sflow_parser/models/
core.rs

1//! sFlow v5 data models
2//!
3//! This module contains the data structures representing sFlow v5 datagrams
4//! as defined in <https://sflow.org/sflow_version_5.txt>
5
6use std::net::{Ipv4Addr, Ipv6Addr};
7
8/// MAC address (6 bytes)
9///
10/// Represents a 48-bit IEEE 802 MAC address.
11#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
12#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
13pub struct MacAddress(pub [u8; 6]);
14
15impl MacAddress {
16    /// Create a new MAC address from 6 bytes
17    pub const fn new(bytes: [u8; 6]) -> Self {
18        Self(bytes)
19    }
20
21    /// Get the MAC address as a byte array
22    pub const fn as_bytes(&self) -> &[u8; 6] {
23        &self.0
24    }
25
26    /// Check if this is a broadcast address (FF:FF:FF:FF:FF:FF)
27    pub fn is_broadcast(&self) -> bool {
28        self.0 == [0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF]
29    }
30
31    /// Check if this is a multicast address (first byte has LSB set)
32    pub fn is_multicast(&self) -> bool {
33        self.0[0] & 0x01 != 0
34    }
35
36    /// Check if this is a unicast address
37    pub fn is_unicast(&self) -> bool {
38        !self.is_multicast()
39    }
40}
41
42impl std::fmt::Display for MacAddress {
43    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
44        write!(
45            f,
46            "{:02x}:{:02x}:{:02x}:{:02x}:{:02x}:{:02x}",
47            self.0[0], self.0[1], self.0[2], self.0[3], self.0[4], self.0[5]
48        )
49    }
50}
51
52impl From<[u8; 6]> for MacAddress {
53    fn from(bytes: [u8; 6]) -> Self {
54        Self(bytes)
55    }
56}
57
58impl From<MacAddress> for [u8; 6] {
59    fn from(mac: MacAddress) -> Self {
60        mac.0
61    }
62}
63
64/// sFlow datagram version
65#[derive(Debug, Clone, Copy, PartialEq, Eq)]
66#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
67pub enum DatagramVersion {
68    Version5 = 5,
69}
70
71/// Address types supported by sFlow
72///
73/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
74///
75/// ```text
76/// enum address_type {
77///    UNKNOWN = 0,
78///    IP_V4   = 1,
79///    IP_V6   = 2
80/// }
81///
82/// union address (address_type type) {
83///    case UNKNOWN:
84///       void;
85///    case IP_V4:
86///       ip_v4 ip;
87///    case IP_V6:
88///       ip_v6 ip;
89/// }
90/// ```
91#[derive(Debug, Clone, PartialEq, Eq)]
92#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
93pub enum Address {
94    /// Unknown address type
95    Unknown,
96    /// IPv4 address
97    IPv4(Ipv4Addr),
98    /// IPv6 address
99    IPv6(Ipv6Addr),
100}
101
102/// Data format identifier
103///
104/// Encodes enterprise ID and format number in a single 32-bit value.
105/// Top 20 bits = enterprise ID, bottom 12 bits = format number.
106///
107/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
108///
109/// ```text
110/// typedef unsigned int data_format;
111/// /* The data_format uniquely identifies the format of an opaque structure in
112///    the sFlow specification. For example, the combination of enterprise = 0
113///    and format = 1 identifies the "sampled_header" flow_data structure. */
114/// ```
115#[derive(Debug, Clone, Copy, PartialEq, Eq)]
116#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
117pub struct DataFormat(pub u32);
118
119impl DataFormat {
120    pub fn new(enterprise: u32, format: u32) -> Self {
121        Self((enterprise << 12) | (format & 0xFFF))
122    }
123
124    pub fn enterprise(&self) -> u32 {
125        self.0 >> 12
126    }
127
128    pub fn format(&self) -> u32 {
129        self.0 & 0xFFF
130    }
131}
132
133/// sFlow data source identifier
134///
135/// Identifies the source of the data. Top 8 bits = source type, bottom 24 bits = index.
136///
137/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
138///
139/// ```text
140/// typedef unsigned int sflow_data_source;
141/// /* The sflow_data_source is encoded as follows:
142///    The most significant byte of the sflow_data_source is used to indicate the type of
143///    sFlowDataSource (e.g. ifIndex, smonVlanDataSource, entPhysicalEntry) and the lower
144///    three bytes contain the relevant index value. */
145/// ```
146#[derive(Debug, Clone, Copy, PartialEq, Eq)]
147#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
148pub struct DataSource(pub u32);
149
150impl DataSource {
151    pub fn new(source_type: u8, index: u32) -> Self {
152        Self(((source_type as u32) << 24) | (index & 0xFFFFFF))
153    }
154
155    pub fn source_type(&self) -> u8 {
156        (self.0 >> 24) as u8
157    }
158
159    pub fn index(&self) -> u32 {
160        self.0 & 0xFFFFFF
161    }
162}
163
164/// Expanded data source (for ifIndex >= 2^24)
165///
166/// Used when the index value exceeds 24 bits (16,777,215).
167///
168/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
169///
170/// ```text
171/// struct sflow_data_source_expanded {
172///    unsigned int source_id_type;  /* sFlowDataSource type */
173///    unsigned int source_id_index; /* sFlowDataSource index */
174/// }
175/// ```
176#[derive(Debug, Clone, Copy, PartialEq, Eq)]
177#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
178pub struct DataSourceExpanded {
179    /// Source type (e.g., 0 = ifIndex, 1 = smonVlanDataSource, 2 = entPhysicalEntry)
180    pub source_id_type: u32,
181    /// Source index value
182    pub source_id_index: u32,
183}
184
185/// Interface identifier
186///
187/// Compact encoding for interface identification. Top 2 bits indicate format:
188/// - 00 = Single interface (value is ifIndex)
189/// - 01 = Packet discarded (value is reason code)
190/// - 10 = Multiple destination interfaces (value is number of interfaces)
191///
192/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
193///
194/// ```text
195/// typedef unsigned int interface;
196/// /* Encoding of the interface value:
197///    Bits 31-30: Format
198///       00 = ifIndex (0-0x3FFFFFFF)
199///       01 = Packet discarded
200///       10 = Multiple destinations
201///    Bits 29-0: Value */
202/// ```
203#[derive(Debug, Clone, Copy, PartialEq, Eq)]
204#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
205pub struct Interface(pub u32);
206
207impl Interface {
208    pub fn format(&self) -> u8 {
209        (self.0 >> 30) as u8
210    }
211
212    pub fn value(&self) -> u32 {
213        self.0 & 0x3FFFFFFF
214    }
215
216    pub fn is_single(&self) -> bool {
217        self.format() == 0
218    }
219
220    pub fn is_discarded(&self) -> bool {
221        self.format() == 1
222    }
223
224    pub fn is_multiple(&self) -> bool {
225        self.format() == 2
226    }
227}
228
229/// Expanded interface (for ifIndex >= 2^24)
230///
231/// Used when the interface index exceeds 30 bits (1,073,741,823).
232///
233/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
234///
235/// ```text
236/// struct interface_expanded {
237///    unsigned int format;        /* interface format */
238///    unsigned int value;         /* interface value,
239///                                   Note: 0xFFFFFFFF is the maximum value and must be used
240///                                   to indicate traffic originating or terminating in device
241///                                   (do not use 0x3FFFFFFF value from compact encoding example) */
242/// }
243/// ```
244///
245/// **ERRATUM:** 0xFFFFFFFF is the maximum value and must be used to indicate traffic
246/// originating or terminating in device (do not use 0x3FFFFFFF value from compact encoding example).
247#[derive(Debug, Clone, Copy, PartialEq, Eq)]
248#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
249pub struct InterfaceExpanded {
250    /// Interface format (0 = ifIndex, 1 = packet discarded, 2 = multiple destinations)
251    pub format: u32,
252    /// Interface value
253    /// **ERRATUM:** 0xFFFFFFFF indicates traffic originating or terminating in device
254    pub value: u32,
255}
256
257/// Flow data types
258#[derive(Debug, Clone, PartialEq, Eq)]
259#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
260pub enum FlowData {
261    /// Sampled Header - Format (0,1)
262    SampledHeader(crate::models::record_flows::SampledHeader),
263    /// Sampled Ethernet - Format (0,2)
264    SampledEthernet(crate::models::record_flows::SampledEthernet),
265    /// Sampled IPv4 - Format (0,3)
266    SampledIpv4(crate::models::record_flows::SampledIpv4),
267    /// Sampled IPv6 - Format (0,4)
268    SampledIpv6(crate::models::record_flows::SampledIpv6),
269    /// Extended Switch - Format (0,1001)
270    ExtendedSwitch(crate::models::record_flows::ExtendedSwitch),
271    /// Extended Router - Format (0,1002)
272    ExtendedRouter(crate::models::record_flows::ExtendedRouter),
273    /// Extended Gateway - Format (0,1003)
274    ExtendedGateway(crate::models::record_flows::ExtendedGateway),
275    /// Extended User - Format (0,1004)
276    ExtendedUser(crate::models::record_flows::ExtendedUser),
277    /// Extended URL - Format (0,1005)
278    /// Note: This format is deprecated but kept for backward compatibility
279    ExtendedUrl(crate::models::record_flows::ExtendedUrl),
280    /// Extended MPLS - Format (0,1006)
281    ExtendedMpls(crate::models::record_flows::ExtendedMpls),
282    /// Extended NAT - Format (0,1007)
283    ExtendedNat(crate::models::record_flows::ExtendedNat),
284    /// Extended MPLS Tunnel - Format (0,1008)
285    ExtendedMplsTunnel(crate::models::record_flows::ExtendedMplsTunnel),
286    /// Extended MPLS VC - Format (0,1009)
287    ExtendedMplsVc(crate::models::record_flows::ExtendedMplsVc),
288    /// Extended MPLS FEC - Format (0,1010)
289    ExtendedMplsFec(crate::models::record_flows::ExtendedMplsFec),
290    /// Extended MPLS LVP FEC - Format (0,1011)
291    ExtendedMplsLvpFec(crate::models::record_flows::ExtendedMplsLvpFec),
292    /// Extended VLAN Tunnel - Format (0,1012)
293    ExtendedVlanTunnel(crate::models::record_flows::ExtendedVlanTunnel),
294    /// Extended 802.11 Payload - Format (0,1013)
295    Extended80211Payload(crate::models::record_flows::Extended80211Payload),
296    /// Extended 802.11 RX - Format (0,1014)
297    Extended80211Rx(crate::models::record_flows::Extended80211Rx),
298    /// Extended 802.11 TX - Format (0,1015)
299    Extended80211Tx(crate::models::record_flows::Extended80211Tx),
300    /// Extended 802.11 Aggregation - Format (0,1016)
301    Extended80211Aggregation(crate::models::record_flows::Extended80211Aggregation),
302    /// Extended OpenFlow v1 - Format (0,1017) - DEPRECATED
303    ExtendedOpenFlowV1(crate::models::record_flows::ExtendedOpenFlowV1),
304    /// Extended L2 Tunnel Egress - Format (0,1021)
305    ExtendedL2TunnelEgress(crate::models::record_flows::ExtendedL2TunnelEgress),
306    /// Extended L2 Tunnel Ingress - Format (0,1022)
307    ExtendedL2TunnelIngress(crate::models::record_flows::ExtendedL2TunnelIngress),
308    /// Extended IPv4 Tunnel Egress - Format (0,1023)
309    ExtendedIpv4TunnelEgress(crate::models::record_flows::ExtendedIpv4TunnelEgress),
310    /// Extended IPv4 Tunnel Ingress - Format (0,1024)
311    ExtendedIpv4TunnelIngress(crate::models::record_flows::ExtendedIpv4TunnelIngress),
312    /// Extended IPv6 Tunnel Egress - Format (0,1025)
313    ExtendedIpv6TunnelEgress(crate::models::record_flows::ExtendedIpv6TunnelEgress),
314    /// Extended IPv6 Tunnel Ingress - Format (0,1026)
315    ExtendedIpv6TunnelIngress(crate::models::record_flows::ExtendedIpv6TunnelIngress),
316    /// Extended Decapsulate Egress - Format (0,1027)
317    ExtendedDecapsulateEgress(crate::models::record_flows::ExtendedDecapsulateEgress),
318    /// Extended Decapsulate Ingress - Format (0,1028)
319    ExtendedDecapsulateIngress(crate::models::record_flows::ExtendedDecapsulateIngress),
320    /// Extended VNI Egress - Format (0,1029)
321    ExtendedVniEgress(crate::models::record_flows::ExtendedVniEgress),
322    /// Extended VNI Ingress - Format (0,1030)
323    ExtendedVniIngress(crate::models::record_flows::ExtendedVniIngress),
324    /// Extended Egress Queue - Format (0,1036)
325    ExtendedEgressQueue(crate::models::record_flows::ExtendedEgressQueue),
326    /// Extended ACL - Format (0,1037)
327    ExtendedAcl(crate::models::record_flows::ExtendedAcl),
328    /// Extended Function - Format (0,1038)
329    ExtendedFunction(crate::models::record_flows::ExtendedFunction),
330    /// Extended Transit - Format (0,1039)
331    ExtendedTransit(crate::models::record_flows::ExtendedTransit),
332    /// Extended Queue - Format (0,1040)
333    ExtendedQueue(crate::models::record_flows::ExtendedQueue),
334    /// Extended Socket IPv4 - Format (0,2100)
335    ExtendedSocketIpv4(crate::models::record_flows::ExtendedSocketIpv4),
336    /// Extended Socket IPv6 - Format (0,2101)
337    ExtendedSocketIpv6(crate::models::record_flows::ExtendedSocketIpv6),
338    /// Extended Proxy Socket IPv4 - Format (0,2102)
339    ExtendedProxySocketIpv4(crate::models::record_flows::ExtendedProxySocketIpv4),
340    /// Extended Proxy Socket IPv6 - Format (0,2103)
341    ExtendedProxySocketIpv6(crate::models::record_flows::ExtendedProxySocketIpv6),
342    /// Application Operation - Format (0,2202)
343    AppOperation(crate::models::record_flows::AppOperation),
344    /// Application Parent Context - Format (0,2203)
345    AppParentContext(crate::models::record_flows::AppParentContext),
346    /// Application Initiator - Format (0,2204)
347    AppInitiator(crate::models::record_flows::AppInitiator),
348    /// Application Target - Format (0,2205)
349    AppTarget(crate::models::record_flows::AppTarget),
350    /// HTTP Request - Format (0,2206)
351    HttpRequest(crate::models::record_flows::HttpRequest),
352    /// Extended Proxy Request - Format (0,2207)
353    ExtendedProxyRequest(crate::models::record_flows::ExtendedProxyRequest),
354    /// Unknown or unparsed format
355    Unknown { format: DataFormat, data: Vec<u8> },
356}
357
358/// Flow record containing flow data
359#[derive(Debug, Clone, PartialEq, Eq)]
360#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
361pub struct FlowRecord {
362    pub flow_format: DataFormat,
363    pub flow_data: FlowData,
364}
365
366/// Counter data types
367#[derive(Debug, Clone, PartialEq)]
368#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
369pub enum CounterData {
370    /// Generic Interface Counters - Format (0,1)
371    GenericInterface(crate::models::record_counters::GenericInterfaceCounters),
372    /// Ethernet Interface Counters - Format (0,2)
373    EthernetInterface(crate::models::record_counters::EthernetInterfaceCounters),
374    /// Token Ring Counters - Format (0,3)
375    TokenRing(crate::models::record_counters::TokenRingCounters),
376    /// 100BaseVG Counters - Format (0,4)
377    Vg100Interface(crate::models::record_counters::Vg100InterfaceCounters),
378    /// VLAN Counters - Format (0,5)
379    Vlan(crate::models::record_counters::VlanCounters),
380    /// IEEE 802.11 Counters - Format (0,6)
381    Ieee80211(crate::models::record_counters::Ieee80211Counters),
382    /// Processor Counters - Format (0,1001)
383    Processor(crate::models::record_counters::ProcessorCounters),
384    /// Radio Utilization - Format (0,1002)
385    RadioUtilization(crate::models::record_counters::RadioUtilization),
386    /// Host Description - Format (0,2000)
387    HostDescription(crate::models::record_counters::HostDescription),
388    /// Host Adapters - Format (0,2001)
389    HostAdapters(crate::models::record_counters::HostAdapters),
390    /// Host Parent - Format (0,2002)
391    HostParent(crate::models::record_counters::HostParent),
392    /// Host CPU - Format (0,2003)
393    HostCpu(crate::models::record_counters::HostCpu),
394    /// Host Memory - Format (0,2004)
395    HostMemory(crate::models::record_counters::HostMemory),
396    /// Host Disk I/O - Format (0,2005)
397    HostDiskIo(crate::models::record_counters::HostDiskIo),
398    /// Host Network I/O - Format (0,2006)
399    HostNetIo(crate::models::record_counters::HostNetIo),
400    /// Virtual Node - Format (0,2100)
401    VirtualNode(crate::models::record_counters::VirtualNode),
402    /// Virtual CPU - Format (0,2101)
403    VirtualCpu(crate::models::record_counters::VirtualCpu),
404    /// Virtual Memory - Format (0,2102)
405    VirtualMemory(crate::models::record_counters::VirtualMemory),
406    /// Virtual Disk I/O - Format (0,2103)
407    VirtualDiskIo(crate::models::record_counters::VirtualDiskIo),
408    /// Virtual Network I/O - Format (0,2104)
409    VirtualNetIo(crate::models::record_counters::VirtualNetIo),
410    /// OpenFlow Port - Format (0,1004)
411    OpenFlowPort(crate::models::record_counters::OpenFlowPort),
412    /// OpenFlow Port Name - Format (0,1005)
413    OpenFlowPortName(crate::models::record_counters::OpenFlowPortName),
414    /// HTTP Counters - Format (0,2201)
415    HttpCounters(crate::models::record_counters::HttpCounters),
416    /// App Operations - Format (0,2202)
417    AppOperations(crate::models::record_counters::AppOperations),
418    /// App Resources - Format (0,2203)
419    AppResources(crate::models::record_counters::AppResources),
420    /// App Workers - Format (0,2206)
421    AppWorkers(crate::models::record_counters::AppWorkers),
422    /// Unknown or unparsed format
423    Unknown { format: DataFormat, data: Vec<u8> },
424}
425
426/// Counter record containing counter data
427#[derive(Debug, Clone, PartialEq)]
428#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
429pub struct CounterRecord {
430    pub counter_format: DataFormat,
431    pub counter_data: CounterData,
432}
433
434/// Compact flow sample - Format (0,1)
435///
436/// Contains sampled packet information with compact encoding for interfaces.
437///
438/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
439///
440/// ```text
441/// /* Format of a single flow sample */
442/// /* opaque = sample_data; enterprise = 0; format = 1 */
443///
444/// struct flow_sample {
445///    unsigned int sequence_number;  /* Incremented with each flow sample
446///                                      generated by this sFlow Instance. */
447///    sflow_data_source source_id;   /* sFlowDataSource */
448///    unsigned int sampling_rate;    /* sFlowPacketSamplingRate */
449///    unsigned int sample_pool;      /* Total number of packets that could have been
450///                                      sampled (i.e. packets skipped by sampling process
451///                                      + total number of samples) */
452///    unsigned int drops;            /* Number of times that the sFlow agent detected
453///                                      that a packet marked to be sampled was dropped
454///                                      due to lack of resources. */
455///    interface input;               /* Input interface */
456///    interface output;              /* Output interface */
457///    flow_record flow_records<>;    /* Information about sampled packet */
458/// }
459/// ```
460///
461/// **ERRATUM:** Sequence number clarified as incremented per "sFlow Instance" instead of "source_id".
462#[derive(Debug, Clone, PartialEq, Eq)]
463#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
464pub struct FlowSample {
465    /// Sequence number incremented with each flow sample generated by this sFlow Instance
466    /// **ERRATUM:** Clarified as "sFlow Instance" instead of "source_id"
467    pub sequence_number: u32,
468    /// sFlow data source identifier
469    pub source_id: DataSource,
470    /// Sampling rate (1 in N packets)
471    pub sampling_rate: u32,
472    /// Total packets that could have been sampled
473    pub sample_pool: u32,
474    /// Number of dropped samples due to lack of resources
475    pub drops: u32,
476    /// Input interface
477    pub input: Interface,
478    /// Output interface
479    pub output: Interface,
480    /// Flow records describing the sampled packet
481    pub flow_records: Vec<FlowRecord>,
482}
483
484/// Compact counters sample - Format (0,2)
485///
486/// Contains interface and system counter statistics.
487///
488/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
489///
490/// ```text
491/// /* Format of a single counter sample */
492/// /* opaque = sample_data; enterprise = 0; format = 2 */
493///
494/// struct counters_sample {
495///    unsigned int sequence_number;   /* Incremented with each counter sample
496///                                       generated by this sFlow Instance. */
497///    sflow_data_source source_id;    /* sFlowDataSource */
498///    counter_record counters<>;      /* Counters polled for this source */
499/// }
500/// ```
501///
502/// **ERRATUM:** Sequence number clarified as incremented per "sFlow Instance" instead of "source_id".
503#[derive(Debug, Clone, PartialEq)]
504#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
505pub struct CountersSample {
506    /// Sequence number incremented with each counter sample generated by this sFlow Instance
507    /// **ERRATUM:** Clarified as "sFlow Instance" instead of "source_id"
508    pub sequence_number: u32,
509    /// sFlow data source identifier
510    pub source_id: DataSource,
511    /// Counter records for this source
512    pub counters: Vec<CounterRecord>,
513}
514
515/// Expanded flow sample - Format (0,3)
516///
517/// Flow sample with expanded encoding for large interface indices (>= 2^24).
518///
519/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
520///
521/// ```text
522/// /* Format of a single expanded flow sample */
523/// /* opaque = sample_data; enterprise = 0; format = 3 */
524///
525/// struct flow_sample_expanded {
526///    unsigned int sequence_number;  /* Incremented with each flow sample
527///                                      generated by this sFlow Instance. */
528///    sflow_data_source_expanded source_id; /* sFlowDataSource */
529///    unsigned int sampling_rate;    /* sFlowPacketSamplingRate */
530///    unsigned int sample_pool;      /* Total number of packets that could have been
531///                                      sampled (i.e. packets skipped by sampling process
532///                                      + total number of samples) */
533///    unsigned int drops;            /* Number of times that the sFlow agent detected
534///                                      that a packet marked to be sampled was dropped
535///                                      due to lack of resources. */
536///    interface_expanded input;      /* Input interface */
537///    interface_expanded output;     /* Output interface */
538///    flow_record flow_records<>;    /* Information about sampled packet */
539/// }
540/// ```
541///
542/// **ERRATUM:** Sequence number clarified as incremented per "sFlow Instance" instead of "source_id".
543#[derive(Debug, Clone, PartialEq, Eq)]
544#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
545pub struct FlowSampleExpanded {
546    /// Sequence number incremented with each flow sample generated by this sFlow Instance
547    /// **ERRATUM:** Clarified as "sFlow Instance" instead of "source_id"
548    pub sequence_number: u32,
549    /// Expanded sFlow data source identifier
550    pub source_id: DataSourceExpanded,
551    /// Sampling rate (1 in N packets)
552    pub sampling_rate: u32,
553    /// Total packets that could have been sampled
554    pub sample_pool: u32,
555    /// Number of dropped samples due to lack of resources
556    pub drops: u32,
557    /// Input interface (expanded)
558    pub input: InterfaceExpanded,
559    /// Output interface (expanded)
560    pub output: InterfaceExpanded,
561    /// Flow records describing the sampled packet
562    pub flow_records: Vec<FlowRecord>,
563}
564
565/// Expanded counter sample - Format (0,4)
566///
567/// Counter sample with expanded encoding for large interface indices (>= 2^24).
568///
569/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
570///
571/// ```text
572/// /* Format of a single expanded counters sample */
573/// /* opaque = sample_data; enterprise = 0; format = 4 */
574///
575/// struct counters_sample_expanded {
576///    unsigned int sequence_number;   /* Incremented with each counter sample
577///                                       generated by this sFlow Instance. */
578///    sflow_data_source_expanded source_id; /* sFlowDataSource */
579///    counter_record counters<>;      /* Counters polled for this source */
580/// }
581/// ```
582///
583/// **ERRATUM:** Sequence number clarified as incremented per "sFlow Instance" instead of "source_id".
584#[derive(Debug, Clone, PartialEq)]
585#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
586pub struct CountersSampleExpanded {
587    /// Sequence number incremented with each counter sample generated by this sFlow Instance
588    /// **ERRATUM:** Clarified as "sFlow Instance" instead of "source_id"
589    pub sequence_number: u32,
590    /// Expanded sFlow data source identifier
591    pub source_id: DataSourceExpanded,
592    /// Counter records for this source
593    pub counters: Vec<CounterRecord>,
594}
595
596/// Discarded packet sample - Format (0,5)
597///
598/// # XDR Definition ([sFlow Drops](https://sflow.org/sflow_drops.txt))
599///
600/// ```text
601/// /* Format of a single discarded packet event */
602/// /* opaque = sample_data; enterprise = 0; format = 5 */
603/// struct discarded_packet {
604///    unsigned int sequence_number;  /* Incremented with each discarded packet
605///                                      record generated by this source_id. */
606///    sflow_data_source_expanded source_id; /* sFlowDataSource */
607///    unsigned int drops;            /* Number of times that the sFlow agent
608///                                      detected that a discarded packet record
609///                                      was dropped by the rate limit, or because
610///                                      of a lack of resources. The drops counter
611///                                      reports the total number of drops detected
612///                                      since the agent was last reset. Note: An
613///                                      agent that cannot detect drops will always
614///                                      report zero. */
615///    unsigned int inputifindex;     /* If set, ifIndex of interface packet was
616///                                      received on. Zero if unknown. Must identify
617///                                      physical port consistent with flow_sample
618///                                      input interface. */
619///    unsigned int outputifindex;    /* If set, ifIndex for egress drops. Zero
620///                                      otherwise. Must identify physical port
621///                                      consistent with flow_sample output
622///                                      interface. */
623///    drop_reason reason;            /* Reason for dropping packet. */
624///    flow_record discard_records<>; /* Information about the discarded packet. */
625/// }
626/// ```
627#[derive(Debug, Clone, PartialEq, Eq)]
628#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
629pub struct DiscardedPacket {
630    /// Sequence number incremented with each discarded packet record
631    pub sequence_number: u32,
632
633    /// sFlow data source
634    pub source_id: DataSourceExpanded,
635
636    /// Number of discarded packet records dropped by rate limit or lack of resources
637    pub drops: u32,
638
639    /// Input interface index (0 if unknown)
640    pub input_ifindex: u32,
641
642    /// Output interface index (0 if not egress drop)
643    pub output_ifindex: u32,
644
645    /// Reason for dropping the packet
646    pub reason: crate::models::record_flows::DropReason,
647
648    /// Flow records describing the discarded packet
649    pub flow_records: Vec<FlowRecord>,
650}
651
652/// Sample data types
653#[derive(Debug, Clone, PartialEq)]
654#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
655pub enum SampleData {
656    FlowSample(FlowSample),
657    CountersSample(CountersSample),
658    FlowSampleExpanded(FlowSampleExpanded),
659    CountersSampleExpanded(CountersSampleExpanded),
660    DiscardedPacket(DiscardedPacket),
661    Unknown { format: DataFormat, data: Vec<u8> },
662}
663
664/// Sample record
665#[derive(Debug, Clone, PartialEq)]
666#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
667pub struct SampleRecord {
668    pub sample_type: DataFormat,
669    pub sample_data: SampleData,
670}
671
672/// sFlow v5 datagram
673///
674/// Top-level structure containing one or more samples.
675///
676/// # XDR Definition ([sFlow v5](https://sflow.org/sflow_version_5.txt))
677///
678/// ```text
679/// /* sFlow version 5 datagram */
680///
681/// struct sflow_datagram {
682///    unsigned int version;        /* sFlow version (5) */
683///    address agent_address;       /* IP address of sampling agent */
684///    unsigned int sub_agent_id;   /* Used to distinguish multiple sFlow instances
685///                                    on the same agent */
686///    unsigned int sequence_number;/* Incremented with each sample datagram generated
687///                                    by a sub-agent within an agent */
688///    unsigned int uptime;         /* Current time (in milliseconds since device
689///                                    last booted). Should be set as close to
690///                                    datagram transmission time as possible. */
691///    sample_record samples<>;     /* An array of sample records */
692/// }
693/// ```
694#[derive(Debug, Clone, PartialEq)]
695#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
696pub struct SFlowDatagram {
697    /// sFlow protocol version (always 5)
698    pub version: DatagramVersion,
699    /// IP address of the sFlow agent
700    pub agent_address: Address,
701    /// Sub-agent identifier (distinguishes multiple sFlow instances on same agent)
702    pub sub_agent_id: u32,
703    /// Datagram sequence number (incremented with each datagram from this sub-agent)
704    pub sequence_number: u32,
705    /// Device uptime in milliseconds since last boot
706    pub uptime: u32,
707    /// Array of sample records
708    pub samples: Vec<SampleRecord>,
709}
710
711impl SFlowDatagram {
712    /// Create a new sFlow v5 datagram
713    pub fn new(
714        agent_address: Address,
715        sub_agent_id: u32,
716        sequence_number: u32,
717        uptime: u32,
718    ) -> Self {
719        Self {
720            version: DatagramVersion::Version5,
721            agent_address,
722            sub_agent_id,
723            sequence_number,
724            uptime,
725            samples: Vec::new(),
726        }
727    }
728}
sflow_parser/models/core.rs

sflow_parser/models/
core.rs
