2 * iostat 2002 Ronnie Sahlberg
6 * Wireshark - Network traffic analyzer
7 * By Gerald Combs <gerald@wireshark.org>
8 * Copyright 1998 Gerald Combs
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version 2
13 * of the License, or (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
31 #ifdef HAVE_SYS_TYPES_H
32 # include <sys/types.h>
36 #include "epan/epan_dissect.h"
37 #include "epan/packet_info.h"
39 #include <epan/stat_cmd_args.h>
40 #include <epan/strutil.h>
43 typedef struct _io_stat_t {
44 gint64 interval; /* unit is us */
46 struct _io_stat_item_t *items;
50 #define CALC_TYPE_FRAMES 0
51 #define CALC_TYPE_BYTES 1
52 #define CALC_TYPE_FRAMES_AND_BYTES 2
53 #define CALC_TYPE_COUNT 3
54 #define CALC_TYPE_SUM 4
55 #define CALC_TYPE_MIN 5
56 #define CALC_TYPE_MAX 6
57 #define CALC_TYPE_AVG 7
58 #define CALC_TYPE_LOAD 8
60 typedef struct _io_stat_item_t {
62 struct _io_stat_item_t *next;
63 struct _io_stat_item_t *prev;
64 gint64 time; /* unit is us since start of capture */
72 #define NANOSECS_PER_SEC 1000000000
75 iostat_packet(void *arg, packet_info *pinfo, epan_dissect_t *edt, const void *dummy _U_)
77 io_stat_item_t *mit = arg;
79 gint64 current_time, ct;
83 current_time = (gint64)(pinfo->fd->rel_ts.secs*1000000) + (pinfo->fd->rel_ts.nsecs+500)/1000;
85 /* the prev item before the main one is always the last interval we saw packets for */
88 /* XXX for the time being, just ignore all frames that are in the past.
89 should be fixed in the future but hopefully it is uncommon */
90 if(current_time<it->time){
94 /* we have moved into a new interval, we need to create a new struct */
96 while(ct >= (it->time + mit->parent->interval)){
97 it->next=g_malloc(sizeof(io_stat_item_t));
103 it->time = it->prev->time + mit->parent->interval;
107 it->calc_type=it->prev->calc_type;
108 it->hf_index=it->prev->hf_index;
111 /* it will now give us the current structure to use to store the data in */
114 switch(it->calc_type){
115 case CALC_TYPE_BYTES:
116 case CALC_TYPE_FRAMES:
117 case CALC_TYPE_FRAMES_AND_BYTES:
118 it->counter+=pinfo->fd->pkt_len;
120 case CALC_TYPE_COUNT:
121 gp=proto_get_finfo_ptr_array(edt->tree, it->hf_index);
123 it->counter+=gp->len;
127 gp=proto_get_finfo_ptr_array(edt->tree, it->hf_index);
132 for(i=0;i<gp->len;i++){
133 switch(proto_registrar_get_ftype(it->hf_index)){
138 it->counter+=fvalue_get_uinteger(&((field_info *)gp->pdata[i])->value);
141 it->counter+=fvalue_get_integer64(&((field_info *)gp->pdata[i])->value);
147 it->counter+=fvalue_get_sinteger(&((field_info *)gp->pdata[i])->value);
150 it->counter+=(gint64)fvalue_get_integer64(&((field_info *)gp->pdata[i])->value);
152 case FT_RELATIVE_TIME:
153 new_time = fvalue_get(&((field_info *)gp->pdata[i])->value);
154 val=(guint64)(new_time->secs) * NANOSECS_PER_SEC + new_time->nsecs;
162 gp=proto_get_finfo_ptr_array(edt->tree, it->hf_index);
168 type=proto_registrar_get_ftype(it->hf_index);
169 for(i=0;i<gp->len;i++){
175 val=fvalue_get_uinteger(&((field_info *)gp->pdata[i])->value);
176 if((it->frames==1)&&(i==0)){
178 } else if(val<it->counter){
183 val=fvalue_get_integer64(&((field_info *)gp->pdata[i])->value);
184 if((it->frames==1)&&(i==0)){
186 } else if(val<it->counter){
194 val=fvalue_get_sinteger(&((field_info *)gp->pdata[i])->value);
195 if((it->frames==1)&&(i==0)){
197 } else if((gint32)val<(gint32)(it->counter)){
202 val=fvalue_get_integer64(&((field_info *)gp->pdata[i])->value);
203 if((it->frames==1)&&(i==0)){
205 } else if((gint64)val<(gint64)(it->counter)){
209 case FT_RELATIVE_TIME:
210 new_time=fvalue_get(&((field_info *)gp->pdata[i])->value);
211 val=(guint64)(new_time->secs) * NANOSECS_PER_SEC + new_time->nsecs;
212 if((it->frames==1)&&(i==0)){
214 } else if(val<it->counter){
223 gp=proto_get_finfo_ptr_array(edt->tree, it->hf_index);
229 type=proto_registrar_get_ftype(it->hf_index);
230 for(i=0;i<gp->len;i++){
236 val=fvalue_get_uinteger(&((field_info *)gp->pdata[i])->value);
237 if((it->frames==1)&&(i==0)){
239 } else if(val>it->counter){
244 val=fvalue_get_integer64(&((field_info *)gp->pdata[i])->value);
245 if((it->frames==1)&&(i==0)){
247 } else if(val>it->counter){
255 val=fvalue_get_sinteger(&((field_info *)gp->pdata[i])->value);
256 if((it->frames==1)&&(i==0)){
258 } else if((gint32)val>(gint32)(it->counter)){
263 val=fvalue_get_integer64(&((field_info *)gp->pdata[i])->value);
264 if((it->frames==1)&&(i==0)){
266 } else if((gint64)val>(gint64)(it->counter)){
270 case FT_RELATIVE_TIME:
271 new_time=fvalue_get(&((field_info *)gp->pdata[i])->value);
272 val=(guint64)(new_time->secs) * NANOSECS_PER_SEC + new_time->nsecs;
273 if((it->frames==1)&&(i==0)){
275 } else if(val>it->counter){
284 gp=proto_get_finfo_ptr_array(edt->tree, it->hf_index);
290 type=proto_registrar_get_ftype(it->hf_index);
291 for(i=0;i<gp->len;i++){
298 val=fvalue_get_uinteger(&((field_info *)gp->pdata[i])->value);
303 val=fvalue_get_integer64(&((field_info *)gp->pdata[i])->value);
310 val=fvalue_get_sinteger(&((field_info *)gp->pdata[i])->value);
313 case FT_RELATIVE_TIME:
314 new_time=fvalue_get(&((field_info *)gp->pdata[i])->value);
315 val=(guint64)(new_time->secs) * NANOSECS_PER_SEC + new_time->nsecs;
323 gp=proto_get_finfo_ptr_array(edt->tree, it->hf_index);
327 type=proto_registrar_get_ftype(it->hf_index);
328 if (type != FT_RELATIVE_TIME) {
330 "\ntshark: LOAD() is only supported for relative-time fiels such as smb.time\n"
334 for(i=0;i<gp->len;i++){
340 new_time=fvalue_get(&((field_info *)gp->pdata[i])->value);
341 val=(guint64)(new_time->secs)*1000000 + new_time->nsecs/1000;
342 tival = (int)(val % mit->parent->interval);
343 it->counter += tival;
347 if (val < (guint64)mit->parent->interval) {
353 pit->counter += mit->parent->interval;
354 val -= mit->parent->interval;
367 iostat_draw(void *arg)
369 io_stat_item_t *mit = arg;
371 io_stat_item_t **items;
376 guint32 borderLen=68;
384 /* Display the table border */
385 for(i=0;i<iot->num_items;i++){
386 if(iot->items[i].calc_type==CALC_TYPE_FRAMES_AND_BYTES)
389 if(iot->interval!=G_MAXINT32)
392 borderLen+=(iot->num_items-3)*17;
393 for(i=0;i<borderLen;i++){
399 printf("IO Statistics\n");
400 if(iot->interval!=G_MAXINT32)
401 printf("Interval: %3" G_GINT64_MODIFIER "u.%06" G_GINT64_MODIFIER "u secs\n",
402 iot->interval/1000000, iot->interval%1000000);
404 for(i=0;i<iot->num_items;i++){
405 printf("Column #%u: %s\n",i,iot->filters[i]?iot->filters[i]:"");
407 if(iot->interval==G_MAXINT32){
412 for(i=0;i<iot->num_items;i++){
413 if(iot->items[i].calc_type==CALC_TYPE_FRAMES_AND_BYTES){
414 printf(" Column #%-2u |",i);
416 printf(" Column #%-2u |",i);
421 if(iot->interval==G_MAXINT32) {
426 for(i=0;i<iot->num_items;i++){
427 switch(iot->items[i].calc_type){
428 case CALC_TYPE_FRAMES:
431 case CALC_TYPE_BYTES:
434 case CALC_TYPE_FRAMES_AND_BYTES:
435 printf(" Frames | Bytes |");
437 case CALC_TYPE_COUNT:
459 items=g_malloc(sizeof(io_stat_item_t *)*iot->num_items);
460 frames=g_malloc(sizeof(guint64)*iot->num_items);
461 counters=g_malloc(sizeof(guint64)*iot->num_items);
462 num=g_malloc(sizeof(guint64)*iot->num_items);
463 /* preset all items at the first interval */
464 for(i=0;i<iot->num_items;i++){
465 items[i]=&iot->items[i];
468 /* loop the items until we run out of them all */
472 for(i=0;i<iot->num_items;i++){
477 for(i=0;i<iot->num_items;i++){
478 if(items[i] && (t>=(items[i]->time+iot->interval))){
479 items[i]=items[i]->next;
482 if(items[i] && (t<(items[i]->time+iot->interval)) && (t>=items[i]->time) ){
483 frames[i]=items[i]->frames;
484 counters[i]=items[i]->counter;
485 num[i]=items[i]->num;
494 if(iot->interval==G_MAXINT32) {
497 printf("%04u.%06u-%04u.%06u ",
498 (int)(t/1000000),(int)(t%1000000),
499 (int)((t+iot->interval)/1000000),
500 (int)((t+iot->interval)%1000000));
502 for(i=0;i<iot->num_items;i++){
503 switch(iot->items[i].calc_type){
504 case CALC_TYPE_FRAMES:
505 printf(" %15" G_GINT64_MODIFIER "u ", frames[i]);
507 case CALC_TYPE_BYTES:
508 printf(" %15" G_GINT64_MODIFIER "u ", counters[i]);
510 case CALC_TYPE_FRAMES_AND_BYTES:
511 printf(" %15" G_GINT64_MODIFIER "u %15" G_GINT64_MODIFIER "u ", frames[i], counters[i]);
513 case CALC_TYPE_COUNT:
514 printf(" %15" G_GINT64_MODIFIER "u ", counters[i]);
517 switch(proto_registrar_get_ftype(iot->items[i].hf_index)){
518 case FT_RELATIVE_TIME:
519 counters[i] = (counters[i]+500)/1000;
521 (int)(counters[i]/1000000), (int)(counters[i]%1000000));
524 printf(" %15" G_GINT64_MODIFIER "u ", counters[i]);
529 switch(proto_registrar_get_ftype(iot->items[i].hf_index)){
535 printf(" %15" G_GINT64_MODIFIER "u ", counters[i]);
542 printf(" %15" G_GINT64_MODIFIER "d ", counters[i]);
544 case FT_RELATIVE_TIME:
545 counters[i]=(counters[i]+500)/1000;
547 (int)(counters[i]/1000000), (int)(counters[i]%1000000));
552 switch(proto_registrar_get_ftype(iot->items[i].hf_index)){
558 printf(" %15u ", (int)(counters[i]));
565 printf(" %15" G_GINT64_MODIFIER "d ", counters[i]);
567 case FT_RELATIVE_TIME:
568 counters[i]=(counters[i]+500)/1000;
570 (int)(counters[i]/1000000), (int)(counters[i]%1000000));
578 switch(proto_registrar_get_ftype(iot->items[i].hf_index)){
584 printf(" %15" G_GINT64_MODIFIER "u ", counters[i]/num[i]);
591 printf(" %15" G_GINT64_MODIFIER "d ", counters[i]/num[i]);
593 case FT_RELATIVE_TIME:
594 counters[i]=((counters[i]/num[i])+500)/1000;
596 (int)(counters[i]/1000000), (int)(counters[i]%1000000));
602 switch(proto_registrar_get_ftype(iot->items[i].hf_index)){
603 case FT_RELATIVE_TIME:
605 (int)(counters[i]/iot->interval), (int)((counters[i]%iot->interval)*1000000/iot->interval));
618 for(i=0;i<borderLen;i++){
631 const char *func_name;
635 static calc_type_ent_t calc_type_table[] = {
636 { "FRAMES", CALC_TYPE_FRAMES },
637 { "BYTES", CALC_TYPE_BYTES },
638 { "COUNT", CALC_TYPE_COUNT },
639 { "SUM", CALC_TYPE_SUM },
640 { "MIN", CALC_TYPE_MIN },
641 { "MAX", CALC_TYPE_MAX },
642 { "AVG", CALC_TYPE_AVG },
643 { "LOAD", CALC_TYPE_LOAD },
648 register_io_tap(io_stat_t *io, int i, const char *filter)
650 GString *error_string;
654 const char *p, *parenp;
656 header_field_info *hfi;
658 io->items[i].prev=&io->items[i];
659 io->items[i].next=NULL;
660 io->items[i].parent=io;
662 io->items[i].calc_type=CALC_TYPE_FRAMES_AND_BYTES;
663 io->items[i].frames=0;
664 io->items[i].counter=0;
666 io->filters[i]=filter;
671 for(j=0; calc_type_table[j].func_name; j++){
672 namelen=strlen(calc_type_table[j].func_name);
673 if(filter && strncmp(filter, calc_type_table[j].func_name, namelen) == 0) {
674 io->items[i].calc_type=calc_type_table[j].calc_type;
675 if(*(filter+namelen)=='(') {
677 parenp=strchr(p, ')');
679 fprintf(stderr, "\ntshark: Closing parenthesis missing from calculated expression.\n");
684 if(io->items[i].calc_type==CALC_TYPE_FRAMES || io->items[i].calc_type==CALC_TYPE_BYTES){
686 fprintf(stderr, "\ntshark: %s does require or allow a field name within the parens.\n",
687 calc_type_table[j].func_name);
692 /* bail out if a field name was not specified */
693 fprintf(stderr, "\ntshark: You didn't specify a field name for %s(*).\n",
694 calc_type_table[j].func_name);
699 field=g_malloc(parenp-p+1);
700 memcpy(field, p, parenp-p);
701 field[parenp-p] = '\0';
703 if (io->items[i].calc_type==CALC_TYPE_FRAMES || io->items[i].calc_type==CALC_TYPE_BYTES)
705 hfi=proto_registrar_get_byname(field);
707 fprintf(stderr, "\ntshark: There is no field named '%s'.\n",
713 io->items[i].hf_index=hfi->id;
717 if (io->items[i].calc_type==CALC_TYPE_FRAMES || io->items[i].calc_type==CALC_TYPE_BYTES)
721 if(hfi && !(io->items[i].calc_type==CALC_TYPE_BYTES ||
722 io->items[i].calc_type==CALC_TYPE_FRAMES ||
723 io->items[i].calc_type==CALC_TYPE_FRAMES_AND_BYTES)){
724 /* check that the type is compatible */
736 /* these types support all calculations */
738 case FT_RELATIVE_TIME:
739 /* this type only supports SUM, COUNT, MAX, MIN, AVG */
740 switch(io->items[i].calc_type){
742 case CALC_TYPE_COUNT:
750 "\ntshark: %s is a relative-time field, so %s(*) calculations are not supported on it.",
752 calc_type_table[j].func_name);
758 * XXX - support all operations on floating-point
761 if(io->items[i].calc_type!=CALC_TYPE_COUNT){
763 "\ntshark: %s doesn't have integral values, so %s(*) calculations are not supported on it.\n",
765 calc_type_table[j].func_name);
773 error_string=register_tap_listener("frame", &io->items[i], flt, TL_REQUIRES_PROTO_TREE, NULL, iostat_packet, i?NULL:iostat_draw);
777 fprintf(stderr, "\ntshark: Couldn't register io,stat tap: %s\n",
779 g_string_free(error_string, TRUE);
785 iostat_init(const char *optarg, void* userdata _U_)
787 gdouble interval_float;
791 const char *filter=NULL;
793 if(sscanf(optarg,"io,stat,%lf,%n",&interval_float,&idx)==1){
795 if(*(optarg+idx)==',')
803 fprintf(stderr, "\ntshark: invalid \"-z io,stat,<interval>[,<filter>]\" argument\n");
807 /* if interval is 0, calculate statistics over the whole file
808 * by setting the interval to G_MAXINT32
810 if(interval_float==0) {
813 /* make interval be number of us rounded to the nearest integer*/
814 interval=(gint64)(interval_float*1000000.0+0.5);
819 "\ntshark: \"-z\" interval must be >=0.000001 seconds or \"0\" for the entire capture duration.\n");
823 io=g_malloc(sizeof(io_stat_t));
824 io->interval=interval;
825 if((!filter)||(filter[0]==0)){
827 io->items=g_malloc(sizeof(io_stat_item_t)*io->num_items);
828 io->filters=g_malloc(sizeof(char *)*io->num_items);
830 register_io_tap(io, 0, NULL);
832 const char *str,*pos;
835 /* find how many ',' separated filters we have */
838 while((str=strchr(str,','))){
843 io->items=g_malloc(sizeof(io_stat_item_t)*io->num_items);
844 io->filters=g_malloc(sizeof(char *)*io->num_items);
846 /* for each filter, register a tap listener */
852 register_io_tap(io, i, NULL);
853 } else if(pos==NULL) {
855 register_io_tap(io, i, tmp);
857 tmp=g_malloc((pos-str)+1);
858 g_strlcpy(tmp,str,(pos-str)+1);
859 register_io_tap(io, i, tmp);
868 register_tap_listener_iostat(void)
870 register_stat_cmd_arg("io,stat,", iostat_init, NULL);