trpr.cpp

trpr是可以分析tcpdump和mgen日志记录

        wrap = true;
    }
    else if ((theSequence > (seq_hlf+seq_qtr)) &&
             (seq_last < seq_qtr))
    {
        delta = theSequence - seq_last - seq_max - 1;
    }
    else
    {
        delta = theSequence - seq_last;   
    }
    if (wrap && (theSequence >= seq_first))
    {
        wrap = false;
        wrap_count++;
           
    }
    
    if ((labs(delta) > seq_qtr) || (theFlow != flow_id))
    {
        resync_count++;
        fprintf(stderr, "trpr: LossTracker2() resync! (thisSeq:%lu lastSeq:%lu theFlow:%lu lastFlow:%lu)\n",  
                        theSequence, seq_last, theFlow, flow_id);
        first_packet = true;
        Update(theTime, theSequence, theFlow);
        return -1; 
    }
    
    // 2) Is this packet "after" our first packet    
    if ((theSequence < seq_qtr) &&
        (seq_first > (seq_hlf+seq_qtr)))
    {
        delta = seq_max - seq_first + theSequence + 1;
    }
    else if ((theSequence > (seq_hlf+seq_qtr)) &&
             (seq_first < seq_qtr))
    {
        delta = theSequence - seq_first - seq_max - 1;
    }
    else
    {
        delta = theSequence - seq_first; 
    }
    if (wrap_count & (delta <= 0)) delta += seq_max;
    
    // 2) Does this packet count?
    if (delta > 0)
    {
        // It's a good packet
        packet_count++;
        seq_last = theSequence;
    }
    else if (delta < 0)
    {
        // Late packet, don't count
        //fprintf(stderr, "late packet (seq:%lu seq_first:%lu) ...\n", theSequence, seq_first);
    }
    else
    {
        duplicate_count++;
    } 
    
    time_last = theTime;  
     
    if ((window_end < 0.0) || (theTime < window_end) || (packet_count < 2))
        return 0;
    else
        return 1;
}  // end LossTracker2::Update()

double LossTracker2::LossFraction()
{
    long delta;
    if ((seq_last < seq_qtr) &&
        (seq_first > (seq_hlf+seq_qtr)))
    {
        delta = seq_max - seq_first + seq_last + 1;
    }
    else if ((seq_last > (seq_hlf+seq_qtr)) &&
             (seq_first < seq_qtr))
    {
        delta = seq_last - seq_first - seq_max - 1;
    }
    else
    {
        delta = seq_last - seq_first; 
    }
    unsigned long wraps = wrap_count;
    if (wraps & (delta <= 0)) 
    {
        delta += seq_max;
        wraps--;
    }
    
    if (delta < 0) return -1.0;  // this shouldn't happen!
    double packetsExpected = (double)delta + 1.0;
    if (wraps) packetsExpected += (((double)wraps) * ((double)seq_max));
    
    if (packet_count > 1)
    {
        double lossFraction = 1.0 - (((double)(packet_count-1)) / (packetsExpected - 1.0));
        return lossFraction;
    }
    else
    {
        fprintf(stderr, "Low packet count? %lu\n", packet_count);
        return -1.0;
    }
}  // end LossTracker2::LossFraction()

Flow::Flow(bool presetFlow)
    : preset(presetFlow), 
      type(NULL), type_len(0), src_port(-1), dst_port(-1),
      byte_count(0), accumulator(0.0), accumulator_count(0),
      last_time(-1.0), pos_x(999.0), pos_y(999.0),
      sum_init(true), sum_total(0.0), sum_var(0.0), 
      sum_min(0.0), sum_max(0.0), sum_weight(0.0),
      prev(NULL), next(NULL)
{
    histogram.Init(1000, 0.5);
}

Flow::~Flow()
{
    if (type) delete []type;
}

bool Flow::SetType(const char* theType)
{
    if (type) delete []type;
    int len = strlen(theType) + 1;
    if(!(type = new char[len]))
    {
        perror("trpr: Error allocating flow type storage");
        return false;
    }
    strcpy(type, theType);
    type_len = len - 1;
    return true;
}  // end Flow::SetName()

bool Flow::Match(const char* theType, 
                 const Address& srcAddr, unsigned short srcPort, 
                 const Address& dstAddr, unsigned short dstPort,
                 unsigned long flowId) const
{
    if ((type && !TypeMatch(theType)) ||    
        ((dst_port >= 0) && (dst_port != dstPort)) ||
        ((dst_addr.IsValid()) && !(dst_addr == dstAddr)) ||
        ((src_port >= 0) && (src_port != srcPort)) ||
        ((src_addr.IsValid()) && !(src_addr == srcAddr)) ||
        ((flow_id.IsValid()) && (flow_id != flowId)))
    {
        return false;
    }
    else
    {
        return true;
    }
}  // end Flow::Match()

void Flow::PrintDescription(FILE* f)
{
    if (type)
        fprintf(f, "%s,", type);
    else
        fprintf(f, "*,");
    
    if (src_addr.IsValid())
    {
        src_addr.PrintDescription(f);
        fprintf(f, "/");     
    }
    else
    {
        fprintf(f, "*/");
    }
    if (src_port >= 0)
        fprintf(f, "%lu->", (unsigned long)src_port);
    else
        fprintf(f, "*->");
    if (dst_addr.IsValid())
    {
        dst_addr.PrintDescription(f);
        fprintf(f, "/");
    }
    else
    {
        fprintf(f, "*/");
    }
    if (dst_port >= 0)
        fprintf(f, "%lu", (unsigned long)dst_port);
    else
        fprintf(f, "*");
    if (flow_id.IsValid())
        fprintf(f, "~%lu", (unsigned long)flow_id);
}  // end Flow::PrintDescription()

bool Flow::AppendData(double x, double y)
{
    Point* thePoint = new Point(x,y);
    if (thePoint)
    {
        point_list.Append(thePoint);
        return true;   
    }
    else
    {
        return false;
    }
}  // end Flow::AppendData()

double Flow::UpdatePosition(double theTime, double x, double y)
{
    if (PositionIsValid())
    {
        x = 0.25*pos_x + 0.75*x;
        y = 0.25*pos_y + 0.75*y;
        double dx = (pos_x - x);
        double dy = (pos_y - y);
        double dp = sqrt(dx*dx + dy*dy);
        double dt = theTime - last_time;
        if (dt > 0.0)
        {
            return (1.0e05*dp/dt); // to approx. meters/sec
        }
        else
        {
            fprintf(stderr, "trpr: Flow::UpdatePosition() time moved backwards!\n");  
            return -1.0;
        }
    }
    else
    {
        pos_x = x;
        pos_y = y;
        last_time = theTime;
        return -1.0;   
    }
}  // end Flow::UpdatePosition()

FlowList::FlowList()
    : head(NULL), tail(NULL), count(0)
{
}

FlowList::~FlowList()
{
    Destroy();
}

void FlowList::Append(Flow* theFlow)
{
    if ((theFlow->prev = tail))
        theFlow->prev->next = theFlow;
    else
        head = theFlow;
    theFlow->next = NULL;
    tail = theFlow;
    count++;
}  // end FlowList::Append()


void FlowList::Remove(Flow* theFlow)
{
    if (theFlow->prev)
        theFlow->prev->next = theFlow->next;
    else
        head = theFlow->next;
    
    if (theFlow->next)
        theFlow->next->prev = theFlow->prev;
    else
        tail = theFlow->prev;
    count--;
}  // end FlowList::Remove()
        

void FlowList::Destroy()
{
    Flow* next;
    while ((next = head))
    {
        Remove(next);
        delete next;
    }   
}  // end Destroy()


const char WILDCARD = 'X';

inline void usage()
{
    fprintf(stderr, "TRPR Version %s\n", VERSION);
    fprintf(stderr, "Usage: trpr [version][mgen][ns][raw][key][real][loss][latency|interarrival]\n"
                    "            [window <sec>] [history <sec>]\n"
                    "            [flow <type,srcAddr/port,dstAddr/port,flowId>]\n"
                    "            [auto <type,srcAddr/port,dstAddr/port,flowId>]\n"
                    "            [exclude <type,srcAddr/port,dstAddr/port,flowId>]\n"
                    "            [input <inputFile>] [output <outputFile>]\n"
                    "            [link <src>[,<dst>]][send|recv]\n"
                    "            [range <sec>[:<sec>]][offset <hh:mm:ss>][absolute]\n"
                    "            [summary][histogram][replay <factor>]\n"
                    "            [png <pngFile>][post <postFile>][multiplot]\n"
                    "            [ramp]\n");
    fprintf(stderr, " (NOTE: 'Wildcard' type, addr, or port parameters with 'X')\n");
}


bool Flow::InitFromDescription(char* flowInfo)
{
    flowInfo = strtok(flowInfo, ",");
    if (flowInfo) 
    {
        if(WILDCARD != flowInfo[0]) SetType(flowInfo);
    }
    else
    {
        fprintf(stderr, "trpr: Error parsing \"flow\" description!\n");
        return false;
    }
    // Pull out source addr/port, checking for wildcards
    if ((flowInfo = strtok(NULL, ",")))
    {
        // Parse source address/port
        char* ptr = strchr(flowInfo, '/');
        if (ptr) 
        {
            *ptr++ = '\0';
            if (WILDCARD != ptr[0]) SetSrcPort(atoi(ptr));
        }
        if (WILDCARD != flowInfo[0]) SetSrcAddr(flowInfo);

        // Pull out destination addr/port, checking for wildcards
        flowInfo = strtok(NULL, ",");
        if (flowInfo)
        {
            // Parse destination address/port
            char* ptr = strchr(flowInfo, '/');
            if (ptr) 
            {
                *ptr++ = '\0';
                if (WILDCARD != ptr[0]) SetDstPort(atoi(ptr));
            }
            if (WILDCARD != flowInfo[0]) SetDstAddr(flowInfo);
        }
        // An optional "flowId" can be specified, too
        if ((flowInfo = strtok(flowInfo, ",")))
        {
            if (WILDCARD != flowInfo[0])
            {
                unsigned long flowId;
                if (1 != sscanf(flowInfo, "%lu", &flowId))
                {
                    fprintf(stderr, "trpr: Error parsing \"flow\" flow id!\n");
                    return false;
                } 
                SetFlowId(flowId);
            }
        }
    }
    return true;
}  // end Flow::InitFromDescription()

static const double SECONDS_PER_DAY = (24.0 * 60.0 * 60.0);
                    
int main(int argc, char* argv[])
{ 
    FlowList flowList;
    FlowList autoList;
    FlowList excludeList;
    
    double windowSize = 1.0;
    bool   use_default_window = true;
    double historyDepth = 20.0;
    char* input_file = NULL;
    char* output_file = NULL;
    char* png_file = NULL;
    char* post_file = NULL;
    bool use_gnuplot = true;
    bool multiplot = false;
    bool realTime = false;
    TraceFormat traceFormat = TCPDUMP;
    PlotMode plotMode = RATE;  
    bool replay = false; // real time playback mode
    double replayFactor = 1.0;
    double startTime = -1.0;
    double stopTime = -1.0;
    bool print_key = false;
    double offsetTime = -1.0;
    bool summarize = false;
    bool make_histogram = false;
    unsigned int detect_proto_len = 0;
    bool normalize = true;
    bool stairStep = true;
    
    PacketEvent::TracePoint link;   // Our tracepoint (wildcard default)
    char* linkSrc = NULL;
    char* linkDst = NULL;    
    enum EventMask {SEND = 0x01, RECV = 0x02, DROP = 0x03};
    int eventMask = (RECV | DROP);
    
    if (argc < 2)
    {
        usage();
        exit(-1);
    }
    
    fprintf(stderr, "TRPR Version %s\n", VERSION);
            
    // Parse command line
    int i = 1;
    while(i < argc)
    {
        if (!strcmp("window", argv[i]))
        {
            i++;
            float w;
            if (1 != sscanf(argv[i], "%f", &w))
            {
               fprintf(stderr, "trpr: Error parsing \"window\" size!\n");
               usage();
               exit(-1);
            }
            use_default_window = false;
            windowSize = w;
            i++;
        }
        else if (!strcmp("history", argv[i]))
        {
            i++;
            float w;
            if (1 != sscanf(argv[i], "%f", &w))
            {
               fprintf(stderr, "trpr: Error parsing \"history\" depth!\n");
               usage();
               exit(-1);
            }
            historyDepth = w;
            i++;
        }
        else if (!strcmp("flow", argv[i]))
        {
            i++;
            if (i >= argc)
            {
                fprintf(stderr, "trpr: Insufficient \"flow\" arguments!\n");
                usage();
                exit(-1);