tap-comparestat.c

   1 /* tap-comparestat.c
   2  * Compare two capture files
   3  * Copyright 2008 Vincenzo Condoleo, Christophe Dirac, Reto Ruoss
   4  * supported by HSR (Hochschule Rapperswil)
   5  *
   6  * $Id$
   7  *
   8  * Wireshark - Network traffic analyzer
   9  * By Gerald Combs <gerald@wireshark.org>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 /* This module provides statistics about two merged capture files, to find packet loss,
  28  * time delay, ip header checksum errors and order check to tshark.
  29  * It's also detecting the matching regions of the different files.
  30  *
  31  * The packets are compared by the ip id. MAC or TTL is used to distinct the different files.
  32  * It is only used by tshark and not wireshark
  33  */
  34
  35 #ifdef HAVE_CONFIG_H
  36 # include "config.h"
  37 #endif
  38
  39 #include <stdio.h>
  40 #include <math.h>
  41
  42 #ifdef HAVE_SYS_TYPES_H
  43 # include <sys/types.h>
  44 #endif
  45
  46 #include <string.h>
  47 #include "epan/packet_info.h"
  48 #include <epan/in_cksum.h>
  49 #include <epan/packet.h>
  50 #include <epan/tap.h>
  51 #include <epan/timestamp.h>
  52 #include <epan/stat_cmd_args.h>
  53 #include <epan/dissectors/packet-ip.h>
  54 #include "register.h"
  55 #include "timestats.h"
  56
  57
  58 /* For checksum */
  59 #define BYTES 8
  60 #define WRONG_CHKSUM 0
  61
  62 #define MERGED_FILES 2
  63
  64 #define TTL_SEARCH 5
  65
  66 /* information which will be printed */
  67 typedef struct _for_print {
  68         guint count;
  69         guint16 cksum;
  70         nstime_t predecessor_time;
  71         struct _frame_info *partner;
  72 } for_print;
  73
  74 /* each tracked packet */
  75 typedef struct _frame_info {
  76         for_print *fp;
  77         guint32 num;
  78         guint16 id;
  79         guint8 ip_ttl;
  80         address dl_dst;
  81         nstime_t abs_ts, zebra_time, delta;
  82 } frame_info;
  83
  84 /* used to keep track of the statistics for an entire program interface */
  85 typedef struct _comparestat_t {
  86         char *filter;
  87         emem_tree_t *packet_tree, *ip_id_tree, *nr_tree;
  88         address eth_dst, eth_src;
  89         nstime_t zebra_time, current_time;
  90         timestat_t stats;
  91         GArray *ip_ttl_list;
  92         gboolean last_hit;
  93         guint32 start_ongoing_hits, stop_ongoing_hits, start_packet_nr_first, start_packet_nr_second, stop_packet_nr_first, stop_packet_nr_second;
  94         guint32 first_file_amount, second_file_amount;
  95 } comparestat_t;
  96
  97
  98 /* to call directly _init */
  99 static gdouble compare_variance=0.0;
 100 static guint8 compare_start, compare_stop;
 101 static gboolean TTL_method=TRUE, ON_method=TRUE;
 102
 103 /* This callback is never used by tshark but it is here for completeness. */
 104 static void
 105 comparestat_reset(void *dummy _U_)
 106 {
 107 }
 108
 109
 110 /* This callback is invoked whenever the tap system has seen a packet
 111  * we might be interested in.
 112  * function returns :
 113  *  0: no updates, no need to call (*draw) later
 114  * !0: state has changed, call (*draw) sometime later
 115  */
 116 static int
 117 comparestat_packet(void *arg, packet_info *pinfo, epan_dissect_t *edt _U_, const void *arg2)
 118 {
 119         comparestat_t *cs=arg;
 120         const ws_ip *ci=arg2;
 121         frame_info *fInfo;
 122         vec_t cksum_vec[3];
 123         guint16 computed_cksum=0;
 124
 125         /* so this get filled, usually with the first frame */
 126         if(cs->eth_dst.len==0) {
 127                 cs->eth_dst=pinfo->dl_dst;
 128                 cs->eth_src=pinfo->dl_src;
 129         }
 130
 131         /* Set up the fields of the pseudo-header and create checksum */
 132         cksum_vec[0].ptr=&ci->ip_v_hl;
 133         cksum_vec[0].len=BYTES;
 134         /* skip TTL */
 135         cksum_vec[1].ptr=&ci->ip_p;
 136         cksum_vec[1].len=1;
 137         /* skip header checksum and ip's (because of NAT)*/
 138         cksum_vec[2].ptr=ci->ip_dst.data;
 139         cksum_vec[2].ptr=cksum_vec[2].ptr+ci->ip_dst.len;
 140         /* dynamic computation */
 141         cksum_vec[2].len=pinfo->iphdrlen-20;
 142         computed_cksum=in_cksum(&cksum_vec[0], 3);
 143
 144         /* collect all packet infos */
 145         fInfo=(frame_info*)se_alloc(sizeof(frame_info));
 146         fInfo->fp=(for_print*)se_alloc(sizeof(for_print));
 147         fInfo->fp->partner=NULL;
 148         fInfo->fp->count=1;
 149         fInfo->fp->cksum=computed_cksum;
 150         fInfo->num=pinfo->fd->num;
 151         fInfo->id=ci->ip_id;
 152         fInfo->ip_ttl=ci->ip_ttl;
 153         fInfo->dl_dst=pinfo->dl_dst;
 154         fInfo->abs_ts=pinfo->fd->abs_ts;
 155         /* clean memory */
 156         nstime_set_zero(&fInfo->zebra_time);
 157         nstime_set_zero(&fInfo->fp->predecessor_time);
 158         se_tree_insert32(cs->packet_tree, pinfo->fd->num, fInfo);
 159
 160         return 1;
 161 }
 162
 163 /* Find equal packets, same IP-Id, count them and make time statistics */
 164 static gboolean
 165 call_foreach_count_ip_id(gpointer value, gpointer arg)
 166 {
 167         comparestat_t *cs=(comparestat_t*)arg;
 168         frame_info *fInfo=(frame_info*)value, *fInfoTemp;
 169         nstime_t delta;
 170         guint i;
 171
 172         /* we only need one value out of pinfo we use a temp one */
 173         packet_info *pinfo=(packet_info*)ep_alloc(sizeof(packet_info));
 174         pinfo->fd=(frame_data*)ep_alloc(sizeof(frame_data));
 175         pinfo->fd->num = fInfo->num;
 176
 177         fInfoTemp=se_tree_lookup32(cs->ip_id_tree, fInfo->id);
 178         if(fInfoTemp==NULL){
 179                 /* Detect ongoing package loss */
 180                 if((cs->last_hit==FALSE)&&(cs->start_ongoing_hits>compare_start)&&(cs->stop_ongoing_hits<compare_stop)){
 181                         cs->stop_ongoing_hits++;
 182                         cs->stop_packet_nr_first=fInfo->num;
 183                 } else if(cs->stop_ongoing_hits<compare_stop){
 184                         cs->stop_ongoing_hits=0;
 185                         cs->stop_packet_nr_first=G_MAXINT32;
 186                 }
 187                 cs->last_hit=FALSE;
 188
 189                 fInfo->fp->count=1;
 190                 se_tree_insert32(cs->ip_id_tree, fInfo->id, fInfo);
 191         } else {
 192                 /* Detect ongoing package hits, special behavior if start is set to 0 */
 193                 if((cs->last_hit||(compare_start==0))&&(cs->start_ongoing_hits<compare_start||(compare_start==0))){
 194                         if((compare_start==0)&&(cs->start_ongoing_hits!=0)){
 195                                 /* start from the first packet so allready set */
 196                         } else {
 197                                 cs->start_ongoing_hits++;
 198                                 /* Take the lower number */
 199                                 cs->start_packet_nr_first=fInfoTemp->num;
 200                                 cs->start_packet_nr_second=fInfo->num;
 201                         }
 202                 } else if(cs->start_ongoing_hits<compare_start){
 203                         cs->start_ongoing_hits=0;
 204                         cs->start_packet_nr_first=G_MAXINT32;
 205                 }
 206                 cs->last_hit=TRUE;
 207
 208                 fInfo->fp->count=fInfoTemp->fp->count + 1;
 209                 if(fInfoTemp->fp->cksum!=fInfo->fp->cksum){
 210                         fInfo->fp->cksum=WRONG_CHKSUM;
 211                         fInfoTemp->fp->cksum=WRONG_CHKSUM;
 212                 }
 213                 /* Add partner */
 214                 fInfo->fp->partner=fInfoTemp;
 215                 /* Create time statistic */
 216                 if(fInfo->fp->count==MERGED_FILES){
 217                         nstime_delta(&delta, &fInfo->abs_ts, &fInfoTemp->abs_ts);
 218                         /* Set delta in both packets */
 219                         nstime_set_zero(&fInfoTemp->delta);
 220                         nstime_add(&fInfoTemp->delta, &delta);
 221                         nstime_set_zero(&fInfo->delta);
 222                         nstime_add(&fInfo->delta, &delta);
 223                         time_stat_update(&cs->stats, &delta, pinfo);
 224                 }
 225                 se_tree_insert32(cs->ip_id_tree, fInfo->id, fInfo);
 226         }
 227
 228         /* collect TTL's */
 229         if(TTL_method && (fInfo->num<TTL_SEARCH)){
 230                 for(i=0; i < cs->ip_ttl_list->len; i++){
 231                         if(g_array_index(cs->ip_ttl_list, guint8, i) == fInfo->ip_ttl){
 232                                 return FALSE;
 233                         }
 234                 }
 235                 g_array_append_val(cs->ip_ttl_list, fInfo->ip_ttl);
 236         }
 237
 238         return FALSE;
 239 }
 240
 241 /*Create new numbering */
 242 static gboolean
 243 call_foreach_new_order(gpointer value, gpointer arg)
 244 {
 245         comparestat_t *cs=(comparestat_t*)arg;
 246         frame_info *fInfo=(frame_info*)value, *fInfoTemp;
 247
 248         /* overwrite Info column for new ordering */
 249         fInfoTemp=se_tree_lookup32(cs->nr_tree, fInfo->id);
 250         if(fInfoTemp==NULL){
 251                 if(TTL_method==FALSE){
 252                         if((ADDRESSES_EQUAL(&cs->eth_dst, &fInfo->dl_dst)) || (ADDRESSES_EQUAL(&cs->eth_src, &fInfo->dl_dst))){
 253                                 se_tree_insert32(cs->nr_tree, fInfo->id, fInfo);
 254                                 fInfo->zebra_time=cs->zebra_time;
 255                                 cs->zebra_time.nsecs=cs->zebra_time.nsecs + MERGED_FILES;
 256                         } else {
 257                                 cs->zebra_time.nsecs++;
 258                                 se_tree_insert32(cs->nr_tree, fInfo->id, fInfo);
 259                                 fInfo->zebra_time=cs->zebra_time;
 260                                 cs->zebra_time.nsecs=cs->zebra_time.nsecs++;
 261                         }
 262                 } else {
 263                         if((g_array_index(cs->ip_ttl_list, guint8, 0)==fInfo->ip_ttl) || (g_array_index(cs->ip_ttl_list, guint8, 1)==fInfo->ip_ttl)){
 264                                 se_tree_insert32(cs->nr_tree, fInfo->id, fInfo);
 265                                 fInfo->zebra_time=cs->zebra_time;
 266                                 cs->zebra_time.nsecs=cs->zebra_time.nsecs + MERGED_FILES;
 267                         } else {
 268                                 cs->zebra_time.nsecs++;
 269                                 se_tree_insert32(cs->nr_tree, fInfo->id, fInfo);
 270                                 fInfo->zebra_time=cs->zebra_time;
 271                                 cs->zebra_time.nsecs=cs->zebra_time.nsecs++;
 272                         }
 273
 274                 }
 275         } else {
 276                 if(TTL_method==FALSE){
 277                         if(((ADDRESSES_EQUAL(&cs->eth_dst, &fInfo->dl_dst)) || (ADDRESSES_EQUAL(&cs->eth_src, &fInfo->dl_dst)))&&(!fmod(fInfoTemp->zebra_time.nsecs,MERGED_FILES))){
 278                                 fInfo->zebra_time.nsecs=fInfoTemp->zebra_time.nsecs;
 279                         } else {
 280                                 fInfo->zebra_time.nsecs=fInfoTemp->zebra_time.nsecs+1;
 281                         }
 282                 } else {
 283                         if(((g_array_index(cs->ip_ttl_list, guint8, 0)==fInfo->ip_ttl) || (g_array_index(cs->ip_ttl_list, guint8, 1)==fInfo->ip_ttl))&&(!fmod(fInfoTemp->zebra_time.nsecs,MERGED_FILES))){
 284                                 fInfo->zebra_time.nsecs=fInfoTemp->zebra_time.nsecs;
 285                         } else {
 286                                 fInfo->zebra_time.nsecs=fInfoTemp->zebra_time.nsecs+1;
 287                         }
 288                 }
 289         }
 290
 291         /* count packets of file */
 292         if(fmod(fInfo->zebra_time.nsecs, MERGED_FILES)){
 293                 cs->first_file_amount++;
 294         } else {
 295                 cs->second_file_amount++;
 296         }
 297
 298         /* ordering */
 299         if(!nstime_is_unset(&cs->current_time)){
 300                 fInfo->fp->predecessor_time.nsecs=cs->current_time.nsecs;
 301         }
 302
 303         cs->current_time.nsecs=fInfo->zebra_time.nsecs;
 304
 305         return FALSE;
 306 }
 307
 308 /* calculate scopes if not set yet */
 309 static gboolean
 310 call_foreach_merge_settings(gpointer value, gpointer arg)
 311 {
 312         comparestat_t *cs=(comparestat_t*)arg;
 313         frame_info *fInfo=(frame_info*)value, *fInfoTemp=NULL;
 314         guint32 tot_packet_amount=cs->first_file_amount+cs->second_file_amount, swap;
 315
 316         if((fInfo->num==tot_packet_amount)&&(cs->stop_packet_nr_first!=G_MAXINT32)){
 317                 /* calculate missing stop number */
 318                 swap=cs->stop_packet_nr_first;
 319                 cs->stop_packet_nr_first=tot_packet_amount-cs->second_file_amount;;
 320                 cs->stop_packet_nr_second=swap;
 321         }
 322
 323         if((fInfo->num==tot_packet_amount)&&(cs->stop_packet_nr_first==G_MAXINT32)&&(cs->start_packet_nr_first!=G_MAXINT32)){
 324                 fInfoTemp=se_tree_lookup32(cs->packet_tree, cs->start_packet_nr_first);
 325                 if(fInfoTemp==NULL){
 326                         printf("ERROR: start number not set correctly\n");
 327                         return FALSE;
 328                 }
 329                 if(fmod(fInfoTemp->zebra_time.nsecs, 2)){
 330                         /*first file*/
 331                         cs->stop_packet_nr_first=cs->start_packet_nr_first+abs(cs->second_file_amount-(cs->start_packet_nr_second-cs->first_file_amount));
 332                         if(cs->stop_packet_nr_first>(tot_packet_amount-cs->second_file_amount)){
 333                                 cs->stop_packet_nr_first=tot_packet_amount-cs->second_file_amount;
 334                         }
 335                         /*this only happens if we have too many MAC's or TTL*/
 336                         if(cs->stop_packet_nr_first>cs->start_packet_nr_second){
 337                                 cs->stop_packet_nr_first=cs->start_packet_nr_second-1;
 338                         }
 339                         fInfoTemp=se_tree_lookup32(cs->packet_tree, cs->stop_packet_nr_first);
 340                         while((fInfoTemp!=NULL)?fmod(!fInfoTemp->zebra_time.nsecs, 2):TRUE){
 341                                 cs->stop_packet_nr_first--;
 342                                 fInfoTemp=se_tree_lookup32(cs->packet_tree, cs->stop_packet_nr_first);
 343                         }
 344                 } else {
 345                         /*this only happens if we have too many MAC's or TTL*/
 346                         cs->stop_packet_nr_first=cs->first_file_amount+cs->start_packet_nr_first;
 347                         if(cs->stop_packet_nr_first>tot_packet_amount-cs->first_file_amount){
 348                                 cs->stop_packet_nr_first=tot_packet_amount-cs->first_file_amount;
 349                         }
 350                         fInfoTemp=se_tree_lookup32(cs->packet_tree, cs->stop_packet_nr_first);
 351                         while((fInfoTemp!=NULL)?fmod(fInfoTemp->zebra_time.nsecs, 2):TRUE){
 352                                 cs->stop_packet_nr_first--;
 353                                 fInfoTemp=se_tree_lookup32(cs->packet_tree, cs->stop_packet_nr_first);
 354                         }
 355                 }
 356                 /* set second stop location */
 357                 cs->stop_packet_nr_second=cs->start_packet_nr_second+abs(cs->stop_packet_nr_first-cs->start_packet_nr_first);
 358                 if(cs->stop_packet_nr_second>tot_packet_amount){
 359                         cs->stop_packet_nr_second=tot_packet_amount;
 360                 }
 361         }
 362
 363         /* no start found */
 364         if(fInfo->num==tot_packet_amount&&compare_start!=0&&compare_stop!=0){
 365                 if(cs->start_packet_nr_first==G_MAXINT32){
 366                         printf("Start point couldn't be set, choose a lower compare start");
 367                 }
 368         }
 369
 370         return FALSE;
 371 }
 372
 373 static gboolean
 374 call_foreach_print_ip_tree(gpointer value, gpointer user_data)
 375 {
 376         frame_info *fInfo=(frame_info*)value;
 377         comparestat_t *cs=(comparestat_t*)user_data;
 378         gdouble delta, average;
 379         gboolean show_it=FALSE;
 380
 381         delta=fabs(get_average(&fInfo->delta,1));
 382         average=fabs(get_average(&cs->stats.tot, cs->stats.num));
 383
 384         /* special case if both are set to zero ignore start and stop numbering */
 385         if(compare_start!=0&&compare_stop!=0){
 386                 /* check out if packet is in searched scope */
 387                 if((cs->start_packet_nr_first<fInfo->num)&&(cs->stop_packet_nr_first>fInfo->num)){
 388                         show_it=TRUE;
 389                 } else {
 390                         /* so we won't miss the other file */
 391                         if((fInfo->num>cs->start_packet_nr_second)&&(fInfo->num<cs->stop_packet_nr_second)){
 392                                 show_it=TRUE;
 393                         }
 394                 }
 395         } else {
 396                 show_it=TRUE;
 397         }
 398
 399         if(show_it){
 400                 if(fInfo->fp->count < MERGED_FILES){
 401                         printf("Packet id :%i, count:%i Problem:", fInfo->id, fInfo->fp->count);
 402                         printf("Packet lost\n");
 403                 }
 404                 if(fInfo->fp->count > MERGED_FILES){
 405                         printf("Packet id :%i, count:%i Problem:", fInfo->id, fInfo->fp->count);
 406                         printf("More than two packets\n");
 407                         if(fInfo->fp->cksum == WRONG_CHKSUM){
 408                                 printf("Checksum error over IP header\n");
 409                         }
 410                 }
 411                 if(fInfo->fp->count == MERGED_FILES){
 412                         if(fInfo->fp->cksum == WRONG_CHKSUM){
 413                                 printf("Packet id :%i, count:%i Problem:", fInfo->id, fInfo->fp->count);
 414                                 printf("Checksum error over IP header\n");
 415                                 if(((delta < (average-cs->stats.variance)) || (delta > (average+cs->stats.variance))) && (delta > 0.0) && (cs->stats.variance!=0)){
 416                                         printf("Not arrived in time\n");
 417                                 }
 418                                 if((nstime_cmp(&fInfo->fp->predecessor_time, &fInfo->zebra_time)>0||nstime_cmp(&fInfo->fp->partner->fp->predecessor_time, &fInfo->fp->partner->zebra_time)>0) && (fInfo->zebra_time.nsecs!=MERGED_FILES) && ON_method){
 419                                         printf("Not correct order\n");
 420                                 }
 421                         } else if(((delta < (average-cs->stats.variance)) || (delta > (average+cs->stats.variance))) && (delta > 0.0) && (cs->stats.variance!=0)) {
 422                                 printf("Packet id :%i, count:%i Problem:", fInfo->id, fInfo->fp->count);
 423                                 printf("Package not arrived in time\n");
 424                                 if((nstime_cmp(&fInfo->fp->predecessor_time, &fInfo->zebra_time)>0||nstime_cmp(&fInfo->fp->partner->fp->predecessor_time, &fInfo->fp->partner->zebra_time)>0) && fInfo->zebra_time.nsecs != MERGED_FILES && ON_method){
 425                                         printf("Not correct order\n");
 426                                 }
 427                         } else if((nstime_cmp(&fInfo->fp->predecessor_time, &fInfo->zebra_time)>0||nstime_cmp(&fInfo->fp->partner->fp->predecessor_time, &fInfo->fp->partner->zebra_time)>0) && fInfo->zebra_time.nsecs != MERGED_FILES && ON_method){
 428                                 printf("Packet id :%i, count:%i Problem:", fInfo->id, fInfo->fp->count);
 429                                 printf("Not correct order\n");
 430                         }
 431                 }
 432         }
 433         return FALSE;
 434 }
 435
 436
 437 /* This callback is used when tshark wants us to draw/update our
 438  * data to the output device. Since this is tshark only output is
 439  * stdout.
 440  * TShark will only call this callback once, which is when tshark has
 441  * finished reading all packets and exists.
 442  * If used with wireshark this may be called any time, perhaps once every 3
 443  * seconds or so.
 444  * This function may even be called in parallell with (*reset) or (*draw)
 445  * so make sure there are no races. The data in the rpcstat_t can thus change
 446  * beneath us. Beware.
 447  */
 448 static void
 449 comparestat_draw(void *prs)
 450 {
 451         comparestat_t *cs=prs;
 452         GString *filter_str = g_string_new("");
 453         const gchar *statis_string;
 454         guint32 first_file_amount, second_file_amount;
 455
 456         /* inital steps, clear all data before start*/
 457         cs->zebra_time.secs=0;
 458         cs->zebra_time.nsecs=1;
 459         nstime_set_unset(&cs->current_time);
 460         cs->ip_ttl_list=g_array_new(FALSE, FALSE, sizeof(guint8));
 461         cs->last_hit=FALSE;
 462         cs->start_ongoing_hits=0;
 463         cs->stop_ongoing_hits=0;
 464         cs->start_packet_nr_first=G_MAXINT32;
 465         cs->start_packet_nr_second=G_MAXINT32;
 466         cs->stop_packet_nr_first=G_MAXINT32;
 467         cs->stop_packet_nr_second=G_MAXINT32;
 468         cs->first_file_amount=0;
 469         cs->second_file_amount=0;
 470
 471         time_stat_init(&cs->stats);
 472         /* not using g_free, because struct is managed by binarytrees */
 473         cs->ip_id_tree=se_tree_create(EMEM_TREE_TYPE_RED_BLACK, "ip_id_tree");
 474         emem_tree_foreach(cs->packet_tree, call_foreach_count_ip_id, cs);
 475
 476         /* set up TTL choice if only one number found */
 477         if(TTL_method&&cs->ip_ttl_list->len==1){
 478                 g_array_append_val(cs->ip_ttl_list, g_array_index(cs->ip_ttl_list, guint8, 1));
 479         }
 480
 481         emem_tree_foreach(cs->packet_tree, call_foreach_new_order,cs);
 482         emem_tree_foreach(cs->packet_tree, call_foreach_merge_settings, cs);
 483
 484         /* remembering file amounts */
 485         first_file_amount=cs->first_file_amount;
 486         second_file_amount=cs->second_file_amount;
 487         /* reset after numbering */
 488         cs->nr_tree=se_tree_create(EMEM_TREE_TYPE_RED_BLACK, "nr_tree");
 489
 490         /* Variance */
 491         cs->stats.variance=compare_variance;
 492
 493         /* add statistic string */
 494         statis_string=g_strdup_printf("Compare Statistics: \nNumber of packets total:%i 1st file:%i, 2nd file:%i\nScopes:\t start:%i stop:%i\nand:\t start:%i stop:%i\nEqual packets: %i \nAllowed variation: %f \nAverage time difference: %f\n", (first_file_amount+second_file_amount), first_file_amount, second_file_amount, cs->start_packet_nr_first, cs->stop_packet_nr_first, cs->start_packet_nr_second, cs->stop_packet_nr_second, cs->stats.num, cs->stats.variance, fabs(get_average(&cs->stats.tot, cs->stats.num)));
 495
 496         printf("\n");
 497         printf("===================================================================\n");
 498         printf("%s", statis_string);
 499         emem_tree_foreach(cs->ip_id_tree, call_foreach_print_ip_tree, cs);
 500         printf("===================================================================\n");
 501         g_string_free(filter_str, TRUE);
 502         g_array_free(cs->ip_ttl_list, TRUE);
 503 }
 504
 505 /* When called, this function will create a new instance of comparestat.
 506  * This function is called from tshark when it parses the -z compare, arguments
 507  * and it creates a new instance to store statistics in and registers this
 508  * new instance for the compare tap.
 509  */
 510 static void
 511 comparestat_init(const char *optarg, void* userdata _U_)
 512 {
 513         comparestat_t *cs;
 514         const char *filter=NULL;
 515         GString *error_string;
 516         gint start, stop,ttl, order, pos=0;
 517         gdouble variance;
 518
 519         if(sscanf(optarg,"compare,%d,%d,%d,%d,%lf,%n",&start, &stop, &ttl, &order, &variance, &pos)==5){
 520                 if(pos){
 521                         filter=optarg+pos;
 522                 } else {
 523                         filter=NULL;
 524                 }
 525         } else {
 526                 fprintf(stderr, "tshark: invalid \"-z compare,<start>,<stop>,<ttl[0|1]>,<order[0|1]>,<variance>[,<filter>]\" argument\n");
 527                 exit(1);
 528         }
 529
 530         compare_variance=variance;
 531         compare_start=start;
 532         compare_stop=stop;
 533         TTL_method=ttl;
 534         ON_method=order;
 535
 536         cs=g_malloc(sizeof(comparestat_t));
 537         nstime_set_unset(&cs->current_time);
 538         cs->ip_ttl_list=g_array_new(FALSE, FALSE, sizeof(guint8));
 539         cs->last_hit=FALSE;
 540         cs->start_ongoing_hits=0;
 541         cs->stop_ongoing_hits=0;
 542         cs->start_packet_nr_first=G_MAXINT32;
 543         cs->start_packet_nr_second=G_MAXINT32;
 544         cs->stop_packet_nr_first=G_MAXINT32;
 545         cs->stop_packet_nr_second=G_MAXINT32;
 546         cs->first_file_amount=0;
 547         cs->second_file_amount=0;
 548
 549         cs->zebra_time.secs=0;
 550         cs->zebra_time.nsecs=1;
 551         cs->nr_tree=se_tree_create(EMEM_TREE_TYPE_RED_BLACK, "nr_tree");
 552         /* microsecond precision */
 553         timestamp_set_precision(TS_PREC_AUTO_NSEC);
 554
 555         if(filter){
 556                 cs->filter=g_strdup(filter);
 557         } else {
 558                 cs->filter=NULL;
 559         }
 560
 561         /* create a Hash to count the packets with the same ip.id */
 562         cs->packet_tree=se_tree_create(EMEM_TREE_TYPE_RED_BLACK, "Packet_info_tree");
 563
 564         error_string=register_tap_listener("ip", cs, filter, 0, comparestat_reset, comparestat_packet, comparestat_draw);
 565         if(error_string){
 566                 /* error, we failed to attach to the tap. clean up */
 567                 g_free(cs->filter);
 568                 g_free(cs);
 569
 570                 fprintf(stderr, "tshark: Couldn't register compare tap: %s\n", error_string->str);
 571                 g_string_free(error_string, TRUE);
 572                 exit(1);
 573         }
 574 }
 575
 576
 577 void
 578 register_tap_listener_comparestat(void)
 579 {
 580         register_stat_cmd_arg("compare,", comparestat_init,NULL);
 581 }