循序渐进学习使用WINPCAP（九）

收集统计网络流量

这一章将展示WinPcap的另一项高级功能：收集网络流量的统计信息。WinPcap的统计引擎在内核层级上对到来的数据进行分类。如果你想了解更多的细节请，可以查看NPF驱动指南。

为了利用这个功能来监视网络，程序必须打开一个适配器并用pcap_setmode()将其设置为统计模式。注意pcap_setmode()要用MODE_STAT来将网卡设置为统计模式。

在统计模式下，编写一个程序来监测TCP流量只是几行代码的事情。下面的例子说明了如何来实现该功能。

/* * Copyright (c) 1999 - 2005 NetGroup, Politecnico di Torino (Italy) * Copyright (c) 2005 - 2006 CACE Technologies, Davis (California) * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. Neither the name of the Politecnico di Torino, CACE Technologies * nor the names of its contributors may be used to endorse or promote * products derived from this software without specific prior written * permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * */#include <stdlib.h>#include <stdio.h>#include <pcap.h>void usage();void dispatcher_handler(u_char *, const struct pcap_pkthdr *, const u_char *);void main(int argc, char **argv){pcap_t *fp;char errbuf[PCAP_ERRBUF_SIZE];struct timeval st_ts;u_int netmask;struct bpf_program fcode; /* Check the validity of the command line */ if (argc != 2) { usage(); return; } /* Open the output adapter */ if ( (fp= pcap_open(argv[1], 100, PCAP_OPENFLAG_PROMISCUOUS, 1000, NULL, errbuf) ) == NULL) { fprintf(stderr,"/nUnable to open adapter %s./n", errbuf); return; } /* Don't care about netmask, it won't be used for this filter */ netmask=0xffffff; /* compile the filter */ if (pcap_compile(fp, &fcode, "tcp", 1, netmask) <0 ) { fprintf(stderr,"/nUnable to compile the packet filter. Check the syntax./n"); /* Free the device list */ return; } /* set the filter */ if (pcap_setfilter(fp, &fcode)<0) { fprintf(stderr,"/nError setting the filter./n"); pcap_close(fp); /* Free the device list */ return; } /* 将网卡设置为统计模式 */ if (pcap_setmode(fp, MODE_STAT)<0) { fprintf(stderr,"/nError setting the mode./n"); pcap_close(fp); /* Free the device list */ return; } printf("TCP traffic summary:/n"); /* Start the main loop */ pcap_loop(fp, 0, dispatcher_handler, (PUCHAR)&st_ts); pcap_close(fp); return;}void dispatcher_handler(u_char *state, const struct pcap_pkthdr *header, const u_char *pkt_data){ struct timeval *old_ts = (struct timeval *)state; u_int delay; LARGE_INTEGER Bps,Pps; struct tm ltime; char timestr[16]; time_t local_tv_sec; /* 从最近一次的采用开始以微妙计算延迟时间 */ /* This value is obtained from the timestamp that the associated with the sample. */ delay=(header->ts.tv_sec - old_ts->tv_sec) * 1000000 - old_ts->tv_usec + header->ts.tv_usec; /* 获得每秒的比特数 */ Bps.QuadPart=(((*(LONGLONG*)(pkt_data + 8)) * 8 * 1000000) / (delay)); /* ^ ^ | | | | | | converts bytes in bits --- | | | delay is expressed in microseconds ------| */ /* 获得每秒的数据报数 */ Pps.QuadPart=(((*(LONGLONG*)(pkt_data)) * 1000000) / (delay)); /* 将时间戳转变为可读的标准格式 */ local_tv_sec = header->ts.tv_sec; localtime_s(<ime, &local_tv_sec); strftime( timestr, sizeof timestr, "%H:%M:%S", <ime); /* Print timestamp*/ printf("%s ", timestr); /* Print the samples */ printf("BPS=%I64u ", Bps.QuadPart); printf("PPS=%I64u/n", Pps.QuadPart); //store current timestamp old_ts->tv_sec=header->ts.tv_sec; old_ts->tv_usec=header->ts.tv_usec;}void usage(){ printf("/nShows the TCP traffic load, in bits per second and packets per second./nCopyright (C) 2002 Loris Degioanni./n"); printf("/nUsage:/n"); printf("/t tcptop adapter/n"); printf("/t You can use /"WinDump -D/" if you don't know the name of your adapters./n"); exit(0);}

在设置为统计模式之前，用户可以选择设置一个过滤器来指定要监测的网络流量的子集。细节可见过滤器表达式语法一节。如果没有设置过滤器，所有的流量都将被监测。

一旦：

1. 过滤器被设置
2. pcap_setmode()被调用
3. 用pcap_loop()循环调用

网卡的描述者开始在统计模式下工作。需要指出的是pcap_open()的第四个参数（to_ms）：它定义了采样的间隔。回调函数每隔一定的时间就获取一次采样统计。这些采样被封装入回调函数的第二和第三个参数，如下图所示：

两个64位的计数器分别记录最近一次间隔数据报数量和字节数量。

本例子中，网卡打开时设置超时为1000 ms。也就是说dispatcher_handler()每隔1秒就会被调用一次。此时，过滤器也被编译并设置为只接受TCP包。然后pcap_setmode()和pcap_loop()被调用。注意一个指向timeval结构的指针作为用户参数被传递给pcap_loop()。这个结构将用来存储一个时间戳以计算两次采样的时间间隔。dispatch_handler()用这个时间间隔得到每秒的比特数和数据报数，并且将这两个数据打印在屏幕上。

最后指出的是目前的这个例子是比任何一个利用传统方法捕获包并在用户层进行统计的程序都高效。统计模式需要最小数量的数据拷贝和上下文切换，因此CPU的利用达到最优。另外，内存也只需很少一部分。

附原文：

This lesson shows another advanced feature of WinPcap: the ability to collect statistics about network traffic. The statistical engine makes use of the kernel-level packet filter to efficiently classify the incoming packet. You can take a look at the NPF driver internals manual if you want to know more details.

In order to use this feature, the programmer must open an adapter and put it in statistical mode. This can be done with pcap_setmode(). In particular, MODE_STAT must be used as the mode argument of this function.

With statistical mode, making an application that monitors the TCP traffic load is a matter of few lines of code. The following sample shows how to do it.

/* codes */

Before enabling statistical mode, the user has the option to set a filter that defines the subset of network traffic that will be monitored. See the paragraph on the Filtering expression syntax for details. If no filter has been set, all of the traffic will be monitored.

Once

1. the filter is set
2. pcap_setmode() is called
3. callback invocation is enabled with pcap_loop()

the interface descriptor starts to work in statistical mode. Notice the fourth parameter (to_ms) of pcap_open(): it defines the interval among the statistical samples. The callback function receives the samples calculated by the driver every to_ms milliseconds. These samples are encapsulated in the second and third parameters of the callback function, as shown in the following figure:

figure is above

Two 64-bit counters are provided: the number of packets and the amount of bytes received during the last interval.

In the example, the adapter is opened with a timeout of 1000 ms. This means that dispatcher_handler() is called once per second. At this point a filter that keeps only tcp packets is compiled and set. Then pcap_setmode() and pcap_loop() are called. Note that a struct timeval pointer is passed to pcap_loop() as the user parameter. This structure will be used to store a timestamp in order to calculate the interval between two samples. dispatcher_handler()uses this interval to obtain the bits per second and the packets per second and then prints these values on the screen.

Note finally that this example is by far more efficient than a program that captures the packets in the traditional way and calculates statistics at user-level. Statistical mode requires the minumum amount of data copies and context switches and therefore the CPU is optimized. Moreover, a very small amount of memory is required.

#end