使用libpcap收集连接的统计信息

时间：2016-11-22 11:40:39

标签： c++ multithreading c++11 http-proxy libpcap

我有一个HTTP线程代理，即对于我产生线程的客户端的每个请求：现在我想收集一些统计信息，如每秒比特数（bps）和每秒数据包数（pps）。

我喜欢我的代码只做一件事，所以如果一个线程处理一个连接，它也不会计算每个数据包的bps和pps，我把它留给另一个线程。

我为来自客户端的每个HTTP请求创建一个线程，如果代理成功连接到请求的远程服务器，则proxt将实际的HTTP请求发送到服务器，在路由数据之前，连接线程创建一个日志记录线程：日志记录线程将计算bps和pps直到连接打开。连接线程向日志记录线程信息提供有关要过滤的数据包（本地IP地址，本地端口，远程IP地址，远程端口），因此每个日志记录线程将仅过滤来自父连接线程的数据包。

我在计算每个数据包的bps和pps时遇到问题。

这是我在日志记录线程中循环捕获数据包的伪代码：

www.netflix.com UPLOAD, DIVIDE ACCEPTED PKTS 99239440000000 AND ACCEPTED BITS 793915584000000 PER DELAY 1479811349890053 IS PPS 0 AND BPS 0
www.netflix.com DOWNLOAD, DIVIDE ACCEPTED PKTS 99239440000000 AND ACCEPTED BITS 793915584000000 PER DELAY 1479811350032141 IS PPS 0 AND BPS 0
www.netflix.com DOWNLOAD, DIVIDE ACCEPTED PKTS 99239440000000 AND ACCEPTED BITS 793915584000000 PER DELAY 4344 IS PPS 22845174953 AND BPS 182761414364
www.netflix.com UPLOAD, DIVIDE ACCEPTED PKTS 99239440000000 AND ACCEPTED BITS 793915584000000 PER DELAY 146464 IS PPS 677568822 AND BPS 5420551015
www.netflix.com DOWNLOAD, DIVIDE ACCEPTED PKTS 99239440000000 AND ACCEPTED BITS 793915584000000 PER DELAY 2815 IS PPS 35253797513 AND BPS 282030402841
www.netflix.com UPLOAD, DIVIDE ACCEPTED PKTS 99239440000000 AND ACCEPTED BITS 793915584000000 PER DELAY 2808 IS PPS 35341680911 AND BPS 282733470085
www.netflix.com DOWNLOAD, DIVIDE ACCEPTED PKTS 99239440000000 AND ACCEPTED BITS 793915584000000 PER DELAY 1120 IS PPS 88606642857 AND BPS 708853200000
www.netflix.com UPLOAD, DIVIDE ACCEPTED PKTS 99239440000000 AND ACCEPTED BITS 793915584000000 PER DELAY 1134 IS PPS 87512733686 AND BPS 700101925925
www.netflix.com UPLOAD, DIVIDE ACCEPTED PKTS 99239440000000 AND ACCEPTED BITS 793915584000000 PER DELAY 39658 IS PPS 2502381360 AND BPS 20019052498
www.netflix.com DOWNLOAD, DIVIDE ACCEPTED PKTS 99239440000000 AND ACCEPTED BITS 793915584000000 PER DELAY 176317 IS PPS 562846690 AND BPS 4502773890
www.netflix.com UPLOAD, DIVIDE ACCEPTED PKTS 99239440000000 AND ACCEPTED BITS 793915584000000 PER DELAY 136687 IS PPS 726034224 AND BPS 5808274261

这是一个示例输出：

chars

我从来不知道我的家庭网络可以承受超过500 MBps，所以一定是错的。

This page显示了如何计算bps和pps，并解释了acceptedBits中8 pcap_next_ex的转变，但无论如何我都会报告它。在这里，您可以看到函数libpcap的第二个和第三个参数：

Starting from the beginning of <code>pkt_data</code>, you can see the first <code>long integer</code> bytes represent accepted bytes

基本上，我做了他所说的一切！为什么我会变得如此庞大而奇怪的bps和pps？

使用Ubuntu 14.04;不知道如何检查locate libpcap版本，但/home/dexter/Desktop/wireshark-1.99.9/wiretap/libpcap.c /home/dexter/Desktop/wireshark-1.99.9/wiretap/libpcap.h /usr/lib/x86_64-linux-gnu/libpcap.a /usr/lib/x86_64-linux-gnu/libpcap.so /usr/lib/x86_64-linux-gnu/libpcap.so.0.8 /usr/lib/x86_64-linux-gnu/libpcap.so.1.5.3 /usr/share/doc/libpcap-dev /usr/share/doc/libpcap0.8 /usr/share/doc/libpcap0.8-dev /usr/share/doc/libpcap-dev/changelog.Debian.gz /usr/share/doc/libpcap-dev/copyright /usr/share/doc/libpcap0.8/CREDITS.gz /usr/share/doc/libpcap0.8/README.Debian /usr/share/doc/libpcap0.8/README.gz /usr/share/doc/libpcap0.8/changelog.Debian.gz /usr/share/doc/libpcap0.8/copyright /usr/share/doc/libpcap0.8-dev/changelog.Debian.gz /usr/share/doc/libpcap0.8-dev/copyright /var/lib/dpkg/info/libpcap-dev.[list,md5sums] /var/lib/dpkg/info/libpcap0.8-dev.[list,md5sums,preinst] /var/lib/dpkg/info/libpcap0.8:amd64.[list,md5sums,postinst,postrm,shlibs,symbols] 给出了这个：

 echo '<a href="' . $perma . '" title="' . $title . '">';
 echo $title;
 echo '</a>';

2 个答案:

答案 0 :(得分：1)

在您的代码中：

long long acceptedPackets = ((long long)(pkt_data)) * 1000000;
long long acceptedBits = ((long long)(pkt_data+8)) * 8 * 1000000;

虽然pkt_data是一个指针。

您正在做的是基本上获取数据包数据的地址，将其转换为long long，添加8（对于第二行），将其乘以常量并将其视为您的值，在语义上是不正确的。您应该取消引用该指针，并考虑您的数据类型（将pkt_data转换为指向long long的指针）。

在代码中：

long long acceptedPackets = (*(long long*)(pkt_data)) * 1000000;
long long acceptedBits = (*(long long*)(pkt_data+8)) * 8 * 1000000; 
// this also works:
//long long acceptedPackets = *(long long*)pkt_data * 1000000;
//long long acceptedBits = *((long long*)pkt_data + 1) * 8 * 1000000;

有关示例，请参阅http://ideone.com/JqmRre

编辑：

来自this guide：

  

最后一个论点是最有趣的，也是最有趣的   让普通的新手pcap程序员感到困惑。这是另一个指针   到一个u_char，它指向一块数据的第一个字节   包含整个数据包

这意味着pkt_data是数据包内容本身。除非数据包的前16个字节包含所需信息（这是不真实的，因为它包含原始数据包，因此它具有ETH，IP和TCP / UDP标头），否则您无法使用该数据。为了获得PPS指标，您必须在循环中实现一个简单的计数器（因为您每帧都打印该指标，一个简单的long long pps = (long long)(1.0 / delay);就足够了 - 请注意该除法处于浮点状态。对于您的BPS指标，您应该使用框架标头信息。long long bps = (long long)(header->caplen * 8.0 / delay);应该这样做。

作为旁注，对于时间指标，由于您使用的是C ++ 11，请尝试使用chrono。它比timeval更清晰，更安全：

添加#include <chrono>。

您的最终代码应如下所示：

// pcap variables
pcap_t *handle;
struct pcap_pkthdr *header;
const u_char *pkt_data;
// Use of high_resolution_clock
std::chrono::high_resolution_clock::time_point oldTimeUpload = std::chrono::high_resolution_clock::now();
std::chrono::high_resolution_clock::time_point oldTimeDownload = std::chrono::high_resolution_clock::now();

// stopLogging is a boolean flag declared in connection "parent" thread: 
// it is set to false when connection thread has done sending and
// receiving data and connection is going to be closed
while (((res = pcap_next_ex(handle, &header, &pkt_data)) >= 0) && (!stopLogging)) {
    // check res
    if (packet is upload) {
        std::chrono::high_resolution_clock::time_point now = std::chrono::high_resolution_clock::now();
        long long delay = std::chrono::duration_cast<std::chrono::nanoseconds>(now - oldTimeUpload).count();
        long long pps = (long long)(1000000000.0 / delay);
        long long bps = (long long)(header->caplen * 8 * 1000000000.0 / delay);
        debugRed(host << ", UPLOAD DIVIDE PER DELAY " << delay << 
            " IS PPS " << pps << " AND BPS " << bps);
        oldTimevalUpload.tv_sec = header->ts.tv_sec;
        oldTimevalUpload.tv_usec = header->ts.tv_usec;
    } else if (packet is download) {
        // basically the same as above
    }
}
debug("Quit logging connection " << localIPaddr << ":" << localPort << " and "
    << remoteIPaddr << ":" << remotePort);
pcap_close(handle);

答案 1 :(得分：0)

如何在另一个进程而不是另一个进程上执行pps和bps计算？我可以推荐HttpAnalyzer实用程序，它直接从网络接口捕获HTTP数据包，并计算pps，bps和更多的统计数据。

由于它是开源的，您可以更改代码以满足您的目的或按原样使用。

以下是此实用程序的示例输出：

STATS SUMMARY
=============

General stats
--------------------

Sample time:                                     18.374 [Seconds]
Number of HTTP packets:                            5662 [Packets]
Rate of HTTP packets:                           291.910 [Packets/sec]
Number of HTTP flows:                                55 [Flows]
Rate of HTTP flows:                               2.836 [Flows/sec]
Number of HTTP pipelining flows:                      0 [Flows]
Number of HTTP transactions:                        322 [Transactions]
Rate of HTTP transactions:                       16.601 [Transactions/sec]
Total HTTP data:                                5916120 [Bytes]
Rate of HTTP data:                           305011.600 [Bytes/sec]
Average packets per flow:                       102.945 [Packets]
Average transactions per flow:                    5.963 [Transactions]
Average data per flow:                       107565.818 [Bytes]

HTTP request stats
--------------------

Number of HTTP requests:                            323 [Requests]
Rate of HTTP requests:                           16.653 [Requests/sec]
Total data in headers:                           188596 [Bytes]
Average header size:                            583.889 [Bytes]

HTTP response stats
--------------------

Number of HTTP responses:                           332 [Responses]
Rate of HTTP responses:                          17.117 [Responses/sec]
Total data in headers:                           119577 [Bytes]
Average header size:                            360.172 [Bytes]
Num of responses with content-length:               320 [Responses]
Total body size (may be compressed):            5409410 [Bytes]
Average body size:                            16904.406 [Bytes]

HTTP request methods
--------------------

| Method    | Count |
---------------------
| GET       | 321   |
| POST      | 2     |
---------------------

Hostnames count
--------------------

| Hostname                                 | Count |
----------------------------------------------------
| images1.teny.co.qq                       | 180   |
| www.teny.co.qq                           | 82    |
| go.teny.co.qq                            | 14    |
| www.niwwin.co.qq                         | 8     |
| az835984.vo.msecnd.net                   | 5     |
| asset.pagefair.com                       | 3     |
| b.scorecardresearch.com                  | 3     |
| cdn.oolala.com                           | 3     |
| asset.pagefair.net                       | 2     |
| dy2.teny.co.qq                           | 2     |
| ecdn.firstimpression.io                  | 2     |
| pagead2.googlesyndication.com            | 2     |
| server.exposebox.com                     | 2     |
| totalmedia2.teny.co.qq                   | 2     |
| vrp.mybrain.com                          | 1     |
| trc.oolala.com                           | 1     |
| zdwidget3-bs.sphereup.com                | 1     |
| vrt.mybrain.com                          | 1     |
| www.googletagmanager.com                 | 1     |
| a.visualrevenue.com                      | 1     |
| tpc.googlesyndication.com                | 1     |
| static.dynamicyield.com                  | 1     |
| st.dynamicyield.com                      | 1     |
| sf.exposebox.com                         | 1     |
| mediadownload.teny.co.qq                 | 1     |
| cdn.firstimpression.io                   | 1     |
| ajax.googleapis.com                      | 1     |
----------------------------------------------------

Status code count
--------------------

| Status Code                  | Count |
----------------------------------------
| 200 OK                       | 327   |
| 204 No Content               | 1     |
| 301 Moved Permanently        | 1     |
| 302 Moved Temporarily        | 1     |
| 304 Not Modified             | 2     |
----------------------------------------

Content-type count
--------------------

| Content-type                   | Count |
------------------------------------------
| application/javascript         | 11    |
| application/json               | 1     |
| application/x-javascript       | 23    |
| image/gif                      | 22    |
| image/jpeg                     | 157   |
| image/png                      | 85    |
| text/css                       | 9     |
| text/html                      | 8     |
| text/javascript                | 13    |
------------------------------------------
相关问题
最新问题