2 * iostat 2002 Ronnie Sahlberg
6 * Wireshark - Network traffic analyzer
7 * By Gerald Combs <gerald@wireshark.org>
8 * Copyright 1998 Gerald Combs
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version 2
13 * of the License, or (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
31 #ifdef HAVE_SYS_TYPES_H
32 # include <sys/types.h>
36 #include "epan/epan_dissect.h"
37 #include "epan/packet_info.h"
39 #include <epan/stat_cmd_args.h>
40 #include <epan/strutil.h>
43 typedef struct _io_stat_t {
44 gint64 interval; /* unit is us */
46 struct _io_stat_item_t *items;
50 #define CALC_TYPE_FRAMES 0
51 #define CALC_TYPE_BYTES 1
52 #define CALC_TYPE_FRAMES_AND_BYTES 2
53 #define CALC_TYPE_COUNT 3
54 #define CALC_TYPE_SUM 4
55 #define CALC_TYPE_MIN 5
56 #define CALC_TYPE_MAX 6
57 #define CALC_TYPE_AVG 7
58 #define CALC_TYPE_LOAD 8
60 typedef struct _io_stat_item_t {
62 struct _io_stat_item_t *next;
63 struct _io_stat_item_t *prev;
64 gint64 time; /* unit is us since start of capture */
71 gdouble double_counter;
74 #define NANOSECS_PER_SEC 1000000000
77 iostat_packet(void *arg, packet_info *pinfo, epan_dissect_t *edt, const void *dummy _U_)
79 io_stat_item_t *mit = arg;
81 gint64 current_time, ct;
85 current_time = (gint64)(pinfo->fd->rel_ts.secs*1000000) + (pinfo->fd->rel_ts.nsecs+500)/1000;
87 /* the prev item before the main one is always the last interval we saw packets for */
90 /* XXX for the time being, just ignore all frames that are in the past.
91 should be fixed in the future but hopefully it is uncommon */
92 if(current_time<it->time){
96 /* we have moved into a new interval, we need to create a new struct */
98 while(ct >= (it->time + mit->parent->interval)){
99 it->next=g_malloc(sizeof(io_stat_item_t));
105 it->time = it->prev->time + mit->parent->interval;
108 it->float_counter = 0;
109 it->double_counter = 0;
111 it->calc_type=it->prev->calc_type;
112 it->hf_index=it->prev->hf_index;
115 /* it will now give us the current structure to use to store the data in */
118 switch(it->calc_type){
119 case CALC_TYPE_BYTES:
120 case CALC_TYPE_FRAMES:
121 case CALC_TYPE_FRAMES_AND_BYTES:
122 it->counter+=pinfo->fd->pkt_len;
124 case CALC_TYPE_COUNT:
125 gp=proto_get_finfo_ptr_array(edt->tree, it->hf_index);
127 it->counter+=gp->len;
131 gp=proto_get_finfo_ptr_array(edt->tree, it->hf_index);
136 for(i=0;i<gp->len;i++){
137 switch(proto_registrar_get_ftype(it->hf_index)){
142 it->counter+=fvalue_get_uinteger(&((field_info *)gp->pdata[i])->value);
145 it->counter+=fvalue_get_integer64(&((field_info *)gp->pdata[i])->value);
151 it->counter+=fvalue_get_sinteger(&((field_info *)gp->pdata[i])->value);
154 it->counter+=(gint64)fvalue_get_integer64(&((field_info *)gp->pdata[i])->value);
157 it->float_counter+=(gfloat)fvalue_get_floating(&((field_info *)gp->pdata[i])->value);
160 it->double_counter+=fvalue_get_floating(&((field_info *)gp->pdata[i])->value);
162 case FT_RELATIVE_TIME:
163 new_time = fvalue_get(&((field_info *)gp->pdata[i])->value);
164 val=(guint64)(new_time->secs) * NANOSECS_PER_SEC + new_time->nsecs;
172 gp=proto_get_finfo_ptr_array(edt->tree, it->hf_index);
180 type=proto_registrar_get_ftype(it->hf_index);
181 for(i=0;i<gp->len;i++){
187 val=fvalue_get_uinteger(&((field_info *)gp->pdata[i])->value);
188 if((it->frames==1)&&(i==0)){
190 } else if(val<it->counter){
195 val=fvalue_get_integer64(&((field_info *)gp->pdata[i])->value);
196 if((it->frames==1)&&(i==0)){
198 } else if(val<it->counter){
206 val=fvalue_get_sinteger(&((field_info *)gp->pdata[i])->value);
207 if((it->frames==1)&&(i==0)){
209 } else if((gint32)val<(gint32)(it->counter)){
214 val=fvalue_get_integer64(&((field_info *)gp->pdata[i])->value);
215 if((it->frames==1)&&(i==0)){
217 } else if((gint64)val<(gint64)(it->counter)){
222 float_val=(gfloat)fvalue_get_floating(&((field_info *)gp->pdata[i])->value);
223 if((it->frames==1)&&(i==0)){
224 it->float_counter=float_val;
225 } else if(float_val<it->float_counter){
226 it->float_counter=float_val;
230 double_val=fvalue_get_floating(&((field_info *)gp->pdata[i])->value);
231 if((it->frames==1)&&(i==0)){
232 it->double_counter=double_val;
233 } else if(double_val<it->double_counter){
234 it->double_counter=double_val;
237 case FT_RELATIVE_TIME:
238 new_time=fvalue_get(&((field_info *)gp->pdata[i])->value);
239 val=(guint64)(new_time->secs) * NANOSECS_PER_SEC + new_time->nsecs;
240 if((it->frames==1)&&(i==0)){
242 } else if(val<it->counter){
251 gp=proto_get_finfo_ptr_array(edt->tree, it->hf_index);
259 type=proto_registrar_get_ftype(it->hf_index);
260 for(i=0;i<gp->len;i++){
266 val=fvalue_get_uinteger(&((field_info *)gp->pdata[i])->value);
267 if((it->frames==1)&&(i==0)){
269 } else if(val>it->counter){
274 val=fvalue_get_integer64(&((field_info *)gp->pdata[i])->value);
275 if((it->frames==1)&&(i==0)){
277 } else if(val>it->counter){
285 val=fvalue_get_sinteger(&((field_info *)gp->pdata[i])->value);
286 if((it->frames==1)&&(i==0)){
288 } else if((gint32)val>(gint32)(it->counter)){
293 val=fvalue_get_integer64(&((field_info *)gp->pdata[i])->value);
294 if((it->frames==1)&&(i==0)){
296 } else if((gint64)val>(gint64)(it->counter)){
301 float_val=(gfloat)fvalue_get_floating(&((field_info *)gp->pdata[i])->value);
302 if((it->frames==1)&&(i==0)){
303 it->float_counter=float_val;
304 } else if(float_val>it->float_counter){
305 it->float_counter=float_val;
309 double_val=fvalue_get_floating(&((field_info *)gp->pdata[i])->value);
310 if((it->frames==1)&&(i==0)){
311 it->double_counter=double_val;
312 } else if(double_val>it->double_counter){
313 it->double_counter=double_val;
316 case FT_RELATIVE_TIME:
317 new_time=fvalue_get(&((field_info *)gp->pdata[i])->value);
318 val=(guint64)(new_time->secs) * NANOSECS_PER_SEC + new_time->nsecs;
319 if((it->frames==1)&&(i==0)){
321 } else if(val>it->counter){
330 gp=proto_get_finfo_ptr_array(edt->tree, it->hf_index);
336 type=proto_registrar_get_ftype(it->hf_index);
337 for(i=0;i<gp->len;i++){
344 val=fvalue_get_uinteger(&((field_info *)gp->pdata[i])->value);
349 val=fvalue_get_integer64(&((field_info *)gp->pdata[i])->value);
356 val=fvalue_get_sinteger(&((field_info *)gp->pdata[i])->value);
360 it->float_counter+=(gfloat)fvalue_get_floating(&((field_info *)gp->pdata[i])->value);
363 it->double_counter+=fvalue_get_floating(&((field_info *)gp->pdata[i])->value);
365 case FT_RELATIVE_TIME:
366 new_time=fvalue_get(&((field_info *)gp->pdata[i])->value);
367 val=(guint64)(new_time->secs) * NANOSECS_PER_SEC + new_time->nsecs;
375 gp=proto_get_finfo_ptr_array(edt->tree, it->hf_index);
379 type=proto_registrar_get_ftype(it->hf_index);
380 if (type != FT_RELATIVE_TIME) {
382 "\ntshark: LOAD() is only supported for relative-time fiels such as smb.time\n"
386 for(i=0;i<gp->len;i++){
392 new_time=fvalue_get(&((field_info *)gp->pdata[i])->value);
393 val=(guint64)(new_time->secs)*1000000 + new_time->nsecs/1000;
394 tival = (int)(val % mit->parent->interval);
395 it->counter += tival;
399 if (val < (guint64)mit->parent->interval) {
405 pit->counter += mit->parent->interval;
406 val -= mit->parent->interval;
419 iostat_draw(void *arg)
421 io_stat_item_t *mit = arg;
423 io_stat_item_t **items;
426 gfloat *float_counters;
427 gdouble *double_counters;
430 guint32 borderLen=68;
438 /* Display the table border */
439 for(i=0;i<iot->num_items;i++){
440 if(iot->items[i].calc_type==CALC_TYPE_FRAMES_AND_BYTES)
443 if(iot->interval!=G_MAXINT32)
446 borderLen+=(iot->num_items-3)*17;
447 for(i=0;i<borderLen;i++){
453 printf("IO Statistics\n");
454 if(iot->interval!=G_MAXINT32)
455 printf("Interval: %3" G_GINT64_MODIFIER "u.%06" G_GINT64_MODIFIER "u secs\n",
456 iot->interval/1000000, iot->interval%1000000);
458 for(i=0;i<iot->num_items;i++){
459 printf("Column #%u: %s\n",i,iot->filters[i]?iot->filters[i]:"");
461 if(iot->interval==G_MAXINT32){
466 for(i=0;i<iot->num_items;i++){
467 if(iot->items[i].calc_type==CALC_TYPE_FRAMES_AND_BYTES){
468 printf(" Column #%-2u |",i);
470 printf(" Column #%-2u |",i);
475 if(iot->interval==G_MAXINT32) {
480 for(i=0;i<iot->num_items;i++){
481 switch(iot->items[i].calc_type){
482 case CALC_TYPE_FRAMES:
485 case CALC_TYPE_BYTES:
488 case CALC_TYPE_FRAMES_AND_BYTES:
489 printf(" Frames | Bytes |");
491 case CALC_TYPE_COUNT:
513 items=g_malloc(sizeof(io_stat_item_t *)*iot->num_items);
514 frames=g_malloc(sizeof(guint64)*iot->num_items);
515 counters=g_malloc(sizeof(guint64)*iot->num_items);
516 float_counters=g_malloc(sizeof(gfloat)*iot->num_items);
517 double_counters=g_malloc(sizeof(gdouble)*iot->num_items);
518 num=g_malloc(sizeof(guint64)*iot->num_items);
519 /* preset all items at the first interval */
520 for(i=0;i<iot->num_items;i++){
521 items[i]=&iot->items[i];
524 /* loop the items until we run out of them all */
528 for(i=0;i<iot->num_items;i++){
532 double_counters[i]=0;
535 for(i=0;i<iot->num_items;i++){
536 if(items[i] && (t>=(items[i]->time+iot->interval))){
537 items[i]=items[i]->next;
540 if(items[i] && (t<(items[i]->time+iot->interval)) && (t>=items[i]->time) ){
541 frames[i]=items[i]->frames;
542 counters[i]=items[i]->counter;
543 float_counters[i]=items[i]->float_counter;
544 double_counters[i]=items[i]->double_counter;
545 num[i]=items[i]->num;
554 if(iot->interval==G_MAXINT32) {
557 printf("%04u.%06u-%04u.%06u ",
558 (int)(t/1000000),(int)(t%1000000),
559 (int)((t+iot->interval)/1000000),
560 (int)((t+iot->interval)%1000000));
562 for(i=0;i<iot->num_items;i++){
563 switch(iot->items[i].calc_type){
564 case CALC_TYPE_FRAMES:
565 printf(" %15" G_GINT64_MODIFIER "u ", frames[i]);
567 case CALC_TYPE_BYTES:
568 printf(" %15" G_GINT64_MODIFIER "u ", counters[i]);
570 case CALC_TYPE_FRAMES_AND_BYTES:
571 printf(" %15" G_GINT64_MODIFIER "u %15" G_GINT64_MODIFIER "u ", frames[i], counters[i]);
573 case CALC_TYPE_COUNT:
574 printf(" %15" G_GINT64_MODIFIER "u ", counters[i]);
577 switch(proto_registrar_get_ftype(iot->items[i].hf_index)){
588 printf(" %15" G_GINT64_MODIFIER "u ", counters[i]);
591 printf(" %f ", float_counters[i]);
594 printf(" %f ", double_counters[i]);
596 case FT_RELATIVE_TIME:
597 counters[i] = (counters[i]+500)/1000;
599 (int)(counters[i]/1000000), (int)(counters[i]%1000000));
604 switch(proto_registrar_get_ftype(iot->items[i].hf_index)){
610 printf(" %15" G_GINT64_MODIFIER "u ", counters[i]);
617 printf(" %15" G_GINT64_MODIFIER "d ", counters[i]);
620 printf(" %f ", float_counters[i]);
623 printf(" %f ", double_counters[i]);
625 case FT_RELATIVE_TIME:
626 counters[i]=(counters[i]+500)/1000;
628 (int)(counters[i]/1000000), (int)(counters[i]%1000000));
633 switch(proto_registrar_get_ftype(iot->items[i].hf_index)){
639 printf(" %15u ", (int)(counters[i]));
646 printf(" %15" G_GINT64_MODIFIER "d ", counters[i]);
649 printf(" %f ", float_counters[i]);
652 printf(" %f ", double_counters[i]);
654 case FT_RELATIVE_TIME:
655 counters[i]=(counters[i]+500)/1000;
657 (int)(counters[i]/1000000), (int)(counters[i]%1000000));
665 switch(proto_registrar_get_ftype(iot->items[i].hf_index)){
671 printf(" %15" G_GINT64_MODIFIER "u ", counters[i]/num[i]);
678 printf(" %15" G_GINT64_MODIFIER "d ", counters[i]/num[i]);
681 printf(" %f ", float_counters[i]/num[i]);
684 printf(" %f ", double_counters[i]/num[i]);
686 case FT_RELATIVE_TIME:
687 counters[i]=((counters[i]/num[i])+500)/1000;
689 (int)(counters[i]/1000000), (int)(counters[i]%1000000));
695 switch(proto_registrar_get_ftype(iot->items[i].hf_index)){
696 case FT_RELATIVE_TIME:
698 (int)(counters[i]/iot->interval), (int)((counters[i]%iot->interval)*1000000/iot->interval));
711 for(i=0;i<borderLen;i++){
719 g_free(float_counters);
720 g_free(double_counters);
726 const char *func_name;
730 static calc_type_ent_t calc_type_table[] = {
731 { "FRAMES", CALC_TYPE_FRAMES },
732 { "BYTES", CALC_TYPE_BYTES },
733 { "COUNT", CALC_TYPE_COUNT },
734 { "SUM", CALC_TYPE_SUM },
735 { "MIN", CALC_TYPE_MIN },
736 { "MAX", CALC_TYPE_MAX },
737 { "AVG", CALC_TYPE_AVG },
738 { "LOAD", CALC_TYPE_LOAD },
743 register_io_tap(io_stat_t *io, int i, const char *filter)
745 GString *error_string;
749 const char *p, *parenp;
751 header_field_info *hfi;
753 io->items[i].prev=&io->items[i];
754 io->items[i].next=NULL;
755 io->items[i].parent=io;
757 io->items[i].calc_type=CALC_TYPE_FRAMES_AND_BYTES;
758 io->items[i].frames=0;
759 io->items[i].counter=0;
761 io->filters[i]=filter;
766 for(j=0; calc_type_table[j].func_name; j++){
767 namelen=strlen(calc_type_table[j].func_name);
768 if(filter && strncmp(filter, calc_type_table[j].func_name, namelen) == 0) {
769 io->items[i].calc_type=calc_type_table[j].calc_type;
770 if(*(filter+namelen)=='(') {
772 parenp=strchr(p, ')');
774 fprintf(stderr, "\ntshark: Closing parenthesis missing from calculated expression.\n");
779 if(io->items[i].calc_type==CALC_TYPE_FRAMES || io->items[i].calc_type==CALC_TYPE_BYTES){
781 fprintf(stderr, "\ntshark: %s does require or allow a field name within the parens.\n",
782 calc_type_table[j].func_name);
787 /* bail out if a field name was not specified */
788 fprintf(stderr, "\ntshark: You didn't specify a field name for %s(*).\n",
789 calc_type_table[j].func_name);
794 field=g_malloc(parenp-p+1);
795 memcpy(field, p, parenp-p);
796 field[parenp-p] = '\0';
798 if (io->items[i].calc_type==CALC_TYPE_FRAMES || io->items[i].calc_type==CALC_TYPE_BYTES)
800 hfi=proto_registrar_get_byname(field);
802 fprintf(stderr, "\ntshark: There is no field named '%s'.\n",
808 io->items[i].hf_index=hfi->id;
812 if (io->items[i].calc_type==CALC_TYPE_FRAMES || io->items[i].calc_type==CALC_TYPE_BYTES)
816 if(hfi && !(io->items[i].calc_type==CALC_TYPE_BYTES ||
817 io->items[i].calc_type==CALC_TYPE_FRAMES ||
818 io->items[i].calc_type==CALC_TYPE_FRAMES_AND_BYTES)){
819 /* check that the type is compatible */
831 /* these types support all calculations */
835 /* these types only support SUM, COUNT, MAX, MIN, AVG */
836 switch(io->items[i].calc_type){
838 case CALC_TYPE_COUNT:
845 "\ntshark: %s is a float field, so %s(*) calculations are not supported on it.",
847 calc_type_table[j].func_name);
851 case FT_RELATIVE_TIME:
852 /* this type only supports SUM, COUNT, MAX, MIN, AVG, LOAD */
853 switch(io->items[i].calc_type){
855 case CALC_TYPE_COUNT:
863 "\ntshark: %s is a relative-time field, so %s(*) calculations are not supported on it.",
865 calc_type_table[j].func_name);
871 * XXX - support all operations on floating-point
874 if(io->items[i].calc_type!=CALC_TYPE_COUNT){
876 "\ntshark: %s doesn't have integral values, so %s(*) calculations are not supported on it.\n",
878 calc_type_table[j].func_name);
886 error_string=register_tap_listener("frame", &io->items[i], flt, TL_REQUIRES_PROTO_TREE, NULL, iostat_packet, i?NULL:iostat_draw);
890 fprintf(stderr, "\ntshark: Couldn't register io,stat tap: %s\n",
892 g_string_free(error_string, TRUE);
898 iostat_init(const char *optarg, void* userdata _U_)
900 gdouble interval_float;
904 const char *filter=NULL;
906 if(sscanf(optarg,"io,stat,%lf,%n",&interval_float,&idx)==1){
908 if(*(optarg+idx)==',')
916 fprintf(stderr, "\ntshark: invalid \"-z io,stat,<interval>[,<filter>]\" argument\n");
920 /* if interval is 0, calculate statistics over the whole file
921 * by setting the interval to G_MAXINT32
923 if(interval_float==0) {
926 /* make interval be number of us rounded to the nearest integer*/
927 interval=(gint64)(interval_float*1000000.0+0.5);
932 "\ntshark: \"-z\" interval must be >=0.000001 seconds or \"0\" for the entire capture duration.\n");
936 io=g_malloc(sizeof(io_stat_t));
937 io->interval=interval;
938 if((!filter)||(filter[0]==0)){
940 io->items=g_malloc(sizeof(io_stat_item_t)*io->num_items);
941 io->filters=g_malloc(sizeof(char *)*io->num_items);
943 register_io_tap(io, 0, NULL);
945 const char *str,*pos;
948 /* find how many ',' separated filters we have */
951 while((str=strchr(str,','))){
956 io->items=g_malloc(sizeof(io_stat_item_t)*io->num_items);
957 io->filters=g_malloc(sizeof(char *)*io->num_items);
959 /* for each filter, register a tap listener */
965 register_io_tap(io, i, NULL);
966 } else if(pos==NULL) {
968 register_io_tap(io, i, tmp);
970 tmp=g_malloc((pos-str)+1);
971 g_strlcpy(tmp,str,(pos-str)+1);
972 register_io_tap(io, i, tmp);
981 register_tap_listener_iostat(void)
983 register_stat_cmd_arg("io,stat,", iostat_init, NULL);