用c++写一个从端口解析netflow数据的程序

以下是一个使用 C++ 解析 NetFlow 数据的示例程序，该程序从指定端口接收 NetFlow 数据，并将其解析后输出到控制台：

#include <iostream>
#include <cstring>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <unistd.h>

#define NETFLOW_V5_HEADER_SIZE 24
#define NETFLOW_V5_RECORD_SIZE 48

#pragma pack(push, 1)

struct netflow_v5_header_t {
    uint16_t version;
    uint16_t count;
    uint32_t sys_uptime;
    uint32_t unix_secs;
    uint32_t unix_nsecs;
    uint32_t flow_sequence;
    uint8_t engine_type;
    uint8_t engine_id;
    uint16_t sampling_interval;
};

struct netflow_v5_record_t {
    uint32_t src_addr;
    uint32_t dst_addr;
    uint32_t next_hop;
    uint16_t input_iface;
    uint16_t output_iface;
    uint32_t packets;
    uint32_t bytes;
    uint32_t start_time;
    uint32_t end_time;
    uint16_t src_port;
    uint16_t dst_port;
    uint8_t protocol;
    uint8_t tos;
    uint16_t tcp_flags;
    uint32_t src_as;
    uint32_t dst_as;
    uint8_t src_mask;
    uint8_t dst_mask;
    uint16_t pad;
};

#pragma pack(pop)

int main(int argc, char *argv[]) {
    if (argc != 2) {
        std::cerr << "Usage: " << argv[0] << " <port>" << std::endl;
        return 1;
    }

    int sockfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
    if (sockfd < 0) {
        std::cerr << "Error: Failed to create socket." << std::endl;
        return 1;
    }

    struct sockaddr_in server_addr;
    std::memset(&server_addr, 0, sizeof(server_addr));
    server_addr.sin_family = AF_INET;
    server_addr.sin_addr.s_addr = htonl(INADDR_ANY);
    server_addr.sin_port = htons(std::atoi(argv[1]));

    if (bind(sockfd, (struct sockaddr *)&server_addr, sizeof(server_addr)) < 0) {
        std::cerr << "Error: Failed to bind socket." << std::endl;
        return 1;
    }

    char buf[65536];
    struct sockaddr_in client_addr;
    socklen_t client_addr_len = sizeof(client_addr);

    while (true) {
        ssize_t len = recvfrom(sockfd, buf, sizeof(buf), 0, (struct sockaddr *)&client_addr, &client_addr_len);
        if (len < 0) {
            std::cerr << "Error: Failed to receive data." << std::endl;
            continue;
        }

        std::cout << "Received " << len << " bytes from " << inet_ntoa(client_addr.sin_addr) << ":" << ntohs(client_addr.sin_port) << std::endl;

        if (len < NETFLOW_V5_HEADER_SIZE) {
            std::cerr << "Error: Data too short." << std::endl;
            continue;
        }

        netflow_v5_header_t *header = (netflow_v5_header_t *)buf;

        if (header->version != 5) {
            std::cerr << "Error: Unsupported version." << std::endl;
            continue;
        }

        std::cout << "NetFlow Version 5 Header:" << std::endl;
        std::cout << "  Version: " << header->version << std::endl;
        std::cout << "  Count: " << header->count << std::endl;
        std::cout << "  Sys Uptime: " << header->sys_uptime << std::endl;
        std::cout << "  Unix Secs: " << header->unix_secs << std::endl;
        std::cout << "  Unix Nsecs: " << header->unix_nsecs << std::endl;
        std::cout << "  Flow Sequence: " << header->flow_sequence << std::endl;
        std::cout << "  Engine Type: " << (int)header->engine_type << std::endl;
        std::cout << "  Engine ID: " << (int)header->engine_id << std::endl;
        std::cout << "  Sampling Interval: " << header->sampling_interval << std::endl;

        int offset = NETFLOW_V5_HEADER_SIZE;

        for (int i = 0; i < header->count; i++) {
            if (len < offset + NETFLOW_V5_RECORD_SIZE) {
                std::cerr << "Error: Data too short." << std::endl;
                break;
            }

            netflow_v5_record_t *record = (netflow_v5_record_t *)(buf + offset);

            std::cout << "NetFlow Version 5 Record " << i << ":" << std::endl;
            std::cout << "  Src Addr: " << inet_ntoa(*(struct in_addr *)&record->src_addr) << std::endl;
            std::cout << "  Dst Addr: " << inet_ntoa(*(struct in_addr *)&record->dst_addr) << std::endl;
            std::cout << "  Next Hop: " << inet_ntoa(*(struct in_addr *)&record->next_hop) << std::endl;
            std::cout << "  Input Iface: " << record->input_iface << std::endl;
            std::cout << "  Output Iface: " << record->output_iface << std::endl;
            std::cout << "  Packets: " << record->packets << std::endl;
            std::cout << "  Bytes: " << record->bytes << std::endl;
            std::cout << "  Start Time: " << record->start_time << std::endl;
            std::cout << "  End Time: " << record->end_time << std::endl;
            std::cout << "  Src Port: " << ntohs(record->src_port) << std::endl;
            std::cout << "  Dst Port: " << ntohs(record->dst_port) << std::endl;
            std::cout << "  Protocol: " << (int)record->protocol << std::endl;
            std::cout << "  TOS: " << (int)record->tos << std::endl;
            std::cout << "  TCP Flags: " << record->tcp_flags << std::endl;
            std::cout << "  Src AS: " << record->src_as << std::endl;
            std::cout << "  Dst AS: " << record->dst_as << std::endl;
            std::cout << "  Src Mask: " << (int)record->src_mask << std::endl;
            std::cout << "  Dst Mask: " << (int)record->dst_mask << std::endl;

            offset += NETFLOW_V5_RECORD_SIZE;
        }
    }

    close(sockfd);

    return 0;
}

该程序使用标准的 Linux 系统库函数来接收和解析 NetFlow 数据，可以通过编译并运行该程序来测试。