Move make-manuf to the tools directory.
[obnox/wireshark/wip.git] / tap-comparestat.c
1 /* tap-comparestat.c
2  * Compare two capture files
3  * Copyright 2008 Vincenzo Condoleo, Christophe Dirac, Reto Ruoss
4  * supported by HSR (Hochschule Rapperswil)
5  *
6  * $Id$
7  *
8  * Wireshark - Network traffic analyzer
9  * By Gerald Combs <gerald@wireshark.org>
10  * Copyright 1998 Gerald Combs
11  *
12  * This program is free software; you can redistribute it and/or
13  * modify it under the terms of the GNU General Public License
14  * as published by the Free Software Foundation; either version 2
15  * of the License, or (at your option) any later version.
16  *
17  * This program is distributed in the hope that it will be useful,
18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
20  * GNU General Public License for more details.
21  *
22  * You should have received a copy of the GNU General Public License
23  * along with this program; if not, write to the Free Software
24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
25  */
26
27 /* This module provides statistics about two merged capture files, to find packet loss,
28  * time delay, ip header checksum errors and order check to tshark.
29  * It's also detecting the matching regions of the different files.
30  *
31  * The packets are compared by the ip id. MAC or TTL is used to distinct the different files.
32  * It is only used by tshark and not wireshark
33  */
34
35 #ifdef HAVE_CONFIG_H
36 # include "config.h"
37 #endif
38
39 #include <stdio.h>
40 #include <math.h>
41
42 #ifdef HAVE_SYS_TYPES_H
43 # include <sys/types.h>
44 #endif
45
46 #include <string.h>
47 #include "epan/packet_info.h"
48 #include <epan/in_cksum.h>
49 #include <epan/packet.h>
50 #include <epan/tap.h>
51 #include <epan/timestamp.h>
52 #include <epan/stat_cmd_args.h>
53 #include <epan/dissectors/packet-ip.h>
54 #include "timestats.h"
55
56
57 /* For checksum */
58 #define BYTES 8
59 #define WRONG_CHKSUM 0
60
61 #define MERGED_FILES 2
62
63 #define TTL_SEARCH 5
64
65 /* information which will be printed */
66 typedef struct _for_print {
67         guint count;
68         guint16 cksum;
69         nstime_t predecessor_time;
70         struct _frame_info *partner;
71 } for_print;
72
73 /* each tracked packet */
74 typedef struct _frame_info {
75         for_print *fp;
76         guint32 num;
77         guint16 id;
78         guint8 ip_ttl;
79         address dl_dst;
80         nstime_t abs_ts, zebra_time, delta;
81 } frame_info;
82
83 /* used to keep track of the statistics for an entire program interface */
84 typedef struct _comparestat_t {
85         char *filter;
86         emem_tree_t *packet_tree, *ip_id_tree, *nr_tree;
87         address eth_dst, eth_src;
88         nstime_t zebra_time, current_time;
89         timestat_t stats;
90         GArray *ip_ttl_list;
91         gboolean last_hit;
92         guint32 start_ongoing_hits, stop_ongoing_hits, start_packet_nr_first, start_packet_nr_second, stop_packet_nr_first, stop_packet_nr_second;
93         guint32 first_file_amount, second_file_amount;
94 } comparestat_t;
95
96
97 /* to call directly _init */
98 static gdouble compare_variance=0.0;
99 static guint8 compare_start, compare_stop;
100 static gboolean TTL_method=TRUE, ON_method=TRUE;
101
102 /* This callback is never used by tshark but it is here for completeness. */
103 static void
104 comparestat_reset(void *dummy _U_)
105 {
106 }
107
108
109 /* This callback is invoked whenever the tap system has seen a packet
110  * we might be interested in.
111  * function returns :
112  *  0: no updates, no need to call (*draw) later
113  * !0: state has changed, call (*draw) sometime later
114  */
115 static int
116 comparestat_packet(void *arg, packet_info *pinfo, epan_dissect_t *edt _U_, const void *arg2)
117 {
118         comparestat_t *cs=arg;
119         const ws_ip *ci=arg2;
120         frame_info *fInfo;
121         vec_t cksum_vec[3];
122         guint16 computed_cksum=0;
123
124         /* so this get filled, usually with the first frame */
125         if(cs->eth_dst.len==0) {
126                 cs->eth_dst=pinfo->dl_dst;
127                 cs->eth_src=pinfo->dl_src;
128         }
129
130         /* Set up the fields of the pseudo-header and create checksum */
131         cksum_vec[0].ptr=&ci->ip_v_hl;
132         cksum_vec[0].len=BYTES;
133         /* skip TTL */
134         cksum_vec[1].ptr=&ci->ip_p;
135         cksum_vec[1].len=1;
136         /* skip header checksum and ip's (because of NAT)*/
137         cksum_vec[2].ptr=ci->ip_dst.data;
138         cksum_vec[2].ptr=cksum_vec[2].ptr+ci->ip_dst.len;
139         /* dynamic computation */
140         cksum_vec[2].len=pinfo->iphdrlen-20;
141         computed_cksum=in_cksum(&cksum_vec[0], 3);
142
143         /* collect all packet infos */
144         fInfo=(frame_info*)se_alloc(sizeof(frame_info));
145         fInfo->fp=(for_print*)se_alloc(sizeof(for_print));
146         fInfo->fp->partner=NULL;
147         fInfo->fp->count=1;
148         fInfo->fp->cksum=computed_cksum;
149         fInfo->num=pinfo->fd->num;
150         fInfo->id=ci->ip_id;
151         fInfo->ip_ttl=ci->ip_ttl;
152         fInfo->dl_dst=pinfo->dl_dst;
153         fInfo->abs_ts=pinfo->fd->abs_ts;
154         /* clean memory */
155         nstime_set_zero(&fInfo->zebra_time);
156         nstime_set_zero(&fInfo->fp->predecessor_time);
157         se_tree_insert32(cs->packet_tree, pinfo->fd->num, fInfo);
158
159         return 1;
160 }
161
162 /* Find equal packets, same IP-Id, count them and make time statistics */
163 static gboolean
164 call_foreach_count_ip_id(gpointer value, gpointer arg)
165 {
166         comparestat_t *cs=(comparestat_t*)arg;
167         frame_info *fInfo=(frame_info*)value, *fInfoTemp;
168         nstime_t delta;
169         guint i;
170
171         /* we only need one value out of pinfo we use a temp one */
172         packet_info *pinfo=(packet_info*)ep_alloc(sizeof(packet_info));
173         pinfo->fd=(frame_data*)ep_alloc(sizeof(frame_data));
174         pinfo->fd->num = fInfo->num;
175
176         fInfoTemp=se_tree_lookup32(cs->ip_id_tree, fInfo->id);
177         if(fInfoTemp==NULL){
178                 /* Detect ongoing package loss */
179                 if((cs->last_hit==FALSE)&&(cs->start_ongoing_hits>compare_start)&&(cs->stop_ongoing_hits<compare_stop)){
180                         cs->stop_ongoing_hits++;
181                         cs->stop_packet_nr_first=fInfo->num;
182                 } else if(cs->stop_ongoing_hits<compare_stop){
183                         cs->stop_ongoing_hits=0;
184                         cs->stop_packet_nr_first=G_MAXINT32;
185                 }
186                 cs->last_hit=FALSE;
187
188                 fInfo->fp->count=1;
189                 se_tree_insert32(cs->ip_id_tree, fInfo->id, fInfo);
190         } else {
191                 /* Detect ongoing package hits, special behavior if start is set to 0 */
192                 if((cs->last_hit||(compare_start==0))&&(cs->start_ongoing_hits<compare_start||(compare_start==0))){
193                         if((compare_start==0)&&(cs->start_ongoing_hits!=0)){
194                                 /* start from the first packet so allready set */
195                         } else {
196                                 cs->start_ongoing_hits++;
197                                 /* Take the lower number */
198                                 cs->start_packet_nr_first=fInfoTemp->num;
199                                 cs->start_packet_nr_second=fInfo->num;
200                         }
201                 } else if(cs->start_ongoing_hits<compare_start){
202                         cs->start_ongoing_hits=0;
203                         cs->start_packet_nr_first=G_MAXINT32;
204                 }
205                 cs->last_hit=TRUE;
206
207                 fInfo->fp->count=fInfoTemp->fp->count + 1;
208                 if(fInfoTemp->fp->cksum!=fInfo->fp->cksum){
209                         fInfo->fp->cksum=WRONG_CHKSUM;
210                         fInfoTemp->fp->cksum=WRONG_CHKSUM;
211                 }
212                 /* Add partner */
213                 fInfo->fp->partner=fInfoTemp;
214                 /* Create time statistic */
215                 if(fInfo->fp->count==MERGED_FILES){
216                         nstime_delta(&delta, &fInfo->abs_ts, &fInfoTemp->abs_ts);
217                         /* Set delta in both packets */
218                         nstime_set_zero(&fInfoTemp->delta);
219                         nstime_add(&fInfoTemp->delta, &delta);
220                         nstime_set_zero(&fInfo->delta);
221                         nstime_add(&fInfo->delta, &delta);
222                         time_stat_update(&cs->stats, &delta, pinfo);
223                 }
224                 se_tree_insert32(cs->ip_id_tree, fInfo->id, fInfo);
225         }
226
227         /* collect TTL's */
228         if(TTL_method && (fInfo->num<TTL_SEARCH)){
229                 for(i=0; i < cs->ip_ttl_list->len; i++){
230                         if(g_array_index(cs->ip_ttl_list, guint8, i) == fInfo->ip_ttl){
231                                 return FALSE;
232                         }
233                 }
234                 g_array_append_val(cs->ip_ttl_list, fInfo->ip_ttl);
235         }
236
237         return FALSE;
238 }
239
240 /*Create new numbering */
241 static gboolean
242 call_foreach_new_order(gpointer value, gpointer arg)
243 {
244         comparestat_t *cs=(comparestat_t*)arg;
245         frame_info *fInfo=(frame_info*)value, *fInfoTemp;
246
247         /* overwrite Info column for new ordering */
248         fInfoTemp=se_tree_lookup32(cs->nr_tree, fInfo->id);
249         if(fInfoTemp==NULL){
250                 if(TTL_method==FALSE){
251                         if((ADDRESSES_EQUAL(&cs->eth_dst, &fInfo->dl_dst)) || (ADDRESSES_EQUAL(&cs->eth_src, &fInfo->dl_dst))){
252                                 se_tree_insert32(cs->nr_tree, fInfo->id, fInfo);
253                                 fInfo->zebra_time=cs->zebra_time;
254                                 cs->zebra_time.nsecs=cs->zebra_time.nsecs + MERGED_FILES;
255                         } else {
256                                 cs->zebra_time.nsecs++;
257                                 se_tree_insert32(cs->nr_tree, fInfo->id, fInfo);
258                                 fInfo->zebra_time=cs->zebra_time;
259                                 cs->zebra_time.nsecs++;
260                         }
261                 } else {
262                         if((g_array_index(cs->ip_ttl_list, guint8, 0)==fInfo->ip_ttl) || (g_array_index(cs->ip_ttl_list, guint8, 1)==fInfo->ip_ttl)){
263                                 se_tree_insert32(cs->nr_tree, fInfo->id, fInfo);
264                                 fInfo->zebra_time=cs->zebra_time;
265                                 cs->zebra_time.nsecs=cs->zebra_time.nsecs + MERGED_FILES;
266                         } else {
267                                 cs->zebra_time.nsecs++;
268                                 se_tree_insert32(cs->nr_tree, fInfo->id, fInfo);
269                                 fInfo->zebra_time=cs->zebra_time;
270                                 cs->zebra_time.nsecs++;
271                         }
272
273                 }
274         } else {
275                 if(TTL_method==FALSE){
276                         if(((ADDRESSES_EQUAL(&cs->eth_dst, &fInfo->dl_dst)) || (ADDRESSES_EQUAL(&cs->eth_src, &fInfo->dl_dst)))&&(!fmod(fInfoTemp->zebra_time.nsecs,MERGED_FILES))){
277                                 fInfo->zebra_time.nsecs=fInfoTemp->zebra_time.nsecs;
278                         } else {
279                                 fInfo->zebra_time.nsecs=fInfoTemp->zebra_time.nsecs+1;
280                         }
281                 } else {
282                         if(((g_array_index(cs->ip_ttl_list, guint8, 0)==fInfo->ip_ttl) || (g_array_index(cs->ip_ttl_list, guint8, 1)==fInfo->ip_ttl))&&(!fmod(fInfoTemp->zebra_time.nsecs,MERGED_FILES))){
283                                 fInfo->zebra_time.nsecs=fInfoTemp->zebra_time.nsecs;
284                         } else {
285                                 fInfo->zebra_time.nsecs=fInfoTemp->zebra_time.nsecs+1;
286                         }
287                 }
288         }
289
290         /* count packets of file */
291         if(fmod(fInfo->zebra_time.nsecs, MERGED_FILES)){
292                 cs->first_file_amount++;
293         } else {
294                 cs->second_file_amount++;
295         }
296
297         /* ordering */
298         if(!nstime_is_unset(&cs->current_time)){
299                 fInfo->fp->predecessor_time.nsecs=cs->current_time.nsecs;
300         }
301
302         cs->current_time.nsecs=fInfo->zebra_time.nsecs;
303
304         return FALSE;
305 }
306
307 /* calculate scopes if not set yet */
308 static gboolean
309 call_foreach_merge_settings(gpointer value, gpointer arg)
310 {
311         comparestat_t *cs=(comparestat_t*)arg;
312         frame_info *fInfo=(frame_info*)value, *fInfoTemp=NULL;
313         guint32 tot_packet_amount=cs->first_file_amount+cs->second_file_amount, swap;
314
315         if((fInfo->num==tot_packet_amount)&&(cs->stop_packet_nr_first!=G_MAXINT32)){
316                 /* calculate missing stop number */
317                 swap=cs->stop_packet_nr_first;
318                 cs->stop_packet_nr_first=tot_packet_amount-cs->second_file_amount;;
319                 cs->stop_packet_nr_second=swap;
320         }
321
322         if((fInfo->num==tot_packet_amount)&&(cs->stop_packet_nr_first==G_MAXINT32)&&(cs->start_packet_nr_first!=G_MAXINT32)){
323                 fInfoTemp=se_tree_lookup32(cs->packet_tree, cs->start_packet_nr_first);
324                 if(fInfoTemp==NULL){
325                         printf("ERROR: start number not set correctly\n");
326                         return FALSE;
327                 }
328                 if(fmod(fInfoTemp->zebra_time.nsecs, 2)){
329                         /*first file*/
330                         cs->stop_packet_nr_first=cs->start_packet_nr_first+abs(cs->second_file_amount-(cs->start_packet_nr_second-cs->first_file_amount));
331                         if(cs->stop_packet_nr_first>(tot_packet_amount-cs->second_file_amount)){
332                                 cs->stop_packet_nr_first=tot_packet_amount-cs->second_file_amount;
333                         }
334                         /*this only happens if we have too many MAC's or TTL*/
335                         if(cs->stop_packet_nr_first>cs->start_packet_nr_second){
336                                 cs->stop_packet_nr_first=cs->start_packet_nr_second-1;
337                         }
338                         fInfoTemp=se_tree_lookup32(cs->packet_tree, cs->stop_packet_nr_first);
339                         while((fInfoTemp!=NULL)?fmod(!fInfoTemp->zebra_time.nsecs, 2):TRUE){
340                                 cs->stop_packet_nr_first--;
341                                 fInfoTemp=se_tree_lookup32(cs->packet_tree, cs->stop_packet_nr_first);
342                         }
343                 } else {
344                         /*this only happens if we have too many MAC's or TTL*/
345                         cs->stop_packet_nr_first=cs->first_file_amount+cs->start_packet_nr_first;
346                         if(cs->stop_packet_nr_first>tot_packet_amount-cs->first_file_amount){
347                                 cs->stop_packet_nr_first=tot_packet_amount-cs->first_file_amount;
348                         }
349                         fInfoTemp=se_tree_lookup32(cs->packet_tree, cs->stop_packet_nr_first);
350                         while((fInfoTemp!=NULL)?fmod(fInfoTemp->zebra_time.nsecs, 2):TRUE){
351                                 cs->stop_packet_nr_first--;
352                                 fInfoTemp=se_tree_lookup32(cs->packet_tree, cs->stop_packet_nr_first);
353                         }
354                 }
355                 /* set second stop location */
356                 cs->stop_packet_nr_second=cs->start_packet_nr_second+abs(cs->stop_packet_nr_first-cs->start_packet_nr_first);
357                 if(cs->stop_packet_nr_second>tot_packet_amount){
358                         cs->stop_packet_nr_second=tot_packet_amount;
359                 }
360         }
361
362         /* no start found */
363         if(fInfo->num==tot_packet_amount&&compare_start!=0&&compare_stop!=0){
364                 if(cs->start_packet_nr_first==G_MAXINT32){
365                         printf("Start point couldn't be set, choose a lower compare start");
366                 }
367         }
368
369         return FALSE;
370 }
371
372 static gboolean
373 call_foreach_print_ip_tree(gpointer value, gpointer user_data)
374 {
375         frame_info *fInfo=(frame_info*)value;
376         comparestat_t *cs=(comparestat_t*)user_data;
377         gdouble delta, average;
378         gboolean show_it=FALSE;
379
380         delta=fabs(get_average(&fInfo->delta,1));
381         average=fabs(get_average(&cs->stats.tot, cs->stats.num));
382
383         /* special case if both are set to zero ignore start and stop numbering */
384         if(compare_start!=0&&compare_stop!=0){
385                 /* check out if packet is in searched scope */
386                 if((cs->start_packet_nr_first<fInfo->num)&&(cs->stop_packet_nr_first>fInfo->num)){
387                         show_it=TRUE;
388                 } else {
389                         /* so we won't miss the other file */
390                         if((fInfo->num>cs->start_packet_nr_second)&&(fInfo->num<cs->stop_packet_nr_second)){
391                                 show_it=TRUE;
392                         }
393                 }
394         } else {
395                 show_it=TRUE;
396         }
397
398         if(show_it){
399                 if(fInfo->fp->count < MERGED_FILES){
400                         printf("Packet id :%i, count:%i Problem:", fInfo->id, fInfo->fp->count);
401                         printf("Packet lost\n");
402                 }
403                 if(fInfo->fp->count > MERGED_FILES){
404                         printf("Packet id :%i, count:%i Problem:", fInfo->id, fInfo->fp->count);
405                         printf("More than two packets\n");
406                         if(fInfo->fp->cksum == WRONG_CHKSUM){
407                                 printf("Checksum error over IP header\n");
408                         }
409                 }
410                 if(fInfo->fp->count == MERGED_FILES){
411                         if(fInfo->fp->cksum == WRONG_CHKSUM){
412                                 printf("Packet id :%i, count:%i Problem:", fInfo->id, fInfo->fp->count);
413                                 printf("Checksum error over IP header\n");
414                                 if(((delta < (average-cs->stats.variance)) || (delta > (average+cs->stats.variance))) && (delta > 0.0) && (cs->stats.variance!=0)){
415                                         printf("Not arrived in time\n");
416                                 }
417                                 if((nstime_cmp(&fInfo->fp->predecessor_time, &fInfo->zebra_time)>0||nstime_cmp(&fInfo->fp->partner->fp->predecessor_time, &fInfo->fp->partner->zebra_time)>0) && (fInfo->zebra_time.nsecs!=MERGED_FILES) && ON_method){
418                                         printf("Not correct order\n");
419                                 }
420                         } else if(((delta < (average-cs->stats.variance)) || (delta > (average+cs->stats.variance))) && (delta > 0.0) && (cs->stats.variance!=0)) {
421                                 printf("Packet id :%i, count:%i Problem:", fInfo->id, fInfo->fp->count);
422                                 printf("Package not arrived in time\n");
423                                 if((nstime_cmp(&fInfo->fp->predecessor_time, &fInfo->zebra_time)>0||nstime_cmp(&fInfo->fp->partner->fp->predecessor_time, &fInfo->fp->partner->zebra_time)>0) && fInfo->zebra_time.nsecs != MERGED_FILES && ON_method){
424                                         printf("Not correct order\n");
425                                 }
426                         } else if((nstime_cmp(&fInfo->fp->predecessor_time, &fInfo->zebra_time)>0||nstime_cmp(&fInfo->fp->partner->fp->predecessor_time, &fInfo->fp->partner->zebra_time)>0) && fInfo->zebra_time.nsecs != MERGED_FILES && ON_method){
427                                 printf("Packet id :%i, count:%i Problem:", fInfo->id, fInfo->fp->count);
428                                 printf("Not correct order\n");
429                         }
430                 }
431         }
432         return FALSE;
433 }
434
435
436 /* This callback is used when tshark wants us to draw/update our
437  * data to the output device. Since this is tshark only output is
438  * stdout.
439  * TShark will only call this callback once, which is when tshark has
440  * finished reading all packets and exists.
441  * If used with wireshark this may be called any time, perhaps once every 3
442  * seconds or so.
443  * This function may even be called in parallell with (*reset) or (*draw)
444  * so make sure there are no races. The data in the rpcstat_t can thus change
445  * beneath us. Beware.
446  */
447 static void
448 comparestat_draw(void *prs)
449 {
450         comparestat_t *cs=prs;
451         GString *filter_str = g_string_new("");
452         const gchar *statis_string;
453         guint32 first_file_amount, second_file_amount;
454
455         /* inital steps, clear all data before start*/
456         cs->zebra_time.secs=0;
457         cs->zebra_time.nsecs=1;
458         nstime_set_unset(&cs->current_time);
459         cs->ip_ttl_list=g_array_new(FALSE, FALSE, sizeof(guint8));
460         cs->last_hit=FALSE;
461         cs->start_ongoing_hits=0;
462         cs->stop_ongoing_hits=0;
463         cs->start_packet_nr_first=G_MAXINT32;
464         cs->start_packet_nr_second=G_MAXINT32;
465         cs->stop_packet_nr_first=G_MAXINT32;
466         cs->stop_packet_nr_second=G_MAXINT32;
467         cs->first_file_amount=0;
468         cs->second_file_amount=0;
469
470         time_stat_init(&cs->stats);
471         /* not using g_free, because struct is managed by binarytrees */
472         cs->ip_id_tree=se_tree_create(EMEM_TREE_TYPE_RED_BLACK, "ip_id_tree");
473         emem_tree_foreach(cs->packet_tree, call_foreach_count_ip_id, cs);
474
475         /* set up TTL choice if only one number found */
476         if(TTL_method&&cs->ip_ttl_list->len==1){
477                 g_array_append_val(cs->ip_ttl_list, g_array_index(cs->ip_ttl_list, guint8, 1));
478         }
479
480         emem_tree_foreach(cs->packet_tree, call_foreach_new_order,cs);
481         emem_tree_foreach(cs->packet_tree, call_foreach_merge_settings, cs);
482
483         /* remembering file amounts */
484         first_file_amount=cs->first_file_amount;
485         second_file_amount=cs->second_file_amount;
486         /* reset after numbering */
487         cs->nr_tree=se_tree_create(EMEM_TREE_TYPE_RED_BLACK, "nr_tree");
488
489         /* Variance */
490         cs->stats.variance=compare_variance;
491
492         /* add statistic string */
493         statis_string=g_strdup_printf("Compare Statistics: \nNumber of packets total:%i 1st file:%i, 2nd file:%i\nScopes:\t start:%i stop:%i\nand:\t start:%i stop:%i\nEqual packets: %i \nAllowed variation: %f \nAverage time difference: %f\n", (first_file_amount+second_file_amount), first_file_amount, second_file_amount, cs->start_packet_nr_first, cs->stop_packet_nr_first, cs->start_packet_nr_second, cs->stop_packet_nr_second, cs->stats.num, cs->stats.variance, fabs(get_average(&cs->stats.tot, cs->stats.num)));
494
495         printf("\n");
496         printf("===================================================================\n");
497         printf("%s", statis_string);
498         emem_tree_foreach(cs->ip_id_tree, call_foreach_print_ip_tree, cs);
499         printf("===================================================================\n");
500         g_string_free(filter_str, TRUE);
501         g_array_free(cs->ip_ttl_list, TRUE);
502 }
503
504 /* When called, this function will create a new instance of comparestat.
505  * This function is called from tshark when it parses the -z compare, arguments
506  * and it creates a new instance to store statistics in and registers this
507  * new instance for the compare tap.
508  */
509 static void
510 comparestat_init(const char *optarg, void* userdata _U_)
511 {
512         comparestat_t *cs;
513         const char *filter=NULL;
514         GString *error_string;
515         gint start, stop,ttl, order, pos=0;
516         gdouble variance;
517
518         if(sscanf(optarg,"compare,%d,%d,%d,%d,%lf,%n",&start, &stop, &ttl, &order, &variance, &pos)==5){
519                 if(pos){
520                         filter=optarg+pos;
521                 } else {
522                         filter=NULL;
523                 }
524         } else {
525                 fprintf(stderr, "tshark: invalid \"-z compare,<start>,<stop>,<ttl[0|1]>,<order[0|1]>,<variance>[,<filter>]\" argument\n");
526                 exit(1);
527         }
528
529         compare_variance=variance;
530         compare_start=start;
531         compare_stop=stop;
532         TTL_method=ttl;
533         ON_method=order;
534
535         cs=g_malloc(sizeof(comparestat_t));
536         nstime_set_unset(&cs->current_time);
537         cs->ip_ttl_list=g_array_new(FALSE, FALSE, sizeof(guint8));
538         cs->last_hit=FALSE;
539         cs->start_ongoing_hits=0;
540         cs->stop_ongoing_hits=0;
541         cs->start_packet_nr_first=G_MAXINT32;
542         cs->start_packet_nr_second=G_MAXINT32;
543         cs->stop_packet_nr_first=G_MAXINT32;
544         cs->stop_packet_nr_second=G_MAXINT32;
545         cs->first_file_amount=0;
546         cs->second_file_amount=0;
547
548         cs->zebra_time.secs=0;
549         cs->zebra_time.nsecs=1;
550         cs->nr_tree=se_tree_create(EMEM_TREE_TYPE_RED_BLACK, "nr_tree");
551         /* microsecond precision */
552         timestamp_set_precision(TS_PREC_AUTO_NSEC);
553
554         if(filter){
555                 cs->filter=g_strdup(filter);
556         } else {
557                 cs->filter=NULL;
558         }
559
560         /* create a Hash to count the packets with the same ip.id */
561         cs->packet_tree=se_tree_create(EMEM_TREE_TYPE_RED_BLACK, "Packet_info_tree");
562
563         error_string=register_tap_listener("ip", cs, filter, 0, comparestat_reset, comparestat_packet, comparestat_draw);
564         if(error_string){
565                 /* error, we failed to attach to the tap. clean up */
566                 g_free(cs->filter);
567                 g_free(cs);
568
569                 fprintf(stderr, "tshark: Couldn't register compare tap: %s\n", error_string->str);
570                 g_string_free(error_string, TRUE);
571                 exit(1);
572         }
573 }
574
575
576 void
577 register_tap_listener_comparestat(void)
578 {
579         register_stat_cmd_arg("compare,", comparestat_init,NULL);
580 }