简介：我自己写的php脚本，用来搜集netflow，只支持V5
CODE:
=============================================<?phperror_reporting(E_ALL);/* Allow the script to hang around waiting for connections. */set_tim ...
关键字： NetFlow 流量分析 思科 网络分析 php 脚本
CODE:
=============================================
<?php
error_reporting(E_ALL);
/* Allow the script to hang around waiting for connections. */
set_time_limit(0);
$address = '192.168.67.67';
$port = 9800;
if (($sock = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP)) < 0) {
echo "socket_create() failed: reason: " . socket_strerror($sock) . "\n";
}
echo "Collector 程序运行中 ......\n";
if (($ret = socket_bind($sock, $address, $port)) < 0) {
echo "socket_bind() failed: reason: " . socket_strerror($ret) . "\n";
}
do {
$buf = socket_read($sock, 4096, PHP_BINARY_READ);
$header_fmt_le = "vversion/vcount/VSysUptime/Vunix_secs/Vunix_nsecs/Vflow_sequence/Cengine_type/Cengine_id/vsampling_interval";
$header_fmt_be = "nversion/ncount/NSysUptime/Nunix_secs/Nunix_nsecs/Nflow_sequence/Cengine_type/Cengine_id/nsampling_interval";
$header_fmt = $header_fmt_be;
$header = unpack($header_fmt,substr($buf,0,24));
for($i=0;$i<$header['count'];$i++){
$record_fmt_le = "Vsrcaddr/Vdstaddr/Vnexthop/vinput/voutput/VdPkts/VdOctets/VFirst/VLast/vsrcport/vdstport/Cpad1/Ctcp_flags/Cprot/Ctos/vsrc_as/vdst_as/Csrc_mask/Cdst_mask/vpad2";
$record_fmt_be = "Nsrcaddr/Ndstaddr/Nnexthop/ninput/noutput/NdPkts/NdOctets/NFirst/NLast/nsrcport/ndstport/Cpad1/Ctcp_flags/Cprot/Ctos/nsrc_as/ndst_as/Csrc_mask/Cdst_mask/npad2";
$record_fmt = $record_fmt_be;
$offset = 24 + $i*48;
$record = unpack($record_fmt,substr($buf,$offset,48));
$srcaddr_r = unpack("Csrc1/Csrc2/Csrc3/Csrc4",substr($buf,$offset,4));
$srcaddr = $srcaddr_r['src1'] . "." . $srcaddr_r['src2'] . "." . $srcaddr_r['src3'] . "." . $srcaddr_r['src4'];
$dstaddr_r = unpack("Cdst1/Cdst2/Cdst3/Cdst4",substr($buf,($offset+4),4));
$dstaddr = $dstaddr_r['dst1'] . "." . $dstaddr_r['dst2'] . "." . $dstaddr_r['dst3'] . "." . $dstaddr_r['dst4'];
$nexthop_r = unpack("Cnexthop1/Cnexthop2/Cnexthop3/Cnexthop4",substr($buf,($offset+8),4));
$nexthop = $nexthop_r['nexthop1'] . "." . $nexthop_r['nexthop2'] . "." . $nexthop_r['nexthop3'] . "." . $nexthop_r['nexthop4'];
}
} while (true);
socket_close($sock);
mysql_close($link);
?>
=============================================