📄 fromtcpdump.hh
字号:
// -*- mode: c++; c-basic-offset: 4 -*-#ifndef CLICK_FROMTCPDUMP_HH#define CLICK_FROMTCPDUMP_HH#include <click/element.hh>#include <click/task.hh>#include <click/notifier.hh>#include <click/ipflowid.hh>#include <click/hashmap.hh>#include <clicknet/tcp.h>#include "elements/userlevel/fromfile.hh"#include "ipsumdumpinfo.hh"CLICK_DECLS/*=cFromTcpdump(FILENAME [, I<KEYWORDS>])=s analysisreads packets from an ASCII tcpdump output file=dReads textual TCP/IP packet descriptors from an ASCII tcpdump(1) output file,then creates packets resembling those descriptors and pushes them out theoutput. Optionally stops the driver when there are no more packets.The file may be compressed with gzip(1) or bzip2(1); FromTcpdump willrun zcat(1) or bzcat(1) to uncompress it.FromTcpdump reads from the file named FILENAME unless FILENAME is asingle dash `C<->', in which case it reads from the standard input. It willnot uncompress the standard input, however.FromTcpdump doesn't parse many of the relevant parts of the file. It handlesfragments badly, for example. Mostly it just does TCP and some rudimentaryUDP.Keyword arguments are:=over 8=item STOPBoolean. If true, then FromTcpdump will ask the router to stop when itis done reading. Default is false.=item ACTIVEBoolean. If false, then FromTcpdump will not emit packets (until the`C<active>' handler is written). Default is true.=item ZEROBoolean. Determines the contents of packet data not set by the dump. If trueE<lparen>the default), this data is zero. If false, it is random garbage.=item CHECKSUMBoolean. If true, then output packets' IP, TCP, and UDP checksums are set. Iffalse (the default), the checksum fields contain random garbage.=item SAMPLEUnsigned real number between 0 and 1. FromTcpdump will output eachpacket with probability SAMPLE. Default is 1. FromTcpdump usesfixed-point arithmetic, so the actual sampling probability may differsubstantially from the requested sampling probability. Use theC<sampling_prob> handler to find out the actual probability. If MULTIPACKET istrue, then the sampling probability applies separately to the multiple packetsgenerated per record.=backOnly available in user-level processes.=nFromTcpdump is a notifier signal, active when the element is active andthe dump contains more packets.tcpdump(1)'s binary output is generally much better than the output ofFromTcpdump. Unfortunately, some people just throw it away.=h sampling_prob read-onlyReturns the sampling probability (see the SAMPLE keyword argument).=h active read/writeValue is a Boolean.=h encap read-onlyReturns `IP'. Useful for ToDump's USE_ENCAP_FROM option.=h filesize read-onlyReturns the length of the FromTcpdump file, in bytes, or "-" if thatlength cannot be determined.=h filepos read-onlyReturns FromTcpdump's position in the file, in bytes.=h stop write-onlyWhen written, sets `active' to false and stops the driver.=atcpdump(1), FromDump, FromIPSummaryDump */class FromTcpdump : public Element { public: FromTcpdump(); ~FromTcpdump(); const char *class_name() const { return "FromTcpdump"; } const char *processing() const { return AGNOSTIC; } void *cast(const char *); int configure(Vector<String> &, ErrorHandler *); int initialize(ErrorHandler *); void cleanup(CleanupStage); void add_handlers(); bool run_task(); Packet *pull(int); private: enum { SAMPLING_SHIFT = 28 }; FromFile _ff; uint32_t _sampling_prob; bool _stop : 1; bool _format_complaint : 1; bool _zero : 1; bool _checksum : 1; bool _active : 1; bool _dead : 1; struct FlowRecord { tcp_seq_t init_seq[2]; tcp_seq_t last_seq[2]; inline FlowRecord() { init_seq[0] = init_seq[1] = 0; } }; HashMap<IPFlowID, FlowRecord> _tcp_map; int _absolute_seq; Task _task; ActiveNotifier _notifier; Packet *read_packet(ErrorHandler *); const char *read_tcp_line(WritablePacket *&, const char *begin, const char *end, int *data_len); const char *read_udp_line(WritablePacket *&, const char *begin, const char *end, int *data_len); static String read_handler(Element *, void *); static int write_handler(const String &, Element *, void *, ErrorHandler *); };CLICK_ENDDECLS#endif
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -