1 | /* |
---|
2 | * This file is part of libtrace |
---|
3 | * |
---|
4 | * Copyright (c) 2007 The University of Waikato, Hamilton, New Zealand. |
---|
5 | * Authors: Daniel Lawson |
---|
6 | * Perry Lorier |
---|
7 | * Josef Vodanovich |
---|
8 | * |
---|
9 | * All rights reserved. |
---|
10 | * |
---|
11 | * This code has been developed by the University of Waikato WAND |
---|
12 | * research group. For further information please see http://www.wand.net.nz/ |
---|
13 | * |
---|
14 | * libtrace is free software; you can redistribute it and/or modify |
---|
15 | * it under the terms of the GNU General Public License as published by |
---|
16 | * the Free Software Foundation; either version 2 of the License, or |
---|
17 | * (at your option) any later version. |
---|
18 | * |
---|
19 | * libtrace is distributed in the hope that it will be useful, |
---|
20 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
---|
21 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
---|
22 | * GNU General Public License for more details. |
---|
23 | * |
---|
24 | * You should have received a copy of the GNU General Public License |
---|
25 | * along with libtrace; if not, write to the Free Software |
---|
26 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
---|
27 | * |
---|
28 | * $Id$ |
---|
29 | * |
---|
30 | */ |
---|
31 | |
---|
32 | /* This program takes a series of traces and bpf filters and outputs how many |
---|
33 | * bytes/packets |
---|
34 | */ |
---|
35 | |
---|
36 | #include <stdio.h> |
---|
37 | #include <stdlib.h> |
---|
38 | #include <assert.h> |
---|
39 | #include <string.h> |
---|
40 | #include <sys/time.h> |
---|
41 | #include <sys/types.h> |
---|
42 | |
---|
43 | #include <getopt.h> |
---|
44 | #include <inttypes.h> |
---|
45 | #include <signal.h> |
---|
46 | |
---|
47 | #include "libtrace.h" |
---|
48 | #include "tracereport.h" |
---|
49 | #include "report.h" |
---|
50 | |
---|
51 | struct libtrace_t *trace; |
---|
52 | uint32_t reports_required = 0; |
---|
53 | int packets_read = 0; |
---|
54 | |
---|
55 | static volatile int done=0; |
---|
56 | |
---|
57 | static void cleanup_signal(int sig UNUSED) |
---|
58 | { |
---|
59 | done=1; |
---|
60 | trace_interrupt(); |
---|
61 | } |
---|
62 | |
---|
63 | /* Process a trace, counting packets that match filter(s) */ |
---|
64 | static void run_trace(char *uri, libtrace_filter_t *filter, int count) |
---|
65 | { |
---|
66 | struct libtrace_packet_t *packet = trace_create_packet(); |
---|
67 | |
---|
68 | /* Already read the maximum number of packets - don't need to read |
---|
69 | * anything from this trace */ |
---|
70 | if ((count >= 0 && packets_read >= count) || done) |
---|
71 | return; |
---|
72 | |
---|
73 | trace = trace_create(uri); |
---|
74 | |
---|
75 | if (trace_is_err(trace)) { |
---|
76 | trace_perror(trace,"trace_create"); |
---|
77 | return; |
---|
78 | } |
---|
79 | |
---|
80 | if (filter) { |
---|
81 | trace_config(trace,TRACE_OPTION_FILTER,filter); |
---|
82 | } |
---|
83 | |
---|
84 | if (trace_start(trace)==-1) { |
---|
85 | trace_perror(trace,"trace_start"); |
---|
86 | return; |
---|
87 | } |
---|
88 | |
---|
89 | while (1) { |
---|
90 | int psize; |
---|
91 | |
---|
92 | if (count >= 0 && packets_read >= count) |
---|
93 | break; |
---|
94 | if (done) |
---|
95 | break; |
---|
96 | if ((psize = trace_read_packet(trace, packet)) <1) { |
---|
97 | break; |
---|
98 | } |
---|
99 | if (reports_required & REPORT_TYPE_MISC) |
---|
100 | misc_per_packet(packet); |
---|
101 | if (reports_required & REPORT_TYPE_ERROR) |
---|
102 | error_per_packet(packet); |
---|
103 | if (reports_required & REPORT_TYPE_PORT) |
---|
104 | port_per_packet(packet); |
---|
105 | if (reports_required & REPORT_TYPE_PROTO) |
---|
106 | protocol_per_packet(packet); |
---|
107 | if (reports_required & REPORT_TYPE_TOS) |
---|
108 | tos_per_packet(packet); |
---|
109 | if (reports_required & REPORT_TYPE_TTL) |
---|
110 | ttl_per_packet(packet); |
---|
111 | if (reports_required & REPORT_TYPE_FLOW) |
---|
112 | flow_per_packet(packet); |
---|
113 | if (reports_required & REPORT_TYPE_TCPOPT) |
---|
114 | tcpopt_per_packet(packet); |
---|
115 | if (reports_required & REPORT_TYPE_SYNOPT) |
---|
116 | synopt_per_packet(packet); |
---|
117 | if (reports_required & REPORT_TYPE_NLP) |
---|
118 | nlp_per_packet(packet); |
---|
119 | if (reports_required & REPORT_TYPE_DIR) |
---|
120 | dir_per_packet(packet); |
---|
121 | if (reports_required & REPORT_TYPE_ECN) |
---|
122 | ecn_per_packet(packet); |
---|
123 | if (reports_required & REPORT_TYPE_TCPSEG) |
---|
124 | tcpseg_per_packet(packet); |
---|
125 | |
---|
126 | packets_read ++; |
---|
127 | } |
---|
128 | if (reports_required & REPORT_TYPE_DROPS) |
---|
129 | drops_per_trace(trace); |
---|
130 | trace_destroy_packet(packet); |
---|
131 | trace_destroy(trace); |
---|
132 | } |
---|
133 | |
---|
134 | static void usage(char *argv0) |
---|
135 | { |
---|
136 | fprintf(stderr,"Usage:\n" |
---|
137 | "%s flags traceuri [traceuri...]\n" |
---|
138 | "-f --filter=bpf \tApply BPF filter. Can be specified multiple times\n" |
---|
139 | "-c --count=N Stop after reading N packets\n" |
---|
140 | "-e --error Report packet errors (e.g. checksum failures, rxerrors)\n" |
---|
141 | "-F --flow Report flows\n" |
---|
142 | "-m --misc Report misc information (start/end times, duration, pps)\n" |
---|
143 | "-P --protocol Report transport protocols\n" |
---|
144 | "-p --port Report port numbers\n" |
---|
145 | "-T --tos Report IP TOS\n" |
---|
146 | "-t --ttl Report IP TTL\n" |
---|
147 | "-O --tcpoptions \tReport TCP Options\n" |
---|
148 | "-o --synoptions \tReport TCP Options seen on SYNs\n" |
---|
149 | "-n --nlp Report network layer protocols\n" |
---|
150 | "-d --direction Report direction\n" |
---|
151 | "-C --ecn Report TCP ECN information\n" |
---|
152 | "-s --tcpsegment \tReport TCP segment size\n" |
---|
153 | "-H --help Print libtrace runtime documentation\n" |
---|
154 | ,argv0); |
---|
155 | exit(1); |
---|
156 | } |
---|
157 | |
---|
158 | int main(int argc, char *argv[]) { |
---|
159 | |
---|
160 | int i; |
---|
161 | int opt; |
---|
162 | char *filterstring=NULL; |
---|
163 | struct sigaction sigact; |
---|
164 | int count = -1; |
---|
165 | |
---|
166 | libtrace_filter_t *filter = NULL;/*trace_bpf_setfilter(filterstring); */ |
---|
167 | |
---|
168 | while (1) { |
---|
169 | int option_index; |
---|
170 | struct option long_options[] = { |
---|
171 | { "count", 1, 0, 'c' }, |
---|
172 | { "ecn", 0, 0, 'C' }, |
---|
173 | { "direction", 0, 0, 'd' }, |
---|
174 | { "drops", 0, 0, 'D' }, |
---|
175 | { "error", 0, 0, 'e' }, |
---|
176 | { "flow", 0, 0, 'F' }, |
---|
177 | { "filter", 1, 0, 'f' }, |
---|
178 | { "help", 0, 0, 'H' }, |
---|
179 | { "misc", 0, 0, 'm' }, |
---|
180 | { "nlp", 0, 0, 'n' }, |
---|
181 | { "tcpoptions", 0, 0, 'O' }, |
---|
182 | { "synoptions", 0, 0, 'o' }, |
---|
183 | { "protocol", 0, 0, 'P' }, |
---|
184 | { "port", 0, 0, 'p' }, |
---|
185 | { "tcpsegment", 0, 0, 's' }, |
---|
186 | { "tos", 0, 0, 'T' }, |
---|
187 | { "ttl", 0, 0, 't' }, |
---|
188 | { NULL, 0, 0, 0 } |
---|
189 | }; |
---|
190 | opt = getopt_long(argc, argv, "Df:HemFPpTtOondCsc:", |
---|
191 | long_options, &option_index); |
---|
192 | if (opt == -1) |
---|
193 | break; |
---|
194 | |
---|
195 | switch (opt) { |
---|
196 | case 'c': |
---|
197 | count = atoi(optarg); |
---|
198 | break; |
---|
199 | case 'C': |
---|
200 | reports_required |= REPORT_TYPE_ECN; |
---|
201 | break; |
---|
202 | case 'd': |
---|
203 | reports_required |= REPORT_TYPE_DIR; |
---|
204 | break; |
---|
205 | case 'D': |
---|
206 | reports_required |= REPORT_TYPE_DROPS; |
---|
207 | break; |
---|
208 | case 'e': |
---|
209 | reports_required |= REPORT_TYPE_ERROR; |
---|
210 | break; |
---|
211 | case 'F': |
---|
212 | reports_required |= REPORT_TYPE_FLOW; |
---|
213 | break; |
---|
214 | case 'f': |
---|
215 | filterstring = optarg; |
---|
216 | break; |
---|
217 | case 'H': |
---|
218 | usage(argv[0]); |
---|
219 | break; |
---|
220 | case 'm': |
---|
221 | reports_required |= REPORT_TYPE_MISC; |
---|
222 | break; |
---|
223 | case 'n': |
---|
224 | reports_required |= REPORT_TYPE_NLP; |
---|
225 | break; |
---|
226 | case 'O': |
---|
227 | reports_required |= REPORT_TYPE_TCPOPT; |
---|
228 | break; |
---|
229 | case 'o': |
---|
230 | reports_required |= REPORT_TYPE_SYNOPT; |
---|
231 | break; |
---|
232 | case 'P': |
---|
233 | reports_required |= REPORT_TYPE_PROTO; |
---|
234 | break; |
---|
235 | case 'p': |
---|
236 | reports_required |= REPORT_TYPE_PORT; |
---|
237 | break; |
---|
238 | case 's': |
---|
239 | reports_required |= REPORT_TYPE_TCPSEG; |
---|
240 | break; |
---|
241 | case 'T': |
---|
242 | reports_required |= REPORT_TYPE_TOS; |
---|
243 | break; |
---|
244 | case 't': |
---|
245 | reports_required |= REPORT_TYPE_TTL; |
---|
246 | break; |
---|
247 | default: |
---|
248 | usage(argv[0]); |
---|
249 | } |
---|
250 | } |
---|
251 | |
---|
252 | /* Default to all reports, instead of no reports at all. It's annoying |
---|
253 | * waiting for 10 minutes for a trace to process then discover you |
---|
254 | * forgot to ask for any reports! |
---|
255 | */ |
---|
256 | if (reports_required == 0) { |
---|
257 | reports_required = ~0; |
---|
258 | |
---|
259 | /* Except we might want to not do the flow report, because |
---|
260 | * that can be rather resource-intensive */ |
---|
261 | reports_required &= ~REPORT_TYPE_FLOW; |
---|
262 | } |
---|
263 | |
---|
264 | |
---|
265 | if (filterstring) { |
---|
266 | filter = trace_create_filter(filterstring); |
---|
267 | } |
---|
268 | |
---|
269 | sigact.sa_handler = cleanup_signal; |
---|
270 | sigemptyset(&sigact.sa_mask); |
---|
271 | sigact.sa_flags = SA_RESTART; |
---|
272 | |
---|
273 | sigaction(SIGINT, &sigact, NULL); |
---|
274 | sigaction(SIGTERM, &sigact, NULL); |
---|
275 | |
---|
276 | |
---|
277 | for(i=optind;i<argc;++i) { |
---|
278 | /* This is handy for knowing how far through the traceset |
---|
279 | * we are - printing to stderr because we use stdout for |
---|
280 | * genuine output at the moment */ |
---|
281 | fprintf(stderr, "Reading from trace: %s\n", argv[i]); |
---|
282 | run_trace(argv[i],filter, count); |
---|
283 | } |
---|
284 | |
---|
285 | if (reports_required & REPORT_TYPE_MISC) |
---|
286 | misc_report(); |
---|
287 | if (reports_required & REPORT_TYPE_ERROR) |
---|
288 | error_report(); |
---|
289 | if (reports_required & REPORT_TYPE_FLOW) |
---|
290 | flow_report(); |
---|
291 | if (reports_required & REPORT_TYPE_TOS) |
---|
292 | tos_report(); |
---|
293 | if (reports_required & REPORT_TYPE_PROTO) |
---|
294 | protocol_report(); |
---|
295 | if (reports_required & REPORT_TYPE_PORT) |
---|
296 | port_report(); |
---|
297 | if (reports_required & REPORT_TYPE_TTL) |
---|
298 | ttl_report(); |
---|
299 | if (reports_required & REPORT_TYPE_TCPOPT) |
---|
300 | tcpopt_report(); |
---|
301 | if (reports_required & REPORT_TYPE_SYNOPT) |
---|
302 | synopt_report(); |
---|
303 | if (reports_required & REPORT_TYPE_NLP) |
---|
304 | nlp_report(); |
---|
305 | if (reports_required & REPORT_TYPE_DIR) |
---|
306 | dir_report(); |
---|
307 | if (reports_required & REPORT_TYPE_ECN) |
---|
308 | ecn_report(); |
---|
309 | if (reports_required & REPORT_TYPE_TCPSEG) |
---|
310 | tcpseg_report(); |
---|
311 | if (reports_required & REPORT_TYPE_DROPS) |
---|
312 | drops_report(); |
---|
313 | return 0; |
---|
314 | } |
---|