gtk/mcast_stream.c

   1 /* mcast_stream.c
   2  *
   3  * Copyright 2006, Iskratel , Slovenia
   4  * By Jakob Bratkovic <j.bratkovic@iskratel.si> and
   5  * Miha Jemec <m.jemec@iskratel.si>
   6  *
   7  * $Id$
   8  *
   9  * based on rtp_stream.c
  10  * Copyright 2003, Alcatel Business Systems
  11  * By Lars Ruoff <lars.ruoff@gmx.net>
  12  *
  13  * Wireshark - Network traffic analyzer
  14  * By Gerald Combs <gerald@wireshark.org>
  15  * Copyright 1998 Gerald Combs
  16  *
  17  * This program is free software; you can redistribute it and/or
  18  * modify it under the terms of the GNU General Public License
  19  * as published by the Free Software Foundation; either version 2
  20  * of the License, or (at your option) any later version.
  21  *
  22  * This program is distributed in the hope that it will be useful,
  23  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  24  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25  * GNU General Public License for more details.
  26  *
  27  * You should have received a copy of the GNU General Public License
  28  * along with this program; if not, write to the Free Software
  29  * Foundation,  Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  30  */
  31
  32 #ifdef HAVE_CONFIG_H
  33 # include "config.h"
  34 #endif
  35 #ifdef HAVE_FCNTL_H
  36 #include <fcntl.h>
  37 #endif
  38
  39 #ifdef HAVE_SYS_TYPES_H
  40 # include <sys/types.h>
  41 #endif
  42
  43 #include <glib.h>
  44
  45 #include <stdio.h>
  46 #include <time.h>
  47 #include <string.h>
  48
  49 #include <gtk/gtk.h>
  50
  51 #include <epan/epan.h>
  52 #include <epan/address.h>
  53 #include <epan/packet.h>
  54 #include <epan/tap.h>
  55 #include <epan/strutil.h>
  56
  57 #include "../alert_box.h"
  58 #include "../simple_dialog.h"
  59
  60 #include "gtk/mcast_stream.h"
  61 #include "gtk/mcast_stream_dlg.h"
  62 #include "gtk/main.h"
  63
  64 #ifdef HAVE_WINSOCK2_H
  65 #include <winsock2.h>
  66 #endif
  67
  68 gint32  mcast_stream_trigger         =     50; /* limit for triggering the burst alarm (in packets per second) */
  69 gint32  mcast_stream_bufferalarm     =  10000; /* limit for triggernig the buffer alarm (in bytes) */
  70 guint16 mcast_stream_burstint        =    100; /* burst interval in ms */
  71 gint32  mcast_stream_emptyspeed      =   5000; /* outgoing speed for single stream (kbps)*/
  72 gint32  mcast_stream_cumulemptyspeed = 100000; /* outgoiong speed for all streams (kbps)*/
  73
  74 /* sliding window and buffer usage */
  75 static gint32  buffsize = (int)((double)MAX_SPEED * 100 / 1000) * 2;
  76 static guint16 comparetimes(struct timeval *t1, struct timeval *t2, guint16 burstint_lcl);
  77 static void    buffusagecalc(mcast_stream_info_t *strinfo, packet_info *pinfo, double emptyspeed_lcl);
  78 static void    slidingwindow(mcast_stream_info_t *strinfo, packet_info *pinfo);
  79
  80
  81 /****************************************************************************/
  82 /* the one and only global mcaststream_tapinfo_t structure */
  83 static mcaststream_tapinfo_t the_tapinfo_struct =
  84         {0, NULL, 0, NULL, 0, FALSE};
  85
  86
  87 /****************************************************************************/
  88 /* GCompareFunc style comparison function for _mcast_stream_info */
  89 static gint
  90 mcast_stream_info_cmp(gconstpointer aa, gconstpointer bb)
  91 {
  92         const struct _mcast_stream_info* a = aa;
  93         const struct _mcast_stream_info* b = bb;
  94
  95         if (a==b)
  96                 return 0;
  97         if (a==NULL || b==NULL)
  98                 return 1;
  99         if (ADDRESSES_EQUAL(&(a->src_addr), &(b->src_addr))
 100                 && (a->src_port == b->src_port)
 101                 && ADDRESSES_EQUAL(&(a->dest_addr), &(b->dest_addr))
 102                 && (a->dest_port == b->dest_port))
 103                 return 0;
 104         else
 105                 return 1;
 106
 107 }
 108
 109
 110 /****************************************************************************/
 111 /* when there is a [re]reading of packet's */
 112 void
 113 mcaststream_reset(mcaststream_tapinfo_t *tapinfo)
 114 {
 115         GList* list;
 116
 117         /* free the data items first */
 118         list = g_list_first(tapinfo->strinfo_list);
 119         while (list)
 120         {
 121                 /* XYZ I don't know how to clean this */
 122                 /*g_free(list->element.buff); */
 123                 g_free(list->data);
 124                 list = g_list_next(list);
 125         }
 126         g_list_free(tapinfo->strinfo_list);
 127         tapinfo->strinfo_list = NULL;
 128
 129         /* XYZ and why does the line below causes a crach? */
 130         /*g_free(tapinfo->allstreams->element.buff);*/
 131         g_free(tapinfo->allstreams);
 132         tapinfo->allstreams = NULL;
 133
 134         tapinfo->nstreams = 0;
 135         tapinfo->npackets = 0;
 136
 137         ++(tapinfo->launch_count);
 138
 139         return;
 140 }
 141
 142 static void
 143 mcaststream_reset_cb(void *arg)
 144 {
 145         mcaststream_reset(arg);
 146 }
 147
 148 /****************************************************************************/
 149 /* redraw the output */
 150 static void
 151 mcaststream_draw(void *arg _U_)
 152 {
 153 /* XXX: see mcaststream_on_update in mcast_streams_dlg.c for comments
 154         g_signal_emit_by_name(top_level, "signal_mcaststream_update");
 155 */
 156         mcaststream_dlg_update(the_tapinfo_struct.strinfo_list);
 157         return;
 158 }
 159
 160
 161
 162 /****************************************************************************/
 163 /* whenever a udp packet is seen by the tap listener */
 164 static int
 165 mcaststream_packet(void *arg, packet_info *pinfo, epan_dissect_t *edt _U_, const void *arg2 _U_)
 166 {
 167         mcaststream_tapinfo_t *tapinfo = arg;
 168         mcast_stream_info_t tmp_strinfo;
 169         mcast_stream_info_t *strinfo = NULL;
 170         GList* list;
 171         float deltatime;
 172
 173         /* gather infos on the stream this packet is part of */
 174         COPY_ADDRESS(&(tmp_strinfo.src_addr), &(pinfo->src));
 175         tmp_strinfo.src_port = pinfo->srcport;
 176         COPY_ADDRESS(&(tmp_strinfo.dest_addr), &(pinfo->dst));
 177         tmp_strinfo.dest_port = pinfo->destport;
 178
 179         /* first we ignore non multicast packets; we filter out only those ethernet packets
 180          * which start with the 01:00:5E multicast address (for IPv4) and 33:33 multicast
 181          * address (for IPv6).
 182          */
 183         if ((pinfo->dl_dst.type != AT_ETHER) ||
 184             ((g_ascii_strncasecmp("01005E", bytes_to_str(pinfo->dl_dst.data, pinfo->dl_dst.len), 6) != 0) &&
 185              (g_ascii_strncasecmp("3333", bytes_to_str(pinfo->dl_dst.data, pinfo->dl_dst.len), 4) != 0)) )
 186                 return 0;
 187
 188         /* check whether we already have a stream with these parameters in the list */
 189         list = g_list_first(tapinfo->strinfo_list);
 190         while (list)
 191         {
 192                 if (mcast_stream_info_cmp(&tmp_strinfo, (mcast_stream_info_t*)(list->data))==0)
 193                 {
 194                         strinfo = (mcast_stream_info_t*)(list->data);  /*found!*/
 195                         break;
 196                 }
 197                 list = g_list_next(list);
 198         }
 199
 200         /* not in the list? then create a new entry */
 201         if (!strinfo) {
 202                 /*printf("nov sip %s sp %d dip %s dp %d\n", g_strdup(get_addr_name(&(pinfo->src))),
 203                         pinfo->srcport, g_strdup(get_addr_name(&(pinfo->dst))), pinfo->destport);*/
 204                 tmp_strinfo.npackets = 0;
 205                 tmp_strinfo.apackets = 0;
 206                 tmp_strinfo.first_frame_num = pinfo->fd->num;
 207                 tmp_strinfo.start_sec = (guint32) pinfo->fd->abs_ts.secs;
 208                 tmp_strinfo.start_usec = pinfo->fd->abs_ts.nsecs/1000;
 209                 tmp_strinfo.start_rel_sec = (guint32) pinfo->fd->rel_ts.secs;
 210                 tmp_strinfo.start_rel_usec = pinfo->fd->rel_ts.nsecs/1000;
 211                 tmp_strinfo.vlan_id = 0;
 212
 213                 /* reset Mcast stats */
 214                 tmp_strinfo.average_bw = 0;
 215                 tmp_strinfo.total_bytes = 0;
 216
 217                 /* reset slidingwindow and buffer parameters */
 218                 tmp_strinfo.element.buff = (struct timeval *)g_malloc(buffsize * sizeof(struct timeval));
 219                 tmp_strinfo.element.first=0;
 220                 tmp_strinfo.element.last=0;
 221                 tmp_strinfo.element.burstsize=1;
 222                 tmp_strinfo.element.topburstsize=1;
 223                 tmp_strinfo.element.numbursts=0;
 224                 tmp_strinfo.element.burststatus=0;
 225                 tmp_strinfo.element.count=1;
 226                 tmp_strinfo.element.buffusage=pinfo->fd->pkt_len;
 227                 tmp_strinfo.element.topbuffusage=pinfo->fd->pkt_len;
 228                 tmp_strinfo.element.numbuffalarms=0;
 229                 tmp_strinfo.element.buffstatus=0;
 230                 tmp_strinfo.element.maxbw=0;
 231
 232                 strinfo = g_malloc(sizeof(mcast_stream_info_t));
 233                 *strinfo = tmp_strinfo;  /* memberwise copy of struct */
 234                 tapinfo->strinfo_list = g_list_append(tapinfo->strinfo_list, strinfo);
 235                 strinfo->element.buff = (struct timeval *)g_malloc(buffsize * sizeof(struct timeval));
 236
 237                 /* set time with the first packet */
 238                 if (tapinfo->npackets == 0) {
 239                         tapinfo->allstreams = g_malloc(sizeof(mcast_stream_info_t));
 240                         tapinfo->allstreams->element.buff =
 241                                         (struct timeval *)g_malloc(buffsize * sizeof(struct timeval));
 242                         tapinfo->allstreams->start_rel_sec = (guint32) pinfo->fd->rel_ts.secs;
 243                         tapinfo->allstreams->start_rel_usec = pinfo->fd->rel_ts.nsecs/1000;
 244                         tapinfo->allstreams->total_bytes = 0;
 245                         tapinfo->allstreams->element.first=0;
 246                         tapinfo->allstreams->element.last=0;
 247                         tapinfo->allstreams->element.burstsize=1;
 248                         tapinfo->allstreams->element.topburstsize=1;
 249                         tapinfo->allstreams->element.numbursts=0;
 250                         tapinfo->allstreams->element.burststatus=0;
 251                         tapinfo->allstreams->element.count=1;
 252                         tapinfo->allstreams->element.buffusage=pinfo->fd->pkt_len;
 253                         tapinfo->allstreams->element.topbuffusage=pinfo->fd->pkt_len;
 254                         tapinfo->allstreams->element.numbuffalarms=0;
 255                         tapinfo->allstreams->element.buffstatus=0;
 256                         tapinfo->allstreams->element.maxbw=0;
 257                 }
 258         }
 259
 260         /* time between first and last packet in the group */
 261         strinfo->stop_rel_sec = (guint32) pinfo->fd->rel_ts.secs;
 262         strinfo->stop_rel_usec = pinfo->fd->rel_ts.nsecs/1000;
 263         deltatime = ((float)((strinfo->stop_rel_sec * 1000000 + strinfo->stop_rel_usec)
 264                                         - (strinfo->start_rel_sec*1000000 + strinfo->start_rel_usec)))/1000000;
 265
 266         /* calculate average bandwidth for this stream */
 267         strinfo->total_bytes = strinfo->total_bytes + pinfo->fd->pkt_len;
 268         if (deltatime > 0)
 269                 strinfo->average_bw = (((float)(strinfo->total_bytes*8) / deltatime) / 1000000);
 270
 271         /* increment the packets counter for this stream and calculate average pps */
 272         ++(strinfo->npackets);
 273         strinfo->apackets = (guint32) (strinfo->npackets / deltatime);
 274
 275         /* time between first and last packet in any group */
 276         tapinfo->allstreams->stop_rel_sec = (guint32) pinfo->fd->rel_ts.secs;
 277         tapinfo->allstreams->stop_rel_usec = pinfo->fd->rel_ts.nsecs/1000;
 278         deltatime = ((float)((tapinfo->allstreams->stop_rel_sec * 1000000 + tapinfo->allstreams->stop_rel_usec)
 279                 - (tapinfo->allstreams->start_rel_sec*1000000 + tapinfo->allstreams->start_rel_usec)))/1000000;
 280
 281         /* increment the packets counter of all streams */
 282         ++(tapinfo->npackets);
 283
 284         /* calculate average bandwidth for all streams */
 285         tapinfo->allstreams->total_bytes = tapinfo->allstreams->total_bytes + pinfo->fd->pkt_len;
 286         if (deltatime > 0)
 287                 tapinfo->allstreams->average_bw = (((float)(tapinfo->allstreams->total_bytes *8) / deltatime) / 1000000);
 288
 289         /* sliding window and buffercalc for this group*/
 290         slidingwindow(strinfo, pinfo);
 291         buffusagecalc(strinfo, pinfo, mcast_stream_emptyspeed*1000);
 292         /* sliding window and buffercalc for all groups */
 293         slidingwindow(tapinfo->allstreams, pinfo);
 294         buffusagecalc(tapinfo->allstreams, pinfo, mcast_stream_cumulemptyspeed*1000);
 295         /* end of sliding window */
 296
 297         return 1;  /* refresh output */
 298
 299 }
 300
 301 /****************************************************************************/
 302 /* scan for Mcast streams */
 303 void
 304 mcaststream_scan(void)
 305 {
 306         gboolean was_registered = the_tapinfo_struct.is_registered;
 307         if (!the_tapinfo_struct.is_registered)
 308                 register_tap_listener_mcast_stream();
 309
 310         cf_retap_packets(&cfile);
 311
 312         if (!was_registered)
 313                 remove_tap_listener_mcast_stream();
 314 }
 315
 316
 317 /****************************************************************************/
 318 const mcaststream_tapinfo_t *
 319 mcaststream_get_info(void)
 320 {
 321         return &the_tapinfo_struct;
 322 }
 323
 324
 325 /****************************************************************************/
 326 /* TAP INTERFACE */
 327 /****************************************************************************/
 328
 329 /****************************************************************************/
 330 void
 331 remove_tap_listener_mcast_stream(void)
 332 {
 333         if (the_tapinfo_struct.is_registered) {
 334                 protect_thread_critical_region();
 335                 remove_tap_listener(&the_tapinfo_struct);
 336                 unprotect_thread_critical_region();
 337
 338                 the_tapinfo_struct.is_registered = FALSE;
 339         }
 340 }
 341
 342
 343 /****************************************************************************/
 344 void
 345 register_tap_listener_mcast_stream(void)
 346 {
 347         GString *error_string;
 348         if (!the_tapinfo_struct.is_registered) {
 349                 error_string = register_tap_listener("udp", &the_tapinfo_struct,
 350                         NULL, 0, mcaststream_reset_cb, mcaststream_packet,
 351                         mcaststream_draw);
 352
 353                 if (error_string != NULL) {
 354                         simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK,
 355                                       "%s", error_string->str);
 356                         g_string_free(error_string, TRUE);
 357                         exit(1);
 358                 }
 359
 360                 the_tapinfo_struct.is_registered = TRUE;
 361         }
 362 }
 363
 364 /*******************************************************************************/
 365 /* sliding window and buffer calculations */
 366
 367 /* compare two times */
 368 static guint16
 369 comparetimes(struct timeval *t1, struct timeval *t2, guint16 burstint_lcl)
 370 {
 371         if(((t2->tv_sec - t1->tv_sec)*1000 + (t2->tv_usec - t1->tv_usec)/1000) > burstint_lcl){
 372                 return 1;
 373         } else{
 374                 return 0;
 375         }
 376 }
 377
 378 /* calculate buffer usage */
 379 static void
 380 buffusagecalc(mcast_stream_info_t *strinfo, packet_info *pinfo, double emptyspeed_lcl)
 381 {
 382         gint32 sec=0, usec=0, cur, prev;
 383         struct timeval *buffer;
 384         double timeelapsed;
 385
 386         buffer = strinfo->element.buff;
 387         cur = strinfo->element.last;
 388         if(cur == 0){
 389                 cur = buffsize - 1;
 390                 prev = cur - 1;
 391         } else if(cur == 1){
 392                 prev = buffsize - 1;
 393                 cur = 0;
 394         } else{
 395                 cur=cur-1;
 396                 prev=cur-1;
 397         }
 398
 399         sec = buffer[cur].tv_sec - buffer[prev].tv_sec;
 400         usec = buffer[cur].tv_usec - buffer[prev].tv_usec;
 401         timeelapsed = (double)usec/1000000 + (double)sec;
 402
 403         /* bytes added to buffer */
 404         strinfo->element.buffusage+=pinfo->fd->pkt_len;
 405
 406         /* bytes cleared from buffer */
 407         strinfo->element.buffusage-= (guint32) (timeelapsed * emptyspeed_lcl / 8);
 408
 409         if(strinfo->element.buffusage < 0) strinfo->element.buffusage=0;
 410         if(strinfo->element.buffusage > strinfo->element.topbuffusage)
 411                 strinfo->element.topbuffusage = strinfo->element.buffusage;
 412         /* check for buffer losses */
 413         if((strinfo->element.buffusage >= mcast_stream_bufferalarm) && (strinfo->element.buffstatus == 0)){
 414                 strinfo->element.buffstatus = 1;
 415                 strinfo->element.numbuffalarms++;
 416         } else if(strinfo->element.buffusage < mcast_stream_bufferalarm){
 417                 strinfo->element.buffstatus = 0;
 418         }
 419
 420         return;
 421 }
 422
 423 /* sliding window calculation */
 424 static void
 425 slidingwindow(mcast_stream_info_t *strinfo, packet_info *pinfo)
 426 {
 427         struct timeval *buffer;
 428         gint32 diff;
 429
 430         buffer = strinfo->element.buff;
 431
 432         diff = strinfo->element.last - strinfo->element.first;
 433         if(diff < 0) diff+=buffsize;
 434
 435         /* check if buffer is full */
 436         if(diff >= (buffsize - 2)){
 437                 fprintf(stderr, "Warning: capture buffer full\n");
 438                 strinfo->element.first++;
 439                 if(strinfo->element.first >= buffsize) strinfo->element.first = strinfo->element.first % buffsize;
 440         }
 441
 442         /* burst count */
 443         buffer[strinfo->element.last].tv_sec = (guint32) pinfo->fd->rel_ts.secs;
 444         buffer[strinfo->element.last].tv_usec = pinfo->fd->rel_ts.nsecs/1000;
 445         while(comparetimes((struct timeval *)&(buffer[strinfo->element.first]),
 446                            (struct timeval *)&(buffer[strinfo->element.last]), mcast_stream_burstint)){
 447                 strinfo->element.first++;
 448                 if(strinfo->element.first >= buffsize) strinfo->element.first = strinfo->element.first % buffsize;
 449                 diff--;
 450         }
 451         strinfo->element.burstsize = diff;
 452         if(strinfo->element.burstsize > strinfo->element.topburstsize) {
 453                 strinfo->element.topburstsize = strinfo->element.burstsize;
 454                 strinfo->element.maxbw = (float)(strinfo->element.topburstsize) * 1000 / mcast_stream_burstint * pinfo->fd->pkt_len * 8 / 1000000;
 455         }
 456
 457         strinfo->element.last++;
 458         if(strinfo->element.last >= buffsize) strinfo->element.last = strinfo->element.last % buffsize;
 459         /* trigger check */
 460         if((strinfo->element.burstsize >= mcast_stream_trigger) && (strinfo->element.burststatus == 0)){
 461                 strinfo->element.burststatus = 1;
 462                 strinfo->element.numbursts++;
 463         } else if(strinfo->element.burstsize < mcast_stream_trigger){
 464                 strinfo->element.burststatus = 0;
 465         }
 466
 467         strinfo->element.count++;
 468 }
 469