a
    kÄ#dÄí  ã                b  @   sx$  d Z ddlZddlZddlmZ ddlmZ ddlmZm	Z	 ddl
mZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZm Z m!Z! ddl"m#Z#m$Z$m%Z% ddl&m'Z' dd	l(m)Z)m*Z* dd
l+m,Z, ddl-m.Z. G dd„ de#ƒZ/dD ] Z0e%e,e/e0d� e%e,e/e0d� qüe$e,e/ddd� G dd„ de#ƒZ1G dd„ de#ƒZ2e$e/e1dd� e$e1e2ƒ e$e2e2ƒ G dd„ de#ƒZ3G dd„ de#ƒZ4e$e/e3dd� e$e3e4ƒ e$e4e4ƒ dZ5ddd d!d"d#d$d%dd&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~dd€d�d‚dƒd„d…d†d‡dˆd‰dŠd‹dŒd�dŽd�d�d‘d’d“d”d•d–d—d˜d™dšd›dœd�dždŸd d¡d¢d£d¤d¥d¦d§d¨d©dªd«d¬d­d®d¯d°d±d²d³d´dµd¶d·d¸d¹dºd»d¼d½d¾d¿dÀdÁdÂdÃdÄdÅdÆdÇdÈdÉdÊdËdÌdÍdÎdÏdÐdÑdÒdÓdÔdÕdÖd×dØdÙdÚdÛdÜdÝdÞdßdàdádâdãdädådædçdèdédêdëdìdídîdïdðdñdòdódôdõdöd÷dødùdúdûdüdýdþdÿ�d �d�d�d�d�d�d�d�d�d	�d
�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d �d!�d"�d#�d$�d%�d&�d'�d(�d)�d*�d+�d,�d-�d.�d/�d0�d1�d2�d3�d4�d5�d6�d7�d8�d9�d:�d;�d<�d=�d>�d?�d@�dA�dB�dC�dD�dE�dF�dG�dH�dI�dJ�dK�dL�dM�dN�dO�dP�dQ�dR�dS�dT�dU�dV�dW�dX�dY�dZ�d[�d\�d]�d^�d_�d`�da�db�dc�dd�de�df�dg�dh�di�dj�dk�dl�dm�dn�do�dp�dq�dr�ds�dt�du�dv�dw�dx�dy�dz�d{�d|�d}�d~�d�d€�d��d‚�dƒ�d„�d…�d†�d‡�dˆ�d‰�dŠ�d‹�dŒ�d��dŽ�d��d��d‘�d’�d“�d”�d•�d–�d—�d˜�d™�dš�d›�dœ�d��dž�dŸ�d �d¡�d¢�d£�d¤�d¥�d¦�d§�d¨�d©�dª�d«�d¬�d­�d®�d¯�d°�d±�d²�d³�d´�dµ�d¶�d·�d¸�d¹�dº�d»�d¼�d½�d¾�d¿�dÀ�dÁ�dÂ�dÃ�dÄ�dÅ�dÆ�dÇ�dÈ�dÉ�dÊ�dË�dÌ�dÍ�dÎ�dÏ�dÐ�dÑ�dÒ�dÓ�dÔ�dÕ�dÖ�d×�dØ�dÙ�dÚ�dÛ�dÜ�dÝ�dÞ�dß�dà�dá�dâ�dã�dä�då�dæ�dç�dè�dé�dê�dë�dì�dí�dî�dï�dð�dñ�dò�dó�dô�dõ�dö�d÷�dø�dù�dú�dû�dü�dý�dþ�dÿ�d �d�d�d�d�d�d�d�d�d	�d
�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d �d!�d"�d#�d$�d%�d&�d'�d(�d)�d*�d+�d,�d-�d.�d/�d0�d1�d2�d3�d4�d5�d6�d7�d8�d9�d:�d;�d<�d=�d>�d?�d@�dA�dB�dC�dD�dE�dF�dG�dH�dI�dJ�dK�dL�dM�dN�dO�dP�dQ�dR�dS�dT�dU�dV�dW�dX�dY�dZ�d[�d\�d]�d^�d_�d`�da�db�dc�dd�de�df�dg�dh�di�dj�dk�dl�dm�dn�do�dp�dq�dr�ds�dt�du�dv�dw�dx�dy�dz�d{�d|�d}�d~�d�d€�d��d‚�dƒ�d„�d…�d†�d‡�dˆ�d‰�dŠ�d‹�dŒ�d��dŽ�d��d��d‘�d’�d“�d”�d•�d–�d—�d˜�d™�dš�d›�dœ�d��dž�dŸ�d �d¡�d¢�d£�d¤�d¥�d¦�d§�d¨�d©�dª�d«�d¬�d­�d®�d¯�d°�d±�d²�d³�d´�dµ�d¶�d·�d¸�d¹�dº�d»�d¼�d½�d¾�d¿�dÀ�dÁ�dÂ�dÃ�dÄ�dÅ�dÆ�dÇ�dÈ�dÉ�dÊ�dË�dÌ�dÍ�dÎ�dÏ�dÐ�dÑ�dÒ�dÓ�dÔ�dÕ�dÖ�d×�dØ�dÙ�dÚ�dÛ�dÜ�dÝ�dÞ�dß�dà�dá�dâ�dã�dä�då�dæ�dç�dè�dé�dê�dë�dì�dí�dî�dï�dð�dñ�dò�dó�dô�dõ�dö�d÷�dø�dù�dú�dû�dü�dý�dþ�dÿ�d �d�d�d�d�d�d�d�d�d	�d
�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d �d!�d"�d#�d$�d%�d&�d'�d(�d)�d*�d+�d,�d-�d.�d/�d0�d1�d2�d3�d4�d5�d6�d7�d8�d9�d:�d;�d<�d=�d>�d?�d@�dA�dB�dC�dD�dE�dF�dG�dH�dI�dJ�dK�dL�dM�dN�dO�dP�dQ�dR�dS�dT�dU�dV�dW�dX�dY�dZ�d[�d\�d]�d^�d_�d`�da�db�dc�dd�de�df�dg�dh�di�dj�dk�dl�dm�dn�do�dp�dq�dr�ds�dt�du�dv�dw�dx�dy�dz�d{�d|�d}�d~�d�d€�d��d‚�dƒ�d„�d…�d†�d‡�dˆ�d‰�dŠ�d‹�dŒ�d��dŽ�d��d��d‘�d’�d“�d”�d•�d–�d—�d˜�d™�dš�d›�dœ�d��dž�dŸ�d �d¡�d¢�d£�d¤�d¥�d¦�d§�d¨�d©�dª�d«�d¬�d­�d®�d¯�d°�d±�d²�d³�d´�dµ�d¶�d·�d¸�d¹�dº�d»�d¼�d½�d¾�d¿�dÀ�dÁ�dÂ�dÃ�dÄ�dÅ�dÆ�dÇ�dÈ�dÉ�dÊ�dË�dÌ�dÍ�dÎ�dÏ�dÐ�dÑ�dÒ�dÓ�dÔ�dÕ�dÖ�d×�dØ�dÙ�dÚ�dÛ�dÜ�dÝ�dÞ�dß�dà�dá�dâ�dã�dä�då�dæ�dç�dè�dé�dê�dë�dì�dí�dî�dï�dð�dñ�dò�dó�dô�dõ�död±e5 �d÷d³e5 �dødµe5 �dùd·e5 �dúd¹e5 �dûd»e5 �düd½e5 �dý�dþe5 �dÿd¿e5 �d dÁe5 �ddÃe5 �ddÅe5 �ddÇe5 �ddÉe5 �ddÑe5 �ddÕe5 �d�de5 �d	�d
e5 �d�de5 �d�de5 �d�de5 �d�de5 �d�de5 �d�de5 �d�de5 �d�de5 �d�de5 �d�de5 �d�d e5 �d!�d"e5 �d#�d$e5 �d%�d&e5 �d'�d(e5 �d)�d*e5 �d+�d,e5 �d-�d.e5 �d/�d0e5 �d1�d2e5 �d3�d4e5 �d5�d6e5 �d7�d8e5 �d9�d:e5 �d;d×e5 �d<dÛe5 �d=dÝe5 �d>dße5 �d?dáe5 �d@dãe5 �dAdåe5 �dBdçe5 �dCdée5 �dDdëe5 �dEdíe5 �dFdïe5 �dGdñe5 �dHdóe5 �dIdõe5 �dJd÷e5 �dKdùe5 �dLdûe5 �dMdýe5 �dNdÿe5 �dO�de5 �dP�de5 �dQ�de5 �dR�d	e5 �dS�de5 �dT�de5 �dU�de5 �dV�de5 �dW�de5 �dX�de5 �dY�de5 �dZ�de5 �d[�d'e5 �d\�d)e5 �d]�d?e5 �d^�dAe5 �d_�dCe5 �d`�dEe5 �da�dGe5 �db�dIe5 �dc�dKe5 �dd�dMe5 �de�dOe5 �df�dQe5 �dg�d]e5 �dh�d_e5 �di�dae5 �dj�dce5 �dk�dee5 �dl�dge5 �dm�die5 �dn�dke5 �do�dme5 �dp�doe5 �dq�dqe5 �dr�dse5 �ds�due5 �dt�dwe5 �du�dye5 �dv�d{e5 �dw�d�e5 �dx�d‘e5 �dy�d“e5 �dz�d•e5 �d{�d—e5 �d|�d™e5 �d}�d›e5 �d~�d�e5 �d�dŸe5 �d€�d¡e5 �d��d£e5 �d‚�d¥e5 �dƒ�d§e5 �d„�d©e5 �d…�d«e5 �d†�d­e5 �d‡�d¯e5 �dˆ�d·e5 �d‰�d¹e5 �dŠ�d»e5 �d‹�d½e5 �dŒ�d¿e5 �d��dÁe5 �dŽ�dÃe5 �d��dÅe5 �d��dÇe5 �d‘�dÉe5 �d’�dËe5 �d“�dÍe5 �d”�dÏe5 �d•�dÑe5 �d–�dÓe5 �d—�dÕe5 �d˜�dße5 �d™�dóe5 �dš�dõe5 �d›�d÷e5 �dœ�dùe5 �d��dûe5 �dž�dýe5 �dŸ�dÿe5 �d �de5 �d¡�de5 �d¢�de5 �d£�de5 �d¤�d	e5 �d¥�de5 �d¦�de5 �d§�de5 �d¨�de5 �d©�de5 �dª�de5 �d«�de5 �d¬�d!e5 �d­�d#e5 �d®�d%e5 �d¯�d'e5 �d°�d)e5 �d±�d+e5 �d²�d-e5 �d³�d/e5 �d´�d1e5 �dµ�d3e5 �d¶�d5e5 �d·�d7e5 �d¸�d9e5 �d¹�d;e5 �dº�d=e5 �d»�d?e5 �d¼�dAe5 �d½�dWe5 �d¾�dYe5 �d¿�d[e5 �dÀ�d]e5 �dÁ�d_e5 �dÂ�dae5 �dÃ�dce5 �dÄ�dee5 �dÅ�dge5 �dÆ�die5 �dÇ�dke5 �dÈ�dme5 �dÉ�doe5 �dÊ�dqe5 �dË�dse5 �dÌ�due5 �dÍ�dwe5 �dÎ�dye5 �dÏ�d{e5 �dÐ�d}e5 �dÑ�de5 �dÒ�d�e5 �dÓ�dƒe5 �dÔ�d…e5 �dÕ�d‡e5 �dÖ�d‰e5 �d×�d‹e5 �dØ�d�e5 �dÙ�d�e5 �dÚ�d‘e5 �dÛ�d“e5 �dÜ�d•e5 �dÝ�d—e5 �dÞ�d™e5 �dß�d›e5 �dà�d�e5 �dá�dŸe5 �dâ�d¡e5 �dã�d£e5 �dä�d¥e5 �då�d§e5 �dæ�d©e5 �dç�d«e5 �dè�d­e5 �dé�d¯e5 �dê�d±e5 �dë�d³e5 �dì�dµe5 �dí�d·e5 �dî�d¹e5 �dï�d»e5 �dð�d½e5 �dñ�d¿e5 �dò�dÁe5 �dó�dÃe5 �dô�dÅe5 �dõ�dÇe5 �dö�dÉe5 �d÷�dËe5 �dø�dÍe5 �dù�dÏe5 �dú�dÑe5 �dû�dÓe5 �dü�dÕe5 �dý�d×e5 �dþ�dÙe5 �dÿ�dÛe5 �d �dÝe5 �d�dße5 �d�dáe5 �d�dãe5 �d�dåe5 �d�dçe5 �d�dée5 �d�dëe5 �d�díe5 �d	�dïe5 �d
�dñe5 �d�dóe5 �d�dõe5 �d�d÷e5 �d�dùe5 �d�dûe5 �d�dýe5 �d�dÿe5 �d�de5 �d�de5 �d�de5 �d�de5 �d�d	e5 �d�de5 �d�de5 �d�de5 �d�de5 �d�de5 �d�de5 �d�de5 �d�de5 �d�de5 �d �de5 �d!�de5 �d"�d!e5 �d#�d#e5 �d$�d%e5 �d%�d'e5 �d&�d)e5 �d'�d+e5 �d(�d-e5 dÐ�d/e5 �d)�d1e5 �d*�d3e5 �d+�d5e5 �d,�d7e5 �d-�d9e5 �d.�d;e5 �d/�d=e5 �d0�d?e5 �d1�dAe5 �d2�dCe5 �d3�dEe5 �d4�dGe5 �d5�dIe5 �d6�dKe5 �d7�dMe5 �d8�dOe5 �d9�dQe5 �d:�dSe5 �d;�dUe5 �d<�dWe5 �d=�dYe5 �d>�d[e5 �d?�d]e5 �d@�d_e5 �dA�dae5 �dB�dce5 �dC�dee5 �dD�dge5 �dE�die5 �dF�dke5 �dG�dme5 �dH�doe5 �dI�dqe5 �dJ�dse5 �dK�due5 �dL�dwe5 �dM�dye5 �dN�d{e5 �dO�d}e5 �dP�de5 �dQ�d�e5 �dR�dƒe5 �dS�d…e5 �dT�i1Z6�dU�dV�dW�dX�dY�dZœZ7d$d$d$dddd d$dd d d$dd d$d d d$d$d$d$d$d$d$d;d;ddd"d dd$dd d ddd$d$d$dd$d$dd$dd'd'd d ddd;d;d$d"d"d"d"d"d"d"d"d"d"�d[œAZ8G �d\�d]„ �d]eƒZ9G �d^�d_„ �d_eeƒZ:G �d`�da„ �daee:ƒZ;G �db�dc„ �dcee:ƒZ<d$eegfde d'ed)ed+ed-ed1ed3ed5ed9ed;e9d=e9d?edEe�ddgfdGe�ddgfdQe.dSe.dUedWedYed[e!d]ed_edae dcedeedgediedwe�de�df�dg�dh�di�dj�dkœgfdyed{ed}eded‰e d‹ed�ed�ed‘ed“ed•e�dl�dm�dnœgfd—e.d™e.dÛedÝe.�de<�de<�de<�ddgf�d	e<�ddgf�de<�do�ddgf�de<�do�ddgf�de<g �dp¢f�de<g �dp¢f�de;�do�ddgf�de;�do�ddgf�de<�ddgf�de;�ddgf�de;�do�ddgf�d}e�de.�d™e�d›e�dÛe;�ddgf�dße;�dáe;�dçe;�dée;�dïe<�do�ddgf�dñe<�ddgf�dóe<g �dp¢f�dõe<�do�ddgf�d÷e<�ddgf�dùe<g �dp¢f�de;�d	e.�de.�d[e<�d]e<�ddgf�d_e<�do�ddgf�dae<g �dp¢f�d±e�d³e�dµe�dÏe�dÑe�dÓe.�dÕe.�dýe�dÿe.�de�de�d7e�d£e�d¥e�díe�dïe�d e5 e�d$e5 edõe5 edùe5 e�d™e5 e�dïe5 e.�dñe5 e.�d…e5 eigZ=G �dq�dr„ �dre#ƒZ>G �ds�dt„ �dte#ƒZ?G �du�dv„ �dve#ƒZ@G �dw�dx„ �dxe#ƒZAG �dy�dz„ �dze#ƒZBG �d{�d|„ �d|eƒZC�d}�d~„ ZD�d™�d�d€„ZEG �d��d‚„ �d‚e#ƒZFG �dƒ�d„„ �d„e#ƒZG�d…�d†„ ZH�dš�d‡�dˆ„ZI�d‰�dŠ„ ZJG �d‹�dŒ„ �dŒe)ƒZKG �d��dŽ„ �dŽeFƒZLG �d��d�„ �d�eFƒZMG �d‘�d’„ �d’e#ƒZNG �d“�d”„ �d”e#ƒZOG �d•�d–„ �d–e#ƒZPG �d—�d˜„ �d˜ePƒZQe$e/e>d-d� e$e>eGƒ e$eGeGƒ e$ePeGƒ e$eBeGƒ e$e/e?d/d� e$e?eGƒ dS (›  a=  
Cisco NetFlow protocol v1, v5, v9 and v10 (IPFix)

HowTo dissect NetflowV9/10 (IPFix) packets

# From a pcap / list of packets

Using sniff and sessions::

    >>> sniff(offline=open("my_great_pcap.pcap", "rb"), session=NetflowSession)

Using the netflowv9_defragment/ipfix_defragment commands:

- get a list of packets containing NetflowV9/10 packets
- call `netflowv9_defragment(plist)` to defragment the list

(ipfix_defragment is an alias for netflowv9_defragment)

# Live / on-the-flow / other: use NetflowSession::

    >>> sniff(session=NetflowSession, prn=[...])

é    N)Úconf)Ú	IP_PROTOS)ÚwarningÚScapy_Exception)ÚBitEnumFieldÚBitFieldÚByteEnumFieldÚ	ByteFieldÚConditionalFieldÚFieldÚFieldLenFieldÚ
FlagsFieldÚIPFieldÚIntFieldÚ	LongFieldÚMACFieldÚPacketListFieldÚSecondsIntFieldÚShortEnumFieldÚ
ShortFieldÚStrFieldÚStrFixedLenFieldÚStrLenFieldÚThreeBytesFieldÚUTCTimeFieldÚ
XByteFieldÚXShortField)ÚPacketÚbind_layersÚbind_bottom_up)Ú
PacketList)Ú	IPSessionÚDefaultSession)ÚUDP)ÚIP6Fieldc                   @   s   e Zd ZdZeddƒgZdS )ÚNetflowHeaderzNetflow HeaderÚversioné   N)Ú__name__Ú
__module__Ú__qualname__Únamer   Úfields_desc© r-   r-   úK/var/www/html/gsl.tools/lib/python3.9/site-packages/scapy/layers/netflow.pyr%   H   s   r%   )é  i  i'  i'  iÇ  )Údport)Úsportr/   )r0   r1   c                   @   s@   e Zd ZdZeddƒeddƒeddƒedddd	�gZd
d„ ZdS )ÚNetflowHeaderV1zNetflow Header v1ÚcountNÚ	sysUptimer   ÚunixSecsÚunixNanoSecondsT©Zuse_nanoc                 C   s:   | j d u r2t|  ¡ ƒd }t d|¡|dd …  }|| S ©Nr'   ú!Hé   ©r3   ÚlenÚlayersÚstructÚpack©ÚselfÚpktÚpayr3   r-   r-   r.   Ú
post_build_   s    
zNetflowHeaderV1.post_build©	r(   r)   r*   r+   r   r   r   r,   rD   r-   r-   r-   r.   r2   X   s   ýr2   c                   @   s”   e Zd ZdZeddƒeddƒeddƒeddƒeddƒed	dƒed
dƒeddƒeddƒeddƒeddƒeddƒeddƒeddƒeddƒeddƒgZdS )ÚNetflowRecordV1zNetflow Record v1Zipsrcú0.0.0.0ZipdstÚnexthopZinputIfIndexr   ZoutpuIfIndexÚdpktsZdbytesZ	starttimeÚendtimeÚsrcportÚdstportÚpaddingÚprotoÚtosZpadding1Zpadding2N)	r(   r)   r*   r+   r   r   r   r	   r,   r-   r-   r-   r.   rF   f   s$   ñrF   r'   )r&   c                
   @   s`   e Zd ZdZeddƒeddƒeddƒedddd	�ed
dƒeddƒeddƒeddƒgZdd„ Z	dS )ÚNetflowHeaderV5zNetflow Header v5r3   Nr4   r   r5   r6   Tr7   ÚflowSequenceZ
engineTypeZengineIDZsamplingIntervalc                 C   s:   | j d u r2t|  ¡ ƒd }t d|¡|dd …  }|| S r8   r;   r@   r-   r-   r.   rD   �   s    
zNetflowHeaderV5.post_build)
r(   r)   r*   r+   r   r   r   r	   r,   rD   r-   r-   r-   r.   rP   „   s   ù	rP   c                   @   s¼   e Zd ZdZeddƒeddƒeddƒeddƒed	dƒed
dƒeddƒeddƒeddƒeddƒeddƒeddƒeddddƒe	de
jeƒeddƒeddƒeddƒeddƒeddƒeddƒgZdS )ÚNetflowRecordV5zNetflow Record v5Úsrcz	127.0.0.1ÚdstrH   rG   Úinputr   ÚoutputrI   r'   ZdOctetsé<   ÚfirstÚlastrK   rL   Zpad1ZtcpFlagsr:   é   ZFSRPAUECZprotrO   Zsrc_asZdst_asZsrc_maskZdst_maskZpad2N)r(   r)   r*   r+   r   r   r   r	   r   r   ÚsocketÚIPPROTO_TCPr   r,   r-   r-   r-   r.   rR   –   s,   írR   é   i€à  ZIN_BYTESr:   ZIN_PKTSé   ZFLOWSé   ZPROTOCOLZTOSé   Z	TCP_FLAGSé   ZL4_SRC_PORTrZ   ZIPV4_SRC_ADDRé	   ZSRC_MASKé
   Z
INPUT_SNMPé   ZL4_DST_PORTé   ZIPV4_DST_ADDRé   ZDST_MASKé   ZOUTPUT_SNMPé   ZIPV4_NEXT_HOPé   ZSRC_ASé   ZDST_ASé   ZBGP_IPV4_NEXT_HOPé   ZMUL_DST_PKTSé   ZMUL_DST_BYTESé   ZLAST_SWITCHEDé   ZFIRST_SWITCHEDé   Z	OUT_BYTESé   ZOUT_PKTSé   ZIP_LENGTH_MINIMUMé   ZIP_LENGTH_MAXIMUMé   ZIPV6_SRC_ADDRé   ZIPV6_DST_ADDRé   ZIPV6_SRC_MASKé   ZIPV6_DST_MASKé   ZIPV6_FLOW_LABELé    Z	ICMP_TYPEé!   ZMUL_IGMP_TYPEé"   ZSAMPLING_INTERVALé#   ZSAMPLING_ALGORITHMé$   ZFLOW_ACTIVE_TIMEOUTé%   ZFLOW_INACTIVE_TIMEOUTé&   ZENGINE_TYPEé'   Z	ENGINE_IDé(   ZTOTAL_BYTES_EXPé)   ZTOTAL_PKTS_EXPé*   ZTOTAL_FLOWS_EXPé+   ZIPV4_ROUTER_SCé,   ZIP_SRC_PREFIXé-   ZIP_DST_PREFIXé.   ZMPLS_TOP_LABEL_TYPEé/   ZMPLS_TOP_LABEL_IP_ADDRé0   ZFLOW_SAMPLER_IDé1   ZFLOW_SAMPLER_MODEé2   ZFLOW_SAMPLER_RANDOM_INTERVALé3   Z
FLOW_CLASSé4   zIP TTL MINIMUMé5   zIP TTL MAXIMUMé6   zIPv4 IDé7   ZDST_TOSé8   ZSRC_MACé9   ZDST_MACé:   ZSRC_VLANé;   ZDST_VLANrW   ZIP_PROTOCOL_VERSIONé=   Z	DIRECTIONé>   ZIPV6_NEXT_HOPé?   ZBGP_IPV6_NEXT_HOPé@   ZIPV6_OPTION_HEADERSéF   ZMPLS_LABEL_1éG   ZMPLS_LABEL_2éH   ZMPLS_LABEL_3éI   ZMPLS_LABEL_4éJ   ZMPLS_LABEL_5éK   ZMPLS_LABEL_6éL   ZMPLS_LABEL_7éM   ZMPLS_LABEL_8éN   ZMPLS_LABEL_9éO   ZMPLS_LABEL_10éP   ZDESTINATION_MACéQ   Z
SOURCE_MACéR   ZIF_NAMEéS   ZIF_DESCéT   ZSAMPLER_NAMEéU   ZBYTES_TOTALéV   ZPACKETS_TOTALéX   ZFRAGMENT_OFFSETéY   ZFORWARDING_STATUSéZ   ZVPN_ROUTE_DISTINGUISHERé[   ZmplsTopLabelPrefixLengthé\   ZSRC_TRAFFIC_INDEXé]   ZDST_TRAFFIC_INDEXé^   ZAPPLICATION_DESCé_   ZAPPLICATION_IDé`   ZAPPLICATION_NAMEéb   ZpostIpDiffServCodePointéc   ZmulticastReplicationFactorée   ZclassificationEngineIdé€   ZDST_AS_PEERé�   ZSRC_AS_PEERé‚   ZexporterIPv4Addresséƒ   ZexporterIPv6Addressé„   ZDROPPED_BYTESé…   ZDROPPED_PACKETSé†   ZDROPPED_BYTES_TOTALé‡   ZDROPPED_PACKETS_TOTALéˆ   ZflowEndReasoné‰   ZcommonPropertiesIdéŠ   ZobservationPointIdé‹   ZicmpTypeCodeIPv6éŒ   ZMPLS_TOP_LABEL_IPv6_ADDRESSé�   Z
lineCardIdéŽ   ZportIdé�   ZmeteringProcessIdé�   ZFLOW_EXPORTERé‘   Z
templateIdé’   ZwlanChannelIdé“   ZwlanSSIDé”   ZflowIdé•   ZobservationDomainIdé–   ZflowStartSecondsé—   ZflowEndSecondsé˜   ZflowStartMillisecondsé™   ZflowEndMillisecondséš   ZflowStartMicrosecondsé›   ZflowEndMicrosecondséœ   ZflowStartNanosecondsé�   ZflowEndNanosecondséž   ZflowStartDeltaMicrosecondséŸ   ZflowEndDeltaMicrosecondsé    ZsystemInitTimeMillisecondsé¡   ZflowDurationMillisecondsé¢   ZflowDurationMicrosecondsé£   ZobservedFlowTotalCounté¤   ZignoredPacketTotalCounté¥   ZignoredOctetTotalCounté¦   ZnotSentFlowTotalCounté§   ZnotSentPacketTotalCounté¨   ZnotSentOctetTotalCounté©   ZdestinationIPv6Prefixéª   ZsourceIPv6Prefixé«   ZpostOctetTotalCounté¬   ZpostPacketTotalCounté­   ZflowKeyIndicatoré®   ZpostMCastPacketTotalCounté¯   ZpostMCastOctetTotalCounté°   ZICMP_IPv4_TYPEé±   ZICMP_IPv4_CODEé²   ZICMP_IPv6_TYPEé³   ZICMP_IPv6_CODEé´   ZUDP_SRC_PORTéµ   ZUDP_DST_PORTé¶   ZTCP_SRC_PORTé·   ZTCP_DST_PORTé¸   ZTCP_SEQ_NUMé¹   ZTCP_ACK_NUMéº   ZTCP_WINDOW_SIZEé»   ZTCP_URGENT_PTRé¼   ZTCP_HEADER_LENé½   ZIP_HEADER_LENé¾   ZIP_TOTAL_LENé¿   ZpayloadLengthIPv6éÀ   ÚIP_TTLéÁ   ZnextHeaderIPv6éÂ   ZmplsPayloadLengthéÃ   ZIP_DSCPéÄ   ZIP_PRECEDENCEéÅ   ZIP_FRAGMENT_FLAGSéÆ   ZDELTA_BYTES_SQUAREDéÇ   ZTOTAL_BYTES_SQUAREDéÈ   ZMPLS_TOP_LABEL_TTLéÉ   ZMPLS_LABEL_STACK_OCTETSéÊ   ZMPLS_LABEL_STACK_DEPTHéË   ZMPLS_TOP_LABEL_EXPéÌ   ZIP_PAYLOAD_LENGTHéÍ   Z
UDP_LENGTHéÎ   ZIS_MULTICASTéÏ   ZIP_HEADER_WORDSéÐ   ZIP_OPTION_MAPéÑ   ZTCP_OPTION_MAPéÒ   ZpaddingOctetséÓ   ZcollectorIPv4AddresséÔ   ZcollectorIPv6AddresséÕ   ZcollectorInterfaceéÖ   ZcollectorProtocolVersioné×   ZcollectorTransportProtocoléØ   ZcollectorTransportPortéÙ   ZexporterTransportPortéÚ   ZtcpSynTotalCountéÛ   ZtcpFinTotalCountéÜ   ZtcpRstTotalCountéÝ   ZtcpPshTotalCountéÞ   ZtcpAckTotalCountéß   ZtcpUrgTotalCountéà   ZipTotalLengthéá   ZpostNATSourceIPv4Addresséâ   ZpostNATDestinationIPv4Addresséã   ZpostNAPTSourceTransportPortéä   Z postNAPTDestinationTransportPortéå   ZnatOriginatingAddressRealméæ   ZnatEventéç   ZinitiatorOctetséè   ZresponderOctetséé   ZfirewallEventéê   ZingressVRFIDéë   ZegressVRFIDéì   ZVRFnameéí   ZpostMplsTopLabelExpéî   ZtcpWindowScaleéï   ZbiflowDirectionéð   ZethernetHeaderLengthéñ   ZethernetPayloadLengthéò   ZethernetTotalLengthéó   Zdot1qVlanIdéô   Zdot1qPriorityéõ   Zdot1qCustomerVlanIdéö   Zdot1qCustomerPriorityé÷   Z
metroEvcIdéø   ZmetroEvcTypeéù   ZpseudoWireIdéú   ZpseudoWireTypeéû   ZpseudoWireControlWordéü   ZingressPhysicalInterfaceéý   ZegressPhysicalInterfaceéþ   ZpostDot1qVlanIdéÿ   ZpostDot1qCustomerVlanIdé   ZethernetTypei  ZpostIpPrecedencei  ZcollectionTimeMillisecondsi  ZexportSctpStreamIdi  ZmaxExportSecondsi  ZmaxFlowEndSecondsi  ZmessageMD5Checksumi  ZmessageScopei  ZminExportSecondsi	  ZminFlowStartSecondsi
  ZopaqueOctetsi  ZsessionScopei  ZmaxFlowEndMicrosecondsi  ZmaxFlowEndMillisecondsi  ZmaxFlowEndNanosecondsi  ZminFlowStartMicrosecondsi  ZminFlowStartMillisecondsi  ZminFlowStartNanosecondsi  ZcollectorCertificatei  ZexporterCertificatei  ZdataRecordsReliabilityi  ZobservationPointTypei  ZnewConnectionDeltaCounti  ZconnectionSumDurationSecondsi  ZconnectionTransactionIdi  ZpostNATSourceIPv6Addressi  ZpostNATDestinationIPv6Addressi  Z	natPoolIdi  ZnatPoolNamei  ZanonymizationFlagsi  ZanonymizationTechniquei  ZinformationElementIndexi   Zp2pTechnologyi!  ZtunnelTechnologyi"  ZencryptedTechnologyi#  Z	basicListi$  ZsubTemplateListi%  ZsubTemplateMultiListi&  ZbgpValidityStatei'  ZIPSecSPIi(  ZgreKeyi)  ZnatTypei*  ZinitiatorPacketsi+  ZresponderPacketsi,  ZobservationDomainNamei-  ZselectionSequenceIdi.  Z
selectorIdi/  ZinformationElementIdi0  ZselectorAlgorithmi1  ZsamplingPacketIntervali2  ZsamplingPacketSpacei3  ZsamplingTimeIntervali4  ZsamplingTimeSpacei5  ZsamplingSizei6  ZsamplingPopulationi7  ZsamplingProbabilityi8  ZdataLinkFrameSizei9  zIP_SECTION HEADERi:  zIP_SECTION PAYLOADi;  ZdataLinkFrameSectioni<  ZmplsLabelStackSectioni=  ZmplsPayloadPacketSectioni>  ZselectorIdTotalPktsObservedi?  ZselectorIdTotalPktsSelectedi@  ZabsoluteErroriA  ZrelativeErroriB  ZobservationTimeSecondsiC  ZobservationTimeMillisecondsiD  ZobservationTimeMicrosecondsiE  ZobservationTimeNanosecondsiF  ZdigestHashValueiG  ZhashIPPayloadOffsetiH  ZhashIPPayloadSizeiI  ZhashOutputRangeMiniJ  ZhashOutputRangeMaxiK  ZhashSelectedRangeMiniL  ZhashSelectedRangeMaxiM  ZhashDigestOutputiN  ZhashInitialiserValueiO  ZselectorNameiP  ZupperCILimitiQ  ZlowerCILimitiR  ZconfidenceLeveliS  ZinformationElementDataTypeiT  ZinformationElementDescriptioniU  ZinformationElementNameiV  ZinformationElementRangeBeginiW  ZinformationElementRangeEndiX  ZinformationElementSemanticsiY  ZinformationElementUnitsiZ  ZprivateEnterpriseNumberi[  ZvirtualStationInterfaceIdi\  ZvirtualStationInterfaceNamei]  ZvirtualStationUUIDi^  ZvirtualStationNamei_  Zlayer2SegmentIdi`  Zlayer2OctetDeltaCountia  Zlayer2OctetTotalCountib  ZingressUnicastPacketTotalCountic  Z ingressMulticastPacketTotalCountid  Z ingressBroadcastPacketTotalCountie  ZegressUnicastPacketTotalCountif  ZegressBroadcastPacketTotalCountig  Z#monitoringIntervalStartMilliSecondsih  Z!monitoringIntervalEndMilliSecondsii  ZportRangeStartij  ZportRangeEndik  ZportRangeStepSizeil  ZportRangeNumPortsim  ZstaMacAddressin  ZstaIPv4Addressio  ZwtpMacAddressip  ZingressInterfaceTypeiq  ZegressInterfaceTypeir  ZrtpSequenceNumberis  ZuserNameit  ZapplicationCategoryNameiu  ZapplicationSubCategoryNameiv  ZapplicationGroupNameiw  ZoriginalFlowsPresentix  ZoriginalFlowsInitiatediy  ZoriginalFlowsCompletediz  ZdistinctCountOfSourceIPAddressi{  Z#distinctCountOfDestinationIPAddressi|  Z distinctCountOfSourceIPv4Addressi}  Z%distinctCountOfDestinationIPv4Addressi~  Z distinctCountOfSourceIPv6Addressi  Z%distinctCountOfDestinationIPv6Addressi€  ZvalueDistributionMethodi�  Zrfc3550JitterMillisecondsi‚  Zrfc3550JitterMicrosecondsiƒ  Zrfc3550JitterNanosecondsi„  Zdot1qDEIi…  Zdot1qCustomerDEIi†  ZflowSelectorAlgorithmi‡  ZflowSelectedOctetDeltaCountiˆ  ZflowSelectedPacketDeltaCounti‰  ZflowSelectedFlowDeltaCountiŠ  ZselectorIDTotalFlowsObservedi‹  ZselectorIDTotalFlowsSelectediŒ  ZsamplingFlowIntervali�  ZsamplingFlowSpacingiŽ  ZflowSamplingTimeIntervali�  ZflowSamplingTimeSpacingi�  ZhashFlowDomaini‘  ZtransportOctetDeltaCounti’  ZtransportPacketDeltaCounti“  ZoriginalExporterIPv4Addressi”  ZoriginalExporterIPv6Addressi•  ZoriginalObservationDomainIdi–  ZintermediateProcessIdi—  ZignoredDataRecordTotalCounti˜  ZdataLinkFrameTypei™  ZsectionOffsetiš  ZsectionExportedOctetsi›  Zdot1qServiceInstanceTagiœ  Zdot1qServiceInstanceIdi�  Zdot1qServiceInstancePriorityiž  Zdot1qCustomerSourceMacAddressiŸ  Z"dot1qCustomerDestinationMacAddressi   z)deprecated [dup of layer2OctetDeltaCount]i¡  ZpostLayer2OctetDeltaCounti¢  ZpostMCastLayer2OctetDeltaCounti£  z(deprecated [dup of layer2OctetTotalCounti¤  ZpostLayer2OctetTotalCounti¥  ZpostMCastLayer2OctetTotalCounti¦  ZminimumLayer2TotalLengthi§  ZmaximumLayer2TotalLengthi¨  ZdroppedLayer2OctetDeltaCounti©  ZdroppedLayer2OctetTotalCountiª  ZignoredLayer2OctetTotalCounti«  ZnotSentLayer2OctetTotalCounti¬  Zlayer2OctetDeltaSumOfSquaresi­  Zlayer2OctetTotalSumOfSquaresi®  Zlayer2FrameDeltaCounti¯  Zlayer2FrameTotalCounti°  Z pseudoWireDestinationIPv4Addressi±  ZignoredLayer2FrameTotalCounti²  ZmibObjectValueIntegeri³  ZmibObjectValueOctetStringi´  ZmibObjectValueOIDiµ  ZmibObjectValueBitsi¶  ZmibObjectValueIPAddressi·  ZmibObjectValueCounteri¸  ZmibObjectValueGaugei¹  ZmibObjectValueTimeTicksiº  ZmibObjectValueUnsignedi»  ZmibObjectValueTablei¼  ZmibObjectValueRowi½  ZmibObjectIdentifieri¾  ZmibSubIdentifieri¿  ZmibIndexIndicatoriÀ  ZmibCaptureTimeSemanticsiÁ  ZmibContextEngineIDiÂ  ZmibContextNameiÃ  ZmibObjectNameiÄ  ZmibObjectDescriptioniÅ  ZmibObjectSyntaxiÆ  ZmibModuleNameiÇ  Z
mobileIMSIiÈ  ZmobileMSISDNiÉ  ZhttpStatusCodeiÊ  ZsourceTransportPortsLimitiË  ZhttpRequestMethodiÌ  ZhttpRequestHostiÍ  ZhttpRequestTargetiÎ  ZhttpMessageVersioniÏ  ZnatInstanceIDiÐ  ZinternalAddressRealmiÑ  ZexternalAddressRealmiÒ  ZnatQuotaExceededEventiÓ  ZnatThresholdEventiÔ  ZhttpUserAgentiÕ  ZhttpContentTypeiÖ  ZhttpReasonPhrasei×  ZmaxSessionEntriesiØ  ZmaxBIBEntriesiÙ  ZmaxEntriesPerUseriÚ  ZmaxSubscribersiÛ  ZmaxFragmentsPendingReassemblyiÜ  ZaddressPoolHighThresholdiÝ  ZaddressPoolLowThresholdiÞ  ZaddressPortMappingHighThresholdiß  ZaddressPortMappingLowThresholdià  Z&addressPortMappingPerUserHighThresholdiá  Z!globalAddressMappingHighThresholdi4`  ZNAT_LOG_FIELD_IDX_CONTEXT_IDi5`  ZNAT_LOG_FIELD_IDX_CONTEXT_NAMEi6`  ZNAT_LOG_FIELD_IDX_ASSIGN_TS_SECi7`  Z!NAT_LOG_FIELD_IDX_UNASSIGN_TS_SECi8`  ZNAT_LOG_FIELD_IDX_IPV4_INT_ADDRi9`  ZNAT_LOG_FIELD_IDX_IPV4_EXT_ADDRi:`  Z NAT_LOG_FIELD_IDX_EXT_PORT_FIRSTi;`  ZNAT_LOG_FIELD_IDX_EXT_PORT_LASTiè€  ZINGRESS_ACL_IDié€  ZEGRESS_ACL_IDiê€  ZFW_EXT_EVENTiÐ„  ZSGT_SOURCE_TAGiÑ„  ZSGT_DESTINATION_TAGiÒ„  ZSGT_SOURCE_NAMEiÓ„  ZSGT_DESTINATION_NAMEiˆ�  ZPACKETS_DROPPEDi‹�  Z	BYTE_RATEiŒ�  ZAPPLICATION_MEDIA_BYTESiŽ�  ZAPPLICATION_MEDIA_BYTE_RATEi��  ZAPPLICATION_MEDIA_PACKETSi‘�  ZAPPLICATION_MEDIA_PACKET_RATEi“�  ZAPPLICATION_MEDIA_EVENTi”�  ZMONITOR_EVENTi•�  ZTIMESTAMP_INTERVALi–�  ZTRANSPORT_PACKETS_EXPECTEDi˜�  ZTRANSPORT_ROUND_TRIP_TIMEi™�  ZTRANSPORT_EVENT_PACKET_LOSSi›�  ZTRANSPORT_PACKETS_LOSTi��  ZTRANSPORT_PACKETS_LOST_RATEiž�  ZTRANSPORT_RTP_SSRCiŸ�  ZTRANSPORT_RTP_JITTER_MEANi �  ZTRANSPORT_RTP_JITTER_MINi¡�  ZTRANSPORT_RTP_JITTER_MAXi±�  ZTRANSPORT_RTP_PAYLOAD_TYPEiÏ�  ZTRANSPORT_BYTES_OUT_OF_ORDERiÒ�  ZTRANSPORT_PACKETS_OUT_OF_ORDERiÛ�  ZTRANSPORT_TCP_WINDOWS_SIZE_MINiÜ�  ZTRANSPORT_TCP_WINDOWS_SIZE_MAXiÝ�  ZTRANSPORT_TCP_WINDOWS_SIZE_MEANiÞ�  Z"TRANSPORT_TCP_MAXIMUM_SEGMENT_SIZEi@œ  ZAAA_USERNAMEiAœ  ZXLATE_SRC_ADDR_IPV4iBœ  ZXLATE_DST_ADDR_IPV4iCœ  ZXLATE_SRC_PORTiDœ  ZXLATE_DST_PORTiEœ  ZFW_EVENTZSRC_FRAGMENTSZDST_FRAGMENTSZSRC_TO_DST_MAX_THROUGHPUTZSRC_TO_DST_MIN_THROUGHPUTZSRC_TO_DST_AVG_THROUGHPUTZSRC_TO_SRC_MAX_THROUGHPUTZSRC_TO_SRC_MIN_THROUGHPUTéW   ZSRC_TO_SRC_AVG_THROUGHPUTZNUM_PKTS_UP_TO_128_BYTESZNUM_PKTS_128_TO_256_BYTESZNUM_PKTS_256_TO_512_BYTESZNUM_PKTS_512_TO_1024_BYTESZNUM_PKTS_1024_TO_1514_BYTESZNUM_PKTS_OVER_1514_BYTESZCUMULATIVE_ICMP_TYPEZSRC_IP_COUNTRYéf   ZSRC_IP_CITYég   ZDST_IP_COUNTRYéh   ZDST_IP_CITYéi   ZFLOW_PROTO_PORTéj   ZUPSTREAM_TUNNEL_IDék   ZLONGEST_FLOW_PKTél   ZSHORTEST_FLOW_PKTém   ZRETRANSMITTED_IN_PKTSén   ZRETRANSMITTED_OUT_PKTSéo   ZOOORDER_IN_PKTSép   ZOOORDER_OUT_PKTSéq   ZUNTUNNELED_PROTOCOLér   ZUNTUNNELED_IPV4_SRC_ADDRés   ZUNTUNNELED_L4_SRC_PORTét   ZUNTUNNELED_IPV4_DST_ADDRéu   ZUNTUNNELED_L4_DST_PORTév   ZL7_PROTOéw   ZL7_PROTO_NAMEéx   ZDOWNSTREAM_TUNNEL_IDéy   ZFLOW_USER_NAMEéz   ZFLOW_SERVER_NAMEé{   ZCLIENT_NW_LATENCY_MSé|   ZSERVER_NW_LATENCY_MSé}   ZAPPL_LATENCY_MSé~   ZPLUGIN_NAMEé   ZRETRANSMITTED_IN_BYTESZRETRANSMITTED_OUT_BYTESZSIP_CALL_IDZSIP_CALLING_PARTYZSIP_CALLED_PARTYZSIP_RTP_CODECSZSIP_INVITE_TIMEZSIP_TRYING_TIMEZSIP_RINGING_TIMEZSIP_INVITE_OK_TIMEZSIP_INVITE_FAILURE_TIMEZSIP_BYE_TIMEZSIP_BYE_OK_TIMEZSIP_CANCEL_TIMEZSIP_CANCEL_OK_TIMEZSIP_RTP_IPV4_SRC_ADDRZSIP_RTP_L4_SRC_PORTZSIP_RTP_IPV4_DST_ADDRZSIP_RTP_L4_DST_PORTZSIP_RESPONSE_CODEZSIP_REASON_CAUSEZRTP_FIRST_SEQZRTP_FIRST_TSZRTP_LAST_SEQZRTP_LAST_TSZRTP_IN_JITTERZRTP_OUT_JITTERZRTP_IN_PKT_LOSTZRTP_OUT_PKT_LOSTZRTP_OUT_PAYLOAD_TYPEZRTP_IN_MAX_DELTAZRTP_OUT_MAX_DELTAZRTP_IN_PAYLOAD_TYPEZSRC_PROC_PIDZSRC_PROC_NAMEZHTTP_URLZHTTP_RET_CODEZHTTP_REFERERZHTTP_UAZ	HTTP_MIMEZSMTP_MAIL_FROMZSMTP_RCPT_TOZ	HTTP_HOSTZSSL_SERVER_NAMEZBITTORRENT_HASHZMYSQL_SRV_VERSIONZMYSQL_USERNAMEZMYSQL_DBZMYSQL_QUERYZMYSQL_RESPONSEZORACLE_USERNAMEZORACLE_QUERYZORACLE_RSP_CODEZORACLE_RSP_STRINGZORACLE_QUERY_DURATIONZ	DNS_QUERYZDNS_QUERY_IDZDNS_QUERY_TYPEZDNS_RET_CODEZDNS_NUM_ANSWERSZPOP_USERZGTPV1_REQ_MSG_TYPEZGTPV1_RSP_MSG_TYPEZGTPV1_C2S_TEID_DATAZGTPV1_C2S_TEID_CTRLZGTPV1_S2C_TEID_DATAZGTPV1_S2C_TEID_CTRLZGTPV1_END_USER_IPZGTPV1_END_USER_IMSIZGTPV1_END_USER_MSISDNZGTPV1_END_USER_IMEIZGTPV1_APN_NAMEZGTPV1_RAI_MCCZGTPV1_RAI_MNCZGTPV1_ULI_CELL_LACZGTPV1_ULI_CELL_CIZGTPV1_ULI_SACZGTPV1_RAT_TYPEZRADIUS_REQ_MSG_TYPEZRADIUS_RSP_MSG_TYPEZRADIUS_USER_NAMEZRADIUS_CALLING_STATION_IDZRADIUS_CALLED_STATION_IDZRADIUS_NAS_IP_ADDRZRADIUS_NAS_IDENTIFIERZRADIUS_USER_IMSIZRADIUS_USER_IMEIZRADIUS_FRAMED_IP_ADDRZRADIUS_ACCT_SESSION_IDZRADIUS_ACCT_STATUS_TYPEZRADIUS_ACCT_IN_OCTETSZRADIUS_ACCT_OUT_OCTETSZRADIUS_ACCT_IN_PKTSZRADIUS_ACCT_OUT_PKTSZ
IMAP_LOGINZGTPV2_REQ_MSG_TYPEZGTPV2_RSP_MSG_TYPEZGTPV2_C2S_S1U_GTPU_TEIDZGTPV2_C2S_S1U_GTPU_IPZGTPV2_S2C_S1U_GTPU_TEIDZGTPV2_S2C_S1U_GTPU_IPZGTPV2_END_USER_IMSIZGTPV2_END_USER_MSISDNZGTPV2_APN_NAMEZGTPV2_ULI_MCCZGTPV2_ULI_MNCZGTPV2_ULI_CELL_TACZGTPV2_ULI_CELL_IDZGTPV2_RAT_TYPEZGTPV2_PDN_IPZGTPV2_END_USER_IMEIZSRC_AS_PATH_1ZSRC_AS_PATH_2ZSRC_AS_PATH_3ZSRC_AS_PATH_4ZSRC_AS_PATH_5ZSRC_AS_PATH_6ZSRC_AS_PATH_7ZSRC_AS_PATH_8ZSRC_AS_PATH_9ZSRC_AS_PATH_10ZDST_AS_PATH_1ZDST_AS_PATH_2ZDST_AS_PATH_3ZDST_AS_PATH_4ZDST_AS_PATH_5ZDST_AS_PATH_6ZDST_AS_PATH_7ZDST_AS_PATH_8ZDST_AS_PATH_9ZDST_AS_PATH_10ZMYSQL_APPL_LATENCY_USECZGTPV0_REQ_MSG_TYPEZGTPV0_RSP_MSG_TYPEZ	GTPV0_TIDZGTPV0_END_USER_IPZGTPV0_END_USER_MSISDNZGTPV0_APN_NAMEZGTPV0_RAI_MCCZGTPV0_RAI_MNCZGTPV0_RAI_CELL_LACZGTPV0_RAI_CELL_RACZGTPV0_RESPONSE_CAUSEZGTPV1_RESPONSE_CAUSEZGTPV2_RESPONSE_CAUSEZNUM_PKTS_TTL_5_32ZNUM_PKTS_TTL_32_64ZNUM_PKTS_TTL_64_96ZNUM_PKTS_TTL_96_128ZNUM_PKTS_TTL_128_160ZNUM_PKTS_TTL_160_192ZNUM_PKTS_TTL_192_224ZNUM_PKTS_TTL_224_255ZGTPV1_RAI_LACZGTPV1_RAI_RACZGTPV1_ULI_MCCZGTPV1_ULI_MNCZNUM_PKTS_TTL_2_5ZNUM_PKTS_TTL_EQ_1ZRTP_SIP_CALL_IDZIN_SRC_OSI_SAPZOUT_DST_OSI_SAPZWHOIS_DAS_DOMAINZDNS_TTL_ANSWERZDHCP_CLIENT_MACZDHCP_CLIENT_IPZDHCP_CLIENT_NAMEZ	FTP_LOGINZFTP_PASSWORDZFTP_COMMANDZFTP_COMMAND_RET_CODEZHTTP_METHODZ	HTTP_SITEZSIP_C_IPZSIP_CALL_STATEZEPP_REGISTRAR_NAMEZEPP_CMDZEPP_CMD_ARGSZEPP_RSP_CODEZEPP_REASON_STRZEPP_SERVER_NAMEZ
RTP_IN_MOSZRTP_IN_R_FACTORZSRC_PROC_USER_NAMEZSRC_FATHER_PROC_PIDZSRC_FATHER_PROC_NAMEZDST_PROC_PIDZDST_PROC_NAMEZDST_PROC_USER_NAMEZDST_FATHER_PROC_PIDZDST_FATHER_PROC_NAMEZRTP_RTTZRTP_IN_TRANSITZRTP_OUT_TRANSITZSRC_PROC_ACTUAL_MEMORYZSRC_PROC_PEAK_MEMORYZSRC_PROC_AVERAGE_CPU_LOADZSRC_PROC_NUM_PAGE_FAULTSZDST_PROC_ACTUAL_MEMORYZDST_PROC_PEAK_MEMORYZDST_PROC_AVERAGE_CPU_LOADZDST_PROC_NUM_PAGE_FAULTSZDURATION_INZDURATION_OUTZSRC_PROC_PCTG_IOWAITZDST_PROC_PCTG_IOWAITZRTP_DTMF_TONESZUNTUNNELED_IPV6_SRC_ADDRZUNTUNNELED_IPV6_DST_ADDRZDNS_RESPONSEZDIAMETER_REQ_MSG_TYPEZDIAMETER_RSP_MSG_TYPEZDIAMETER_REQ_ORIGIN_HOSTZDIAMETER_RSP_ORIGIN_HOSTZDIAMETER_REQ_USER_NAMEZDIAMETER_RSP_RESULT_CODEZDIAMETER_EXP_RES_VENDOR_IDZDIAMETER_EXP_RES_RESULT_CODEZS1AP_ENB_UE_S1AP_IDZS1AP_MME_UE_S1AP_IDZS1AP_MSG_EMM_TYPE_MME_TO_ENBZS1AP_MSG_ESM_TYPE_MME_TO_ENBZS1AP_MSG_EMM_TYPE_ENB_TO_MMEZS1AP_MSG_ESM_TYPE_ENB_TO_MMEZS1AP_CAUSE_ENB_TO_MMEZS1AP_DETAILED_CAUSE_ENB_TO_MMEZTCP_WIN_MIN_INZTCP_WIN_MAX_INZTCP_WIN_MSS_INZTCP_WIN_SCALE_INZTCP_WIN_MIN_OUTZTCP_WIN_MAX_OUTZTCP_WIN_MSS_OUTZTCP_WIN_SCALE_OUTZDHCP_REMOTE_IDZDHCP_SUBSCRIBER_IDZSRC_PROC_UIDZDST_PROC_UIDZ	USER_NAMEZDHCP_MESSAGE_TYPEZRTP_IN_PKT_DROPZRTP_OUT_PKT_DROPZRTP_OUT_MOSZRTP_OUT_R_FACTORZRTP_MOSZGTPV2_S5_S8_GTPC_TEIDZRTP_R_FACTORZRTP_SSRCZPAYLOAD_HASHZGTPV2_C2S_S5_S8_GTPU_TEIDZGTPV2_S2C_S5_S8_GTPU_TEIDZGTPV2_C2S_S5_S8_GTPU_IPZGTPV2_S2C_S5_S8_GTPU_IPZ
SRC_AS_MAPZ
DST_AS_MAPZDIAMETER_HOP_BY_HOP_IDZUPSTREAM_SESSION_IDZDOWNSTREAM_SESSION_IDZSRC_IP_LONGZ
SRC_IP_LATZDST_IP_LONGZ
DST_IP_LATZDIAMETER_CLR_CANCEL_TYPEZDIAMETER_CLR_FLAGSZGTPV2_C2S_S5_S8_GTPC_IPZGTPV2_S2C_S5_S8_GTPC_IPZGTPV2_C2S_S5_S8_SGW_GTPU_TEIDZGTPV2_S2C_S5_S8_SGW_GTPU_TEIDZGTPV2_C2S_S5_S8_SGW_GTPU_IPZGTPV2_S2C_S5_S8_SGW_GTPU_IPZHTTP_X_FORWARDED_FORZHTTP_VIAZ	SSDP_HOSTZSSDP_USNZNETBIOS_QUERY_NAMEZNETBIOS_QUERY_TYPEZNETBIOS_RESPONSEZNETBIOS_QUERY_OSZSSDP_SERVERZ	SSDP_TYPEZSSDP_METHODZNPROBE_IPV4_ADDRESSÚSystemZ	Interfacez	Line cardÚCacheÚTemplate)r'   r:   r^   r_   r]   )Ar'   r:   r^   r_   r]   r`   ra   rZ   rb   rc   rd   re   rf   rg   rh   ri   rj   rk   rl   rm   rn   ro   rp   rq   rt   ru   rv   rw   rx   ry   rz   r{   r|   r}   r~   r   r€   r�   r‚   rƒ   r‡   rˆ   r‰   rŠ   r‹   r�   r‘   r’   r“   r”   rW   r•   r–   r—   r˜   r™   rš   r›   rœ   r�   rž   rŸ   r    r¡   r¢   c                   @   s   e Zd Zdd„ ZdS )Ú
ShortOrIntc                 C   s0   t |ƒdkr"tj| | j| jdd� t | ||¡S )Nr:   r9   )Úfmt)r<   r   Ú__init__r+   ÚdefaultÚgetfield)rA   rB   Úxr-   r-   r.   rZ  L  s    zShortOrInt.getfieldN)r(   r)   r*   rZ  r-   r-   r-   r.   rV  K  s   rV  c                   @   s   e Zd ZdZdd„ ZdS )Ú_AdjustableNetflowFieldz`Fields that can receive a length kwarg, even though they normally can't.
    Netflow usage only.c                 C   sF   |dkrt  | ||¡ d S |dkr4t | ||¡ d S t | ||¡ d S )Nr_   rZ   )r   rX  r   )rA   r+   rY  Úlengthr-   r-   r.   rX  U  s    z _AdjustableNetflowField.__init__N©r(   r)   r*   Ú__doc__rX  r-   r-   r-   r.   r\  R  s   r\  c                   @   s   e Zd ZdZdd„ ZdS )ÚN9SecondsIntFieldz5Defines dateTimeSeconds (without EPOCH: just seconds)c                 O   s<   |  dd¡}tj| ||g|¢R i |¤Ž t | |||¡ d S ©Nr]  rZ   )Úpopr   rX  r\  ©rA   r+   rY  ÚargsÚkargsr]  r-   r-   r.   rX  a  s
    ÿzN9SecondsIntField.__init__Nr^  r-   r-   r-   r.   r`  _  s   r`  c                   @   s   e Zd ZdZdd„ ZdS )ÚN9UTCTimeFieldzDefines dateTimeSeconds (EPOCH)c                 O   s<   |  dd¡}tj| ||g|¢R i |¤Ž t | |||¡ d S ra  )rb  r   rX  r\  rc  r-   r-   r.   rX  k  s
    ÿzN9UTCTimeField.__init__Nr^  r-   r-   r-   r.   rf  i  s   rf  TÚUNKNOWNzTE-MIDPTÚATOMZVPNZBGPZLDP)r   r'   r:   r^   r_   r]   zIngress flowzEgress flow)r   r'   F)FFTc                   @   sD   e Zd ZdZeddƒeddƒeddƒeddƒeddƒgZd	d
„ ZdS )ÚNetflowHeaderV9zNetflow Header V9r3   Nr4   r   r5   ZpackageSequenceZSourceIDc                 C   s@   | j d u r8tdd„ |  ¡ D ƒƒ}t d|¡|dd …  }|| S )Nc                 s   s    | ]}|t ttfv rd V  qdS )r'   N)ÚNetflowFlowsetV9ÚNetflowDataflowsetV9ÚNetflowOptionsFlowsetV9©Ú.0r[  r-   r-   r.   Ú	<genexpr>ï  s   ýz-NetflowHeaderV9.post_build.<locals>.<genexpr>r9   r:   )r3   Úsumr=   r>   r?   r@   r-   r-   r.   rD   í  s    
zNetflowHeaderV9.post_buildrE   r-   r-   r-   r.   ri  å  s   üri  c                   @   s@   e Zd ZdZdZeddƒeddƒeddƒeddƒgZdd	„ Z	dS )
ÚNetflowHeaderV10zIPFix (Netflow V10) Headerr]  NZ
ExportTimer   rQ   ZObservationDomainIDc                 C   s:   | j d u r2t|ƒt|ƒ }t d|¡|dd …  }|| S )Nr9   r:   ©r]  r<   r>   r?   )rA   rB   rC   r]  r-   r-   r.   rD     s    
zNetflowHeaderV10.post_build)
r(   r)   r*   r_  r+   r   r   r   r,   rD   r-   r-   r-   r.   rq  ù  s   ýrq  c                   @   sT   e Zd ZdZedddƒedddeƒeddƒee	d	dƒd
d„ ƒgZ
dd„ Zdd„ ZdS )ÚNetflowTemplateFieldV9z$Netflow Flowset Template Field V9/10ÚenterpriseBitr   r'   Ú	fieldTypeNrh   ÚfieldLengthÚenterpriseNumberc                 C   s   | j S ©N©rt  ©Úpr-   r-   r.   Ú<lambda>  ó    zNetflowTemplateFieldV9.<lambda>c                 O   sF   t j| g|¢R i |¤Ž | jd urB| jd u rB| jtv rBt| j | _d S rx  )r   rX  ru  rv  Ú$NetflowV9TemplateFieldDefaultLengths©rA   rd  Úkwargsr-   r-   r.   rX    s    
ÿþÿzNetflowTemplateFieldV9.__init__c                 C   s   t jS rx  ©r   Úpadding_layer©rA   r{  r-   r-   r.   Údefault_payload_class  s    z,NetflowTemplateFieldV9.default_payload_class)r(   r)   r*   r+   r   r   ÚNetflowV910TemplateFieldTypesr   r
   r   r,   rX  r„  r-   r-   r-   r.   rs    s   
ÿ
ÿü	rs  c                   @   sB   e Zd ZdZeddƒedddd�edg edd	„ d
�gZdd„ Z	dS )ÚNetflowTemplateV9zNetflow Flowset Template V9/10Ú
templateIDr6  Ú
fieldCountNÚtemplate_fields©Úcount_ofc                 C   s   | j S rx  )rˆ  ©rB   r-   r-   r.   r|  #  r}  zNetflowTemplateV9.<lambda>©Z
count_fromc                 C   s   t jS rx  r�  rƒ  r-   r-   r.   r„  %  s    z'NetflowTemplateV9.default_payload_class)
r(   r)   r*   r+   r   r   r   rs  r,   r„  r-   r-   r-   r.   r†    s   ÿþr†  c                   @   s@   e Zd ZdZeddƒeddddd„ d	�edg ed
d„ d�gZdS )rj  zNetflow FlowSet V9/10Ú	flowSetIDr   r]  NÚ	templatesc                 C   s   |d S ©Nr_   r-   ©rB   r[  r-   r-   r.   r|  -  r}  zNetflowFlowsetV9.<lambda>)Ú	length_ofÚadjustc                 C   s
   | j d S r�  ©r]  rŒ  r-   r-   r.   r|  /  r}  ©Zlength_from)	r(   r)   r*   r+   r   r   r   r†  r,   r-   r-   r-   r.   rj  )  s   ÿÿýrj  c                   @   s   e Zd Zdd„ ZdS )Ú_CustomStrFixedLenFieldc                 C   s   t |ƒS rx  )Úrepr)rA   rB   Úvr-   r-   r.   Úi2repr3  s    z_CustomStrFixedLenField.i2reprN)r(   r)   r*   r™  r-   r-   r-   r.   r–  2  s   r–  c           	         s¾   g ‰ |D ]Œ\}}t  |d¡}t|tƒr*|n|g f\}}i }|rxt|tƒrP||d< ˆ  |t |d¡dg|¢R i |¤Ž¡ qˆ  tt |d¡d|d�¡ qG ‡ fdd„d| ƒ}| j	|_	| j
|_
|S )	zLInternal function used to generate the Records from
    their template.
    Nr]  Zunknown_datar   r}  r”  c                       s   e Zd Z” ZdZdS )z-_GenNetflowRecordV9.<locals>.NetflowRecordV9ITN)r(   r)   r*   r,   Zmatch_subclassr-   ©Z_fields_descr-   r.   ÚNetflowRecordV9IT  s   r›  )ÚNetflowV9TemplateFieldDecodersÚgetÚ
isinstanceÚtupleÚ
issubclassr\  Úappendr…  r–  r+   r(   )	ÚclsZlengths_listÚjÚkZ_f_dataZ_f_typeZ_f_argsZ	_f_kwargsr›  r-   rš  r.   Ú_GenNetflowRecordV97  s:    ÿ

þþþÿ
þÿr¥  c                 C   sŽ   i }| j D ]>}g }|jD ]}| |j|jf¡ q|r
tt|ƒ}|||j< q
|sVtdƒ‚t	|ƒdkrz|du rrtdƒ‚|| S t
| ¡ ƒd S dS )zw
    Get a NetflowRecordV9/10 for a specific NetflowFlowsetV9/10.

    Have a look at the online doc for examples.
    zNo template IDs detectedr'   Nz3Multiple possible templates ! Specify templateID=..r   )r�  r‰  r¡  rv  ru  r¥  ÚNetflowRecordV9r‡  r   r<   ÚlistÚvalues)Zflowsetr‡  ÚdefinitionsÚntv9ÚllistÚtmplr¢  r-   r-   r.   ÚGetNetflowRecordV9\  s&    


ÿÿr­  c                   @   s$   e Zd ZdZeddƒgZdd„ ZdS )r¦  z Netflow DataFlowset Record V9/10Ú
fieldValueÚ c                 C   s   t jS rx  r�  rƒ  r-   r-   r.   r„  |  s    z%NetflowRecordV9.default_payload_classN)r(   r)   r*   r+   r   r,   r„  r-   r-   r-   r.   r¦  x  s   r¦  c                   @   sL   e Zd ZdZeddƒeddƒedg edd„ d	�gZedd
d„ƒZ	dd„ Z
dS )rk  zNetflow DataFlowSet V9/10r‡  r6  r]  NÚrecordsc                 C   s
   | j d S r�  r”  rŒ  r-   r-   r.   r|  ‡  r}  zNetflowDataflowsetV9.<lambda>r•  c                 O   sX   |rT|d d… dkrt S |d d… dkr,tS |d d… dkr@t S |d d… dkrTtS | S )Nr:   s     s    s    s    )rj  rl  ÚNetflowOptionsFlowset10)r¢  Z_pktrd  re  r-   r-   r.   Údispatch_hook‰  s    z"NetflowDataflowsetV9.dispatch_hookc                 C   sX   | j d u rPt|ƒ}| d }|d d… t d|| ¡ |dd …  }|d| 7 }|| S )Nr_   r:   r9   ó    rr  )rA   rB   rC   r]  Úpadr-   r-   r.   rD   ™  s    

(zNetflowDataflowsetV9.post_build)N)r(   r)   r*   r+   r   r   r¦  r,   Úclassmethodr²  rD   r-   r-   r-   r.   rk  €  s   ýþrk  c              	   C   sÚ  t | v r€| }t |v r€|t  }|jD ]T}g }|jD ]}| |j|jf¡ q0|r"tdd„ |D ƒƒ}tt|ƒ}	||	f||j	< q"|j
}qt| v �r6| }t|v �r6|t }g }|jD ]}
| |
j|
jf¡ qªtdd„ |D ƒƒ}tt|ƒ}g }|jD ]}| |j|jf¡ qètdd„ |D ƒƒ}tt|ƒ}||||f||j	< |j
}qŽt| v �rÖ| }t|v �rÖ|t }|j	}||v�r~||v�r~| |¡ dS z|jd j}|j d¡ W n ttf�y´   Y dS 0 g }||v �r<|| \}}	t|ƒ|k�r| |	|d|… ƒ¡ ||d… }�qÐ||_|�rÌt|ƒdk�r0| t |¡¡ n
| |¡ n�||v �rÌ|| \}}}}|�rr| ||d|… ƒ¡ |�r’| ||||| … ƒ¡ t|ƒ|| k�rÀ| t ||| d… ¡¡ ||_d|_ |j
}�qDdS )	z?Used internally to process a single packet during defragmentingc                 s   s   | ]}|d  V  qdS ©r   Nr-   rm  r-   r-   r.   ro  ¯  r}  z/_netflowv9_defragment_packet.<locals>.<genexpr>c                 s   s   | ]}|d  V  qdS r¶  r-   rm  r-   r-   r.   ro  ¿  r}  c                 s   s   | ]}|d  V  qdS r¶  r-   rm  r-   r-   r.   ro  Ë  r}  Nr   r_   z#Netflow DataFlowSet V9/10 - OPTIONS)!rj  r�  r‰  r¡  rv  ru  rp  r¥  r¦  r‡  Úpayloadrl  ÚscopesÚscopeFieldlengthÚscopeFieldTypeÚNetflowOptionsRecordScopeV9ÚoptionsÚoptionFieldlengthÚoptionFieldTypeÚNetflowOptionsRecordOptionV9rk  Úaddr°  r®  rb  Ú
IndexErrorÚAttributeErrorr<   Zadd_payloadr   r‚  Zdo_dissect_payloadr+   )rB   r©  Údefinitions_optsÚignoredÚcurrentrª  r«  r¬  Ztot_lenr¢  ÚscopeZscope_tot_lenZ	scope_clsÚoptZoption_tot_lenZ
option_clsZdataflÚtidÚdataÚresZ	scope_lenZ
option_lenr-   r-   r.   Ú_netflowv9_defragment_packet£  s¨    





þþ
þþþ





ÿÿÿrË  c                 C   s\   t | ttfƒs| g} i }i }tƒ }| D ]}t||||ƒ q&tjdkrX|rXtdt|ƒ ƒ | S )z¿Process all NetflowV9/10 Packets to match IDs of the DataFlowsets
    with the Headers

    params:
     - plist: the list of mixed NetflowV9/10 packets.
     - verb: verbose print (0/1)
    r'   z!Ignored templateIDs (missing): %s)rž  r    r§  ÚsetrË  r   Úverbr   )ÚplistrÍ  r©  rÃ  rÄ  rB   r-   r-   r.   Únetflowv9_defragment  s    ýrÏ  c                  O   s   t | i |¤ŽS )zAlias for netflowv9_defragment)rÏ  )rd  r€  r-   r-   r.   Úipfix_defragment&  s    rÐ  c                   @   s(   e Zd ZdZdd„ Zdd„ Zdd„ ZdS )	ÚNetflowSessionztSession used to defragment NetflowV9/10 packets on the flow.
    See help(scapy.layers.netflow) for more infos.
    c                 O   s0   t j| g|¢R i |¤Ž i | _i | _tƒ | _d S rx  )r!   rX  r©  rÃ  rÌ  rÄ  r  r-   r-   r.   rX  /  s    zNetflowSession.__init__c                 C   s   t || j| j| jƒ |S rx  )rË  r©  rÃ  rÄ  ©rA   rB   r-   r-   r.   Ú_process_packet5  s    ýzNetflowSession._process_packetc                 C   s$   |   |¡}|  |¡}t | |¡ d S rx  )Z_ip_process_packetrÓ  r"   Úon_packet_receivedrÒ  r-   r-   r.   rÔ  <  s    

z!NetflowSession.on_packet_receivedN)r(   r)   r*   r_  rX  rÓ  rÔ  r-   r-   r-   r.   rÑ  +  s   rÑ  c                   @   s   e Zd ZdZdS )r»  z-Netflow Options Template Record V9/10 - ScopeN©r(   r)   r*   r+   r-   r-   r-   r.   r»  D  s   r»  c                   @   s   e Zd ZdZdS )r¿  z.Netflow Options Template Record V9/10 - OptionNrÕ  r-   r-   r-   r.   r¿  H  s   r¿  c                   @   sL   e Zd ZdZedddƒedddeƒeddƒeed	dƒd
d„ ƒgZ	dd„ Z
dS )ÚNetflowOptionsFlowsetOptionV9z/Netflow Options Template FlowSet V9/10 - Optionrt  r   r'   r¾  Nrh   r½  rw  c                 C   s   | j S rx  ry  rz  r-   r-   r.   r|  T  r}  z&NetflowOptionsFlowsetOptionV9.<lambda>c                 C   s   t jS rx  r�  rƒ  r-   r-   r.   r„  V  s    z3NetflowOptionsFlowsetOptionV9.default_payload_class)r(   r)   r*   r+   r   r   r…  r   r
   r,   r„  r-   r-   r-   r.   rÖ  M  s   
ÿ
ÿürÖ  c                   @   s.   e Zd ZdZeddeƒeddƒgZdd„ ZdS )ÚNetflowOptionsFlowsetScopeV9z.Netflow Options Template FlowSet V9/10 - Scoperº  Nr¹  r   c                 C   s   t jS rx  r�  rƒ  r-   r-   r.   r„  `  s    z2NetflowOptionsFlowsetScopeV9.default_payload_class)	r(   r)   r*   r+   r   ÚScopeFieldTypesr   r,   r„  r-   r-   r-   r.   r×  [  s
   
ÿr×  c                   @   sˆ   e Zd ZdZeddƒeddƒeddƒeddd	d
�edddd
�ed	g edd„ d�edg edd„ d�e	dddd„ d�gZ
dd„ Zdd„ ZdS )rl  z#Netflow Options Template FlowSet V9rŽ  r'   r]  Nr‡  r6  Úoption_scope_lengthr¸  )r’  Úoption_field_lengthr¼  c                 C   s   | j S rx  )rÙ  rŒ  r-   r-   r.   r|  q  r}  z NetflowOptionsFlowsetV9.<lambda>r•  c                 C   s   | j S rx  )rÚ  rŒ  r-   r-   r.   r|  u  r}  r´  c                 C   s   | j | j | j d S )Nrc   )r]  rÙ  rÚ  rŒ  r-   r-   r.   r|  v  s
    
ÿÿc                 C   s   t jS rx  r�  rƒ  r-   r-   r.   r„  z  s    z-NetflowOptionsFlowsetV9.default_payload_classc                 C   sr   | j d u r2|d d… t dt|ƒ¡ |dd …  }| jd u rjd| j | j }|d |… t|ƒ d d  }|| S ©Nr:   r9   r_   rc   r³  )r]  r>   r?   r<   r´  rÙ  rÚ  ©rA   rB   rC   Ústartr-   r-   r.   rD   }  s    
(
z"NetflowOptionsFlowsetV9.post_build)r(   r)   r*   r+   r   r   r   r×  rÖ  r   r,   r„  rD   r-   r-   r-   r.   rl  d  s0   ÿÿýýðrl  c                   @   sŠ   e Zd ZdZdZeddƒeddƒeddƒeddd	d
d„ d�edddd�edg edd„ d�ed	g e	dd„ d�e
dddd„ d�gZdd„ ZdS )r±  z,Netflow V10 (IPFix) Options Template FlowSetrŽ  r^   r]  Nr‡  r6  Úfield_countr¼  c                 C   s   ||   d¡ | d ¡ S )NÚscope_field_count)Ú	get_fieldZi2mr‘  r-   r-   r.   r|  “  s
    ÿÿz NetflowOptionsFlowset10.<lambda>)r‹  r“  rß  r¸  rŠ  c                 C   s   | j S rx  )rß  rŒ  r-   r-   r.   r|  œ  r}  r�  c                 C   s   | j | j S rx  )rÞ  rß  rŒ  r-   r-   r.   r|     s    r´  c                 C   s   | j | jd  d S )Nr_   rc   )r]  rß  rŒ  r-   r-   r.   r|  £  s    r•  c                 C   sp   | j d u r2|d d… t dt|ƒ¡ |dd …  }| jd u rhd| jd  }|d |… t|ƒ d d  }|| S rÛ  )r]  r>   r?   r<   r´  rß  rÜ  r-   r-   r.   rD   ¦  s    
(
z"NetflowOptionsFlowset10.post_build)r(   r)   r*   r_  r+   r   r   r   r×  rÖ  r   r,   rD   r-   r-   r-   r.   r±  ˆ  s2   þÿýýèr±  )N)r'   )Rr_  r[   r>   Zscapy.configr   Z
scapy.datar   Zscapy.errorr   r   Zscapy.fieldsr   r   r   r	   r
   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   Zscapy.packetr   r   r   Zscapy.plistr    Zscapy.sessionsr!   r"   Zscapy.layers.inetr#   Zscapy.layers.inet6r$   r%   Úportr2   rF   rP   rR   Z	NTOP_BASEr…  rØ  r~  rV  r\  r`  rf  rœ  ri  rq  rs  r†  rj  r–  r¥  r­  r¦  rk  rË  rÏ  rÐ  rÑ  r»  r¿  rÖ  r×  rl  r±  r-   r-   r-   r.   Ú<module>	   sP  d







































€ € € € € € È      Bû	¿G

&





•o	%#i	$(



