2 * Reports capture file information including # of packets, duration, others
4 * Copyright 2004 Ian Schorr
8 * Wireshark - Network traffic analyzer
9 * By Gerald Combs <gerald@wireshark.org>
10 * Copyright 1998 Gerald Combs
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version 2
15 * of the License, or (at your option) any later version.
17 * This program is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, write to the Free Software
24 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
41 #ifdef HAVE_SYS_TIME_H
47 #include <epan/packet.h>
48 #include <epan/filesystem.h>
49 #include <epan/plugins.h>
50 #include <epan/report_err.h>
52 #include <wsutil/privileges.h>
58 static gboolean cap_file_type = FALSE; /* Do not report capture type */
59 static gboolean cap_file_encap = FALSE; /* Do not report encapsulation */
60 static gboolean cap_packet_count = FALSE; /* Do not produce packet count */
61 static gboolean cap_file_size = FALSE; /* Do not report file size */
62 static gboolean cap_data_size = FALSE; /* Do not report packet byte size */
63 static gboolean cap_duration = FALSE; /* Do not report capture duration */
64 static gboolean cap_start_time = FALSE;
65 static gboolean cap_end_time = FALSE;
67 static gboolean cap_data_rate_byte = FALSE;
68 static gboolean cap_data_rate_bit = FALSE;
69 static gboolean cap_packet_size = FALSE;
70 static gboolean cap_packet_rate = FALSE;
73 typedef struct _capture_info {
90 double data_rate; /* in bytes */
94 secs_nsecs(const struct wtap_nstime * nstime)
96 return (nstime->nsecs / 1000000000.0) + (double)nstime->secs;
99 static void print_value(gchar *text_p1, gint width, gchar *text_p2, double value) {
101 printf("%s%.*f%s\n", text_p1, width, value, text_p2);
103 printf("%sn/a\n", text_p1);
107 print_stats(capture_info *cf_info)
109 const gchar *file_type_string, *file_encap_string;
113 /* Build printable strings for various stats */
114 file_type_string = wtap_file_type_string(cf_info->file_type);
115 file_encap_string = wtap_encap_string(cf_info->file_encap);
116 start_time_t = (time_t)cf_info->start_time;
117 stop_time_t = (time_t)cf_info->stop_time;
119 if (cap_file_type) printf ("File type: %s\n", file_type_string);
120 if (cap_file_encap) printf ("File encapsulation: %s\n", file_encap_string);
121 if (cap_packet_count) printf ("Number of packets: %u\n", cf_info->packet_count);
122 if (cap_file_size) printf ("File size: %" G_GINT64_MODIFIER "d bytes\n", cf_info->filesize);
123 if (cap_data_size) printf ("Data size: %" G_GINT64_MODIFIER "u bytes\n", cf_info->packet_bytes);
124 if (cap_duration) print_value("Capture duration: ", 0, " seconds", cf_info->duration);
125 if (cap_start_time) printf ("Start time: %s", (cf_info->packet_count>0) ? ctime (&start_time_t) : "n/a\n");
126 if (cap_end_time) printf ("End time: %s", (cf_info->packet_count>0) ? ctime (&stop_time_t) : "n/a\n");
127 if (cap_data_rate_byte) print_value("Data byte rate: ", 2, " bytes/sec", cf_info->data_rate);
128 if (cap_data_rate_bit) print_value("Data bit rate: ", 2, " bits/sec", cf_info->data_rate*8);
129 if (cap_packet_size) printf ("Average packet size: %.2f bytes\n", cf_info->packet_size);
130 if (cap_packet_rate) print_value("Average packet rate: ", 2, " packets/sec", cf_info->packet_rate);
134 process_cap_file(wtap *wth, const char *filename)
143 const struct wtap_pkthdr *phdr;
144 capture_info cf_info;
145 double start_time = 0;
146 double stop_time = 0;
149 /* Tally up data that we need to parse through the file to find */
150 while (wtap_read(wth, &err, &err_info, &data_offset)) {
151 phdr = wtap_phdr(wth);
152 cur_time = secs_nsecs(&phdr->ts);
154 start_time = cur_time;
155 stop_time = cur_time;
157 if (cur_time < start_time) {
158 start_time = cur_time;
160 if (cur_time > stop_time) {
161 stop_time = cur_time;
169 "capinfos: An error occurred after reading %u packets from \"%s\": %s.\n",
170 packet, filename, wtap_strerror(err));
173 case WTAP_ERR_UNSUPPORTED:
174 case WTAP_ERR_UNSUPPORTED_ENCAP:
175 case WTAP_ERR_BAD_RECORD:
176 fprintf(stderr, "(%s)\n", err_info);
184 size = wtap_file_size(wth, &err);
187 "capinfos: Can't get size of \"%s\": %s.\n",
188 filename, strerror(err));
192 cf_info.filesize = size;
195 cf_info.file_type = wtap_file_type(wth);
197 /* File Encapsulation */
198 cf_info.file_encap = wtap_file_encap(wth);
201 cf_info.packet_count = packet;
204 cf_info.start_time = start_time;
205 cf_info.stop_time = stop_time;
206 cf_info.duration = stop_time-start_time;
208 /* Number of packet bytes */
209 cf_info.packet_bytes = bytes;
211 cf_info.data_rate = 0.0;
212 cf_info.packet_rate = 0.0;
213 cf_info.packet_size = 0.0;
216 if (cf_info.duration > 0.0) {
217 cf_info.data_rate = (double)bytes / (stop_time-start_time); /* Data rate per second */
218 cf_info.packet_rate = (double)packet / (stop_time-start_time); /* packet rate per second */
220 cf_info.packet_size = (double)bytes / packet; /* Avg packet size */
223 printf("File name: %s\n", filename);
224 print_stats(&cf_info);
230 usage(gboolean is_error)
236 /* XXX - add capinfos header info here */
242 fprintf(output, "Capinfos %s"
244 " (" SVNVERSION " from " SVNPATH ")"
247 fprintf(output, "Prints information about capture files.\n");
248 fprintf(output, "See http://www.wireshark.org for more information.\n");
249 fprintf(output, "\n");
250 fprintf(output, "Usage: capinfos [options] <infile> ...\n");
251 fprintf(output, "\n");
252 fprintf(output, "General:\n");
253 fprintf(output, " -t display the capture file type\n");
254 fprintf(output, " -E display the capture file encapsulation\n");
255 fprintf(output, "\n");
256 fprintf(output, "Size:\n");
257 fprintf(output, " -c display the number of packets\n");
258 fprintf(output, " -s display the size of the file (in bytes)\n");
259 fprintf(output, " -d display the total length of all packets (in bytes)\n");
260 fprintf(output, "\n");
261 fprintf(output, "Time:\n");
262 fprintf(output, " -u display the capture duration (in seconds)\n");
263 fprintf(output, " -a display the capture start time\n");
264 fprintf(output, " -e display the capture end time\n");
265 fprintf(output, "\n");
266 fprintf(output, "Statistic:\n");
267 fprintf(output, " -y display average data rate (in bytes/sec)\n");
268 fprintf(output, " -i display average data rate (in bits/sec)\n");
269 fprintf(output, " -z display average packet size (in bytes)\n");
270 fprintf(output, " -x display average packet rate (in packets/sec)\n");
271 fprintf(output, "\n");
272 fprintf(output, "Miscellaneous:\n");
273 fprintf(output, " -h display this help and exit\n");
274 fprintf(output, "\n");
275 fprintf(output, "If no options are given the default is to display all infos\n");
280 * Don't report failures to load plugins because most (non-wiretap) plugins
281 * *should* fail to load (because we're not linked against libwireshark and
282 * dissector plugins need libwireshark).
285 failure_message(const char *msg_format _U_, va_list ap _U_)
293 main(int argc, char *argv[])
302 char* init_progfile_dir_error;
306 * Get credential information for later use.
308 get_credential_info();
311 /* Register wiretap plugins */
313 if ((init_progfile_dir_error = init_progfile_dir(argv[0], main))) {
314 g_warning("capinfos: init_progfile_dir(): %s", init_progfile_dir_error);
315 g_free(init_progfile_dir_error);
317 init_report_err(failure_message,NULL,NULL,NULL);
322 /* Process the options */
324 while ((opt = getopt(argc, argv, "tEcsduaeyizvhx")) !=-1) {
329 cap_file_type = TRUE;
333 cap_file_encap = TRUE;
337 cap_packet_count = TRUE;
341 cap_file_size = TRUE;
345 cap_data_size = TRUE;
353 cap_start_time = TRUE;
361 cap_data_rate_byte = TRUE;
365 cap_data_rate_bit = TRUE;
369 cap_packet_size = TRUE;
373 cap_packet_rate = TRUE;
381 case '?': /* Bad flag - print usage message */
390 /* If no arguments were given, by default display all statistics */
391 cap_file_type = TRUE;
392 cap_file_encap = TRUE;
393 cap_packet_count = TRUE;
394 cap_file_size = TRUE;
395 cap_data_size = TRUE;
397 cap_start_time = TRUE;
400 cap_data_rate_byte = TRUE;
401 cap_data_rate_bit = TRUE;
402 cap_packet_size = TRUE;
403 cap_packet_rate = TRUE;
406 if ((argc - optind) < 1) {
411 for (opt = optind; opt < argc; opt++) {
413 wth = wtap_open_offline(argv[opt], &err, &err_info, FALSE);
416 fprintf(stderr, "capinfos: Can't open %s: %s\n", argv[opt],
420 case WTAP_ERR_UNSUPPORTED:
421 case WTAP_ERR_UNSUPPORTED_ENCAP:
422 case WTAP_ERR_BAD_RECORD:
423 fprintf(stderr, "(%s)\n", err_info);
432 status = process_cap_file(wth, argv[opt]);