/////////////////////////////////////////////////////////// // Matching predicates /////////////////////////////////////////////////////////// PRED [LFTA_LEGAL, COST HIGH]str_exists_substr[string, string]; PRED [LFTA_LEGAL, COST HIGH]str_compare[string,string]; PRED [LFTA_LEGAL, COST LOW] str_match_offset [uint,string,string]; PRED [LFTA_LEGAL, COST LOW] byte_match_offset [uint,uint,string]; /////////////////////////////////////////////////////////// // MIN/MAX functions /////////////////////////////////////////////////////////// ullong FUN [LFTA_LEGAL, COST FREE] LLMIN (ullong,ullong); ullong FUN [LFTA_LEGAL, COST FREE] LLMAX (ullong,ullong); uint FUN [LFTA_LEGAL, COST FREE] UMIN (uint,uint); uint FUN [LFTA_LEGAL, COST FREE] UMAX (uint,uint); IP FUN [LFTA_LEGAL, COST FREE] UMIN (IP,IP); IP FUN [LFTA_LEGAL, COST FREE] UMAX (IP,IP); /////////////////////////////////////////////////////////// // conditional functions /////////////////////////////////////////////////////////// uint FUN [LFTA_LEGAL, COST FREE] EQ (uint, uint); uint FUN [LFTA_LEGAL, COST FREE] GEQ (uint, uint); uint FUN [LFTA_LEGAL, COST FREE] LEQ (uint, uint); /////////////////////////////////////////////////////////// // Function for regex matching /////////////////////////////////////////////////////////// uint FUN [LFTA_LEGAL, COST EXPENSIVE] str_regex_match( string, string HANDLE); uint FUN [LFTA_LEGAL, COST EXPENSIVE] str_partial_regex_match( string, string HANDLE, uint); string FUN [PARTIAL, COST EXPENSIVE] str_extract_regex( string, string HANDLE); /////////////////////////////////////////////////////////// // Truncating strings /////////////////////////////////////////////////////////// string FUN [LFTA_LEGAL,PARTIAL,COST FREE] str_truncate (string, uint); /////////////////////////////////////////////////////////// // Function for casting /////////////////////////////////////////////////////////// int FUN [LFTA_LEGAL,COST FREE] non_temporal(int); uint FUN [LFTA_LEGAL,COST FREE] non_temporal(uint); llong FUN [LFTA_LEGAL,COST FREE] non_temporal(llong); ullong FUN [LFTA_LEGAL,COST FREE] non_temporal(ullong); int FUN [LFTA_LEGAL,COST FREE]INT(uint); int FUN [LFTA_LEGAL,COST FREE]INT(ullong); int FUN [LFTA_LEGAL,COST FREE]INT(llong); uint FUN [LFTA_LEGAL,COST FREE]UINT(int); uint FUN [LFTA_LEGAL,COST FREE]UINT(ullong); uint FUN [LFTA_LEGAL,COST FREE]UINT(llong); uint FUN [LFTA_LEGAL,COST FREE]UINT(IP); float FUN [LFTA_LEGAL,COST FREE] FLOAT(llong); float FUN [LFTA_LEGAL,COST FREE] FLOAT(ullong); float FUN [LFTA_LEGAL,COST FREE] FLOAT(int); float FUN [LFTA_LEGAL,COST FREE] FLOAT(uint); ullong FUN [LFTA_LEGAL,COST FREE]ULLONG(uint); ullong FUN [LFTA_LEGAL,COST FREE]ULLONG(int); /////////////////////////////////////////////////////////// // Numeric functions /////////////////////////////////////////////////////////// float FUN [LFTA_LEGAL, COST LOW] sqrt(float); /////////////////////////////////////////////////////////// // Convert an IPv4 address /////////////////////////////////////////////////////////// uint FUN [PARTIAL,COST HIGH] strtoi(string); IP FUN [PARTIAL,COST HIGH] strtoip(string); // for constant strings - faster at runtime uint FUN [LFTA_LEGAL,COST LOW] strtoi_c(string HANDLE); IP FUN [LFTA_LEGAL,COST LOW] strtoip_c(string HANDLE); /////////////////////////////////////////////////////////// // Compute running sum /////////////////////////////////////////////////////////// ullong UDAF [RUNNING, SUBAGGR moving_sum_lfta, SUPERAGGR super_moving_sum_udaf ] moving_sum_udaf fstring12 (uint, uint); uint EXTR moving_sum moving_sum_udaf moving_sum_extract (uint,uint); uint FUN [COST LOW] moving_sum_extract(ullong); float EXTR moving_sum_exp moving_sum_udaf moving_sum_extract_exp (uint,uint, float); float FUN [COST LOW] moving_sum_extract_exp(ullong, float); ullong UDAF [RUNNING] super_moving_sum_udaf fstring12 (ullong); ullong UDAF moving_sum_lfta fstring8 (uint, uint); /////////////////////////////////////////////////////////// // Compute the average of // all positive numbers /////////////////////////////////////////////////////////// float UDAF POSAVG fstring16(float); /////////////////////////////////////////////////////////// // Simple average example /////////////////////////////////////////////////////////// float EXTR extr_avg avg_udaf extr_avg_fcn (uint); float FUN extr_avg_fcn (string); string UDAF[SUBAGGR avg_udaf_lfta, SUPERAGGR avg_udaf_hfta] avg_udaf fstring12 (uint); string UDAF avg_udaf_hfta fstring12 (string); string UDAF avg_udaf_lfta fstring12 (uint); /////////////////////////////////////////////////////////// // SAMPLING /////////////////////////////////////////////////////////// fstring100 STATE smart_sampling_state; int SFUN packet_count smart_sampling_state (); float SFUN gamma smart_sampling_state (); int SFUN do_clean_count smart_sampling_state (); int SFUN init_threshold smart_sampling_state (); int SFUN delay smart_sampling_state(); int SFUN newly_closed smart_sampling_state(); /////////////////////////////////////////////////////////// // Manku Heavy Hitter /////////////////////////////////////////////////////////// fstring20 STATE manku_hh_state; BOOL SFUN local_count manku_hh_state (UINT); int SFUN current_bucket manku_hh_state (); /////////////////////////////////////////////////////////// // FIRST and LAST aggregation funciton // Should be replaced by builtins /////////////////////////////////////////////////////////// uint UDAF [RUNNING, SUBAGGR FIRST_lfta, SUPERAGGR FIRST_hfta] FIRST uint (uint); uint UDAF [RUNNING] FIRST_hfta uint (uint); uint UDAF [RUNNING] FIRST_lfta uint (uint); ullong UDAF [RUNNING, SUBAGGR FIRST_ULL_lfta, SUPERAGGR FIRST_ULL_hfta] FIRST ullong (ullong); ullong UDAF [RUNNING] FIRST_ULL_hfta ullong (ullong); ullong UDAF [RUNNING] FIRST_ULL_lfta ullong (ullong); IP UDAF [RUNNING, SUBAGGR FIRST_lfta, SUPERAGGR FIRST_hfta] FIRST IP (IP); IP UDAF [RUNNING] FIRST_hfta IP (IP); IP UDAF [RUNNING] FIRST_lfta IP (IP); string UDAF [RUNNING, SUBAGGR FIRST_STR_lfta, SUPERAGGR FIRST_STR_hfta] FIRST string (string); string UDAF [RUNNING] FIRST_STR_hfta string (string); string UDAF [RUNNING] FIRST_STR_lfta string (string); uint UDAF [RUNNING, SUBAGGR LAST_lfta, SUPERAGGR LAST_hfta] LAST uint (uint); uint UDAF [RUNNING] LAST_hfta uint (uint); uint UDAF [RUNNING] LAST_lfta uint (uint); ullong UDAF [RUNNING, SUBAGGR LAST_ULL_lfta, SUPERAGGR LAST_ULL_hfta] LAST ullong (ullong); ullong UDAF [RUNNING] LAST_ULL_hfta ullong (ullong); ullong UDAF [RUNNING] LAST_ULL_lfta ullong (ullong); IP UDAF [RUNNING, SUBAGGR LAST_lfta, SUPERAGGR LAST_hfta] LAST IP (IP); IP UDAF [RUNNING] LAST_hfta IP (IP); IP UDAF [RUNNING] LAST_lfta IP (IP); string UDAF [RUNNING, SUBAGGR LAST_STR_lfta, SUPERAGGR LAST_STR_hfta] LAST string (string); string UDAF [RUNNING] LAST_STR_hfta string (string); string UDAF [RUNNING] LAST_STR_lfta string (string); /////////////////////////////////////////////////////////// // integer array aggregation funciton // We are going to store 4 values in LFTA in fixed size buffer // plus one byte for array length (17 bytes total) // HFTA will combine partial aggregates /////////////////////////////////////////////////////////// string UDAF [RUNNING, SUBAGGR running_array_aggr_lfta, SUPERAGGR running_array_aggr_hfta] running_array_aggr string (uint); string UDAF [RUNNING] running_array_aggr_hfta string (string); string UDAF [RUNNING] running_array_aggr_lfta fstring17 (uint);