--- ../../nfdump-1.6.5/bin/netflow_v9.h 2011-12-29 19:13:36.000000000 +0400 +++ netflow_v9.h 2012-01-20 09:24:48.000000000 +0400 @@ -230,6 +230,14 @@ #define NF9_FORWARDING_STATUS 89 +#define NAT_LOG_FIELD_IDX_CONTEXT_ID 24628 +#define NAT_LOG_FIELD_IDX_CONTEXT_NAME 24629 +#define NAT_LOG_FIELD_IDX_ASSIGN_TS_SEC 24630 +#define NAT_LOG_FIELD_IDX_UNASSIGN_TS_SEC 24631 +#define NAT_LOG_FIELD_IDX_IPV4_INT_ADDR 24632 +#define NAT_LOG_FIELD_IDX_IPV4_EXT_ADDR 24633 +#define NAT_LOG_FIELD_IDX_EXT_PORT_FIRST 24634 +#define NAT_LOG_FIELD_IDX_EXT_PORT_LAST 24635 /* prototypes */ --- ../../nfdump-1.6.5/bin/netflow_v9.c 2011-12-30 17:54:42.000000000 +0400 +++ netflow_v9.c 2012-01-20 15:07:35.000000000 +0400 @@ -84,6 +84,8 @@ #include "inline.c" extern int verbose; +extern int ericsson_nat; + extern extension_descriptor_t extension_descriptor[]; extern uint32_t Max_num_extensions; extern uint32_t default_sampling; @@ -895,11 +897,38 @@ field_type = Get_val16(p); p = p + 2; field_length = Get_val16(p); p = p + 2; + if (ericsson_nat) { + switch(field_type) { + case NAT_LOG_FIELD_IDX_ASSIGN_TS_SEC : + field_type = NF9_FIRST_SWITCHED ; + break; + + case NAT_LOG_FIELD_IDX_UNASSIGN_TS_SEC : + field_type = NF9_LAST_SWITCHED ; + break; + case NAT_LOG_FIELD_IDX_IPV4_INT_ADDR : + field_type = NF9_IPV4_SRC_ADDR; + break; + + case NAT_LOG_FIELD_IDX_IPV4_EXT_ADDR : + field_type = NF9_IPV4_DST_ADDR; + break; + + case NAT_LOG_FIELD_IDX_EXT_PORT_FIRST : + field_type = NF9_L4_SRC_PORT ; + break; + + case NAT_LOG_FIELD_IDX_EXT_PORT_LAST : + field_type = NF9_L4_DST_PORT; + break; + + } + } // make sure field < 128 - if ( field_type > 127 ) { + if ( field_type > 128 ) { offset += field_length; - syslog(LOG_ERR, "Process_v9: [%u] field ID > 128 - field ignored. ", exporter->exporter_id ); + //syslog(LOG_ERR, "Process_v9: [%u] field ID > 128 - field ignored. ", exporter->exporter_id ); dbg_printf("Type: %u, Length %u => Skipped.\n", field_type, field_length); continue; } @@ -1291,6 +1320,10 @@ First = data_record->first; Last = data_record->last; + if (ericsson_nat) { + data_record->msec_first = 0; + data_record->msec_last = 0; + } else { if ( First > Last ) /* First in msec, in case of msec overflow, between start and end */ start_time = exporter->boot_time - 0x100000000LL + (uint64_t)First; @@ -1315,6 +1348,7 @@ if ( end_time > fs->last_seen ) fs->last_seen = end_time; + } // Update stats if ( table->packet_offset ) { if ( (data_record->flags & FLAG_PKG_64 ) == 0 ) // 32bit packet counter --- ../../nfdump-1.6.5/bin/nfcapd.c 2011-12-29 19:24:14.000000000 +0400 +++ nfcapd.c 2012-01-23 14:18:24.000000000 +0400 @@ -121,6 +121,7 @@ /* globals */ caddr_t shmem; int verbose = 0; +int ericsson_nat = 0; extern uint32_t default_sampling; // the default sampling rate when nothing else applies. set by -S extern uint32_t overwrite_sampling; // unconditionally overwrite sampling rate with given sampling rate -S @@ -180,6 +181,7 @@ "-T\t\tInclude extension tags in records.\n" "-4\t\tListen on IPv4 (default).\n" "-6\t\tListen on IPv6.\n" + "-N\t\tConvert SmartEdge Router Specific Logging Field.\n" "-V\t\tPrint version and exit.\n" , name); } // End of usage @@ -777,7 +779,7 @@ extension_tags = DefaultExtensions; pcap_file = NULL; - while ((c = getopt(argc, argv, "46ef:whEVI:DB:b:j:l:n:p:P:R:S:s:T:t:x:Xru:g:z")) != EOF) { + while ((c = getopt(argc, argv, "46Nef:whEVI:DB:b:j:l:n:p:P:R:S:s:T:t:x:Xru:g:z")) != EOF) { switch (c) { case 'h': usage(argv[0]); @@ -938,6 +940,9 @@ exit(255); } break; + case 'N': + ericsson_nat = 1; + break; default: usage(argv[0]); exit(255); --- ../../nfdump-1.6.5/bin/nfreplay.c 2011-12-29 19:24:14.000000000 +0400 +++ nfreplay.c 2012-01-23 14:21:40.000000000 +0400 @@ -92,6 +92,7 @@ /* Global Variables */ FilterEngine_data_t *Engine; int verbose; +int ericsson_nat = 0; /* Local Variables */ static const char *nfdump_version = VERSION;