void hostmon(time_t facilitytime, char *ifptr) { int logging = options.logging; struct ethtab table; struct ethtabent *entry; char scratch_saddr[ETH_ALEN]; char scratch_daddr[ETH_ALEN]; unsigned int idx = 1; int is_ip; int ch; char *ifname = ifptr; struct timeval tv; struct timeval tv_rate; time_t now = 0; time_t statbegin = 0; time_t startlog = 0; struct timeval updtime; struct eth_desc *list = NULL; FILE *logfile = NULL; int pkt_result; WINDOW *sortwin; PANEL *sortpanel; int keymode = 0; int fd; if (ifptr && !dev_up(ifptr)) { err_iface_down(); return; } LIST_HEAD(promisc); if (options.promisc) { promisc_init(&promisc, ifptr); promisc_set_list(&promisc); } hostmonhelp(); initethtab(&table); /* Ethernet description list */ struct eth_desc *elist = load_eth_desc(ARPHRD_ETHER); /* FDDI description list */ struct eth_desc *flist = load_eth_desc(ARPHRD_FDDI); if (logging) { if (strcmp(current_logfile, "") == 0) { strncpy(current_logfile, gen_instance_logname(LANLOG, getpid()), 80); if (!daemonized) input_logfile(current_logfile, &logging); } } if (logging) { opentlog(&logfile, current_logfile); if (logfile == NULL) logging = 0; } if (logging) { signal(SIGUSR1, rotate_lanlog); rotate_flag = 0; writelog(logging, logfile, "******** LAN traffic monitor started ********"); } leaveok(table.tabwin, TRUE); fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if(fd == -1) { write_error("Unable to obtain monitoring socket"); goto err; } if(ifptr && dev_bind_ifname(fd, ifptr) == -1) { write_error("Unable to bind interface on the socket"); goto err_close; } exitloop = 0; gettimeofday(&tv, NULL); tv_rate = tv; updtime = tv; statbegin = startlog = tv.tv_sec; PACKET_INIT(pkt); do { gettimeofday(&tv, NULL); now = tv.tv_sec; unsigned long msecs = timeval_diff_msec(&tv, &tv_rate); if (msecs >= 1000) { printelapsedtime(statbegin, now, LINES - 3, 15, table.borderwin); updateethrates(&table, msecs, idx); tv_rate = tv; } if (logging) { check_rotate_flag(&logfile); if ((now - startlog) >= options.logspan) { writeethlog(table.head, now - statbegin, logfile); startlog = now; } } if (screen_update_needed(&tv, &updtime)) { update_panels(); doupdate(); updtime = tv; } if ((facilitytime != 0) && (((now - statbegin) / 60) >= facilitytime)) exitloop = 1; if (packet_get(fd, &pkt, &ch, table.tabwin) == -1) { write_error("Packet receive failed"); exitloop = 1; break; } if (ch != ERR) { if (keymode == 0) { switch (ch) { case KEY_UP: scrollethwin(&table, SCROLLDOWN, &idx); break; case KEY_DOWN: scrollethwin(&table, SCROLLUP, &idx); break; case KEY_PPAGE: case '-': pageethwin(&table, SCROLLDOWN, &idx); break; case KEY_NPAGE: case ' ': pageethwin(&table, SCROLLUP, &idx); break; case 12: case 'l': case 'L': tx_refresh_screen(); break; case 's': case 'S': show_hostsort_keywin(&sortwin, &sortpanel); keymode = 1; break; case 'q': case 'Q': case 'x': case 'X': case 27: case 24: exitloop = 1; } } else if (keymode == 1) { del_panel(sortpanel); delwin(sortwin); sort_hosttab(&table, &idx, ch); keymode = 0; } } if (pkt.pkt_len <= 0) continue; char ifnamebuf[IFNAMSIZ]; pkt_result = packet_process(&pkt, NULL, NULL, NULL, MATCH_OPPOSITE_USECONFIG, 0); if (pkt_result != PACKET_OK) continue; if (!ifptr) { /* we're capturing on "All interfaces", */ /* so get the name of the interface */ /* of this packet */ int r = dev_get_ifname(pkt.pkt_ifindex, ifnamebuf); if (r != 0) { write_error("Unable to get interface name"); break; /* can't get interface name, get out! */ } ifname = ifnamebuf; } /* get HW addresses */ switch (pkt.pkt_hatype) { case ARPHRD_ETHER: { memcpy(scratch_saddr, pkt.ethhdr->h_source, ETH_ALEN); memcpy(scratch_daddr, pkt.ethhdr->h_dest, ETH_ALEN); list = elist; break; } case ARPHRD_FDDI: { memcpy(scratch_saddr, pkt.fddihdr->saddr, FDDI_K_ALEN); memcpy(scratch_daddr, pkt.fddihdr->daddr, FDDI_K_ALEN); list = flist; break; } default: /* unknown link protocol */ continue; } switch(pkt.pkt_protocol) { case ETH_P_IP: case ETH_P_IPV6: is_ip = 1; break; default: is_ip = 0; break; } /* Check source address entry */ entry = in_ethtable(&table, pkt.pkt_hatype, scratch_saddr); if (!entry) entry = addethentry(&table, pkt.pkt_hatype, ifname, scratch_saddr, list); if (entry != NULL) { updateethent(entry, pkt.pkt_len, is_ip, 1); if (!entry->prev_entry->un.desc.printed) printethent(&table, entry->prev_entry, idx); printethent(&table, entry, idx); } /* Check destination address entry */ entry = in_ethtable(&table, pkt.pkt_hatype, scratch_daddr); if (!entry) entry = addethentry(&table, pkt.pkt_hatype, ifname, scratch_daddr, list); if (entry != NULL) { updateethent(entry, pkt.pkt_len, is_ip, 0); if (!entry->prev_entry->un.desc.printed) printethent(&table, entry->prev_entry, idx); printethent(&table, entry, idx); } } while (!exitloop); err_close: close(fd); err: if (options.promisc) { promisc_restore_list(&promisc); promisc_destroy(&promisc); } if (logging) { signal(SIGUSR1, SIG_DFL); writeethlog(table.head, time(NULL) - statbegin, logfile); writelog(logging, logfile, "******** LAN traffic monitor stopped ********"); fclose(logfile); } del_panel(table.tabpanel); delwin(table.tabwin); del_panel(table.borderpanel); delwin(table.borderwin); update_panels(); doupdate(); destroyethtab(&table); free_eth_desc(elist); free_eth_desc(flist); strcpy(current_logfile, ""); }
/* * The detailed interface statistics function */ void detstats(char *iface, time_t facilitytime) { int logging = options.logging; WINDOW *statwin; PANEL *statpanel; int pkt_result = 0; FILE *logfile = NULL; unsigned int iplen = 0; struct ifcounts ifcounts; int ch; struct timeval tv; struct timeval start_tv; struct timeval updtime; time_t starttime; time_t now; time_t statbegin; time_t startlog; struct proto_counter span; struct rate rate; struct rate rate_in; struct rate rate_out; unsigned long peakactivity = 0; unsigned long peakactivity_in = 0; unsigned long peakactivity_out = 0; struct rate pps_rate; struct rate pps_rate_in; struct rate pps_rate_out; unsigned long peakpps = 0; unsigned long peakpps_in = 0; unsigned long peakpps_out = 0; int fd; if (!dev_up(iface)) { err_iface_down(); return; } LIST_HEAD(promisc); if (options.promisc) { promisc_init(&promisc, iface); promisc_set_list(&promisc); } move(LINES - 1, 1); stdexitkeyhelp(); statwin = newwin(LINES - 2, COLS, 1, 0); statpanel = new_panel(statwin); tx_stdwinset(statwin); wtimeout(statwin, -1); wattrset(statwin, BOXATTR); tx_colorwin(statwin); tx_box(statwin, ACS_VLINE, ACS_HLINE); wmove(statwin, 0, 1); wprintw(statwin, " Statistics for %s ", iface); wattrset(statwin, STDATTR); update_panels(); doupdate(); memset(&ifcounts, 0, sizeof(struct ifcounts)); if (logging) { if (strcmp(current_logfile, "") == 0) { snprintf(current_logfile, 64, "%s-%s.log", DSTATLOG, iface); if (!daemonized) input_logfile(current_logfile, &logging); } } if (logging) { opentlog(&logfile, current_logfile); if (logfile == NULL) logging = 0; } if (logging) { signal(SIGUSR1, rotate_dstat_log); rotate_flag = 0; writelog(logging, logfile, "******** Detailed interface statistics started ********"); } printdetlabels(statwin); printdetails(&ifcounts, statwin); update_panels(); doupdate(); memset(&span, 0, sizeof(span)); rate_alloc(&rate, 5); rate_alloc(&rate_in, 5); rate_alloc(&rate_out, 5); rate_alloc(&pps_rate, 5); rate_alloc(&pps_rate_in, 5); rate_alloc(&pps_rate_out, 5); gettimeofday(&tv, NULL); start_tv = tv; updtime = tv; starttime = startlog = statbegin = tv.tv_sec; leaveok(statwin, TRUE); fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if(fd == -1) { write_error("Unable to obtain monitoring socket"); goto err; } if(dev_bind_ifname(fd, iface) == -1) { write_error("Unable to bind interface on the socket"); goto err_close; } exitloop = 0; PACKET_INIT(pkt); /* * Data-gathering loop */ while (!exitloop) { gettimeofday(&tv, NULL); now = tv.tv_sec; if ((now - starttime) >= 1) { char buf[64]; unsigned long activity, activity_in, activity_out; unsigned long pps, pps_in, pps_out; unsigned long msecs; wattrset(statwin, BOXATTR); printelapsedtime(statbegin, now, LINES - 3, 1, statwin); msecs = timeval_diff_msec(&tv, &start_tv); rate_add_rate(&rate, span.proto_total.pc_bytes, msecs); activity = rate_get_average(&rate); rate_add_rate(&rate_in, span.proto_in.pc_bytes, msecs); activity_in = rate_get_average(&rate_in); rate_add_rate(&rate_out, span.proto_out.pc_bytes, msecs); activity_out = rate_get_average(&rate_out); rate_add_rate(&pps_rate, span.proto_total.pc_packets, msecs); pps = rate_get_average(&pps_rate); rate_add_rate(&pps_rate_in, span.proto_in.pc_packets, msecs); pps_in = rate_get_average(&pps_rate_in); rate_add_rate(&pps_rate_out, span.proto_out.pc_packets, msecs); pps_out = rate_get_average(&pps_rate_out); memset(&span, 0, sizeof(span)); starttime = now; start_tv = tv; wattrset(statwin, HIGHATTR); rate_print(activity, buf, sizeof(buf)); mvwprintw(statwin, 14, 19, "%s", buf); rate_print_pps(pps, buf, sizeof(buf)); mvwprintw(statwin, 15, 19, "%s", buf); rate_print(activity_in, buf, sizeof(buf)); mvwprintw(statwin, 17, 19, "%s", buf); rate_print_pps(pps_in, buf, sizeof(buf)); mvwprintw(statwin, 18, 19, "%s", buf); rate_print(activity_out, buf, sizeof(buf)); mvwprintw(statwin, 20, 19, "%s", buf); rate_print_pps(pps_out, buf, sizeof(buf)); mvwprintw(statwin, 21, 19, "%s", buf); if (activity > peakactivity) peakactivity = activity; if (activity_in > peakactivity_in) peakactivity_in = activity_in; if (activity_out > peakactivity_out) peakactivity_out = activity_out; if (pps > peakpps) peakpps = pps; if (pps_in > peakpps_in) peakpps_in = pps_in; if (pps_out > peakpps_out) peakpps_out = pps_out; } if (logging) { check_rotate_flag(&logfile); if ((now - startlog) >= options.logspan) { writedstatlog(iface, peakactivity, peakpps, peakactivity_in, peakpps_in, peakactivity_out, peakpps_out, &ifcounts, time(NULL) - statbegin, logfile); startlog = now; } } if (screen_update_needed(&tv, &updtime)) { printdetails(&ifcounts, statwin); update_panels(); doupdate(); updtime = tv; } if ((facilitytime != 0) && (((now - statbegin) / 60) >= facilitytime)) exitloop = 1; if (packet_get(fd, &pkt, &ch, statwin) == -1) { write_error("Packet receive failed"); exitloop = 1; break; } switch (ch) { case ERR: /* no key ready, do nothing */ break; case 12: case 'l': case 'L': tx_refresh_screen(); break; case 'Q': case 'q': case 'X': case 'x': case 24: case 27: exitloop = 1; break; } if (pkt.pkt_len <= 0) continue; int outgoing; pkt_result = packet_process(&pkt, NULL, NULL, NULL, MATCH_OPPOSITE_USECONFIG, options.v6inv4asv6); if (pkt_result != PACKET_OK && pkt_result != MORE_FRAGMENTS) continue; outgoing = (pkt.pkt_pkttype == PACKET_OUTGOING); update_proto_counter(&ifcounts.total, outgoing, pkt.pkt_len); if (pkt.pkt_pkttype == PACKET_BROADCAST) { update_pkt_counter(&ifcounts.bcast, pkt.pkt_len); } update_proto_counter(&span, outgoing, pkt.pkt_len); /* account network layer protocol */ switch(pkt.pkt_protocol) { case ETH_P_IP: if (pkt_result == CHECKSUM_ERROR) { update_pkt_counter(&ifcounts.bad, pkt.pkt_len); continue; } iplen = ntohs(pkt.iphdr->tot_len); update_proto_counter(&ifcounts.ipv4, outgoing, iplen); break; case ETH_P_IPV6: iplen = ntohs(pkt.ip6_hdr->ip6_plen) + 40; update_proto_counter(&ifcounts.ipv6, outgoing, iplen); break; default: update_proto_counter(&ifcounts.nonip, outgoing, iplen); continue; } __u8 ip_protocol = pkt_ip_protocol(&pkt); /* account transport layer protocol */ switch (ip_protocol) { case IPPROTO_TCP: update_proto_counter(&ifcounts.tcp, outgoing, iplen); break; case IPPROTO_UDP: update_proto_counter(&ifcounts.udp, outgoing, iplen); break; case IPPROTO_ICMP: case IPPROTO_ICMPV6: update_proto_counter(&ifcounts.icmp, outgoing, iplen); break; default: update_proto_counter(&ifcounts.other, outgoing, iplen); break; } } err_close: close(fd); err: rate_destroy(&pps_rate_out); rate_destroy(&pps_rate_in); rate_destroy(&pps_rate); rate_destroy(&rate_out); rate_destroy(&rate_in); rate_destroy(&rate); if (options.promisc) { promisc_restore_list(&promisc); promisc_destroy(&promisc); } if (logging) { signal(SIGUSR1, SIG_DFL); writedstatlog(iface, peakactivity, peakpps, peakactivity_in, peakpps_in, peakactivity_out, peakpps_out, &ifcounts, time(NULL) - statbegin, logfile); writelog(logging, logfile, "******** Detailed interface statistics stopped ********"); fclose(logfile); } del_panel(statpanel); delwin(statwin); strcpy(current_logfile, ""); pkt_cleanup(); update_panels(); doupdate(); }
void hostmon(const struct OPTIONS *options, time_t facilitytime, char *ifptr, struct filterstate *ofilter) { int logging = options->logging; struct ethtab table; struct ethtabent *entry; char scratch_saddr[ETH_ALEN]; char scratch_daddr[ETH_ALEN]; unsigned int idx = 1; int is_ip; int ch; char *ifname = ifptr; struct timeval tv; time_t starttime; time_t now = 0; unsigned long long unow = 0; time_t statbegin = 0; time_t startlog = 0; time_t updtime = 0; unsigned long long updtime_usec = 0; struct eth_desc *list = NULL; FILE *logfile = NULL; int pkt_result; WINDOW *sortwin; PANEL *sortpanel; int keymode = 0; int instance_id; int fd; struct promisc_states *promisc_list; if (!facility_active(LANMONIDFILE, ifptr)) mark_facility(LANMONIDFILE, "LAN monitor", ifptr); else { write_error("LAN station monitor already running on %s", gen_iface_msg(ifptr)); return; } if (ifptr != NULL) { if (!dev_up(ifptr)) { err_iface_down(); unmark_facility(LANMONIDFILE, ifptr); return; } } if ((first_active_facility()) && (options->promisc)) { init_promisc_list(&promisc_list); save_promisc_list(promisc_list); srpromisc(1, promisc_list); destroy_promisc_list(&promisc_list); } adjust_instance_count(PROCCOUNTFILE, 1); instance_id = adjust_instance_count(LANMONCOUNTFILE, 1); hostmonhelp(); initethtab(&table, options->actmode); /* Ethernet description list */ struct eth_desc *elist = load_eth_desc(ARPHRD_ETHER); /* FDDI description list */ struct eth_desc *flist = load_eth_desc(ARPHRD_FDDI); if (logging) { if (strcmp(current_logfile, "") == 0) { strncpy(current_logfile, gen_instance_logname(LANLOG, instance_id), 80); if (!daemonized) input_logfile(current_logfile, &logging); } } if (logging) { opentlog(&logfile, current_logfile); if (logfile == NULL) logging = 0; } if (logging) { signal(SIGUSR1, rotate_lanlog); rotate_flag = 0; writelog(logging, logfile, "******** LAN traffic monitor started ********"); } leaveok(table.tabwin, TRUE); fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if(fd == -1) { write_error("Unable to obtain monitoring socket"); goto err; } if(ifptr && dev_bind_ifname(fd, ifptr) == -1) { write_error("Unable to bind interface on the socket"); goto err_close; } exitloop = 0; gettimeofday(&tv, NULL); starttime = statbegin = startlog = tv.tv_sec; PACKET_INIT(pkt); do { gettimeofday(&tv, NULL); now = tv.tv_sec; unow = tv.tv_sec * 1000000ULL + tv.tv_usec; if ((now - starttime) >= 5) { printelapsedtime(statbegin, now, LINES - 3, 15, table.borderwin); updateethrates(&table, options->actmode, starttime, now, idx); starttime = now; } if (logging) { check_rotate_flag(&logfile); if ((now - startlog) >= options->logspan) { writeethlog(table.head, options->actmode, now - statbegin, logfile); startlog = now; } } if (((options->updrate != 0) && (now - updtime >= options->updrate)) || ((options->updrate == 0) && (unow - updtime_usec >= DEFAULT_UPDATE_DELAY))) { update_panels(); doupdate(); updtime = now; updtime_usec = unow; } if ((facilitytime != 0) && (((now - statbegin) / 60) >= facilitytime)) exitloop = 1; if (packet_get(fd, &pkt, &ch, table.tabwin) == -1) { write_error("Packet receive failed"); exitloop = 1; break; } if (ch != ERR) { if (keymode == 0) { switch (ch) { case KEY_UP: scrollethwin(&table, SCROLLDOWN, &idx); break; case KEY_DOWN: scrollethwin(&table, SCROLLUP, &idx); break; case KEY_PPAGE: case '-': pageethwin(&table, SCROLLDOWN, &idx); break; case KEY_NPAGE: case ' ': pageethwin(&table, SCROLLUP, &idx); break; case 12: case 'l': case 'L': tx_refresh_screen(); break; case 's': case 'S': show_hostsort_keywin(&sortwin, &sortpanel); keymode = 1; break; case 'q': case 'Q': case 'x': case 'X': case 27: case 24: exitloop = 1; } } else if (keymode == 1) { del_panel(sortpanel); delwin(sortwin); sort_hosttab(&table, &idx, ch); keymode = 0; } } if (pkt.pkt_len > 0) { char ifnamebuf[IFNAMSIZ]; pkt_result = packet_process(&pkt, NULL, NULL, NULL, ofilter, MATCH_OPPOSITE_USECONFIG, 0); if (pkt_result != PACKET_OK) continue; if (!ifptr) { /* we're capturing on "All interfaces", */ /* so get the name of the interface */ /* of this packet */ int r = dev_get_ifname(pkt.pkt_ifindex, ifnamebuf); if (r != 0) { write_error("Unable to get interface name"); break; /* can't get interface name, get out! */ } ifname = ifnamebuf; } /* get HW addresses */ switch (pkt.pkt_hatype) { case ARPHRD_ETHER: { struct ethhdr *hdr_eth = (struct ethhdr *)pkt.pkt_buf; memcpy(scratch_saddr, hdr_eth->h_source, ETH_ALEN); memcpy(scratch_daddr, hdr_eth->h_dest, ETH_ALEN); list = elist; break; } case ARPHRD_FDDI: { struct fddihdr *hdr_fddi = (struct fddihdr *)pkt.pkt_buf; memcpy(scratch_saddr, hdr_fddi->saddr, FDDI_K_ALEN); memcpy(scratch_daddr, hdr_fddi->daddr, FDDI_K_ALEN); list = flist; break; } case ARPHRD_IEEE802: case ARPHRD_IEEE802_TR: { struct trh_hdr *hdr_trh = (struct trh_hdr *)pkt.pkt_buf; memcpy(scratch_saddr, hdr_trh->saddr, TR_ALEN); memcpy(scratch_daddr, hdr_trh->daddr, TR_ALEN); list = flist; break; } default: /* unknown link protocol */ continue; } switch(pkt.pkt_protocol) { case ETH_P_IP: case ETH_P_IPV6: is_ip = 1; break; default: is_ip = 0; break; } /* Check source address entry */ entry = in_ethtable(&table, pkt.pkt_hatype, scratch_saddr); if (!entry) entry = addethentry(&table, pkt.pkt_hatype, ifname, scratch_saddr, list); if (entry != NULL) { updateethent(entry, pkt.pkt_len, is_ip, 1); if (!entry->prev_entry->un.desc.printed) printethent(&table, entry->prev_entry, idx); printethent(&table, entry, idx); } /* Check destination address entry */ entry = in_ethtable(&table, pkt.pkt_hatype, scratch_daddr); if (!entry) entry = addethentry(&table, pkt.pkt_hatype, ifname, scratch_daddr, list); if (entry != NULL) { updateethent(entry, pkt.pkt_len, is_ip, 0); if (!entry->prev_entry->un.desc.printed) printethent(&table, entry->prev_entry, idx); printethent(&table, entry, idx); } } } while (!exitloop); err_close: close(fd); err: if ((options->promisc) && (is_last_instance())) { load_promisc_list(&promisc_list); srpromisc(0, promisc_list); destroy_promisc_list(&promisc_list); } adjust_instance_count(PROCCOUNTFILE, -1); adjust_instance_count(LANMONCOUNTFILE, -1); if (logging) { signal(SIGUSR1, SIG_DFL); writeethlog(table.head, options->actmode, time(NULL) - statbegin, logfile); writelog(logging, logfile, "******** LAN traffic monitor stopped ********"); fclose(logfile); } del_panel(table.tabpanel); delwin(table.tabwin); del_panel(table.borderpanel); delwin(table.borderwin); update_panels(); doupdate(); destroyethtab(&table); free_eth_desc(elist); free_eth_desc(flist); unmark_facility(LANMONIDFILE, ifptr); strcpy(current_logfile, ""); }
void packet_size_breakdown(struct OPTIONS *options, char *ifname, int facilitytime, struct filterstate *ofilter) { WINDOW *win; PANEL *panel; WINDOW *borderwin; PANEL *borderpanel; struct ifstat_brackets brackets[20]; unsigned int interval; int ch; int fd; char buf[MAX_PACKET_SIZE]; int br; char *ipacket; char iface[10]; unsigned int mtu; struct sockaddr_ll fromaddr; unsigned short linktype; int pkt_result; struct timeval tv; unsigned long starttime, startlog, timeint; unsigned long now; unsigned long long unow; unsigned long updtime = 0; unsigned long long updtime_usec = 0; int logging = options->logging; FILE *logfile = NULL; struct promisc_states *promisc_list; char msgstring[80]; if (!facility_active(PKTSIZEIDFILE, ifname)) mark_facility(PKTSIZEIDFILE, "Packet size breakdown", ifname); else { snprintf(msgstring, 80, "Packet sizes already being monitored on %s", ifname); write_error(msgstring, daemonized); return; } if (!iface_supported(ifname)) { err_iface_unsupported(); unmark_facility(PKTSIZEIDFILE, ifname); return; } if (!iface_up(ifname)) { err_iface_down(); unmark_facility(PKTSIZEIDFILE, ifname); return; } borderwin = newwin(LINES - 2, COLS, 1, 0); borderpanel = new_panel(borderwin); wattrset(borderwin, BOXATTR); tx_box(borderwin, ACS_VLINE, ACS_HLINE); mvwprintw(borderwin, 0, 1, " Packet Distribution by Size "); win = newwin(LINES - 4, COLS - 2, 2, 1); panel = new_panel(win); tx_stdwinset(win); wtimeout(win, -1); wattrset(win, STDATTR); tx_colorwin(win); move(LINES - 1, 1); stdexitkeyhelp(); initialize_brackets(ifname, brackets, &interval, &mtu, win); mvwprintw(win, 1, 1, "Packet size brackets for interface %s", ifname); wattrset(win, BOXATTR); mvwprintw(win, 4, 1, "Packet Size (bytes)"); mvwprintw(win, 4, 26, "Count"); mvwprintw(win, 4, 36, "Packet Size (bytes)"); mvwprintw(win, 4, 60, "Count"); wattrset(win, HIGHATTR); if (logging) { if (strcmp(current_logfile, "") == 0) { snprintf(current_logfile, 80, "%s-%s.log", PKTSIZELOG, ifname); if (!daemonized) input_logfile(current_logfile, &logging); } } if (logging) { opentlog(&logfile, current_logfile); if (logfile == NULL) logging = 0; } if (logging) signal(SIGUSR1, rotate_size_log); writelog(logging, logfile, "******** Packet size distribution facility started ********"); exitloop = 0; gettimeofday(&tv, NULL); starttime = startlog = timeint = tv.tv_sec; open_socket(&fd); if (fd < 0) { unmark_facility(PKTSIZEIDFILE, ifname); return; } if ((first_active_facility()) && (options->promisc)) { init_promisc_list(&promisc_list); save_promisc_list(promisc_list); srpromisc(1, promisc_list); destroy_promisc_list(&promisc_list); } adjust_instance_count(PROCCOUNTFILE, 1); active_facility_countfile[0] = '\0'; do { gettimeofday(&tv, NULL); now = tv.tv_sec; unow = tv.tv_sec * 1e+6 + tv.tv_usec; if (((options->updrate != 0) && (now - updtime >= options->updrate)) || ((options->updrate == 0) && (unow - updtime_usec >= DEFAULT_UPDATE_DELAY))) { update_panels(); doupdate(); updtime = now; updtime_usec = unow; } if (now - timeint >= 5) { printelapsedtime(starttime, now, LINES - 3, 1, borderwin); timeint = now; } if ((now - startlog >= options->logspan) && (logging)) { write_size_log(brackets, now - starttime, ifname, mtu, logfile); startlog = now; } check_rotate_flag(&logfile, logging); if ((facilitytime != 0) && (((now - starttime) / 60) >= facilitytime)) exitloop = 1; getpacket(fd, buf, &fromaddr, &ch, &br, iface, win); if (ch != ERR) { switch (ch) { case 12: case 'l': case 'L': tx_refresh_screen(); break; case 'x': case 'X': case 'q': case 'Q': case 27: case 24: exitloop = 1; } } if (br > 0) { pkt_result = processpacket(buf, &ipacket, &br, NULL, NULL, NULL, &fromaddr, &linktype, ofilter, MATCH_OPPOSITE_USECONFIG, iface, ifname); if (pkt_result != PACKET_OK) continue; update_size_distrib(br, brackets, interval, win); } } while (!exitloop); if (logging) { signal(SIGUSR1, SIG_DFL); write_size_log(brackets, now - starttime, ifname, mtu, logfile); writelog(logging, logfile, "******** Packet size distribution facility stopped ********"); fclose(logfile); } close(fd); if ((options->promisc) && (is_last_instance())) { load_promisc_list(&promisc_list); srpromisc(0, promisc_list); destroy_promisc_list(&promisc_list); } adjust_instance_count(PROCCOUNTFILE, -1); del_panel(panel); delwin(win); del_panel(borderpanel); delwin(borderwin); unmark_facility(PKTSIZEIDFILE, ifname); strcpy(current_logfile, ""); }