#!/usr/bin/perl

#
# ftprint: quick hack to demonstrate reading flow-tools data in perl
#
# usage: flow-cat -z0 <files> | ftprint
#
# unpack() makes this really really really slow.  Aboud 10x slower
# than flow-cat <files> | flow-stat -f15 which has the same functionality.
#

$fth_size = 384;
$fth_decode = "CCCCSCCLLLLLLLLLLLLLA256A68";

$fts2rec_v5_size = 60;
$fts2rec_v5_decode = "LLLLLLSSLLLLSSCCCCCCCCSS";

binmode STDIN;

read STDIN,$dec,$fth_size;
@fth = unpack($fth_decode, $dec);


if ((@fth[0] != hex '0xCF') || (@fth[1] != hex '0x10') || (@fth[3] != 2) ||
  (@fth[4] != 5)) {
  die "Unsupported flow stream.\n";
}

print "header: magic1=@fth[0] ";
print "magic2=@fth[1] ";
print "byte_order=@fth[2] ";
print "s_version=@fth[3] ";
print "d_version=@fth[4]\n";

while (!eof STDIN) {
  read STDIN,$dec,$fts2rec_v5_size;
  @flow = unpack($fts2rec_v5_decode, $dec);
  $octets += @flow[9];
  $packets += @flow[8];
#  print "flow: packets=@flow[8] ";
#  print "octets=@flow[9]\n";
  ++$flows;
}

print "total: flows=$flows octets=$octets packets=$packets\n";




