diff options
Diffstat (limited to '3rdparty/winpcap/docs/html/group__wpcap__tut9.html')
-rw-r--r-- | 3rdparty/winpcap/docs/html/group__wpcap__tut9.html | 206 |
1 files changed, 0 insertions, 206 deletions
diff --git a/3rdparty/winpcap/docs/html/group__wpcap__tut9.html b/3rdparty/winpcap/docs/html/group__wpcap__tut9.html deleted file mode 100644 index 2bbceef9f79..00000000000 --- a/3rdparty/winpcap/docs/html/group__wpcap__tut9.html +++ /dev/null @@ -1,206 +0,0 @@ -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> -<html xmlns="http://www.w3.org/1999/xhtml"> -<head> -<meta http-equiv="Content-Type" content="text/xhtml;charset=UTF-8"/> -<title>WinPcap: Gathering Statistics on the network traffic</title> -<link href="tabs.css" rel="stylesheet" type="text/css"/> -<link href="style.css" rel="stylesheet" type="text/css"/> -</head> -<body> -<!-- Generated by Doxygen 1.6.1 --> -<div class="navigation" id="top"> - <div class="tabs"> - <ul> - <li><a href="main.html"><span>Main Page</span></a></li> - <li><a href="pages.html"><span>Related Pages</span></a></li> - <li><a href="modules.html"><span>Modules</span></a></li> - <li><a href="annotated.html"><span>Data Structures</span></a></li> - <li><a href="files.html"><span>Files</span></a></li> - </ul> - </div> -</div> -<div class="contents"> -<h1>Gathering Statistics on the network traffic</h1><table border="0" cellpadding="0" cellspacing="0"> -</table> -<p>This lesson shows another advanced feature of WinPcap: the ability to collect statistics about network traffic. The statistical engine makes use of the kernel-level packet filter to efficiently classify the incoming packet. You can take a look at the <a class="el" href="group__NPF.html">NPF driver internals manual</a> if you want to know more details.</p> -<p>In order to use this feature, the programmer must open an adapter and put it in <em>statistical</em> <em>mode</em>. This can be done with <a class="el" href="group__wpcapfunc.html#gaef07ef49d3c75644f3fd34518e2fe720" title="Set the working mode of the interface p to mode.">pcap_setmode()</a>. In particular, MODE_STAT must be used as the <em>mode</em> argument of this function.</p> -<p>With statistical mode, making an application that monitors the TCP traffic load is a matter of few lines of code. The following sample shows how to do it.</p> -<div class="fragment"><pre class="fragment"><span class="comment">/*</span> -<span class="comment"> * Copyright (c) 1999 - 2005 NetGroup, Politecnico di Torino (Italy)</span> -<span class="comment"> * Copyright (c) 2005 - 2006 CACE Technologies, Davis (California)</span> -<span class="comment"> * All rights reserved.</span> -<span class="comment"> *</span> -<span class="comment"> * Redistribution and use in source and binary forms, with or without</span> -<span class="comment"> * modification, are permitted provided that the following conditions</span> -<span class="comment"> * are met:</span> -<span class="comment"> *</span> -<span class="comment"> * 1. Redistributions of source code must retain the above copyright</span> -<span class="comment"> * notice, this list of conditions and the following disclaimer.</span> -<span class="comment"> * 2. Redistributions in binary form must reproduce the above copyright</span> -<span class="comment"> * notice, this list of conditions and the following disclaimer in the</span> -<span class="comment"> * documentation and/or other materials provided with the distribution.</span> -<span class="comment"> * 3. Neither the name of the Politecnico di Torino, CACE Technologies </span> -<span class="comment"> * nor the names of its contributors may be used to endorse or promote </span> -<span class="comment"> * products derived from this software without specific prior written </span> -<span class="comment"> * permission.</span> -<span class="comment"> *</span> -<span class="comment"> * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS</span> -<span class="comment"> * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT</span> -<span class="comment"> * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR</span> -<span class="comment"> * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT</span> -<span class="comment"> * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,</span> -<span class="comment"> * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT</span> -<span class="comment"> * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,</span> -<span class="comment"> * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY</span> -<span class="comment"> * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT</span> -<span class="comment"> * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE</span> -<span class="comment"> * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</span> -<span class="comment"> *</span> -<span class="comment"> */</span> - -<span class="preprocessor">#include <stdlib.h></span> -<span class="preprocessor">#include <stdio.h></span> - -<span class="preprocessor">#include <pcap.h></span> - -<span class="keywordtype">void</span> usage(); - -<span class="keywordtype">void</span> dispatcher_handler(u_char *, <span class="keyword">const</span> <span class="keyword">struct</span> <a class="code" href="structpcap__pkthdr.html" title="Header of a packet in the dump file.">pcap_pkthdr</a> *, <span class="keyword">const</span> u_char *); - - -<span class="keywordtype">void</span> main(<span class="keywordtype">int</span> argc, <span class="keywordtype">char</span> **argv) -{ -<a class="code" href="group__wpcap__def.html#ga4711d025f83503ce692efa5e45ec60a7" title="Descriptor of an open capture instance. This structure is opaque to the user, that...">pcap_t</a> *fp; -<span class="keywordtype">char</span> errbuf[<a class="code" href="group__wpcap__def.html#gacd448353957d92c98fccc29e1fc8d927" title="Size to use when allocating the buffer that contains the libpcap errors.">PCAP_ERRBUF_SIZE</a>]; -<span class="keyword">struct </span>timeval st_ts; -u_int netmask; -<span class="keyword">struct </span>bpf_program fcode; - - <span class="comment">/* Check the validity of the command line */</span> - <span class="keywordflow">if</span> (argc != 2) - { - usage(); - <span class="keywordflow">return</span>; - } - - <span class="comment">/* Open the output adapter */</span> - <span class="keywordflow">if</span> ( (fp= <a class="code" href="group__wpcapfunc.html#ga2b64c7b6490090d1d37088794f1f1791" title="Open a generic source in order to capture / send (WinPcap only) traffic.">pcap_open</a>(argv[1], 100, <a class="code" href="group__remote__open__flags.html#ga9134ce51a9a6a7d497c3dee5affdc3b9" title="Defines if the adapter has to go in promiscuous mode.">PCAP_OPENFLAG_PROMISCUOUS</a>, 1000, NULL, errbuf) ) == NULL) - { - fprintf(stderr,<span class="stringliteral">"\nUnable to open adapter %s.\n"</span>, errbuf); - <span class="keywordflow">return</span>; - } - - <span class="comment">/* Don't care about netmask, it won't be used for this filter */</span> - netmask=0xffffff; - - <span class="comment">//compile the filter</span> - <span class="keywordflow">if</span> (<a class="code" href="group__wpcapfunc.html#ga363bdc6f6b39b4979ddcf15ecb830c5c" title="Compile a packet filter, converting an high level filtering expression (see Filtering...">pcap_compile</a>(fp, &fcode, <span class="stringliteral">"tcp"</span>, 1, netmask) <0 ) - { - fprintf(stderr,<span class="stringliteral">"\nUnable to compile the packet filter. Check the syntax.\n"</span>); - <span class="comment">/* Free the device list */</span> - <span class="keywordflow">return</span>; - } - - <span class="comment">//set the filter</span> - <span class="keywordflow">if</span> (<a class="code" href="group__wpcapfunc.html#gaf5f9cfe85dad0967ff607e5159b1ba61" title="Associate a filter to a capture.">pcap_setfilter</a>(fp, &fcode)<0) - { - fprintf(stderr,<span class="stringliteral">"\nError setting the filter.\n"</span>); - <a class="code" href="group__wpcapfunc.html#gaa45a5e1a4ba9925bb3586dcbeec78560" title="close the files associated with p and deallocates resources.">pcap_close</a>(fp); - <span class="comment">/* Free the device list */</span> - <span class="keywordflow">return</span>; - } - - <span class="comment">/* Put the interface in statstics mode */</span> - <span class="keywordflow">if</span> (<a class="code" href="group__wpcapfunc.html#gaef07ef49d3c75644f3fd34518e2fe720" title="Set the working mode of the interface p to mode.">pcap_setmode</a>(fp, <a class="code" href="group__NPF__include.html#ga503326906a62e96c147ae6af31fb5659" title="Statistical working mode.">MODE_STAT</a>)<0) - { - fprintf(stderr,<span class="stringliteral">"\nError setting the mode.\n"</span>); - <a class="code" href="group__wpcapfunc.html#gaa45a5e1a4ba9925bb3586dcbeec78560" title="close the files associated with p and deallocates resources.">pcap_close</a>(fp); - <span class="comment">/* Free the device list */</span> - <span class="keywordflow">return</span>; - } - - - printf(<span class="stringliteral">"TCP traffic summary:\n"</span>); - - <span class="comment">/* Start the main loop */</span> - <a class="code" href="group__wpcapfunc.html#ga6bcb7c5c59d76ec16b8a699da136b5de" title="Collect a group of packets.">pcap_loop</a>(fp, 0, dispatcher_handler, (PUCHAR)&st_ts); - - <a class="code" href="group__wpcapfunc.html#gaa45a5e1a4ba9925bb3586dcbeec78560" title="close the files associated with p and deallocates resources.">pcap_close</a>(fp); - <span class="keywordflow">return</span>; -} - -<span class="keywordtype">void</span> dispatcher_handler(u_char *state, <span class="keyword">const</span> <span class="keyword">struct</span> <a class="code" href="structpcap__pkthdr.html" title="Header of a packet in the dump file.">pcap_pkthdr</a> *header, <span class="keyword">const</span> u_char *pkt_data) -{ - <span class="keyword">struct </span>timeval *old_ts = (<span class="keyword">struct </span>timeval *)state; - u_int delay; - LARGE_INTEGER Bps,Pps; - <span class="keyword">struct </span>tm ltime; - <span class="keywordtype">char</span> timestr[16]; - time_t local_tv_sec; - - <span class="comment">/* Calculate the delay in microseconds from the last sample. */</span> - <span class="comment">/* This value is obtained from the timestamp that the associated with the sample. */</span> - delay=(header-><a class="code" href="structpcap__pkthdr.html#a21be78b2818c91cb205885b8a6f5aed8" title="time stamp">ts</a>.tv_sec - old_ts->tv_sec) * 1000000 - old_ts->tv_usec + header-><a class="code" href="structpcap__pkthdr.html#a21be78b2818c91cb205885b8a6f5aed8" title="time stamp">ts</a>.tv_usec; - <span class="comment">/* Get the number of Bits per second */</span> - Bps.QuadPart=(((*(LONGLONG*)(pkt_data + 8)) * 8 * 1000000) / (delay)); - <span class="comment">/* ^ ^</span> -<span class="comment"> | |</span> -<span class="comment"> | | </span> -<span class="comment"> | |</span> -<span class="comment"> converts bytes in bits -- |</span> -<span class="comment"> |</span> -<span class="comment"> delay is expressed in microseconds --</span> -<span class="comment"> */</span> - - <span class="comment">/* Get the number of Packets per second */</span> - Pps.QuadPart=(((*(LONGLONG*)(pkt_data)) * 1000000) / (delay)); - - <span class="comment">/* Convert the timestamp to readable format */</span> - local_tv_sec = header-><a class="code" href="structpcap__pkthdr.html#a21be78b2818c91cb205885b8a6f5aed8" title="time stamp">ts</a>.tv_sec; - localtime_s(&ltime, &local_tv_sec); - strftime( timestr, <span class="keyword">sizeof</span> timestr, <span class="stringliteral">"%H:%M:%S"</span>, &ltime); - - <span class="comment">/* Print timestamp*/</span> - printf(<span class="stringliteral">"%s "</span>, timestr); - - <span class="comment">/* Print the samples */</span> - printf(<span class="stringliteral">"BPS=%I64u "</span>, Bps.QuadPart); - printf(<span class="stringliteral">"PPS=%I64u\n"</span>, Pps.QuadPart); - - <span class="comment">//store current timestamp</span> - old_ts->tv_sec=header-><a class="code" href="structpcap__pkthdr.html#a21be78b2818c91cb205885b8a6f5aed8" title="time stamp">ts</a>.tv_sec; - old_ts->tv_usec=header-><a class="code" href="structpcap__pkthdr.html#a21be78b2818c91cb205885b8a6f5aed8" title="time stamp">ts</a>.tv_usec; -} - - -<span class="keywordtype">void</span> usage() -{ - - printf(<span class="stringliteral">"\nShows the TCP traffic load, in bits per second and packets per second.\nCopyright (C) 2002 Loris Degioanni.\n"</span>); - printf(<span class="stringliteral">"\nUsage:\n"</span>); - printf(<span class="stringliteral">"\t tcptop adapter\n"</span>); - printf(<span class="stringliteral">"\t You can use \"WinDump -D\" if you don't know the name of your adapters.\n"</span>); - - exit(0); -} -</pre></div><p>Before enabling statistical mode, the user has the option to set a filter that defines the subset of network traffic that will be monitored. See the paragraph on the <a class="el" href="group__language.html">Filtering expression syntax</a> for details. If no filter has been set, all of the traffic will be monitored.</p> -<p>Once</p> -<ul> -<li>the filter is set</li> -<li><a class="el" href="group__wpcapfunc.html#gaef07ef49d3c75644f3fd34518e2fe720" title="Set the working mode of the interface p to mode.">pcap_setmode()</a> is called</li> -<li>callback invocation is enabled with <a class="el" href="group__wpcapfunc.html#ga6bcb7c5c59d76ec16b8a699da136b5de" title="Collect a group of packets.">pcap_loop()</a></li> -</ul> -<p>the interface descriptor starts to work in statistical mode. Notice the fourth parameter (<em>to_ms</em>) of <a class="el" href="group__wpcapfunc.html#ga2b64c7b6490090d1d37088794f1f1791" title="Open a generic source in order to capture / send (WinPcap only) traffic.">pcap_open()</a>: it defines the interval among the statistical samples. The callback function receives the samples calculated by the driver every <em>to_ms</em> milliseconds. These samples are encapsulated in the second and third parameters of the callback function, as shown in the following figure:</p> -<div align="center"> -<img src="stats_wpcap.gif" alt="stats_wpcap.gif"/> -</div> -<p>Two 64-bit counters are provided: the number of packets and the amount of bytes received during the last interval.</p> -<p>In the example, the adapter is opened with a timeout of 1000 ms. This means that dispatcher_handler() is called once per second. At this point a filter that keeps only tcp packets is compiled and set. Then <a class="el" href="group__wpcapfunc.html#gaef07ef49d3c75644f3fd34518e2fe720" title="Set the working mode of the interface p to mode.">pcap_setmode()</a> and <a class="el" href="group__wpcapfunc.html#ga6bcb7c5c59d76ec16b8a699da136b5de" title="Collect a group of packets.">pcap_loop()</a> are called. Note that a struct timeval pointer is passed to <a class="el" href="group__wpcapfunc.html#ga6bcb7c5c59d76ec16b8a699da136b5de" title="Collect a group of packets.">pcap_loop()</a> as the <em>user</em> parameter. This structure will be used to store a timestamp in order to calculate the interval between two samples. dispatcher_handler()uses this interval to obtain the bits per second and the packets per second and then prints these values on the screen.</p> -<p>Note finally that this example is by far more efficient than a program that captures the packets in the traditional way and calculates statistics at user-level. Statistical mode requires the minumum amount of data copies and context switches and therefore the CPU is optimized. Moreover, a very small amount of memory is required.</p> -<p><a class="el" href="group__wpcap__tut8.html"><<< Previous</a> </p> -</div> - -<hr> -<p align="right"><img border="0" src="winpcap_small.gif" align="absbottom" width="91" height="27"> -documentation. Copyright (c) 2002-2005 Politecnico di Torino. Copyright (c) 2005-2009 -CACE Technologies. All rights reserved.</p> |