epan/dissectors/packet-sflow.c

   1 /* packet-sflow.c
   2  * Routines for sFlow v5 dissection implemented according to the specifications
   3  * at http://www.sflow.org/sflow_version_5.txt
   4  *
   5  * Additional 802.11 structures support implemented according to the
   6  * specifications at http://www.sflow.org/sflow_80211.txt
   7  *
   8  * By Yi Yu <yiyu.inbox@gmail.com>
   9  *
  10  * $Id$
  11  *
  12  * TODO:
  13  *   802.11 aggregation data dissection                         (sFlow v5)
  14  *
  15  *
  16  * Based on Jeff Rizzo's <riz@boogers.sf.ca.us> dissector for sFlow v2/4
  17  * in Wireshark 1.0.8 public release.
  18  *
  19  * Wireshark - Network traffic analyzer
  20  * By Gerald Combs <gerald@wireshark.org>
  21  * Copyright 1998 Gerald Combs
  22  *
  23  * This program is free software; you can redistribute it and/or
  24  * modify it under the terms of the GNU General Public License
  25  * as published by the Free Software Foundation; either version 2
  26  * of the License, or (at your option) any later version.
  27  *
  28  * This program is distributed in the hope that it will be useful,
  29  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  30  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  31  * GNU General Public License for more details.
  32  *
  33  * You should have received a copy of the GNU General Public License
  34  * along with this program; if not, write to the Free Software
  35  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  36  *
  37  *
  38  * This file (mostly) implements a dissector for sFlow (RFC3176),
  39  * from the version 4 spec at http://www.sflow.org/SFLOW-DATAGRAM.txt .
  40  *
  41  * TODO:
  42  *   Fix the highlighting of the datastream when bits are selected
  43  *   split things out into packet-sflow.h ?
  44  *   make routines more consistent as to whether they return
  45  *     'offset' or bytes consumed ('len')                       (sFlow v2/4)
  46  *   implement sampled_ipv4 and sampled_ipv6 packet data types  (sFlow v2/4)
  47  *   implement extended_user                                    (sFlow v2/4)
  48  *   implement extended_url                                     (sFlow v2/4)
  49  *   implement non-generic counters sampling                    (sFlow v2/4)
  50  */
  51
  52 #include "config.h"
  53
  54 #include <glib.h>
  55
  56 #include <epan/packet.h>
  57 #include <epan/exceptions.h>
  58 #include <epan/prefs.h>
  59 #include <epan/expert.h>
  60 #include <epan/ipproto.h>
  61
  62 #define SFLOW_UDP_PORTS "6343"
  63
  64 static dissector_handle_t sflow_handle;
  65
  66 /*
  67  *  global_sflow_ports : holds the configured range of ports for sflow
  68  */
  69 static range_t *global_sflow_ports = NULL;
  70
  71 /*
  72  *  sflow_245_ports : holds the currently used range of ports for sflow
  73  */
  74 static gboolean global_dissect_samp_headers = TRUE;
  75 static gboolean global_analyze_samp_ip_headers = FALSE;
  76
  77 #define ENTERPRISE_DEFAULT 0
  78
  79 #define ADDR_TYPE_UNKNOWN 0
  80 #define ADDR_TYPE_IPV4    1
  81 #define ADDR_TYPE_IPV6    2
  82
  83 #define FLOWSAMPLE 1
  84 #define COUNTERSSAMPLE 2
  85 #define EXPANDED_FLOWSAMPLE 3
  86 #define EXPANDED_COUNTERSSAMPLE 4
  87
  88 static const value_string sflow_245_sampletype[] = {
  89     { FLOWSAMPLE, "Flow sample"},
  90     { COUNTERSSAMPLE, "Counters sample"},
  91     { EXPANDED_FLOWSAMPLE, "Expanded flow sample"},
  92     { EXPANDED_COUNTERSSAMPLE, "Expanded counters sample"},
  93     { 0, NULL}
  94 };
  95
  96 #define SFLOW_5_IEEE80211_VERSION_A 1
  97 #define SFLOW_5_IEEE80211_VERSION_B 2
  98 #define SFLOW_5_IEEE80211_VERSION_G 3
  99 #define SFLOW_5_IEEE80211_VERSION_N 4
 100
 101 static const value_string sflow_5_ieee80211_versions [] = {
 102     { SFLOW_5_IEEE80211_VERSION_A, "802.11a"},
 103     { SFLOW_5_IEEE80211_VERSION_B, "802.11b"},
 104     { SFLOW_5_IEEE80211_VERSION_G, "802.11g"},
 105     { SFLOW_5_IEEE80211_VERSION_N, "802.11n"},
 106     { 0, NULL}
 107 };
 108
 109 /* interface counter types */
 110 #define SFLOW_245_COUNTERS_GENERIC 1
 111 #define SFLOW_245_COUNTERS_ETHERNET 2
 112 #define SFLOW_245_COUNTERS_TOKENRING 3
 113 #define SFLOW_245_COUNTERS_FDDI 4
 114 #define SFLOW_245_COUNTERS_VG 5
 115 #define SFLOW_245_COUNTERS_WAN 6
 116 #define SFLOW_245_COUNTERS_VLAN 7
 117
 118 static const value_string sflow_245_counterstype[] = {
 119     { SFLOW_245_COUNTERS_GENERIC,  "Generic counters"},
 120     { SFLOW_245_COUNTERS_ETHERNET, "Ethernet counters"},
 121     { SFLOW_245_COUNTERS_FDDI,     "FDDI counters"},
 122     { SFLOW_245_COUNTERS_VG,       "100baseVG counters"},
 123     { SFLOW_245_COUNTERS_WAN,      "WAN counters"},
 124     { SFLOW_245_COUNTERS_VLAN,     "VLAN counters"},
 125     { 0, NULL}
 126 };
 127
 128 #define MAX_HEADER_SIZE 256
 129
 130 #define SFLOW_245_PACKET_DATA_TYPE_HEADER 1
 131 #define SFLOW_245_PACKET_DATA_TYPE_IPV4 2
 132 #define SFLOW_245_PACKET_DATA_TYPE_IPV6 3
 133
 134 static const value_string sflow_245_packet_information_type[] = {
 135     { SFLOW_245_PACKET_DATA_TYPE_HEADER, "Packet headers are sampled"},
 136     { SFLOW_245_PACKET_DATA_TYPE_IPV4,   "IP Version 4 data"},
 137     { SFLOW_245_PACKET_DATA_TYPE_IPV6,   "IP Version 6 data"},
 138     { 0, NULL}
 139 };
 140
 141 static const value_string extended_80211_suite_type_vals[] = {
 142     { 0, "Use group cipher suite"},
 143     { 1, "WEP-40"},
 144     { 2, "TKIP"},
 145     { 4, "CCMP"},
 146     { 5, "WEP-104"},
 147     { 0, NULL}
 148 };
 149
 150 static const value_string sflow_ifdirection_vals[] = {
 151     { 1, "Full-Duplex"},
 152     { 2, "Half-Duplex"},
 153     { 3, "In"},
 154     { 4, "Out"},
 155     { 0, NULL}
 156 };
 157
 158 const true_false_string tfs_low_normal = { "Low", "Normal" };
 159 const true_false_string tfs_high_normal = { "High", "Normal" };
 160 const true_false_string tfs_minimize_monetary_normal = { "Minimize Monetary", "Normal" };
 161 const true_false_string tfs_up_down = { "Up", "Down" };
 162
 163 #define SFLOW_245_HEADER_ETHERNET 1
 164 #define SFLOW_245_HEADER_TOKENBUS 2
 165 #define SFLOW_245_HEADER_TOKENRING 3
 166 #define SFLOW_245_HEADER_FDDI 4
 167 #define SFLOW_245_HEADER_FRAME_RELAY 5
 168 #define SFLOW_245_HEADER_X25 6
 169 #define SFLOW_245_HEADER_PPP 7
 170 #define SFLOW_245_HEADER_SMDS 8
 171 #define SFLOW_245_HEADER_AAL5 9
 172 #define SFLOW_245_HEADER_AAL5_IP 10
 173 #define SFLOW_245_HEADER_IPv4 11
 174 #define SFLOW_245_HEADER_IPv6 12
 175 #define SFLOW_245_HEADER_MPLS 13
 176 #define SFLOW_5_HEADER_POS 14
 177 #define SFLOW_5_HEADER_80211_MAC 15
 178 #define SFLOW_5_HEADER_80211_AMPDU 16
 179 #define SFLOW_5_HEADER_80211_AMSDU_SUBFRAME 17
 180
 181 static const value_string sflow_245_header_protocol[] = {
 182     { SFLOW_245_HEADER_ETHERNET,           "Ethernet"},
 183     { SFLOW_245_HEADER_TOKENBUS,           "Token Bus"},
 184     { SFLOW_245_HEADER_TOKENRING,          "Token Ring"},
 185     { SFLOW_245_HEADER_FDDI,               "FDDI"},
 186     { SFLOW_245_HEADER_FRAME_RELAY,        "Frame Relay"},
 187     { SFLOW_245_HEADER_X25,                "X.25"},
 188     { SFLOW_245_HEADER_PPP,                "PPP"},
 189     { SFLOW_245_HEADER_SMDS,               "SMDS"},
 190     { SFLOW_245_HEADER_AAL5,               "ATM AAL5"},
 191     { SFLOW_245_HEADER_AAL5_IP,            "ATM AAL5-IP (e.g., Cisco AAL5 mux)"},
 192     { SFLOW_245_HEADER_IPv4,               "IPv4"},
 193     { SFLOW_245_HEADER_IPv6,               "IPv6"},
 194     { SFLOW_245_HEADER_MPLS,               "MPLS"},
 195     { SFLOW_5_HEADER_POS,                  "PPP over SONET/SDH (RFC 1662, 2615)"},
 196     { SFLOW_5_HEADER_80211_MAC,            "802.11 MAC"},
 197     { SFLOW_5_HEADER_80211_AMPDU,          "802.11n Aggregated MPDU"},
 198     { SFLOW_5_HEADER_80211_AMSDU_SUBFRAME, "A-MSDU Subframe"},
 199     { 0, NULL}
 200 };
 201
 202 /* extended packet data types */
 203 #define SFLOW_245_EXTENDED_SWITCH 1
 204 #define SFLOW_245_EXTENDED_ROUTER 2
 205 #define SFLOW_245_EXTENDED_GATEWAY 3
 206 #define SFLOW_245_EXTENDED_USER 4
 207 #define SFLOW_245_EXTENDED_URL 5
 208
 209 static const value_string sflow_245_extended_data_types[] = {
 210     { SFLOW_245_EXTENDED_SWITCH, "Extended switch information"},
 211     { SFLOW_245_EXTENDED_ROUTER, "Extended router information"},
 212     { SFLOW_245_EXTENDED_GATEWAY, "Extended gateway information"},
 213     { SFLOW_245_EXTENDED_USER, "Extended user information"},
 214     { SFLOW_245_EXTENDED_URL, "Extended URL information"},
 215     { 0, NULL}
 216 };
 217
 218
 219 #define SFLOW_245_AS_SET 1
 220 #define SFLOW_245_AS_SEQUENCE 2
 221
 222 static const value_string sflow_245_as_types[] = {
 223     { SFLOW_245_AS_SET, "AS Set"},
 224     { SFLOW_245_AS_SEQUENCE, "AS Sequence"},
 225     { 0, NULL}
 226 };
 227
 228 #define SFLOW_245_IPV4_PRECEDENCE_ROUTINE 0
 229 #define SFLOW_245_IPV4_PRECEDENCE_PRIORITY 1
 230 #define SFLOW_245_IPV4_PRECEDENCE_IMMEDIATE 2
 231 #define SFLOW_245_IPV4_PRECEDENCE_FLASH 3
 232 #define SFLOW_245_IPV4_PRECEDENCE_FLASH_OVERRIDE 4
 233 #define SFLOW_245_IPV4_PRECEDENCE_CRITIC_ECP 5
 234 #define SFLOW_245_IPV4_PRECEDENCE_INTERNETWORK_CONTROL 6
 235 #define SFLOW_245_IPV4_PRECEDENCE_NETWORK_CONTROL 7
 236
 237 static const value_string sflow_245_ipv4_precedence_types[] = {
 238     { SFLOW_245_IPV4_PRECEDENCE_ROUTINE, "Routine"},
 239     { SFLOW_245_IPV4_PRECEDENCE_PRIORITY, "Priority"},
 240     { SFLOW_245_IPV4_PRECEDENCE_IMMEDIATE, "Immediate"},
 241     { SFLOW_245_IPV4_PRECEDENCE_FLASH, "Flash"},
 242     { SFLOW_245_IPV4_PRECEDENCE_FLASH_OVERRIDE, "Flash Override"},
 243     { SFLOW_245_IPV4_PRECEDENCE_CRITIC_ECP, "CRITIC/ECP"},
 244     { SFLOW_245_IPV4_PRECEDENCE_INTERNETWORK_CONTROL, "Internetwork Control"},
 245     { SFLOW_245_IPV4_PRECEDENCE_NETWORK_CONTROL, "Network Control"},
 246     { 0, NULL}
 247 };
 248
 249 /* sFlow v5 flow record formats */
 250 #define SFLOW_5_RAW_PACKET_HEADER 1
 251 #define SFLOW_5_ETHERNET_FRAME 2
 252 #define SFLOW_5_IPV4 3
 253 #define SFLOW_5_IPV6 4
 254 #define SFLOW_5_SWITCH 1001
 255 #define SFLOW_5_ROUTER 1002
 256 #define SFLOW_5_GATEWAY 1003
 257 #define SFLOW_5_USER 1004
 258 #define SFLOW_5_URL 1005
 259 #define SFLOW_5_MPLS_DATA 1006
 260 #define SFLOW_5_NAT 1007
 261 #define SFLOW_5_MPLS_TUNNEL 1008
 262 #define SFLOW_5_MPLS_VC 1009
 263 #define SFLOW_5_MPLS_FEC 1010
 264 #define SFLOW_5_MPLS_LVP_FEC 1011
 265 #define SFLOW_5_VLAN_TUNNEL 1012
 266 #define SFLOW_5_80211_PAYLOAD 1013
 267 #define SFLOW_5_80211_RX 1014
 268 #define SFLOW_5_80211_TX 1015
 269 #define SFLOW_5_80211_AGGREGATION 1016
 270
 271
 272 static const value_string sflow_5_flow_record_type[] = {
 273     { SFLOW_5_RAW_PACKET_HEADER, "Raw packet header"},
 274     { SFLOW_5_ETHERNET_FRAME, "Ethernet frame data"},
 275     { SFLOW_5_IPV4, "IPv4 data"},
 276     { SFLOW_5_IPV6, "IPv6 data"},
 277     { SFLOW_5_SWITCH, "Extended switch data"},
 278     { SFLOW_5_ROUTER, "Extended router data"},
 279     { SFLOW_5_GATEWAY, "Extended gateway data"},
 280     { SFLOW_5_USER, "Extended user data"},
 281     { SFLOW_5_URL, "Extended URL data"},
 282     { SFLOW_5_MPLS_DATA, "Extended MPLS data"},
 283     { SFLOW_5_NAT, "Extended NAT data"},
 284     { SFLOW_5_MPLS_TUNNEL, "Extended MPLS tunnel data"},
 285     { SFLOW_5_MPLS_VC, "Extended MPLS VC data"},
 286     { SFLOW_5_MPLS_FEC, "Extended MPLS FEC data"},
 287     { SFLOW_5_MPLS_LVP_FEC, "Extended MPLS LVP FEC data"},
 288     { SFLOW_5_VLAN_TUNNEL, "Extended VLAN tunnel"},
 289     { SFLOW_5_80211_PAYLOAD, "Extended 802.11 payload"},
 290     { SFLOW_5_80211_RX, "Extended 802.11 RX"},
 291     { SFLOW_5_80211_TX, "Extended 802.11 TX"},
 292     { SFLOW_5_80211_AGGREGATION, "Extended 802.11 aggregation"},
 293     { 0, NULL}
 294 };
 295
 296 /* sFlow v5 counters record formats */
 297 #define SFLOW_5_GENERIC_INTERFACE 1
 298 #define SFLOW_5_ETHERNET_INTERFACE 2
 299 #define SFLOW_5_TOKEN_RING 3
 300 #define SFLOW_5_100BASE_VG_INTERFACE 4
 301 #define SFLOW_5_VLAN 5
 302 #define SFLOW_5_80211_COUNTERS 6
 303 #define SFLOW_5_PROCESSOR 1001
 304 #define SFLOW_5_RADIO_UTILIZATION 1002
 305
 306 static const value_string sflow_5_counters_record_type[] = {
 307     { SFLOW_5_GENERIC_INTERFACE, "Generic interface counters"},
 308     { SFLOW_5_ETHERNET_INTERFACE, "Ethernet interface counters"},
 309     { SFLOW_5_TOKEN_RING, "Token ring counters"},
 310     { SFLOW_5_100BASE_VG_INTERFACE, "100 Base VG interface counters"},
 311     { SFLOW_5_VLAN, "VLAN counters"},
 312     { SFLOW_5_80211_COUNTERS, "IEEE 802.11 counters"},
 313     { SFLOW_5_PROCESSOR, "Processor information"},
 314     { SFLOW_5_RADIO_UTILIZATION, "Radio utilization"},
 315     { 0, NULL}
 316 };
 317
 318 /* ethernet counters.  These will be preceded by generic counters. */
 319 struct ethernet_counters {
 320     guint32 dot3StatsAlignmentErrors;
 321     guint32 dot3StatsFCSErrors;
 322     guint32 dot3StatsSingleCollisionFrames;
 323     guint32 dot3StatsMultipleCollisionFrames;
 324     guint32 dot3StatsSQETestErrors;
 325     guint32 dot3StatsDeferredTransmissions;
 326     guint32 dot3StatsLateCollisions;
 327     guint32 dot3StatsExcessiveCollisions;
 328     guint32 dot3StatsInternalMacTransmitErrors;
 329     guint32 dot3StatsCarrierSenseErrors;
 330     guint32 dot3StatsFrameTooLongs;
 331     guint32 dot3StatsInternalMacReceiveErrors;
 332     guint32 dot3StatsSymbolErrors;
 333 };
 334
 335 struct sflow_address_type {
 336     int hf_addr_v4;
 337     int hf_addr_v6;
 338 };
 339
 340 struct sflow_address_details {
 341     int addr_type;              /* ADDR_TYPE_IPV4 | ADDR_TYPE_IPV6 */
 342     union {
 343         guint8 v4[4];
 344         guint8 v6[16];
 345     } agent_address;
 346 };
 347
 348 /* Initialize the protocol and registered fields */
 349 static int proto_sflow = -1;
 350 static int hf_sflow_version = -1;
 351 /*static int hf_sflow_245_agent_address_type = -1; */
 352 static int hf_sflow_agent_address_v4 = -1;
 353 static int hf_sflow_agent_address_v6 = -1;
 354 static int hf_sflow_5_sub_agent_id = -1;
 355 static int hf_sflow_5_sample_length = -1;
 356 static int hf_sflow_5_flow_data_length = -1;
 357 /* static int hf_sflow_5_counters_data_length = -1; */
 358 static int hf_sflow_245_seqnum = -1;
 359 static int hf_sflow_245_sysuptime = -1;
 360 static int hf_sflow_245_numsamples = -1;
 361 static int hf_sflow_245_header_protocol = -1;
 362 static int hf_sflow_245_sampletype = -1;
 363 static int hf_sflow_245_sampletype12 = -1;
 364 static int hf_sflow_245_ipv4_precedence_type = -1;
 365 static int hf_sflow_5_flow_record_format = -1;
 366 static int hf_sflow_5_counters_record_format = -1;
 367 static int hf_sflow_245_header = -1;
 368 static int hf_sflow_245_packet_information_type = -1;
 369 static int hf_sflow_245_extended_information_type = -1;
 370 static int hf_sflow_245_vlan_in = -1; /* incoming 802.1Q VLAN ID */
 371 static int hf_sflow_245_vlan_out = -1; /* outgoing 802.1Q VLAN ID */
 372 static int hf_sflow_245_pri_in = -1; /* incominging 802.1p priority */
 373 static int hf_sflow_245_pri_out = -1; /* outgoing 802.1p priority */
 374 static int hf_sflow_245_nexthop_v4 = -1; /* nexthop address */
 375 static int hf_sflow_245_nexthop_v6 = -1; /* nexthop address */
 376 static int hf_sflow_245_ipv4_src = -1;
 377 static int hf_sflow_245_ipv4_dst = -1;
 378 static int hf_sflow_245_ipv6_src = -1;
 379 static int hf_sflow_245_ipv6_dst = -1;
 380 static int hf_sflow_245_nexthop_src_mask = -1;
 381 static int hf_sflow_245_nexthop_dst_mask = -1;
 382
 383
 384 /* extended gateway (all versions) */
 385 static int hf_sflow_245_as = -1;
 386 static int hf_sflow_245_src_as = -1;
 387 static int hf_sflow_245_src_peer_as = -1;
 388 static int hf_sflow_245_dst_as_entries = -1; /* aka length */
 389 static int hf_sflow_245_dst_as = -1;
 390 /* extended gateway (>= version 4) */
 391 static int hf_sflow_245_community_entries = -1;
 392 /* static int hf_sflow_245_community = -1; */
 393 static int hf_sflow_245_localpref = -1;
 394
 395 /* generic interface counter */
 396 static int hf_sflow_245_ifindex = -1;
 397 static int hf_sflow_245_iftype = -1;
 398 static int hf_sflow_245_ifspeed = -1;
 399 static int hf_sflow_245_ifdirection = -1;
 400 static int hf_sflow_245_ifadmin_status = -1;
 401 static int hf_sflow_245_ifoper_status = -1;
 402 static int hf_sflow_245_ifinoct = -1;
 403 static int hf_sflow_245_ifinpkt = -1;
 404 static int hf_sflow_245_ifinmcast = -1;
 405 static int hf_sflow_245_ifinbcast = -1;
 406 static int hf_sflow_245_ifinerr = -1;
 407 static int hf_sflow_245_ifindisc = -1;
 408 static int hf_sflow_245_ifinunk = -1;
 409 static int hf_sflow_245_ifoutoct = -1;
 410 static int hf_sflow_245_ifoutpkt = -1;
 411 static int hf_sflow_245_ifoutmcast = -1;
 412 static int hf_sflow_245_ifoutbcast = -1;
 413 static int hf_sflow_245_ifoutdisc = -1;
 414 static int hf_sflow_245_ifouterr = -1;
 415 static int hf_sflow_245_ifpromisc = -1;
 416
 417 /* ethernet interface counter */
 418 static int hf_sflow_245_dot3StatsAlignmentErrors = -1;
 419 static int hf_sflow_245_dot3StatsFCSErrors = -1;
 420 static int hf_sflow_245_dot3StatsSingleCollisionFrames = -1;
 421 static int hf_sflow_245_dot3StatsMultipleCollisionFrames = -1;
 422 static int hf_sflow_245_dot3StatsSQETestErrors = -1;
 423 static int hf_sflow_245_dot3StatsDeferredTransmissions = -1;
 424 static int hf_sflow_245_dot3StatsLateCollisions = -1;
 425 static int hf_sflow_245_dot3StatsExcessiveCollisions = -1;
 426 static int hf_sflow_245_dot3StatsInternalMacTransmitErrors = -1;
 427 static int hf_sflow_245_dot3StatsCarrierSenseErrors = -1;
 428 static int hf_sflow_245_dot3StatsFrameTooLongs = -1;
 429 static int hf_sflow_245_dot3StatsInternalMacReceiveErrors = -1;
 430 static int hf_sflow_245_dot3StatsSymbolErrors = -1;
 431
 432 /* token ring counter */
 433 static int hf_sflow_245_dot5StatsLineErrors = -1;
 434 static int hf_sflow_245_dot5StatsBurstErrors = -1;
 435 static int hf_sflow_245_dot5StatsACErrors = -1;
 436 static int hf_sflow_245_dot5StatsAbortTransErrors = -1;
 437 static int hf_sflow_245_dot5StatsInternalErrors = -1;
 438 static int hf_sflow_245_dot5StatsLostFrameErrors = -1;
 439 static int hf_sflow_245_dot5StatsReceiveCongestions = -1;
 440 static int hf_sflow_245_dot5StatsFrameCopiedErrors = -1;
 441 static int hf_sflow_245_dot5StatsTokenErrors = -1;
 442 static int hf_sflow_245_dot5StatsSoftErrors = -1;
 443 static int hf_sflow_245_dot5StatsHardErrors = -1;
 444 static int hf_sflow_245_dot5StatsSignalLoss = -1;
 445 static int hf_sflow_245_dot5StatsTransmitBeacons = -1;
 446 static int hf_sflow_245_dot5StatsRecoveries = -1;
 447 static int hf_sflow_245_dot5StatsLobeWires = -1;
 448 static int hf_sflow_245_dot5StatsRemoves = -1;
 449 static int hf_sflow_245_dot5StatsSingles = -1;
 450 static int hf_sflow_245_dot5StatsFreqErrors = -1;
 451
 452 /* 100 BaseVG interface counters */
 453 static int hf_sflow_245_dot12InHighPriorityFrames = -1;
 454 static int hf_sflow_245_dot12InHighPriorityOctets = -1;
 455 static int hf_sflow_245_dot12InNormPriorityFrames = -1;
 456 static int hf_sflow_245_dot12InNormPriorityOctets = -1;
 457 static int hf_sflow_245_dot12InIPMErrors = -1;
 458 static int hf_sflow_245_dot12InOversizeFrameErrors = -1;
 459 static int hf_sflow_245_dot12InDataErrors = -1;
 460 static int hf_sflow_245_dot12InNullAddressedFrames = -1;
 461 static int hf_sflow_245_dot12OutHighPriorityFrames = -1;
 462 static int hf_sflow_245_dot12OutHighPriorityOctets = -1;
 463 static int hf_sflow_245_dot12TransitionIntoTrainings = -1;
 464 static int hf_sflow_245_dot12HCInHighPriorityOctets = -1;
 465 static int hf_sflow_245_dot12HCInNormPriorityOctets = -1;
 466 static int hf_sflow_245_dot12HCOutHighPriorityOctets = -1;
 467
 468 /* VLAN counters */
 469 static int hf_sflow_245_vlan_id = -1;
 470 static int hf_sflow_245_octets = -1;
 471 static int hf_sflow_245_ucastPkts = -1;
 472 static int hf_sflow_245_multicastPkts = -1;
 473 static int hf_sflow_245_broadcastPkts = -1;
 474 static int hf_sflow_245_discards = -1;
 475
 476 /* 802.11 interface counters */
 477 static int hf_sflow_5_dot11TransmittedFragmentCount = -1;
 478 static int hf_sflow_5_dot11MulticastTransmittedFrameCount = -1;
 479 static int hf_sflow_5_dot11FailedCount = -1;
 480 static int hf_sflow_5_dot11RetryCount = -1;
 481 static int hf_sflow_5_dot11MultipleRetryCount = -1;
 482 static int hf_sflow_5_dot11FrameDuplicateCount = -1;
 483 static int hf_sflow_5_dot11RTSSuccessCount = -1;
 484 static int hf_sflow_5_dot11RTSFailureCount = -1;
 485 static int hf_sflow_5_dot11ACKFailureCount = -1;
 486 static int hf_sflow_5_dot11ReceivedFragmentCount = -1;
 487 static int hf_sflow_5_dot11MulticastReceivedFrameCount = -1;
 488 static int hf_sflow_5_dot11FCSErrorCount = -1;
 489 static int hf_sflow_5_dot11TransmittedFrameCount = -1;
 490 static int hf_sflow_5_dot11WEPUndecryptableCount = -1;
 491 static int hf_sflow_5_dot11QoSDiscardedFragmentCount = -1;
 492 static int hf_sflow_5_dot11AssociatedStationCount = -1;
 493 static int hf_sflow_5_dot11QoSCFPollsReceivedCount = -1;
 494 static int hf_sflow_5_dot11QoSCFPollsUnusedCount = -1;
 495 static int hf_sflow_5_dot11QoSCFPollsUnusableCount = -1;
 496 static int hf_sflow_5_dot11QoSCFPollsLostCount = -1;
 497 /* static int hf_sflow_5_ieee80211_version = -1; */
 498
 499
 500 /* processor information */
 501 static int hf_sflow_5_cpu_5s = -1;
 502 static int hf_sflow_5_cpu_1m = -1;
 503 static int hf_sflow_5_cpu_5m = -1;
 504 static int hf_sflow_5_total_memory = -1;
 505 static int hf_sflow_5_free_memory = -1;
 506
 507 /* radio utilisation */
 508 static int hf_sflow_5_elapsed_time = -1;
 509 static int hf_sflow_5_on_channel_time = -1;
 510 static int hf_sflow_5_on_channel_busy_time = -1;
 511
 512 /* Generated from convert_proto_tree_add_text.pl */
 513 static int hf_sflow_5_extended_80211_suite_type = -1;
 514 static int hf_sflow_5_extended_80211_rx_channel = -1;
 515 static int hf_sflow_flow_sample_input_interface = -1;
 516 static int hf_sflow_counters_sample_sampling_interval = -1;
 517 static int hf_sflow_5_extended_url_host_length = -1;
 518 static int hf_sflow_245_ip_tcp_flag_syn = -1;
 519 static int hf_sflow_flow_sample_output_interface = -1;
 520 static int hf_sflow_245_length_of_ip_packet = -1;
 521 static int hf_sflow_counters_sample_counters_type = -1;
 522 static int hf_sflow_5_extended_mpls_tunnel_id = -1;
 523 static int hf_sflow_flow_sample_sample_pool = -1;
 524 static int hf_sflow_5_extended_80211_tx_speed = -1;
 525 static int hf_sflow_5_extended_vlan_tunnel_tpid_tci_pair = -1;
 526 static int hf_sflow_245_extended_mpls_out_label_stack_entries = -1;
 527 static int hf_sflow_flow_sample_input_interface_value = -1;
 528 static int hf_sflow_flow_sample_sampling_rate = -1;
 529 static int hf_sflow_5_extended_80211_rx_rcpi = -1;
 530 static int hf_sflow_enterprise = -1;
 531 static int hf_sflow_245_header_frame_length = -1;
 532 static int hf_sflow_5_extended_user_destination_character_set = -1;
 533 static int hf_sflow_5_extended_80211_rx_bssid = -1;
 534 static int hf_sflow_5_extended_80211_tx_retransmission_duration = -1;
 535 static int hf_sflow_245_ethernet_length_of_mac_packet = -1;
 536 static int hf_sflow_245_ip_tcp_flag_psh = -1;
 537 static int hf_sflow_flow_sample_flow_record = -1;
 538 static int hf_sflow_245_extended_mpls_in_label = -1;
 539 static int hf_sflow_5_extended_user_source_character_set = -1;
 540 static int hf_sflow_5_extended_user_destination_user_string_length = -1;
 541 static int hf_sflow_counters_sample_sequence_number = -1;
 542 static int hf_sflow_5_extended_80211_rx_speed = -1;
 543 static int hf_sflow_5_extended_80211_rx_rsni = -1;
 544 static int hf_sflow_flow_sample_source_id_index = -1;
 545 static int hf_sflow_245_ip_tcp_flag_ece = -1;
 546 static int hf_sflow_245_ipv4_throughput = -1;
 547 static int hf_sflow_5_extended_80211_oui = -1;
 548 static int hf_sflow_counters_sample_source_id_type = -1;
 549 static int hf_sflow_flow_sample_input_interface_format = -1;
 550 static int hf_sflow_5_extended_80211_tx_channel = -1;
 551 static int hf_sflow_245_ip_tcp_flag_urg = -1;
 552 static int hf_sflow_5_extended_mpls_tunnel_name_length = -1;
 553 static int hf_sflow_5_extended_80211_tx_version = -1;
 554 static int hf_sflow_245_ipv4_delay = -1;
 555 static int hf_sflow_flow_sample_source_id_class = -1;
 556 static int hf_sflow_245_ethernet_source_mac_address = -1;
 557 static int hf_sflow_5_extended_mpls_ftn_mask = -1;
 558 static int hf_sflow_245_extended_mpls_out_label = -1;
 559 static int hf_sflow_245_ipv6_priority = -1;
 560 static int hf_sflow_245_ip_tcp_flag_fin = -1;
 561 static int hf_sflow_245_ip_destination_port = -1;
 562 static int hf_sflow_5_extended_mpls_vc_label_cos_value = -1;
 563 static int hf_sflow_5_extended_80211_rx_packet_duration = -1;
 564 static int hf_sflow_5_extended_80211_tx_packet_duration = -1;
 565 static int hf_sflow_245_ipv4_reliability = -1;
 566 static int hf_sflow_5_extended_80211_tx_power = -1;
 567 static int hf_sflow_flow_sample_multiple_outputs = -1;
 568 static int hf_sflow_5_extended_user_source_user_string_length = -1;
 569 static int hf_sflow_5_extended_80211_payload_length = -1;
 570 static int hf_sflow_flow_sample_output_interface_format = -1;
 571 static int hf_sflow_245_ethernet_packet_type = -1;
 572 static int hf_sflow_counters_sample_expanded_source_id_type = -1;
 573 static int hf_sflow_245_ip_source_port = -1;
 574 static int hf_sflow_245_extended_mpls_in_label_stack_entries = -1;
 575 static int hf_sflow_5_extended_mpls_vc_instance_name_length = -1;
 576 static int hf_sflow_245_ipv4_cost = -1;
 577 static int hf_sflow_5_extended_mpls_ftn_description_length = -1;
 578 static int hf_sflow_5_extended_vlan_tunnel_number_of_layers = -1;
 579 static int hf_sflow_5_extended_80211_tx_bssid = -1;
 580 static int hf_sflow_245_ip_tcp_flag_rst = -1;
 581 static int hf_sflow_245_ip_tcp_flag_ack = -1;
 582 static int hf_sflow_245_ip_tcp_flag_cwr = -1;
 583 static int hf_sflow_5_extended_80211_tx_retransmissions = -1;
 584 static int hf_sflow_5_extended_80211_rx_version = -1;
 585 static int hf_sflow_flow_sample_dropped_packets = -1;
 586 static int hf_sflow_counters_sample_expanded_source_id_index = -1;
 587 static int hf_sflow_245_header_payload_removed = -1;
 588 static int hf_sflow_245_ethernet_destination_mac_address = -1;
 589 static int hf_sflow_counters_sample_source_id_class = -1;
 590 static int hf_sflow_5_extended_url_url_length = -1;
 591 static int hf_sflow_flow_sample_source_id_type = -1;
 592 static int hf_sflow_5_extended_mpls_fec_address_prefix_length = -1;
 593 static int hf_sflow_flow_sample_sequence_number = -1;
 594 static int hf_sflow_counters_sample_source_id_index = -1;
 595 static int hf_sflow_counters_sample_counters_records = -1;
 596 static int hf_sflow_5_extended_mpls_tunnel_cos_value = -1;
 597 static int hf_sflow_5_extended_mpls_vc_id = -1;
 598 static int hf_sflow_flow_sample_output_interface_value = -1;
 599 static int hf_sflow_5_extended_user_destination_user = -1;
 600 static int hf_sflow_245_as_type = -1;
 601 static int hf_sflow_counters_sample_index = -1;
 602 static int hf_sflow_5_extended_url_url = -1;
 603 static int hf_sflow_flow_sample_index = -1;
 604 static int hf_sflow_5_extended_80211_rx_ssid = -1;
 605 static int hf_sflow_5_extended_mpls_vc_instance_name = -1;
 606 static int hf_sflow_5_extended_mpls_tunnel_name = -1;
 607 static int hf_sflow_5_extended_80211_payload = -1;
 608 static int hf_sflow_5_extended_user_source_user = -1;
 609 static int hf_sflow_5_extended_url_host = -1;
 610 static int hf_sflow_5_extended_80211_tx_ssid = -1;
 611 static int hf_sflow_5_extended_url_direction = -1;
 612 static int hf_sflow_5_extended_mpls_ftn_description = -1;
 613 static int hf_sflow_245_ip_protocol = -1;
 614
 615 /* Initialize the subtree pointers */
 616 static gint ett_sflow_245 = -1;
 617 static gint ett_sflow_245_sample = -1;
 618 static gint ett_sflow_5_flow_record = -1;
 619 static gint ett_sflow_5_counters_record = -1;
 620 static gint ett_sflow_5_mpls_in_label_stack = -1;
 621 static gint ett_sflow_5_mpls_out_label_stack = -1;
 622 static gint ett_sflow_245_extended_data = -1;
 623 static gint ett_sflow_245_gw_as_dst = -1;
 624 static gint ett_sflow_245_gw_as_dst_seg = -1;
 625 static gint ett_sflow_245_gw_community = -1;
 626 static gint ett_sflow_245_sampled_header = -1;
 627
 628 static expert_field ei_sflow_invalid_address_type = EI_INIT;
 629
 630 /* dissectors for other protocols */
 631 static dissector_handle_t eth_withoutfcs_handle;
 632 static dissector_handle_t tr_handle;
 633 static dissector_handle_t fddi_handle;
 634 static dissector_handle_t fr_handle;
 635 static dissector_handle_t x25_handle;
 636 static dissector_handle_t ppp_hdlc_handle;
 637 static dissector_handle_t smds_handle;
 638 static dissector_handle_t aal5_handle;
 639 static dissector_handle_t ipv4_handle;
 640 static dissector_handle_t ipv6_handle;
 641 static dissector_handle_t mpls_handle;
 642 static dissector_handle_t pos_handle;
 643 static dissector_handle_t ieee80211_mac_handle;
 644 static dissector_handle_t ieee80211_ampdu_handle;
 645 static dissector_handle_t ieee80211_amsdu_subframe_handle;
 646 /* don't dissect */
 647 static dissector_handle_t data_handle;
 648
 649 void proto_reg_handoff_sflow_245(void);
 650
 651 /* dissect a sampled header - layer 2 protocols */
 652 static gint
 653 dissect_sflow_245_sampled_header(tvbuff_t *tvb, packet_info *pinfo,
 654                                  proto_tree *tree, volatile gint offset) {
 655     guint32 version, header_proto, frame_length;
 656     volatile guint32 header_length;
 657     tvbuff_t *next_tvb;
 658     proto_tree *sflow_245_header_tree;
 659     proto_item *ti;
 660     /* stuff for saving column state before calling other dissectors.
 661      * Thanks to Guy Harris for the tip. */
 662     gboolean save_writable;
 663     gboolean save_in_error_pkt;
 664     address save_dl_src, save_dl_dst, save_net_src, save_net_dst, save_src, save_dst;
 665     void *pd_save;
 666
 667     version = tvb_get_ntohl(tvb, 0);
 668     header_proto = tvb_get_ntohl(tvb, offset);
 669     proto_tree_add_item(tree, hf_sflow_245_header_protocol, tvb, offset, 4, ENC_BIG_ENDIAN);
 670     offset += 4;
 671     frame_length = tvb_get_ntohl(tvb, offset);
 672     proto_tree_add_item(tree, hf_sflow_245_header_frame_length, tvb, offset, 4, ENC_BIG_ENDIAN);
 673     offset += 4;
 674
 675     if (version == 5) {
 676         proto_tree_add_item(tree, hf_sflow_245_header_payload_removed, tvb, offset, 4, ENC_BIG_ENDIAN);
 677         offset += 4;
 678     }
 679
 680     header_length = tvb_get_ntohl(tvb, offset);
 681     offset += 4;
 682
 683     if (header_length % 4) /* XDR requires 4-byte alignment */
 684         header_length += (4 - (header_length % 4));
 685
 686
 687     ti = proto_tree_add_item(tree, hf_sflow_245_header, tvb, offset, header_length, ENC_NA);
 688     sflow_245_header_tree = proto_item_add_subtree(ti, ett_sflow_245_sampled_header);
 689
 690     /* hand the header off to the appropriate dissector.  It's probably
 691      * a short frame, so ignore any exceptions. */
 692     next_tvb = tvb_new_subset(tvb, offset, header_length, frame_length);
 693
 694     /* save some state */
 695     save_writable = col_get_writable(pinfo->cinfo);
 696
 697     /*
 698        If sFlow samples a TCP packet it is very likely that the
 699        TCP analysis will flag the packet as having some error with
 700        the sequence numbers.  sFlow only report on a "sample" of
 701        traffic so many packets will not be reported on.  This is
 702        most obvious if the colorizing rules are on, but will also
 703        cause confusion if you attempt to filter on
 704        "tcp.analysis.flags".
 705
 706        The following only works to suppress IP/TCP errors, but
 707        it is a start anyway.  Other protocols carried as payloads
 708        may exhibit similar issues.
 709
 710        I think what is really needed is a more general
 711        "protocol_as_payload" flag.  Of course then someone has to
 712        play whack-a-mole and add code to implement it to any
 713        protocols that could be carried as a payload.  In the case
 714        of sFlow that pretty much means anything on your network.
 715      */
 716     save_in_error_pkt = pinfo->flags.in_error_pkt;
 717     if (!global_analyze_samp_ip_headers) {
 718         pinfo->flags.in_error_pkt = TRUE;
 719     }
 720
 721     col_set_writable(pinfo->cinfo, FALSE);
 722     save_dl_src = pinfo->dl_src;
 723     save_dl_dst = pinfo->dl_dst;
 724     save_net_src = pinfo->net_src;
 725     save_net_dst = pinfo->net_dst;
 726     save_src = pinfo->src;
 727     save_dst = pinfo->dst;
 728     pd_save = pinfo->private_data;
 729
 730     TRY
 731     {
 732         switch (header_proto) {
 733             case SFLOW_245_HEADER_ETHERNET:
 734                 call_dissector(eth_withoutfcs_handle, next_tvb, pinfo, sflow_245_header_tree);
 735                 break;
 736             case SFLOW_245_HEADER_TOKENRING:
 737                 call_dissector(tr_handle, next_tvb, pinfo, sflow_245_header_tree);
 738                 break;
 739             case SFLOW_245_HEADER_FDDI:
 740                 call_dissector(fddi_handle, next_tvb, pinfo, sflow_245_header_tree);
 741                 break;
 742             case SFLOW_245_HEADER_FRAME_RELAY:
 743                 call_dissector(fr_handle, next_tvb, pinfo, sflow_245_header_tree);
 744                 break;
 745             case SFLOW_245_HEADER_X25:
 746                 call_dissector(x25_handle, next_tvb, pinfo, sflow_245_header_tree);
 747                 break;
 748             case SFLOW_245_HEADER_PPP:
 749                 call_dissector(ppp_hdlc_handle, next_tvb, pinfo, sflow_245_header_tree);
 750                 break;
 751             case SFLOW_245_HEADER_SMDS:
 752                 call_dissector(smds_handle, next_tvb, pinfo, sflow_245_header_tree);
 753                 break;
 754             case SFLOW_245_HEADER_AAL5:
 755             case SFLOW_245_HEADER_AAL5_IP:
 756                 /* I'll be surprised if this works! I have no AAL5 captures
 757                  * to test with, and I'm not sure how the encapsulation goes */
 758                 call_dissector(aal5_handle, next_tvb, pinfo, sflow_245_header_tree);
 759                 break;
 760             case SFLOW_245_HEADER_IPv4:
 761                 call_dissector(ipv4_handle, next_tvb, pinfo, sflow_245_header_tree);
 762                 break;
 763             case SFLOW_245_HEADER_IPv6:
 764                 call_dissector(ipv6_handle, next_tvb, pinfo, sflow_245_header_tree);
 765                 break;
 766             case SFLOW_245_HEADER_MPLS:
 767                 call_dissector(mpls_handle, next_tvb, pinfo, sflow_245_header_tree);
 768                 break;
 769             case SFLOW_5_HEADER_POS:
 770                 call_dissector(pos_handle, next_tvb, pinfo, sflow_245_header_tree);
 771                 break;
 772             case SFLOW_5_HEADER_80211_MAC:
 773                 call_dissector(ieee80211_mac_handle, next_tvb, pinfo, sflow_245_header_tree);
 774                 break;
 775             case SFLOW_5_HEADER_80211_AMPDU:
 776                 call_dissector(ieee80211_ampdu_handle, next_tvb, pinfo, sflow_245_header_tree);
 777                 break;
 778             case SFLOW_5_HEADER_80211_AMSDU_SUBFRAME:
 779                 call_dissector(ieee80211_amsdu_subframe_handle, next_tvb, pinfo, sflow_245_header_tree);
 780                 break;
 781             default:
 782                 /* some of the protocols, I have no clue where to begin. */
 783                 break;
 784         }
 785     }
 786
 787     CATCH_BOUNDS_ERRORS {
 788         /*  Restore the private_data structure in case one of the
 789          *  called dissectors modified it (and, due to the exception,
 790          *  was unable to restore it).
 791          */
 792         pinfo->private_data = pd_save;
 793     }
 794     ENDTRY;
 795
 796     /* restore saved state */
 797     col_set_writable(pinfo->cinfo, save_writable);
 798     pinfo->flags.in_error_pkt = save_in_error_pkt;
 799
 800     pinfo->dl_src = save_dl_src;
 801     pinfo->dl_dst = save_dl_dst;
 802     pinfo->net_src = save_net_src;
 803     pinfo->net_dst = save_net_dst;
 804     pinfo->src = save_src;
 805     pinfo->dst = save_dst;
 806
 807     offset += header_length;
 808     return offset;
 809 }
 810
 811 static gint
 812 dissect_sflow_245_address_type(tvbuff_t *tvb, packet_info *pinfo,
 813                                proto_tree *tree, gint offset,
 814                                struct sflow_address_type *hf_type,
 815                                struct sflow_address_details *addr_detail) {
 816     guint32 addr_type;
 817     int len;
 818
 819     addr_type = tvb_get_ntohl(tvb, offset);
 820     offset += 4;
 821
 822     switch (addr_type) {
 823     case ADDR_TYPE_UNKNOWN:
 824         len = 0;
 825         break;
 826     case ADDR_TYPE_IPV4:
 827         len = 4;
 828         proto_tree_add_item(tree, hf_type->hf_addr_v4, tvb, offset, 4, ENC_BIG_ENDIAN);
 829         break;
 830     case ADDR_TYPE_IPV6:
 831         len = 16;
 832         proto_tree_add_item(tree, hf_type->hf_addr_v6, tvb, offset, 16, ENC_NA);
 833         break;
 834     default:
 835         /* Invalid address type, or a type we don't understand; we don't
 836            know the length. W e treat it as having no contents; that
 837            doesn't trap us in an endless loop, as we at least include
 838            the address type and thus at least advance the offset by 4.
 839            Note that we have a problem, though. */
 840         len = 0;
 841         proto_tree_add_expert_format(tree, pinfo, &ei_sflow_invalid_address_type, tvb,
 842                                      offset - 4, 4, "Unknown address type (%u)", addr_type);
 843     }
 844
 845     if (addr_detail) {
 846         addr_detail->addr_type = addr_type;
 847         switch (len) {
 848         case 4:
 849             tvb_memcpy(tvb, addr_detail->agent_address.v4, offset, len);
 850             break;
 851         case 16:
 852             tvb_memcpy(tvb, addr_detail->agent_address.v6, offset, len);
 853             break;
 854         }
 855     }
 856
 857     return offset + len;
 858 }
 859
 860 /* extended switch data, after the packet data */
 861 static gint
 862 dissect_sflow_245_extended_switch(tvbuff_t *tvb, proto_tree *tree, gint offset) {
 863     proto_tree_add_item(tree, hf_sflow_245_vlan_in, tvb, offset, 4, ENC_BIG_ENDIAN);
 864     offset += 4;
 865     proto_tree_add_item(tree, hf_sflow_245_pri_in, tvb, offset, 4, ENC_BIG_ENDIAN);
 866     offset += 4;
 867     proto_tree_add_item(tree, hf_sflow_245_vlan_out, tvb, offset, 4, ENC_BIG_ENDIAN);
 868     offset += 4;
 869     proto_tree_add_item(tree, hf_sflow_245_pri_out, tvb, offset, 4, ENC_BIG_ENDIAN);
 870     offset += 4;
 871
 872     return offset;
 873 }
 874
 875 /* extended router data, after the packet data */
 876 static gint
 877 dissect_sflow_245_extended_router(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset) {
 878     struct sflow_address_type addr_type = {hf_sflow_245_nexthop_v4, hf_sflow_245_nexthop_v6};
 879
 880     offset = dissect_sflow_245_address_type(tvb, pinfo, tree, offset, &addr_type, NULL);
 881     proto_tree_add_item(tree, hf_sflow_245_nexthop_src_mask, tvb, offset, 4, ENC_BIG_ENDIAN);
 882     offset += 4;
 883     proto_tree_add_item(tree, hf_sflow_245_nexthop_dst_mask, tvb, offset, 4, ENC_BIG_ENDIAN);
 884     offset += 4;
 885     return offset;
 886 }
 887
 888 /* extended MPLS data */
 889 static gint
 890 dissect_sflow_5_extended_mpls_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset) {
 891     guint32 in_label_count, out_label_count, label, i, j;
 892     proto_tree *in_stack;
 893     proto_item *ti_in;
 894     proto_tree *out_stack;
 895     proto_item *ti_out;
 896
 897     struct sflow_address_type addr_type = {hf_sflow_245_nexthop_v4, hf_sflow_245_nexthop_v6};
 898     offset = dissect_sflow_245_address_type(tvb, pinfo, tree, offset, &addr_type, NULL);
 899
 900     in_label_count = tvb_get_ntohl(tvb, offset);
 901     proto_tree_add_item(tree, hf_sflow_245_extended_mpls_in_label_stack_entries, tvb, offset, 4, ENC_BIG_ENDIAN);
 902     offset += 4;
 903
 904     ti_in = proto_tree_add_text(tree, tvb, offset, -1, "In Label Stack");
 905     in_stack = proto_item_add_subtree(ti_in, ett_sflow_5_mpls_in_label_stack);
 906
 907     /* by applying the mask, we avoid possible corrupted data that causes huge number of loops
 908      * 255 is a sensible limit of label count */
 909     for (i = 0, j = 0; i < (in_label_count & 0x000000ff); i++, j += 4) {
 910         label = tvb_get_ntohl(tvb, offset + j);
 911         proto_tree_add_uint_format(in_stack, hf_sflow_245_extended_mpls_in_label, tvb, offset, 4,
 912             label, "Label %u: %u", i + 1, label);
 913     }
 914     offset += (in_label_count * 4);
 915
 916     out_label_count = tvb_get_ntohl(tvb, offset);
 917     proto_tree_add_item(tree, hf_sflow_245_extended_mpls_out_label_stack_entries, tvb, offset, 4, ENC_BIG_ENDIAN);
 918     offset += 4;
 919
 920     ti_out = proto_tree_add_text(tree, tvb, offset, -1, "Out Label Stack");
 921     out_stack = proto_item_add_subtree(ti_out, ett_sflow_5_mpls_in_label_stack);
 922
 923     /* by applying the mask, we avoid possible corrupted data that causes huge number of loops
 924      * 255 is a sensible limit of label count */
 925     for (i = 0, j = 0; i < (out_label_count & 0x000000ff); i++, j += 4) {
 926         label = tvb_get_ntohl(tvb, offset + j);
 927         proto_tree_add_uint_format(out_stack, hf_sflow_245_extended_mpls_out_label, tvb, offset, 4,
 928             label, "Label %u: %u", i + 1, label);
 929     }
 930     offset = offset + out_label_count * 4;
 931
 932     return offset;
 933 }
 934
 935 /* extended NAT data */
 936 static gint
 937 dissect_sflow_5_extended_nat(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset) {
 938     struct sflow_address_type addr_type = {hf_sflow_245_ipv4_src,
 939                                            hf_sflow_245_ipv6_src};
 940     offset = dissect_sflow_245_address_type(tvb, pinfo, tree, offset, &addr_type, NULL);
 941
 942     addr_type.hf_addr_v4 = hf_sflow_245_ipv4_dst;
 943     addr_type.hf_addr_v6 = hf_sflow_245_ipv6_dst;
 944
 945     offset = dissect_sflow_245_address_type(tvb, pinfo, tree, offset, &addr_type, NULL);
 946
 947     return offset;
 948 }
 949
 950 /* extended gateway data, after the packet data */
 951 static gint
 952 dissect_sflow_245_extended_gateway(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset) {
 953     gint32 len = 0;
 954     gint32 i, j, comm_len, dst_len, dst_seg_len;
 955     guint32 path_type;
 956     gint32 kludge;
 957
 958     guint32 version = tvb_get_ntohl(tvb, 0); /* get sFlow version */
 959     proto_item *ti;
 960     proto_tree *sflow_245_dst_as_tree;
 961     proto_tree *sflow_245_comm_tree;
 962     proto_tree *sflow_245_dst_as_seg_tree;
 963
 964     /* sFlow v5 contains next hop router IP address */
 965     if (version == 5) {
 966         struct sflow_address_type addr_type = {hf_sflow_245_nexthop_v4, hf_sflow_245_nexthop_v6};
 967
 968         offset = dissect_sflow_245_address_type(tvb, pinfo, tree, offset, &addr_type, NULL);
 969     }
 970
 971     proto_tree_add_item(tree, hf_sflow_245_as, tvb, offset + len, 4, ENC_BIG_ENDIAN);
 972     len += 4;
 973
 974     proto_tree_add_item(tree, hf_sflow_245_src_as, tvb, offset + len, 4, ENC_BIG_ENDIAN);
 975     len += 4;
 976
 977     proto_tree_add_item(tree, hf_sflow_245_src_peer_as, tvb, offset + len, 4, ENC_BIG_ENDIAN);
 978     len += 4;
 979
 980     dst_len = tvb_get_ntohl(tvb, offset + len);
 981     ti = proto_tree_add_uint(tree, hf_sflow_245_dst_as_entries, tvb, offset + len, 4, dst_len);
 982     sflow_245_dst_as_tree = proto_item_add_subtree(ti, ett_sflow_245_gw_as_dst);
 983     len += 4;
 984
 985     for (i = 0; i < dst_len; i++) {
 986         if (version < 4) {
 987             /* Version 2 AS paths are different than versions >= 4 as
 988                follows:
 989
 990                There is no type encoded in the packet.
 991
 992                The destination ASs are encoded as an array of integers
 993                rather as an array of arrays of integers.  I just
 994                pretended they were encoded as an array of arrays with
 995                an implicit length of 1 to not have to do two
 996                completely separate blocks for the different versions.
 997
 998                Having a subtree for "arrays" guaranteed to have only a
 999                single element proved cumbersome to navigate so I moved
1000                the creation of the subtree to only happen for versions
1001                >= 4.
1002              */
1003             dst_seg_len = 1;
1004             sflow_245_dst_as_seg_tree = sflow_245_dst_as_tree;
1005         } else {
1006             path_type = tvb_get_ntohl(tvb, offset + len);
1007             len += 4;
1008             dst_seg_len = tvb_get_ntohl(tvb, offset + len);
1009             len += 4;
1010             kludge = 8;
1011             ti = proto_tree_add_uint_format(tree, hf_sflow_245_as_type, tvb, offset + len - kludge, kludge, path_type,
1012                     "%s, (%u entries)", val_to_str_const(path_type, sflow_245_as_types, "Unknown AS type"), dst_seg_len);
1013             sflow_245_dst_as_seg_tree = proto_item_add_subtree(ti, ett_sflow_245_gw_as_dst_seg);
1014         }
1015
1016         for (j = 0; j < dst_seg_len; j++) {
1017             proto_tree_add_item(sflow_245_dst_as_seg_tree, hf_sflow_245_dst_as, tvb, offset + len, 4, ENC_BIG_ENDIAN);
1018             len += 4;
1019         }
1020     }
1021
1022
1023     if (version >= 4) {
1024         comm_len = tvb_get_ntohl(tvb, offset + len);
1025
1026         ti = proto_tree_add_uint(tree, hf_sflow_245_community_entries, tvb, offset + len, 4, comm_len);
1027         sflow_245_comm_tree = proto_item_add_subtree(ti, ett_sflow_245_gw_community);
1028         len += 4;
1029         for (i = 0; i < comm_len; i++) {
1030             proto_tree_add_item(sflow_245_comm_tree,
1031                     hf_sflow_245_dst_as, tvb, offset + len,
1032                     4, ENC_BIG_ENDIAN);
1033             len += 4;
1034         }
1035
1036         proto_tree_add_item(tree, hf_sflow_245_localpref, tvb, offset + len, 4, ENC_BIG_ENDIAN);
1037         len += 4;
1038
1039     }
1040
1041     return offset + len;
1042 }
1043
1044 /* sflow v5 ethernet frame data */
1045 static gint
1046 dissect_sflow_5_ethernet_frame(tvbuff_t *tvb, proto_tree *tree, gint offset) {
1047
1048     proto_tree_add_item(tree, hf_sflow_245_ethernet_length_of_mac_packet, tvb, offset, 4, ENC_BIG_ENDIAN);
1049     offset += 4;
1050
1051     proto_tree_add_item(tree, hf_sflow_245_ethernet_source_mac_address, tvb, offset, 6, ENC_NA);
1052     /* Padded to 4 byte offset */
1053     offset += 8;
1054
1055     proto_tree_add_item(tree, hf_sflow_245_ethernet_destination_mac_address, tvb, offset, 6, ENC_NA);
1056     /* Padded to 4 byte offset */
1057     offset += 8;
1058
1059     proto_tree_add_item(tree, hf_sflow_245_ethernet_packet_type, tvb, offset, 4, ENC_BIG_ENDIAN);
1060     offset += 4;
1061
1062     return offset;
1063 }
1064
1065 /* sflow v5 IPv4 data */
1066 static gint
1067 dissect_sflow_5_ipv4(tvbuff_t *tvb, proto_tree *tree, gint offset) {
1068
1069     proto_tree_add_item(tree, hf_sflow_245_length_of_ip_packet, tvb, offset, 4, ENC_BIG_ENDIAN);
1070     offset += 4;
1071
1072     proto_tree_add_item(tree, hf_sflow_245_ip_protocol, tvb, offset, 4, ENC_BIG_ENDIAN);
1073     offset += 4;
1074
1075     proto_tree_add_item(tree, hf_sflow_245_ipv4_src, tvb, offset, 4, ENC_BIG_ENDIAN);
1076     offset += 4;
1077
1078     proto_tree_add_item(tree, hf_sflow_245_ipv4_dst, tvb, offset, 4, ENC_BIG_ENDIAN);
1079     offset += 4;
1080
1081     proto_tree_add_item(tree, hf_sflow_245_ip_source_port, tvb, offset, 4, ENC_BIG_ENDIAN);
1082     offset += 4;
1083
1084     proto_tree_add_item(tree, hf_sflow_245_ip_destination_port, tvb, offset, 4, ENC_BIG_ENDIAN);
1085     offset += 4;
1086
1087     /* dissect tcp flags bit-by-bit */
1088     /* 8 flags are included here, plus 24-bit 0-padding */
1089     proto_tree_add_item(tree, hf_sflow_245_ip_tcp_flag_cwr, tvb, offset, 1, ENC_NA);
1090     proto_tree_add_item(tree, hf_sflow_245_ip_tcp_flag_ece, tvb, offset, 1, ENC_NA);
1091     proto_tree_add_item(tree, hf_sflow_245_ip_tcp_flag_urg, tvb, offset, 1, ENC_NA);
1092     proto_tree_add_item(tree, hf_sflow_245_ip_tcp_flag_ack, tvb, offset, 1, ENC_NA);
1093     proto_tree_add_item(tree, hf_sflow_245_ip_tcp_flag_psh, tvb, offset, 1, ENC_NA);
1094     proto_tree_add_item(tree, hf_sflow_245_ip_tcp_flag_rst, tvb, offset, 1, ENC_NA);
1095     proto_tree_add_item(tree, hf_sflow_245_ip_tcp_flag_syn, tvb, offset, 1, ENC_NA);
1096     proto_tree_add_item(tree, hf_sflow_245_ip_tcp_flag_fin, tvb, offset, 1, ENC_NA);
1097
1098     offset += 4;
1099
1100     /* 7 bits for type of service, plus 1 reserved bit */
1101     proto_tree_add_item(tree, hf_sflow_245_ipv4_precedence_type, tvb, offset, 1, ENC_NA);
1102     proto_tree_add_item(tree, hf_sflow_245_ipv4_delay, tvb, offset, 1, ENC_NA);
1103     proto_tree_add_item(tree, hf_sflow_245_ipv4_throughput, tvb, offset, 1, ENC_NA);
1104     proto_tree_add_item(tree, hf_sflow_245_ipv4_reliability, tvb, offset, 1, ENC_NA);
1105     proto_tree_add_item(tree, hf_sflow_245_ipv4_cost, tvb, offset, 1, ENC_NA);
1106
1107     offset += 4;
1108
1109     return offset;
1110 }
1111
1112 /* sflow v5 IPv6 data */
1113 static gint
1114 dissect_sflow_5_ipv6(tvbuff_t *tvb, proto_tree *tree, gint offset) {
1115
1116     proto_tree_add_item(tree, hf_sflow_245_length_of_ip_packet, tvb, offset, 4, ENC_BIG_ENDIAN);
1117     offset += 4;
1118
1119     proto_tree_add_item(tree, hf_sflow_245_ip_protocol, tvb, offset, 4, ENC_BIG_ENDIAN);
1120     offset += 4;
1121
1122     proto_tree_add_item(tree, hf_sflow_245_ipv6_src, tvb, offset, 16, ENC_NA);
1123     offset += 16;
1124
1125     proto_tree_add_item(tree, hf_sflow_245_ipv6_dst, tvb, offset, 16, ENC_NA);
1126     offset += 16;
1127
1128     proto_tree_add_item(tree, hf_sflow_245_ip_source_port, tvb, offset, 4, ENC_BIG_ENDIAN);
1129     offset += 4;
1130
1131     proto_tree_add_item(tree, hf_sflow_245_ip_destination_port, tvb, offset, 4, ENC_BIG_ENDIAN);
1132     offset += 4;
1133
1134     /* dissect tcp flags bit-by-bit */
1135     /* 8 flags are included here, plus 24-bit 0-padding */
1136     proto_tree_add_item(tree, hf_sflow_245_ip_tcp_flag_cwr, tvb, offset, 1, ENC_NA);
1137     proto_tree_add_item(tree, hf_sflow_245_ip_tcp_flag_ece, tvb, offset, 1, ENC_NA);
1138     proto_tree_add_item(tree, hf_sflow_245_ip_tcp_flag_urg, tvb, offset, 1, ENC_NA);
1139     proto_tree_add_item(tree, hf_sflow_245_ip_tcp_flag_ack, tvb, offset, 1, ENC_NA);
1140     proto_tree_add_item(tree, hf_sflow_245_ip_tcp_flag_psh, tvb, offset, 1, ENC_NA);
1141     proto_tree_add_item(tree, hf_sflow_245_ip_tcp_flag_rst, tvb, offset, 1, ENC_NA);
1142     proto_tree_add_item(tree, hf_sflow_245_ip_tcp_flag_syn, tvb, offset, 1, ENC_NA);
1143     proto_tree_add_item(tree, hf_sflow_245_ip_tcp_flag_fin, tvb, offset, 1, ENC_NA);
1144
1145     offset += 4;
1146
1147     /* Priority -- Traffic class field enables a source to identify the desired
1148        delivery priority of the packets. Priority values are divided into
1149        ranges: traffic where the source provides congestion control and
1150        non-congestion control traffic.
1151
1152        It is displayed as unsigned integer here according to sFlow specification */
1153
1154     proto_tree_add_item(tree, hf_sflow_245_ipv6_priority, tvb, offset, 4, ENC_BIG_ENDIAN);
1155     offset += 4;
1156
1157     return offset;
1158 }
1159
1160 /* sflow v5 user data */
1161 static gint
1162 dissect_sflow_5_extended_user(tvbuff_t *tvb, proto_tree *tree, gint offset) {
1163     guint32 src_length, dest_length;
1164
1165     /* charset is not processed here, all chars are assumed to be ASCII */
1166     proto_tree_add_item(tree, hf_sflow_5_extended_user_source_character_set, tvb, offset, 4, ENC_BIG_ENDIAN);
1167     offset += 4;
1168
1169     src_length = tvb_get_ntohl(tvb, offset);
1170     proto_tree_add_item(tree, hf_sflow_5_extended_user_source_user_string_length, tvb, offset, 4, ENC_BIG_ENDIAN);
1171     offset += 4;
1172
1173     /* extract source user info char by char */
1174     proto_tree_add_item(tree, hf_sflow_5_extended_user_source_user, tvb, offset, src_length, ENC_NA|ENC_ASCII);
1175     offset += src_length;
1176     /* get the correct offset by adding padding byte count */
1177     if (src_length % 4)
1178         offset += (4 - src_length % 4);
1179
1180     /* charset is not processed here, all chars are assumed to be ASCII */
1181     proto_tree_add_item(tree, hf_sflow_5_extended_user_destination_character_set, tvb, offset, 4, ENC_BIG_ENDIAN);
1182     offset += 4;
1183
1184     dest_length = tvb_get_ntohl(tvb, offset);
1185     proto_tree_add_item(tree, hf_sflow_5_extended_user_destination_user_string_length, tvb, offset, 4, ENC_BIG_ENDIAN);
1186     offset += 4;
1187
1188     /* extract destination user info char by char */
1189     proto_tree_add_item(tree, hf_sflow_5_extended_user_destination_user, tvb, offset, dest_length, ENC_NA|ENC_ASCII);
1190     offset += dest_length;
1191     /* get the correct offset by adding padding byte count */
1192     if (dest_length % 4)
1193         offset += (4 - dest_length % 4);
1194
1195     return offset;
1196 }
1197
1198 /* sflow v5 URL data */
1199 static gint
1200 dissect_sflow_5_extended_url(tvbuff_t *tvb, proto_tree *tree, gint offset) {
1201     guint32 direction, url_length, host_length;
1202
1203     direction = tvb_get_ntohl(tvb, offset);
1204     switch (direction) {
1205         case 1:
1206             proto_tree_add_uint_format(tree, hf_sflow_5_extended_url_direction, tvb, offset, 4, direction,
1207                                         "Source Address is Server(%u)", direction);
1208             break;
1209         case 2:
1210             proto_tree_add_uint_format(tree, hf_sflow_5_extended_url_direction, tvb, offset, 4, direction,
1211                                         "Destination Address is Server (%u)", direction);
1212             break;
1213         default:
1214             proto_tree_add_uint_format(tree, hf_sflow_5_extended_url_direction, tvb, offset, 4, direction,
1215                                         "Server Unspecified (%u)", direction);
1216             break;
1217     }
1218     offset += 4;
1219
1220     url_length = tvb_get_ntohl(tvb, offset);
1221     proto_tree_add_item(tree, hf_sflow_5_extended_url_url_length, tvb, offset, 4, ENC_BIG_ENDIAN);
1222     offset += 4;
1223
1224     /* extract URL char by char */
1225     proto_tree_add_item(tree, hf_sflow_5_extended_url_url, tvb, offset, url_length, ENC_NA|ENC_ASCII);
1226     offset += url_length;
1227     /* get the correct offset by adding padding byte count */
1228     if (url_length % 4)
1229         offset += (4 - url_length % 4);
1230
1231     host_length = tvb_get_ntohl(tvb, offset);
1232     proto_tree_add_item(tree, hf_sflow_5_extended_url_host_length, tvb, offset, 4, ENC_BIG_ENDIAN);
1233     offset += 4;
1234
1235     /* extract host info char by char */
1236     proto_tree_add_item(tree, hf_sflow_5_extended_url_host, tvb, offset, host_length, ENC_NA|ENC_ASCII);
1237     offset += host_length;
1238     /* get the correct offset by adding padding byte count */
1239     if (host_length % 4)
1240         offset += (4 - host_length % 4);
1241
1242     return offset;
1243 }
1244
1245 /* sflow v5 MPLS tunnel */
1246 static gint
1247 dissect_sflow_5_extended_mpls_tunnel(tvbuff_t *tvb, proto_tree *tree, gint offset) {
1248     guint32 name_length;
1249
1250     name_length = tvb_get_ntohl(tvb, offset);
1251     proto_tree_add_item(tree, hf_sflow_5_extended_mpls_tunnel_name_length, tvb, offset, 4, ENC_BIG_ENDIAN);
1252     offset += 4;
1253
1254     /* extract tunnel name char by char */
1255     proto_tree_add_item(tree, hf_sflow_5_extended_mpls_tunnel_name, tvb, offset, name_length, ENC_NA|ENC_ASCII);
1256     offset += name_length;
1257     /* get the correct offset by adding padding byte count */
1258     if (name_length % 4)
1259         offset += (4 - name_length % 4);
1260
1261     proto_tree_add_item(tree, hf_sflow_5_extended_mpls_tunnel_id, tvb, offset, 4, ENC_BIG_ENDIAN);
1262     offset += 4;
1263
1264     proto_tree_add_item(tree, hf_sflow_5_extended_mpls_tunnel_cos_value, tvb, offset, 4, ENC_BIG_ENDIAN);
1265     offset += 4;
1266
1267     return offset;
1268 }
1269
1270 /* sflow v5 MPLS VC */
1271 static gint
1272 dissect_sflow_5_extended_mpls_vc(tvbuff_t *tvb, proto_tree *tree, gint offset) {
1273     guint32 name_length;
1274
1275     name_length = tvb_get_ntohl(tvb, offset);
1276     proto_tree_add_item(tree, hf_sflow_5_extended_mpls_vc_instance_name_length, tvb, offset, 4, ENC_BIG_ENDIAN);
1277     offset += 4;
1278
1279     /* extract source user info char by char */
1280     proto_tree_add_item(tree, hf_sflow_5_extended_mpls_vc_instance_name, tvb, offset, name_length, ENC_NA|ENC_ASCII);
1281     offset += name_length;
1282     /* get the correct offset by adding padding byte count */
1283     if (name_length % 4)
1284         offset += (4 - name_length % 4);
1285
1286     proto_tree_add_item(tree, hf_sflow_5_extended_mpls_vc_id, tvb, offset, 4, ENC_BIG_ENDIAN);
1287     offset += 4;
1288
1289     proto_tree_add_item(tree, hf_sflow_5_extended_mpls_vc_label_cos_value, tvb, offset, 4, ENC_BIG_ENDIAN);
1290     offset += 4;
1291
1292     return offset;
1293 }
1294
1295 /* sflow v5 MPLS FEC */
1296 static gint
1297 dissect_sflow_5_extended_mpls_fec(tvbuff_t *tvb, proto_tree *tree, gint offset) {
1298     guint32 length;
1299
1300     length = tvb_get_ntohl(tvb, offset);
1301     proto_tree_add_item(tree, hf_sflow_5_extended_mpls_ftn_description_length, tvb, offset, 4, ENC_BIG_ENDIAN);
1302     offset += 4;
1303
1304     /* extract MPLS FTN description char by char */
1305     proto_tree_add_item(tree, hf_sflow_5_extended_mpls_ftn_description, tvb, offset, length, ENC_NA|ENC_ASCII);
1306     offset += length;
1307     /* get the correct offset by adding padding byte count */
1308     if (length % 4)
1309         offset += (4 - length % 4);
1310
1311     proto_tree_add_item(tree, hf_sflow_5_extended_mpls_ftn_mask, tvb, offset, 4, ENC_BIG_ENDIAN);
1312     offset += 4;
1313
1314     return offset;
1315 }
1316
1317 /* sflow v5 MPLS LVP FEC */
1318 static gint
1319 dissect_sflow_5_extended_mpls_lvp_fec(tvbuff_t *tvb, proto_tree *tree, gint offset) {
1320
1321     proto_tree_add_item(tree, hf_sflow_5_extended_mpls_fec_address_prefix_length, tvb, offset, 4, ENC_BIG_ENDIAN);
1322     offset += 4;
1323     return offset;
1324 }
1325
1326 /* sflow v5 extended VLAN tunnel */
1327 static gint
1328 dissect_sflow_5_extended_vlan_tunnel(tvbuff_t *tvb, proto_tree *tree, gint offset) {
1329     guint32 num, i;
1330
1331     num = tvb_get_ntohl(tvb, offset);
1332     proto_tree_add_item(tree, hf_sflow_5_extended_vlan_tunnel_number_of_layers, tvb, offset, 4, ENC_BIG_ENDIAN);
1333     offset += 4;
1334
1335     /* loop strip 802.1Q TPID/TCI layers. each TPID/TCI pair is represented as a
1336        single 32 bit integer layers listed from outermost to innermost */
1337     for (i = 0; i < num; i++) {
1338         proto_tree_add_item(tree, hf_sflow_5_extended_vlan_tunnel_tpid_tci_pair, tvb, offset, 4, ENC_BIG_ENDIAN);
1339         offset += 4;
1340     }
1341
1342     return offset;
1343 }
1344
1345 /* sflow v5 extended 802.11 payload */
1346 static gint
1347 dissect_sflow_5_extended_80211_payload(tvbuff_t *tvb, proto_tree *tree, gint offset) {
1348     guint32 cipher_suite, OUI, suite_type, length;
1349
1350     cipher_suite = tvb_get_ntohl(tvb, offset);
1351     OUI = cipher_suite >> 8;
1352     suite_type = cipher_suite & 0x000000ff;
1353
1354     if (OUI == 0x000FAC) {
1355         proto_tree_add_uint_format_value(tree, hf_sflow_5_extended_80211_oui, tvb, offset, 3, OUI, "Default (0x%X)", OUI);
1356         offset += 3;
1357         proto_tree_add_item(tree, hf_sflow_5_extended_80211_suite_type, tvb, offset, 1, ENC_NA);
1358     } else {
1359         proto_tree_add_uint_format_value(tree, hf_sflow_5_extended_80211_oui, tvb, offset, 3, OUI, "Other vender (0x%X)", OUI);
1360         offset += 3;
1361         proto_tree_add_uint_format_value(tree, hf_sflow_5_extended_80211_suite_type, tvb, offset, 1,
1362             suite_type, "Vender specific (%u)", suite_type);
1363     }
1364     offset++;
1365
1366     length = tvb_get_ntohl(tvb, offset);
1367     proto_tree_add_item(tree, hf_sflow_5_extended_80211_payload_length, tvb, offset, 4, ENC_BIG_ENDIAN);
1368     offset += 4;
1369
1370     /* extract data byte by byte */
1371     proto_tree_add_item(tree, hf_sflow_5_extended_80211_payload, tvb, offset, length, ENC_NA);
1372     offset += length;
1373     /* get the correct offset by adding padding byte count */
1374     if (length % 4)
1375         offset += (4 - length % 4);
1376
1377     return offset;
1378 }
1379
1380 /* sflow v5 extended 802.11 rx */
1381 static gint
1382 dissect_sflow_5_extended_80211_rx(tvbuff_t *tvb, proto_tree *tree, gint offset) {
1383     guint32 ssid_length, duration;
1384
1385     /* extract SSID char by char. max char count = 32 */
1386     ssid_length = tvb_get_ntohl(tvb, offset);
1387     offset += 4;
1388     proto_tree_add_item(tree, hf_sflow_5_extended_80211_rx_ssid, tvb, offset, ssid_length, ENC_NA|ENC_ASCII);
1389     offset += ssid_length;
1390     /* get the correct offset by adding padding byte count */
1391     if (ssid_length % 4)
1392         offset += (4 - ssid_length % 4);
1393
1394     proto_tree_add_item(tree, hf_sflow_5_extended_80211_rx_bssid, tvb, offset, 6, ENC_NA);
1395     /* Padded to 4 byte offset */
1396     offset += 8;
1397
1398     proto_tree_add_item(tree, hf_sflow_5_extended_80211_rx_version, tvb, offset, 4, ENC_BIG_ENDIAN);
1399     offset += 4;
1400
1401     proto_tree_add_item(tree, hf_sflow_5_extended_80211_rx_channel, tvb, offset, 4, ENC_BIG_ENDIAN);
1402     offset += 4;
1403
1404     proto_tree_add_item(tree, hf_sflow_5_extended_80211_rx_speed, tvb, offset, 8, ENC_BIG_ENDIAN);
1405     offset += 8;
1406
1407     proto_tree_add_item(tree, hf_sflow_5_extended_80211_rx_rsni, tvb, offset, 4, ENC_BIG_ENDIAN);
1408     offset += 4;
1409
1410     proto_tree_add_item(tree, hf_sflow_5_extended_80211_rx_rcpi, tvb, offset, 4, ENC_BIG_ENDIAN);
1411     offset += 4;
1412
1413     duration = tvb_get_ntohl(tvb, offset);
1414     if (duration == 0) {
1415         proto_tree_add_uint_format_value(tree, hf_sflow_5_extended_80211_rx_packet_duration, tvb, offset, 4, duration, "Unknown");
1416     } else {
1417         proto_tree_add_item(tree, hf_sflow_5_extended_80211_rx_packet_duration, tvb, offset, 4, ENC_BIG_ENDIAN);
1418     }
1419     offset += 4;
1420
1421     return offset;
1422 }
1423
1424 /* sflow v5 extended 802.11 tx */
1425 static gint
1426 dissect_sflow_5_extended_80211_tx(tvbuff_t *tvb, proto_tree *tree, gint offset) {
1427     guint32 ssid_length, transmissions, packet_duration, retrans_duration;
1428
1429     /* extract SSID char by char. max char count = 32 */
1430     ssid_length = tvb_get_ntohl(tvb, offset);
1431     if (ssid_length > 32)
1432         ssid_length = 32;
1433     offset += 4;
1434     proto_tree_add_item(tree, hf_sflow_5_extended_80211_tx_ssid, tvb, offset, ssid_length, ENC_NA|ENC_ASCII);
1435     offset += ssid_length;
1436     /* get the correct offset by adding padding byte count */
1437     if (ssid_length % 4)
1438         offset += (4 - ssid_length % 4);
1439
1440     proto_tree_add_item(tree, hf_sflow_5_extended_80211_tx_bssid, tvb, offset, 6, ENC_NA);
1441     /* Padded to 4 byte offset */
1442     offset += 8;
1443
1444     proto_tree_add_item(tree, hf_sflow_5_extended_80211_tx_version, tvb, offset, 4, ENC_BIG_ENDIAN);
1445     offset += 4;
1446
1447     transmissions = tvb_get_ntohl(tvb, offset);
1448     switch (transmissions) {
1449         case 0:
1450             proto_tree_add_uint_format_value(tree, hf_sflow_5_extended_80211_tx_retransmissions, tvb, offset, 4,
1451                     0, "Unknown");
1452             break;
1453         case 1:
1454             proto_tree_add_uint_format_value(tree, hf_sflow_5_extended_80211_tx_retransmissions, tvb, offset, 4,
1455                     1, "Packet transmitted sucessfully on first attempt");
1456             break;
1457         default:
1458             proto_tree_add_uint(tree, hf_sflow_5_extended_80211_tx_retransmissions, tvb, offset, 4, transmissions - 1);
1459             break;
1460     }
1461     offset += 4;
1462
1463     packet_duration = tvb_get_ntohl(tvb, offset);
1464     if (packet_duration == 0) {
1465         proto_tree_add_uint_format_value(tree, hf_sflow_5_extended_80211_tx_packet_duration, tvb, offset, 4, packet_duration, "Unknown");
1466     } else {
1467         proto_tree_add_item(tree, hf_sflow_5_extended_80211_tx_packet_duration, tvb, offset, 4, ENC_BIG_ENDIAN);
1468     }
1469     offset += 4;
1470
1471     retrans_duration = tvb_get_ntohl(tvb, offset);
1472     if (retrans_duration == 0) {
1473         proto_tree_add_uint_format_value(tree, hf_sflow_5_extended_80211_tx_retransmission_duration, tvb, offset, 4, retrans_duration, "Unknown");
1474     } else {
1475         proto_tree_add_item(tree, hf_sflow_5_extended_80211_tx_retransmission_duration, tvb, offset, 4, ENC_BIG_ENDIAN);
1476     }
1477     offset += 4;
1478
1479     proto_tree_add_item(tree, hf_sflow_5_extended_80211_tx_channel, tvb, offset, 4, ENC_BIG_ENDIAN);
1480     offset += 4;
1481
1482     proto_tree_add_item(tree, hf_sflow_5_extended_80211_tx_speed, tvb, offset, 8, ENC_BIG_ENDIAN);
1483     offset += 8;
1484
1485     proto_tree_add_item(tree, hf_sflow_5_extended_80211_tx_power, tvb, offset, 4, ENC_BIG_ENDIAN);
1486     offset += 4;
1487
1488     return offset;
1489 }
1490
1491 /* sflow v5 extended 802.11 aggregation */
1492 static gint
1493 dissect_sflow_5_extended_80211_aggregation(tvbuff_t *tvb _U_, proto_tree *tree _U_, gint offset) {
1494
1495     return offset;
1496 }
1497
1498 /* dissect an sflow v2/4 flow sample */
1499 static gint
1500 dissect_sflow_24_flow_sample(tvbuff_t *tvb, packet_info *pinfo,
1501         proto_tree *tree, gint offset, proto_item *parent) {
1502     guint32 sequence_number, sampling_rate, sample_pool, output;
1503
1504     proto_tree *extended_data_tree;
1505     proto_item *ti;
1506     guint32 packet_type, extended_data, ext_type, i;
1507
1508     sequence_number = tvb_get_ntohl(tvb, offset);
1509     proto_tree_add_item(tree, hf_sflow_flow_sample_sequence_number, tvb, offset, 4, ENC_BIG_ENDIAN);
1510     proto_item_append_text(parent, ", seq %u", sequence_number);
1511     proto_tree_add_item(tree, hf_sflow_flow_sample_source_id_class, tvb, offset + 4, 4, ENC_BIG_ENDIAN);
1512     proto_tree_add_item(tree, hf_sflow_flow_sample_index, tvb, offset + 4, 4, ENC_BIG_ENDIAN);
1513     sampling_rate = tvb_get_ntohl(tvb, offset + 8);
1514     proto_tree_add_uint_format_value(tree, hf_sflow_flow_sample_sampling_rate, tvb, offset + 8, 4,
1515             sampling_rate, "1 out of %u packets",
1516             sampling_rate);
1517     sample_pool = tvb_get_ntohl(tvb, offset + 12);
1518     proto_tree_add_uint_format_value(tree, hf_sflow_flow_sample_sample_pool, tvb, offset + 12, 4,
1519             sample_pool, "%u total packets",
1520             sample_pool);
1521     proto_tree_add_item(tree, hf_sflow_flow_sample_dropped_packets, tvb, offset + 16, 4, ENC_BIG_ENDIAN);
1522     proto_tree_add_item(tree, hf_sflow_flow_sample_input_interface, tvb, offset + 20, 4, ENC_BIG_ENDIAN);
1523     output = tvb_get_ntohl(tvb, offset + 24);
1524     if (output & 0x80000000) {
1525         output & 0x7fffffff ?
1526             proto_tree_add_uint_format_value(tree, hf_sflow_flow_sample_multiple_outputs, tvb, offset + 24, 4,
1527                 output & 0x7fffffff, "%u interfaces", output & 0x7fffffff) :
1528             proto_tree_add_uint_format_value(tree, hf_sflow_flow_sample_multiple_outputs, tvb, offset + 24, 4,
1529                 0x80000000, "unknown number");
1530     } else {
1531         proto_tree_add_item(tree, hf_sflow_flow_sample_output_interface, tvb, offset + 24, 4, ENC_BIG_ENDIAN);
1532     }
1533     offset += 28;
1534
1535     /* what kind of flow sample is it? */
1536     packet_type = tvb_get_ntohl(tvb, offset);
1537     proto_tree_add_item(tree, hf_sflow_245_packet_information_type, tvb, offset, 4, ENC_BIG_ENDIAN);
1538     offset += 4;
1539     switch (packet_type) {
1540         case SFLOW_245_PACKET_DATA_TYPE_HEADER:
1541             offset = dissect_sflow_245_sampled_header(tvb, pinfo, tree, offset);
1542             break;
1543         case SFLOW_245_PACKET_DATA_TYPE_IPV4:
1544         case SFLOW_245_PACKET_DATA_TYPE_IPV6:
1545         default:
1546             break;
1547     }
1548     /* still need to dissect extended data */
1549     extended_data = tvb_get_ntohl(tvb, offset);
1550     offset += 4;
1551
1552     for (i = 0; i < extended_data; i++) {
1553         /* figure out what kind of extended data it is */
1554         ext_type = tvb_get_ntohl(tvb, offset);
1555
1556         /* create a subtree.  Might want to move this to
1557          * the end, so more info can be correct.
1558          */
1559         ti = proto_tree_add_uint(tree, hf_sflow_245_extended_information_type, tvb, offset, 4, ext_type);
1560         extended_data_tree = proto_item_add_subtree(ti, ett_sflow_245_extended_data);
1561         offset += 4;
1562
1563         switch (ext_type) {
1564             case SFLOW_245_EXTENDED_SWITCH:
1565                 offset = dissect_sflow_245_extended_switch(tvb, extended_data_tree, offset);
1566                 break;
1567             case SFLOW_245_EXTENDED_ROUTER:
1568                 offset = dissect_sflow_245_extended_router(tvb, pinfo, extended_data_tree, offset);
1569                 break;
1570             case SFLOW_245_EXTENDED_GATEWAY:
1571                 offset = dissect_sflow_245_extended_gateway(tvb, pinfo, extended_data_tree, offset);
1572                 break;
1573             case SFLOW_245_EXTENDED_USER:
1574                 break;
1575             case SFLOW_245_EXTENDED_URL:
1576                 break;
1577             default:
1578                 break;
1579         }
1580         proto_item_set_end(ti, tvb, offset);
1581     }
1582     return offset;
1583
1584 }
1585
1586 /* dissect an sflow v5 flow record */
1587 static gint
1588 dissect_sflow_5_flow_record(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset) {
1589     proto_tree *flow_data_tree;
1590     proto_item *ti;
1591     guint32 enterprise_format, enterprise, format;
1592
1593     /* what kind of flow sample is it? */
1594     enterprise_format = tvb_get_ntohl(tvb, offset);
1595     enterprise = enterprise_format >> 12;
1596     format = enterprise_format & 0x00000fff;
1597
1598     /* only accept default enterprise 0 (InMon sFlow) */
1599     if (enterprise == ENTERPRISE_DEFAULT) {
1600         ti = proto_tree_add_text(tree, tvb, offset, -1, "%s",
1601                 val_to_str_const(format, sflow_5_flow_record_type, "Unknown sample format"));
1602         flow_data_tree = proto_item_add_subtree(ti, ett_sflow_5_flow_record);
1603
1604         proto_tree_add_uint_format_value(flow_data_tree, hf_sflow_enterprise, tvb, offset, 4,
1605                             enterprise, "standard sFlow (%u)", enterprise);
1606         proto_tree_add_item(flow_data_tree, hf_sflow_5_flow_record_format, tvb, offset, 4, ENC_BIG_ENDIAN);
1607         offset += 4;
1608
1609         proto_tree_add_item(flow_data_tree, hf_sflow_5_flow_data_length, tvb, offset, 4, ENC_BIG_ENDIAN);
1610         offset += 4;
1611
1612         switch (format) {
1613             case SFLOW_5_RAW_PACKET_HEADER:
1614                 offset = dissect_sflow_245_sampled_header(tvb, pinfo, flow_data_tree, offset);
1615                 break;
1616             case SFLOW_5_ETHERNET_FRAME:
1617                 offset = dissect_sflow_5_ethernet_frame(tvb, flow_data_tree, offset);
1618                 break;
1619             case SFLOW_5_IPV4:
1620                 offset = dissect_sflow_5_ipv4(tvb, flow_data_tree, offset);
1621                 break;
1622             case SFLOW_5_IPV6:
1623                 offset = dissect_sflow_5_ipv6(tvb, flow_data_tree, offset);
1624                 break;
1625             case SFLOW_5_SWITCH:
1626                 offset = dissect_sflow_245_extended_switch(tvb, flow_data_tree, offset);
1627                 break;
1628             case SFLOW_5_ROUTER:
1629                 offset = dissect_sflow_245_extended_router(tvb, pinfo, flow_data_tree, offset);
1630                 break;
1631             case SFLOW_5_GATEWAY:
1632                 offset = dissect_sflow_245_extended_gateway(tvb, pinfo, flow_data_tree, offset);
1633                 break;
1634             case SFLOW_5_USER:
1635                 offset = dissect_sflow_5_extended_user(tvb, flow_data_tree, offset);
1636                 break;
1637             case SFLOW_5_URL:
1638                 offset = dissect_sflow_5_extended_url(tvb, flow_data_tree, offset);
1639                 break;
1640             case SFLOW_5_MPLS_DATA:
1641                 offset = dissect_sflow_5_extended_mpls_data(tvb, pinfo, flow_data_tree, offset);
1642                 break;
1643             case SFLOW_5_NAT:
1644                 offset = dissect_sflow_5_extended_nat(tvb, pinfo, flow_data_tree, offset);
1645                 break;
1646             case SFLOW_5_MPLS_TUNNEL:
1647                 offset = dissect_sflow_5_extended_mpls_tunnel(tvb, flow_data_tree, offset);
1648                 break;
1649             case SFLOW_5_MPLS_VC:
1650                 offset = dissect_sflow_5_extended_mpls_vc(tvb, flow_data_tree, offset);
1651                 break;
1652             case SFLOW_5_MPLS_FEC:
1653                 offset = dissect_sflow_5_extended_mpls_fec(tvb, flow_data_tree, offset);
1654                 break;
1655             case SFLOW_5_MPLS_LVP_FEC:
1656                 offset = dissect_sflow_5_extended_mpls_lvp_fec(tvb, flow_data_tree, offset);
1657                 break;
1658             case SFLOW_5_VLAN_TUNNEL:
1659                 offset = dissect_sflow_5_extended_vlan_tunnel(tvb, flow_data_tree, offset);
1660                 break;
1661             case SFLOW_5_80211_PAYLOAD:
1662                 offset = dissect_sflow_5_extended_80211_payload(tvb, flow_data_tree, offset);
1663                 break;
1664             case SFLOW_5_80211_RX:
1665                 offset = dissect_sflow_5_extended_80211_rx(tvb, flow_data_tree, offset);
1666                 break;
1667             case SFLOW_5_80211_TX:
1668                 offset = dissect_sflow_5_extended_80211_tx(tvb, flow_data_tree, offset);
1669                 break;
1670             case SFLOW_5_80211_AGGREGATION:
1671                 offset = dissect_sflow_5_extended_80211_aggregation(tvb, flow_data_tree, offset);
1672                 break;
1673             default:
1674                 break;
1675         }
1676     } else {
1677         /* unknown enterprise format, what to do?? */
1678         ti = proto_tree_add_text(tree, tvb, offset, -1, "Unknown enterprise format");
1679         flow_data_tree = proto_item_add_subtree(ti, ett_sflow_5_flow_record);
1680         proto_tree_add_uint_format_value(flow_data_tree, hf_sflow_enterprise, tvb, offset, -1,
1681                                     enterprise, "Non-standard sFlow (%u)", enterprise);
1682     }
1683     proto_item_set_end(ti, tvb, offset);
1684
1685     return offset;
1686 }
1687
1688 /* dissect generic interface counters */
1689 static gint
1690 dissect_sflow_5_generic_interface(proto_tree *counter_data_tree, tvbuff_t *tvb, gint offset) {
1691
1692     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifindex, tvb, offset, 4, ENC_BIG_ENDIAN);
1693     offset += 4;
1694     proto_tree_add_item(counter_data_tree, hf_sflow_245_iftype, tvb, offset, 4, ENC_BIG_ENDIAN);
1695     offset += 4;
1696     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifspeed, tvb, offset, 8, ENC_BIG_ENDIAN);
1697     offset += 8;
1698     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifdirection, tvb, offset, 4, ENC_BIG_ENDIAN);
1699     offset += 4;
1700     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifadmin_status, tvb, offset, 4, ENC_BIG_ENDIAN);
1701     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifoper_status, tvb, offset, 4, ENC_BIG_ENDIAN);
1702     offset += 4;
1703     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifinoct, tvb, offset, 8, ENC_BIG_ENDIAN);
1704     offset += 8;
1705     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifinpkt, tvb, offset, 4, ENC_BIG_ENDIAN);
1706     offset += 4;
1707     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifinmcast, tvb, offset, 4, ENC_BIG_ENDIAN);
1708     offset += 4;
1709     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifinbcast, tvb, offset, 4, ENC_BIG_ENDIAN);
1710     offset += 4;
1711     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifindisc, tvb, offset, 4, ENC_BIG_ENDIAN);
1712     offset += 4;
1713     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifinerr, tvb, offset, 4, ENC_BIG_ENDIAN);
1714     offset += 4;
1715     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifinunk, tvb, offset, 4, ENC_BIG_ENDIAN);
1716     offset += 4;
1717     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifoutoct, tvb, offset, 8, ENC_BIG_ENDIAN);
1718     offset += 8;
1719     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifoutpkt, tvb, offset, 4, ENC_BIG_ENDIAN);
1720     offset += 4;
1721     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifoutmcast, tvb, offset, 4, ENC_BIG_ENDIAN);
1722     offset += 4;
1723     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifoutbcast, tvb, offset, 4, ENC_BIG_ENDIAN);
1724     offset += 4;
1725     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifoutdisc, tvb, offset, 4, ENC_BIG_ENDIAN);
1726     offset += 4;
1727     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifouterr, tvb, offset, 4, ENC_BIG_ENDIAN);
1728     offset += 4;
1729     proto_tree_add_item(counter_data_tree, hf_sflow_245_ifpromisc, tvb, offset, 4, ENC_BIG_ENDIAN);
1730     offset += 4;
1731
1732     return offset;
1733 }
1734
1735 /* dissect ethernet interface counters */
1736 static gint
1737 dissect_sflow_5_ethernet_interface(proto_tree *counter_data_tree, tvbuff_t *tvb, gint offset) {
1738
1739     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot3StatsAlignmentErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1740     offset += 4;
1741     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot3StatsFCSErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1742     offset += 4;
1743     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot3StatsSingleCollisionFrames, tvb, offset, 4, ENC_BIG_ENDIAN);
1744     offset += 4;
1745     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot3StatsMultipleCollisionFrames, tvb, offset, 4, ENC_BIG_ENDIAN);
1746     offset += 4;
1747     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot3StatsSQETestErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1748     offset += 4;
1749     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot3StatsDeferredTransmissions, tvb, offset, 4, ENC_BIG_ENDIAN);
1750     offset += 4;
1751     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot3StatsLateCollisions, tvb, offset, 4, ENC_BIG_ENDIAN);
1752     offset += 4;
1753     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot3StatsExcessiveCollisions, tvb, offset, 4, ENC_BIG_ENDIAN);
1754     offset += 4;
1755     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot3StatsInternalMacTransmitErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1756     offset += 4;
1757     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot3StatsCarrierSenseErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1758     offset += 4;
1759     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot3StatsFrameTooLongs, tvb, offset, 4, ENC_BIG_ENDIAN);
1760     offset += 4;
1761     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot3StatsInternalMacReceiveErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1762     offset += 4;
1763     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot3StatsSymbolErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1764     offset += 4;
1765
1766     return offset;
1767 }
1768
1769 /* dissect token ring counters */
1770 static gint
1771 dissect_sflow_5_token_ring(proto_tree *counter_data_tree, tvbuff_t *tvb, gint offset) {
1772
1773     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot5StatsLineErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1774     offset += 4;
1775     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot5StatsBurstErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1776     offset += 4;
1777     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot5StatsACErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1778     offset += 4;
1779     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot5StatsAbortTransErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1780     offset += 4;
1781     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot5StatsInternalErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1782     offset += 4;
1783     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot5StatsLostFrameErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1784     offset += 4;
1785     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot5StatsReceiveCongestions, tvb, offset, 4, ENC_BIG_ENDIAN);
1786     offset += 4;
1787     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot5StatsFrameCopiedErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1788     offset += 4;
1789     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot5StatsTokenErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1790     offset += 4;
1791     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot5StatsSoftErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1792     offset += 4;
1793     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot5StatsHardErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1794     offset += 4;
1795     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot5StatsSignalLoss, tvb, offset, 4, ENC_BIG_ENDIAN);
1796     offset += 4;
1797     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot5StatsTransmitBeacons, tvb, offset, 4, ENC_BIG_ENDIAN);
1798     offset += 4;
1799     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot5StatsRecoveries, tvb, offset, 4, ENC_BIG_ENDIAN);
1800     offset += 4;
1801     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot5StatsLobeWires, tvb, offset, 4, ENC_BIG_ENDIAN);
1802     offset += 4;
1803     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot5StatsRemoves, tvb, offset, 4, ENC_BIG_ENDIAN);
1804     offset += 4;
1805     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot5StatsSingles, tvb, offset, 4, ENC_BIG_ENDIAN);
1806     offset += 4;
1807     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot5StatsFreqErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1808     offset += 4;
1809
1810     return offset;
1811 }
1812
1813 /* dissect 100 BaseVG interface counters */
1814 static gint
1815 dissect_sflow_5_vg_interface(proto_tree *counter_data_tree, tvbuff_t *tvb, gint offset) {
1816
1817     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot12InHighPriorityFrames, tvb, offset, 4, ENC_BIG_ENDIAN);
1818     offset += 4;
1819     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot12InHighPriorityOctets, tvb, offset, 8, ENC_BIG_ENDIAN);
1820     offset += 8;
1821     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot12InNormPriorityFrames, tvb, offset, 4, ENC_BIG_ENDIAN);
1822     offset += 4;
1823     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot12InNormPriorityOctets, tvb, offset, 8, ENC_BIG_ENDIAN);
1824     offset += 8;
1825     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot12InIPMErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1826     offset += 4;
1827     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot12InOversizeFrameErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1828     offset += 4;
1829     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot12InDataErrors, tvb, offset, 4, ENC_BIG_ENDIAN);
1830     offset += 4;
1831     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot12InNullAddressedFrames, tvb, offset, 4, ENC_BIG_ENDIAN);
1832     offset += 4;
1833     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot12OutHighPriorityFrames, tvb, offset, 4, ENC_BIG_ENDIAN);
1834     offset += 4;
1835     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot12OutHighPriorityOctets, tvb, offset, 8, ENC_BIG_ENDIAN);
1836     offset += 8;
1837     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot12TransitionIntoTrainings, tvb, offset, 4, ENC_BIG_ENDIAN);
1838     offset += 4;
1839     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot12HCInHighPriorityOctets, tvb, offset, 8, ENC_BIG_ENDIAN);
1840     offset += 8;
1841     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot12HCInNormPriorityOctets, tvb, offset, 8, ENC_BIG_ENDIAN);
1842     offset += 8;
1843     proto_tree_add_item(counter_data_tree, hf_sflow_245_dot12HCOutHighPriorityOctets, tvb, offset, 8, ENC_BIG_ENDIAN);
1844     offset += 8;
1845
1846     return offset;
1847 }
1848
1849 /* dissect VLAN counters */
1850 static gint
1851 dissect_sflow_5_vlan(proto_tree *counter_data_tree, tvbuff_t *tvb, gint offset) {
1852
1853     proto_tree_add_item(counter_data_tree, hf_sflow_245_vlan_id, tvb, offset, 4, ENC_BIG_ENDIAN);
1854     offset += 4;
1855     proto_tree_add_item(counter_data_tree, hf_sflow_245_octets, tvb, offset, 8, ENC_BIG_ENDIAN);
1856     offset += 8;
1857     proto_tree_add_item(counter_data_tree, hf_sflow_245_ucastPkts, tvb, offset, 4, ENC_BIG_ENDIAN);
1858     offset += 4;
1859     proto_tree_add_item(counter_data_tree, hf_sflow_245_multicastPkts, tvb, offset, 4, ENC_BIG_ENDIAN);
1860     offset += 4;
1861     proto_tree_add_item(counter_data_tree, hf_sflow_245_broadcastPkts, tvb, offset, 4, ENC_BIG_ENDIAN);
1862     offset += 4;
1863     proto_tree_add_item(counter_data_tree, hf_sflow_245_discards, tvb, offset, 4, ENC_BIG_ENDIAN);
1864     offset += 4;
1865
1866     return offset;
1867 }
1868
1869 /* dissect 802.11 counters */
1870 static gint
1871 dissect_sflow_5_80211_counters(proto_tree *counter_data_tree, tvbuff_t *tvb, gint offset) {
1872
1873     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11TransmittedFragmentCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1874     offset += 4;
1875     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11MulticastTransmittedFrameCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1876     offset += 4;
1877     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11FailedCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1878     offset += 4;
1879     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11RetryCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1880     offset += 4;
1881     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11MultipleRetryCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1882     offset += 4;
1883     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11FrameDuplicateCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1884     offset += 4;
1885     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11RTSSuccessCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1886     offset += 4;
1887     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11RTSFailureCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1888     offset += 4;
1889     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11ACKFailureCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1890     offset += 4;
1891     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11ReceivedFragmentCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1892     offset += 4;
1893     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11MulticastReceivedFrameCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1894     offset += 4;
1895     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11FCSErrorCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1896     offset += 4;
1897     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11TransmittedFrameCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1898     offset += 4;
1899     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11WEPUndecryptableCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1900     offset += 4;
1901     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11QoSDiscardedFragmentCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1902     offset += 4;
1903     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11AssociatedStationCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1904     offset += 4;
1905     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11QoSCFPollsReceivedCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1906     offset += 4;
1907     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11QoSCFPollsUnusedCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1908     offset += 4;
1909     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11QoSCFPollsUnusableCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1910     offset += 4;
1911     proto_tree_add_item(counter_data_tree, hf_sflow_5_dot11QoSCFPollsLostCount, tvb, offset, 4, ENC_BIG_ENDIAN);
1912     offset += 4;
1913
1914     return offset;
1915 }
1916
1917 /* dissect processor information */
1918 static gint
1919 dissect_sflow_5_processor_information(proto_tree *counter_data_tree, tvbuff_t *tvb, gint offset) {
1920
1921     proto_tree_add_item(counter_data_tree, hf_sflow_5_cpu_5s, tvb, offset, 4, ENC_BIG_ENDIAN);
1922     offset += 4;
1923     proto_tree_add_item(counter_data_tree, hf_sflow_5_cpu_1m, tvb, offset, 4, ENC_BIG_ENDIAN);
1924     offset += 4;
1925     proto_tree_add_item(counter_data_tree, hf_sflow_5_cpu_5m, tvb, offset, 4, ENC_BIG_ENDIAN);
1926     offset += 4;
1927     proto_tree_add_item(counter_data_tree, hf_sflow_5_total_memory, tvb, offset, 8, ENC_BIG_ENDIAN);
1928     offset += 8;
1929     proto_tree_add_item(counter_data_tree, hf_sflow_5_free_memory, tvb, offset, 8, ENC_BIG_ENDIAN);
1930     offset += 8;
1931
1932     return offset;
1933 }
1934
1935 /* dissect radio utilization */
1936 static gint
1937 dissect_sflow_5_radio_utilization(proto_tree *counter_data_tree, tvbuff_t *tvb, gint offset) {
1938
1939     proto_tree_add_item(counter_data_tree, hf_sflow_5_elapsed_time, tvb, offset, 4, ENC_BIG_ENDIAN);
1940     offset += 4;
1941     proto_tree_add_item(counter_data_tree, hf_sflow_5_on_channel_time, tvb, offset, 4, ENC_BIG_ENDIAN);
1942     offset += 4;
1943     proto_tree_add_item(counter_data_tree, hf_sflow_5_on_channel_busy_time, tvb, offset, 4, ENC_BIG_ENDIAN);
1944     offset += 4;
1945
1946     return offset;
1947 }
1948
1949 /* dissect an sflow v5 counters record */
1950 static gint
1951 dissect_sflow_5_counters_record(tvbuff_t *tvb, proto_tree *tree, gint offset) {
1952     proto_tree *counter_data_tree;
1953     proto_item *ti;
1954     guint32 enterprise_format, enterprise, format;
1955
1956     /* what kind of flow sample is it? */
1957     enterprise_format = tvb_get_ntohl(tvb, offset);
1958     enterprise = enterprise_format >> 12;
1959     format = enterprise_format & 0x00000fff;
1960
1961     if (enterprise == ENTERPRISE_DEFAULT) { /* only accept default enterprise 0 (InMon sFlow) */
1962         ti = proto_tree_add_text(tree, tvb, offset, -1, "%s",
1963                 val_to_str_const(format, sflow_5_counters_record_type, "Unknown sample format"));
1964         counter_data_tree = proto_item_add_subtree(ti, ett_sflow_5_counters_record);
1965
1966         proto_tree_add_uint_format_value(counter_data_tree, hf_sflow_enterprise, tvb, offset, 4,
1967                                 enterprise, "standard sFlow (%u)", enterprise);
1968
1969         proto_tree_add_item(counter_data_tree, hf_sflow_5_counters_record_format, tvb, offset, 4, ENC_BIG_ENDIAN);
1970         offset += 4;
1971
1972         proto_tree_add_item(counter_data_tree, hf_sflow_5_flow_data_length, tvb, offset, 4, ENC_BIG_ENDIAN);
1973         offset += 4;
1974
1975         switch (format) {
1976             case SFLOW_5_GENERIC_INTERFACE:
1977                 offset = dissect_sflow_5_generic_interface(counter_data_tree, tvb, offset);
1978                 break;
1979             case SFLOW_5_ETHERNET_INTERFACE:
1980                 offset = dissect_sflow_5_ethernet_interface(counter_data_tree, tvb, offset);
1981                 break;
1982             case SFLOW_5_TOKEN_RING:
1983                 offset = dissect_sflow_5_token_ring(counter_data_tree, tvb, offset);
1984                 break;
1985             case SFLOW_5_100BASE_VG_INTERFACE:
1986                 offset = dissect_sflow_5_vg_interface(counter_data_tree, tvb, offset);
1987                 break;
1988             case SFLOW_5_VLAN:
1989                 offset = dissect_sflow_5_vlan(counter_data_tree, tvb, offset);
1990                 break;
1991             case SFLOW_5_80211_COUNTERS:
1992                 offset = dissect_sflow_5_80211_counters(counter_data_tree, tvb, offset);
1993                 break;
1994             case SFLOW_5_PROCESSOR:
1995                 offset = dissect_sflow_5_processor_information(counter_data_tree, tvb, offset);
1996                 break;
1997             case SFLOW_5_RADIO_UTILIZATION:
1998                 offset = dissect_sflow_5_radio_utilization(counter_data_tree, tvb, offset);
1999                 break;
2000             default:
2001                 break;
2002         }
2003     } else { /* unknown enterprise format, what to do?? */
2004         ti = proto_tree_add_text(tree, tvb, offset, -1, "Unknown enterprise format");
2005         counter_data_tree = proto_item_add_subtree(ti, ett_sflow_5_counters_record);
2006         proto_tree_add_uint_format_value(counter_data_tree, hf_sflow_enterprise, tvb, offset, -1,
2007                         enterprise, "Non-standard sFlow (%u)", enterprise);
2008     }
2009     proto_item_set_end(ti, tvb, offset);
2010
2011     return offset;
2012 }
2013
2014 /* dissect an sflow v5 flow sample */
2015 static void
2016 dissect_sflow_5_flow_sample(tvbuff_t *tvb, packet_info *pinfo,
2017         proto_tree *tree, gint offset, proto_item *parent) {
2018
2019     guint32 sequence_number, sampling_rate, sample_pool,
2020             output, records, i;
2021
2022     sequence_number = tvb_get_ntohl(tvb, offset);
2023     proto_tree_add_item(tree, hf_sflow_flow_sample_sequence_number, tvb, offset, 4, ENC_BIG_ENDIAN);
2024     offset += 4;
2025     proto_item_append_text(parent, ", seq %u", sequence_number);
2026
2027     proto_tree_add_item(tree, hf_sflow_flow_sample_source_id_class, tvb, offset, 4, ENC_BIG_ENDIAN);
2028     proto_tree_add_item(tree, hf_sflow_flow_sample_index, tvb, offset, 4, ENC_BIG_ENDIAN);
2029     offset += 4;
2030     sampling_rate = tvb_get_ntohl(tvb, offset);
2031     proto_tree_add_uint_format_value(tree, hf_sflow_flow_sample_sampling_rate, tvb, offset, 4,
2032             sampling_rate, "1 out of %u packets", sampling_rate);
2033     offset += 4;
2034     sample_pool = tvb_get_ntohl(tvb, offset);
2035     proto_tree_add_uint_format_value(tree, hf_sflow_flow_sample_sample_pool, tvb, offset, 4,
2036             sample_pool, "%u total packets", sample_pool);
2037     offset += 4;
2038     proto_tree_add_item(tree, hf_sflow_flow_sample_dropped_packets, tvb, offset, 4, ENC_BIG_ENDIAN);
2039     offset += 4;
2040     proto_tree_add_item(tree, hf_sflow_flow_sample_input_interface, tvb, offset, 4, ENC_BIG_ENDIAN);
2041     offset += 4;
2042     output = tvb_get_ntohl(tvb, offset);
2043     if (output & 0x80000000) {
2044         output & 0x7fffffff ?
2045             proto_tree_add_uint_format_value(tree, hf_sflow_flow_sample_multiple_outputs, tvb, offset, 4,
2046                 output & 0x7fffffff, "%u interfaces", output & 0x7fffffff) :
2047             proto_tree_add_uint_format_value(tree, hf_sflow_flow_sample_multiple_outputs, tvb, offset, 4,
2048                 0x80000000, "unknown number");
2049     } else {
2050         proto_tree_add_item(tree, hf_sflow_flow_sample_output_interface, tvb, offset, 4, ENC_BIG_ENDIAN);
2051     }
2052     offset += 4;
2053     records = tvb_get_ntohl(tvb, offset);
2054     proto_tree_add_item(tree, hf_sflow_flow_sample_flow_record, tvb, offset, 4, ENC_BIG_ENDIAN);
2055     offset += 4;
2056
2057     /* start loop processing flow records */
2058     /* we set an upper records limit to 255 in case corrupted data causes
2059      * huge number of loops! */
2060     for (i = 0; i < (records&0x000000ff); i++) {
2061         offset = dissect_sflow_5_flow_record(tvb, pinfo, tree, offset);
2062     }
2063
2064 }
2065
2066 /* dissect an expanded flow sample */
2067 static void
2068 dissect_sflow_5_expanded_flow_sample(tvbuff_t *tvb, packet_info *pinfo,
2069         proto_tree *tree, gint offset, proto_item *parent) {
2070
2071     guint32 sequence_number, sampling_rate, sample_pool, records, i;
2072
2073     sequence_number = tvb_get_ntohl(tvb, offset);
2074     proto_tree_add_item(tree, hf_sflow_flow_sample_sequence_number, tvb, offset, 4, ENC_BIG_ENDIAN);
2075     offset += 4;
2076     proto_item_append_text(parent, ", seq %u", sequence_number);
2077     proto_tree_add_item(tree, hf_sflow_flow_sample_source_id_type, tvb, offset, 4, ENC_BIG_ENDIAN);
2078     offset += 4;
2079     proto_tree_add_item(tree, hf_sflow_flow_sample_source_id_index, tvb, offset, 4, ENC_BIG_ENDIAN);
2080     offset += 4;
2081     sampling_rate = tvb_get_ntohl(tvb, offset);
2082     proto_tree_add_uint_format_value(tree, hf_sflow_flow_sample_sampling_rate, tvb, offset, 4,
2083             sampling_rate, "1 out of %u packets", sampling_rate);
2084     offset += 4;
2085     sample_pool = tvb_get_ntohl(tvb, offset);
2086     proto_tree_add_uint_format_value(tree, hf_sflow_flow_sample_sample_pool, tvb, offset, 4,
2087             sample_pool, "%u total packets", sample_pool);
2088     offset += 4;
2089     proto_tree_add_item(tree, hf_sflow_flow_sample_dropped_packets, tvb, offset, 4, ENC_BIG_ENDIAN);
2090     offset += 4;
2091     proto_tree_add_item(tree, hf_sflow_flow_sample_input_interface_format, tvb, offset, 4, ENC_BIG_ENDIAN);
2092     offset += 4;
2093     proto_tree_add_item(tree, hf_sflow_flow_sample_input_interface_value, tvb, offset, 4, ENC_BIG_ENDIAN);
2094     offset += 4;
2095     proto_tree_add_item(tree, hf_sflow_flow_sample_output_interface_format, tvb, offset, 4, ENC_BIG_ENDIAN);
2096     offset += 4;
2097     proto_tree_add_item(tree, hf_sflow_flow_sample_output_interface_value, tvb, offset, 4, ENC_BIG_ENDIAN);
2098     offset += 4;
2099     records = tvb_get_ntohl(tvb, offset);
2100     proto_tree_add_item(tree, hf_sflow_flow_sample_flow_record, tvb, offset, 4, ENC_BIG_ENDIAN);
2101     offset += 4;
2102
2103     /* start loop processing flow records
2104      * we limit record count to 255 in case corrupted data may cause huge number of loops */
2105     for (i = 0; i < (records&0x000000ff); i++) {
2106         offset = dissect_sflow_5_flow_record(tvb, pinfo, tree, offset);
2107     }
2108 }
2109
2110 /* dissect an sflow v2/4 counters sample */
2111 static gint
2112 dissect_sflow_24_counters_sample(tvbuff_t *tvb, proto_tree *tree, gint offset, proto_item *parent) {
2113
2114     guint32 sequence_number, counters_type;
2115
2116     sequence_number = tvb_get_ntohl(tvb, offset);
2117     proto_tree_add_item(tree, hf_sflow_counters_sample_sequence_number, tvb, offset, 4, ENC_BIG_ENDIAN);
2118     proto_item_append_text(parent, ", seq %u", sequence_number);
2119
2120     proto_tree_add_item(tree, hf_sflow_counters_sample_source_id_class, tvb, offset + 4, 4, ENC_BIG_ENDIAN);
2121     proto_tree_add_item(tree, hf_sflow_counters_sample_index, tvb, offset + 4, 4, ENC_BIG_ENDIAN);
2122     proto_tree_add_item(tree, hf_sflow_counters_sample_sampling_interval, tvb, offset + 8, 4, ENC_BIG_ENDIAN);
2123     counters_type = tvb_get_ntohl(tvb, offset + 12);
2124     proto_tree_add_item(tree, hf_sflow_counters_sample_counters_type, tvb, offset + 12, 4, ENC_BIG_ENDIAN);
2125
2126     offset += 16;
2127
2128     /* most counters types have the "generic" counters first */
2129     switch (counters_type) {
2130         case SFLOW_245_COUNTERS_GENERIC:
2131         case SFLOW_245_COUNTERS_ETHERNET:
2132         case SFLOW_245_COUNTERS_TOKENRING:
2133         case SFLOW_245_COUNTERS_FDDI:
2134         case SFLOW_245_COUNTERS_VG:
2135         case SFLOW_245_COUNTERS_WAN:
2136             proto_tree_add_item(tree, hf_sflow_245_ifindex, tvb, offset, 4, ENC_BIG_ENDIAN);
2137             proto_item_append_text(parent, ", ifIndex %u", tvb_get_ntohl(tvb, offset));
2138             offset += 4;
2139             proto_tree_add_item(tree, hf_sflow_245_iftype, tvb, offset, 4, ENC_BIG_ENDIAN);
2140             offset += 4;
2141             proto_tree_add_item(tree, hf_sflow_245_ifspeed, tvb, offset, 8, ENC_BIG_ENDIAN);
2142             offset += 8;
2143             proto_tree_add_item(tree, hf_sflow_245_ifdirection, tvb, offset, 4, ENC_BIG_ENDIAN);
2144             offset += 4;
2145             proto_tree_add_item(tree, hf_sflow_245_ifadmin_status, tvb, offset, 4, ENC_BIG_ENDIAN);
2146             proto_tree_add_item(tree, hf_sflow_245_ifoper_status, tvb, offset, 4, ENC_BIG_ENDIAN);
2147             offset += 4;
2148             proto_tree_add_item(tree, hf_sflow_245_ifinoct, tvb, offset, 8, ENC_BIG_ENDIAN);
2149             offset += 8;
2150             proto_tree_add_item(tree, hf_sflow_245_ifinpkt, tvb, offset, 4, ENC_BIG_ENDIAN);
2151             offset += 4;
2152             proto_tree_add_item(tree, hf_sflow_245_ifinmcast, tvb, offset, 4, ENC_BIG_ENDIAN);
2153             offset += 4;
2154             proto_tree_add_item(tree, hf_sflow_245_ifinbcast, tvb, offset, 4, ENC_BIG_ENDIAN);
2155             offset += 4;
2156             proto_tree_add_item(tree, hf_sflow_245_ifindisc, tvb, offset, 4, ENC_BIG_ENDIAN);
2157             offset += 4;
2158             proto_tree_add_item(tree, hf_sflow_245_ifinerr, tvb, offset, 4, ENC_BIG_ENDIAN);
2159             offset += 4;
2160             proto_tree_add_item(tree, hf_sflow_245_ifinunk, tvb, offset, 4, ENC_BIG_ENDIAN);
2161             offset += 4;
2162             proto_tree_add_item(tree, hf_sflow_245_ifoutoct, tvb, offset, 8, ENC_BIG_ENDIAN);
2163             offset += 8;
2164             proto_tree_add_item(tree, hf_sflow_245_ifoutpkt, tvb, offset, 4, ENC_BIG_ENDIAN);
2165             offset += 4;
2166             proto_tree_add_item(tree, hf_sflow_245_ifoutmcast, tvb, offset, 4, ENC_BIG_ENDIAN);
2167             offset += 4;
2168             proto_tree_add_item(tree, hf_sflow_245_ifoutbcast, tvb, offset, 4, ENC_BIG_ENDIAN);
2169             offset += 4;
2170             proto_tree_add_item(tree, hf_sflow_245_ifoutdisc, tvb, offset, 4, ENC_BIG_ENDIAN);
2171             offset += 4;
2172             proto_tree_add_item(tree, hf_sflow_245_ifouterr, tvb, offset, 4, ENC_BIG_ENDIAN);
2173             offset += 4;
2174             proto_tree_add_item(tree, hf_sflow_245_ifpromisc, tvb, offset, 4, ENC_BIG_ENDIAN);
2175             offset += 4;
2176             break;
2177     }
2178
2179     /* Some counter types have other info to gather */
2180     switch (counters_type) {
2181         case SFLOW_245_COUNTERS_ETHERNET:
2182             offset += (int)sizeof (struct ethernet_counters);
2183             break;
2184         case SFLOW_245_COUNTERS_TOKENRING:
2185             offset = dissect_sflow_5_token_ring(tree, tvb, offset);
2186             break;
2187         case SFLOW_245_COUNTERS_VG:
2188             offset = dissect_sflow_5_vg_interface(tree, tvb, offset);
2189             break;
2190         case SFLOW_245_COUNTERS_VLAN:
2191             offset = dissect_sflow_5_vlan(tree, tvb, offset);
2192             break;
2193         default:
2194             break;
2195     }
2196     return offset;
2197 }
2198
2199 /* dissect an sflow v5 counters sample */
2200 static void
2201 dissect_sflow_5_counters_sample(tvbuff_t *tvb, proto_tree *tree, gint offset, proto_item *parent) {
2202     guint32 sequence_number, records, i;
2203
2204     /* grab the flow header.  This will remain in network byte
2205        order, so must convert each item before use */
2206     sequence_number = tvb_get_ntohl(tvb, offset);
2207     proto_tree_add_item(tree, hf_sflow_counters_sample_sequence_number, tvb, offset, 4, ENC_BIG_ENDIAN);
2208     proto_item_append_text(parent, ", seq %u", sequence_number);
2209     offset += 4;
2210     proto_tree_add_item(tree, hf_sflow_counters_sample_source_id_type, tvb, offset, 4, ENC_BIG_ENDIAN);
2211     proto_tree_add_item(tree, hf_sflow_counters_sample_source_id_index, tvb, offset, 4, ENC_BIG_ENDIAN);
2212     offset += 4;
2213     records = tvb_get_ntohl(tvb, offset);
2214     proto_tree_add_item(tree, hf_sflow_counters_sample_counters_records, tvb, offset, 4, ENC_BIG_ENDIAN);
2215     offset += 4;
2216
2217     /* start loop processing counters records
2218      * limit record count to 255 in case corrupted data may cause huge number of loops */
2219     for (i = 0; i < (records&0x000000ff); i++) {
2220         offset = dissect_sflow_5_counters_record(tvb, tree, offset);
2221     }
2222 }
2223
2224 /* dissect an expanded counters sample */
2225 static void
2226 dissect_sflow_5_expanded_counters_sample(tvbuff_t *tvb, proto_tree *tree, gint offset, proto_item *parent) {
2227     guint32 sequence_number, records, i;
2228
2229     sequence_number = tvb_get_ntohl(tvb, offset);
2230     proto_tree_add_item(tree, hf_sflow_counters_sample_sequence_number, tvb, offset, 4, ENC_BIG_ENDIAN);
2231     proto_item_append_text(parent, ", seq %u", sequence_number);
2232     offset += 4;
2233     proto_tree_add_item(tree, hf_sflow_counters_sample_expanded_source_id_type, tvb, offset, 4, ENC_BIG_ENDIAN);
2234     offset += 4;
2235     proto_tree_add_item(tree, hf_sflow_counters_sample_expanded_source_id_index, tvb, offset, 4, ENC_BIG_ENDIAN);
2236     offset += 4;
2237     records = tvb_get_ntohl(tvb, offset);
2238     proto_tree_add_item(tree, hf_sflow_counters_sample_counters_records, tvb, offset, 4, ENC_BIG_ENDIAN);
2239     offset += 4;
2240
2241     /* start loop processing counters records
2242      * limit record count to 255 in case corrupted data may cause huge number of loops */
2243     for (i = 0; i < (records&0x000000ff); i++) {
2244         offset = dissect_sflow_5_counters_record(tvb, tree, offset);
2245     }
2246 }
2247
2248 /* Code to dissect the sflow v2/4/5 samples */
2249 static gint
2250 dissect_sflow_245_samples(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset, guint32 version) {
2251     proto_tree *sflow_245_sample_tree;
2252     proto_item *ti;             /* tree item */
2253     guint32     sample_type, enterprise, format, length;
2254
2255     /* decide what kind of sample it is. */
2256     sample_type = tvb_get_ntohl(tvb, offset);
2257     if (version == 5) {
2258         enterprise = sample_type >> 12;
2259         format = sample_type & 0x00000fff;
2260
2261         if (enterprise == ENTERPRISE_DEFAULT) { /* only accept default enterprise 0 (InMon sFlow) */
2262             ti = proto_tree_add_text(tree, tvb, offset, -1, "%s",
2263                     val_to_str_const(format, sflow_245_sampletype, "Unknown sample format"));
2264             sflow_245_sample_tree = proto_item_add_subtree(ti, ett_sflow_245_sample);
2265
2266             proto_tree_add_uint_format_value(sflow_245_sample_tree, hf_sflow_enterprise, tvb, offset, 4, enterprise, "standard sFlow (%u)", enterprise);
2267             proto_tree_add_item(sflow_245_sample_tree, hf_sflow_245_sampletype12, tvb, offset, 4, ENC_BIG_ENDIAN);
2268             offset += 4;
2269
2270             length = tvb_get_ntohl(tvb, offset);
2271             proto_tree_add_item(sflow_245_sample_tree, hf_sflow_5_sample_length, tvb, offset, 4, ENC_BIG_ENDIAN);
2272             offset += 4;
2273
2274             switch (format) {
2275                 case FLOWSAMPLE:
2276                     dissect_sflow_5_flow_sample(tvb, pinfo, sflow_245_sample_tree, offset, ti);
2277                     break;
2278                 case COUNTERSSAMPLE:
2279                     dissect_sflow_5_counters_sample(tvb, sflow_245_sample_tree, offset, ti);
2280                     break;
2281                 case EXPANDED_FLOWSAMPLE:
2282                     dissect_sflow_5_expanded_flow_sample(tvb, pinfo, sflow_245_sample_tree, offset, ti);
2283                     break;
2284                 case EXPANDED_COUNTERSSAMPLE:
2285                     dissect_sflow_5_expanded_counters_sample(tvb, sflow_245_sample_tree, offset, ti);
2286                     break;
2287                 default:
2288                     break;
2289             }
2290             /* Make sure the length doesn't run past the end of the packet */
2291             tvb_ensure_bytes_exist(tvb, offset, length);
2292             /* current offset points to sample length field, which is 4 bytes from the beginning of the packet*/
2293             offset += length;
2294         } else { /* unknown enterprise format, what to do?? */
2295             ti = proto_tree_add_text(tree, tvb, offset, -1, "Unknown enterprise format");
2296             sflow_245_sample_tree = proto_item_add_subtree(ti, ett_sflow_245_sample);
2297             proto_tree_add_uint_format_value(sflow_245_sample_tree, hf_sflow_enterprise, tvb, offset, -1,
2298                             enterprise, "Non-standard sFlow (%u)", enterprise);
2299         }
2300
2301     } else { /* version 2 or 4 */
2302         ti = proto_tree_add_text(tree, tvb, offset, -1, "%s",
2303                 val_to_str_const(sample_type, sflow_245_sampletype, "Unknown sample type"));
2304         sflow_245_sample_tree = proto_item_add_subtree(ti, ett_sflow_245_sample);
2305
2306         proto_tree_add_item(sflow_245_sample_tree, hf_sflow_245_sampletype, tvb, offset, 4, ENC_BIG_ENDIAN);
2307         offset += 4;
2308
2309         switch (sample_type) {
2310             case FLOWSAMPLE:
2311                 offset = dissect_sflow_24_flow_sample(tvb, pinfo, sflow_245_sample_tree, offset, ti);
2312                 break;
2313             case COUNTERSSAMPLE:
2314                 offset = dissect_sflow_24_counters_sample(tvb, sflow_245_sample_tree, offset, ti);
2315                 break;
2316             default:
2317                 break;
2318         }
2319     }
2320     proto_item_set_end(ti, tvb, offset);
2321
2322     return offset;
2323 }
2324
2325 /* Code to actually dissect the packets */
2326 static int
2327 dissect_sflow_245(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
2328 {
2329     /* Set up structures needed to add the protocol subtree and manage it */
2330     proto_item                   *ti;
2331     proto_tree                   *sflow_245_tree;
2332     guint32                       version, sub_agent_id, seqnum;
2333     struct sflow_address_details  addr_details;
2334     struct sflow_address_type     addr_type = {hf_sflow_agent_address_v4, hf_sflow_agent_address_v6};
2335
2336     guint32        numsamples;
2337     volatile guint offset = 0;
2338     guint          i      = 0;
2339
2340     /*
2341      * We fetch the version and address type so that we can determine,
2342      * ahead of time, whether this is an sFlow packet or not, before
2343      * we do *anything* to the columns or the protocol tree.
2344      *
2345      * XXX - we might want to deem this "not sFlow" if we don't have at
2346      * least 8 bytes worth of data.
2347      */
2348     version = tvb_get_ntohl(tvb, offset);
2349     if (version != 2 && version != 4 && version != 5) {
2350        /* Unknown version; assume it's not an sFlow packet. */
2351        return 0;
2352     }
2353     addr_details.addr_type = tvb_get_ntohl(tvb, offset + 4);
2354     switch (addr_details.addr_type) {
2355         case ADDR_TYPE_UNKNOWN:
2356         case ADDR_TYPE_IPV4:
2357         case ADDR_TYPE_IPV6:
2358             break;
2359
2360         default:
2361             /*
2362              * Address type we don't know about; assume it's not an sFlow
2363              * packet.
2364              */
2365             return 0;
2366     }
2367
2368     /* Make entries in Protocol column and Info column on summary display */
2369     col_set_str(pinfo->cinfo, COL_PROTOCOL, "sFlow");
2370
2371     /* create display subtree for the protocol */
2372     ti = proto_tree_add_item(tree, proto_sflow, tvb, 0, -1, ENC_NA);
2373
2374     sflow_245_tree = proto_item_add_subtree(ti, ett_sflow_245);
2375
2376     col_add_fstr(pinfo->cinfo, COL_INFO, "V%u", version);
2377     proto_tree_add_item(sflow_245_tree, hf_sflow_version, tvb, offset, 4, ENC_BIG_ENDIAN);
2378     offset += 4;
2379
2380     offset = dissect_sflow_245_address_type(tvb, pinfo, sflow_245_tree, offset,
2381                                             &addr_type, &addr_details);
2382     switch (addr_details.addr_type) {
2383         case ADDR_TYPE_UNKNOWN:
2384             break;
2385         case ADDR_TYPE_IPV4:
2386             col_append_fstr(pinfo->cinfo, COL_INFO, ", agent %s", ip_to_str(addr_details.agent_address.v4));
2387             break;
2388         case ADDR_TYPE_IPV6:
2389             col_append_fstr(pinfo->cinfo, COL_INFO, ", agent %s",
2390                     ip6_to_str((struct e_in6_addr *) addr_details.agent_address.v6));
2391             break;
2392     }
2393
2394     if (version == 5) {
2395         sub_agent_id = tvb_get_ntohl(tvb, offset);
2396         col_append_fstr(pinfo->cinfo, COL_INFO, ", sub-agent ID %u", sub_agent_id);
2397         proto_tree_add_uint(sflow_245_tree, hf_sflow_5_sub_agent_id, tvb, offset, 4, sub_agent_id);
2398         offset += 4;
2399     }
2400     seqnum = tvb_get_ntohl(tvb, offset);
2401     col_append_fstr(pinfo->cinfo, COL_INFO, ", seq %u", seqnum);
2402     proto_tree_add_uint(sflow_245_tree, hf_sflow_245_seqnum, tvb, offset, 4, seqnum);
2403     offset += 4;
2404     proto_tree_add_item(sflow_245_tree, hf_sflow_245_sysuptime, tvb, offset, 4, ENC_BIG_ENDIAN);
2405     offset += 4;
2406     numsamples = tvb_get_ntohl(tvb, offset);
2407     col_append_fstr(pinfo->cinfo, COL_INFO, ", %u samples", numsamples);
2408     proto_tree_add_uint(sflow_245_tree, hf_sflow_245_numsamples, tvb, offset, 4, numsamples);
2409     offset += 4;
2410
2411     /* Ok, we're now at the end of the sflow_245 datagram header;
2412      * everything from here out should be samples. Loop over
2413      * the expected number of samples, and pass them to the appropriate
2414      * dissectors.
2415      */
2416
2417     /* limit number of samples to 255 to avoid huge number of loops
2418      * caused by corrupted data */
2419     for (i = 0; i < (numsamples & 0x000000ff); i++) {
2420         offset = dissect_sflow_245_samples(tvb, pinfo, sflow_245_tree, offset, version);
2421     }
2422
2423     return tvb_length(tvb);
2424 }
2425
2426 /* Register the protocol with Wireshark */
2427
2428 /* this format is require because a script is used to build the C function
2429    that calls all the protocol registration.
2430  */
2431
2432 void
2433 proto_register_sflow(void) {
2434
2435     module_t *sflow_245_module;
2436
2437     /* Setup list of header fields  See Section 1.6.1 for details*/
2438     static hf_register_info hf[] = {
2439         { &hf_sflow_version,
2440             { "Datagram version", "sflow_245.version",
2441                 FT_UINT32, BASE_DEC, NULL, 0x0,
2442                 "sFlow datagram version", HFILL}},
2443         { &hf_sflow_agent_address_v4,
2444             { "Agent address", "sflow_245.agent",
2445                 FT_IPv4, BASE_NONE, NULL, 0x0,
2446                 "sFlow Agent IP address", HFILL}},
2447         { &hf_sflow_agent_address_v6,
2448             { "Agent address", "sflow_245.agent.v6",
2449                 FT_IPv6, BASE_NONE, NULL, 0x0,
2450                 "sFlow Agent IPv6 address", HFILL}},
2451         { &hf_sflow_5_sub_agent_id,
2452             { "Sub-agent ID", "sflow_245.sub_agent_id",
2453                 FT_UINT32, BASE_DEC, NULL, 0x0,
2454                 "sFlow sub-agent ID", HFILL}},
2455         { &hf_sflow_5_sample_length,
2456             { "Sample length (byte)", "sflow_5.sample_length",
2457                 FT_UINT32, BASE_DEC, NULL, 0x0,
2458                 "sFlow sample length", HFILL}},
2459         { &hf_sflow_5_flow_data_length,
2460             { "Flow data length (byte)", "sflow_5.flow_data_length",
2461                 FT_UINT32, BASE_DEC, NULL, 0x0,
2462                 "sFlow flow data length", HFILL}},
2463 #if 0
2464         { &hf_sflow_5_counters_data_length,
2465             { "Counters data length (byte)", "sflow_5.counter_data_length",
2466                 FT_UINT32, BASE_DEC, NULL, 0x0,
2467                 "sFlow counters data length", HFILL}},
2468 #endif
2469         { &hf_sflow_245_seqnum,
2470             { "Sequence number", "sflow_245.sequence_number",
2471                 FT_UINT32, BASE_DEC, NULL, 0x0,
2472                 "sFlow datagram sequence number", HFILL}},
2473         { &hf_sflow_245_sysuptime,
2474             { "SysUptime", "sflow_245.sysuptime",
2475                 FT_UINT32, BASE_DEC, NULL, 0x0,
2476                 "System Uptime", HFILL}},
2477         { &hf_sflow_245_numsamples,
2478             { "NumSamples", "sflow_245.numsamples",
2479                 FT_UINT32, BASE_DEC, NULL, 0x0,
2480                 "Number of samples in sFlow datagram", HFILL}},
2481         { &hf_sflow_245_sampletype,
2482             { "sFlow sample type", "sflow_245.sampletype",
2483                 FT_UINT32, BASE_DEC, VALS(sflow_245_sampletype), 0x0,
2484                 "Type of sFlow sample", HFILL}},
2485         { &hf_sflow_245_sampletype12,
2486             { "sFlow sample type", "sflow_245.sampletype",
2487                 FT_UINT32, BASE_DEC, VALS(sflow_245_sampletype), 0x00000FFF,
2488                 "Type of sFlow sample", HFILL}},
2489 #if 0
2490         { &hf_sflow_5_ieee80211_version,
2491             { "Version", "sflow_245.ieee80211_version",
2492                 FT_UINT32, BASE_DEC, VALS(sflow_5_ieee80211_versions), 0x0,
2493                 "IEEE 802.11 Version", HFILL}},
2494 #endif
2495         { &hf_sflow_245_ipv4_precedence_type,
2496             { "Precedence", "sflow_245.ipv4_precedence_type",
2497                 FT_UINT8, BASE_DEC, VALS(sflow_245_ipv4_precedence_types), 0xE0,
2498                 "IPv4 Precedence Type", HFILL}},
2499         { &hf_sflow_5_flow_record_format,
2500             { "Format", "sflow_245.flow_record_format",
2501                 FT_UINT32, BASE_DEC, VALS(sflow_5_flow_record_type), 0x0,
2502                 "Format of sFlow flow record", HFILL}},
2503         { &hf_sflow_5_counters_record_format,
2504             { "Format", "sflow_245.counters_record_format",
2505                 FT_UINT32, BASE_DEC, VALS(sflow_5_counters_record_type), 0x00000FFF,
2506                 "Format of sFlow counters record", HFILL}},
2507         { &hf_sflow_245_header_protocol,
2508             { "Header protocol", "sflow_245.header_protocol",
2509                 FT_UINT32, BASE_DEC, VALS(sflow_245_header_protocol), 0x0,
2510                 "Protocol of sampled header", HFILL}},
2511         { &hf_sflow_245_header,
2512             { "Header of sampled packet", "sflow_245.header",
2513                 FT_BYTES, BASE_NONE, NULL, 0x0,
2514                 "Data from sampled header", HFILL}},
2515         { &hf_sflow_245_packet_information_type,
2516             { "Sample type", "sflow_245.packet_information_type",
2517                 FT_UINT32, BASE_DEC, VALS(sflow_245_packet_information_type), 0x0,
2518                 "Type of sampled information", HFILL}},
2519         { &hf_sflow_245_extended_information_type,
2520             { "Extended information type", "sflow_245.extended_information_type",
2521                 FT_UINT32, BASE_DEC, VALS(sflow_245_extended_data_types), 0x0,
2522                 "Type of extended information", HFILL}},
2523         { &hf_sflow_245_vlan_in,
2524             { "Incoming 802.1Q VLAN", "sflow_245.vlan.in",
2525                 FT_UINT32, BASE_DEC, NULL, 0x0,
2526                 "Incoming VLAN ID", HFILL}},
2527         { &hf_sflow_245_vlan_out,
2528             { "Outgoing 802.1Q VLAN", "sflow_245.vlan.out",
2529                 FT_UINT32, BASE_DEC, NULL, 0x0,
2530                 "Outgoing VLAN ID", HFILL}},
2531         { &hf_sflow_245_pri_in,
2532             { "Incoming 802.1p priority", "sflow_245.pri.in",
2533                 FT_UINT32, BASE_DEC, NULL, 0x0,
2534                 NULL, HFILL}},
2535         { &hf_sflow_245_pri_out,
2536             { "Outgoing 802.1p priority", "sflow_245.pri.out",
2537                 FT_UINT32, BASE_DEC, NULL, 0x0,
2538                 NULL, HFILL}},
2539         { &hf_sflow_245_nexthop_v4,
2540             { "Next hop", "sflow_245.nexthop",
2541                 FT_IPv4, BASE_NONE, NULL, 0x0,
2542                 "Next hop address", HFILL}},
2543         { &hf_sflow_245_ipv4_src,
2544             { "Source IP address", "sflow_245.ipv4_src",
2545                 FT_IPv4, BASE_NONE, NULL, 0x0,
2546                 "Source IPv4 address", HFILL}},
2547         { &hf_sflow_245_ipv4_dst,
2548             { "Destination IP address", "sflow_245.ipv4_dst",
2549                 FT_IPv4, BASE_NONE, NULL, 0x0,
2550                 "Destination IPv4 address", HFILL}},
2551         { &hf_sflow_245_nexthop_v6,
2552             { "Next hop", "sflow_245.nexthop",
2553                 FT_IPv6, BASE_NONE, NULL, 0x0,
2554                 "Next hop address", HFILL}},
2555         { &hf_sflow_245_ipv6_src,
2556             { "Source IP address", "sflow_245.ipv6_src",
2557                 FT_IPv6, BASE_NONE, NULL, 0x0,
2558                 "Source IPv6 address", HFILL}},
2559         { &hf_sflow_245_ipv6_dst,
2560             { "Destination IP address", "sflow_245.ipv6_dst",
2561                 FT_IPv6, BASE_NONE, NULL, 0x0,
2562                 "Destination IPv6 address", HFILL}},
2563         { &hf_sflow_245_nexthop_src_mask,
2564             { "Next hop source mask", "sflow_245.nexthop.src_mask",
2565                 FT_UINT32, BASE_DEC, NULL, 0x0,
2566                 "Next hop source mask bits", HFILL}},
2567         { &hf_sflow_245_nexthop_dst_mask,
2568             { "Next hop destination mask", "sflow_245.nexthop.dst_mask",
2569                 FT_UINT32, BASE_DEC, NULL, 0x0,
2570                 "Next hop destination mask bits", HFILL}},
2571         { &hf_sflow_245_ifindex,
2572             { "Interface index", "sflow_245.ifindex",
2573                 FT_UINT32, BASE_DEC, NULL, 0x0,
2574                 NULL, HFILL}},
2575         { &hf_sflow_245_as,
2576             { "AS Router", "sflow_245.as",
2577                 FT_UINT32, BASE_DEC, NULL, 0x0,
2578                 "Autonomous System of Router", HFILL}},
2579         { &hf_sflow_245_src_as,
2580             { "AS Source", "sflow_245.srcAS",
2581                 FT_UINT32, BASE_DEC, NULL, 0x0,
2582                 "Autonomous System of Source", HFILL}},
2583         { &hf_sflow_245_src_peer_as,
2584             { "AS Peer", "sflow_245.peerAS",
2585                 FT_UINT32, BASE_DEC, NULL, 0x0,
2586                 "Autonomous System of Peer", HFILL}},
2587         { &hf_sflow_245_dst_as_entries,
2588             { "AS Destinations", "sflow_245.dstASentries",
2589                 FT_UINT32, BASE_DEC, NULL, 0x0,
2590                 "Autonomous System destinations", HFILL}},
2591         { &hf_sflow_245_dst_as,
2592             { "AS Destination", "sflow_245.dstAS",
2593                 FT_UINT32, BASE_DEC, NULL, 0x0,
2594                 "Autonomous System destination", HFILL}},
2595         /* Needed for sFlow >= 4.  If I had a capture to test... */
2596         { &hf_sflow_245_community_entries,
2597             { "Gateway Communities", "sflow_245.communityEntries",
2598                 FT_UINT32, BASE_DEC, NULL, 0x0,
2599                 NULL, HFILL}},
2600 #if 0
2601         { &hf_sflow_245_community,
2602             { "Gateway Community", "sflow_245.community",
2603                 FT_UINT32, BASE_DEC, NULL, 0x0,
2604                 "Gateway Communities", HFILL}},
2605 #endif
2606         { &hf_sflow_245_localpref,
2607             { "localpref", "sflow_245.localpref",
2608                 FT_UINT32, BASE_DEC, NULL, 0x0,
2609                 "Local preferences of AS route", HFILL}},
2610         /**/
2611         { &hf_sflow_245_iftype,
2612             { "Interface Type", "sflow_245.iftype",
2613                 FT_UINT32, BASE_DEC, NULL, 0x0,
2614                 NULL, HFILL}},
2615         { &hf_sflow_245_ifspeed,
2616             { "Interface Speed", "sflow_245.ifspeed",
2617                 FT_UINT64, BASE_DEC, NULL, 0x0,
2618                 NULL, HFILL}},
2619         { &hf_sflow_245_ifdirection,
2620             { "Interface Direction", "sflow_245.ifdirection",
2621                 FT_UINT32, BASE_DEC, VALS(sflow_ifdirection_vals), 0x0,
2622                 NULL, HFILL}},
2623         { &hf_sflow_245_ifadmin_status,
2624             { "IfAdminStatus", "sflow_245.ifadmin_status",
2625                 FT_BOOLEAN, 32, TFS(&tfs_up_down), 0x00000001,
2626                 NULL, HFILL}},
2627         { &hf_sflow_245_ifoper_status,
2628             { "IfOperStatus", "sflow_245.ifoper_status",
2629                 FT_BOOLEAN, 32, TFS(&tfs_up_down), 0x00000002,
2630                 NULL, HFILL}},
2631         { &hf_sflow_245_ifinoct,
2632             { "Input Octets", "sflow_245.ifinoct",
2633                 FT_UINT64, BASE_DEC, NULL, 0x0,
2634                 NULL, HFILL}},
2635         { &hf_sflow_245_ifinpkt,
2636             { "Input Packets", "sflow_245.ifinpkt",
2637                 FT_UINT32, BASE_DEC, NULL, 0x0,
2638                 NULL, HFILL}},
2639         { &hf_sflow_245_ifinmcast,
2640             { "Input Multicast Packets", "sflow_245.ifinmcast",
2641                 FT_UINT32, BASE_DEC, NULL, 0x0,
2642                 NULL, HFILL}},
2643         { &hf_sflow_245_ifinbcast,
2644             { "Input Broadcast Packets", "sflow_245.ifinbcast",
2645                 FT_UINT32, BASE_DEC, NULL, 0x0,
2646                 NULL, HFILL}},
2647         { &hf_sflow_245_ifindisc,
2648             { "Input Discarded Packets", "sflow_245.ifindisc",
2649                 FT_UINT32, BASE_DEC, NULL, 0x0,
2650                 NULL, HFILL}},
2651         { &hf_sflow_245_ifinerr,
2652             { "Input Errors", "sflow_245.ifinerr",
2653                 FT_UINT32, BASE_DEC, NULL, 0x0,
2654                 NULL, HFILL}},
2655         { &hf_sflow_245_ifinunk,
2656             { "Input Unknown Protocol Packets", "sflow_245.ifinunk",
2657                 FT_UINT32, BASE_DEC, NULL, 0x0,
2658                 NULL, HFILL}},
2659         { &hf_sflow_245_ifoutoct,
2660             { "Output Octets", "sflow_245.ifoutoct",
2661                 FT_UINT64, BASE_DEC, NULL, 0x0,
2662                 NULL, HFILL}},
2663         { &hf_sflow_245_ifoutpkt,
2664             { "Output Packets", "sflow_245.ifoutpkt",
2665                 FT_UINT32, BASE_DEC, NULL, 0x0,
2666                 NULL, HFILL}},
2667         { &hf_sflow_245_ifoutmcast,
2668             { "Output Multicast Packets", "sflow_245.ifoutmcast",
2669                 FT_UINT32, BASE_DEC, NULL, 0x0,
2670                 NULL, HFILL}},
2671         { &hf_sflow_245_ifoutbcast,
2672             { "Output Broadcast Packets", "sflow_245.ifoutbcast",
2673                 FT_UINT32, BASE_DEC, NULL, 0x0,
2674                 NULL, HFILL}},
2675         { &hf_sflow_245_ifoutdisc,
2676             { "Output Discarded Packets", "sflow_245.ifoutdisc",
2677                 FT_UINT32, BASE_DEC, NULL, 0x0,
2678                 NULL, HFILL}},
2679         { &hf_sflow_245_ifouterr,
2680             { "Output Errors", "sflow_245.ifouterr",
2681                 FT_UINT32, BASE_DEC, NULL, 0x0,
2682                 NULL, HFILL}},
2683         { &hf_sflow_245_ifpromisc,
2684             { "Promiscuous Mode", "sflow_245.ifpromisc",
2685                 FT_UINT32, BASE_DEC, NULL, 0x0,
2686                 NULL, HFILL}},
2687         { &hf_sflow_245_dot3StatsAlignmentErrors,
2688             { "Alignment Errors", "sflow_245.dot3StatsAlignmentErrors",
2689                 FT_UINT32, BASE_DEC, NULL, 0x0,
2690                 "dot3 Stats Alignment Errors", HFILL}},
2691         { &hf_sflow_245_dot3StatsFCSErrors,
2692             { "FCS Errors", "sflow_245.dot3StatsFCSErrors",
2693                 FT_UINT32, BASE_DEC, NULL, 0x0,
2694                 "dot3 Stats FCS Errors", HFILL}},
2695         { &hf_sflow_245_dot3StatsSingleCollisionFrames,
2696             { "Single Collision Frames", "sflow_245.dot3StatsSingleCollisionFrames",
2697                 FT_UINT32, BASE_DEC, NULL, 0x0,
2698                 "dot3 Stats Single Collision Frames", HFILL}},
2699         { &hf_sflow_245_dot3StatsMultipleCollisionFrames,
2700             { "Multiple Collision Frames", "sflow_245.dot3StatsMultipleCollisionFrames",
2701                 FT_UINT32, BASE_DEC, NULL, 0x0,
2702                 "dot3 Stats Multiple Collision Frames", HFILL}},
2703         { &hf_sflow_245_dot3StatsSQETestErrors,
2704             { "SQE Test Errors", "sflow_245.dot3StatsSQETestErrors",
2705                 FT_UINT32, BASE_DEC, NULL, 0x0,
2706                 "dot3 Stats SQE Test Errors", HFILL}},
2707         { &hf_sflow_245_dot3StatsDeferredTransmissions,
2708             { "Deferred Transmissions", "sflow_245.dot3StatsDeferredTransmissions",
2709                 FT_UINT32, BASE_DEC, NULL, 0x0,
2710                 "dot3 Stats Deferred Transmissions", HFILL}},
2711         { &hf_sflow_245_dot3StatsLateCollisions,
2712             { "Late Collisions", "sflow_245.dot3StatsLateCollisions",
2713                 FT_UINT32, BASE_DEC, NULL, 0x0,
2714                 "dot3 Stats Late Collisions", HFILL}},
2715         { &hf_sflow_245_dot3StatsExcessiveCollisions,
2716             { "Excessive Collisions", "sflow_245.dot3StatsExcessiveCollisions",
2717                 FT_UINT32, BASE_DEC, NULL, 0x0,
2718                 "dot3 Stats Excessive Collisions", HFILL}},
2719         { &hf_sflow_245_dot3StatsInternalMacTransmitErrors,
2720             { "Internal Mac Transmit Errors", "sflow_245.dot3StatsInternalMacTransmitErrors",
2721                 FT_UINT32, BASE_DEC, NULL, 0x0,
2722                 "dot3 Stats Internal Mac Transmit Errors", HFILL}},
2723         { &hf_sflow_245_dot3StatsCarrierSenseErrors,
2724             { "Carrier Sense Errors", "sflow_245.dot3StatsCarrierSenseErrors",
2725                 FT_UINT32, BASE_DEC, NULL, 0x0,
2726                 "dot3 Stats Carrier Sense Errors", HFILL}},
2727         { &hf_sflow_245_dot3StatsFrameTooLongs,
2728             { "Frame Too Longs", "sflow_245.dot3StatsFrameTooLongs",
2729                 FT_UINT32, BASE_DEC, NULL, 0x0,
2730                 "dot3 Stats Frame Too Longs", HFILL}},
2731         { &hf_sflow_245_dot3StatsInternalMacReceiveErrors,
2732             { "Internal Mac Receive Errors", "sflow_245.dot3StatsInternalMacReceiveErrors",
2733                 FT_UINT32, BASE_DEC, NULL, 0x0,
2734                 "dot3 Stats Internal Mac Receive Errors", HFILL}},
2735         { &hf_sflow_245_dot3StatsSymbolErrors,
2736             { "Symbol Errors", "sflow_245.dot3StatsSymbolErrors",
2737                 FT_UINT32, BASE_DEC, NULL, 0x0,
2738                 "dot3 Stats Symbol Errors", HFILL}},
2739         { &hf_sflow_245_dot5StatsLineErrors,
2740             { "Line Errors", "sflow_245.dot5StatsLineErrors",
2741                 FT_UINT32, BASE_DEC, NULL, 0x0,
2742                 "dot5 Stats Line Errors", HFILL}},
2743         { &hf_sflow_245_dot5StatsBurstErrors,
2744             { "Burst Errors", "sflow_245.dot5StatsBurstErrors",
2745                 FT_UINT32, BASE_DEC, NULL, 0x0,
2746                 "dot5 Stats Burst Errors", HFILL}},
2747         { &hf_sflow_245_dot5StatsACErrors,
2748             { "AC Errors", "sflow_245.dot5StatsACErrors",
2749                 FT_UINT32, BASE_DEC, NULL, 0x0,
2750                 "dot5 Stats AC Errors", HFILL}},
2751         { &hf_sflow_245_dot5StatsAbortTransErrors,
2752             { "Abort Trans Errors", "sflow_245.dot5StatsAbortTransErrors",
2753                 FT_UINT32, BASE_DEC, NULL, 0x0,
2754                 "dot5 Stats Abort Trans Errors", HFILL}},
2755         { &hf_sflow_245_dot5StatsInternalErrors,
2756             { "Internal Errors", "sflow_245.dot5StatsInternalErrors",
2757                 FT_UINT32, BASE_DEC, NULL, 0x0,
2758                 "dot5 Stats Internal Errors", HFILL}},
2759         { &hf_sflow_245_dot5StatsLostFrameErrors,
2760             { "Lost Frame Errors", "sflow_245.dot5StatsLostFrameErrors",
2761                 FT_UINT32, BASE_DEC, NULL, 0x0,
2762                 "dot5 Stats Lost Frame Errors", HFILL}},
2763         { &hf_sflow_245_dot5StatsReceiveCongestions,
2764             { "Receive Congestions", "sflow_245.dot5StatsReceiveCongestions",
2765                 FT_UINT32, BASE_DEC, NULL, 0x0,
2766                 "dot5 Stats Receive Congestions", HFILL}},
2767         { &hf_sflow_245_dot5StatsFrameCopiedErrors,
2768             { "Frame Copied Errors", "sflow_245.dot5StatsFrameCopiedErrors",
2769                 FT_UINT32, BASE_DEC, NULL, 0x0,
2770                 "dot5 Stats Frame Copied Errors", HFILL}},
2771         { &hf_sflow_245_dot5StatsTokenErrors,
2772             { "Token Errors", "sflow_245.dot5StatsTokenErrors",
2773                 FT_UINT32, BASE_DEC, NULL, 0x0,
2774                 "dot5 Stats Token Errors", HFILL}},
2775         { &hf_sflow_245_dot5StatsSoftErrors,
2776             { "Soft Errors", "sflow_245.dot5StatsSoftErrors",
2777                 FT_UINT32, BASE_DEC, NULL, 0x0,
2778                 "dot5 Stats Soft Errors", HFILL}},
2779         { &hf_sflow_245_dot5StatsHardErrors,
2780             { "Hard Errors", "sflow_245.dot5StatsHardErrors",
2781                 FT_UINT32, BASE_DEC, NULL, 0x0,
2782                 "dot5 Stats Hard Errors", HFILL}},
2783         { &hf_sflow_245_dot5StatsSignalLoss,
2784             { "Signal Loss", "sflow_245.dot5StatsSignalLoss",
2785                 FT_UINT32, BASE_DEC, NULL, 0x0,
2786                 "dot5 Stats Signal Loss", HFILL}},
2787         { &hf_sflow_245_dot5StatsTransmitBeacons,
2788             { "Transmit Beacons", "sflow_245.dot5StatsTransmitBeacons",
2789                 FT_UINT32, BASE_DEC, NULL, 0x0,
2790                 "dot5 Stats Transmit Beacons", HFILL}},
2791         { &hf_sflow_245_dot5StatsRecoveries,
2792             { "Recoveries", "sflow_245.dot5StatsRecoveries",
2793                 FT_UINT32, BASE_DEC, NULL, 0x0,
2794                 "dot5 Stats Recoveries", HFILL}},
2795         { &hf_sflow_245_dot5StatsLobeWires,
2796             { "Lobe Wires", "sflow_245.dot5StatsLobeWires",
2797                 FT_UINT32, BASE_DEC, NULL, 0x0,
2798                 "dot5 Stats Lobe Wires", HFILL}},
2799         { &hf_sflow_245_dot5StatsRemoves,
2800             { "Removes", "sflow_245.dot5StatsRemoves",
2801                 FT_UINT32, BASE_DEC, NULL, 0x0,
2802                 "dot5 Stats Removes", HFILL}},
2803         { &hf_sflow_245_dot5StatsSingles,
2804             { "Singles", "sflow_245.dot5StatsSingles",
2805                 FT_UINT32, BASE_DEC, NULL, 0x0,
2806                 "dot5 Stats Singles", HFILL}},
2807         { &hf_sflow_245_dot5StatsFreqErrors,
2808             { "Freq Errors", "sflow_245.dot5StatsFreqErrors",
2809                 FT_UINT32, BASE_DEC, NULL, 0x0,
2810                 "dot5 Stats Freq Errors", HFILL}},
2811         { &hf_sflow_245_dot12InHighPriorityFrames,
2812             { "In High Priority Frames", "sflow_245.dot12InHighPriorityFrames",
2813                 FT_UINT32, BASE_DEC, NULL, 0x0,
2814                 "dot12 Input High Priority Frames", HFILL}},
2815         { &hf_sflow_245_dot12InHighPriorityOctets,
2816             { "In High Priority Octets", "sflow_245.dot12InHighPriorityOctets",
2817                 FT_UINT64, BASE_DEC, NULL, 0x0,
2818                 "dot12 Input High Priority Octets", HFILL}},
2819         { &hf_sflow_245_dot12InNormPriorityFrames,
2820             { "In Normal Priority Frames", "sflow_245.dot12InNormPriorityFrames",
2821                 FT_UINT32, BASE_DEC, NULL, 0x0,
2822                 "dot12 Input Normal Priority Frames", HFILL}},
2823         { &hf_sflow_245_dot12InNormPriorityOctets,
2824             { "In Normal Priority Octets", "sflow_245.dot12InNormPriorityOctets",
2825                 FT_UINT64, BASE_DEC, NULL, 0x0,
2826                 "dot12 Input Normal Priority Octets", HFILL}},
2827         { &hf_sflow_245_dot12InIPMErrors,
2828             { "In IPM Errors", "sflow_245.dot12InIPMErrors",
2829                 FT_UINT32, BASE_DEC, NULL, 0x0,
2830                 "dot12 Input IPM Errors", HFILL}},
2831         { &hf_sflow_245_dot12InOversizeFrameErrors,
2832             { "In Oversize Frame Errors", "sflow_245.dot12InOversizeFrameErrors",
2833                 FT_UINT32, BASE_DEC, NULL, 0x0,
2834                 "dot12 Input Oversize Frame Errors", HFILL}},
2835         { &hf_sflow_245_dot12InDataErrors,
2836             { "In Data Errors", "sflow_245.dot12InDataErrors",
2837                 FT_UINT32, BASE_DEC, NULL, 0x0,
2838                 "dot12 Input Data Errors", HFILL}},
2839         { &hf_sflow_245_dot12InNullAddressedFrames,
2840             { "In Null Addressed Frames", "sflow_245.dot12InNullAddressedFrames",
2841                 FT_UINT32, BASE_DEC, NULL, 0x0,
2842                 "dot12 Input Null Addressed Frames", HFILL}},
2843         { &hf_sflow_245_dot12OutHighPriorityFrames,
2844             { "Out High Priority Frames", "sflow_245.dot12OutHighPriorityFrames",
2845                 FT_UINT32, BASE_DEC, NULL, 0x0,
2846                 "dot12 Output High Priority Frames", HFILL}},
2847         { &hf_sflow_245_dot12OutHighPriorityOctets,
2848             { "Out High Priority Octets", "sflow_245.dot12OutHighPriorityOctets",
2849                 FT_UINT64, BASE_DEC, NULL, 0x0,
2850                 "dot12 Out High Priority Octets", HFILL}},
2851         { &hf_sflow_245_dot12TransitionIntoTrainings,
2852             { "Transition Into Trainings", "sflow_245.dot12TransitionIntoTrainings",
2853                 FT_UINT32, BASE_DEC, NULL, 0x0,
2854                 "dot12 Transition Into Trainings", HFILL}},
2855         { &hf_sflow_245_dot12HCInHighPriorityOctets,
2856             { "HC In High Priority Octets", "sflow_245.dot12HCInHighPriorityOctets",
2857                 FT_UINT64, BASE_DEC, NULL, 0x0,
2858                 "dot12 HC Input High Priority Octets", HFILL}},
2859         { &hf_sflow_245_dot12HCInNormPriorityOctets,
2860             { "HC In Normal Priority Octets", "sflow_245.dot12HCInNormPriorityOctets",
2861                 FT_UINT64, BASE_DEC, NULL, 0x0,
2862                 "dot12 HC Input Normal Priority Octets", HFILL}},
2863         { &hf_sflow_245_dot12HCOutHighPriorityOctets,
2864             { "HC Out High Priority Octets", "sflow_245.dot12HCOutHighPriorityOctets",
2865                 FT_UINT64, BASE_DEC, NULL, 0x0,
2866                 "dot12 HC Output High Priority Octets", HFILL}},
2867         { &hf_sflow_245_vlan_id,
2868             { "VLAN ID", "sflow_245.vlan_id",
2869                 FT_UINT32, BASE_DEC, NULL, 0x0,
2870                 NULL, HFILL}},
2871         { &hf_sflow_245_octets,
2872             { "Octets", "sflow_245.octets",
2873                 FT_UINT64, BASE_DEC, NULL, 0x0,
2874                 NULL, HFILL}},
2875         { &hf_sflow_245_ucastPkts,
2876             { "Unicast Packets", "sflow_245.ucastPkts",
2877                 FT_UINT32, BASE_DEC, NULL, 0x0,
2878                 NULL, HFILL}},
2879         { &hf_sflow_245_multicastPkts,
2880             { "Multicast Packets", "sflow_245.multicastPkts",
2881                 FT_UINT32, BASE_DEC, NULL, 0x0,
2882                 NULL, HFILL}},
2883         { &hf_sflow_245_broadcastPkts,
2884             { "Broadcast Packets", "sflow_245.broadcastPkts",
2885                 FT_UINT32, BASE_DEC, NULL, 0x0,
2886                 NULL, HFILL}},
2887         { &hf_sflow_245_discards,
2888             { "Discards", "sflow_245.discards",
2889                 FT_UINT32, BASE_DEC, NULL, 0x0,
2890                 NULL, HFILL}},
2891         { &hf_sflow_5_dot11TransmittedFragmentCount,
2892             { "Transmitted Fragment Count", "sflow_5.dot11TransmittedFragmentCount",
2893                 FT_UINT32, BASE_DEC, NULL, 0x0,
2894                 NULL, HFILL}},
2895         { &hf_sflow_5_dot11MulticastTransmittedFrameCount,
2896             { "Multicast Transmitted Frame Count", "sflow_5.dot11MulticastTransmittedFrameCount",
2897                 FT_UINT32, BASE_DEC, NULL, 0x0,
2898                 NULL, HFILL}},
2899         { &hf_sflow_5_dot11FailedCount,
2900             { "Failed Count", "sflow_5.dot11FailedCount",
2901                 FT_UINT32, BASE_DEC, NULL, 0x0,
2902                 NULL, HFILL}},
2903         { &hf_sflow_5_dot11RetryCount,
2904             { "Retry Count", "sflow_5.dot11RetryCount",
2905                 FT_UINT32, BASE_DEC, NULL, 0x0,
2906                 NULL, HFILL}},
2907         { &hf_sflow_5_dot11MultipleRetryCount,
2908             { "Multiple Retry Count", "sflow_5.dot11MultipleRetryCount",
2909                 FT_UINT32, BASE_DEC, NULL, 0x0,
2910                 NULL, HFILL}},
2911         { &hf_sflow_5_dot11FrameDuplicateCount,
2912             { "Frame Duplicate Count", "sflow_5.dot11FrameDuplicateCount",
2913                 FT_UINT32, BASE_DEC, NULL, 0x0,
2914                 NULL, HFILL}},
2915         { &hf_sflow_5_dot11RTSSuccessCount,
2916             { "RTS Success Count", "sflow_5.dot11RTSSuccessCount",
2917                 FT_UINT32, BASE_DEC, NULL, 0x0,
2918                 NULL, HFILL}},
2919         { &hf_sflow_5_dot11RTSFailureCount,
2920             { "Failure Count", "sflow_5.dot11RTSFailureCount",
2921                 FT_UINT32, BASE_DEC, NULL, 0x0,
2922                 NULL, HFILL}},
2923         { &hf_sflow_5_dot11ACKFailureCount,
2924             { "ACK Failure Count", "sflow_5.dot11ACKFailureCount",
2925                 FT_UINT32, BASE_DEC, NULL, 0x0,
2926                 NULL, HFILL}},
2927         { &hf_sflow_5_dot11ReceivedFragmentCount,
2928             { "Received Fragment Count", "sflow_5.dot11ReceivedFragmentCount",
2929                 FT_UINT32, BASE_DEC, NULL, 0x0,
2930                 NULL, HFILL}},
2931         { &hf_sflow_5_dot11MulticastReceivedFrameCount,
2932             { "Multicast Received Frame Count", "sflow_5.dot11MulticastReceivedFrameCount",
2933                 FT_UINT32, BASE_DEC, NULL, 0x0,
2934                 NULL, HFILL}},
2935         { &hf_sflow_5_dot11FCSErrorCount,
2936             { "FCS Error Count", "sflow_5.dot11FCSErrorCount",
2937                 FT_UINT32, BASE_DEC, NULL, 0x0,
2938                 NULL, HFILL}},
2939         { &hf_sflow_5_dot11TransmittedFrameCount,
2940             { "Transmitted Frame Count", "sflow_5.dot11TransmittedFrameCount",
2941                 FT_UINT32, BASE_DEC, NULL, 0x0,
2942                 NULL, HFILL}},
2943         { &hf_sflow_5_dot11WEPUndecryptableCount,
2944             { "WEP Undecryptable Count", "sflow_5.dot11WEPUndecryptableCount",
2945                 FT_UINT32, BASE_DEC, NULL, 0x0,
2946                 NULL, HFILL}},
2947         { &hf_sflow_5_dot11QoSDiscardedFragmentCount,
2948             { "QoS Discarded Fragment Count", "sflow_5.dot11QoSDiscardedFragmentCount",
2949                 FT_UINT32, BASE_DEC, NULL, 0x0,
2950                 NULL, HFILL}},
2951         { &hf_sflow_5_dot11AssociatedStationCount,
2952             { "Associated Station Count", "sflow_5.dot11AssociatedStationCount",
2953                 FT_UINT32, BASE_DEC, NULL, 0x0,
2954                 NULL, HFILL}},
2955         { &hf_sflow_5_dot11QoSCFPollsReceivedCount,
2956             { "QoS CF Polls Received Count", "sflow_5.dot11QoSCFPollsReceivedCount",
2957                 FT_UINT32, BASE_DEC, NULL, 0x0,
2958                 NULL, HFILL}},
2959         { &hf_sflow_5_dot11QoSCFPollsUnusedCount,
2960             { "QoS CF Polls Unused Count", "sflow_5.dot11QoSCFPollsUnusedCount",
2961                 FT_UINT32, BASE_DEC, NULL, 0x0,
2962                 NULL, HFILL}},
2963         { &hf_sflow_5_dot11QoSCFPollsUnusableCount,
2964             { "QoS CF Polls Unusable Count", "sflow_5.dot11QoSCFPollsUnusableCount",
2965                 FT_UINT32, BASE_DEC, NULL, 0x0,
2966                 NULL, HFILL}},
2967         { &hf_sflow_5_dot11QoSCFPollsLostCount,
2968             { "QoS CF Polls Lost Count", "sflow_5.dot11QoSCFPollsLostCount",
2969                 FT_UINT32, BASE_DEC, NULL, 0x0,
2970                 NULL, HFILL}},
2971         { &hf_sflow_5_cpu_5s,
2972             { "5s CPU Load (100 = 1%)", "sflow_5.cpu_5s",
2973                 FT_UINT32, BASE_DEC, NULL, 0x0,
2974                 "Average CPU Load Over 5 Seconds (100 = 1%)", HFILL}},
2975         { &hf_sflow_5_cpu_1m,
2976             { "1m CPU Load (100 = 1%)", "sflow_5.cpu_1m",
2977                 FT_UINT32, BASE_DEC, NULL, 0x0,
2978                 "Average CPU Load Over 1 Minute (100 = 1%)", HFILL}},
2979         { &hf_sflow_5_cpu_5m,
2980             { "5m CPU Load (100 = 1%)", "sflow_5.cpu_5m",
2981                 FT_UINT32, BASE_DEC, NULL, 0x0,
2982                 "Average CPU Load Over 5 Minutes (100 = 1%)", HFILL}},
2983         { &hf_sflow_5_total_memory,
2984             { "Total Memory", "sflow_5.total_memory",
2985                 FT_UINT64, BASE_DEC, NULL, 0x0,
2986                 NULL, HFILL}},
2987         { &hf_sflow_5_free_memory,
2988             { "Free Memory", "sflow_5.free_memory",
2989                 FT_UINT64, BASE_DEC, NULL, 0x0,
2990                 NULL, HFILL}},
2991         { &hf_sflow_5_elapsed_time,
2992             { "Elapsed Time (ms)", "sflow_5.elapsed_time",
2993                 FT_UINT32, BASE_DEC, NULL, 0x0,
2994                 "Elapsed Time in ms", HFILL}},
2995         { &hf_sflow_5_on_channel_time,
2996             { "On Channel (ms)", "sflow_5.on_channel_time",
2997                 FT_UINT32, BASE_DEC, NULL, 0x0,
2998                 "Time in ms Spent on Channel", HFILL}},
2999         { &hf_sflow_5_on_channel_busy_time,
3000             { "On Channel Busy (ms)", "sflow_5.channel_busy_time",
3001                 FT_UINT32, BASE_DEC, NULL, 0x0,
3002                 "Time in ms Spent on Channel and Busy", HFILL}},
3003
3004       /* Generated from convert_proto_tree_add_text.pl */
3005       { &hf_sflow_245_header_frame_length, { "Frame Length", "sflow_245.header.frame_length", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3006       { &hf_sflow_245_header_payload_removed, { "Payload removed", "sflow_245.header.payload_removed", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3007       { &hf_sflow_245_extended_mpls_in_label_stack_entries, { "In Label Stack Entries", "sflow_245.extended_mpls.in_label_stack_entries", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3008       { &hf_sflow_245_extended_mpls_in_label, { "Label", "sflow_245.extended_mpls.in_label", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3009       { &hf_sflow_245_extended_mpls_out_label_stack_entries, { "Out Label Stack Entries", "sflow_245.extended_mpls.out_label_stack_entries", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3010       { &hf_sflow_245_extended_mpls_out_label, { "Label", "sflow_245.extended_mpls.out_label", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3011       { &hf_sflow_245_ethernet_length_of_mac_packet, { "Length of MAC Packet", "sflow_245.ethernet.length", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3012       { &hf_sflow_245_ethernet_source_mac_address, { "Source MAC Address", "sflow_245.ethernet.source_mac_address", FT_ETHER, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3013       { &hf_sflow_245_ethernet_destination_mac_address, { "Destination MAC Address", "sflow_245.ethernet.destination_mac_address", FT_ETHER, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3014       { &hf_sflow_245_ethernet_packet_type, { "Ethernet Packet Type", "sflow_245.ethernet.packet_type", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3015       { &hf_sflow_245_length_of_ip_packet, { "Length of IP Packet", "sflow_245.ip.length", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3016       { &hf_sflow_245_ip_source_port, { "Source Port", "sflow_245.ip.source_port", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3017       { &hf_sflow_245_ip_destination_port, { "Destination Port", "sflow.ip.destination_port", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3018       { &hf_sflow_245_ip_tcp_flag_cwr, { "TCP Flag (CWR)", "sflow_245.ip.tcp_flag.cwr", FT_BOOLEAN, 8, TFS(&tfs_set_notset), 0x80, NULL, HFILL }},
3019       { &hf_sflow_245_ip_tcp_flag_ece, { "TCP Flag (ECE)", "sflow_245.ip.tcp_flag.ece", FT_BOOLEAN, 8, TFS(&tfs_set_notset), 0x40, NULL, HFILL }},
3020       { &hf_sflow_245_ip_tcp_flag_urg, { "TCP Flag (URG)", "sflow_245.ip.tcp_flag.urg", FT_BOOLEAN, 8, TFS(&tfs_set_notset), 0x20, NULL, HFILL }},
3021       { &hf_sflow_245_ip_tcp_flag_ack, { "TCP Flag (ACK)", "sflow_245.ip.tcp_flag.ack", FT_BOOLEAN, 8, TFS(&tfs_set_notset), 0x10, NULL, HFILL }},
3022       { &hf_sflow_245_ip_tcp_flag_psh, { "TCP Flag (PSH)", "sflow_245.ip.tcp_flag.psh", FT_BOOLEAN, 8, TFS(&tfs_set_notset), 0x08, NULL, HFILL }},
3023       { &hf_sflow_245_ip_tcp_flag_rst, { "TCP Flag (RST)", "sflow_245.ip.tcp_flag.rst", FT_BOOLEAN, 8, TFS(&tfs_set_notset), 0x04, NULL, HFILL }},
3024       { &hf_sflow_245_ip_tcp_flag_syn, { "TCP Flag (SYN)", "sflow_245.ip.tcp_flag.syn", FT_BOOLEAN, 8, TFS(&tfs_set_notset), 0x02, NULL, HFILL }},
3025       { &hf_sflow_245_ip_tcp_flag_fin, { "TCP Flag (FIN)", "sflow_245.ip.tcp_flag.fin", FT_BOOLEAN, 8, TFS(&tfs_set_notset), 0x01, NULL, HFILL }},
3026       { &hf_sflow_245_ipv4_delay, { "Delay", "sflow_245.ipv4_delay", FT_BOOLEAN, 8, TFS(&tfs_low_normal), 0x10, NULL, HFILL }},
3027       { &hf_sflow_245_ipv4_throughput, { "Throughput", "sflow_245.ipv4_throughput", FT_BOOLEAN, 8, TFS(&tfs_high_normal), 0x08, NULL, HFILL }},
3028       { &hf_sflow_245_ipv4_reliability, { "Reliability", "sflow_245.ipv4_reliability", FT_BOOLEAN, 8, TFS(&tfs_high_normal), 0x04, NULL, HFILL }},
3029       { &hf_sflow_245_ipv4_cost, { "Cost (RFC1349)", "sflow_245.ipv4_cost", FT_BOOLEAN, 8, TFS(&tfs_minimize_monetary_normal), 0x02, NULL, HFILL }},
3030       { &hf_sflow_245_ipv6_priority, { "Priority", "sflow_245.ipv6_priority", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3031       { &hf_sflow_5_extended_user_source_character_set, { "Source Character Set", "sflow_5.extended_user.source_character_set", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3032       { &hf_sflow_5_extended_user_source_user_string_length, { "Source User String Length (bytes)", "sflow_5.extended_user.source_user_string_length", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3033       { &hf_sflow_5_extended_user_destination_character_set, { "Destination Character Set", "sflow_5.extended_user.destination_character_set", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3034       { &hf_sflow_5_extended_user_destination_user_string_length, { "Destination User String Length (bytes)", "sflow_5.extended_user.destination_user_string_length", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3035       { &hf_sflow_5_extended_url_url_length, { "URL Length (bytes)", "sflow_5.extended_url.url_length", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3036       { &hf_sflow_5_extended_url_host_length, { "Host Length (bytes)", "sflow_5.extended_url.host_length", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3037       { &hf_sflow_5_extended_mpls_tunnel_name_length, { "Tunnel Name Length (bytes)", "sflow_5.extended_mpls_tunnel.name_length", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3038       { &hf_sflow_5_extended_mpls_tunnel_id, { "Tunnel ID", "sflow_5.extended_mpls_tunnel.id", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3039       { &hf_sflow_5_extended_mpls_tunnel_cos_value, { "Tunnel COS Value", "sflow_5.extended_mpls_tunnel.cos_value", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3040       { &hf_sflow_5_extended_mpls_vc_instance_name_length, { "VC Instance Name Length (bytes)", "sflow_5.extended_mpls_vc.instance_name_length", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3041       { &hf_sflow_5_extended_mpls_vc_id, { "VLL/VC ID", "sflow_5.extended_mpls_vc.id", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3042       { &hf_sflow_5_extended_mpls_vc_label_cos_value, { "VC Label COS Value", "sflow_5.extended_mpls_vc.label_cos_value", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3043       { &hf_sflow_5_extended_mpls_ftn_description_length, { "MPLS FTN Description Length (bytes)", "sflow_5.extended_mpls.ftn_description_length", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3044       { &hf_sflow_5_extended_mpls_ftn_mask, { "MPLS FTN Mask", "sflow_5.extended_mpls.ftn_mask", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3045       { &hf_sflow_5_extended_mpls_fec_address_prefix_length, { "MPLS FEC Address Prefix Length (bytes)", "sflow_5.extended_mpls.fec_address_prefix_length", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3046       { &hf_sflow_5_extended_vlan_tunnel_number_of_layers, { "Number of Layers", "sflow_5.extended_vlan_tunnel.number_of_layers", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3047       { &hf_sflow_5_extended_vlan_tunnel_tpid_tci_pair, { "TPID/TCI Pair as Integer", "sflow_5.extended_vlan_tunnel.tpid_tci_pair", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3048       { &hf_sflow_5_extended_80211_oui, { "OUI", "sflow_5.extended_80211.oui", FT_UINT24, BASE_HEX, NULL, 0x0, NULL, HFILL }},
3049       { &hf_sflow_5_extended_80211_suite_type, { "Suite Type", "sflow_5.extended_80211.suite_type", FT_UINT8, BASE_DEC, VALS(extended_80211_suite_type_vals), 0x0, NULL, HFILL }},
3050       { &hf_sflow_5_extended_80211_payload_length, { "Payload Length", "sflow_5.extended_80211.payload_length", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3051       { &hf_sflow_5_extended_80211_rx_bssid, { "BSSID", "sflow_5.extended_80211.rx.bssid", FT_ETHER, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3052       { &hf_sflow_5_extended_80211_rx_version, { "Version", "sflow_5.extended_80211.rx.version", FT_UINT32, BASE_DEC, VALS(sflow_5_ieee80211_versions), 0x0, NULL, HFILL }},
3053       { &hf_sflow_5_extended_80211_rx_channel, { "Channel", "sflow_5.extended_80211.rx.channel", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3054       { &hf_sflow_5_extended_80211_rx_speed, { "Speed", "sflow_5.extended_80211.rx.speed", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3055       { &hf_sflow_5_extended_80211_rx_rsni, { "RSNI", "sflow_5.extended_80211.rx.rsni", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3056       { &hf_sflow_5_extended_80211_rx_rcpi, { "RCPI", "sflow_5.extended_80211.rx.rcpi", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3057       { &hf_sflow_5_extended_80211_rx_packet_duration, { "Packet Duration (ms)", "sflow_5.rx.extended_80211.packet_duration", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3058       { &hf_sflow_5_extended_80211_tx_bssid, { "BSSID", "sflow_5.extended_80211.tx.bssid", FT_ETHER, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3059       { &hf_sflow_5_extended_80211_tx_version, { "Version", "sflow_5.extended_80211.tx.version", FT_UINT32, BASE_DEC, VALS(sflow_5_ieee80211_versions), 0x0, NULL, HFILL }},
3060       { &hf_sflow_5_extended_80211_tx_retransmissions, { "Retransmissions", "sflow_5.extended_80211.tx.retransmissions", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3061       { &hf_sflow_5_extended_80211_tx_packet_duration, { "Packet Duration (ms)", "sflow_5.extended_80211.tx.packet_duration", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3062       { &hf_sflow_5_extended_80211_tx_retransmission_duration, { "Retransmission Duration (ms)", "sflow_5.extended_80211.tx.retransmission_duration", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3063       { &hf_sflow_5_extended_80211_tx_channel, { "Channel", "sflow_5.extended_80211.tx.channel", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3064       { &hf_sflow_5_extended_80211_tx_speed, { "Speed", "sflow_5.extended_80211.tx.speed", FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3065       { &hf_sflow_5_extended_80211_tx_power, { "Power", "sflow_5.extended_80211.tx.power", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3066       { &hf_sflow_flow_sample_sequence_number, { "Sequence number", "sflow.flow_sample.sequence_number", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3067       { &hf_sflow_flow_sample_source_id_class, { "Source ID class", "sflow.flow_sample.source_id_class", FT_UINT32, BASE_DEC, NULL, 0xFF000000, NULL, HFILL }},
3068       { &hf_sflow_flow_sample_sampling_rate, { "Sampling rate", "sflow.flow_sample.sampling_rate", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3069       { &hf_sflow_flow_sample_sample_pool, { "Sample pool", "sflow.flow_sample.sample_pool", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3070       { &hf_sflow_flow_sample_dropped_packets, { "Dropped packets", "sflow.flow_sample.dropped_packets", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3071       { &hf_sflow_flow_sample_input_interface, { "Input interface (ifIndex)", "sflow.flow_sample.input_interface", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3072       { &hf_sflow_flow_sample_multiple_outputs, { "Multiple outputs", "sflow.flow_sample.multiple_outputs", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3073       { &hf_sflow_flow_sample_output_interface, { "Output interface (ifIndex)", "sflow.flow_sample.output_interface", FT_UINT32, BASE_DEC, NULL, 0x7fffffff, NULL, HFILL }},
3074       { &hf_sflow_enterprise, { "Enterprise", "sflow.enterprise", FT_UINT32, BASE_DEC, NULL, 0xFFFFF000, NULL, HFILL }},
3075       { &hf_sflow_flow_sample_flow_record, { "Flow record", "sflow.flow_sample.flow_record", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3076       { &hf_sflow_flow_sample_source_id_type, { "Source ID type", "sflow.flow_sample.source_id_type", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3077       { &hf_sflow_flow_sample_source_id_index, { "Source ID index", "sflow.flow_sample.source_id_index", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3078       { &hf_sflow_flow_sample_input_interface_format, { "Input interface format", "sflow.flow_sample.input_interface_format", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3079       { &hf_sflow_flow_sample_input_interface_value, { "Input interface value", "sflow.flow_sample.input_interface_value", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3080       { &hf_sflow_flow_sample_output_interface_format, { "Output interface format", "sflow.flow_sample.output_interface_format", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3081       { &hf_sflow_flow_sample_output_interface_value, { "Output interface value", "sflow.flow_sample.output_interface_value", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3082       { &hf_sflow_counters_sample_sequence_number, { "Sequence number", "sflow.counters_sample.sequence_number", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3083       { &hf_sflow_counters_sample_source_id_class, { "Source ID class", "sflow.counters_sample.source_id_class", FT_UINT32, BASE_DEC, NULL, 0xFF000000, NULL, HFILL }},
3084       { &hf_sflow_counters_sample_sampling_interval, { "Sampling Interval", "sflow.counters_sample.sampling_interval", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3085       { &hf_sflow_counters_sample_counters_type, { "Counters type", "sflow.counters_sample.counters_type", FT_UINT32, BASE_DEC, VALS(sflow_245_counterstype), 0x0, NULL, HFILL }},
3086       { &hf_sflow_counters_sample_source_id_type, { "Source ID type", "sflow.counters_sample.source_id_type", FT_UINT32, BASE_DEC, NULL, 0xFF000000, NULL, HFILL }},
3087       { &hf_sflow_counters_sample_source_id_index, { "Source ID index", "sflow.counters_sample.source_id_index", FT_UINT32, BASE_DEC, NULL, 0x00FFFFFF, NULL, HFILL }},
3088       { &hf_sflow_counters_sample_counters_records, { "Counters records", "sflow.counters_sample.counters_records", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3089       { &hf_sflow_counters_sample_expanded_source_id_type, { "Source ID type", "sflow.counters_sample.source_id_type", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3090       { &hf_sflow_counters_sample_expanded_source_id_index, { "Source ID index", "sflow.counters_sample.source_id_index", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3091       { &hf_sflow_245_as_type, { "AS Type", "sflow.as_type", FT_UINT32, BASE_DEC, VALS(sflow_245_as_types), 0x0, NULL, HFILL }},
3092       { &hf_sflow_245_ip_protocol, { "IP Protocol", "sflow.ip_protocol", FT_UINT32, BASE_DEC|BASE_EXT_STRING, &ipproto_val_ext, 0x0, NULL, HFILL }},
3093       { &hf_sflow_5_extended_user_source_user, { "Source User", "sflow_5.extended_user.source_user", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3094       { &hf_sflow_5_extended_user_destination_user, { "Destination User", "sflow_5.extended_user.destination_user", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3095       { &hf_sflow_5_extended_url_direction, { "Direction", "sflow_5.extended_url.direction", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3096       { &hf_sflow_5_extended_url_url, { "URL", "sflow_5.extended_url.url", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3097       { &hf_sflow_5_extended_url_host, { "Host", "sflow_5.extended_url.host", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3098       { &hf_sflow_5_extended_mpls_tunnel_name, { "Tunnel Name", "sflow_5.extended_mpls_tunnel.tunnel_name", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3099       { &hf_sflow_5_extended_mpls_vc_instance_name, { "VC Instance Name", "sflow_5.extended_mpls_vc.vc_instance_name", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3100       { &hf_sflow_5_extended_mpls_ftn_description, { "MPLS FTN Description", "sflow_5.extended_mpls.ftn_description", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3101       { &hf_sflow_5_extended_80211_payload, { "Payload", "sflow_5.extended_80211.payload", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3102       { &hf_sflow_5_extended_80211_rx_ssid, { "SSID", "sflow_5.extended_80211.rx.ssid", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3103       { &hf_sflow_5_extended_80211_tx_ssid, { "SSID", "sflow_5.extended_80211.tx.ssid", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
3104       { &hf_sflow_flow_sample_index, { "Index", "sflow.flow_sample.index", FT_UINT32, BASE_DEC, NULL, 0x00FFFFFF, NULL, HFILL }},
3105       { &hf_sflow_counters_sample_index, { "Index", "sflow.counters_sample.index", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
3106     };
3107
3108     /* Setup protocol subtree array */
3109     static gint * ett[] = {
3110         &ett_sflow_245,
3111         &ett_sflow_245_sample,
3112         &ett_sflow_5_flow_record,
3113         &ett_sflow_5_counters_record,
3114         &ett_sflow_5_mpls_in_label_stack,
3115         &ett_sflow_5_mpls_out_label_stack,
3116         &ett_sflow_245_extended_data,
3117         &ett_sflow_245_gw_as_dst,
3118         &ett_sflow_245_gw_as_dst_seg,
3119         &ett_sflow_245_gw_community,
3120         &ett_sflow_245_sampled_header,
3121     };
3122
3123     static ei_register_info ei[] = {
3124         { &ei_sflow_invalid_address_type, { "sflow.invalid_address_type", PI_MALFORMED, PI_ERROR, "Unknown/invalid address type", EXPFILL }},
3125     };
3126
3127     expert_module_t* expert_sflow;
3128
3129     /* Register the protocol name and description */
3130     proto_sflow = proto_register_protocol(
3131             "InMon sFlow", /* name       */
3132             "sFlow", /* short name */
3133             "sflow" /* abbrev     */
3134             );
3135
3136     /* Required function calls to register the header fields and subtrees used */
3137     proto_register_field_array(proto_sflow, hf, array_length(hf));
3138     proto_register_subtree_array(ett, array_length(ett));
3139     expert_sflow = expert_register_protocol(proto_sflow);
3140     expert_register_field_array(expert_sflow, ei, array_length(ei));
3141
3142     /* Register our configuration options for sFlow */
3143     sflow_245_module = prefs_register_protocol(proto_sflow, proto_reg_handoff_sflow_245);
3144
3145     /* Set default Neflow port(s) */
3146     range_convert_str(&global_sflow_ports, SFLOW_UDP_PORTS, MAX_UDP_PORT);
3147
3148     prefs_register_obsolete_preference(sflow_245_module, "udp.port");
3149
3150     prefs_register_range_preference(sflow_245_module, "ports",
3151             "sFlow UDP Port(s)",
3152             "Set the port(s) for sFlow messages"
3153             " (default: " SFLOW_UDP_PORTS ")",
3154             &global_sflow_ports, MAX_UDP_PORT);
3155
3156     /*
3157        If I use a filter like "ip.src == 10.1.1.1" this will, in
3158        addition to the usual suspects, find every sFlow packet
3159        where *any* of the payload headers contain 10.1.1.1 as a
3160        src addr.  I think this may not be the desired behavior.
3161        It can certainly be confusing since the ip.src being found
3162        is buried about 3 subtrees deep and the subtrees might be
3163        under any one of the sampled (payload) header trees. It is
3164        certainly not quickly obvious why the filter matched.
3165      */
3166     prefs_register_bool_preference(sflow_245_module, "enable_dissection",
3167             "Dissect data in sampled headers",
3168             "Enabling dissection makes it easy to view protocol details in each of the sampled headers.  Disabling dissection may reduce noise caused when display filters match the contents of any sampled header(s).",
3169             &global_dissect_samp_headers);
3170     /*
3171        It is not clear to me that it *ever* makes sense to enable
3172        this option.  However, it was previously the default
3173        behavior so I'll leave it as an option if someone thinks
3174        they have a use for it.
3175      */
3176     prefs_register_bool_preference(sflow_245_module, "enable_analysis",
3177             "Analyze data in sampled IP headers",
3178             "This option only makes sense if dissection of sampled headers is enabled and probably not even then.",
3179             &global_analyze_samp_ip_headers);
3180 }
3181
3182 void
3183 proto_reg_handoff_sflow_245(void) {
3184     static range_t *sflow_ports;
3185     static gboolean sflow_245_prefs_initialized = FALSE;
3186
3187     if (!sflow_245_prefs_initialized) {
3188         sflow_handle = new_create_dissector_handle(dissect_sflow_245, proto_sflow);
3189         data_handle = find_dissector("data");
3190         sflow_245_prefs_initialized = TRUE;
3191     } else {
3192                 dissector_delete_uint_range("udp.port", sflow_ports, sflow_handle);
3193         g_free(sflow_ports);
3194     }
3195
3196     sflow_ports = range_copy(global_sflow_ports);
3197     dissector_add_uint_range("udp.port", sflow_ports, sflow_handle);
3198
3199
3200     /*dissector_handle_t sflow_245_handle;*/
3201
3202     /*
3203      * XXX - should this be done with a dissector table?
3204      */
3205
3206     if (global_dissect_samp_headers) {
3207         eth_withoutfcs_handle = find_dissector("eth_withoutfcs");
3208         tr_handle = find_dissector("tr");
3209         fddi_handle = find_dissector("fddi");
3210         fr_handle = find_dissector("fr");
3211         x25_handle = find_dissector("x.25");
3212         ppp_hdlc_handle = find_dissector("ppp_hdlc");
3213 #if 0
3214         smds_handle = find_dissector("smds");
3215 #else
3216         /* We don't have an SMDS dissector yet
3217          *
3218          *Switched multimegabit data service (SMDS) was a connectionless service
3219          *used to connect LANs, MANs and WANs to exchange data. SMDS was based on
3220          *the IEEE 802.6 DQDB standard. SMDS fragmented its datagrams into smaller
3221          *"cells" for transport, and can be viewed as a technological precursor of ATM.
3222          */
3223         smds_handle = data_handle;
3224 #endif
3225 #if 0
3226         aal5_handle = find_dissector("aal5");
3227 #else
3228         /*
3229          * No AAL5 (ATM Adaptation Layer 5) dissector available.
3230          * What does the packet look like?  An AAL5 PDU?  Where
3231          * do the VPI/VCI pair appear, if anywhere?
3232          */
3233         aal5_handle = data_handle;
3234 #endif
3235         ipv4_handle = find_dissector("ip");
3236         ipv6_handle = find_dissector("ipv6");
3237         mpls_handle = find_dissector("mpls");
3238 #if 0
3239         pos_handle = find_dissector("pos");
3240 #else
3241         /* wireshark does not have POS dissector yet */
3242         pos_handle = data_handle;
3243 #endif
3244         ieee80211_mac_handle = find_dissector("wlan");
3245 #if 0
3246         ieee80211_ampdu_handle = find_dissector("ampdu");
3247         ieee80211_amsdu_subframe_handle = find_dissector("wlan_aggregate");
3248 #else
3249         /* No handles for these */
3250         ieee80211_ampdu_handle = data_handle;
3251         ieee80211_amsdu_subframe_handle = data_handle;
3252 #endif
3253     } else {
3254         eth_withoutfcs_handle = data_handle;
3255         tr_handle = data_handle;
3256         fddi_handle = data_handle;
3257         fr_handle = data_handle;
3258         x25_handle = data_handle;
3259         ppp_hdlc_handle = data_handle;
3260         smds_handle = data_handle;
3261         aal5_handle = data_handle;
3262         ipv4_handle = data_handle;
3263         ipv6_handle = data_handle;
3264         mpls_handle = data_handle;
3265         pos_handle = data_handle;
3266         ieee80211_mac_handle = data_handle;
3267         ieee80211_ampdu_handle = data_handle;
3268         ieee80211_amsdu_subframe_handle = data_handle;
3269     }
3270
3271 }
3272
3273
3274 /*
3275  * Editor modelines
3276  *
3277  * Local Variables:
3278  * c-basic-offset: 4
3279  * tab-width: 8
3280  * indent-tabs-mode: nil
3281  * End:
3282  *
3283  * ex: set shiftwidth=4 tabstop=8 noexpandtab
3284  * :indentSize=4:tabSize=8:noTabs=true:
3285  */