np_tcp_window.py

该软件根据网络数据生成NetFlow记录。NetFlow可用于网络规划、负载均衡、安全监控等

###############################################################################

    def scale(self):

	hdrlist = self.pktlist
	i1 = self.indx1
	i2 = self.indx2

	hlen = 0
	first = hdrlist[i1].tm
	last = hdrlist[i2].tm
	
	#scale for period - easy pkt list is ordered
	self.tbase = first
	dur = self.dur = last-first
	#print 'Pkt list: first %d last %d dur %d' % (first, last, dur)

	if dur == 0:
	    dur = self.dur = 100

	self.tscalef = self.xwi*1.0/dur

	# scale for seq spaces - may not be ordered
	self.has_sacks = 1
	self.has_cacks = 1
	slowseq = SEQ_MAX
	slowack = SEQ_MAX 
	clowseq = SEQ_MAX 
	clowack = SEQ_MAX 
	stopseq = 0L
	stopack = 0L
	ctopseq = 0L
	ctopack = 0L

	sseq_wraps = 0L
	sack_wraps = 0L
	cseq_wraps = 0L
	cack_wraps = 0L
	srel_wraps = 0L
	crel_wraps = 0L

	sfirstack = -1
	cfirstack = -1

	slastack = None
	clastack = None

	slastrel = None
	clastrel = None

	smax_inflight = 0
	cmax_inflight = 0

	smax_rtt = 0
	smin_rtt = BIGNUMBER
	cmax_rtt = 0
	cmin_rtt = BIGNUMBER

	order = 0
	first = 1

        nomod = not self.modelled

	#print 'Pkts %d-%d:' % (i1, i2)
	for p in hdrlist[i1:i2+1]:
	    #p.printself_rel()
	    #print 'sf = %d cf = %d' % (p.sinflight, p.cinflight)
	    #print '#%d %.3f %.3f' % (p.indx, p.prtt, p.delay)
	    p.order = order
	    order = order+1
	    hlen = hlen + 1
	    seq = p.seq
	    ack = p.ack
	    len = p.len
	    pend = seq+len
	    #pend = seq_add(seq, len)
	    #flags = ord(p.flags)
	    flags = p.flags
	    #print 'seq %s' % (Longstring(seq))
            if nomod:
                p.markers = 0
                p.highrel = None
                p.remark = 0
                p.trig = 0
                p.tstr = ''
                p.prtt = p.trtt = p.delay = 0
                p.lag = None
	    if p.dir == SERVER:
		if not (p.markers & P_SEQ_RTMT):
		    wseq = seq + sseq_wraps
		    pend = wseq + len
		    if seq_add(seq, len) < seq:
			# wrap
			sseq_wraps += SEQ_MAX
		    stopseq = MAX(pend, stopseq)
		    slowseq = MIN(wseq, slowseq)
		else:
		    # NB this probably hasn't been tested
		    wseq = seq
		    while stopseq - wseq > SEQ_MAX/2:
			wseq += SEQ_MAX

		p.wseq = wseq
		    
		if (flags & TH_ACK): # and not (p.markers & P_BOGUS_ACK):
		    if sfirstack == -1:
			sfirstack = ack
		    elif ack < slastack:
			# wrap
			sack_wraps += SEQ_MAX
		    slastack = ack
		    wack = ack + sack_wraps
		    stopack = MAX(wack, stopack)
		    slowack = MIN(wack, slowack)
		    p.wack = wack

                if self.modelled:
                    smax_rtt = MAX(smax_rtt, p.prtt+p.delay)
                    if p.prtt:
                        smin_rtt = MIN(smin_rtt, p.prtt+p.delay)

                if p.highrel != None:
                    if (slastrel != None and p.highrel < slastrel) or p.highrel < p.ack:
                            # wrap
                            srel_wraps += SEQ_MAX
                    slastrel = p.highrel
                    p.wrel = p.highrel + srel_wraps
                else:
                    p.wrel = None
		    

	    elif p.dir == CLIENT:
		if not (p.markers & P_SEQ_RTMT):
		    wseq = seq + cseq_wraps
		    pend = wseq + len
		    if seq_add(seq, len) < seq:
			# wrap
			cseq_wraps += SEQ_MAX
		    ctopseq = MAX(pend, ctopseq)
		    clowseq = MIN(wseq, clowseq)
		else:
		    # NB this probably hasn't been tested
		    wseq = seq
		    while ctopseq - wseq > SEQ_MAX/2:
			wseq += SEQ_MAX

		p.wseq = wseq
		    
		if (flags & TH_ACK): # and not (p.markers & P_BOGUS_ACK):
		    if cfirstack == -1:
			cfirstack = ack
		    elif ack < clastack:
			# wrap
			cack_wraps += SEQ_MAX
		    clastack = ack
		    wack = ack + cack_wraps
		    ctopack = MAX(wack, ctopack)
		    clowack = MIN(wack, clowack)
		    p.wack = wack

                if self.modelled:
                    cmax_rtt = MAX(cmax_rtt, p.prtt+p.delay)
                    if p.prtt:
                        cmin_rtt = MIN(cmin_rtt, p.prtt+p.delay)

                if p.highrel != None:
                      #if p.highrel < clastrel:
                    if (clastrel != None and p.highrel < clastrel) or p.highrel < p.ack:
                        # wrap
                        crel_wraps += SEQ_MAX
                    clastrel = p.highrel
                    p.wrel = p.highrel + crel_wraps
                else:
                    p.wrel = None

	    else:
		errstr = 'Goof - unknown pkt direction %d' % (p.dir)
		sys.stderr.write(errstr)
		sys.exit(0)

	    smax_inflight = MAX(p.sinflight, smax_inflight)
	    cmax_inflight = MAX(p.cinflight, cmax_inflight)

	if slowseq == BIGNUMBER:
	    slowseq = clowack
	    stopseq = ctopack
	if slowack == BIGNUMBER:
	    slowack = clowseq
	    stopack = ctopseq
	    self.has_sacks = 0
	if clowseq == BIGNUMBER:
	    clowseq = slowack
	    ctopseq = stopack
	if clowack == BIGNUMBER:
	    clowack = slowseq
	    ctopack = stopseq
	    self.has_cacks = 0

	self.sseqbase = MIN(clowack, slowseq)
	self.cseqbase = MIN(slowack, clowseq)

	sseqhigh = MAX(stopseq, ctopack)
	cseqhigh = MAX(ctopseq, stopack)

	self.hdrlist_len = hlen
	self.slowseq = slowseq
	self.stopseq = stopseq
	self.slowack = slowack
	self.stopack = stopack
	self.sseqrange = sseqhigh - self.sseqbase
	self.sackrange = stopack - slowack
	self.clowseq = clowseq
	self.ctopseq = ctopseq
	self.clowack = clowack
	self.ctopack = ctopack
	self.cseqrange = cseqhigh - self.cseqbase
	self.cackrange = ctopack - clowack

	self.sfirstack = sfirstack
	self.cfirstack = cfirstack

	self.seqrange = MAX(self.sseqrange, self.cseqrange)
	#self.ackrange =  MAX(self.sackrange, self.cackrange)
	#self.seqspace = MAX(self.seqrange, self.ackrange)

## 	if self.seqspace == 0:
## 	    self.seqspace = 100

	self.seqrange = MAX(self.seqrange,100)

	if not smax_rtt:
	    smax_rtt = 100
	self.smax_rtt = smax_rtt

	if smin_rtt == BIGNUMBER:
	    smin_rtt = 1
	self.smin_rtt = smin_rtt

	if not cmax_rtt:
	    cmax_rtt = 100
	self.cmax_rtt = cmax_rtt

	if cmin_rtt == BIGNUMBER:
	    cmin_rtt = 1
	self.cmin_rtt = cmin_rtt
	#print 'CMINRTT %d' % (cmin_rtt)

## 	print 'server seq %s-%s = %s' % (Longstring(slowseq), 
## 				     Longstring(stopseq), 
## 				     Longstring(self.sseqrange))
## 	print 'client seq %s-%s = %s' % (Longstring(clowseq), 
## 				     Longstring(ctopseq), 
## 				     Longstring(self.cseqrange))

## 	print 'server ack %s-%s = %s' % (Longstring(slowack), 
## 				     Longstring(stopack), 
## 				     Longstring(self.sackrange))
## 	print 'client ack %s-%s = %s' % (Longstring(clowack), 
## 				     Longstring(ctopack), 
## 				     Longstring(self.cackrange))

	self.sscalef = self.yht*1.0/self.seqrange

	## for hdr in hdrlist:
## 	    hdr.printself_rel()

	self.cmax_inflight = cmax_inflight
	self.smax_inflight = smax_inflight
	self.max_inflight = MAX(cmax_inflight, smax_inflight)
	self.max_inflight = MAX(self.max_inflight, 1)

	self.fscalef = self.flight_yht*1.0/self.max_inflight

	#print 'srtt min %.3f max %.3f range %.3f' % (smin_rtt/1000.0, smax_rtt/1000.0, (smax_rtt-smin_rtt)/1000.0)
	#print 'crtt min %.3f max %.3f range %.3f' % (cmin_rtt/1000.0, cmax_rtt/1000.0, (cmax_rtt-cmin_rtt)/1000.0)

	try:
	    self.srscalef = float(self.rtt_yht-self.min_ytic_hi/2)/(smax_rtt-smin_rtt)
	except ZeroDivisionError:
	    # max-min range is 0 - only one packet
	    hrange = smax_rtt/5
	    self.srmax_rtt = smax_rtt+hrange
	    self.srmin_rtt = smin_rtt-hrange
	    self.srscalef = float(self.rtt_yht-self.min_ytic_hi/2)/(hrange*2)
	try:
	    self.crscalef = float(self.rtt_yht-self.min_ytic_hi/2)/(cmax_rtt-cmin_rtt)
	except ZeroDivisionError:
	    # max-min range is 0 - only one packet
	    hrange = cmax_rtt/5
	    self.crmax_rtt = cmax_rtt+hrange
	    self.crmin_rtt = cmin_rtt-hrange
	    self.crscalef = float(self.rtt_yht-self.min_ytic_hi/2)/(hrange*2)
	
###############################################################################
	    

    def draw_blob(self, x, y, col, tag=''):

	RECT = self.canv.create_rectangle

	return RECT(x-2, y-2, x+2, y+2, outline='', fill=col, tag=tag) 
	
###############################################################################


    def draw_cross(self, x, y, col, indx):
	
	LINE = self.canv.create_line
	TEXT = self.canv.create_text
	LINE(x-5, y-5, x+5, y+5, fill=col)
	TEXT(x+5, y+5, anchor=NW, fill=col, font=PKT_LABEL_FONT, 
	     text='%d' % (indx))
	return LINE(x-5, y+5, x+5, y-5, fill=col) 
	
###############################################################################


    def draw_point(self, x, y, col, indx):

	OVAL = self.canv.create_oval
	TEXT = self.canv.create_text
	
	if indx != None:
	    TEXT(x+5, y+5, anchor=NW, fill=col, font=PKT_LABEL_FONT, 
	     text='%d' % (indx))

	return OVAL(x-2, y-2, x+2, y+2, outline=col, fill=col) 
	
###############################################################################


    def draw_vtic(self, x, y, col, indx):

	LINE = self.canv.create_line
	TEXT = self.canv.create_text
	
## 	if indx != None:
## 	    TEXT(x+5, y+5, anchor=NW, fill=col, font=("helvetica", 10), 
## 	     text='%d' % (indx))

	return LINE(x, y-2, x, y+2, fill=col)
	    

##############################################################################
##############################################################################

#
# Window displaying graph of TCP connection activity
#

class TCP_Window(Toplevel):

    def __init__(self, conn, Display, root=None):

	Toplevel.__init__(self)
	self.root = root
	self.Display = Display
	self.canvasses = []

	self.draw_conn(conn)
 	geomstr = '%dx%d' % (TCP_WDW_WI,TCP_WDW_HT)
	self.geometry(geomstr)

##############################################################################

    def gone(self):
	##if self.root != None:
	    #self.root.destroy()
	# Comment out following line when using np_tcp.py
	self.destroy()

##############################################################################


    def mouse_3_dblclick(self, event):
	# pop canvas zoom stack
	canv = event.widget
	x = canv.canvasx(event.x)
	y = canv.canvasy(event.y)

	Canv = canv.Canv

	if inside(x, y, Canv.mouse_bounds):
	    if self.canvas_curr > 0:
		self.canvasses[self.canvas_curr].canv.place_forget() 
		self.canvas_curr = self.canvas_curr - 1 
		self.canvasses.pop()
		# re-show previous in stack
		curr = self.canvasses[self.canvas_curr]
		curr.canv.place(x=curr.xpos, y=curr.ypos, width=curr.wi, 
				height=curr.ht)
	elif inside(x, y, Canv.rtt_bounds):
	    Canv.rtt_scaledown(RTT_ZOOM_FACT)

##############################################################################

    def clear_canvasses(self):

	for c in self.canvasses:
	    #c.canv.place.forget()
	    c.canv.delete(ALL)
	    del(c)

	self.canvasses = []
	self.clear_titlebar()
	
############################################################################

    def set_titlebar(self, conn):

	tstr = 'James pretty picture of connection #%d' % (conn.id)
	self.winfo_toplevel().title(tstr)
	

############################################################################

    def clear_titlebar(self):

	tstr = ''
	self.winfo_toplevel().title(tstr)
	

############################################################################

	
    def draw_conn(self, conn):

	if len(self.canvasses):
	    self.clear_canvasses()

	#if conn == None:
	if not conn:
	    return

	self.conn = conn
	self.conn.sseqbase = MIN(self.conn.slowseq, self.conn.clowack)
	self.conn.cseqbase = MIN(self.conn.clowseq, self.conn.slowack)
	self.pktlist = conn.pktlist
	self.pktlist_len = len(conn.pktlist)

	self.calc_inflights(self.pktlist) # does for all zooms

	self.canvasses = []
	self.canvasses_tot = 1
	self.canvas_curr = 0
	self.canvasses.append(TCP_canv(self, conn, self.pktlist,
				       0, self.pktlist_len-1,
				       TCP_WDW_WI, TCP_WDW_HT, 
				       0, 0))
	self.set_titlebar(conn)

##############################################################################

    #
    # For each pkt how many pkts are in flight (seen but not acked)
    # - invariant over zooms
    #
    def calc_inflights(self, plist):

	sinflight = 0
	cinflight = 0

	sinflight_min = 0
	cinflight_min = 0

## 	slowseq = BIGNUMBER
## 	clowseq = BIGNUMBER

## 	slowack = BIGNUMBER
## 	clowack = BIGNUMBER

	slastacked_indx = 0
	clastacked_indx = 0

	

	for i in range(len(plist)):
	    p = plist[i]
	    #p.indx = i # tag with indx for zoom selection
	    way = p.dir
	    #flags = ord(p.flags)
	    flags = p.flags
	    plen = p.len
	    if flags & TH_FIN or flags & TH_SYN:
		plen = plen + 1
	    if plen:
		p.needs_ack = 1
	    else:
		p.needs_ack = 0
	    if way == SERVER:
		if plen:
		    sinflight = sinflight+1
		if flags & TH_ACK:
		    ack = p.ack
		    on = 0
		    cleared = 0
		    # ack may be for more than one pkt
		    for pkt in plist[clastacked_indx:i]:
			#on = on+1
			pway = pkt.dir
			if pway == CLIENT:
			    if pkt.seq+pkt.len <= ack:
				on = on+1
				if pkt.needs_ack:
				    pkt.needs_ack = 0
				    cleared = cleared+1
			    else:
				break
		    clastacked_indx = clastacked_indx + on
		    cinflight = cinflight - cleared
	    if way == CLIENT:
		if plen:
		    cinflight = cinflight+1
		if flags & TH_ACK:
		    ack = p.ack
		    on = 0
		    cleared = 0
		    # ack may be for more than one pkt
		    for pkt in plist[slastacked_indx:i]:
			#on = on+1
			pway = pkt.dir
			if pway == SERVER:
			    if pkt.seq+pkt.len <= ack:
				on = on+1
				if pkt.needs_ack:
				    pkt.needs_ack = 0
				    cleared = cleared+1
			    else:
				break
		    slastacked_indx = slastacked_indx + on
		    sinflight = sinflight - cleared

	    
	    p.sinflight = sinflight
	    p.cinflight = cinflight

	    if sinflight < sinflight_min:
		sinflight_min = sinflight
	    if cinflight < cinflight_min:
		cinflight_min = cinflight

	#
	# Acks arriving for pkts in flight before trace start will have forced
	# inflights negative - patch to reflect pkts in flight at start
	#
	if sinflight_min < 0 or sinflight_min < 0:
	    sadd = -sinflight_min
	    cadd = -cinflight_min

## 	    for p in plist:
## 		p.sinflight = p.sinflight+sadd
## 		p.cinflight = p.cinflight+cadd