ftstat.c

netflow,抓包

  if (rpt->out->fields & FT_STAT_FIELD_MIN_PPS) {\
    if (comma) fmt_buf[len++] = ',';\
    len += sprintf(fmt_buf+len, "%f",\
     ((double)A->ps.min_pps / (double)rpt->min_pps)*100.0);\
    comma = 1;\
  }\
  if (rpt->out->fields & FT_STAT_FIELD_MAX_PPS) {\
    if (comma) fmt_buf[len++] = ',';\
    len += sprintf(fmt_buf+len, "%f",\
     ((double)A->ps.max_pps / (double)rpt->max_pps)*100.0);\
    comma = 1;\
  }\
  if (rpt->out->fields & FT_STAT_FIELD_FRECS) {\
    if (comma) fmt_buf[len++] = ',';\
    len += fmt_uint64(fmt_buf+len, A->nrecs, FMT_JUST_LEFT);\
    comma = 1;\
  }\
  fmt_buf[len++] = '\n';\
  fmt_buf[len] = 0;\
  fputs(fmt_buf, fp);\
  if (rpt->out->records && (tally.rt_recs == rpt->out->records)) {\
    fprintf(fp, "# stop, hit record limit.\n");\
    break;\
  }

#define NEXT_WORD(A,B)\
  for (;;) {\
    B = strsep(A, " \t");\
    if ((B && *B != 0) || (!B))\
      break;\
  }\

/*
 * A = ftstat_rpt_n (struct to allocate)
 * B = rptn (local var name for A)
 * C = hash bits
 * D = size of hash record (passed to sizeof (struct)
 * E = size of hash key
 * F = num hash recs in a chunk
 *
 */
#define STD_NEW_HASH(A,B,C,D,E,F)\
  struct A *B;\
  int slen;\
  if (!(B = (struct A*)malloc(sizeof (*B)))) {\
    fterr_warnx("malloc(rpt): failed");\
    return (struct A*)0L;\
  }\
  bzero(B, sizeof *B);\
  if (rpt->all_fields & FT_STAT_FIELD_PS)\
    slen = sizeof (struct D);\
  else\
    slen = sizeof (struct D) - sizeof (struct ftps);\
  if (!(B->ftch = ftchash_new(C, slen, E, F))) {\
    free(B);\
    fterr_warnx("ftchash_new(): failed");\
    return (struct A*)0L;\
  }\
  return B;\

/*
 * A = ftstat_rpt_n (struct to allocate)
 * B = rptn (local var name for A)
 * C = bucket size
 *
 */
#define STD_NEW_BUCKET(A,B,C,D)\
  struct A *B;\
  if (!(B = (struct A*)malloc(sizeof (*B)))) {\
    fterr_warnx("malloc(rpt): failed");\
    return (struct A*)0L;\
  }\
  bzero(B, sizeof *B);\
  if (bucket_alloc(&B->bucket, (u_int32)C, D)) {\
    fterr_warnx("bucket_alloc(): failed");\
    free(B);\
    return (struct A*)0L;\
  }\
  return B;\

#define STD_CALC_BUCKET(A,B,C)\
  struct A *B;\
  register int i;\
  if (rpt->t_recs)\
    rpt->avg_pps /= (double)rpt->t_recs;\
  if (rpt->t_recs)\
    rpt->avg_bps /= (double)rpt->t_recs;\
  B = rpt->data;\
  for (i = 0; i < C; ++i) {\
    if ((B->bucket.duration[i]) && (rpt->all_fields & FT_STAT_FIELD_PS)) {\
      B->bucket.avg_pps[i] /= (double)B->bucket.recs[i];\
      B->bucket.avg_bps[i] /= (double)B->bucket.recs[i];\
    }\
    if (B->bucket.packets[i])\
      rpt->recs ++;\
  }\
  return 0;\

/*
 * A = ftstat_rpt_n
 * B = rptn (local var name for A)
 * C = ftchash_rec_x
 * D = ftch_recn (local var name for C)
 * note rpt_66, 67 have this expanded by hand
 */
#define STD_CALC_HASH(A,B,C,D)\
  struct C *D;\
  struct A *B;\
  B = rpt->data;\
  if (rpt->t_recs)\
    rpt->avg_pps /= (double)rpt->t_recs;\
  if (rpt->t_recs)\
    rpt->avg_bps /= (double)rpt->t_recs;\
  rpt->recs = B->ftch->entries;\
  if (rpt->all_fields & FT_STAT_FIELD_PS) {\
    ftchash_first(B->ftch);\
    while ((D = ftchash_foreach(B->ftch))) {\
      if (D->etime) {\
        D->ps.avg_pps /= (double)D->nrecs;\
        D->ps.avg_bps /= (double)D->nrecs;\
      }\
    }\
  }\
  return 0;

#define STD_FREE_BUCKET(A)\
  if (A) {\
    bucket_free(&A->bucket);\
    free(A);\
  }\

#define STD_FREE_HASH(A)\
  if (A) {\
    if (A->ftch)\
      ftchash_free(A->ftch);\
    free (A);\
  }\

/*
 * A = ftstat_rpt_n
 * B = rptn (local var name for A)
 * D = size of bucket
 * KEY* = ascii key name
 */
#define STD_DUMP_BUCKET(A,B,C,SYM,KEY,KEY1,KEY2,KEY3,KEY4,KEY5,KEY6)\
  struct A *B;\
  B = rpt->data;\
  recn_dump(fp, rpt->out->fields, KEY, KEY1, KEY2, KEY3, KEY4,KEY5,KEY6);\
  bucket_dump1(fp, rpt, &B->bucket, C, SYM);\
  return 0;\

/*
 * A = ftstat_rpt_n
 * B = rptn (local var name for A)
 * C = hash dump function
 * KEY* = ascii key name
 */
#define STD_DUMP_HASH0(A,B,C,KEY,KEY1,KEY2,KEY3,KEY4,KEY5,KEY6)\
  struct A *B;\
  B = rpt->data;\
  recn_dump(fp, rpt->out->fields, KEY, KEY1, KEY2, KEY3, KEY4, KEY5, KEY6);\
  C(fp, rpt, B->ftch);\
  return 0;

#define STD_DUMP_HASH0P(A,B,C,D,KEY,KEY1,KEY2,KEY3,KEY4,KEY5,KEY6)\
  struct A *B;\
  B = rpt->data;\
  recn_dump(fp, rpt->out->fields, KEY, KEY1, KEY2, KEY3, KEY4, KEY5, KEY6);\
  C(fp, rpt, B->ftch, D);\
  return 0;


#define STD_DUMP_HASH1(A,B,C,SYM1,KEY,KEY1,KEY2,KEY3,KEY4,KEY5,KEY6)\
  struct A *B;\
  B = rpt->data;\
  recn_dump(fp, rpt->out->fields, KEY, KEY1, KEY2, KEY3, KEY4, KEY5, KEY6);\
  C(fp, rpt, B->ftch, SYM1);\
  return 0;

#define STD_DUMP_HASH1P(A,B,C,D,SYM1,KEY,KEY1,KEY2,KEY3,KEY4,KEY5,KEY6)\
  struct A *B;\
  B = rpt->data;\
  recn_dump(fp, rpt->out->fields, KEY, KEY1, KEY2, KEY3, KEY4, KEY5, KEY6);\
  C(fp, rpt, B->ftch, SYM1, D);\
  return 0;

#define STD_DUMP_HASH2(A,B,C,SYM1,SYM2,KEY,KEY1,KEY2,KEY3,KEY4,KEY5,KEY6)\
  struct A *B;\
  B = rpt->data;\
  recn_dump(fp, rpt->out->fields, KEY, KEY1, KEY2, KEY3, KEY4, KEY5, KEY6);\
  C(fp, rpt, B->ftch, SYM1, SYM2);\
  return 0;

#define STD_DUMP_HASH2P(A,B,C,D,SYM1,SYM2,KEY,KEY1,KEY2,KEY3,KEY4,KEY5,KEY6)\
  struct A *B;\
  B = rpt->data;\
  recn_dump(fp, rpt->out->fields, KEY, KEY1, KEY2, KEY3, KEY4, KEY5, KEY6);\
  C(fp, rpt, B->ftch, SYM1, SYM2, D);\
  return 0;

#define STD_DUMP_HASH3(A,B,C,SYM1,SYM2,SYM3,KEY,KEY1,KEY2,KEY3,KEY4,KEY5,KEY6)\
  struct A *B;\
  B = rpt->data;\
  recn_dump(fp, rpt->out->fields, KEY, KEY1, KEY2, KEY3, KEY4, KEY5, KEY6);\
  C(fp, rpt, B->ftch, SYM1, SYM2, SYM3);\
  return 0;

#define STD_DUMP_HASH4(A,B,C,SYM1,SYM2,SYM3,SYM4,KEY,KEY1,KEY2,KEY3,KEY4,KEY5,KEY6)\
  struct A *B;\
  B = rpt->data;\
  recn_dump(fp, rpt->out->fields, KEY, KEY1, KEY2, KEY3, KEY4, KEY5, KEY6);\
  C(fp, rpt, B->ftch, SYM1, SYM2, SYM3,SYM4);\
  return 0;

#define STD_ACCUM\
  cur.dFlows64 = 1;\
  FT_RECGET_LAST(cur,rec,*fo);\
  FT_RECGET_FIRST(cur,rec,*fo);\
  FT_RECGET64_DPKTS(cur,rec,*fo);\
  FT_RECGET64_DOCTETS(cur,rec,*fo);\
  FT_RECGET_UNIX_SECS(cur,rec,*fo);\
  if (fo->xfields &  FT_XFIELD_DFLOWS) {\
    FT_RECGET64_DFLOWS(cur,rec,*fo);\
  } else {\
    cur.dFlows64 = 1;\
  }\
  if (rpt->scale) {\
    cur.dPkts64 *= rpt->scale;\
    cur.dOctets64 *= rpt->scale;\
  }\
  if (!cur.dPkts64) {\
    rpt->t_ignores ++;\
    return 0;\
  }\
  if (cur.unix_secs > rpt->time_end)\
    rpt->time_end = cur.unix_secs;\
  if (cur.unix_secs < rpt->time_start)\
    rpt->time_start = cur.unix_secs;\
  {\
  duration_tmp = (cur.Last - cur.First);\
  if (duration_tmp) {\
    rpt->t_recs ++;\
    rpt->t_duration += duration_tmp;\
    if (rpt->all_fields & FT_STAT_FIELD_PS) {\
      pps_tmp = (double)cur.dPkts64/((double)(duration_tmp)/1000.0);\
      bps_tmp = (double)cur.dOctets64*8/((double)(duration_tmp)/1000.0);\
      if (pps_tmp > rpt->max_pps)\
        rpt->max_pps = pps_tmp;\
      if ((pps_tmp < rpt->min_pps) || (!rpt->min_pps))\
        rpt->min_pps = pps_tmp;\
      rpt->avg_pps += pps_tmp;\
      if (bps_tmp > rpt->max_bps)\
        rpt->max_bps = bps_tmp;\
      if ((bps_tmp < rpt->min_bps) || (!rpt->min_bps))\
        rpt->min_bps = bps_tmp;\
      rpt->avg_bps += bps_tmp;\
    }\
  }\
  }\
  rpt->t_flows += cur.dFlows64;\
  rpt->t_octets += cur.dOctets64;\
  rpt->t_packets += cur.dPkts64;\

#define STD_ACCUM_BUCKET1(A,B)\
  struct fts3rec_all2 cur;\
  struct A *B;\
  u_int32 duration_tmp;\
  double bps_tmp, pps_tmp;\
  B = rpt->data;\
  STD_ACCUM;

#define STD_ACCUM_BUCKET2(A,B)\
  if (duration_tmp) {\
    A.duration[B] += duration_tmp;\
    A.recs[B] ++;\
    if (rpt->all_fields & FT_STAT_FIELD_PS) {\
      if (pps_tmp > A.max_pps[B])\
        A.max_pps[B] = pps_tmp;\
      if ((pps_tmp < A.min_pps[B]) || (!A.min_pps[B]))\
        A.min_pps[B] = pps_tmp;\
      A.avg_pps[B] += pps_tmp;\
      if (bps_tmp > A.max_bps[B])\
        A.max_bps[B] = bps_tmp;\
      if ((bps_tmp < A.min_bps[B]) || (!A.min_bps[B]))\
        A.min_bps[B] = bps_tmp;\
      A.avg_bps[B] += bps_tmp;\
    }\
  }\
  A.flows[B] += cur.dFlows64;\
  A.octets[B] += cur.dOctets64;\
  A.packets[B] += cur.dPkts64;\

#define STD_ACCUM_HASH1(A,B,C,D,E)\
  struct fts3rec_all2 cur;\
  struct C D, *E;\
  struct A *B;\
  u_int32 hash;\
  u_int32 duration_tmp;\
  double bps_tmp, pps_tmp;\
  bzero(&D, sizeof D);\
  B = rpt->data;\
  STD_ACCUM;

#define STD_ACCUM_HASH2(A,B,C)\
  if (!(C = ftchash_update(A->ftch, &B, hash))) {\
    fterr_warnx("ftch_update(): failed");\
    return -1;\
  }\
  STD_ACCUM_INCP(C);\

#define STD_ACCUM_INCP(A)\
  if (duration_tmp) {\
    A->etime += (duration_tmp);\
    A->nrecs ++;\
    if (rpt->all_fields & FT_STAT_FIELD_PS) {\
      if (pps_tmp > A->ps.max_pps)\
        A->ps.max_pps = pps_tmp;\
      if ((pps_tmp < A->ps.min_pps) || (!A->ps.min_pps))\
        A->ps.min_pps = pps_tmp;\
      A->ps.avg_pps += pps_tmp;\
      if (bps_tmp > A->ps.max_bps)\
        A->ps.max_bps = bps_tmp;\
      if ((bps_tmp < A->ps.min_bps) || (!A->ps.min_bps))\
        A->ps.min_bps = bps_tmp;\
      A->ps.avg_bps += bps_tmp;\
    }\
  }\
  A->nflows += cur.dFlows64;\
  A->noctets += cur.dOctets64;\
  A->npackets += cur.dPkts64;\

#define STD_CALC\
  if (rpt->t_recs)\
    rpt->avg_pps /= (double)rpt->t_recs;\
  if (rpt->t_recs)\
    rpt->avg_bps /= (double)rpt->t_recs;

#define STD_DUMP_TOTALS_HEADER\
  if (ftsrpt->all_fields & FT_STAT_FIELD_PS)\
    fprintf(fp, "# rec1: ignores,flows,octets,packets,duration,avg_bps,min_bps,max_bps,avg_pps,min_pps,max_pps\n");\
  else\
    fprintf(fp, "# rec1: ignores,flows,octets,packets,duration\n");\

#define STD_DUMP_TOTALS_VAL\
  fmt_uint64(fmt_buf, ftsrpt->t_ignores, FMT_JUST_LEFT);\
  strcat(fmt_buf, ",");\
  fmt_uint64(fmt_tmp, ftsrpt->t_flows, FMT_JUST_LEFT);\
  strcat(fmt_buf, fmt_tmp);\
  strcat(fmt_buf, ",");\
  fmt_uint64(fmt_tmp, ftsrpt->t_octets, FMT_JUST_LEFT);\
  strcat(fmt_buf, fmt_tmp);\
  strcat(fmt_buf, ",");\
  fmt_uint64(fmt_tmp, ftsrpt->t_packets, FMT_JUST_LEFT);\
  strcat(fmt_buf, fmt_tmp);\
  strcat(fmt_buf, ",");\
  fmt_uint64(fmt_tmp, ftsrpt->t_duration, FMT_JUST_LEFT);\
  strcat(fmt_buf, fmt_tmp);\
  if (ftsrpt->all_fields & FT_STAT_FIELD_PS) {\
    fprintf(fp, "%s,%f,%f,%f,%f,%f,%f\n", fmt_buf,\
      ftsrpt->avg_bps, ftsrpt->min_bps, ftsrpt->max_bps,\
      ftsrpt->avg_pps, ftsrpt->min_pps, ftsrpt->max_pps);\
  } else {\
    fprintf(fp, "%s\n", fmt_buf);\
  }\


enum ftstat_parse_state { PARSE_STATE_UNSET, PARSE_STATE_REPORT,
                          PARSE_STATE_DEFINITION, PARSE_STATE_OUTPUT };