Age | Commit message (Collapse) | Author | Files | Lines |
|
Don't hide status bar line when dumping flows but
print "[Collecting flows ...]" on the same line.
Really there is no sense to hide this status bar line.
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Show bytes/pkts counters per src/dst direction. By default counters
originated from dst are showed. Src counters are showed only if '-s' is
specified.
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Get rid of flushing connections which resets all counters.
Use dump whole ipv4/ipv6 connection tables to fullfill the existing
flows, but this needs to use hand-made flow filtering because
nfct_filter does not work when we do NFCT_Q_DUMP.
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Rename collector_cb to reflect behaviour such as catching flow events.
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Rename ct_dump variable & update_cb function so they reflect 'updating'
of a particular flow at runtime.
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Move creating nfct filter to separate function to make collector() less
messy.
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
There might be new fast connection between flush &
handling new events which can be not handled,
so put flushing connections before loop.
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
The city_{src,dst}, country_{src,dst} and rev_dns_{src,dst} members of
struct flow_entry have their size defined at compile time, so perform
the equal size checks at compile time as well.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Seems it was caused by specifying all netfilter groups
when flushing connections.
Used separated nfct instance w/o netfilter groups to
flush ipv4/ipv6 connections.
More info can be fetched from the issue item on github:
https://github.com/netsniff-ng/netsniff-ng/issues/145
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
|
|
'G' should be printed when bytes > 1000000000 but
it was printed with 'M' prefix which was caused
by missing 'else'.
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
|
|
Replace n & tmp variables to more understandable prev & next.
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
|
|
Rename tcp -> is_tcp param and change it to bool.
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
|
|
Convert int -> bool as parameter.
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
|
|
Use bool as return type in flow_entry_get_extended_is_dns(...) func.
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
|
|
Only 0/1 are used as return values, change to type bool.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Use a switch statement instead of looking up a valid state in the
*_states_show bool arrays in presenter_flow_wrong_state(). This makes
the code a bit easier to read.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Just assign a default value of false and override it with true if the
checks go through.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Moved sysctl get/set funcs from flowtop to separated sysctl module.
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
|
|
Follow-up of commit 9a89c1d813fb ("Revert "flowtop: Fix hanging
while waiting for collector"") which both address the clean up
in the panic handler.
This reverts commit 451275470106024f106a310a5af050b3ca046a4f.
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
|
|
Align the arguments/parameters on successive lines with the opening
parenthesis.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
flowtop and the netsniff-ng's netlink message dissector both need to get
the process name for a pid from /proc/<pid>/exe, thus move that
functionality to an own function.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Make the path creation a bit more straight-forward.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Print flow bytes amount in human readable format units (G,M,K).
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
[tklauser: Make bandw2str static, change arg type, formatting]
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Count flows which might be showed and show this number
on the top status line.
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Mark each flow if it is visible on the screen to know if it is needed
update traffic acct info.
Changed to use non blocking recv of nf conntrack events to update
traffic accounting.
Now nf_conntrack is cloned when new flow entry is added to send dump
request which is used to update traffic accounting info (packet, bytes).
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
[tklauser: Formatting changes]
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Change code to walk each flow by presenter to look more understandable.
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
[tklauser: Revert unnecessary whitespace changes]
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
While removing flow which is pointed by 'head' then head is set to
NULL and all the list disappears, so fixed by set removing flow next
entry to list 'head'.
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
|
|
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
In case if main thread already initialized screen but then collector
called panic, the process exits but console stays with the same colored
screen and shifted shell prompt.
Fixed by adding conditional variable locking.
Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
No need for some of the empty lines, remove them to make the output a
bit denser.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Try to convert the directory entry name to an unsigned integer with
strtoul() instead of using strspn() to determine if a proc entry is a
PID. If it is a valid PID (i.e. strtoul returned a value != 0), we can
directly use it to pass into walk_process() and there set
flow_entry->proc_num.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Instead of testing three skip conditions for every entry, make use of
the short-circuit evaluation of the boolean OR operator to only test as
few conditions as necessary.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Move the copyright/bug report/license string to an own constant and use
it for the output of help() and version() to avoid duplication and
prevent the strings from getting out of sync. This makes the text
section of flowtop.o slightly smaller:
before:
text data bss dec hex filename
15601 4 48 15653 3d25 flowtop/flowtop.o
after:
text data bss dec hex filename
15228 4 48 15280 3bb0 flowtop/flowtop.o
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Follow commit 9ad7f8882097 ("build: astraceroute: Only build ioops with
GeoIP support enabled").
The ioops module is only needed in geoip.o, thus make it dependent on
CONFIG_GEOIP.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Up to now, the lookup of TCP/UDP port names and Ethernet types was
tightly integrated with the dissector infrastructure, since it is its
main user. However, flowtop also makes use of the name lookup
functionality without needing the actual dissector infrastructure. Thus,
the basic dissector infrastructure also needs to be linked into flowtop
without actually being used.
Fix this by extracting the port/ethertype lookup into an own module
which can then be used either directly (for flowtop) or as part of the
dissector infrastructure (for netsniff-ng).
This also reverts the quick & dirty fix introduced in commit f3322c6
("flowtop: Include netlink dissector to fix build temporarily").
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Change the interface to the geoip_* functions to take a pointer to a
struct sockaddr_in{,6} instead of the struct itself.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Any types that are fixed width should use the standard format specifier
macros (PRI... for printf-type functions, SCN... for scanf-type
functions) to ensure proper data access.
Prior to this ifpps was crashing in 32-bit environments due to the
following call
mvwprintw(screen, (*voff)++, 2,
"%s,%s %s (%s%s), t=%lums, cpus=%u%s/%u"
" ", uts.release, machine,
ifname, drvinf.driver, buff, ms_interval, top_cpus,
top_cpus > 0 && top_cpus < cpus ? "+1" : "", cpus);
since ms_interval is a uint64_t but %lu expects an unsigned long, which
is only 32 bits.
Signed-off-by: James McCoy <vega.james@gmail.com>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Handle all termination signals that we're allowed to handle (SIGKILL
can't be handled) in order to exit gracefully in any regular termination
case.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Fix the following compiler warnings that occur when building with "-W
-Wall -Wextra":
flowtop.c: In function ‘walk_process’:
flowtop.c:417:45: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]
flowtop.c: In function ‘presenter_screen_update’:
flowtop.c:937:16: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]
flowtop.c:938:17: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
In order to avoid compiler warnings when compiling with
-W/-Wunused-parameter, mark unused function parameters with
__maybe_unused.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
Those are fixes for the following warnings:
pcap_mm.c:119:29: warning: Using plain integer as NULL pointer
pcap_mm.c:141:29: warning: Using plain integer as NULL pointer
ring.c:24:31: warning: Using plain integer as NULL pointer
flowtop.c:1114:22: warning: Using plain integer as NULL pointer
ifpps.c:1133:29: warning: Using plain integer as NULL pointer
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
|
|
In order to be able to better track regressions or to give support,
let us track the Git id as well in version information. This makes
the ``--version'' switch actually useful.
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
|
|
Consolidate all conntrack header includes into conntrack.h as this
is more clean.
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
|
|
ncurses (de-)initialization is duplicated across flowtop and ifpps, so
move it to an own module and use it from both tools.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
The screen pointer can never be NULL, since initscr() exits the process
in case of an error. Thus the bug_on() check can be omitted.
Also rework presenter_screen_init() - where initscr() is called - to
return the pointer.
This will also silence a Coverity scanner error (even though it isn't
actually one).
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
|
|
If this is ever the case, bail out.
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
|
|
Finally eliminate xutils.{c,h} and move the rest to epoll2.
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
|
|
Add an extra file for signal handling functions.
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
|
|
Rename xio to ioops (io-ops) and boil its include files down to a
minimum.
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
|