sflow_parser/models/record_flows.rs
1//! Flow record data structures
2//!
3//! These represent the actual packet data captured in flow samples.
4//! Enterprise = 0 (sFlow.org standard formats)
5
6use std::net::{Ipv4Addr, Ipv6Addr};
7
8/// Header protocol types for sampled headers
9#[derive(Debug, Clone, Copy, PartialEq, Eq)]
10pub enum HeaderProtocol {
11 EthernetIso88023 = 1,
12 Iso88024TokenBus = 2,
13 Iso88025TokenRing = 3,
14 Fddi = 4,
15 FrameRelay = 5,
16 X25 = 6,
17 Ppp = 7,
18 Smds = 8,
19 Aal5 = 9,
20 Aal5Ip = 10,
21 Ipv4 = 11,
22 Ipv6 = 12,
23 Mpls = 13,
24 Pos = 14,
25 Ieee80211Mac = 15,
26 Ieee80211Ampdu = 16,
27 Ieee80211Amsdu = 17,
28}
29
30impl HeaderProtocol {
31 /// Convert from u32 value to HeaderProtocol enum
32 pub fn from_u32(value: u32) -> Option<Self> {
33 match value {
34 1 => Some(HeaderProtocol::EthernetIso88023),
35 2 => Some(HeaderProtocol::Iso88024TokenBus),
36 3 => Some(HeaderProtocol::Iso88025TokenRing),
37 4 => Some(HeaderProtocol::Fddi),
38 5 => Some(HeaderProtocol::FrameRelay),
39 6 => Some(HeaderProtocol::X25),
40 7 => Some(HeaderProtocol::Ppp),
41 8 => Some(HeaderProtocol::Smds),
42 9 => Some(HeaderProtocol::Aal5),
43 10 => Some(HeaderProtocol::Aal5Ip),
44 11 => Some(HeaderProtocol::Ipv4),
45 12 => Some(HeaderProtocol::Ipv6),
46 13 => Some(HeaderProtocol::Mpls),
47 14 => Some(HeaderProtocol::Pos),
48 15 => Some(HeaderProtocol::Ieee80211Mac),
49 16 => Some(HeaderProtocol::Ieee80211Ampdu),
50 17 => Some(HeaderProtocol::Ieee80211Amsdu),
51 _ => None,
52 }
53 }
54}
55
56impl std::fmt::Display for HeaderProtocol {
57 fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
58 match self {
59 HeaderProtocol::EthernetIso88023 => write!(f, "Ethernet (ISO 802.3)"),
60 HeaderProtocol::Iso88024TokenBus => write!(f, "ISO 802.4 Token Bus"),
61 HeaderProtocol::Iso88025TokenRing => write!(f, "ISO 802.5 Token Ring"),
62 HeaderProtocol::Fddi => write!(f, "FDDI"),
63 HeaderProtocol::FrameRelay => write!(f, "Frame Relay"),
64 HeaderProtocol::X25 => write!(f, "X.25"),
65 HeaderProtocol::Ppp => write!(f, "PPP"),
66 HeaderProtocol::Smds => write!(f, "SMDS"),
67 HeaderProtocol::Aal5 => write!(f, "AAL5"),
68 HeaderProtocol::Aal5Ip => write!(f, "AAL5 IP"),
69 HeaderProtocol::Ipv4 => write!(f, "IPv4"),
70 HeaderProtocol::Ipv6 => write!(f, "IPv6"),
71 HeaderProtocol::Mpls => write!(f, "MPLS"),
72 HeaderProtocol::Pos => write!(f, "POS"),
73 HeaderProtocol::Ieee80211Mac => write!(f, "IEEE 802.11 MAC"),
74 HeaderProtocol::Ieee80211Ampdu => write!(f, "IEEE 802.11 A-MPDU"),
75 HeaderProtocol::Ieee80211Amsdu => write!(f, "IEEE 802.11 A-MSDU"),
76 }
77 }
78}
79
80/// Sampled Header - Format (0,1)
81///
82/// Raw packet header captured from the wire
83///
84/// # XDR Definition (sFlow v5)
85///
86/// ```text
87/// /* Raw Packet Header */
88/// /* opaque = flow_data; enterprise = 0; format = 1 */
89///
90/// struct sampled_header {
91/// header_protocol protocol; /* Format of sampled header */
92/// unsigned int frame_length; /* Original length of packet before sampling */
93/// unsigned int stripped; /* Number of octets removed from packet */
94/// opaque header<>; /* Header bytes */
95/// }
96/// ```
97#[derive(Debug, Clone, PartialEq, Eq)]
98pub struct SampledHeader {
99 /// Protocol of the sampled packet
100 pub protocol: HeaderProtocol,
101
102 /// Original length of the packet (before sampling)
103 pub frame_length: u32,
104
105 /// Number of bytes stripped from the packet before sampling
106 pub stripped: u32,
107
108 /// Raw header bytes
109 pub header: Vec<u8>,
110}
111
112/// Sampled Ethernet Frame - Format (0,2)
113///
114/// Ethernet frame header information
115///
116/// # XDR Definition (sFlow v5)
117///
118/// ```text
119/// /* Ethernet Frame Data */
120/// /* opaque = flow_data; enterprise = 0; format = 2 */
121///
122/// struct sampled_ethernet {
123/// unsigned int length; /* The length of the MAC packet received on the
124/// network, excluding lower layer encapsulations
125/// and framing bits but including FCS octets */
126/// mac src_mac; /* Source MAC address */
127/// mac dst_mac; /* Destination MAC address */
128/// unsigned int type; /* Ethernet packet type */
129/// }
130/// ```
131#[derive(Debug, Clone, PartialEq, Eq)]
132pub struct SampledEthernet {
133 /// Length of MAC packet in bytes
134 pub length: u32,
135
136 /// Source MAC address
137 pub src_mac: crate::models::MacAddress,
138
139 /// Destination MAC address
140 pub dst_mac: crate::models::MacAddress,
141
142 /// Ethernet type
143 pub eth_type: u32,
144}
145
146/// Sampled IPv4 - Format (0,3)
147///
148/// IPv4 packet header information
149///
150/// # XDR Definition (sFlow v5)
151///
152/// ```text
153/// /* Packet IP version 4 data */
154/// /* opaque = flow_data; enterprise = 0; format = 3 */
155///
156/// struct sampled_ipv4 {
157/// unsigned int length; /* Length of IP packet excluding lower layer encapsulations */
158/// unsigned int protocol; /* IP Protocol type (e.g., TCP = 6, UDP = 17) */
159/// ip_v4 src_ip; /* Source IP Address */
160/// ip_v4 dst_ip; /* Destination IP Address */
161/// unsigned int src_port; /* TCP/UDP source port number or equivalent */
162/// unsigned int dst_port; /* TCP/UDP destination port number or equivalent */
163/// unsigned int tcp_flags; /* TCP flags */
164/// unsigned int tos; /* IP type of service */
165/// }
166/// ```
167#[derive(Debug, Clone, PartialEq, Eq)]
168pub struct SampledIpv4 {
169 /// Length of IP packet in bytes
170 pub length: u32,
171
172 /// IP Protocol (TCP=6, UDP=17, etc.)
173 pub protocol: u32,
174
175 /// Source IP address
176 pub src_ip: Ipv4Addr,
177
178 /// Destination IP address
179 pub dst_ip: Ipv4Addr,
180
181 /// Source port (for TCP/UDP)
182 pub src_port: u32,
183
184 /// Destination port (for TCP/UDP)
185 pub dst_port: u32,
186
187 /// TCP flags
188 pub tcp_flags: u32,
189
190 /// Type of Service
191 pub tos: u32,
192}
193
194/// Sampled IPv6 - Format (0,4)
195///
196/// IPv6 packet header information
197///
198/// # XDR Definition (sFlow v5)
199///
200/// ```text
201/// /* Packet IP Version 6 Data */
202/// /* opaque = flow_data; enterprise = 0; format = 4 */
203///
204/// struct sampled_ipv6 {
205/// unsigned int length; /* Length of IP packet excluding lower layer encapsulations */
206/// unsigned int protocol; /* IP next header (e.g., TCP = 6, UDP = 17) */
207/// ip_v6 src_ip; /* Source IP Address */
208/// ip_v6 dst_ip; /* Destination IP Address */
209/// unsigned int src_port; /* TCP/UDP source port number or equivalent */
210/// unsigned int dst_port; /* TCP/UDP destination port number or equivalent */
211/// unsigned int tcp_flags; /* TCP flags */
212/// unsigned int priority; /* IP priority */
213/// }
214/// ```
215#[derive(Debug, Clone, PartialEq, Eq)]
216pub struct SampledIpv6 {
217 /// Length of IP packet in bytes
218 pub length: u32,
219
220 /// IP Protocol (TCP=6, UDP=17, etc.)
221 pub protocol: u32,
222
223 /// Source IP address
224 pub src_ip: Ipv6Addr,
225
226 /// Destination IP address
227 pub dst_ip: Ipv6Addr,
228
229 /// Source port (for TCP/UDP)
230 pub src_port: u32,
231
232 /// Destination port (for TCP/UDP)
233 pub dst_port: u32,
234
235 /// TCP flags
236 pub tcp_flags: u32,
237
238 /// Priority (traffic class)
239 pub priority: u32,
240}
241
242/// Extended Switch Data - Format (0,1001)
243///
244/// Layer 2 switching information
245///
246/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
247///
248/// ```text
249/// /* Extended Switch Data */
250/// /* opaque = flow_data; enterprise = 0; format = 1001 */
251///
252/// struct extended_switch {
253/// unsigned int src_vlan; /* The 802.1Q VLAN id of incoming frame */
254/// unsigned int src_priority; /* The 802.1p priority of incoming frame */
255/// unsigned int dst_vlan; /* The 802.1Q VLAN id of outgoing frame */
256/// unsigned int dst_priority; /* The 802.1p priority of outgoing frame */
257/// }
258/// ```
259#[derive(Debug, Clone, PartialEq, Eq)]
260pub struct ExtendedSwitch {
261 /// Source VLAN ID
262 pub src_vlan: u32,
263
264 /// Source priority (802.1p)
265 pub src_priority: u32,
266
267 /// Destination VLAN ID
268 pub dst_vlan: u32,
269
270 /// Destination priority (802.1p)
271 pub dst_priority: u32,
272}
273
274/// Extended Router Data - Format (0,1002)
275///
276/// Layer 3 routing information
277///
278/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
279///
280/// ```text
281/// /* Extended Router Data */
282/// /* opaque = flow_data; enterprise = 0; format = 1002 */
283///
284/// struct extended_router {
285/// next_hop nexthop; /* IP address of next hop router */
286/// unsigned int src_mask_len; /* Source address prefix mask (number of bits) */
287/// unsigned int dst_mask_len; /* Destination address prefix mask (number of bits) */
288/// }
289/// ```
290#[derive(Debug, Clone, PartialEq, Eq)]
291pub struct ExtendedRouter {
292 /// IP address of next hop router
293 pub next_hop: crate::models::core::Address,
294
295 /// Source subnet mask bits
296 pub src_mask_len: u32,
297
298 /// Destination subnet mask bits
299 pub dst_mask_len: u32,
300}
301
302/// AS Path Type
303#[derive(Debug, Clone, Copy, PartialEq, Eq)]
304pub enum AsPathType {
305 AsSet = 1,
306 AsSequence = 2,
307}
308
309/// AS Path Segment
310#[derive(Debug, Clone, PartialEq, Eq)]
311pub struct AsPathSegment {
312 pub path_type: u32,
313 pub path_length: u32,
314 pub path: Vec<u32>,
315}
316
317/// Extended Gateway Data - Format (0,1003)
318///
319/// BGP routing information
320///
321/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
322///
323/// ```text
324/// /* Extended Gateway Data */
325/// /* opaque = flow_data; enterprise = 0; format = 1003 */
326///
327/// struct extended_gateway {
328/// next_hop nexthop; /* Address of the border router */
329/// unsigned int as; /* Autonomous system number of router */
330/// unsigned int src_as; /* Autonomous system number of source */
331/// unsigned int src_peer_as; /* Autonomous system number of source peer */
332/// as_path_type dst_as_path<>; /* AS path to the destination */
333/// unsigned int communities<>; /* Communities associated with this route */
334/// unsigned int localpref; /* LocalPref associated with this route */
335/// }
336/// ```
337#[derive(Debug, Clone, PartialEq, Eq)]
338pub struct ExtendedGateway {
339 /// IP address of the border router
340 pub next_hop: crate::models::core::Address,
341
342 /// Autonomous system number
343 pub as_number: u32,
344
345 /// Source AS
346 pub src_as: u32,
347
348 /// Source peer AS
349 pub src_peer_as: u32,
350
351 /// Autonomous system path to the destination
352 pub dst_as_path: Vec<AsPathSegment>,
353
354 /// BGP communities
355 pub communities: Vec<u32>,
356
357 /// Local preference
358 pub local_pref: u32,
359}
360
361/// Extended User Data - Format (0,1004)
362///
363/// Application-level user information
364///
365/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
366///
367/// ```text
368/// /* Extended User Data */
369/// /* opaque = flow_data; enterprise = 0; format = 1004 */
370///
371/// struct extended_user {
372/// charset src_charset; /* Character set for src_user */
373/// opaque src_user<>; /* User ID associated with packet source */
374/// charset dst_charset; /* Character set for dst_user */
375/// opaque dst_user<>; /* User ID associated with packet destination */
376/// }
377/// ```
378#[derive(Debug, Clone, PartialEq, Eq)]
379pub struct ExtendedUser {
380 /// Source character set (MIBEnum)
381 pub src_charset: u32,
382
383 /// Source user ID
384 pub src_user: String,
385
386 /// Destination character set (MIBEnum)
387 pub dst_charset: u32,
388
389 /// Destination user ID
390 pub dst_user: String,
391}
392
393/// URL Direction
394#[derive(Debug, Clone, Copy, PartialEq, Eq)]
395pub enum UrlDirection {
396 Source = 1,
397 Destination = 2,
398}
399
400/// Extended URL Data - Format (0,1005)
401///
402/// HTTP request information
403///
404/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
405///
406/// ```text
407/// /* Extended URL Data */
408/// /* opaque = flow_data; enterprise = 0; format = 1005 */
409///
410/// struct extended_url {
411/// url_direction direction; /* Direction of connection */
412/// string url<>; /* The HTTP request-line (see RFC 2616) */
413/// string host<>; /* The host field from the HTTP header */
414/// }
415/// ```
416#[derive(Debug, Clone, PartialEq, Eq)]
417pub struct ExtendedUrl {
418 /// Direction (source or destination)
419 pub direction: u32,
420
421 /// URL string (HTTP request-line)
422 pub url: String,
423
424 /// Host header from HTTP request
425 pub host: String,
426}
427
428/// Extended MPLS Data - Format (0,1006)
429///
430/// MPLS label stack information
431///
432/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
433///
434/// ```text
435/// /* Extended MPLS Data */
436/// /* opaque = flow_data; enterprise = 0; format = 1006 */
437///
438/// struct extended_mpls {
439/// next_hop nexthop; /* Address of the next hop */
440/// label_stack in_stack; /* Label stack of received packet */
441/// label_stack out_stack;/* Label stack for transmitted packet */
442/// }
443/// ```
444#[derive(Debug, Clone, PartialEq, Eq)]
445pub struct ExtendedMpls {
446 /// Next hop address
447 pub next_hop: crate::models::core::Address,
448
449 /// Input label stack
450 pub in_stack: Vec<u32>,
451
452 /// Output label stack
453 pub out_stack: Vec<u32>,
454}
455
456/// Extended NAT Data - Format (0,1007)
457///
458/// Network Address Translation information
459///
460/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
461///
462/// ```text
463/// /* Extended NAT Data */
464/// /* opaque = flow_data; enterprise = 0; format = 1007 */
465///
466/// struct extended_nat {
467/// address src_address; /* Source address */
468/// address dst_address; /* Destination address */
469/// }
470/// ```
471#[derive(Debug, Clone, PartialEq, Eq)]
472pub struct ExtendedNat {
473 /// Source address type
474 pub src_address: crate::models::core::Address,
475
476 /// Destination address type
477 pub dst_address: crate::models::core::Address,
478}
479
480/// Extended MPLS Tunnel - Format (0,1008)
481///
482/// MPLS tunnel information
483///
484/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
485///
486/// ```text
487/// /* Extended MPLS Tunnel */
488/// /* opaque = flow_data; enterprise = 0; format = 1008 */
489///
490/// struct extended_mpls_tunnel {
491/// string tunnel_lsp_name<>; /* Tunnel name */
492/// unsigned int tunnel_id; /* Tunnel ID */
493/// unsigned int tunnel_cos; /* Tunnel COS value */
494/// }
495/// ```
496#[derive(Debug, Clone, PartialEq, Eq)]
497pub struct ExtendedMplsTunnel {
498 /// Tunnel LSP name
499 pub tunnel_lsp_name: String,
500
501 /// Tunnel ID
502 pub tunnel_id: u32,
503
504 /// Tunnel COS value
505 pub tunnel_cos: u32,
506}
507
508/// Extended MPLS VC - Format (0,1009)
509///
510/// MPLS Virtual Circuit information
511///
512/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
513///
514/// ```text
515/// /* Extended MPLS VC */
516/// /* opaque = flow_data; enterprise = 0; format = 1009 */
517///
518/// struct extended_mpls_vc {
519/// string vc_instance_name<>; /* VC instance name */
520/// unsigned int vll_vc_id; /* VLL/VC instance ID */
521/// unsigned int vc_label_cos; /* VC Label COS value */
522/// }
523/// ```
524#[derive(Debug, Clone, PartialEq, Eq)]
525pub struct ExtendedMplsVc {
526 /// VC instance name
527 pub vc_instance_name: String,
528
529 /// VC ID
530 pub vll_vc_id: u32,
531
532 /// VC label
533 pub vc_label: u32,
534
535 /// VC COS
536 pub vc_cos: u32,
537}
538
539/// Extended MPLS FEC - Format (0,1010)
540///
541/// MPLS Forwarding Equivalence Class information
542///
543/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
544///
545/// ```text
546/// /* Extended MPLS FEC */
547/// /* opaque = flow_data; enterprise = 0; format = 1010 */
548///
549/// struct extended_mpls_FTN {
550/// string mplsFTNDescr<>; /* FEC description */
551/// unsigned int mplsFTNMask; /* FEC mask */
552/// }
553/// ```
554#[derive(Debug, Clone, PartialEq, Eq)]
555pub struct ExtendedMplsFec {
556 /// FEC address prefix
557 pub fec_addr_prefix: crate::models::core::Address,
558
559 /// FEC prefix length
560 pub fec_prefix_len: u32,
561}
562
563/// Extended MPLS LVP FEC - Format (0,1011)
564///
565/// MPLS LDP FEC information
566///
567/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
568///
569/// ```text
570/// /* Extended MPLS LVP FEC */
571/// /* opaque = flow_data; enterprise = 0; format = 1011 */
572///
573/// struct extended_mpls_LDP_FEC {
574/// unsigned int mplsFecAddrPrefixLength; /* FEC address prefix length */
575/// }
576/// ```
577#[derive(Debug, Clone, PartialEq, Eq)]
578pub struct ExtendedMplsLvpFec {
579 /// FEC address prefix length
580 pub mpls_fec_addr_prefix_length: u32,
581}
582
583/// Extended VLAN Tunnel - Format (0,1012)
584///
585/// VLAN tunnel information for nested VLAN tags
586///
587/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
588///
589/// ```text
590/// /* Extended VLAN tunnel information */
591/// /* opaque = flow_data; enterprise = 0; format = 1012 */
592///
593/// struct extended_vlantunnel {
594/// unsigned int stack<>; /* List of stripped 802.1Q TPID/TCI layers */
595/// }
596/// ```
597#[derive(Debug, Clone, PartialEq, Eq)]
598pub struct ExtendedVlanTunnel {
599 /// List of stripped 802.1Q TPID/TCI layers
600 pub stack: Vec<u32>,
601}
602
603/// Extended 802.11 Payload - Format (0,1013)
604///
605/// Unencrypted 802.11 payload data
606///
607/// # XDR Definition ([sFlow 802.11](https://sflow.org/sflow_80211.txt))
608///
609/// ```text
610/// /* Extended 80211 Payload */
611/// /* opaque = flow_data; enterprise = 0; format = 1013 */
612///
613/// struct extended_80211_payload {
614/// cipher_suite ciphersuite; /* encryption scheme used for this packet */
615/// opaque data<>; /* unencrypted bytes from the payload */
616/// }
617/// ```
618#[derive(Debug, Clone, PartialEq, Eq)]
619pub struct Extended80211Payload {
620 /// Cipher suite (OUI + Suite Type)
621 pub cipher_suite: u32,
622
623 /// Unencrypted payload data
624 pub data: Vec<u8>,
625}
626
627/// Extended 802.11 RX - Format (0,1014)
628///
629/// 802.11 receive information
630///
631/// # XDR Definition ([sFlow 802.11](https://sflow.org/sflow_80211.txt))
632///
633/// ```text
634/// /* Extended 802.11 RX */
635/// /* opaque = flow_data; enterprise = 0; format = 1014 */
636///
637/// struct extended_80211_rx {
638/// string ssid<32>; /* SSID string */
639/// mac bssid; /* BSSID */
640/// ieee80211_version version; /* version */
641/// unsigned int channel; /* channel number */
642/// unsigned hyper speed; /* speed */
643/// unsigned int rsni; /* received signal to noise ratio */
644/// unsigned int rcpi; /* received channel power */
645/// duration_us packet_duration; /* time packet occupied RF medium */
646/// }
647/// ```
648#[derive(Debug, Clone, PartialEq, Eq)]
649pub struct Extended80211Rx {
650 /// SSID string (max 32 bytes)
651 pub ssid: String,
652
653 /// BSSID (MAC address)
654 pub bssid: crate::models::MacAddress,
655
656 /// IEEE 802.11 version (a=1, b=2, g=3, n=4)
657 pub version: u32,
658
659 /// Channel number
660 pub channel: u32,
661
662 /// Speed in bits per second
663 pub speed: u64,
664
665 /// Received signal to noise ratio (RSNI)
666 pub rsni: u32,
667
668 /// Received channel power indicator (RCPI)
669 pub rcpi: u32,
670
671 /// Packet duration in microseconds
672 pub packet_duration: u32,
673}
674
675/// Extended 802.11 TX - Format (0,1015)
676///
677/// 802.11 transmit information
678///
679/// # XDR Definition ([sFlow 802.11](https://sflow.org/sflow_80211.txt))
680///
681/// ```text
682/// /* Extended 802.11 TX */
683/// /* opaque = flow_data; enterprise = 0; format = 1015 */
684///
685/// struct extended_80211_tx {
686/// string ssid<32>; /* SSID string */
687/// mac bssid; /* BSSID */
688/// ieee80211_version version; /* version */
689/// unsigned int transmissions; /* number of transmissions */
690/// duration_us packet_duration; /* time packet occupied RF medium */
691/// duration_us retrans_duration;/* time failed attempts occupied RF */
692/// unsigned int channel; /* channel number */
693/// unsigned hyper speed; /* speed */
694/// unsigned int power; /* transmit power in mW */
695/// }
696/// ```
697#[derive(Debug, Clone, PartialEq, Eq)]
698pub struct Extended80211Tx {
699 /// SSID string (max 32 bytes)
700 pub ssid: String,
701
702 /// BSSID (MAC address)
703 pub bssid: crate::models::MacAddress,
704
705 /// IEEE 802.11 version (a=1, b=2, g=3, n=4)
706 pub version: u32,
707
708 /// Number of transmissions (0=unknown, 1=success on first attempt, n>1 = n-1 retransmissions)
709 pub transmissions: u32,
710
711 /// Packet duration in microseconds (successful transmission)
712 pub packet_duration: u32,
713
714 /// Retransmission duration in microseconds (failed attempts)
715 pub retrans_duration: u32,
716
717 /// Channel number
718 pub channel: u32,
719
720 /// Speed in bits per second
721 pub speed: u64,
722
723 /// Transmit power in milliwatts
724 pub power: u32,
725}
726
727/// PDU (Protocol Data Unit) in 802.11 aggregation
728///
729/// # XDR Definition ([sFlow 802.11](https://sflow.org/sflow_80211.txt))
730///
731/// ```text
732/// struct pdu {
733/// flow_record flow_records<>;
734/// }
735/// ```
736#[derive(Debug, Clone, PartialEq, Eq)]
737pub struct Pdu {
738 /// Flow records for this PDU
739 pub flow_records: Vec<crate::models::FlowRecord>,
740}
741
742/// Extended 802.11 Aggregation - Format (0,1016)
743///
744/// 802.11 frame aggregation information
745///
746/// # XDR Definition ([sFlow 802.11](https://sflow.org/sflow_80211.txt))
747///
748/// ```text
749/// /* Extended 802.11 Aggregation Data */
750/// /* opaque = flow_data; enterprise = 0; format = 1016 */
751///
752/// struct extended_80211_aggregation {
753/// pdu pdus<>; /* Array of PDUs in the aggregation */
754/// }
755/// ```
756#[derive(Debug, Clone, PartialEq, Eq)]
757pub struct Extended80211Aggregation {
758 /// Array of PDUs in the aggregation
759 pub pdus: Vec<Pdu>,
760}
761
762/// Extended OpenFlow v1 - Format (0,1017) - **DEPRECATED**
763///
764/// OpenFlow 1.0 forwarding information
765///
766/// **Note:** This format was defined in an early draft of the sFlow OpenFlow specification
767/// but was deprecated and removed from the final specification. It is included here for
768/// backward compatibility with legacy implementations.
769///
770/// # XDR Definition ([sFlow OpenFlow Draft](https://sflow.org/draft-sflow-openflow.txt))
771///
772/// ```text
773/// /* Extended OpenFlow 1.0 Data */
774/// /* opaque = flow_data; enterprise = 0; format = 1017 */
775///
776/// struct extended_openflow_v1 {
777/// unsigned hyper flow_cookie; /* Flow cookie set by controller */
778/// wildcards flow_match; /* Bit array of wildcarded fields */
779/// actions flow_actions; /* Bit array of actions applied */
780/// }
781/// ```
782#[derive(Debug, Clone, PartialEq, Eq)]
783pub struct ExtendedOpenFlowV1 {
784 /// Flow cookie set by the OpenFlow controller
785 pub flow_cookie: u64,
786
787 /// Bit array describing the fields in the packet header that are used to form the flow key
788 /// See OpenFlow 1.0 ofp_match for the definition of wildcards
789 pub flow_match: u32,
790
791 /// Bit array describing fields that may have been altered by the flow action
792 /// The ofp_action_type enum is used to determine the bit positions
793 pub flow_actions: u32,
794}
795
796/// Extended L2 Tunnel Egress - Format (0,1021)
797///
798/// Layer 2 tunnel egress information - reports outer Ethernet headers
799/// that will be added on egress when encapsulating packets
800///
801/// # XDR Definition ([sFlow Tunnels](https://sflow.org/sflow_tunnels.txt))
802///
803/// ```text
804/// /* opaque = flow_data; enterprise = 0; format = 1021 */
805/// struct extended_L2_tunnel_egress {
806/// sampled_ethernet header;
807/// }
808/// ```
809#[derive(Debug, Clone, PartialEq, Eq)]
810pub struct ExtendedL2TunnelEgress {
811 /// Outer Ethernet header that will be added on egress
812 pub header: SampledEthernet,
813}
814
815/// Extended L2 Tunnel Ingress - Format (0,1022)
816///
817/// Layer 2 tunnel ingress information - reports outer Ethernet headers
818/// that were present on ingress and removed during decapsulation
819///
820/// # XDR Definition ([sFlow Tunnels](https://sflow.org/sflow_tunnels.txt))
821///
822/// ```text
823/// /* opaque = flow_data; enterprise = 0; format = 1022 */
824/// struct extended_L2_tunnel_ingress {
825/// sampled_ethernet header;
826/// }
827/// ```
828#[derive(Debug, Clone, PartialEq, Eq)]
829pub struct ExtendedL2TunnelIngress {
830 /// Outer Ethernet header that was present on ingress
831 pub header: SampledEthernet,
832}
833
834/// Extended IPv4 Tunnel Egress - Format (0,1023)
835///
836/// IPv4 tunnel egress information - reports outer IPv4 headers
837/// that will be added on egress when encapsulating packets
838///
839/// # XDR Definition ([sFlow Tunnels](https://sflow.org/sflow_tunnels.txt))
840///
841/// ```text
842/// /* opaque = flow_data; enterprise = 0; format = 1023 */
843/// struct extended_ipv4_tunnel_egress {
844/// sampled_ipv4 header;
845/// }
846/// ```
847#[derive(Debug, Clone, PartialEq, Eq)]
848pub struct ExtendedIpv4TunnelEgress {
849 /// Outer IPv4 header that will be added on egress
850 pub header: SampledIpv4,
851}
852
853/// Extended IPv4 Tunnel Ingress - Format (0,1024)
854///
855/// IPv4 tunnel ingress information - reports outer IPv4 headers
856/// that were present on ingress and removed during decapsulation
857///
858/// # XDR Definition ([sFlow Tunnels](https://sflow.org/sflow_tunnels.txt))
859///
860/// ```text
861/// /* opaque = flow_data; enterprise = 0; format = 1024 */
862/// struct extended_ipv4_tunnel_ingress {
863/// sampled_ipv4 header;
864/// }
865/// ```
866#[derive(Debug, Clone, PartialEq, Eq)]
867pub struct ExtendedIpv4TunnelIngress {
868 /// Outer IPv4 header that was present on ingress
869 pub header: SampledIpv4,
870}
871
872/// Extended IPv6 Tunnel Egress - Format (0,1025)
873///
874/// IPv6 tunnel egress information - reports outer IPv6 headers
875/// that will be added on egress when encapsulating packets
876///
877/// # XDR Definition ([sFlow Tunnels](https://sflow.org/sflow_tunnels.txt))
878///
879/// ```text
880/// /* opaque = flow_data; enterprise = 0; format = 1025 */
881/// struct extended_ipv6_tunnel_egress {
882/// sampled_ipv6 header;
883/// }
884/// ```
885#[derive(Debug, Clone, PartialEq, Eq)]
886pub struct ExtendedIpv6TunnelEgress {
887 /// Outer IPv6 header that will be added on egress
888 pub header: SampledIpv6,
889}
890
891/// Extended IPv6 Tunnel Ingress - Format (0,1026)
892///
893/// IPv6 tunnel ingress information - reports outer IPv6 headers
894/// that were present on ingress and removed during decapsulation
895///
896/// # XDR Definition ([sFlow Tunnels](https://sflow.org/sflow_tunnels.txt))
897///
898/// ```text
899/// /* opaque = flow_data; enterprise = 0; format = 1026 */
900/// struct extended_ipv6_tunnel_ingress {
901/// sampled_ipv6 header;
902/// }
903/// ```
904#[derive(Debug, Clone, PartialEq, Eq)]
905pub struct ExtendedIpv6TunnelIngress {
906 /// Outer IPv6 header that was present on ingress
907 pub header: SampledIpv6,
908}
909
910/// Extended Decapsulate Egress - Format (0,1027)
911///
912/// Indicates the end of a tunnel and points to the start of the inner header
913/// Used when a packet is sampled before decapsulation on ingress
914///
915/// # XDR Definition ([sFlow Tunnels](https://sflow.org/sflow_tunnels.txt))
916///
917/// ```text
918/// /* opaque = flow_data; enterprise = 0; format = 1027 */
919/// struct extended_decapsulate_egress {
920/// unsigned int inner_header_offset;
921/// }
922/// ```
923#[derive(Debug, Clone, PartialEq, Eq)]
924pub struct ExtendedDecapsulateEgress {
925 /// Offset in bytes to the inner header within the sampled packet header
926 pub inner_header_offset: u32,
927}
928
929/// Extended Decapsulate Ingress - Format (0,1028)
930///
931/// Indicates the start of a tunnel
932/// Used when a packet is sampled after encapsulation on egress
933///
934/// # XDR Definition ([sFlow Tunnels](https://sflow.org/sflow_tunnels.txt))
935///
936/// ```text
937/// /* opaque = flow_data; enterprise = 0; format = 1028 */
938/// struct extended_decapsulate_ingress {
939/// unsigned int inner_header_offset;
940/// }
941/// ```
942#[derive(Debug, Clone, PartialEq, Eq)]
943pub struct ExtendedDecapsulateIngress {
944 /// Offset in bytes to the inner header within the sampled packet header
945 pub inner_header_offset: u32,
946}
947
948/// Extended VNI Egress - Format (0,1029)
949///
950/// Virtual Network Identifier for egress traffic
951/// The VNI may be explicitly included in the tunneling protocol or implicit
952///
953/// # XDR Definition ([sFlow Tunnels](https://sflow.org/sflow_tunnels.txt))
954///
955/// ```text
956/// /* opaque_flow_data; enterprise = 0; format = 1029 */
957/// struct extended_vni_egress {
958/// unsigned int vni;
959/// }
960/// ```
961#[derive(Debug, Clone, PartialEq, Eq)]
962pub struct ExtendedVniEgress {
963 /// Virtual Network Identifier
964 pub vni: u32,
965}
966
967/// Extended VNI Ingress - Format (0,1030)
968///
969/// Virtual Network Identifier for ingress traffic
970/// The VNI may be explicitly included in the tunneling protocol or implicit
971///
972/// # XDR Definition ([sFlow Tunnels](https://sflow.org/sflow_tunnels.txt))
973///
974/// ```text
975/// /* opaque_flow_data; enterprise = 0; format = 1030 */
976/// struct extended_vni_ingress {
977/// unsigned int vni;
978/// }
979/// ```
980#[derive(Debug, Clone, PartialEq, Eq)]
981pub struct ExtendedVniIngress {
982 /// Virtual Network Identifier
983 pub vni: u32,
984}
985
986/// Extended Socket IPv4 - Format (0,2100)
987///
988/// IPv4 socket information for application transactions
989///
990/// # XDR Definition ([sFlow Host](https://sflow.org/sflow_host.txt))
991///
992/// ```text
993/// /* IPv4 Socket */
994/// /* opaque = flow_data; enterprise = 0; format = 2100 */
995///
996/// struct extended_socket_ipv4 {
997/// unsigned int protocol; /* IP Protocol type (e.g., TCP = 6, UDP = 17) */
998/// ip_v4 local_ip; /* local IP address */
999/// ip_v4 remote_ip; /* remote IP address */
1000/// unsigned int local_port; /* TCP/UDP local port number or equivalent */
1001/// unsigned int remote_port; /* TCP/UDP remote port number or equivalent */
1002/// }
1003/// ```
1004#[derive(Debug, Clone, PartialEq, Eq)]
1005pub struct ExtendedSocketIpv4 {
1006 /// IP Protocol type (e.g., TCP = 6, UDP = 17)
1007 pub protocol: u32,
1008
1009 /// Local IP address
1010 pub local_ip: std::net::Ipv4Addr,
1011
1012 /// Remote IP address
1013 pub remote_ip: std::net::Ipv4Addr,
1014
1015 /// TCP/UDP local port number
1016 pub local_port: u32,
1017
1018 /// TCP/UDP remote port number
1019 pub remote_port: u32,
1020}
1021
1022/// Extended Socket IPv6 - Format (0,2101)
1023///
1024/// IPv6 socket information for application transactions
1025///
1026/// # XDR Definition ([sFlow Host](https://sflow.org/sflow_host.txt))
1027///
1028/// ```text
1029/// /* IPv6 Socket */
1030/// /* opaque = flow_data; enterprise = 0; format = 2101 */
1031///
1032/// struct extended_socket_ipv6 {
1033/// unsigned int protocol; /* IP Protocol type (e.g., TCP = 6, UDP = 17) */
1034/// ip_v6 local_ip; /* local IP address */
1035/// ip_v6 remote_ip; /* remote IP address */
1036/// unsigned int local_port; /* TCP/UDP local port number or equivalent */
1037/// unsigned int remote_port; /* TCP/UDP remote port number or equivalent */
1038/// }
1039/// ```
1040#[derive(Debug, Clone, PartialEq, Eq)]
1041pub struct ExtendedSocketIpv6 {
1042 /// IP Protocol type (e.g., TCP = 6, UDP = 17)
1043 pub protocol: u32,
1044
1045 /// Local IP address
1046 pub local_ip: std::net::Ipv6Addr,
1047
1048 /// Remote IP address
1049 pub remote_ip: std::net::Ipv6Addr,
1050
1051 /// TCP/UDP local port number
1052 pub local_port: u32,
1053
1054 /// TCP/UDP remote port number
1055 pub remote_port: u32,
1056}
1057
1058/// Application operation context
1059///
1060/// # XDR Definition ([sFlow Application](https://sflow.org/sflow_application.txt))
1061///
1062/// ```text
1063/// struct context {
1064/// application application;
1065/// operation operation;
1066/// attributes attributes;
1067/// }
1068/// ```
1069#[derive(Debug, Clone, PartialEq, Eq)]
1070pub struct AppContext {
1071 /// Application name (e.g., "payment", "mail.smtp", "db.oracle")
1072 pub application: String,
1073
1074 /// Operation name (e.g., "get.customer.name", "upload.photo")
1075 pub operation: String,
1076
1077 /// Operation attributes as name=value pairs (e.g., "cc=visa&loc=mobile")
1078 pub attributes: String,
1079}
1080
1081/// Application operation status
1082///
1083/// # XDR Definition ([sFlow Application](https://sflow.org/sflow_application.txt))
1084#[derive(Debug, Clone, Copy, PartialEq, Eq)]
1085#[repr(u32)]
1086pub enum AppStatus {
1087 Success = 0,
1088 Other = 1,
1089 Timeout = 2,
1090 InternalError = 3,
1091 BadRequest = 4,
1092 Forbidden = 5,
1093 TooLarge = 6,
1094 NotImplemented = 7,
1095 NotFound = 8,
1096 Unavailable = 9,
1097 Unauthorized = 10,
1098}
1099
1100impl From<u32> for AppStatus {
1101 fn from(value: u32) -> Self {
1102 match value {
1103 0 => AppStatus::Success,
1104 1 => AppStatus::Other,
1105 2 => AppStatus::Timeout,
1106 3 => AppStatus::InternalError,
1107 4 => AppStatus::BadRequest,
1108 5 => AppStatus::Forbidden,
1109 6 => AppStatus::TooLarge,
1110 7 => AppStatus::NotImplemented,
1111 8 => AppStatus::NotFound,
1112 9 => AppStatus::Unavailable,
1113 10 => AppStatus::Unauthorized,
1114 _ => AppStatus::Other,
1115 }
1116 }
1117}
1118
1119/// Application Operation - Format (0,2202)
1120///
1121/// Sampled application operation information
1122///
1123/// # XDR Definition ([sFlow Application](https://sflow.org/sflow_application.txt))
1124///
1125/// ```text
1126/// /* Sampled Application Operation */
1127/// /* opaque = flow_data; enterprise = 0; format = 2202 */
1128///
1129/// struct app_operation {
1130/// context context; /* attributes describing the operation */
1131/// utf8string<64> status_descr; /* additional text describing status */
1132/// unsigned hyper req_bytes; /* size of request body (exclude headers) */
1133/// unsigned hyper resp_bytes; /* size of response body (exclude headers) */
1134/// unsigned int uS; /* duration of the operation (microseconds) */
1135/// status status; /* status code */
1136/// }
1137/// ```
1138#[derive(Debug, Clone, PartialEq, Eq)]
1139pub struct AppOperation {
1140 /// Operation context
1141 pub context: AppContext,
1142
1143 /// Additional status description
1144 pub status_descr: String,
1145
1146 /// Size of request body in bytes (excluding headers)
1147 pub req_bytes: u64,
1148
1149 /// Size of response body in bytes (excluding headers)
1150 pub resp_bytes: u64,
1151
1152 /// Duration of the operation in microseconds
1153 pub duration_us: u32,
1154
1155 /// Operation status code
1156 pub status: AppStatus,
1157}
1158
1159/// Application Parent Context - Format (0,2203)
1160///
1161/// Parent context for sampled client operations
1162///
1163/// # XDR Definition ([sFlow Application](https://sflow.org/sflow_application.txt))
1164///
1165/// ```text
1166/// /* Optional parent context information for sampled client operation */
1167/// /* opaque = flow_data; enterprise = 0; format = 2203 */
1168///
1169/// struct app_parent_context {
1170/// context context;
1171/// }
1172/// ```
1173#[derive(Debug, Clone, PartialEq, Eq)]
1174pub struct AppParentContext {
1175 /// Parent operation context
1176 pub context: AppContext,
1177}
1178
1179/// Application Initiator - Format (0,2204)
1180///
1181/// Actor initiating the request (e.g., customer sending a payment)
1182///
1183/// # XDR Definition ([sFlow Application](https://sflow.org/sflow_application.txt))
1184///
1185/// ```text
1186/// /* Actor initiating the request */
1187/// /* e.g. customer sending a payment */
1188/// /* opaque = flow_data; enterprise = 0; format = 2204 */
1189///
1190/// app_initiator {
1191/// actor actor;
1192/// }
1193/// ```
1194#[derive(Debug, Clone, PartialEq, Eq)]
1195pub struct AppInitiator {
1196 /// Business level identifier (e.g., customer id, vendor id)
1197 pub actor: String,
1198}
1199
1200/// Application Target - Format (0,2205)
1201///
1202/// Actor targeted by the request (e.g., recipient of payment)
1203///
1204/// # XDR Definition ([sFlow Application](https://sflow.org/sflow_application.txt))
1205///
1206/// ```text
1207/// /* Actor targetted by the request */
1208/// /* e.g. recipient of payment */
1209/// /* opaque = flow_data; enterprise = 0; format = 2205 */
1210///
1211/// app_target {
1212/// actor actor;
1213/// }
1214/// ```
1215#[derive(Debug, Clone, PartialEq, Eq)]
1216pub struct AppTarget {
1217 /// Business level identifier (e.g., customer id, vendor id)
1218 pub actor: String,
1219}