forked from lucab/ntop
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathglobals-defines.h
2709 lines (2318 loc) · 96.7 KB
/
globals-defines.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/*
* -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
* http://www.ntop.org
*
* Copyright (C) 1998-2012 Luca Deri <[email protected]>
*
* -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software Foundation,
* Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*/
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
/*
*
* This file, included from ntop.h, contains ALL common #define statements.
*
* Changes here affect how ntop compiles. This includes features that are
* enabled, etc.
*
* Names have at least one part that defines their "type". Listed below in the order
* they are most frequently changed.
*
* PARM -- any "PARM" item is an internal tuning item, e.g. one that must be set at
* compile time and can not be overridden at run time.
*
* MAKE -- MAKEs are like PARM, but set based on other factors like the os, absence
* of other values, etc.
*
* DEBUG -- any "DEBUG" item is not normally set, but if #define(d) causes additional
* output fron ntop of a debugging nature.
*
* CONST, LEN and MAX - these are arbitrary values, limits and lengths of fields
* (buffer size, ethernet address, et al) and arrays.
*
* FLAG and BITFLAG -- are various constants and flags.
* FLAG is a numeric/char value used to mean something
* BITFLAG is a value used to test/set a specific bit in a value
*
* HTML -- an "HTML" item is the name of a page produced by the ntop web server. Using
* these constants ensures that the same name is used for testing and for including in
* generated html. Note that this includes the graphics we use (.jpg, .gif and .png)
* regardless of whether it's a generated "page" or just a static included image.
*
* CFG -- any "CFG" item is set in config.h by ./configure indicating that ntop was
* requested to be compiled with a particular configuration. These are not defined in
* this file.
*
* HAVE -- any "HAVE" item is set in config.h by ./configure indicating that the .h and
* .a/.so tests found we have a particular file or library during the testing process.
* HAVE items are not defined in this file (they're in config.h). However -
* Note that we don't differentiate in the code between the automatically generated
* singular items (HAVE_SSL_H) and the composite ones (generated from a bunch of tests,
* HAVE_OPENSSL). Forced and/or Composite items should be defined here.
*
* DEFAULT -- any "DEFAULT" item is the standard, default value of a global data item.
* This can be over-ridden (usually) by a command-line pararameter at run-time.
* These go pretty much last so they can use values from other classes.
*
* -- any MISSING or EXTERNALLY named item, obviously, has to have the proper missing
* or externally named name. These are grouped after the ntop stuff...
*
* Note that with this initial version (01-2003), there is something less than 100%
* adherence to this. Any corrections, comments, (hopefully) documentation would be
* greatly appreciated.
*
*/
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
/* P A R M items */
/* These typically make MAJOR changes in how ntop's operates */
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* These cause features (debugging or ones that may have problems) to be enabled/disabled.
*/
/*
* A general work-in-progress flag
*/
/* #define PARM_ENABLE_EXPERIMENTAL */
/*
* Controls whether to make a fork() call in http.c and others
*/
#define PARM_FORK_CHILD_PROCESS
/*
* Cache sessions instead of purging them and reuse.
*/
/* #define PARM_USE_SESSIONS_CACHE */
/*
* Define to enable alternating row colors on many tables.
*/
#undef PARM_USE_COLOR
/*
* This causes the hash functions in vendor.c to invert the mac address #s when
* computing the hash. This allows a lot fewer entries in the hash table.
*/
#define PARM_USE_MACHASH_INVERT
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* These cause more data (perhaps controversial or experimental) to be reported.
*/
/* PARM_PRINT_ALL_SESSIONS causes report.c/reportUtils.c to include in reports
* lines for sessions that are not "active".
*/
#define PARM_PRINT_ALL_SESSIONS
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* Timeouts and intervals - in seconds (x*60 = x minutes)
*/
/*
* SLEEP LIMIT - this is how long we let a thread actually sleep before
* waking up and checking myGlobals.ntopRunState...
*
* The lower this is, the more responsive ntop is to shutdowns. But the more time is 'wasted'
* just making threads and putting them back to sleep.
*
*/
#define PARM_SLEEP_LIMIT 10
/*
* Max number of hosts a 'non server' host should contact
*/
#define CONTACTED_PEERS_THRESHOLD 1024
/*
* How long between runs of the idle host purge?
*/
#define PARM_HOST_PURGE_INTERVAL 60
/*
* How long must a host be idle to be considered for purge?
*/
#define PARM_HOST_PURGE_MINIMUM_IDLE_NOACTVSES 60
#define PARM_HOST_PURGE_MINIMUM_IDLE_ACTVSES 60
/*
* How long must a session be idle to be considered for purge?
*/
#define PARM_SESSION_PURGE_MINIMUM_IDLE 10*60
/*
* How long before a passive ftp session timesout?
*/
#define PARM_PASSIVE_SESSION_MINIMUM_IDLE 60
/*
* How long an idle AS entry can last (sec)
* NOTE: it should be longer than the default RRD time
*/
#define PARM_AS_MAXIMUM_IDLE 360
/*
* How long to leave somebody in myGlobals.weDontWantToTalkWithYou[]
*/
#define PARM_WEDONTWANTTOTALKWITHYOU_INTERVAL 5*60 /* 5 minutes */
/*
* How often should we update the throughput counters?
*/
#define PARM_THROUGHPUT_REFRESH_INTERVAL 30
/*
* Minimum value for the auto refresh of web pages (those that can be auto refreshed).
* User set via the -r | --refresh-time parameter.
*/
#define PARM_MIN_WEBPAGE_AUTOREFRESH_TIME 15
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
/* M A K E option items */
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
/* Win32 - Force various things to make up for lack of ./configure process */
#ifdef WIN32
#define MAKE_STATIC_PLUGIN
#define CFG_LITTLE_ENDIAN 1
#undef CFG_BIG_ENDIAN
/* CFG_DATAFILE_DIR - see ntop_win32.h */
#ifndef CFG_PLUGIN_DIR
#define CFG_PLUGIN_DIR "."
#endif
#ifndef CFG_CONFIGFILE_DIR
#define CFG_CONFIGFILE_DIR "."
#endif
#ifndef CFG_DBFILE_DIR
#define CFG_DBFILE_DIR "."
#endif
#endif
/*
* Defined in (Linux) <arpa/nameser_compat.h> which is included from
* <arpa/nameser.h>
* If - for whatever reason - they're not found... add them, based on the Linux definitions.
*/
#ifndef PACKETSZ
#define MAKE_NTOP_PACKETSZ_DECLARATIONS
#endif
/*
* MAKE_WITH_SYSLOG is shorthand for defined(HAVE_SYS_SYSLOG_H) || defined(HAVE_SYSLOG_H)
* Use that ifdef everywhere else for code dependent on the includes.
*/
#undef MAKE_WITH_SYSLOG
#ifdef HAVE_SYS_SYSLOG_H
#define MAKE_WITH_SYSLOG
#else
#ifdef HAVE_SYSLOG_H
#define MAKE_WITH_SYSLOG
#endif
#endif
/*
* This flag indicates that fork() is implemented with copy-on-write.
* This means that the set of tables reported on in fork()ed processes
* will be complete and unchanged as of the instant of the fork.
*/
#if defined(LINUX)
#define MAKE_WITH_FORK_COPYONWRITE
#else /* WIN32 OPENBSD FREEBSD et al */
#undef MAKE_WITH_FORK_COPYONWRITE
#endif
/*
* This flag turns on a signal trap in netflowPlugin.c. If you're seeing
* netflow simply and silently die, this might catch the signal and log
* it for analysis.
*/
/* #define MAKE_WITH_NETFLOWSIGTRAP */
/*
* This flag turns on a signal trap in webInterface.c and in http.c for
* the children. If you're seeing pages simply and silently die, this
* might catch the signal and log it for analysis.
*/
/* #define MAKE_WITH_HTTPSIGTRAP */
/* EXPERIMENTAL */
/* Define MAKE_WITH_LOG_XXXXXX if you want log messages to use more than just
* LOG_ERR for ntop's messages.
*
* See util.c for the mappings from CONST_TRACE_xxxx_LEVEL to LOG_xxxxxx settings.
*
* If you do this, it's STRONGLY suggested - to prevent a large # of console
* messages - that you:
* use --use-syslog=local3 or such
* add local3.none to a couple of places in /etc/syslog.conf
* so ntop's LOG_ERROR messages don't flood the real console.
*/
/* #undef MAKE_WITH_LOG_XXXXXX */
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
/* D E B U G items */
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
/*
* WARNING: Descriptions are APPROXIMATE. Check the code before turning
* these on/off. They can cause HUGE amounts of log messages,
* and/or slow ntop down so it can't keep up.
*
* Debugging code has not been widely tested, is subject to change
* on a developers whim and should NOT be used on production systems!
*
* OK? You've been warned!
*
* If you add something here, remember to add it to the #ifdef and the
* detailed reporting lines in webInterface.c
*
*/
/*
* Enable these to make MAJOR, debug-type changes in ntop's activities!
* These are usually lots and lots of log messages
*/
/* ADDRESS_DEBUG logs the activities in address.c related to testing for
* local, pseudolocal and remote status for ip addresses.
*/
/* #define ADDRESS_DEBUG */
/* CHKVER_DEBUG logs the activities in util.c related to checking the ntop
* version.
*/
/* #define CHKVER_DEBUG */
/* CMPFCTN_DEBUG logs info about the hostResolvedName compare function.
*/
/* #define CMPFCTN_DEBUG */
/* DNS_DEBUG logs the activites in address.c related to Name resolution.
*/
/* #define DNS_DEBUG */
/* DNS_SNIFF_DEBUG logs the activites in pbuf.c and sessions.c related to
* DNS requests and replies sniffed out of the ntop monitored traffic.
*/
/* #define DNS_SNIFF_DEBUG */
/* FINGERPRINT_DEBUG logs information about OS Fingerprinting.
*/
/* #define FINGERPRINT_DEBUG */
/* FRAGMENT_DEBUG logs information about packet fragments nto receives.
*/
/* #define FRAGMENT_DEBUG */
/* FTP_DEBUG logs ftp control session information.
*/
/* #define FTP_DEBUG */
/* GDBM_DEBUG logs the activites in address.c related to gdbm */
/* #define GDBM_DEBUG */
/* HASH_DEBUG logs the adding of values to the hash. It also enables
* (a presently unused) routine, hashDump().
*/
/* #define HASH_DEBUG */
/* HOST_FREE_DEBUG logs the freeing of hash_hostTraffic by freeHostInfo() in hash.c
*/
/* #define HOST_FREE_DEBUG */
/* HTTP_DEBUG logs the http sessions. It logs HTTP/1... from source port 80
* and anything to destination port 80. Also http headers, etc.
*/
/* #define HTTP_DEBUG */
/* IDLE_PURGE_DEBUG logs the purging of idle hosts
*/
/* #define IDLE_PURGE_DEBUG */
/* INITWEB_DEBUG logs the initialization of the web server
*/
/* #define INITWEB_DEBUG */
/* LATENCY_DEBUG logs the acquisition of latency figures.
*/
/* #define LATENCY_DEBUG */
/* MEMORY_DEBUG selects among various options for debugging ntop's memory allocations
* (look in leaks.c for most of this).
*
* You can (and should) set this via --with-memorydebug=VALUE in ./configure!
*
* Undefined (or zero) ... no debugging
*
* 1 gnu mtrace()/muntrace()
* see http://www.gnu.org/software/libc/manual/html_node/Interpreting-the-traces.html
* 2 ElectricFence
* see http://directory.fsf.org/devel/debug/ElectricFence.html
* 3 leaks.c - ntop custom allocation tracker
* 4 gnu mcheck()
* see http://www.gnu.org/software/libc/manual/html_node/Heap-Consistency-Checking.html
*
* WARNING: If this is enabled, the size of the hash_list (later in ntop.h) is restricted.
*
* Use this construct for coding:
*
* #ifdef MAKE_WITH_SAFER_ROUTINES
* ...here...
* #elif defined(MEMORY_DEBUG) && (MEMORY_DEBUG == 1)
* ...here...
* #elif defined(MEMORY_DEBUG) && (MEMORY_DEBUG == 2)
* ...here...
* #elif defined(MEMORY_DEBUG) && (MEMORY_DEBUG == 3)
* ...here...
* #elif defined(MEMORY_DEBUG) && (MEMORY_DEBUG == 4)
* ...here...
* #elif defined(MEMORY_DEBUG)
* <error>
* #else
* <default, usually nothing>
* #endif
*
*/
/* #define MEMORY_DEBUG 1 */
/*
* WARNING: Unless you also define MEMORY_DEBUG_UNLIMITED, there
* There is code in pbuf.c that will automatically stop ntop,
* based upon the limits below...
*/
/* #define MEMORY_DEBUG_UNLIMITED */
#define MEMORY_DEBUG_PACKETS 10000
#define MEMORY_DEBUG_SECONDS 15*60 /* 15 Minutes */
/* Don't change this (except to add new cases) - it's the default handling for above ... */
#ifdef MAKE_WITH_SAFER_ROUTINES
#elif defined(MEMORY_DEBUG) && (MEMORY_DEBUG == 1)
#elif defined(MEMORY_DEBUG) && (MEMORY_DEBUG == 2)
#elif defined(MEMORY_DEBUG) && (MEMORY_DEBUG == 3)
#elif defined(MEMORY_DEBUG) && (MEMORY_DEBUG == 4)
#elif defined(MEMORY_DEBUG)
#error Invalid value for MEMORY_DEBUG - fix --with-memorydebug= ./configure option
#else
#define MAKE_WITH_SAFER_ROUTINES
#endif /* MAKE_WITH_SAFER_ROUTINES / MEMORY_DEBUG */
/*
* MUTEX_DEBUG causes util.c to log information about mutex/condvar operations.
*/
/* #define MUTEX_DEBUG */
/* NETFLOW_DEBUG logs the netflow packets as they are sent from
* sendNetFlow() in netflow.c
*/
/* #define NETFLOW_DEBUG */
/* PACKET_DEBUG writes the IP and ETHER packets received by ntop to
* a file. Major impact on performance...
*/
/* #define PACKET_DEBUG */
/* PARAM_DEBUG enabled debug messages during command line parameter
* processing.
*/
/* #define PARAM_DEBUG */
/* PLUGIN_DEBUG enables debug messages during plugin start/stop.
*/
/* #define PLUGIN_DEBUG */
/* PROBLEMREPORTID_DEBUG enables debug messages showing the values used to create
* the unique ProblemReport Id
*/
/* #define PROBLEMREPORTID_DEBUG */
/* P2P_DEBUG enables debug messages during P2P protocol processing.
*/
/* #define P2P_DEBUG 1 */
/* SESSION_TRACE_DEBUG causes sessions.c to log the start and end of
* tcp sessions.
*/
/* #define SESSION_TRACE_DEBUG */
/* STORAGE_DEBUG causes util.c to log the store/resurrection of host information,
* i.e. the -S command line parameter.
*/
/* #define STORAGE_DEBUG */
/* URL_DEBUG causes http.c to log information regarding processing of URLs
* received by the ntop web server
*/
/* #define URL_DEBUG */
/* UNKNOWN_PACKET_DEBUG causes pbuf.c to log packets that are
* either from an unknown protocol or of an unknown ethernet type
*/
/* #define UNKNOWN_PACKET_DEBUG */
/* VENDOR_DEBUG debugs the vendor table stuff in vendor.c
*/
/* #define VENDOR_DEBUG */
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
/* L E N, L I M, M A X items */
/* Some are with the CONST_ items, below too */
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* Tunables - changing these should allow ntop to handle more or less of some thing.
* Commonly changed ones are up front...
*/
/*
* Number of entries in myGlobals.packetQueue[], which is the queue of
* received but unanalyzed packets.
*
* Keep an eye on myGlobals.maxPacketQueueLen - this can eat up a lot of memory.
* Each entry is well over 2*DEFAULT_SNAPLEN bytes.
*/
#define CONST_PACKET_QUEUE_LENGTH 2048
/*
* This is the size of the table that holds IP addresses we don't want to
* talk to (due to sending an invalid - i.e. hostile) URL
*
* Valid values are 0 (disables) up to whatever.
*/
#define MAX_NUM_BAD_IP_ADDRESSES 3
/* Maximum number of queued addresses waiting to be resolved */
#define MAX_NUM_QUEUED_ADDRESSES 16384
/* Maximum length of network delay statistics */
#define MAX_NUM_NET_DELAY_STATS 16
/*
* Number of (optional) "AR - Address Resolution" threads,
* i.e. dequeueAddressThreadId[] and numDequeueThreads in myGlobals.
*
* You might increase this if you have really slow dns resolution and are running
* asyncronously.
*/
#define MAX_NUM_DEQUEUE_ADDRESS_THREADS 3
/* Hash size */
#define CONST_HASH_INITIAL_SIZE 32*1024
/* Number of mutexes used for locking sessions */
#define NUM_SESSION_MUTEXES 8
/*
* These change the break points for the "Network Traffic: xxxx" reports
* (e.g. dataHostTraffic.html et al). See getBgPctgColor() in reportUtils.c
*/
#define CONST_PCTG_LOW 25 /* % */
#define CONST_CONST_PCTG_LOW_COLOR "BGCOLOR=#C6EEF7"
#define CONST_PCTG_MID 75 /* % */
#define CONST_CONST_PCTG_MID_COLOR "BGCOLOR=#C6EFC8"
#define CONST_PCTG_HIGH_COLOR "BGCOLOR=#FF3118"
/*
* The number of entries in the logView ring buffer - how many log messages
* we can display in the GUI.
*/
#define CONST_LOG_VIEW_BUFFER_SIZE 50
/*
* Tunables - changing these should allow ntop to handle more or less of some thing.
* Uncommonly changed ones...
*/
/*
* The number of entries in HostTrafic's recentlyUsedClientPorts[] and
* recentlyUsedServerPorts[] - this is the "TCP/UDP Recently Used Ports"
* section of the "Info about host" report.
*/
#define MAX_NUM_RECENT_PORTS 5
/* it defines the maximum number of undefined protocols */
#define MAX_NUM_UNKNOWN_PROTOS 5
/*
* These are various html colors used in places throughout ntop.
*
* Change them if you want, remember there are also static .html pages and
* .css style sheets to change too!
*/
#define CONST_COLOR_1 "#CCCCFF"
#define CONST_COLOR_2 "#FFCCCC"
/*
* This is the minimum percentage of a slice in many of the pie graphs
* Anything smaller is just dropped. If you don't like your pies, change it.
* 0.1 % is 1 part in 1000. 0.5 or 1.0 might be better choices.
*/
#define MIN_SLICE_PERCENTAGE 0.1
/*
* This is the size if the box to draw the legends in
*/
#define CONST_LEGEND_BOX_SIZE 7
#define CONST_VLAN_COLUMN_SORT 20
/*
* Max number of OS entries in the report
*/
#define MAX_NUM_OS 256
#ifdef MEMORY_DEBUG
#define MAX_PER_DEVICE_HASH_LIST 256
#else
#define MAX_PER_DEVICE_HASH_LIST ((u_int16_t)-1) /* Static hash size */
#endif
#define MAX_NUM_PURGED_SESSIONS 512
#define MAX_TOT_NUM_SESSIONS MAX_PER_DEVICE_HASH_LIST
/*
* This is the theoretical upper limit on "NIC"s. This must be large enough to include
* the dummy device, other pseudo- devices (sFlow, netFlow) and all of the real and
* virtual network interface cards on the -i parameter.
*
* Note that because the big allocators are dynamic, reducing this will not save
* much memory. Still, 32 is absurd for MOST people.
*
* But, remember - when sniffing from a multihomed interface it is necessary to add
* all the virtual interfaces because ntop has to know all the local addresses.
*
* This affects static allocations:
* in graph.c - for reporting
* in hash.c - for lastPurgeTime[] in purgeIdleHosts()
* in plugin.c - for the flow filters structure
*
* This affects dynamic allocations in initialize.c - if it's too small for the -i parameter,
* there is a warning message in initDevices().
*
*/
#define MAX_NUM_DEVICES 32
/*
* Maximum virtual device (e.g. eth0:n) to check
*/
#define MAX_NUM_DEVICES_VIRTUAL 7
/*
* Display name for netFlow/sFlow 'dummy' or virtual devices
*/
#define NETFLOW_DEVICE_NAME "NetFlow-device"
#define SFLOW_DEVICE_NAME "sFlow-device"
#define CPACKET_DEVICE_NAME "cPacket-device"
/*
* This defines the maximum number of entries in the ntop pwFile
* note that both 'users' and 'urls' are stored in here.
*/
#define MAX_NUM_PWFILE_ENTRIES 64
/*
* This is an IPv4 convention - it's the upper port # that is "officially assigned" (reserved)
* for a specific service. This controls upto what port# ntop reports in various places,
* such as the 'TCP/UDP Service/Port Usage' section in the "Info about host" page, the
* 'TCP/UDP Protocol Subnet Usage' section in ipProtoUsage.html, etc.
*
* You could certainly make this larger if you are concerned about ports over 1024, but
* it will cost you memory.
*/
#define MAX_ASSIGNED_IP_PORTS 1024
/*
* Work table entries[] in dumpElementHash(), reportUtils.c
*/
#define MAX_HASHDUMP_ENTRY (u_short)-1
/*
* Size of the AS and VLAN hashes, created by allocateElementHash() and dumped by
* dumpElementHash().
*/
#define MAX_ELEMENT_HASH 4096
/*
* Size of the array of tcp ACK ids we are waiting to see (sessions.c).
* Note that this is a PER SESSION value. See handleSession().
*/
#define MAX_NUM_FIN 4
/*
* This MUST be a little bigger than the number of entries in the array in vendor.c
* Ideally, it would be prime and big enough to minimize the collisions
* (check IPX/SAP Hash Collisions in the configuration report).
*
* NOTE: The hashs can be optimized - look at the note in vendor.c
*
* Don't kill yourself on this - it's not a LOT of storage - unused entries cost
* only 8 bytes... These values are pretty good for the table as of 01-2003.
*
* Based on the data as of 01-2003:
* normal: size 181 2 collisions
* 109 4 collisions
* invert: size 179 0 collisions
* 93 2 collisions
*/
#ifdef PARM_USE_MACHASH_INVERT
#define MAX_IPXSAP_NAME_HASH 179
#else
#define MAX_IPXSAP_NAME_HASH 181
#endif
/*
* Size of the nfs entries hash in plugins/nfsPlugin.c.
*/
#define MAX_NFS_NAME_HASH 12288
/*
* Limit of the table used to display hosts in the pda Plugin.
*/
#define MAX_PDA_HOST_TABLE 4096
/*
* Limit of the table used to display hosts in the lastSeen plugin.
*/
#define MAX_LASTSEEN_TABLE_SIZE 4096
/*
* Maximum number of entries in the User Lists.
* See updateHTTPVirtualHosts(), updateFileList() and updateHostUsers().
* Note that these are singly linked lists, so this is the only limit
* on their size.
*/
#define MAX_NUM_LIST_ENTRIES 32
/*
* This is the maximum number of entries in the contacted peers tables,
* peersSerials[] in UsageCounter, and contactedIpPeersIndexes[] in ProcessInfo.
* These tables maintain the host to host contact information for various reports.
*/
#define MAX_NUM_CONTACTED_PEERS 8
/*
* This is the maximum number of 'routers' to report in the "Local Subnet Routers" section
* (that is localRoutersList.html). It's a local array, routerList[] built in
* printLocalRoutersList(). It is built from a scan of all of the contacted peers data.
*/
#define MAX_NUM_ROUTERS 512
/*
* This defines the number of entries in util.c of the local structure networks[][3]
* (i.e. the network, mask, and broadcast).
*
* This array is set from the NICs and -m values and used to determine if an address
* is pseudoLocal, see __pseudoLocalAddress().
*
* It MUST be big enough to hold all of the addresses assigned to each interface, plus
* any additional values set by -m. Don't be stingy - it's 3 32bit integers per entry.
*/
#define MAX_NUM_NETWORKS 64
/*
* This defines the # of entries in hostsCache[] in myGlobals.
*
* That is used as a holding tank of purged host entries for reuse, instead of
* doing free/malloc sets. The current value is reported as 'Host Memory Cache Size'
* in the configuration report.
*
* On a busy network with lots of hosts coming and going, this MIGHT help - check the
* info.html report and see if the MAX is this size.
*
* MAX_SESSIONS_CACHE_LEN defaults to the same, but it caches sessions and could
* be different.
*/
#define MAX_HOSTS_CACHE_LEN 512
#define MAX_SESSIONS_CACHE_LEN MAX_HOSTS_CACHE_LEN
/*
* Maximum number of bytes to process from a packet.
* Should equal the value of _mtuSize[DLT_NULL], set in globals-core.h.
*
* Note that this is the SIZE of the buffer, the actual # of bytes copied is
* set by DEFAULT_SNAPLEN.
*/
#ifdef MAKE_WITH_JUMBO_FRAMES
#define MAX_PACKET_LEN 9000
#else
#define MAX_PACKET_LEN 8232
#endif
/*
* Maximum number of protocols for graphs - hostIPTrafficDistrib()
* Probably don't want to change this - they get pretty unreadable even this big.
*/
#define MAX_NUM_PROTOS 64
/*
* Used in initialize.c to limit the size of myGlobals.device[].numHosts (you will see
* the message, Truncated network size (device xxx) to nnnn hosts (real netmask xxx).
*
* If you have a few devices but large networks (e.g. a single /16) you might want to
* increase this to track more hosts. But watch the memory usage.
*/
#define MAX_SUBNET_HOSTS 1024
/*
* Used in util.c - the number of entries in the (ftp) passiveSessions
* and voipSessions tracking structure
*/
#define MAX_PASSIVE_FTP_SESSION_TRACKER 2048
/*
* Sets myGlobals.maxNumLines, which is used to determine how many rows (lines)
* appear on each page of a multiple paged report
*/
#define CONST_NUM_TABLE_ROWS_PER_PAGE 30
/*
* Size of myGlobals.transTimeHash[], used to produce the "IP Service Stats"
* in the "Info about host" report. If you are monitoring a busy server
* handling lots of long running requests, you might need to up this -
* IF coding for other longer-running services is added. The key structure
* is ServiceStats in ProtocolInfo.
*/
#define CONST_NUM_TRANSACTION_ENTRIES 256
/*
* Number of entries in probeList[] in netFlowPlugin.c and sflowPlugin.c
*/
#define MAX_NUM_PROBES 16
/*
* Number of entries in flowIgnored[] in netFlowPlugin.c
*/
#define MAX_NUM_IGNOREDFLOWS 32
/*
* This is used in URL security to put an upper limit on the URL we're willing to
* deal with - it's then used in http.c as the size of a couple of static work buffers.
*/
#define MAX_LEN_URL 512
/*
* Number of tcp flags we'll store for an IP Session
*/
#define MAX_NUM_STORED_FLAGS 4
/*
* Used during initialization and the mtu and header size tables in globals-core.c,
* if we don't know the real value. This is a flag value so we don't do processing
* based on an unknown value.
*/
#define CONST_UNKNOWN_MTU 65355
/*
* Interval to run the (background) fingerprint lookup scan
*/
#define CONST_FINGERPRINT_LOOP_INTERVAL 150 /* 2.5m */
/*
* OS Fingerprint file, from ettercap (http://ettercap.sourceforge.net/)
*/
#define CONST_OSFINGERPRINT_FILE "etter.finger.os"
/*
* SourceForge page to submit new fingerprints for Ettercap...
*/
#define CONST_ETTERCAP_HOMEPAGE "http://ettercap.sourceforge.net/"
#define CONST_ETTERCAP_FINGERPRINT "fingerprint.php"
/*
* Autonomous System Number list file...
*/
#define CONST_ASLIST_FILE "AS-list.txt"
/*
* libgd file name
*/
#define CONST_LIBGD_SO "libgd.so"
/*
* openSSL (https://) stuff
*
* MAX_SSL_CONNECTIONS
* This is the # of SSL_connection entries in ssl[] and thus the maximum number
* of simultaneous SSL connections ntop can support.
*
* CONST_SSL_CERTF_FILENAME
* This is the name of the ssl certificate file ntop used, located in the
* myGlobals.configFileDirs[] list of directories.
*/
#ifdef HAVE_OPENSSL
#define MAX_SSL_CONNECTIONS 32
#define CONST_SSL_CERTF_FILENAME "ntop-cert.pem"
#endif
/*
* This is the URL to request the latest version information
*/
#define CONST_VERSIONCHECK_SITE "version.ntop.org"
#define CONST_VERSIONCHECK_DOCUMENT "version.xml"
#define CONST_VERSIONCHECK_URL CONST_VERSIONCHECK_SITE "/" CONST_VERSIONCHECK_DOCUMENT
/*
* How often - in SECONDS - to recheck the version information
* Why the weird value? So every instance in the world, which is started @ midnight by a
* cron job doesn't hit the web server at exactly the same time every nn days...
*/
#define CONST_VERSIONRECHECK_INTERVAL 1300000 /* 15 days 1 hour 6 minutes 40 seconds */
/* Other choices: */
//#define CONST_VERSIONRECHECK_INTERVAL 3600 /* 1 hour */
//#define CONST_VERSIONRECHECK_INTERVAL 86400 /* 1 Day */
//#define CONST_VERSIONRECHECK_INTERVAL 360000 /* 100 hours */
//#define CONST_VERSIONRECHECK_INTERVAL 604800 /* 1 week */
//#define CONST_VERSIONRECHECK_INTERVAL 1209600 /* 14 days */
//#define CONST_VERSIONRECHECK_INTERVAL 2592000 /* 30 days */
/*
* Status for checkVersion...
*/
#define FLAG_CHECKVERSION_NOTCHECKED 0
#define FLAG_CHECKVERSION_OBSOLETE 1
#define FLAG_CHECKVERSION_UNSUPPORTED 2
#define FLAG_CHECKVERSION_NOTCURRENT 3
#define FLAG_CHECKVERSION_CURRENT 4
#define FLAG_CHECKVERSION_OLDDEVELOPMENT 5
#define FLAG_CHECKVERSION_DEVELOPMENT 6
#define FLAG_CHECKVERSION_NEWDEVELOPMENT 7
/* Flag for printBar() */
#define FLAG_NONSPLITBAR 999 /* Anything > 100 < MAX_SHORT will work */
/*
* Items which affect the listen() call in webInterface.c. Making this larger
* allows the tcp/ip stack to queue more requests for the ntop web server
* before it starts dropping them. See man listen.
*/
#define DEFAULT_WEBSERVER_REQUEST_QUEUE_LEN 10
/*
* Be aware that some OSes have limits on how large this can be and
* will silently ignore larger values...
*/
#define MIN_WEBSERVER_REQUEST_QUEUE_LEN 2
#define MAX_WEBSERVER_REQUEST_QUEUE_LEN 20
/*
* These adjust the width of the columns in the info.html report
*/
#define CONST_INFOHTML_COL1_WIDTH 250
#define CONST_INFOHTML_COL2_WIDTH 175
#define CONST_INFOHTML_COL3_WIDTH 175
#define CONST_INFOHTML_COL23_WIDTH 350 /* columns 2 + 3 */
/*
* How many pathological cases (same IP/MAC different VLANs) to warn about
*/
#define MAX_MULTIPLE_VLAN_WARNINGS 10
/*
* How many packets/flows/cycles/records to track for the processing time stats -
* undef means don't do it...
*
* Values MUST BE a power of 2!
*/
#define MAX_PROCESS_BUFFER 1024
/* For compatibility w/ 3.2rc1, these are undef. But it's a good idea to enable them... */
#undef MAX_RRD_PROCESS_BUFFER
#undef MAX_RRD_CYCLE_BUFFER
#undef MAX_NETFLOW_FLOW_BUFFER
#undef MAX_NETFLOW_PACKET_BUFFER
/* #define MAX_RRD_PROCESS_BUFFER 512 */
/* #define MAX_RRD_CYCLE_BUFFER 4 */
/* #define MAX_NETFLOW_FLOW_BUFFER 128 */
/* #define MAX_NETFLOW_PACKET_BUFFER 16 */
/*
http://code.google.com/apis/maps/
*/
#define GOOGLE_DEFAULT_MAP_KEY "ABQIAAAAfFZuochHQVROgoyQEe3_SBS6yewdwLQqdZ11GEdkGrSPz1gWRxTmFdYiXZrTS3LFawwiK5Pufj5j1Q"
/*
* These are the constants used by the ntop web server to match requests and
* to generate links in generated pages. Look in http.c, plugins, etc.
*
* 1. Keep this list sorted by the defined value (e.g. the xxxx.html)
* 2. Add to it INSTEAD of using inline constants.
* 3. If the text ends .html, end the CONST_ constant with _HTML
* that keeps the full names different from the partials
* (similarly .xml .p3p, etc.)
* If it's a header (ends /), end the CONST_ with _HEADER
*/
#define CONST_ABTNTOP_HTML "aboutNtop.html"
#define CONST_ADD_URLS_HTML "addURLs.html"
#define CONST_ADD_USERS_HTML "addUsers.html"
#define CONST_BAR_ALLPROTO_DIST "allProtoDistribution"
#define CONST_CHANGE_FILTER_HTML "changeFilter.html"
#define CONST_CREDITS_HTML "Credits.html"
#define CONST_SORT_DATA_HOST_TRAFFIC_HTML "dataHostTraffic.html"
#define CONST_SORT_DATA_RCVD_HOST_TRAFFIC_HTML "dataRcvdHostTraffic.html"
#define CONST_SORT_DATA_SENT_HOST_TRAFFIC_HTML "dataSentHostTraffic.html"
#define CONST_DELETE_URL "deleteURL"
#define CONST_DELETE_USER "deleteUser"
#define CONST_DO_ADD_URL "doAddURL"
#define CONST_DO_ADD_USER "doAddUser"
#define CONST_DO_CHANGE_FILTER "doChangeFilter"
#define CONST_DOMAIN_STATS_HTML "domainStats.html"
#define CONST_COMMUNITIES_STATS_HTML "hostCommunities.html"
#define CONST_DUMP_DATA_HTML "dumpData.html"
#define CONST_DUMP_HOSTS_INDEXES_HTML "dumpDataIndexes.html"
#define CONST_DUMP_NTOP_FLOWS_HTML "dumpFlows.html"
#define CONST_DUMP_TRAFFIC_DATA_HTML "dumpTrafficData.html"
#define CONST_DUMP_NTOP_XML "dump.xml"
#define CONST_EDIT_PREFS "editPrefs.html"
#define CONST_FAVICON_ICO "favicon.ico"
#define CONST_FILTER_INFO_HTML "filterInfo.html"
#define CONST_IF_STATS_HTML "ifStats.html"
#define CONST_NTOP_HELP_HTML "help.html"