From 278f62a9da99dcca7a7b95f34635b0fcd1a88185 Mon Sep 17 00:00:00 2001 From: Daniel Borkmann Date: Tue, 25 Jun 2013 12:30:58 +0200 Subject: netsniff-ng: tpacketv3: 'fix' packet accounting output In netsniff-ng, we use tpacketv3 for capturing-only mode. The issue observed lately is that when using f.e. -n10 or capturing a pcap and then quitting, the pcap or actually seen number of packets are less than what the statistics tell us from getsockopt(2). This is due to the fact that tpacketv3 divides its ring buffer into blocks of frames. Meaning, while we are traversing block n, the kernel already fills up block n+1 and following if new packets arrive. While doing so, it increments packet counters. Thus, when we ^C, we haven't seen those blocks, so the stats tell us mostly a slightly higher result. Fix this by adjusting socket stats printing to this fact. Signed-off-by: Daniel Borkmann --- ring_rx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'ring_rx.c') diff --git a/ring_rx.c b/ring_rx.c index c674332..96101be 100644 --- a/ring_rx.c +++ b/ring_rx.c @@ -131,7 +131,7 @@ void bind_rx_ring(int sock, struct ring *ring, int ifindex) bind_ring_generic(sock, ring, ifindex); } -void sock_rx_net_stats(int sock) +void sock_rx_net_stats(int sock, unsigned long seen) { int ret; bool v3 = get_sockopt_tpacket(sock) == TPACKET_V3; @@ -147,7 +147,8 @@ void sock_rx_net_stats(int sock) uint64_t packets = stats.k3.tp_packets; uint64_t drops = stats.k3.tp_drops; - printf("\r%12ld packets incoming\n", packets); + printf("\r%12ld packets incoming (%ld unread on exit)\n", + v3 ? seen : packets, v3 ? packets - seen : 0); printf("\r%12ld packets passed filter\n", packets - drops); printf("\r%12ld packets failed filter (out of space)\n", drops); if (stats.k3.tp_packets > 0) -- cgit v1.2.3-54-g00ecf