Component index
Section index

Component tcpdump


Search

	/*
	    Using the class TCPINFO, we see how we can attach a TCPINFO object
	    to a TCP session to collect per-session information. In this case
	    we are counting the eol characters sent/received.
	*/
	
	class TCPINFO: public ARRAY_OBJ{
	public:
	    int nbrec;
	    int nbsent;
	    TCPINFO(){
	        nbrec = 0;
	        nbsent = 0;
	    }
	};
	<mod>
	static void sample_countlines(const char *device,const char *filter)
	{
	    <call tcpdump>(device,filter);
	    <f newsession>
	        data = new TCPINFO;
	    </f>
	    <f endsession>
	        TCPINFO *info = (TCPINFO*)data;
	        printf ("endsession: %08x:%u -> %08x:%u -- newlines: received %d sent %d\n"
	            ,session.saddr,session.sport
	            ,session.daddr,session.dport
	            ,info->nbrec,info->nbsent);
	    </f>
	    <f packet>
	        TCPINFO *info = (TCPINFO*)data;
	        const char *pt = (const char*)packet;
	        int nl = 0;
	        for (int i=0; i<len; i++){
	            if (pt[i] == '\n') nl++;
	        }
	        if (from){
	            info->nbsent += nl;
	        }else{
	            info->nbrec += nl;
	        }
	    </f>
	    </call>
	}
	</mod>