/* packet-sflow.c

 * Routines for sFlow v5 dissection implemented according to the specifications

 * at http://www.sflow.org/sflow_version_5.txt

 *

 * Additional 802.11 structures support implemented according to the

 * specifications at http://www.sflow.org/sflow_80211.txt

 *

 * By Yi Yu <yiyu.inbox@gmail.com>

 *

 * TODO:

 *   802.11 aggregation data dissection                         (sFlow v5)

 *

 *

 * Based on Jeff Rizzo's <riz@boogers.sf.ca.us> dissector for sFlow v2/4

 * in Wireshark 1.0.8 public release.

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 *

 *

 * This file (mostly) implements a dissector for sFlow (RFC3176),

 * from the version 4 spec at http://www.sflow.org/SFLOW-DATAGRAM.txt .

 *

 * TODO:

 *   Fix the highlighting of the datastream when bits are selected

 *   split things out into packet-sflow.h ?

 *   make routines more consistent as to whether they return

 *     'offset' or bytes consumed ('len')                       (sFlow v2/4)

 *   implement sampled_ipv4 and sampled_ipv6 packet data types  (sFlow v2/4)

 *   implement extended_user                                    (sFlow v2/4)

 *   implement extended_url                                     (sFlow v2/4)

 *   implement non-generic counters sampling                    (sFlow v2/4)

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/exceptions.h>

#include <epan/prefs.h>

#include <epan/expert.h>

#include <epan/to_str.h>

#include <epan/etypes.h>

#include <epan/tfs.h>

#include <epan/unit_strings.h>

#include <wsutil/array.h>

#include <wsutil/ws_roundup.h>

#include <wsutil/ws_padding_to.h>

#include "packet-sflow.h"

#include "packet-iana-data.h"

#define SFLOW_UDP_PORTS "6343"

void proto_register_sflow(void);

static dissector_handle_t sflow_handle;

/*

 *  sflow_245_ports : holds the currently used range of ports for sflow

 */

static bool global_dissect_samp_headers = true;

static bool global_analyze_samp_ip_headers;

#define ENTERPRISE_DEFAULT 0

#define ADDR_TYPE_UNKNOWN 0

#define ADDR_TYPE_IPV4    1

#define ADDR_TYPE_IPV6    2

#define FLOWSAMPLE 1

#define COUNTERSSAMPLE 2

#define EXPANDED_FLOWSAMPLE 3

#define EXPANDED_COUNTERSSAMPLE 4

#define LAG_PORT_STATS 7

static const value_string sflow_agent_address_types[] = {

    { ADDR_TYPE_IPV4, "IPv4" },

    { ADDR_TYPE_IPV6, "IPv6" },

    { 0, NULL }

};

static const value_string sflow_245_sampletype[] = {

    { FLOWSAMPLE,              "Flow sample"},

    { COUNTERSSAMPLE,          "Counters sample"},

    { EXPANDED_FLOWSAMPLE,     "Expanded flow sample"},

    { EXPANDED_COUNTERSSAMPLE, "Expanded counters sample"},

    { LAG_PORT_STATS,          "Lag Port stats"},

    { 0, NULL}

};

#define SFLOW_5_IEEE80211_VERSION_A 1

#define SFLOW_5_IEEE80211_VERSION_B 2

#define SFLOW_5_IEEE80211_VERSION_G 3

#define SFLOW_5_IEEE80211_VERSION_N 4

static const value_string sflow_5_ieee80211_versions [] = {

    { SFLOW_5_IEEE80211_VERSION_A, "802.11a"},

    { SFLOW_5_IEEE80211_VERSION_B, "802.11b"},

    { SFLOW_5_IEEE80211_VERSION_G, "802.11g"},

    { SFLOW_5_IEEE80211_VERSION_N, "802.11n"},

    { 0, NULL}

};

/* interface counter types */

#define SFLOW_245_COUNTERS_GENERIC 1

#define SFLOW_245_COUNTERS_ETHERNET 2

#define SFLOW_245_COUNTERS_TOKENRING 3

#define SFLOW_245_COUNTERS_FDDI 4

#define SFLOW_245_COUNTERS_VG 5

#define SFLOW_245_COUNTERS_WAN 6

#define SFLOW_245_COUNTERS_VLAN 7

static const value_string sflow_245_counterstype[] = {

    { SFLOW_245_COUNTERS_GENERIC,  "Generic counters"},

    { SFLOW_245_COUNTERS_ETHERNET, "Ethernet counters"},

    { SFLOW_245_COUNTERS_TOKENRING,"Token Ring counters"},

    { SFLOW_245_COUNTERS_FDDI,     "FDDI counters"},

    { SFLOW_245_COUNTERS_VG,       "100baseVG counters"},

    { SFLOW_245_COUNTERS_WAN,      "WAN counters"},

    { SFLOW_245_COUNTERS_VLAN,     "VLAN counters"},

    { 0, NULL}

};

#define MAX_HEADER_SIZE 256

#define SFLOW_245_PACKET_DATA_TYPE_HEADER 1

#define SFLOW_245_PACKET_DATA_TYPE_IPV4 2

#define SFLOW_245_PACKET_DATA_TYPE_IPV6 3

static const value_string sflow_245_packet_information_type[] = {

    { SFLOW_245_PACKET_DATA_TYPE_HEADER, "Packet headers are sampled"},

    { SFLOW_245_PACKET_DATA_TYPE_IPV4,   "IP Version 4 data"},

    { SFLOW_245_PACKET_DATA_TYPE_IPV6,   "IP Version 6 data"},

    { 0, NULL}

};

static const value_string extended_80211_suite_type_vals[] = {

    { 0, "Use group cipher suite"},

    { 1, "WEP-40"},

    { 2, "TKIP"},

    { 4, "CCMP"},

    { 5, "WEP-104"},

    { 0, NULL}

};

static const value_string sflow_ifdirection_vals[] = {

    { 1, "Full-Duplex"},

    { 2, "Half-Duplex"},

    { 3, "In"},

    { 4, "Out"},

    { 0, NULL}

};

static const true_false_string tfs_minimize_monetary_normal = { "Minimize Monetary", "Normal" };

static const value_string sflow_245_header_protocol[] = {

    { SFLOW_245_HEADER_ETHERNET,           "Ethernet"},

    { SFLOW_245_HEADER_TOKENBUS,           "Token Bus"},

    { SFLOW_245_HEADER_TOKENRING,          "Token Ring"},

    { SFLOW_245_HEADER_FDDI,               "FDDI"},

    { SFLOW_245_HEADER_FRAME_RELAY,        "Frame Relay"},

    { SFLOW_245_HEADER_X25,                "X.25"},

    { SFLOW_245_HEADER_PPP,                "PPP"},

    { SFLOW_245_HEADER_SMDS,               "SMDS"},

    { SFLOW_245_HEADER_AAL5,               "ATM AAL5"},

    { SFLOW_245_HEADER_AAL5_IP,            "ATM AAL5-IP (e.g., Cisco AAL5 mux)"},

    { SFLOW_245_HEADER_IPv4,               "IPv4"},

    { SFLOW_245_HEADER_IPv6,               "IPv6"},

    { SFLOW_245_HEADER_MPLS,               "MPLS"},

    { SFLOW_5_HEADER_POS,                  "PPP over SONET/SDH (RFC 1662, 2615)"},

    { SFLOW_5_HEADER_80211_MAC,            "802.11 MAC"},

    { SFLOW_5_HEADER_80211_AMPDU,          "802.11n Aggregated MPDU"},

    { SFLOW_5_HEADER_80211_AMSDU_SUBFRAME, "A-MSDU Subframe"},

    { 0, NULL}

};

static value_string_ext sflow_245_header_protocol_ext = VALUE_STRING_EXT_INIT(sflow_245_header_protocol);

/* extended packet data types */

#define SFLOW_245_EXTENDED_SWITCH 1

#define SFLOW_245_EXTENDED_ROUTER 2

#define SFLOW_245_EXTENDED_GATEWAY 3

#define SFLOW_245_EXTENDED_USER 4

#define SFLOW_245_EXTENDED_URL 5

static const value_string sflow_245_extended_data_types[] = {

    { SFLOW_245_EXTENDED_SWITCH, "Extended switch information"},

    { SFLOW_245_EXTENDED_ROUTER, "Extended router information"},

    { SFLOW_245_EXTENDED_GATEWAY, "Extended gateway information"},

    { SFLOW_245_EXTENDED_USER, "Extended user information"},

    { SFLOW_245_EXTENDED_URL, "Extended URL information"},

    { 0, NULL}

};

#define SFLOW_245_AS_SET 1

#define SFLOW_245_AS_SEQUENCE 2

static const value_string sflow_245_as_types[] = {

    { SFLOW_245_AS_SET, "AS Set"},

    { SFLOW_245_AS_SEQUENCE, "AS Sequence"},

    { 0, NULL}

};

#define SFLOW_245_IPV4_PRECEDENCE_ROUTINE 0

#define SFLOW_245_IPV4_PRECEDENCE_PRIORITY 1

#define SFLOW_245_IPV4_PRECEDENCE_IMMEDIATE 2

#define SFLOW_245_IPV4_PRECEDENCE_FLASH 3

#define SFLOW_245_IPV4_PRECEDENCE_FLASH_OVERRIDE 4

#define SFLOW_245_IPV4_PRECEDENCE_CRITIC_ECP 5

#define SFLOW_245_IPV4_PRECEDENCE_INTERNETWORK_CONTROL 6

#define SFLOW_245_IPV4_PRECEDENCE_NETWORK_CONTROL 7

static const value_string sflow_245_ipv4_precedence_types[] = {

    { SFLOW_245_IPV4_PRECEDENCE_ROUTINE, "Routine"},

    { SFLOW_245_IPV4_PRECEDENCE_PRIORITY, "Priority"},

    { SFLOW_245_IPV4_PRECEDENCE_IMMEDIATE, "Immediate"},

    { SFLOW_245_IPV4_PRECEDENCE_FLASH, "Flash"},

    { SFLOW_245_IPV4_PRECEDENCE_FLASH_OVERRIDE, "Flash Override"},

    { SFLOW_245_IPV4_PRECEDENCE_CRITIC_ECP, "CRITIC/ECP"},

    { SFLOW_245_IPV4_PRECEDENCE_INTERNETWORK_CONTROL, "Internetwork Control"},

    { SFLOW_245_IPV4_PRECEDENCE_NETWORK_CONTROL, "Network Control"},

    { 0, NULL}

};

/* sFlow v5 flow record formats */

#define SFLOW_5_RAW_PACKET_HEADER    1

#define SFLOW_5_ETHERNET_FRAME       2

#define SFLOW_5_IPV4                 3

#define SFLOW_5_IPV6                 4

#define SFLOW_5_SWITCH            1001

#define SFLOW_5_ROUTER            1002

#define SFLOW_5_GATEWAY           1003

#define SFLOW_5_USER              1004

#define SFLOW_5_URL               1005

#define SFLOW_5_MPLS_DATA         1006

#define SFLOW_5_NAT               1007

#define SFLOW_5_MPLS_TUNNEL       1008

#define SFLOW_5_MPLS_VC           1009

#define SFLOW_5_MPLS_FEC          1010

#define SFLOW_5_MPLS_LVP_FEC      1011

#define SFLOW_5_VLAN_TUNNEL       1012

#define SFLOW_5_80211_PAYLOAD     1013

#define SFLOW_5_80211_RX          1014

#define SFLOW_5_80211_TX          1015

#define SFLOW_5_80211_AGGREGATION 1016

static const value_string sflow_5_flow_record_type[] = {

    { SFLOW_5_RAW_PACKET_HEADER, "Raw packet header"},

    { SFLOW_5_ETHERNET_FRAME,    "Ethernet frame data"},

    { SFLOW_5_IPV4,              "IPv4 data"},

    { SFLOW_5_IPV6,              "IPv6 data"},

    { SFLOW_5_SWITCH,            "Extended switch data"},

    { SFLOW_5_ROUTER,            "Extended router data"},

    { SFLOW_5_GATEWAY,           "Extended gateway data"},

    { SFLOW_5_USER,              "Extended user data"},

    { SFLOW_5_URL,               "Extended URL data"},

    { SFLOW_5_MPLS_DATA,         "Extended MPLS data"},

    { SFLOW_5_NAT,               "Extended NAT data"},

    { SFLOW_5_MPLS_TUNNEL,       "Extended MPLS tunnel data"},

    { SFLOW_5_MPLS_VC,           "Extended MPLS VC data"},

    { SFLOW_5_MPLS_FEC,          "Extended MPLS FEC data"},

    { SFLOW_5_MPLS_LVP_FEC,      "Extended MPLS LVP FEC data"},

    { SFLOW_5_VLAN_TUNNEL,       "Extended VLAN tunnel"},

    { SFLOW_5_80211_PAYLOAD,     "Extended 802.11 payload"},

    { SFLOW_5_80211_RX,          "Extended 802.11 RX"},

    { SFLOW_5_80211_TX,          "Extended 802.11 TX"},

    { SFLOW_5_80211_AGGREGATION, "Extended 802.11 aggregation"},

    { 0, NULL}

};

static value_string_ext sflow_5_flow_record_type_ext = VALUE_STRING_EXT_INIT(sflow_5_flow_record_type);

/* sFlow v5 counters record formats */

#define SFLOW_5_GENERIC_INTERFACE 1

#define SFLOW_5_ETHERNET_INTERFACE 2

#define SFLOW_5_TOKEN_RING 3

#define SFLOW_5_100BASE_VG_INTERFACE 4

#define SFLOW_5_VLAN 5

#define SFLOW_5_80211_COUNTERS 6

#define SFLOW_5_LAG 7

#define SFLOW_5_PROCESSOR 1001

#define SFLOW_5_RADIO_UTILIZATION 1002

static const value_string sflow_5_counters_record_type[] = {

    { SFLOW_5_GENERIC_INTERFACE,    "Generic interface counters"},

    { SFLOW_5_ETHERNET_INTERFACE,   "Ethernet interface counters"},

    { SFLOW_5_TOKEN_RING,           "Token ring counters"},

    { SFLOW_5_100BASE_VG_INTERFACE, "100 Base VG interface counters"},

    { SFLOW_5_VLAN,                 "VLAN counters"},

    { SFLOW_5_LAG,                  "LAG counters"},

    { SFLOW_5_80211_COUNTERS,       "IEEE 802.11 counters"},

    { SFLOW_5_PROCESSOR,            "Processor information"},

    { SFLOW_5_RADIO_UTILIZATION,    "Radio utilization"},

    { 0, NULL}

};

/* sFlow v5 interface formats */

#define SFLOW_5_INT_FORMAT 0xC0000000

#define SFLOW_5_INT_VALUE  0x3FFFFFFF

#define SFLOW_5_INT_FORMAT_IFINDEX  0

#define SFLOW_5_INT_FORMAT_DISCARD  1

#define SFLOW_5_INT_FORMAT_MULTIPLE 2

static const value_string interface_format[] = {

    { SFLOW_5_INT_FORMAT_IFINDEX,       "ifindex"},

    { SFLOW_5_INT_FORMAT_DISCARD,       "packet discarded"},

    { SFLOW_5_INT_FORMAT_MULTIPLE,      "multiple interfaces"},

    { 0, NULL}

};

static const value_string interface_discard[] = {

    {   0, "Net Unreachable"},

    {   1, "Host Unreachable"},

    {   2, "Protocol Unreachable"},

    {   3, "Port Unreachable"},

    {   4, "Fragmentation Needed and Don't Fragment was Set"},

    {   5, "Source Route Failed"},

    {   6, "Destination Network Unknown"},

    {   7, "Destination Host Unknown"},

    {   8, "Source Host Isolated"},

    {   9, "Communication with Destination Network is Administratively Prohibited"},

    {  10, "Communication with Destination Host is Administratively Prohibited"},

    {  11, "Destination Network Unreachable for Type of Service"},

    {  12, "Destination Host Unreachable for Type of Service"},

    {  13, "Communication Administratively Prohibited"},

    {  14, "Host Precedence Violation"},

    {  15, "Precedence cutoff in effect"},

    { 256, "unknown"},

    { 257, "ttl exceeded"},

    { 258, "ACL"},

    { 259, "no buffer space"},

    { 260, "RED"},

    { 261, "traffic shaping/rate limiting"},

    { 262, "packet too big (for protocols that don't support fragmentation)"},

    { 263, "Source MAC is multicast"},

    { 264, "VLAN tag mismatch"},

    { 265, "Ingress VLAN filter"},

    { 266, "Ingress spanning tree filter"},

    { 267, "Port list is empty"},

    { 268, "Port loopback filter"},

    { 269, "Blackhole route"},

    { 270, "Non IP"},

    { 271, "Unicast destination IP over multicast destination MAC"},

    { 272, "Destination IP is loopback address"},

    { 273, "Source IP is multicast"},

    { 274, "Source IP is looback address"},

    { 275, "IP header corrupted"},

    { 276, "IPv4 source address is limited broadcast"},

    { 277, "IPv6 multicast destination IP reserved scope"},

    { 278, "IPv6 multicast destination IP interface local scope"},

    { 279, "Unresolved neighbor"},

    { 280, "Multicast reverse path forwarding"},

    { 281, "Non routable packet"},

    { 282, "Decap error"},

    { 283, "Overlay source MAC is multicast"},

    { 284, "Unknown L2"},

    { 285, "Unknown L3"},

    { 286, "Unknown L3 exception"},

    { 287, "Unknown buffer"},

    { 288, "Unknown tunnel"},

    { 289, "Unknown L4"},

    { 290, "Source IP in unspecified"},

    { 291, "Mlag port isolation"},

    { 292, "Blackhole ARP neighbor"},

    { 293, "Source MAC is destination MAC"},

    { 294, "Destination MAC is reserved"},

    { 295, "Source IP class E"},

    { 296, "Multicast destination MAC mismatch"},

    { 297, "Source IP is destination IP"},

    { 298, "Destination IP is local network"},

    { 299, "Destination IP is link local"},

    { 300, "Overlay source MAC is destination MAC"},

    { 301, "Egress VLAN filter"},

    { 302, "Unicast reverse path forwarding"},

    { 303, "Split horizon"},

    { 304, "locked_port"},

    { 305, "dmac_filter"},

    { 306, "blackhole_nexthop"},

    { 307, "vxlan_parsing"},

    { 308, "llc_snap_parsing"},

    { 309, "vlan_parsing"},

    { 310, "pppoe_ppp_parsing"},

    { 311, "mpls_parsing"},

    { 312, "arp_parsing"},

    { 313, "ip_1_parsing"},

    { 314, "ip_n_parsing"},

    { 315, "gre_parsing"},

    { 316, "udp_parsing"},

    { 317, "tcp_parsing"},

    { 318, "ipsec_parsing"},

    { 319, "sctp_parsing"},

    { 320, "dccp_parsing"},

    { 321, "gtp_parsing"},

    { 322, "esp_parsing"},

    { 323, "unknown_parsing"},

    { 324, "pkt_too_small"},

    { 325, "unhandled_proto"},

    { 326, "ipv6disabled"},

    { 327, "invalid_proto"},

    { 328, "ip_noproto"},

    { 329, "skb_csum"},

    { 330, "skb_ucopy_fault"},

    { 331, "dev_ready"},

    { 332, "dev_hdr"},

    { 333, "dup_frag"},

    { 334, "skb_gso_seg"},

    { 335, "reverse_path_forwarding"},

    { 336, "icmp_parsing"},

    { 337, "tcp_md5notfound"},

    { 338, "tcp_md5unexpected"},

    { 339, "tcp_md5failure"},

    { 340, "tcp_flags"},

    { 341, "tcp_zerowindow"},

    { 342, "tcp_old_data"},

    { 343, "tcp_overwindow"},

    { 344, "tcp_ofomerge"},

    { 345, "tcp_rfc7323_paws"},

    { 346, "tcp_invalid_sequence"},

    { 347, "tcp_reset"},

    { 348, "tcp_invalid_syn"},

    { 349, "tcp_close"},

    { 350, "tcp_fastopen"},

    { 351, "tcp_old_ack"},

    { 352, "tcp_too_old_ack"},

    { 353, "tcp_ack_unsent_data"},

    { 354, "tcp_ofo_queue_prune"},

    { 355, "tcp_ofo_drop"},

    { 356, "tcp_minttl"},

    { 357, "ipv6_bad_exthdr"},

    { 358, "ipv6_ndisc_frag"},

    { 359, "ipv6_ndisc_hop_limit"},

    { 360, "ipv6_ndisc_bad_code"},

    { 361, "ipv6_ndisc_bad_options"},

    { 362, "ipv6_ndisc_ns_otherhost"},

    { 363, "tap_filter"},

    { 364, "tap_txfilter"},

    { 365, "tc_ingress"},

    { 366, "tc_egress"},

    { 367, "xdp"},

    { 368, "cpu_backlog"},

    { 369, "bpf_cgroup_egress"},

    { 370, "xfrm_policy"},

    { 371, "socket_filter"},

    { 372, "bgp_flowspec"},

    { 0, NULL}

};

/* ethernet counters.  These will be preceded by generic counters. */

struct ethernet_counters {

    uint32_t dot3StatsAlignmentErrors;

    uint32_t dot3StatsFCSErrors;

    uint32_t dot3StatsSingleCollisionFrames;

    uint32_t dot3StatsMultipleCollisionFrames;

    uint32_t dot3StatsSQETestErrors;

    uint32_t dot3StatsDeferredTransmissions;

    uint32_t dot3StatsLateCollisions;

    uint32_t dot3StatsExcessiveCollisions;

    uint32_t dot3StatsInternalMacTransmitErrors;

    uint32_t dot3StatsCarrierSenseErrors;

    uint32_t dot3StatsFrameTooLongs;

    uint32_t dot3StatsInternalMacReceiveErrors;

    uint32_t dot3StatsSymbolErrors;

};

struct sflow_address_type {

    int hf_addr_v4;

    int hf_addr_v6;

};

/* Initialize the protocol and registered fields */

static int proto_sflow;

static int hf_sflow_version;

static int hf_sflow_agent_address_type;

static int hf_sflow_agent_address_v4;

static int hf_sflow_agent_address_v6;

static int hf_sflow_5_sub_agent_id;

static int hf_sflow_5_sample_length;

static int hf_sflow_5_flow_data_length;

/* static int hf_sflow_5_counters_data_length; */

static int hf_sflow_245_seqnum;

static int hf_sflow_245_sysuptime;

static int hf_sflow_245_numsamples;

static int hf_sflow_245_header_protocol;

static int hf_sflow_245_sampletype;

static int hf_sflow_245_sampletype12;

static int hf_sflow_245_ipv4_precedence_type;

static int hf_sflow_5_flow_record_format;

static int hf_sflow_5_counters_record_format;

static int hf_sflow_245_header;

static int hf_sflow_245_packet_information_type;

static int hf_sflow_245_extended_information_type;

static int hf_sflow_245_vlan_in; /* incoming 802.1Q VLAN ID */

static int hf_sflow_245_vlan_out; /* outgoing 802.1Q VLAN ID */

static int hf_sflow_245_pri_in; /* incoming 802.1p priority */

static int hf_sflow_245_pri_out; /* outgoing 802.1p priority */

static int hf_sflow_245_nexthop_v4; /* nexthop address */

static int hf_sflow_245_nexthop_v6; /* nexthop address */

static int hf_sflow_245_ipv4_src;

static int hf_sflow_245_ipv4_dst;

static int hf_sflow_245_ipv6_src;

static int hf_sflow_245_ipv6_dst;

static int hf_sflow_245_nexthop_src_mask;

static int hf_sflow_245_nexthop_dst_mask;

/* extended gateway (all versions) */

static int hf_sflow_245_as;

static int hf_sflow_245_src_as;

static int hf_sflow_245_src_peer_as;

static int hf_sflow_245_dst_as_entries; /* aka length */

static int hf_sflow_245_dst_as;

/* extended gateway (>= version 4) */

static int hf_sflow_245_community_entries;

/* static int hf_sflow_245_community; */

static int hf_sflow_245_localpref;

/* generic interface counter */

static int hf_sflow_245_ifindex;

static int hf_sflow_245_iftype;

static int hf_sflow_245_ifspeed;

static int hf_sflow_245_ifdirection;

static int hf_sflow_245_ifadmin_status;

static int hf_sflow_245_ifoper_status;

static int hf_sflow_245_ifinoct;

static int hf_sflow_245_ifinpkt;

static int hf_sflow_245_ifinmcast;

static int hf_sflow_245_ifinbcast;

static int hf_sflow_245_ifinerr;

static int hf_sflow_245_ifindisc;

static int hf_sflow_245_ifinunk;

static int hf_sflow_245_ifoutoct;

static int hf_sflow_245_ifoutpkt;

static int hf_sflow_245_ifoutmcast;

static int hf_sflow_245_ifoutbcast;

static int hf_sflow_245_ifoutdisc;

static int hf_sflow_245_ifouterr;

static int hf_sflow_245_ifpromisc;

/* ethernet interface counter */

static int hf_sflow_245_dot3StatsAlignmentErrors;

static int hf_sflow_245_dot3StatsFCSErrors;

static int hf_sflow_245_dot3StatsSingleCollisionFrames;

static int hf_sflow_245_dot3StatsMultipleCollisionFrames;

static int hf_sflow_245_dot3StatsSQETestErrors;

static int hf_sflow_245_dot3StatsDeferredTransmissions;

static int hf_sflow_245_dot3StatsLateCollisions;

static int hf_sflow_245_dot3StatsExcessiveCollisions;

static int hf_sflow_245_dot3StatsInternalMacTransmitErrors;

static int hf_sflow_245_dot3StatsCarrierSenseErrors;

static int hf_sflow_245_dot3StatsFrameTooLongs;

static int hf_sflow_245_dot3StatsInternalMacReceiveErrors;

static int hf_sflow_245_dot3StatsSymbolErrors;

/* token ring counter */

static int hf_sflow_245_dot5StatsLineErrors;

static int hf_sflow_245_dot5StatsBurstErrors;

static int hf_sflow_245_dot5StatsACErrors;

static int hf_sflow_245_dot5StatsAbortTransErrors;

static int hf_sflow_245_dot5StatsInternalErrors;

static int hf_sflow_245_dot5StatsLostFrameErrors;

static int hf_sflow_245_dot5StatsReceiveCongestions;

static int hf_sflow_245_dot5StatsFrameCopiedErrors;

static int hf_sflow_245_dot5StatsTokenErrors;

static int hf_sflow_245_dot5StatsSoftErrors;

static int hf_sflow_245_dot5StatsHardErrors;

static int hf_sflow_245_dot5StatsSignalLoss;

static int hf_sflow_245_dot5StatsTransmitBeacons;

static int hf_sflow_245_dot5StatsRecoveries;

static int hf_sflow_245_dot5StatsLobeWires;

static int hf_sflow_245_dot5StatsRemoves;

static int hf_sflow_245_dot5StatsSingles;

static int hf_sflow_245_dot5StatsFreqErrors;

/* 100 BaseVG interface counters */

static int hf_sflow_245_dot12InHighPriorityFrames;

static int hf_sflow_245_dot12InHighPriorityOctets;

static int hf_sflow_245_dot12InNormPriorityFrames;

static int hf_sflow_245_dot12InNormPriorityOctets;

static int hf_sflow_245_dot12InIPMErrors;

static int hf_sflow_245_dot12InOversizeFrameErrors;

static int hf_sflow_245_dot12InDataErrors;

static int hf_sflow_245_dot12InNullAddressedFrames;

static int hf_sflow_245_dot12OutHighPriorityFrames;

static int hf_sflow_245_dot12OutHighPriorityOctets;

static int hf_sflow_245_dot12TransitionIntoTrainings;

static int hf_sflow_245_dot12HCInHighPriorityOctets;

static int hf_sflow_245_dot12HCInNormPriorityOctets;

static int hf_sflow_245_dot12HCOutHighPriorityOctets;

/* VLAN counters */

static int hf_sflow_245_vlan_id;

static int hf_sflow_245_octets;

static int hf_sflow_245_ucastPkts;

static int hf_sflow_245_multicastPkts;

static int hf_sflow_245_broadcastPkts;

static int hf_sflow_245_discards;

/* 802.11 interface counters */

static int hf_sflow_5_dot11TransmittedFragmentCount;

static int hf_sflow_5_dot11MulticastTransmittedFrameCount;

static int hf_sflow_5_dot11FailedCount;

static int hf_sflow_5_dot11RetryCount;

static int hf_sflow_5_dot11MultipleRetryCount;

static int hf_sflow_5_dot11FrameDuplicateCount;

static int hf_sflow_5_dot11RTSSuccessCount;

static int hf_sflow_5_dot11RTSFailureCount;

static int hf_sflow_5_dot11ACKFailureCount;

static int hf_sflow_5_dot11ReceivedFragmentCount;

static int hf_sflow_5_dot11MulticastReceivedFrameCount;

static int hf_sflow_5_dot11FCSErrorCount;

static int hf_sflow_5_dot11TransmittedFrameCount;

static int hf_sflow_5_dot11WEPUndecryptableCount;

static int hf_sflow_5_dot11QoSDiscardedFragmentCount;

static int hf_sflow_5_dot11AssociatedStationCount;

static int hf_sflow_5_dot11QoSCFPollsReceivedCount;

static int hf_sflow_5_dot11QoSCFPollsUnusedCount;

static int hf_sflow_5_dot11QoSCFPollsUnusableCount;

static int hf_sflow_5_dot11QoSCFPollsLostCount;

/* static int hf_sflow_5_ieee80211_version; */

/* processor information */

static int hf_sflow_5_cpu_5s;

static int hf_sflow_5_cpu_1m;

static int hf_sflow_5_cpu_5m;

static int hf_sflow_5_total_memory;

static int hf_sflow_5_free_memory;

/* radio utilisation */

static int hf_sflow_5_elapsed_time;

static int hf_sflow_5_on_channel_time;

static int hf_sflow_5_on_channel_busy_time;

/* Generated from convert_proto_tree_add_text.pl */

static int hf_sflow_5_extended_80211_suite_type;

static int hf_sflow_5_extended_80211_rx_channel;

static int hf_sflow_flow_sample_input_interface;

static int hf_sflow_counters_sample_sampling_interval;

static int hf_sflow_5_extended_url_host_length;

static int hf_sflow_245_ip_tcp_flag_syn;

static int hf_sflow_24_flow_sample_output_interface;

static int hf_sflow_5_flow_sample_output_interface;

static int hf_sflow_5_flow_sample_output_interface_form;

static int hf_sflow_5_flow_sample_output_interface_val;

static int hf_sflow_5_flow_sample_output_interface_val_discard;

static int hf_sflow_245_length_of_ip_packet;

static int hf_sflow_counters_sample_counters_type;

static int hf_sflow_5_extended_mpls_tunnel_id;

static int hf_sflow_flow_sample_sample_pool;

static int hf_sflow_5_extended_80211_tx_speed;

static int hf_sflow_5_extended_vlan_tunnel_tpid_tci_pair;

static int hf_sflow_245_extended_mpls_out_label_stack_entries;

static int hf_sflow_flow_sample_input_interface_value;

static int hf_sflow_flow_sample_sampling_rate;

static int hf_sflow_5_extended_80211_rx_rcpi;

static int hf_sflow_enterprise;

static int hf_sflow_enterprise_length;

static int hf_sflow_enterprise_data;

static int hf_sflow_245_header_frame_length;

static int hf_sflow_5_extended_user_destination_character_set;

static int hf_sflow_5_extended_80211_rx_bssid;

static int hf_sflow_5_extended_80211_tx_retransmission_duration;

static int hf_sflow_245_ethernet_length_of_mac_packet;

static int hf_sflow_245_ip_tcp_flag_psh;

static int hf_sflow_flow_sample_flow_record;

static int hf_sflow_245_extended_mpls_in_label;

static int hf_sflow_5_extended_user_source_character_set;

static int hf_sflow_5_extended_user_destination_user_string_length;

static int hf_sflow_counters_sample_sequence_number;

static int hf_sflow_5_extended_80211_rx_speed;

static int hf_sflow_5_extended_80211_rx_rsni;

static int hf_sflow_flow_sample_source_id_index;

static int hf_sflow_245_ip_tcp_flag_ece;

static int hf_sflow_245_ipv4_throughput;

static int hf_sflow_5_extended_80211_oui;

static int hf_sflow_counters_sample_source_id_type;

static int hf_sflow_flow_sample_input_interface_format;

static int hf_sflow_5_extended_80211_tx_channel;

static int hf_sflow_245_ip_tcp_flag_urg;

static int hf_sflow_5_extended_mpls_tunnel_name_length;

static int hf_sflow_5_extended_80211_tx_version;

static int hf_sflow_245_ipv4_delay;

static int hf_sflow_flow_sample_source_id_class;

static int hf_sflow_245_ethernet_source_mac_address;

static int hf_sflow_5_extended_mpls_ftn_mask;

static int hf_sflow_245_extended_mpls_out_label;

static int hf_sflow_245_ipv6_priority;

static int hf_sflow_245_ip_tcp_flag_fin;

static int hf_sflow_245_ip_destination_port;

static int hf_sflow_5_extended_mpls_vc_label_cos_value;

static int hf_sflow_5_extended_80211_rx_packet_duration;

static int hf_sflow_5_extended_80211_tx_packet_duration;

static int hf_sflow_245_ipv4_reliability;

static int hf_sflow_5_extended_80211_tx_power;

static int hf_sflow_24_flow_sample_multiple_outputs;

static int hf_sflow_5_extended_user_source_user_string_length;

static int hf_sflow_5_extended_80211_payload_length;

static int hf_sflow_5_flow_sample_output_interface_expanded_format;

static int hf_sflow_245_ethernet_packet_type;

static int hf_sflow_counters_sample_expanded_source_id_type;

static int hf_sflow_245_ip_source_port;

static int hf_sflow_245_extended_mpls_in_label_stack_entries;

static int hf_sflow_5_extended_mpls_vc_instance_name_length;

static int hf_sflow_245_ipv4_cost;

static int hf_sflow_5_extended_mpls_ftn_description_length;

static int hf_sflow_5_extended_vlan_tunnel_number_of_layers;

static int hf_sflow_5_extended_80211_tx_bssid;

static int hf_sflow_245_ip_tcp_flag_rst;

static int hf_sflow_245_ip_tcp_flag_ack;

static int hf_sflow_245_ip_tcp_flag_cwr;

static int hf_sflow_5_extended_80211_tx_retransmissions;

static int hf_sflow_5_extended_80211_rx_version;

static int hf_sflow_flow_sample_dropped_packets;

static int hf_sflow_counters_sample_expanded_source_id_index;

static int hf_sflow_245_header_payload_stripped;

static int hf_sflow_245_sampled_header_length;

static int hf_sflow_245_ethernet_destination_mac_address;

static int hf_sflow_counters_sample_source_id_class;

static int hf_sflow_5_extended_url_url_length;

static int hf_sflow_flow_sample_source_id_type;

static int hf_sflow_5_extended_mpls_fec_address_prefix_length;

static int hf_sflow_flow_sample_sequence_number;

static int hf_sflow_counters_sample_source_id_index;

static int hf_sflow_counters_sample_counters_records;

static int hf_sflow_5_extended_mpls_tunnel_cos_value;

static int hf_sflow_5_extended_mpls_vc_id;

static int hf_sflow_24_flow_sample_output_interface_value;

static int hf_sflow_5_flow_sample_output_interface_expanded_value;

static int hf_sflow_5_flow_sample_output_interface_expanded_value_discarded;

static int hf_sflow_5_flow_sample_output_interface_expanded_value_number;

static int hf_sflow_5_flow_sample_output_interface_expanded_value_ifindex;

static int hf_sflow_5_extended_user_destination_user;

static int hf_sflow_245_as_type;

static int hf_sflow_counters_sample_index;

static int hf_sflow_5_extended_url_url;

static int hf_sflow_flow_sample_index;

static int hf_sflow_5_extended_80211_rx_ssid;

static int hf_sflow_5_extended_mpls_vc_instance_name;

static int hf_sflow_5_extended_mpls_tunnel_name;

static int hf_sflow_5_extended_80211_payload;

static int hf_sflow_5_extended_user_source_user;

static int hf_sflow_5_extended_url_host;

static int hf_sflow_5_extended_80211_tx_ssid;

static int hf_sflow_5_extended_url_direction;

static int hf_sflow_5_extended_mpls_ftn_description;

static int hf_sflow_245_ip_protocol;

static int hf_sflow_lag_port_padding;

static int hf_sflow_lag_port_actorsystemid;

static int hf_sflow_lag_port_partneropersystemid;

static int hf_sflow_lag_port_attachedaggid;

static int hf_sflow_lag_port_state;

static int hf_sflow_lag_port_actoradminstate;

static int hf_sflow_lag_port_actoroperstate;

static int hf_sflow_lag_port_partneradminstate;

static int hf_sflow_lag_port_partneroperstate;

static int hf_sflow_lag_port_reserved;

static int hf_sflow_5_lag_port_actoradminstate;

static int hf_sflow_5_lag_port_actoroperstate;

static int hf_sflow_5_lag_port_partneradminstate;

static int hf_sflow_5_lag_port_partneroperstate;

static int hf_sflow_lag_port_stats_lacpdusrx;

static int hf_sflow_lag_port_stats_markerpdusrx;

static int hf_sflow_lag_port_stats_markerresponsepdusrx;

static int hf_sflow_lag_port_stats_unknownrx;

static int hf_sflow_lag_port_stats_illegalrx;

static int hf_sflow_lag_port_stats_lacpdustx;

static int hf_sflow_lag_port_stats_markerpdustx;

static int hf_sflow_lag_port_stats_markerresponsepdustx;

/* Initialize the subtree pointers */

static int ett_sflow_245;

static int ett_sflow_245_sample;

static int ett_sflow_5_flow_record;

static int ett_sflow_5_counters_record;

static int ett_sflow_5_mpls_in_label_stack;

static int ett_sflow_5_mpls_out_label_stack;

static int ett_sflow_245_extended_data;

static int ett_sflow_245_gw_as_dst;

static int ett_sflow_245_gw_as_dst_seg;

static int ett_sflow_245_gw_community;

static int ett_sflow_245_sampled_header;

static int ett_sflow_lag_port_state_flags;

static int ett_sflow_5_output_interface;

static expert_field ei_sflow_invalid_address_type;

static expert_field ei_sflow_unknown_record_format;

static dissector_table_t   header_subdissector_table;

static const unit_name_string units_total_packets = { " total packet", " total packets" };

void proto_reg_handoff_sflow_245(void);

/* dissect a sampled header - layer 2 protocols */

static int

dissect_sflow_245_sampled_header(tvbuff_t *tvb, packet_info *pinfo,

                                 proto_tree *tree, volatile int offset) {

    uint32_t          version, header_proto, frame_length;

    uint32_t header_length;

    tvbuff_t         *next_tvb;

    proto_tree       *sflow_245_header_tree;

    proto_item       *ti;

    /* stuff for saving column state before calling other dissectors.

     * Thanks to Guy Harris for the tip. */

    bool              save_writable;

    bool              save_in_error_pkt;

    address           save_dl_src, save_dl_dst, save_net_src, save_net_dst, save_src, save_dst;

    version = tvb_get_ntohl(tvb, 0);

    header_proto = tvb_get_ntohl(tvb, offset);

    proto_tree_add_item(tree, hf_sflow_245_header_protocol, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    frame_length = tvb_get_ntohl(tvb, offset);

    proto_tree_add_item(tree, hf_sflow_245_header_frame_length, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    if (version == 5) {

        proto_tree_add_item(tree, hf_sflow_245_header_payload_stripped, tvb, offset, 4, ENC_BIG_ENDIAN);

        offset += 4;

    }

    proto_tree_add_item_ret_uint(tree, hf_sflow_245_sampled_header_length, tvb, offset, 4, ENC_BIG_ENDIAN, &header_length);

    offset += 4;

    ti = proto_tree_add_item(tree, hf_sflow_245_header, tvb, offset, header_length, ENC_NA);

    sflow_245_header_tree = proto_item_add_subtree(ti, ett_sflow_245_sampled_header);

    /* hand the header off to the appropriate dissector.  It's probably

     * a short frame, so ignore any exceptions. */

    next_tvb = tvb_new_subset_length_caplen(tvb, offset, header_length, frame_length);

    /* save some state */

    save_writable = col_get_writable(pinfo->cinfo, -1);

    /*

       If sFlow samples a TCP packet it is very likely that the

       TCP analysis will flag the packet as having some error with

       the sequence numbers.  sFlow only report on a "sample" of

       traffic so many packets will not be reported on.  This is

       most obvious if the colorizing rules are on, but will also

       cause confusion if you attempt to filter on

       "tcp.analysis.flags".

       The following only works to suppress IP/TCP errors, but

       it is a start anyway.  Other protocols carried as payloads

       may exhibit similar issues.

       I think what is really needed is a more general

       "protocol_as_payload" flag.  Of course then someone has to

       play whack-a-mole and add code to implement it to any

       protocols that could be carried as a payload.  In the case

       of sFlow that pretty much means anything on your network.

     */

    save_in_error_pkt = pinfo->flags.in_error_pkt;

    if (!global_analyze_samp_ip_headers) {

        pinfo->flags.in_error_pkt = true;

    }

    col_set_writable(pinfo->cinfo, -1, false);

    copy_address_shallow(&save_dl_src, &pinfo->dl_src);

    copy_address_shallow(&save_dl_dst, &pinfo->dl_dst);

    copy_address_shallow(&save_net_src, &pinfo->net_src);

    copy_address_shallow(&save_net_dst, &pinfo->net_dst);

    copy_address_shallow(&save_src, &pinfo->src);

    copy_address_shallow(&save_dst, &pinfo->dst);

    TRY

    {

        if ((global_dissect_samp_headers == false) ||

            !dissector_try_uint(header_subdissector_table, header_proto, next_tvb, pinfo, sflow_245_header_tree))

        {

            call_data_dissector(next_tvb, pinfo, sflow_245_header_tree);

        }

    }

    CATCH_BOUNDS_ERRORS {

    }

    ENDTRY;

    /* restore saved state */

    col_set_writable(pinfo->cinfo, -1, save_writable);

    pinfo->flags.in_error_pkt = save_in_error_pkt;

    copy_address_shallow(&pinfo->dl_src, &save_dl_src);

    copy_address_shallow(&pinfo->dl_dst, &save_dl_dst);

    copy_address_shallow(&pinfo->net_src, &save_net_src);

    copy_address_shallow(&pinfo->net_dst, &save_net_dst);

    copy_address_shallow(&pinfo->src, &save_src);

    copy_address_shallow(&pinfo->dst, &save_dst);

    /* XDR requires 4-byte alignment */

    offset += WS_ROUNDUP_4(header_length);

    return offset;

}

static int

dissect_sflow_245_address_type(tvbuff_t *tvb, packet_info *pinfo,

                               proto_tree *tree, int offset,

                               struct sflow_address_type *hf_type,

                               address *addr) {

    uint32_t addr_type;

    int len;

    addr_type = tvb_get_ntohl(tvb, offset);

    offset += 4;

    switch (addr_type) {

    case ADDR_TYPE_UNKNOWN:

        len = 0;

        break;

    case ADDR_TYPE_IPV4:

        len = 4;

        proto_tree_add_item(tree, hf_type->hf_addr_v4, tvb, offset, 4, ENC_BIG_ENDIAN);

        break;

    case ADDR_TYPE_IPV6:

        len = 16;

        proto_tree_add_item(tree, hf_type->hf_addr_v6, tvb, offset, 16, ENC_NA);

        break;

    default:

        /* Invalid address type, or a type we don't understand; we don't

           know the length. We treat it as having no contents; that

           doesn't trap us in an endless loop, as we at least include

           the address type and thus at least advance the offset by 4.

           Note that we have a problem, though. */

        len = 0;

        proto_tree_add_expert_format(tree, pinfo, &ei_sflow_invalid_address_type, tvb,

                                     offset - 4, 4, "Unknown address type (%u)", addr_type);

    }

    if (addr) {

        switch (len) {

        default:

            clear_address(addr);

            break;

        case 4:

            set_address_tvb(addr, AT_IPv4, len, tvb, offset);

            break;

        case 16:

            set_address_tvb(addr, AT_IPv6, len, tvb, offset);

            break;

        }

    }

    return offset + len;

}

/* extended switch data, after the packet data */

static int

dissect_sflow_245_extended_switch(tvbuff_t *tvb, proto_tree *tree, int offset) {

    proto_tree_add_item(tree, hf_sflow_245_vlan_in, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    proto_tree_add_item(tree, hf_sflow_245_pri_in, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    proto_tree_add_item(tree, hf_sflow_245_vlan_out, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    proto_tree_add_item(tree, hf_sflow_245_pri_out, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    return offset;

}

/* extended router data, after the packet data */

static int

dissect_sflow_245_extended_router(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset) {

    struct sflow_address_type addr_type;

    addr_type.hf_addr_v4 = hf_sflow_245_nexthop_v4;

    addr_type.hf_addr_v6 = hf_sflow_245_nexthop_v6;

    offset = dissect_sflow_245_address_type(tvb, pinfo, tree, offset, &addr_type, NULL);

    proto_tree_add_item(tree, hf_sflow_245_nexthop_src_mask, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    proto_tree_add_item(tree, hf_sflow_245_nexthop_dst_mask, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    return offset;

}

/* extended MPLS data */

static int

dissect_sflow_5_extended_mpls_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset) {

    uint32_t    in_label_count, out_label_count, label, i, j;

    proto_tree *in_stack;

    proto_tree *out_stack;

    struct sflow_address_type addr_type;

    addr_type.hf_addr_v4 = hf_sflow_245_nexthop_v4;

    addr_type.hf_addr_v6 = hf_sflow_245_nexthop_v6;

    offset = dissect_sflow_245_address_type(tvb, pinfo, tree, offset, &addr_type, NULL);

    in_label_count = tvb_get_ntohl(tvb, offset);

    proto_tree_add_item(tree, hf_sflow_245_extended_mpls_in_label_stack_entries, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    in_stack = proto_tree_add_subtree(tree, tvb, offset, -1, ett_sflow_5_mpls_in_label_stack, NULL, "In Label Stack");

    /* by applying the mask, we avoid possible corrupted data that causes huge number of loops

     * 255 is a sensible limit of label count */

    for (i = 0, j = 0; i < (in_label_count & 0x000000ff); i++, j += 4) {

        label = tvb_get_ntohl(tvb, offset + j);

        proto_tree_add_uint_format(in_stack, hf_sflow_245_extended_mpls_in_label, tvb, offset, 4,

            label, "Label %u: %u", i + 1, label);

    }

    offset += (in_label_count * 4);

    out_label_count = tvb_get_ntohl(tvb, offset);

    proto_tree_add_item(tree, hf_sflow_245_extended_mpls_out_label_stack_entries, tvb, offset, 4, ENC_BIG_ENDIAN);

    offset += 4;

    out_stack = proto_tree_add_subtree(tree, tvb, offset, -1, ett_sflow_5_mpls_in_label_stack, NULL, "Out Label Stack");

    /* by applying the mask, we avoid possible corrupted data that causes huge number of loops

     * 255 is a sensible limit of label count */

    for (i = 0, j = 0; i < (out_label_count & 0x000000ff); i++, j += 4) {

        label = tvb_get_ntohl(tvb, offset + j);

        proto_tree_add_uint_format(out_stack, hf_sflow_245_extended_mpls_out_label, tvb, offset, 4,

            label, "Label %u: %u", i + 1, label);

    }

    offset = offset + out_label_count * 4;

    return offset;

}

/* extended NAT data */

static int

dissect_sflow_5_extended_nat(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset) {

    struct sflow_address_type addr_type;

    addr_type.hf_addr_v4 = hf_sflow_245_ipv4_src;

    addr_type.hf_addr_v6 = hf_sflow_245_ipv6_src;

    offset = dissect_sflow_245_address_type(tvb, pinfo, tree, offset, &addr_type, NULL);

    addr_type.hf_addr_v4 = hf_sflow_245_ipv4_dst;

    addr_type.hf_addr_v6 = hf_sflow_245_ipv6_dst;

    offset = dissect_sflow_245_address_type(tvb, pinfo, tree, offset, &addr_type, NULL);

    return offset;

}

/* extended gateway data, after the packet data */

static int

dissect_sflow_245_extended_gateway(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset) {

    int32_t len = 0;

    int32_t i, j, comm_len, dst_len, dst_seg_len;

    uint32_t path_type;

    int32_t kludge;

    uint32_t version = tvb_get_ntohl(tvb, 0); /* get sFlow version */

    proto_item *ti;

    proto_tree *sflow_245_dst_as_tree;