tcpdump-3.4a5-sack.patch

该软件根据网络数据生成NetFlow记录。NetFlow可用于网络规划、负载均衡、安全监控等

From vger.rutgers.edu!owner-linux-kernel-outgoing Sat May  2 12:13:16 1998
Return-Path: <[e-mail]>
Received: from ferret.lmh.ox.ac.uk by the-village.bc.nu with smtp
	(Smail3.1.29.1 #2) id m0yVaEF-000aNNa; Sat, 2 May 98 12:13 BST
Received: (qmail 7663 invoked from network); 2 May 1998 11:22:31 -0000
Received: from vger.rutgers.edu (root@128.6.190.2)
  by ferret.lmh.ox.ac.uk with SMTP; 2 May 1998 11:22:31 -0000
Received: by vger.rutgers.edu id <971243-28922>; Sat, 2 May 1998 06:24:40 -0400
Received: from dm.cobaltmicro.com ([209.133.34.35]:1055 "EHLO dm.cobaltmicro.com" ident: "root") by vger.rutgers.edu with ESMTP id <971250-28922>; Sat, 2 May 1998 06:10:57 -0400
Received: (from davem@localhost)
	by dm.cobaltmicro.com (8.8.7/8.8.7) id DAA00964;
	Sat, 2 May 1998 03:14:14 -0700
Date:	Sat, 2 May 1998 03:14:14 -0700
Message-Id: <[e-mail]>
From:	"David S. Miller" <[e-mail]>
To:	[e-mail]
CC:	[e-mail], [e-mail]
Subject: a plea for TCP bug reportes, README
X-Orcpt: rfc822;[e-mail]
Sender: [e-mail]
Precedence: bulk
X-Loop: [e-mail]
Status: RO


I'd like to ask people sending me tcpdumps to assist in the tracking
down of TCP stalls, hiccups, and performance problems to apply the
following patch to tcpdump.

The problem is that the format used by older tcpdumps to output the
SACK options in the TCP header are in the wrong format, a format which
predates the real RFC specification for SACK.

This will make debugging for me so much easier, thanks.  This patch
should go cleanly onto the redhat-5.0 srpm sources for tcpdump.

--- tcpdump-3.3/tcpdump-3.3/print-tcp.c.orig	Tue Dec 10 23:26:08 1996
+++ tcpdump-3.3/tcpdump-3.3/print-tcp.c	Thu Mar 19 23:46:33 1998
@@ -103,8 +103,8 @@
 	register int hlen;
 	register char ch;
 	u_short sport, dport, win, urp;
-	u_int32_t seq, ack;
-
+	u_int32_t seq, ack,thseq,thack;	
+        int threv;
 	tp = (struct tcphdr *)bp;
 	ip = (struct ip *)bp2;
 	ch = '\0';
@@ -162,7 +162,7 @@
 			tha.port = dport << 16 | sport;
 			rev = 1;
 		}
-
+		threv = rev;
 		for (th = &tcp_seq_hash[tha.port % TSEQ_HASHSIZE];
 		     th->nxt; th = th->nxt)
 			if (!memcmp((char *)&tha, (char *)&th->addr,
@@ -183,6 +183,10 @@
 			else
 				th->seq = seq, th->ack = ack - 1;
 		} else {
+		  
+		        thseq = th->seq;
+                        thack = th->ack;
+
 			if (rev)
 				seq -= th->ack, ack -= th->seq;
 			else
@@ -263,18 +267,32 @@
 				break;
 
 			case TCPOPT_SACK:
-				(void)printf("sack");
-				datalen = len - 2;
-				for (i = 0; i < datalen; i += 4) {
-					LENCHECK(i + 4);
-					/* block-size@relative-origin */
-					(void)printf(" %u@%u",
-					    EXTRACT_16BITS(cp + i + 2),
-					    EXTRACT_16BITS(cp + i));
+			  {
+			    u_int32_t s, e;
+
+			    datalen = len - 2;
+			    if (datalen % 8 != 0) {
+				(void)printf(" malformed sack ");
+			    } else {
+				(void)printf(" sack %d ", datalen / 8);
+				for (i = 0; i < datalen; i += 8) {
+				    LENCHECK(i + 4);
+				    s = EXTRACT_32BITS(cp + i);
+				    LENCHECK(i + 8);
+				    e = EXTRACT_32BITS(cp + i + 4);
+				    if (threv) {
+					s -= thseq;
+					e -= thseq;
+				    } else {
+					s -= thack;
+					e -= thack;
+				    }
+				    (void)printf("{%u:%u}", s, e);
 				}
-				if (datalen % 4)
-					(void)printf("[len %d]", len);
-				break;
+				(void)printf(" ");
+			    }
+			    break;
+			  }
 
 			case TCPOPT_ECHO:
 				(void)printf("echo");

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [e-mail]