em-sflow 1.0.1

data/.gitignore

@@ -0,0 +1,19 @@
+*.gem
+*.rbc
+.bundle
+.config
+.yardoc
+Gemfile.lock
+InstalledFiles
+_yardoc
+coverage
+doc/
+lib/bundler/man
+pkg
+rdoc
+spec/reports
+test/tmp
+test/version_tmp
+tmp
+
+.rvmrc

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in em-sflow.gemspec
+gemspec

data/LICENSE

@@ -0,0 +1,22 @@
+Copyright (c) 2012 Norman Elton
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.rdoc

@@ -0,0 +1,56 @@
+= sFlow Library for EventMachine
+
+== Summary
+
+This gem collects, parses, and optionally proxies sampled flow records from network switches and routers. For information about sFlow, refer to www.sflow.org[http://www.sflow.org].
+
+== Features
+
+Version 1.0.0
+
+* Ability to parse the following sFlow messages: Raw Packet Header, Generic Interface Counter, Ethernet Interface Counter
+* All other sFlow messages are stubbed out. Their implementation should take no more than a few minutes for someone with access to an sFlow-capable device exporting these message types.
+* Ability to proxy a copy of the sFlow packet to a secondary collector.
+
+
+== Examples
+
+Collector:
+
+  EM.run {
+    c = EventMachine::SFlow::Collector.new(:host => "127.0.0.1")
+
+    c.on_sflow do |pkt|
+      puts "Got #{pkt.samples.count} samples"
+
+      pkt.samples.each do |sample|
+        sample.records.each do |record|
+          if record.is_a? EM::SFlow::RawPacketHeader
+            puts "Received a sampled packet from #{pkt.agent} of length #{record.header.size}"
+          elsif record.is_a? EM::SFlow::GenericInterfaceCounters
+            puts "Interface #{record.if_index} on #{pkt.agent} has seen #{record.if_in_octets} inbound bytes, #{record.if_out_octets} outbound bytes"
+          end
+        end
+      end
+    end
+  }
+
+Proxy:
+
+  EM.run {
+    c = EventMachine::SFlow::Collector.new(:host => "127.0.0.1")
+    
+    c.proxy_to "192.168.1.1"
+  }
+  
+Multiple callbacks and proxy targets can be defined simultaneously
+
+== Change Log
+
+Version 1.0.0:
+
+* Initial release
+
+== Credits
+
+Author: Norman Elton  normelton@gmail.com

data/Rakefile

@@ -0,0 +1,2 @@
+#!/usr/bin/env rake
+require "bundler/gem_tasks"

data/em-sflow.gemspec

@@ -0,0 +1,22 @@
+# -*- encoding: utf-8 -*-
+require File.expand_path('../lib/em-sflow/version', __FILE__)
+
+Gem::Specification.new do |gem|
+  gem.authors       = ["Norman Elton"]
+  gem.email         = ["normelton@gmail.com"]
+  gem.description   = "EventMachine-powered sFlow Collector"
+  gem.summary       = "EventMachine-powered sFlow Collector"
+  gem.homepage      = "http://github.com/normelton/em-sflow"
+
+  gem.files         = `git ls-files`.split($\)
+  gem.executables   = gem.files.grep(%r{^bin/}).map{ |f| File.basename(f) }
+  gem.test_files    = gem.files.grep(%r{^(test|spec|features)/})
+  gem.name          = "em-sflow"
+  gem.require_paths = ["lib"]
+  gem.version       = EventMachine::SFlow::VERSION
+  
+  gem.extra_rdoc_files = ["README.rdoc"]
+  gem.rdoc_options     = ["--line-numbers", "--inline-source", "--title", "EM-SFLOW", "--main", "README.rdoc"]
+
+  gem.add_runtime_dependency "eventmachine", ">= 0.12.10"
+end

data/lib/em-sflow.rb

@@ -0,0 +1,20 @@
+require "em-sflow/version"
+
+require "eventmachine"
+require "ipaddr"
+
+require "em-sflow/collector"
+require "em-sflow/datagram_handler"
+require "em-sflow/binary_string"
+require "em-sflow/packet/datagram"
+require "em-sflow/packet/flow_sample"
+require "em-sflow/packet/counter_sample"
+require "em-sflow/packet/raw_packet_header"
+require "em-sflow/packet/generic_interface_counters"
+require "em-sflow/packet/ethernet_interface_counters"
+
+module EventMachine
+  module SFlow
+    # Your code goes here...
+  end
+end

data/lib/em-sflow/binary_string.rb

@@ -0,0 +1,9 @@
+module EventMachine
+  module SFlow
+    module BinaryString
+      def advance i
+        slice!(0..(i - 1))
+      end
+    end
+  end
+end

data/lib/em-sflow/collector.rb

@@ -0,0 +1,24 @@
+
+module EventMachine
+  module SFlow
+    class Collector
+      def initialize args = {}
+        args[:host] ||= "127.0.0.1"
+        args[:port] ||= 6343
+        
+        @callbacks = []
+        @proxy_targets = []
+        
+        EventMachine.open_datagram_socket(args[:host], args[:port], DatagramHandler, {:host => args[:host], :callbacks => @callbacks, :proxy_targets => @proxy_targets})
+      end
+      
+      def proxy_to target
+        @proxy_targets << target
+      end
+      
+      def on_sflow &proc
+        @callbacks << proc
+      end
+    end
+  end
+end

data/lib/em-sflow/datagram_handler.rb

@@ -0,0 +1,30 @@
+module EventMachine
+  module SFlow
+    module DatagramHandler
+      def initialize args
+        @host = args[:host]
+        @callbacks = args[:callbacks]
+        @proxy_targets = args[:proxy_targets]
+      end
+      
+      def receive_data data
+        unless @proxy_targets.empty?
+          @proxy_socket ||= EventMachine.open_datagram_socket(@host, 0)
+          
+          @proxy_targets.each do |target|
+            target_host = target.split(":")[0]
+            target_port = target.split(":")[1] || "6343"
+
+            @proxy_socket.send_datagram(data, target_host, target_port)
+          end
+        end
+
+        datagram = Datagram.new(data)
+        
+        @callbacks.each do |callback|
+          callback.call datagram
+        end
+      end
+    end
+  end
+end

data/lib/em-sflow/packet/counter_sample.rb

@@ -0,0 +1,40 @@
+class EventMachine::SFlow::CounterSample
+  attr_accessor :sequence_number, :source_class, :source_value, :records
+  def initialize data
+    @records = []
+    
+    data.extend EM::SFlow::BinaryString
+    
+    @sequence_number, source_id_class_value, record_count = data.unpack("NNN")
+    
+    @source_class = source_id_class_value >> 24
+    @source_value = source_id_class_value & (2 ** 24 - 1)
+    
+    data.advance(12)
+    
+    record_count.times do
+      enterprise_format, length = data.unpack("NN")
+      
+      enterprise = enterprise_format >> 12
+      format = enterprise_format & (2 ** 12 - 1)
+      
+      data.advance(8)
+      
+      record_data = data.advance(length)
+
+      if enterprise == 0 && format == 1
+        @records << EM::SFlow::GenericInterfaceCounters.new(record_data)
+      elsif enterprise == 0 && format == 2
+        @records << EM::SFlow::EthernetInterfaceCounters.new(record_data)
+      elsif enterprise == 0 && format == 3
+        # @records << EM::SFlow::TokenRingCounters.new(record_data)
+      elsif enterprise == 0 && format == 4
+        # @records << EM::SFlow::HundredBaseVgCounters.new(record_data)
+      elsif enterprise == 0 && format == 5
+        # @records << EM::SFlow::VlanCounters.new(record_data)
+      elsif enterprise == 0 && format == 1001
+        # @records << EM::SFlow::ProcessorInformation.new(record_data)
+      end
+    end
+  end
+end

data/lib/em-sflow/packet/datagram.rb

@@ -0,0 +1,46 @@
+class EventMachine::SFlow::Datagram
+  attr_reader :version, :agent, :sub_agent_id, :datagram_sequence, :uptime, :samples
+  
+  def initialize data
+    data.extend EM::SFlow::BinaryString
+    
+    @samples = []
+
+    @version, ip_version = data.unpack("NN")
+    
+    data.advance(8)
+
+    if ip_version == 1
+      @agent = IPAddr.new(data.unpack("N").first, Socket::AF_INET)
+      data.advance(4)
+    else
+      ip_elements = data.unpack("NNNN")
+      @agent = IPAddr.new((ip_elements[0] << 96) + (ip_elements[1] << 64) + (ip_elements[2] << 32) + ip_elements[3], Socket::AF_INET6)
+      data.advance(16)
+    end
+    
+    @sub_agent_id, @datagram_sequence, @uptime, sample_count = data.unpack("NNNN")
+    
+    data.advance(16)
+
+    sample_count.times do
+      enterprise_format, length = data.unpack("NN")
+      enterprise = enterprise_format >> 12
+      format = enterprise_format & (2 ** 12 - 1)
+      
+      data.advance(8)
+
+      sample_data = data.advance(length)
+      
+      if enterprise == 0 && format == 1
+        @samples << EM::SFlow::FlowSample.new(sample_data)
+      elsif enterprise == 0 && format == 2  
+        @samples << EM::SFlow::CounterSample.new(sample_data)
+      elsif enterprise == 0 && format == 3
+        # @samples << EM::SFlow::ExpandedFlowSample.new(sample_data)
+      elsif enterprise == 0 && format == 4
+        # @samples << EM::SFlow::ExpandedCounterSample.new(sample_data)
+      end
+    end
+  end
+end

data/lib/em-sflow/packet/ethernet_interface_counters.rb

@@ -0,0 +1,9 @@
+class EventMachine::SFlow::EthernetInterfaceCounters
+  attr_accessor :alignment_errors, :fcs_errors, :single_collision_frames, :multiple_collision_frames, :sqe_test_errors, :deferred_transmissions, :late_collisions, :excessive_collisions, :internal_mac_transmit_errors, :carrier_sense_errors, :frames_too_long, :internal_mac_receive_errors, :symbol_errors
+  
+  def initialize data
+    data.extend EventMachine::SFlow::BinaryString
+    
+    @alignment_errors, @fcs_errors, @single_collision_frames, @multiple_collision_frames, @sqe_test_errors, @deferred_transmissions, @late_collisions, @excessive_collisions, @internal_mac_transmit_errors, @carrier_sense_errors, @frames_too_long, @internal_mac_receive_errors, @symbol_errors = data.unpack("NNNNNNNNNNNNN")
+  end
+end

data/lib/em-sflow/packet/flow_sample.rb

@@ -0,0 +1,61 @@
+class EventMachine::SFlow::FlowSample
+  attr_accessor :sequence_number, :source_class, :source_value, :sampling_rate, :sample_pool, :drop_count, :input_count, :output_count, :records
+  
+  def initialize data
+    data.extend EM::SFlow::BinaryString
+    
+    @records = []
+    
+    @sequence_number, source_id_class_value, @sampling_rate, @sample_pool, @drop_count, @input_count, @output_count, record_count = data.unpack("NNNNNNNN")
+    
+    @source_class = source_id_class_value >> 24
+    @source_value = source_id_class_value & (2 ** 24 - 1)
+    
+    data.advance(32)
+    
+    record_count.times do
+      enterprise_format, length = data.unpack("NN")
+      
+      enterprise = enterprise_format >> 12
+      format = enterprise_format & (2 ** 12 - 1)
+      
+      data.advance(8)
+      
+      record_data = data.advance(length)
+
+      if enterprise == 0 && format == 1
+        @records << EM::SFlow::RawPacketHeader.new(record_data)
+      elsif enterprise == 0 && format == 2
+        # @records << EM::SFlow::EthernetFrameData.new(record_data)
+      elsif enterprise == 0 && format == 3
+        # @records << EM::SFlow::IPv4Data.new(record_data)
+      elsif enterprise == 0 && format == 4
+        # @records << EM::SFlow::IPv6Data.new(record_data)
+      elsif enterprise == 0 && format == 1001
+        # @records << EM::SFlow::ExtendedSwitchData.new(record_data)
+      elsif enterprise == 0 && format == 1002
+        # @records << EM::SFlow::ExtendedRouterData.new(record_data)
+      elsif enterprise == 0 && format == 1003
+        # @records << EM::SFlow::ExtendedGatewayData.new(record_data)
+      elsif enterprise == 0 && format == 1004
+        # @records << EM::SFlow::ExtendedUserData.new(record_data)
+      elsif enterprise == 0 && format == 1005
+        # @records << EM::SFlow::ExtendedUrlData.new(record_data)
+      elsif enterprise == 0 && format == 1006
+        # @records << EM::SFlow::ExtendedMplsData.new(record_data)
+      elsif enterprise == 0 && format == 1007
+        # @records << EM::SFlow::ExtendedNatData.new(record_data)
+      elsif enterprise == 0 && format == 1008
+        # @records << EM::SFlow::ExtendedMplsTunnel.new(record_data)
+      elsif enterprise == 0 && format == 1009
+        # @records << EM::SFlow::ExtendedMplsVc.new(record_data)
+      elsif enterprise == 0 && format == 1010
+        # @records << EM::SFlow::ExtendedMplsFec.new(record_data)
+      elsif enterprise == 0 && format == 1011
+        # @records << EM::SFlow::ExtendedMplsLvpFec.new(record_data)
+      elsif enterprise == 0 && format == 1012
+        # @records << EM::SFlow::ExtendedVlanTunnel.new(record_data)
+      end
+    end
+  end
+end

data/lib/em-sflow/packet/generic_interface_counters.rb

@@ -0,0 +1,26 @@
+class EventMachine::SFlow::GenericInterfaceCounters
+  attr_accessor :if_index, :if_type, :if_speed, :if_direction, :if_admin_status, :if_oper_status, :if_in_octets, :if_in_ucast_pkts, :if_in_mcast_pkts, :if_in_bcast_pkts, :if_in_discards, :if_in_errors, :if_in_unknown_protocols, :if_out_octets, :if_out_ucast_pkts, :if_out_mcast_pkts, :if_out_bcast_pkts, :if_out_discards, :if_out_errors, :if_promiscuous
+  
+  def initialize data
+    data.extend EventMachine::SFlow::BinaryString
+    
+    @if_index, @if_type, if_speed_a, if_speed_b, @if_direction, if_status = data.unpack("NNNNNN")
+    @if_speed = (if_speed_a << 32) + if_speed_b
+    @if_admin_status = (if_status >> 31) && 1
+    @if_oper_status = (if_status >> 30) && 1
+    
+    data.advance(24)
+    
+    if_in_octets_a, if_in_octets_b, @if_in_ucast_pkts, @if_in_mcast_pkts, @if_in_bcast_pkts, @if_in_discards, @if_in_errors, @if_in_unknown_protocols = data.unpack("NNNNNNNN")
+    @if_in_octets = (if_in_octets_a << 32) + if_in_octets_b
+    
+    data.advance(32)
+    
+    if_out_octets_a, if_out_octets_b, @if_out_ucast_pkts, @if_out_mcast_pkts, @if_out_bcast_pkts, @if_out_discards, @if_out_errors = data.unpack("NNNNNNN")
+    @if_out_octets = (if_out_octets_a << 32) + if_out_octets_b
+    
+    data.advance(28)
+    
+    @if_promiscuous = data.unpack("N").first
+  end
+end

data/lib/em-sflow/packet/raw_packet_header.rb

@@ -0,0 +1,12 @@
+class EventMachine::SFlow::RawPacketHeader
+  attr_accessor :protocol, :frame_length, :strip_count, :header
+  
+  def initialize data
+    data.extend EventMachine::SFlow::BinaryString
+    
+    @protocol, @frame_length, @strip_count, length = data.unpack("NNNN")
+    data.advance(16)
+    
+    @header = data
+  end
+end

data/lib/em-sflow/version.rb

@@ -0,0 +1,5 @@
+module EventMachine
+  module SFlow
+    VERSION = "1.0.1"
+  end
+end

metadata

@@ -0,0 +1,80 @@
+--- !ruby/object:Gem::Specification
+name: em-sflow
+version: !ruby/object:Gem::Version
+  version: 1.0.1
+  prerelease: 
+platform: ruby
+authors:
+- Norman Elton
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2012-04-30 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: eventmachine
+  requirement: &70342806966360 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 0.12.10
+  type: :runtime
+  prerelease: false
+  version_requirements: *70342806966360
+description: EventMachine-powered sFlow Collector
+email:
+- normelton@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files:
+- README.rdoc
+files:
+- .gitignore
+- Gemfile
+- LICENSE
+- README.rdoc
+- Rakefile
+- em-sflow.gemspec
+- lib/em-sflow.rb
+- lib/em-sflow/binary_string.rb
+- lib/em-sflow/collector.rb
+- lib/em-sflow/datagram_handler.rb
+- lib/em-sflow/packet/counter_sample.rb
+- lib/em-sflow/packet/datagram.rb
+- lib/em-sflow/packet/ethernet_interface_counters.rb
+- lib/em-sflow/packet/flow_sample.rb
+- lib/em-sflow/packet/generic_interface_counters.rb
+- lib/em-sflow/packet/raw_packet_header.rb
+- lib/em-sflow/version.rb
+homepage: http://github.com/normelton/em-sflow
+licenses: []
+post_install_message: 
+rdoc_options:
+- --line-numbers
+- --inline-source
+- --title
+- EM-SFLOW
+- --main
+- README.rdoc
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 1.8.5
+signing_key: 
+specification_version: 3
+summary: EventMachine-powered sFlow Collector
+test_files: []