trpr.cpp

trpr是可以分析tcpdump和mgen日志记录

        const char* ProtocolType(unsigned char value) const;
                
        Address SourceAddress(const char* hdr) const
        {
	        if (Version(hdr) == 4)
            {   
	            unsigned long buf;
	            buf =  ((256*256*256)*((unsigned char)hdr[12]) +
                            (256*256)*((unsigned char)hdr[13]) +
                                (256)*((unsigned char)hdr[14]) +
                                      ((unsigned char)hdr[15]));
                return Address(buf, Address::IPv4);
	        }
	        else // (Version(hdr) == 6)
	        {
	            unsigned long buf[4];
	            Address theAddress;
	            for(unsigned int i =0; i < 4; i++)
	            {
                    buf[i] = ((256*256*256)*((unsigned char)hdr[(i*4)+8]) +
                                  (256*256)*((unsigned char)hdr[(i*4)+9]) +
                                      (256)*((unsigned char)hdr[(i*4)+10]) +
                                            ((unsigned char)hdr[(i*4)+11]));
                    buf[i] = htonl(buf[i]);
	            }
	            theAddress.SetIPv6(buf);
	            return theAddress;
	        }
	    }
        
        Address DestinationAddress(const char* hdr) const
        {
	        if(4 == Version(hdr))
            {
                unsigned long buf = (((256*256*256)*((unsigned char)hdr[16]) +
                                          (256*256)*((unsigned char)hdr[17]) +
                                              (256)*((unsigned char)hdr[18]) +
                                                    ((unsigned char)hdr[19])));
                return Address(buf, Address::IPv4);
	        }
	        else  // (6 == Version(hdr))
	        {
	            unsigned long buf[4];
	            Address theAddress;
	            for(unsigned int i = 0; i<=4 ; i++)
	            {

                    buf[i] = ((256*256*256)*((unsigned char)hdr[(i*4)+24]) +
                                  (256*256)*((unsigned char)hdr[(i*4)+25]) +
                                      (256)*((unsigned char)hdr[(i*4)+26]) +
                                            ((unsigned char)hdr[(i*4)+27]));
                    buf[i] = htonl(buf[i]);
                }
                theAddress.SetIPv6(buf);
	            return theAddress;
	        }    
        }
        
        unsigned short SourcePort(const char* hdr) const
        {
	        unsigned int ipHdrLen;
	        if(Version(hdr) == 4)
                ipHdrLen = 4 * (((unsigned char)hdr[0]) & 0x0f);
	        else
	            ipHdrLen = 40;
            hdr += ipHdrLen;
            return (256*((unsigned char)hdr[0]) + (unsigned char)hdr[1]);
        }
        
        unsigned short DestinationPort(const char* hdr) const
        {
	        unsigned int ipHdrLen;
	        if(Version(hdr) == 4)
                ipHdrLen = 4 * (((unsigned char)hdr[0]) & 0x0f);
            else
	            ipHdrLen = 40;
	        hdr += ipHdrLen;
            return (256*((unsigned char)hdr[2]) + (unsigned char)hdr[3]);
        }

      
};  // end class TcpdumpEventParser

class DrecEventParser : public EventParser
{
    public:
        bool GetNextPacketEvent(FILE*           filePtr, 
                                PacketEvent*    theEvent, 
                                double          timeout = -1.0);
};  // end class DrecEventParser


class Point
{
    friend class PointList;
    
    public:
        Point(double x, double y);
        Point(double x, unsigned long k);
        double X() {return xval;}
        double Y() {return yval;}
        double K() {return kval;}
        Point* Prev() {return prev;}
        Point* Next() {return next;}
    
    private:
        double          xval;
        double          yval;
        unsigned long   kval;
        Point*          prev;
        Point*          next;
};  // end class Point()

class PointList
{
    public:
        PointList();
        ~PointList();
        Point* Head() {return head;}
        Point* Tail() {return tail;}
        void Append(Point* thePoint);
        void Remove(Point* thePoint);
        void Destroy();
        void PruneData(double xMin);
        bool PrintData(FILE* filePtr);
        Point* FindPointByK(unsigned long k);
        
    private:
        Point* head;
        Point* tail;
    
};



class LossTracker
{
    public:
        LossTracker();
        void Reset()
        {
            loss_list.Destroy();
            packet_count = 0;
            loss_count = 0;
            duplicate_count = 0;
            late_count = 0;
            loss_fraction = 1.0;
        }
        
        void Init(unsigned long seqMax)
        {
            Reset();
            SetSeqMax(seqMax);
            resync_count = 0;
            first_packet = true;
        }
        bool Update(double theTime, unsigned long theSequence, unsigned long theFlow = 0);
        
        void SetSeqMax(unsigned long seqMax)
        {
            seq_max = seqMax;
            seq_hlf = seqMax >> 1;
            seq_qtr = seqMax >> 2; 
        }
        double LossFraction() {return loss_fraction;}
        unsigned long ResyncCount() {return resync_count;}
        unsigned long DuplicateCount() {return duplicate_count;}
        unsigned long LateCount() {return late_count;}
        
        
    private:
        PointList     loss_list;
        double        last_time;
        double        loss_fraction;
        long          loss_max;
        bool          first_packet;
        unsigned long packet_count;
        unsigned long loss_count;
        unsigned long resync_count;
        unsigned long duplicate_count;
        unsigned long late_count;
        
        unsigned long seq_max;
        unsigned long seq_hlf;
        unsigned long seq_qtr;
        unsigned long seq_last;
        
        unsigned long flow_id; // makes sure all drec packets from same flow
};  // end class LossTracker


// A data driven loss tracker, procrastinates as needed.
class LossTracker2
{
    public:
        LossTracker2();
        void Init(double windowSize, unsigned long seqMax = 0xffffffff)
        {
            window_size = windowSize;
            seq_max = seqMax;
            seq_hlf = seqMax >> 1;
            seq_qtr = seqMax >> 2;
            first_packet = true;
            packet_count = 0;
        }
        void Reset()
        {
            seq_first = seq_last;
            time_first = time_last;
            if (window_size > 0)
                window_end = time_first + window_size;
            packet_count = 1;      
            wrap = false;
            wrap_count = 0;
        }
        int Update(double theTime, unsigned long theSeq, unsigned long theFlow = 0);        
        double LossFraction();
        double LossWindowStart() {return time_first;}
        double LossWindowEnd() {return time_last;}
    
    private:
        bool            first_packet;
        bool            wrap;
        unsigned long   wrap_count;
        double          time_first;
        double          time_last;
        double          window_size;
        double          window_end;
        unsigned long   packet_count;
        unsigned long   seq_first;
        unsigned long   seq_last;
        
        unsigned long   duplicate_count;
        unsigned long   resync_count;
        
        unsigned long   seq_max;
        unsigned long   seq_hlf;
        unsigned long   seq_qtr;
        
        unsigned long   flow_id;  // to make sure all drec packets from same flow
    
};  // end class LossTracker2


// Simple self-scaling linear/non-linear histogram (one-sided)
class Histogram
{
    public:
        Histogram();
        void Init(unsigned long numBins, double linearity)
        {
            num_bins = numBins;
            q = linearity;
            if (bin) delete[] bin;
            bin = NULL;
        }
        bool Tally(double value, unsigned long count = 1);
        void Print(FILE* file);
        unsigned long Count();
        double PercentageInRange(double rangeMin, double rangeMax);
        double Min() {return min_val;}
        double Max() {return max_val;}
        double Percentile(double p);
               
    private:     
        typedef struct
        {
            double          total;
            unsigned long   count;
        } Bin;
        
        double          q;
        unsigned long   num_bins;
        double          min_val;
        double          max_val;  
        Bin*            bin;           
}; // end class Histogram

Histogram::Histogram()
 : q(1.0), num_bins(1000), min_val(0.0), max_val(0.0), bin(NULL)
{
}

bool Histogram::Tally(double value, unsigned long count)
{
    if (!bin)
    {
        if (!(bin = new Bin[num_bins]))
        {
            perror("trpr: Histogram::Tally() Error allocating histogram");
            return false;   
        }
        memset(bin, 0, num_bins*sizeof(Bin));
        min_val = max_val = value;
        bin[0].count = count;
        bin[0].total = (value * (double)count);
    }
    else if ((value > max_val) || (value < min_val))
    {
        Bin* newBin = new Bin[num_bins];
        if (!newBin)
        {
            perror("trpr: Histogram::Tally() Error reallocating histogram");
            return false; 
        }
        memset(newBin, 0, num_bins*sizeof(Bin));

        double newScale, minVal;
        if (value < min_val)
        {        
            newScale = ((double)(num_bins-1)) / pow(max_val - value, q);
            unsigned long index = (unsigned long)ceil(newScale * pow(min_val - value, q));
            if (index > (num_bins-1)) index = num_bins - 1;
            newBin[index].total += bin[0].total;
            newBin[index].count += bin[0].count;
            minVal = value;
        }
        else
        {
            double s = (value < 0.0) ? 0.5 : 2.0;   
            newScale = ((double)(num_bins-1)) / pow(s*value - min_val, q);
            newBin[0].total = bin[0].total;
            newBin[0].count = bin[0].count;
            minVal = min_val;
        }
        for (unsigned int i = 1; i < num_bins; i++)
        {
            if (bin[i].count)
            {
                double x = bin[i].total / ((double)bin[i].count);
                unsigned long index = (unsigned long)ceil(newScale * pow(x - minVal, q));
                if (index > (num_bins-1)) index = num_bins - 1;
                newBin[index].count += bin[i].count;
                newBin[index].total += bin[i].total;
            }   
        }
        if (value < min_val)
        {
            newBin[0].count += count;
            newBin[0].total += (value * (double)count);
            min_val = value;
        }
        else
        {
            double s = (value < 0.0) ? 0.5 : 2.0;   
            max_val = s*value;
            unsigned long index = 
                (unsigned long)ceil(((double)(num_bins-1)) * pow((value-min_val)/(max_val-min_val), q));        
            if (index > (num_bins-1)) index = num_bins - 1;
            bin[index].count += count;
            bin[index].total += (value * (double)count);
        }
        delete[] bin;
        bin = newBin;
    }
    else
    {
        unsigned long index = 
            (unsigned long)ceil(((double)(num_bins-1)) * pow((value-min_val)/(max_val-min_val), q));        
        if (index > (num_bins-1)) index = num_bins - 1;
        bin[index].count += count;
        bin[index].total += (value * (double)count);
    }
    return true;
}  // end Histogram::Tally()

void Histogram::Print(FILE* file)
{
    if (bin)
    {
        for (unsigned int i = 0; i < num_bins; i++)
        {
            if (bin[i].count)
            {
                double x = bin[i].total / ((double)bin[i].count);
                fprintf(file, "%f, %lu\n", x, bin[i].count);    
            }
        }
    }
}  // end Histogram::Print()


unsigned long Histogram::Count()
{
    if (bin)
    {
        unsigned long total =0 ;
        for (unsigned int i = 0; i < num_bins; i++)
        {
            total += bin[i].count;
        }
        return total;
    }
    else
    {
         return 0;
    }   
}  // end Histogram::Count()

double Histogram::PercentageInRange(double rangeMin, double rangeMax)
{
    if (bin)
    {
        unsigned long countTotal = 0;
        unsigned long rangeTotal = 0;
        for (unsigned long i = 0; i < num_bins; i++)
        {
            double value = bin[i].total / ((double)bin[i].count);
            countTotal += bin[i].count;
            if (value < rangeMin)
                continue;
            else if (value > rangeMax)
                continue;
            else
                rangeTotal += bin[i].count;
        }
        return (100.0 * ((double)rangeTotal) / ((double)countTotal));
    }
    else
    {
        return 0.0;
    }         
}  // end Histogram::PercentageInRange()

double Histogram::Percentile(double p)
{
    unsigned long goal = Count();
    goal = (unsigned long)(((double)goal) * p + 0.5);
    unsigned long count = 0;
    if (bin)
    {
        for (unsigned long i = 0; i < num_bins; i++)
        {
            count += bin[i].count;
            if (count >= goal)
            {
                double x = pow(((double)i) / ((double)num_bins-1), 1.0/q);
                x *= (max_val - min_val);
                x += min_val;
                return x;   
            }
        }
    }
    return max_val;
}  // end Histogram::Percentile()


class Flow
{