udp流检测统计

3590阅读　1评论2013-03-20　zooyo
分类：LINUX


  1. #include <stdio.h>
  2. #include <pcap.h>
  3. #include <stdlib.h>
  4. #include <time.h>
  5. #include <getopt.h>
  6. #include <linux/if_ether.h>
  7. #include <linux/ip.h>
  8. #include <linux/udp.h>
  9. #include <netinet/in.h>
  10. #include <arpa/inet.h>
  11. #include <string.h>


  14. #define MIN_LEN    (sizeof(struct ethhdr) + sizeof(struct iphdr) + sizeof(struct udphdr))

  16. #ifdef DEBUG
  17.     #define DEBUGP(format,args...) fprintf(stdout, format, ##args)
  18. #else
  19.     #define DEBUGP(format,args...)
  20. #endif

  22. #define HASHSIZE    (1024 * 1024 * 2)
  23. #define HASH_KEY(ip1, ip2, ports, initval)    jhash_3words(ip1, ip2, ports, initval) % HASHSIZE

  25. /* swap - swap value of @a and @b */
  26. #define swap(a, b) \
  27.     do { typeof(a) __tmp = (a); (a) = (b); (b) = __tmp; } while (0)

  29. #define __jhash_mix(a, b, c) { \
  30.      a -= b; a -= c; a ^= (c>>13); \
  31.      b -= c; b -= a; b ^= (a<<8); \
  32.      c -= a; c -= b; c ^= (b>>13); \
  33.      a -= b; a -= c; a ^= (c>>12); \
  34.      b -= c; b -= a; b ^= (a<<16); \
  35.      c -= a; c -= b; c ^= (b>>5); \
  36.      a -= b; a -= c; a ^= (c>>3);    \
  37.      b -= c; b -= a; b ^= (a<<10); \
  38.      c -= a; c -= b; c ^= (b>>15); \
  39. }
  40.     
  41. /* The golden ration: an arbitrary value */
  42. #define JHASH_GOLDEN_RATIO    0x9e3779b9

  44. static struct option opts[] = {
  45.     {.name = "start",    .has_arg = 1, .val = 's'},
  46.     {.name = "end",    .has_arg = 1, .val = 'e'},
  47.     {.name = "file",    .has_arg = 1, .val = 'f'},
  48.     {.name = "help",    .has_arg = 0, .val = 'h'},
  49.     {NULL}
  50. };

  52. enum udpflow_dir{
  53.     UDPFLOW_ORG = 0,
  54.     UDPFLOW_REPLY,
  55.     UDPFLOW_MAX
  56. };

  58. struct udp_tuple{
  59.     u_int32_t src;
  60.     u_int32_t dst;
  61.     u_int16_t sport;
  62.     u_int16_t dport;
  63. };

  65. struct udp_counter{
  66.     u_int64_t bytes;
  67.     u_int32_t packet;
  68.     u_int32_t total;
  69. };

  71. typedef struct _udpflow{
  72.     struct udp_tuple tuple;
  73.     struct udp_counter counter[UDPFLOW_MAX];
  74.     time_t start;
  75.     time_t end;
  76.     struct _udpflow *next;
  77. }udpflow;


  80. static int s = 1, e = 0;
  81. static udpflow *hash_t[HASHSIZE];
  82. static u_int32_t initval;

  84. static inline u_int32_t jhash_3words(u_int32_t a,
  85.                                      u_int32_t b,
  86.                                      u_int32_t c,
  87.                                      u_int32_t initval) {
  88.     a += JHASH_GOLDEN_RATIO;
  89.     b += JHASH_GOLDEN_RATIO;
  90.     c += initval;

  92.     __jhash_mix(a, b, c);

  94.     return c;
  95. }

  97. static void print_help(void) {
  98.     printf("-h Print this help\n");
  99.     printf("-s Began to capture in which package\n");
  100.     printf("-e End capture in which package\n");
  101.     printf("-f Captured packets\n");
  102.     exit(-1);
  103. }

  105. static char* trans_time(time_t sec) {
  106.     static char buf[32];
  107.     struct tm *date;
  108.     date = localtime(&sec);
  109.     strftime(buf, 64, "%Y-%m-%d %H:%M:%S", date);
  110.     return buf;
  111. }

  113. static u_int32_t hash_udpflow(struct udp_tuple *tuple) {
  114.     union {
  115.         u_int32_t v32;
  116.         u_int16_t v16[2];
  117.     }ports;    
  118.     u_int32_t hash, sip, tip;

  120.     sip = tuple->src;
  121.     tip = tuple->dst;
  122.     ports.v16[0] = tuple->sport;
  123.     ports.v16[1] = tuple->dport;

  125.     /*
  126.      无论是请求数据还是应答数据都排序后送去哈希
  127.      这样使得同一个流的哈希结果是一样
  128.     */
  129.     if(sip < tip)    swap(sip, tip);
  130.     if(ports.v16[0] < ports.v16[1])    swap(ports.v16[0], ports.v16[1]);
  131.     hash = HASH_KEY(sip, tip, ports.v32, initval);
  132.     
  133.     return hash;        
  134. }

  136. static udpflow *lookup(struct udp_tuple *tuple, u_int32_t hash, int *dir) {
  137.     udpflow *pNode = hash_t[hash];
  138.     while(pNode != NULL) {
  139.         /*
  140.         遍历链表的每个节点, 如果查询到统一方向是请求数据
  141.         反方向是应答数据, 第一个数据包就确认为请求包
  142.         */
  143.         if(pNode->tuple.src == tuple->src
  144.             && pNode->tuple.dst == tuple->dst
  145.             && pNode->tuple.sport == tuple->sport
  146.             && pNode->tuple.dport == tuple->dport) {
  147.             *dir = UDPFLOW_ORG;
  148.             return pNode;
  149.         }
  150.         if(pNode->tuple.src == tuple->dst
  151.             && pNode->tuple.dst == tuple->src
  152.             && pNode->tuple.sport == tuple->dport
  153.             && pNode->tuple.dport == tuple->sport) {
  154.             *dir = UDPFLOW_REPLY;
  155.             return pNode;
  156.         }

  158.         pNode = pNode->next;
  159.     }
  160.     return NULL;
  161. }

  163. static void insert(udpflow *udp, u_int32_t hash) {
  164.     udp->next = hash_t[hash];
  165.     hash_t[hash] = udp;
  166. }

  168. static udpflow *found_udpflow(struct udp_tuple *tuple, int *dir) {
  169.     u_int32_t hash;
  170.     udpflow *udp;

  172.     hash = hash_udpflow(tuple); //计算哈希值
  173.     udp = lookup(tuple, hash, dir); //在哈希链表中查询当前包的五元组是否已知
  174.     if(!udp){ //未找到该值则新建链表节点
  175.         udp = (udpflow *)malloc(sizeof(udpflow));
  176.         if(!udp)    return NULL;
  177.     
  178.         memset(udp, 0, sizeof(udpflow));
  179.         *dir = UDPFLOW_ORG; //新建节点为请求数据方向
  180.         udp->tuple.src = tuple->src;
  181.         udp->tuple.dst = tuple->dst;
  182.         udp->tuple.sport = tuple->sport;
  183.         udp->tuple.dport = tuple->dport;
  184.         insert(udp, hash);
  185.     }

  187.     return udp;
  188. }

  190. static void dispatcher_handler(u_char *args, //回调函数传递的参数
  191.                         const struct pcap_pkthdr *header, const u_char *pkt_data) {

  193.     struct ethhdr *ethh;
  194.     struct iphdr *iph;
  195.     struct udphdr *udph;
  196.     struct udp_tuple tuple;
  197.     udpflow *udp;
  198.     int dir;
  199.     u_int32_t count;

  201.     if(header->caplen < MIN_LEN)    return;
  202.      ethh = (struct ethhdr *)pkt_data;
  203.     //上层是IP协议继续
  204.     if(ntohs(ethh->h_proto) == 0x0800) {
  205.         pkt_data += sizeof(struct ethhdr);
  206.         iph = (struct iphdr *)pkt_data;

  208.         //udp协议继续检测
  209.         if(iph->protocol == 17) {
  210.             //跳过IP首部,这里IP首部长度取首部内的长度值
  211.             if(header->caplen > iph->ihl*4)    pkt_data += iph->ihl*4;
  212.             udph = (struct udphdr *)pkt_data;

  214.             tuple.src = iph->saddr;
  215.             tuple.dst = iph->daddr;
  216.             tuple.sport = udph->source;
  217.             tuple.dport = udph->dest;

  219.             /*
  220.             查找当前数据包是否存在于已知UDP流中
  221.             返回的指针要么为查询到的地址, 要么就是新建节点的地址
  222.             以便取出数据直接进行统计操作
  223.             */
  224.             udp = found_udpflow(&tuple, &dir);
  225.             if(!udp)    return;

  227.             udp->counter[dir].total++;
  228.             count = udp->counter[UDPFLOW_ORG].total + udp->counter[UDPFLOW_REPLY].total;
  229.             
  230.             if(count == s){
  231.                 /* 找到开始技术的位置 */
  232.                 udp->counter[dir].packet++;
  233.                 udp->counter[dir].bytes += header->caplen;
  234.                 udp->start = header->ts.tv_sec;
  235.             /* 结束位置未设置则为0, 或者计数器不超过结束位置 */
  236.             } else if(count > s && (e <= s || count <= e)) {
  237.                 udp->counter[dir].packet++;
  238.                 udp->counter[dir].bytes += header->caplen;
  239.                 udp->end = header->ts.tv_sec;
  240.             } else {
  241.                 return;
  242.             }
  243.         }
  244.     }
  245. }

  247. static int load_packet(char *pcapfile) {
  248.     pcap_t *handle;
  249.     char errbuf[PCAP_ERRBUF_SIZE];

  251.     /* 从已捕获的dump文件中读取数据包 */
  252.     if((handle = pcap_open_offline(pcapfile, errbuf)) == NULL) {
  253.         printf("open the dumpfile failed\n");
  254.         exit(3);
  255.     }

  257. #if 0
  258.     char filter_exp[] = "udp";
  259.     struct bpf_program fp;
  260.     if (pcap_compile(handle, &fp, filter_exp, 0, 0) == -1) {
  261.         fprintf(stderr, "Couldn't parse filter %s: %s\n",
  262.                 filter_exp, pcap_geterr(handle));
  263.         exit(4);
  264.     }

  266.     if (pcap_setfilter(handle, &fp) == -1) {
  267.         fprintf(stderr, "Couldn't install filter %s: %s\n",
  268.             filter_exp, pcap_geterr(handle));
  269.         exit(5);
  270.     }
  271. #endif

  273.     /* 开始循环抓包,调用packet_callback处理
  274.      跟从网卡获取数据包一样, 直到读到EOF */
  275.     pcap_loop(handle, 0, dispatcher_handler, NULL);

  277.     pcap_close(handle);

  279.     return 0;
  280. }

  282. static void print_info(void) {
  283.     int idx;
  284.     int size = HASHSIZE;
  285.     u_int64_t rpy_avg, req_avg, perc;
  286.     char src[32] = {0}, dst[32] = {0};
  287.     udpflow *p;

  289.     for(idx=0; idx<HASHSIZE; idx++) {
  290.         p = hash_t[idx];
  291.         if(!p || !p->counter[UDPFLOW_REPLY].packet)    continue;
  292.         snprintf(src, sizeof(src), "%s:%d", inet_ntoa(*((struct in_addr *)&p->tuple.src)),
  293.                 ntohs(p->tuple.sport));
  294.         snprintf(dst, sizeof(dst), "%s:%d", inet_ntoa(*((struct in_addr *)&p->tuple.dst)),
  295.                 ntohs(p->tuple.dport));
  296.         fprintf(stdout, "%-21s -> %-21s", src, dst);

  298.         fprintf(stdout, " ORG_cnt:%-4d REPLY_cnt:%-4d", p->counter[UDPFLOW_ORG].packet, p->counter[UDPFLOW_REPLY].packet);

  300.         req_avg = p->counter[UDPFLOW_ORG].bytes / p->counter[UDPFLOW_ORG].packet;
  301.         rpy_avg = p->counter[UDPFLOW_REPLY].bytes / p->counter[UDPFLOW_REPLY].packet;
  302.         perc = rpy_avg/req_avg;
  303.         fprintf(stdout, " ORG_avg:%-4lu REPLY_avg:%-4lu PERC:%-3lu SEC:%ld\n", req_avg, rpy_avg, perc, p->end-p->start);
  304.     }
  305. }

  307. main(int argc, char **argv) {
  308.     char c;
  309.     char *pcapfile = NULL;
  310.     opterr = 0;
  311.     initval = random();

  313.     if (argc < 2)    print_help();
  314.     while((c = getopt_long(argc, argv, "s:e:f:h", opts, NULL)) != -1) {
  315.         switch(c) {
  316.             case '?':
  317.                 fprintf(stderr, "bad options\n");
  318.                 exit(1);
  319.             case 's':
  320.                 s = atoi(optarg);
  321.                 break;
  322.             case 'e':
  323.                 e = atoi(optarg);
  324.                 break;
  325.             case 'f':
  326.                 pcapfile = optarg;
  327.                 break;
  328.             case 'h':
  329.                 print_help();
  330.         }
  331.     }

  333.     if(!pcapfile) {
  334.         fprintf(stderr, "Specify the captured packets\n");
  335.         exit(2);
  336.     }

  338.     load_packet(pcapfile);

  340.     print_info();
  341.     return 0;
  342. }

上一篇：循环队列的基本操作
下一篇：awk之两个文件之间的跨度查询和打印

文章评论