Skip to content

Commit

Permalink
Unirec output plugin: update list of UniRec elements
Browse files Browse the repository at this point in the history
  • Loading branch information
@hynekkar
hynekkar committed Aug 19, 2020
1 parent 8eb4954 commit 659a5b2
Showing 1 changed file with 104 additions and 19 deletions.
123 changes: 104 additions & 19 deletions extra_plugins/output/unirec/config/unirec-elements.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -43,8 +43,20 @@ BYTES_REV uint64 e29305id1
PACKETS_REV uint32 e29305id2
TCP_FLAGS_REV uint8 e29305id6


# --- DNS specific fields ---
DNS_ID uint16 flowmon:dnsId # DNS transaction id
DNS_ANSWERS uint16 e8057id14 # DNS answers
DNS_RCODE uint8 e8057id1 # DNS rcode
DNS_NAME string e8057id2 # DNS name
DNS_QTYPE uint16 e8057id3 # DNS qtype
DNS_CLASS uint16 e8057id4 # DNS class
DNS_RR_TTL uint32 e8057id5,flowmon:dnsCrrTtl # DNS rr ttl
DNS_RLENGTH uint16 e8057id6 # DNS rlenght
DNS_RDATA bytes e8057id7 # DNS rdata
DNS_PSIZE uint16 e8057id8 # DNS payload size
DNS_DO uint8 e8057id9 # DNS DNSSEC OK bit
DNS_ID uint16 e8057id10,flowmon:dnsId # DNS transaction id

DNS_FLAGS uint16 flowmon:dnsFlagsCodes # DNS header flags
DNS_CNT_QUESTIONS uint16 flowmon:dnsQuestionCount # DNS questions
DNS_CNT_ANSWERS uint16 flowmon:dnsAnswrecCount # DNS answers
Expand All @@ -56,17 +68,37 @@ DNS_Q_CLASS uint16 flowmon:dnsQclass # DNS que
DNS_RR_NAME string flowmon:dnsCrrName # DNS RR name
DNS_RR_TYPE uint16 flowmon:dnsCrrType # DNS RR type
DNS_RR_CLASS uint16 flowmon:dnsCrrClass # DNS RR class
DNS_RR_TTL uint32 flowmon:dnsCrrTtl # DNS RR ttl
DNS_RR_RDATA bytes flowmon:dnsCrrRdata # DNS RR rdata
DNS_RR_RLENGTH uint16 flowmon:dnsCrrRdataLen # DNS RR rlenght
# Note: Old fields DNS_RCODE, DNS_PSIDE and DNS_DO are not available anymore...


# --- SMTP specific fields ---
#SMTP_FLAGS uint8 e8057id200 # SMTP flags
SMTP_COMMAND_FLAGS uint32 e8057id810 # SMTP command flags
SMTP_MAIL_CMD_COUNT uint32 e8057id811 # SMTP MAIL command count
SMTP_RCPT_CMD_COUNT uint32 e8057id812 # SMTP RCPT command count
SMTP_FIRST_SENDER string e8057id813 # SMTP first sender
SMTP_FIRST_RECIPIENT string e8057id814 # SMTP first recipient
SMTP_STAT_CODE_FLAGS uint32 e8057id815 # SMTP status code flags
SMTP_2XX_STAT_CODE_COUNT uint32 e8057id816 # SMTP 2XX status code count
SMTP_3XX_STAT_CODE_COUNT uint32 e8057id817 # SMTP 3XX status code count
SMTP_4XX_STAT_CODE_COUNT uint32 e8057id818 # SMTP 4XX status code count
SMTP_5XX_STAT_CODE_COUNT uint32 e8057id819 # SMTP 5XX status code count
SMTP_DOMAIN string e8057id820 # SMTP domain

# --- SIP specific fields ---
SIP_MSG_TYPE uint16 e8057id100 # SIP message type
SIP_STATUS_CODE uint16 e8057id101 # SIP status code
SIP_CALL_ID string e8057id102,flowmon:sipCallId # SIP call id
SIP_CALLING_PARTY string e8057id103,flowmon:sipCallingParty # SIP from
SIP_CALLED_PARTY string e8057id104,flowmon:sipCalledParty # SIP to
SIP_VIA string e8057id105,flowmon:sipVia # SIP VIA
SIP_USER_AGENT string e8057id106 # SIP user agent
SIP_REQUEST_URI string e8057id107 # SIP request uri
SIP_CSEQ string e8057id108 # SIP CSeq

VOIP_PACKET_TYPE uint8 flowmon:voipPacketType
SIP_CALL_ID string flowmon:sipCallId
SIP_CALLING_PARTY string flowmon:sipCallingParty
SIP_CALLED_PARTY string flowmon:sipCalledParty
SIP_VIA string flowmon:sipVia
SIP_INVITE_RINGING_TIME uint64 flowmon:sipInviteRingingTime
SIP_OK_TIME uint64 flowmon:sipOkTime
SIP_BYE_TIME uint64 flowmon:sipByeTime
Expand All @@ -82,13 +114,21 @@ RTCP_PACKETS uint64 flowmon:rtcpPackets
RTCP_OCTETS uint64 flowmon:rtcpOctets
RTCP_SOURCE_COUNT uint8 flowmon:rtcpSourceCount




# --- HTTP elements ---
HTTP_REQUEST_HOST string flowmon:httpHost
HTTP_REQUEST_URL string flowmon:httpUrl
HTTP_REQUEST_REFERER string flowmon:httpReferer
HTTP_METHOD_MASK uint16 flowmon:httpMethodMask
HTTP_RESPONSE_CONTENT_TYPE string flowmon:httpContentType
HTTP_RESPONSE_STATUS_CODE uint16 flowmon:httpStatusCode
HTTP_REQUEST_METHOD_ID uint32 e16982id500 # HTTP request method id
HTTP_REQUEST_HOST string e16982id501,flowmon:httpHost # HTTP(S) request host
HTTP_REQUEST_URL string e16982id502,flowmon:httpUrl # HTTP request url
HTTP_REQUEST_AGENT_ID uint32 e16982id503 # HTTP request agent id
HTTP_REQUEST_AGENT string e16982id504 # HTTP request agent
HTTP_REQUEST_REFERER string e16982id505 # HTTP referer
HTTP_RESPONSE_STATUS_CODE uint32 e16982id506,flowmon:httpStatusCode # HTTP response status code
HTTP_RESPONSE_CONTENT_TYPE string e16982id507 # HTTP response content type


HTTP_METHOD_ID uint16 flowmon:httpMethodID
HTTP_UA_OS uint16 flowmon:httpUaOs
HTTP_UA_OS_MAJ uint16 flowmon:httpUaOsMaj
HTTP_UA_OS_MIN uint16 flowmon:httpUaOsMin
Expand All @@ -98,7 +138,10 @@ HTTP_UA_APP_MAJ uint16 flowmon:httpUaAppMaj
HTTP_UA_APP_MIN uint16 flowmon:httpUaAppMin
HTTP_UA_APP_BLD uint16 flowmon:httpUaAppBld



# --- Other fields ---
IPV6_TUN_TYPE uint8 e16982id405 # IPv6 tunnel type
APP_ID bytes e0id95 # Application ID from libprotoident / NBAR2 / Flowmon's NBAR plugin

# --- Flowmon TLS fields
Expand Down Expand Up @@ -132,10 +175,52 @@ TLS_PUBLIC_KEYLENGTH int32 flowmon:tlsPublicKeyLength # tlsP
TLS_JA_3FINGERPRINT bytes flowmon:tlsJa3Fingerprint # tlsJa3Fingerprint

# --- Per-Packet Information elements ---
PPI_TLS_REC_LENGTHS int16* e0id291/e8057id1010 # basicList of TLS record lengths
PPI_TLS_REC_TIMES uint16* e0id291/e8057id1011 # basicList of TLS record timestamps
PPI_TLS_CONTENT_TYPES uint8* e0id291/e8057id1012 # basicList of TLS record content types
PPI_PKT_LENGTHS int16* e0id291/e8057id1013 # basicList of packet lengths
PPI_PKT_TIMES time* e0id291/e8057id1014 # basicList of packet timestamps
PPI_PKT_FLAGS int8* e0id291/e8057id1015 # basicList of packet TCP flags
PPI_PKT_DIRECTIONS int8* e0id291/e8057id1016 # basicList of packet directions
#PPI_TLS_REC_LENGTHS uint16* e0id291/e8057id1010 # basicList of TLS record lengths
#PPI_TLS_REC_TIMES uint16* e0id291/e8057id1011 # basicList of TLS record timestamps
#PPI_TLS_CONTENT_TYPES uint8* e0id291/e8057id1012 # basicList of TLS record content types
PPI_PKT_LENGTHS uint16* e0id291/e8057id1013 # basicList of packet lengths
PPI_PKT_TIMES time* e0id291/e8057id1014 # basicList of packet timestamps
PPI_PKT_FLAGS uint8* e0id291/e8057id1015 # basicList of packet TCP flags
PPI_PKT_DIRECTIONS int8* e0id291/e8057id1016 # basicList of packet directions

# --- SSDP Information elements ---

SSDP_LOCATION_PORT uint16 e8057id821
SSDP_SERVER string e8057id822
SSDP_USER_AGENT string e8057id823
SSDP_NT string e8057id824
SSDP_ST string e8057id825

# --- DNSDD Information elements ---

DNSSD_QUERIES string e8057id826
DNSSD_RESPONSES string e8057id827

# --- OVPN Information elements ---

OVPN_CONF_LEVEL uint8 e8057id828

# --- NTP Information elements ---
NTP_LEAP uint8 e8057id18
NTP_VERSION uint8 e8057id19
NTP_MODE uint8 e8057id20
NTP_STRATUM uint8 e8057id21
NTP_POLL uint8 e8057id22
NTP_PRECISION uint8 e8057id23
NTP_DELAY uint32 e8057id24
NTP_DISPERSION uint32 e8057id25
NTP_REF_ID string e8057id26
NTP_REF string e8057id27
NTP_ORIG string e8057id28
NTP_RECV string e8057id29
NTP_SENT string e8057id30

# --- ARP Information elements ---

ARP_HA_FORMAT uint16 e8057id31
ARP_PA_FORMAT uint16 e8057id32
ARP_OPCODE uint16 e8057id33
ARP_SRC_HA bytes e8057id34
ARP_SRC_PA bytes e8057id35
ARP_DST_HA bytes e8057id36
ARP_DST_PA bytes e8057id37

0 comments on commit 659a5b2

Please sign in to comment.