int type;     /* Ethernet packet type */
129/// }
130/// ```
131#[derive(Debug, Clone, PartialEq, Eq)]
132pub struct SampledEthernet {
133    /// Length of MAC packet in bytes
134    pub length: u32,
135
136    /// Source MAC address
137    pub src_mac: crate::models::MacAddress,
138
139    /// Destination MAC address
140    pub dst_mac: crate::models::MacAddress,
141
142    /// Ethernet type
143    pub eth_type: u32,
144}
145
146/// Sampled IPv4 - Format (0,3)
147///
148/// IPv4 packet header information
149///
150/// # XDR Definition (sFlow v5)
151///
152/// ```text
153/// /* Packet IP version 4 data */
154/// /* opaque = flow_data; enterprise = 0; format = 3 */
155///
156/// struct sampled_ipv4 {
157///     unsigned int length;     /* Length of IP packet excluding lower layer encapsulations */
158///     unsigned int protocol;   /* IP Protocol type (e.g., TCP = 6, UDP = 17) */
159///     ip_v4 src_ip;            /* Source IP Address */
160///     ip_v4 dst_ip;            /* Destination IP Address */
161///     unsigned int src_port;   /* TCP/UDP source port number or equivalent */
162///     unsigned int dst_port;   /* TCP/UDP destination port number or equivalent */
163///     unsigned int tcp_flags;  /* TCP flags */
164///     unsigned int tos;        /* IP type of service */
165/// }
166/// ```
167#[derive(Debug, Clone, PartialEq, Eq)]
168pub struct SampledIpv4 {
169    /// Length of IP packet in bytes
170    pub length: u32,
171
172    /// IP Protocol (TCP=6, UDP=17, etc.)
173    pub protocol: u32,
174
175    /// Source IP address
176    pub src_ip: Ipv4Addr,
177
178    /// Destination IP address
179    pub dst_ip: Ipv4Addr,
180
181    /// Source port (for TCP/UDP)
182    pub src_port: u32,
183
184    /// Destination port (for TCP/UDP)
185    pub dst_port: u32,
186
187    /// TCP flags
188    pub tcp_flags: u32,
189
190    /// Type of Service
191    pub tos: u32,
192}
193
194/// Sampled IPv6 - Format (0,4)
195///
196/// IPv6 packet header information
197///
198/// # XDR Definition (sFlow v5)
199///
200/// ```text
201/// /* Packet IP Version 6 Data */
202/// /* opaque = flow_data; enterprise = 0; format = 4 */
203///
204/// struct sampled_ipv6 {
205///     unsigned int length;     /* Length of IP packet excluding lower layer encapsulations */
206///     unsigned int protocol;   /* IP next header (e.g., TCP = 6, UDP = 17) */
207///     ip_v6 src_ip;            /* Source IP Address */
208///     ip_v6 dst_ip;            /* Destination IP Address */
209///     unsigned int src_port;   /* TCP/UDP source port number or equivalent */
210///     unsigned int dst_port;   /* TCP/UDP destination port number or equivalent */
211///     unsigned int tcp_flags;  /* TCP flags */
212///     unsigned int priority;   /* IP priority */
213/// }
214/// ```
215#[derive(Debug, Clone, PartialEq, Eq)]
216pub struct SampledIpv6 {
217    /// Length of IP packet in bytes
218    pub length: u32,
219
220    /// IP Protocol (TCP=6, UDP=17, etc.)
221    pub protocol: u32,
222
223    /// Source IP address
224    pub src_ip: Ipv6Addr,
225
226    /// Destination IP address
227    pub dst_ip: Ipv6Addr,
228
229    /// Source port (for TCP/UDP)
230    pub src_port: u32,
231
232    /// Destination port (for TCP/UDP)
233    pub dst_port: u32,
234
235    /// TCP flags
236    pub tcp_flags: u32,
237
238    /// Priority (traffic class)
239    pub priority: u32,
240}
241
242/// Extended Switch Data - Format (0,1001)
243///
244/// Layer 2 switching information
245///
246/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
247///
248/// ```text
249/// /* Extended Switch Data */
250/// /* opaque = flow_data; enterprise = 0; format = 1001 */
251///
252/// struct extended_switch {
253///     unsigned int src_vlan;     /* The 802.1Q VLAN id of incoming frame */
254///     unsigned int src_priority; /* The 802.1p priority of incoming frame */
255///     unsigned int dst_vlan;     /* The 802.1Q VLAN id of outgoing frame */
256///     unsigned int dst_priority; /* The 802.1p priority of outgoing frame */
257/// }
258/// ```
259#[derive(Debug, Clone, PartialEq, Eq)]
260pub struct ExtendedSwitch {
261    /// Source VLAN ID
262    pub src_vlan: u32,
263
264    /// Source priority (802.1p)
265    pub src_priority: u32,
266
267    /// Destination VLAN ID
268    pub dst_vlan: u32,
269
270    /// Destination priority (802.1p)
271    pub dst_priority: u32,
272}
273
274/// Extended Router Data - Format (0,1002)
275///
276/// Layer 3 routing information
277///
278/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
279///
280/// ```text
281/// /* Extended Router Data */
282/// /* opaque = flow_data; enterprise = 0; format = 1002 */
283///
284/// struct extended_router {
285///     next_hop nexthop;          /* IP address of next hop router */
286///     unsigned int src_mask_len; /* Source address prefix mask (number of bits) */
287///     unsigned int dst_mask_len; /* Destination address prefix mask (number of bits) */
288/// }
289/// ```
290#[derive(Debug, Clone, PartialEq, Eq)]
291pub struct ExtendedRouter {
292    /// IP address of next hop router
293    pub next_hop: crate::models::core::Address,
294
295    /// Source subnet mask bits
296    pub src_mask_len: u32,
297
298    /// Destination subnet mask bits
299    pub dst_mask_len: u32,
300}
301
302/// AS Path Type
303#[derive(Debug, Clone, Copy, PartialEq, Eq)]
304pub enum AsPathType {
305    AsSet = 1,
306    AsSequence = 2,
307}
308
309/// AS Path Segment
310#[derive(Debug, Clone, PartialEq, Eq)]
311pub struct AsPathSegment {
312    pub path_type: u32,
313    pub path_length: u32,
314    pub path: Vec<u32>,
315}
316
317/// Extended Gateway Data - Format (0,1003)
318///
319/// BGP routing information
320///
321/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
322///
323/// ```text
324/// /* Extended Gateway Data */
325/// /* opaque = flow_data; enterprise = 0; format = 1003 */
326///
327/// struct extended_gateway {
328///     next_hop nexthop;           /* Address of the border router */
329///     unsigned int as;            /* Autonomous system number of router */
330///     unsigned int src_as;        /* Autonomous system number of source */
331///     unsigned int src_peer_as;   /* Autonomous system number of source peer */
332///     as_path_type dst_as_path<>; /* AS path to the destination */
333///     unsigned int communities<>; /* Communities associated with this route */
334///     unsigned int localpref;     /* LocalPref associated with this route */
335/// }
336/// ```
337#[derive(Debug, Clone, PartialEq, Eq)]
338pub struct ExtendedGateway {
339    /// IP address of the border router
340    pub next_hop: crate::models::core::Address,
341
342    /// Autonomous system number
343    pub as_number: u32,
344
345    /// Source AS
346    pub src_as: u32,
347
348    /// Source peer AS
349    pub src_peer_as: u32,
350
351    /// Number of AS path segments
352    pub as_path_segments: Vec<AsPathSegment>,
353
354    /// BGP communities
355    pub communities: Vec<u32>,
356
357    /// Local preference
358    pub local_pref: u32,
359}
360
361/// Extended User Data - Format (0,1004)
362///
363/// Application-level user information
364///
365/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
366///
367/// ```text
368/// /* Extended User Data */
369/// /* opaque = flow_data; enterprise = 0; format = 1004 */
370///
371/// struct extended_user {
372///     charset src_charset;   /* Character set for src_user */
373///     opaque src_user<>;     /* User ID associated with packet source */
374///     charset dst_charset;   /* Character set for dst_user */
375///     opaque dst_user<>;     /* User ID associated with packet destination */
376/// }
377/// ```
378#[derive(Debug, Clone, PartialEq, Eq)]
379pub struct ExtendedUser {
380    /// Source character set (MIBEnum)
381    pub src_charset: u32,
382
383    /// Source user ID
384    pub src_user: String,
385
386    /// Destination character set (MIBEnum)
387    pub dst_charset: u32,
388
389    /// Destination user ID
390    pub dst_user: String,
391}
392
393/// URL Direction
394#[derive(Debug, Clone, Copy, PartialEq, Eq)]
395pub enum UrlDirection {
396    Source = 1,
397    Destination = 2,
398}
399
400/// Extended URL Data - Format (0,1005)
401///
402/// HTTP request information
403///
404/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
405///
406/// ```text
407/// /* Extended URL Data */
408/// /* opaque = flow_data; enterprise = 0; format = 1005 */
409///
410/// struct extended_url {
411///     url_direction direction; /* Direction of connection */
412///     string url<>;            /* The HTTP request-line (see RFC 2616) */
413///     string host<>;           /* The host field from the HTTP header */
414/// }
415/// ```
416#[derive(Debug, Clone, PartialEq, Eq)]
417pub struct ExtendedUrl {
418    /// Direction (source or destination)
419    pub direction: u32,
420
421    /// URL string (HTTP request-line)
422    pub url: String,
423
424    /// Host header from HTTP request
425    pub host: String,
426}
427
428/// Extended MPLS Data - Format (0,1006)
429///
430/// MPLS label stack information
431///
432/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
433///
434/// ```text
435/// /* Extended MPLS Data */
436/// /* opaque = flow_data; enterprise = 0; format = 1006 */
437///
438/// struct extended_mpls {
439///     next_hop nexthop;     /* Address of the next hop */
440///     label_stack in_stack; /* Label stack of received packet */
441///     label_stack out_stack;/* Label stack for transmitted packet */
442/// }
443/// ```
444#[derive(Debug, Clone, PartialEq, Eq)]
445pub struct ExtendedMpls {
446    /// Next hop address
447    pub next_hop: crate::models::core::Address,
448
449    /// Input label stack
450    pub in_stack: Vec<u32>,
451
452    /// Output label stack
453    pub out_stack: Vec<u32>,
454}
455
456/// Extended NAT Data - Format (0,1007)
457///
458/// Network Address Translation information
459///
460/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
461///
462/// ```text
463/// /* Extended NAT Data */
464/// /* opaque = flow_data; enterprise = 0; format = 1007 */
465///
466/// struct extended_nat {
467///     address src_address; /* Source address */
468///     address dst_address; /* Destination address */
469/// }
470/// ```
471#[derive(Debug, Clone, PartialEq, Eq)]
472pub struct ExtendedNat {
473    /// Source address type
474    pub src_address: crate::models::core::Address,
475
476    /// Destination address type
477    pub dst_address: crate::models::core::Address,
478}
479
480/// Extended MPLS Tunnel - Format (0,1008)
481///
482/// MPLS tunnel information
483///
484/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
485///
486/// ```text
487/// /* Extended MPLS Tunnel */
488/// /* opaque = flow_data; enterprise = 0; format = 1008 */
489///
490/// struct extended_mpls_tunnel {
491///     string tunnel_lsp_name<>; /* Tunnel name */
492///     unsigned int tunnel_id;   /* Tunnel ID */
493///     unsigned int tunnel_cos;  /* Tunnel COS value */
494/// }
495/// ```
496#[derive(Debug, Clone, PartialEq, Eq)]
497pub struct ExtendedMplsTunnel {
498    /// Tunnel LSP name
499    pub tunnel_lsp_name: String,
500
501    /// Tunnel ID
502    pub tunnel_id: u32,
503
504    /// Tunnel COS value
505    pub tunnel_cos: u32,
506}
507
508/// Extended MPLS VC - Format (0,1009)
509///
510/// MPLS Virtual Circuit information
511///
512/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
513///
514/// ```text
515/// /* Extended MPLS VC */
516/// /* opaque = flow_data; enterprise = 0; format = 1009 */
517///
518/// struct extended_mpls_vc {
519///     string vc_instance_name<>; /* VC instance name */
520///     unsigned int vll_vc_id;    /* VLL/VC instance ID */
521///     unsigned int vc_label_cos; /* VC Label COS value */
522/// }
523/// ```
524#[derive(Debug, Clone, PartialEq, Eq)]
525pub struct ExtendedMplsVc {
526    /// VC instance name
527    pub vc_instance_name: String,
528
529    /// VC ID
530    pub vll_vc_id: u32,
531
532    /// VC label
533    pub vc_label: u32,
534
535    /// VC COS
536    pub vc_cos: u32,
537}
538
539/// Extended MPLS FEC - Format (0,1010)
540///
541/// MPLS Forwarding Equivalence Class information
542///
543/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
544///
545/// ```text
546/// /* Extended MPLS FEC */
547/// /* opaque = flow_data; enterprise = 0; format = 1010 */
548///
549/// struct extended_mpls_FTN {
550///     string mplsFTNDescr<>;  /* FEC description */
551///     unsigned int mplsFTNMask; /* FEC mask */
552/// }
553/// ```
554#[derive(Debug, Clone, PartialEq, Eq)]
555pub struct ExtendedMplsFec {
556    /// FEC address prefix
557    pub fec_addr_prefix: crate::models::core::Address,
558
559    /// FEC prefix length
560    pub fec_prefix_len: u32,
561}
562
563/// Extended MPLS LVP FEC - Format (0,1011)
564///
565/// MPLS LDP FEC information
566///
567/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
568///
569/// ```text
570/// /* Extended MPLS LVP FEC */
571/// /* opaque = flow_data; enterprise = 0; format = 1011 */
572///
573/// struct extended_mpls_LDP_FEC {
574///     unsigned int mplsFecAddrPrefixLength; /* FEC address prefix length */
575/// }
576/// ```
577#[derive(Debug, Clone, PartialEq, Eq)]
578pub struct ExtendedMplsLvpFec {
579    /// FEC address prefix length
580    pub mpls_fec_addr_prefix_length: u32,
581}
582
583/// Extended VLAN Tunnel - Format (0,1012)
584///
585/// VLAN tunnel information for nested VLAN tags
586///
587/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
588///
589/// ```text
590/// /* Extended VLAN tunnel information */
591/// /* opaque = flow_data; enterprise = 0; format = 1012 */
592///
593/// struct extended_vlantunnel {
594///     unsigned int stack<>; /* List of stripped 802.1Q TPID/TCI layers */
595/// }
596/// ```
597#[derive(Debug, Clone, PartialEq, Eq)]
598pub struct ExtendedVlanTunnel {
599    /// Stack of VLAN tags
600    pub vlan_stack: Vec<u32>,
601}
602
603/// Extended 802.11 Payload - Format (0,1013)
604///
605/// Unencrypted 802.11 payload data
606///
607/// # XDR Definition ([sFlow 802.11](https://sflow.org/sflow_80211.txt))
608///
609/// ```text
610/// /* Extended 80211 Payload */
611/// /* opaque = flow_data; enterprise = 0; format = 1013 */
612///
613/// struct extended_80211_payload {
614///     cipher_suite ciphersuite; /* encryption scheme used for this packet */
615///     opaque data<>;            /* unencrypted bytes from the payload */
616/// }
617/// ```
618#[derive(Debug, Clone, PartialEq, Eq)]
619pub struct Extended80211Payload {
620    /// Cipher suite (OUI + Suite Type)
621    pub cipher_suite: u32,
622
623    /// Unencrypted payload data
624    pub data: Vec<u8>,
625}
626
627/// Extended 802.11 RX - Format (0,1014)
628///
629/// 802.11 receive information
630///
631/// # XDR Definition ([sFlow 802.11](https://sflow.org/sflow_80211.txt))
632///
633/// ```text
634/// /* Extended 802.11 RX */
635/// /* opaque = flow_data; enterprise = 0; format = 1014 */
636///
637/// struct extended_80211_rx {
638///     string ssid<32>;           /* SSID string */
639///     mac bssid;                 /* BSSID */
640///     ieee80211_version version; /* version */
641///     unsigned int channel;      /* channel number */
642///     unsigned hyper speed;      /* speed */
643///     unsigned int rsni;         /* received signal to noise ratio */
644///     unsigned int rcpi;         /* received channel power */
645///     duration_us packet_duration; /* time packet occupied RF medium */
646/// }
647/// ```
648#[derive(Debug, Clone, PartialEq, Eq)]
649pub struct Extended80211Rx {
650    /// SSID string (max 32 bytes)
651    pub ssid: String,
652
653    /// BSSID (MAC address)
654    pub bssid: crate::models::MacAddress,
655
656    /// IEEE 802.11 version (a=1, b=2, g=3, n=4)
657    pub version: u32,
658
659    /// Channel number
660    pub channel: u32,
661
662    /// Speed in bits per second
663    pub speed: u64,
664
665    /// Received signal to noise ratio (RSNI)
666    pub rsni: u32,
667
668    /// Received channel power indicator (RCPI)
669    pub rcpi: u32,
670
671    /// Packet duration in microseconds
672    pub packet_duration: u32,
673}
674
675/// Extended 802.11 TX - Format (0,1015)
676///
677/// 802.11 transmit information
678///
679/// # XDR Definition ([sFlow 802.11](https://sflow.org/sflow_80211.txt))
680///
681/// ```text
682/// /* Extended 802.11 TX */
683/// /* opaque = flow_data; enterprise = 0; format = 1015 */
684///
685/// struct extended_80211_tx {
686///     string ssid<32>;             /* SSID string */
687///     mac bssid;                   /* BSSID */
688///     ieee80211_version version;   /* version */
689///     unsigned int transmissions;  /* number of transmissions */
690///     duration_us packet_duration; /* time packet occupied RF medium */
691///     duration_us retrans_duration;/* time failed attempts occupied RF */
692///     unsigned int channel;        /* channel number */
693///     unsigned hyper speed;        /* speed */
694///     unsigned int power;          /* transmit power in mW */
695/// }
696/// ```
697#[derive(Debug, Clone, PartialEq, Eq)]
698pub struct Extended80211Tx {
699    /// SSID string (max 32 bytes)
700    pub ssid: String,
701
702    /// BSSID (MAC address)
703    pub bssid: crate::models::MacAddress,
704
705    /// IEEE 802.11 version (a=1, b=2, g=3, n=4)
706    pub version: u32,
707
708    /// Number of transmissions (0=unknown, 1=success on first attempt, n>1 = n-1 retransmissions)
709    pub transmissions: u32,
710
711    /// Packet duration in microseconds (successful transmission)
712    pub packet_duration: u32,
713
714    /// Retransmission duration in microseconds (failed attempts)
715    pub retrans_duration: u32,
716
717    /// Channel number
718    pub channel: u32,
719
720    /// Speed in bits per second
721    pub speed: u64,
722
723    /// Transmit power in milliwatts
724    pub power: u32,
725}
726
727/// PDU (Protocol Data Unit) in 802.11 aggregation
728///
729/// # XDR Definition ([sFlow 802.11](https://sflow.org/sflow_80211.txt))
730///
731/// ```text
732/// struct pdu {
733///     flow_record flow_records<>;
734/// }
735/// ```
736#[derive(Debug, Clone, PartialEq, Eq)]
737pub struct Pdu {
738    /// Flow records for this PDU
739    pub flow_records: Vec<crate::models::FlowRecord>,
740}
741
742/// Extended 802.11 Aggregation - Format (0,1016)
743///
744/// 802.11 frame aggregation information
745///
746/// # XDR Definition ([sFlow 802.11](https://sflow.org/sflow_80211.txt))
747///
748/// ```text
749/// /* Extended 802.11 Aggregation Data */
750/// /* opaque = flow_data; enterprise = 0; format = 1016 */
751///
752/// struct extended_80211_aggregation {
753///     pdu pdus<>; /* Array of PDUs in the aggregation */
754/// }
755/// ```
756#[derive(Debug, Clone, PartialEq, Eq)]
757pub struct Extended80211Aggregation {
758    /// Array of PDUs in the aggregation
759    pub pdus: Vec<Pdu>,
760}
761
762/// Extended OpenFlow v1 - Format (0,1017) - **DEPRECATED**
763///
764/// OpenFlow 1.0 forwarding information
765///
766/// **Note:** This format was defined in an early draft of the sFlow OpenFlow specification
767/// but was deprecated and removed from the final specification. It is included here for
768/// backward compatibility with legacy implementations.
769///
770/// # XDR Definition ([sFlow OpenFlow Draft](https://sflow.org/draft-sflow-openflow.txt))
771///
772/// ```text
773/// /* Extended OpenFlow 1.0 Data */
774/// /* opaque = flow_data; enterprise = 0; format = 1017 */
775///
776/// struct extended_openflow_v1 {
777///     unsigned hyper flow_cookie;  /* Flow cookie set by controller */
778///     wildcards flow_match;        /* Bit array of wildcarded fields */
779///     actions flow_actions;        /* Bit array of actions applied */
780/// }
781/// ```
782#[derive(Debug, Clone, PartialEq, Eq)]
783pub struct ExtendedOpenFlowV1 {
784    /// Flow cookie set by the OpenFlow controller
785    pub flow_cookie: u64,
786
787    /// Bit array describing the fields in the packet header that are used to form the flow key
788    /// See OpenFlow 1.0 ofp_match for the definition of wildcards
789    pub flow_match: u32,
790
791    /// Bit array describing fields that may have been altered by the flow action
792    /// The ofp_action_type enum is used to determine the bit positions
793    pub flow_actions: u32,
794}
795
796/// Extended Socket IPv4 - Format (0,2100)
797///
798/// IPv4 socket information for application transactions
799///
800/// # XDR Definition ([sFlow Host](https://sflow.org/sflow_host.txt))
801///
802/// ```text
803/// /* IPv4 Socket */
804/// /* opaque = flow_data; enterprise = 0; format = 2100 */
805///
806/// struct extended_socket_ipv4 {
807///     unsigned int protocol;     /* IP Protocol type (e.g., TCP = 6, UDP = 17) */
808///     ip_v4 local_ip;            /* local IP address */
809///     ip_v4 remote_ip;           /* remote IP address */
810///     unsigned int local_port;   /* TCP/UDP local port number or equivalent */
811///     unsigned int remote_port;  /* TCP/UDP remote port number or equivalent */
812/// }
813/// ```
814#[derive(Debug, Clone, PartialEq, Eq)]
815pub struct ExtendedSocketIpv4 {
816    /// IP Protocol type (e.g., TCP = 6, UDP = 17)
817    pub protocol: u32,
818
819    /// Local IP address
820    pub local_ip: std::net::Ipv4Addr,
821
822    /// Remote IP address
823    pub remote_ip: std::net::Ipv4Addr,
824
825    /// TCP/UDP local port number
826    pub local_port: u32,
827
828    /// TCP/UDP remote port number
829    pub remote_port: u32,
830}
831
832/// Extended Socket IPv6 - Format (0,2101)
833///
834/// IPv6 socket information for application transactions
835///
836/// # XDR Definition ([sFlow Host](https://sflow.org/sflow_host.txt))
837///
838/// ```text
839/// /* IPv6 Socket */
840/// /* opaque = flow_data; enterprise = 0; format = 2101 */
841///
842/// struct extended_socket_ipv6 {
843///     unsigned int protocol;     /* IP Protocol type (e.g., TCP = 6, UDP = 17) */
844///     ip_v6 local_ip;            /* local IP address */
845///     ip_v6 remote_ip;           /* remote IP address */
846///     unsigned int local_port;   /* TCP/UDP local port number or equivalent */
847///     unsigned int remote_port;  /* TCP/UDP remote port number or equivalent */
848/// }
849/// ```
850#[derive(Debug, Clone, PartialEq, Eq)]
851pub struct ExtendedSocketIpv6 {
852    /// IP Protocol type (e.g., TCP = 6, UDP = 17)
853    pub protocol: u32,
854
855    /// Local IP address
856    pub local_ip: std::net::Ipv6Addr,
857
858    /// Remote IP address
859    pub remote_ip: std::net::Ipv6Addr,
860
861    /// TCP/UDP local port number
862    pub local_port: u32,
863
864    /// TCP/UDP remote port number
865    pub remote_port: u32,
866}
867
868/// Application operation context
869///
870/// # XDR Definition ([sFlow Application](https://sflow.org/sflow_application.txt))
871///
872/// ```text
873/// struct context {
874///     application application;
875///     operation operation;
876///     attributes attributes;
877/// }
878/// ```
879#[derive(Debug, Clone, PartialEq, Eq)]
880pub struct AppContext {
881    /// Application name (e.g., "payment", "mail.smtp", "db.oracle")
882    pub application: String,
883
884    /// Operation name (e.g., "get.customer.name", "upload.photo")
885    pub operation: String,
886
887    /// Operation attributes as name=value pairs (e.g., "cc=visa&loc=mobile")
888    pub attributes: String,
889}
890
891/// Application operation status
892///
893/// # XDR Definition ([sFlow Application](https://sflow.org/sflow_application.txt))
894#[derive(Debug, Clone, Copy, PartialEq, Eq)]
895#[repr(u32)]
896pub enum AppStatus {
897    Success = 0,
898    Other = 1,
899    Timeout = 2,
900    InternalError = 3,
901    BadRequest = 4,
902    Forbidden = 5,
903    TooLarge = 6,
904    NotImplemented = 7,
905    NotFound = 8,
906    Unavailable = 9,
907    Unauthorized = 10,
908}
909
910impl From<u32> for AppStatus {
911    fn from(value: u32) -> Self {
912        match value {
913            0 => AppStatus::Success,
914            1 => AppStatus::Other,
915            2 => AppStatus::Timeout,
916            3 => AppStatus::InternalError,
917            4 => AppStatus::BadRequest,
918            5 => AppStatus::Forbidden,
919            6 => AppStatus::TooLarge,
920            7 => AppStatus::NotImplemented,
921            8 => AppStatus::NotFound,
922            9 => AppStatus::Unavailable,
923            10 => AppStatus::Unauthorized,
924            _ => AppStatus::Other,
925        }
926    }
927}
928
929/// Application Operation - Format (0,2202)
930///
931/// Sampled application operation information
932///
933/// # XDR Definition ([sFlow Application](https://sflow.org/sflow_application.txt))
934///
935/// ```text
936/// /* Sampled Application Operation */
937/// /* opaque = flow_data; enterprise = 0; format = 2202 */
938///
939/// struct app_operation {
940///     context context;             /* attributes describing the operation */
941///     utf8string<64> status_descr; /* additional text describing status */
942///     unsigned hyper req_bytes;    /* size of request body (exclude headers) */
943///     unsigned hyper resp_bytes;   /* size of response body (exclude headers) */
944///     unsigned int uS;             /* duration of the operation (microseconds) */
945///     status status;               /* status code */
946/// }
947/// ```
948#[derive(Debug, Clone, PartialEq, Eq)]
949pub struct AppOperation {
950    /// Operation context
951    pub context: AppContext,
952
953    /// Additional status description
954    pub status_descr: String,
955
956    /// Size of request body in bytes (excluding headers)
957    pub req_bytes: u64,
958
959    /// Size of response body in bytes (excluding headers)
960    pub resp_bytes: u64,
961
962    /// Duration of the operation in microseconds
963    pub duration_us: u32,
964
965    /// Operation status code
966    pub status: AppStatus,
967}
968
969/// Application Parent Context - Format (0,2203)
970///
971/// Parent context for sampled client operations
972///
973/// # XDR Definition ([sFlow Application](https://sflow.org/sflow_application.txt))
974///
975/// ```text
976/// /* Optional parent context information for sampled client operation */
977/// /* opaque = flow_data; enterprise = 0; format = 2203 */
978///
979/// struct app_parent_context {
980///     context context;
981/// }
982/// ```
983#[derive(Debug, Clone, PartialEq, Eq)]
984pub struct AppParentContext {
985    /// Parent operation context
986    pub context: AppContext,
987}
sflow_parser/models/record_flows.rs

sflow_parser/models/
record_flows.rs
