linux C libpcap 测网速 及流量统计（写完后感觉数据不正确，请高手帮忙看看程序问题）

heimaofj 2010-05-24 03:52:02 




／＊gcc nettraffic.c -o net -lpcap＊／



#define APP_NAME		"sniffex"

#define APP_DESC		"Sniffer example using libpcap"



#include <pcap.h>

#include <stdio.h>

#include <string.h>

#include <stdlib.h>

#include <ctype.h>

#include <errno.h>

#include <sys/types.h>

#include <sys/socket.h>

#include <netinet/in.h>

#include <arpa/inet.h>

#include <limits.h>

/* default snap length (maximum bytes per packet to capture) */

#define SNAP_LEN 1518



/* ethernet headers are always exactly 14 bytes [1] */

#define SIZE_ETHERNET 14



/* Ethernet addresses are 6 bytes */

#define ETHER_ADDR_LEN	6



/* Ethernet header */

struct sniff_ethernet {

        u_char  ether_dhost[ETHER_ADDR_LEN];    /* destination host address */

        u_char  ether_shost[ETHER_ADDR_LEN];    /* source host address */

        u_short ether_type;                     /* IP? ARP? RARP? etc */

};



/* IP header */

struct sniff_ip {

        u_char  ip_vhl;                 /* version << 4 | header length >> 2 */

        u_char  ip_tos;                 /* type of service */

        u_short ip_len;                 /* total length */

        u_short ip_id;                  /* identification */

        u_short ip_off;                 /* fragment offset field */

        #define IP_RF 0x8000            /* reserved fragment flag */

        #define IP_DF 0x4000            /* dont fragment flag */

        #define IP_MF 0x2000            /* more fragments flag */

        #define IP_OFFMASK 0x1fff       /* mask for fragmenting bits */

        u_char  ip_ttl;                 /* time to live */

        u_char  ip_p;                   /* protocol */

        u_short ip_sum;                 /* checksum */

        struct  in_addr ip_src,ip_dst;  /* source and dest address */

};

#define IP_HL(ip)               (((ip)->ip_vhl) & 0x0f)

#define IP_V(ip)                (((ip)->ip_vhl) >> 4)



/* TCP header */

typedef u_int tcp_seq;



struct sniff_tcp {

        u_short th_sport;               /* source port */

        u_short th_dport;               /* destination port */

        tcp_seq th_seq;                 /* sequence number */

        tcp_seq th_ack;                 /* acknowledgement number */

        u_char  th_offx2;               /* data offset, rsvd */

#define TH_OFF(th)      (((th)->th_offx2 & 0xf0) >> 4)

        u_char  th_flags;

        #define TH_FIN  0x01

        #define TH_SYN  0x02

        #define TH_RST  0x04

        #define TH_PUSH 0x08

        #define TH_ACK  0x10

        #define TH_URG  0x20

        #define TH_ECE  0x40

        #define TH_CWR  0x80

        #define TH_FLAGS        (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)

        u_short th_win;                 /* window */

        u_short th_sum;                 /* checksum */

        u_short th_urp;                 /* urgent pointer */

};



void got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet);



void print_payload(const u_char *payload, int len);



void print_hex_ascii_line(const u_char *payload, int len, int offset);



void print_app_banner(void);



void print_app_usage(void);



static unsigned long long total_payload=0;		/*the total bytes up to now*/



/*

 * app name/banner

 */

void

print_app_banner(void)

{



	printf("%s - %s\n", APP_NAME, APP_DESC);

	//printf("%s\n", APP_COPYRIGHT);

	//printf("%s\n", APP_DISCLAIMER);

	printf("\n");



return;

}



/*

 * print help text

 */

void print_app_usage(void)

{



	printf("Usage: %s [interface]\n", APP_NAME);

	printf("\n");

	printf("Options:\n");

	printf("    interface    Listen on <interface> for packets.\n");

	printf("\n");



return;

}



void got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet)

{

	/*the define for BPS PPS and total payload*/

	struct timeval *old_ts=(struct timeval *)args;/*save the time original time when get the pkg*/

	u_long delay;				/*the delay from last packet to this*/

	unsigned long BPS;			/*byte percent second & packet number percent second*/

	float KBPS;

	struct tm* ltime;

	char timestr[16];

	time_t local_tv_sec;

	const struct sniff_ip *ip;			/*ip packet*/

	int size_ip ;

	unsigned long pkgindelay=0;	

	/*the delay from last to this*/

	delay=(header->ts.tv_sec-old_ts->tv_sec)*1000000-old_ts->tv_usec+header->ts.tv_usec;				

	/* define/compute ip header offset */

	ip = (struct sniff_ip*)(packet + SIZE_ETHERNET);

	size_ip = IP_HL(ip)*4;

	if (size_ip < 20) {

		printf("   * Invalid IP header length: %u bytes\n", size_ip);

		return;

	}

	/*byte percent second: b/s*/

	//BPS=(ip->ip_len)

	BPS=(((*(unsigned long*)(ip+16))*1000000)/(delay));

	pkgindelay += ip->ip_len;

	KBPS=(pkgindelay*1000000)/(delay*1024);

	total_payload += ip->ip_len;

	/*change the time formate*/

	local_tv_sec=header->ts.tv_sec;

	ltime=localtime(&local_tv_sec);

	strftime(timestr,sizeof(timestr),"%H:%M:%S",ltime);

	

	

	/*print the time*/

	printf("%s  ",timestr);

	printf("  KBPS=%10.2f kbps",KBPS);

	//printf("BPS=%10.2f kb/s",(BPS/(1024*1024d)));/*the same to KBPS*/

	printf("  Total byte:%I16u bytes\n",total_payload);	

	/*save the time*/

	old_ts->tv_sec=header->ts.tv_sec;

	old_ts->tv_usec=header->ts.tv_usec;

return;

}



int main(int argc, char **argv)

{



	char *dev = NULL;			/* capture device name */

	char errbuf[PCAP_ERRBUF_SIZE];		/* error buffer */

	pcap_t *handle;				/* packet capture handle */



	char filter_exp[20] = "";		/* filter expression [3] */

	struct bpf_program fp;			/* compiled filter program (expression) */

	bpf_u_int32 mask;			/* subnet mask */

	bpf_u_int32 net;			/* ip */

	int num_packets = 0;			/* number of packets to capture */

	struct timeval original_ts;		/*the time when capture th pkg*/



	print_app_banner();



	/* check for capture device name on command-line */

	if (argc == 2) {

		dev = argv[1];

		filter_exp[20]=argv[2];

	}

	else if (argc > 2) {

		fprintf(stderr, "error: unrecognized command-line options\n\n");

		print_app_usage();

		exit(EXIT_FAILURE);

	}

	else {

		/* find a capture device if not specified on command-line */

		dev = pcap_lookupdev(errbuf);

		if (dev == NULL) {

			fprintf(stderr, "Couldn't find default device: %s\n",

			    errbuf);

			exit(EXIT_FAILURE);

		}

	}

	

	/* get network number and mask associated with capture device */

	if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) {

		fprintf(stderr, "Couldn't get netmask for device %s: %s\n",

		    dev, errbuf);

		net = 0;

		mask = 0;

	}



	/* print capture info */

	printf("Device: %s\n", dev);

	printf("Number of packets: %d\n", num_packets);

	printf("Filter expression: %s\n", filter_exp);



	/* open capture device */

	handle = pcap_open_live(dev, SNAP_LEN, 1, 1000, errbuf);

	if (handle == NULL) {

		fprintf(stderr, "Couldn't open device %s: %s\n", dev, errbuf);

		exit(EXIT_FAILURE);

	}

	/* make sure we're capturing on an Ethernet device [2] */

	if (pcap_datalink(handle) != DLT_EN10MB) {

		fprintf(stderr, "%s is not an Ethernet\n", dev);

		exit(EXIT_FAILURE);

	}

	/* compile the filter expression */

	if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {

		fprintf(stderr, "Couldn't parse filter %s: %s\n",

		    filter_exp, pcap_geterr(handle));

		exit(EXIT_FAILURE);

	}

	/* apply the compiled filter */

	if (pcap_setfilter(handle, &fp) == -1) {

		fprintf(stderr, "Couldn't install filter %s: %s\n",

		    filter_exp, pcap_geterr(handle));

		exit(EXIT_FAILURE);

	}

	/* now we can set our callback function */

	pcap_loop(handle, num_packets, got_packet, (unsigned char*)&original_ts);



	/* cleanup */

	pcap_freecode(&fp);

	pcap_close(handle);



	printf("\nCapture complete.\n");



return 0;

}

linux C语言 （用libpcap库）测网速 及流量统计，写完后感觉数据不正确，请高手帮忙看看程序问题。
运行结果如下：

先谢谢了
...全文
1173 6 打赏 收藏 转发到动态 举报
AI 作业
写回复
用AI写文章
6 条回复
切换为时间正序
请发表友善的回复…
发表回复
siasjack 2011-12-11
  • 打赏
  • 举报
 回复
我已经加你好友了，这短时间也在写这个！希望能和你交流一下！我qq815872995，加我好友吧 呵呵
fbmouth 2010-07-08
  • 打赏
  • 举报
 回复
网络类型转换。。。
fbmouth 2010-07-08
  • 打赏
  • 举报
 回复
每个包的长度应该为，IP包长-IP包头-TCP包头（或者其他类型的包头，应该判断一个包的类型后，再根据包头的大小不同，去掉相应包头就要以了）
heimaofj 2010-05-31
  • 打赏
  • 举报
 回复 


/*

*this is a program of getting the speed of network  

*/



static unsigned long sec_delay=0;	

static unsigned long up_total_load=0;	

static unsigned long down_total_load=0;	

static unsigned long up_sec_load=0;	

static unsigned long down_sec_load=0;	

static struct in_addr tmp_ip;		

static char local_ip[16];		



							

void

got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet)

{

	

	struct timeval *old_ts=(struct timeval *)args;

	unsigned long msec_delay=0;		

	unsigned long msec_load=0;

	struct tm* ltime;

	char timestr[16];

	time_t local_tv_sec;

	double UP_BPS,DOWN_BPS;

	static int count = 1;                 

	

	

	const struct sniff_ethernet *ethernet; 

	const struct sniff_ip *ip;             

	const struct sniff_tcp *tcp;           

	const char *payload;                   



	int size_ip;

	int size_tcp;

	int size_payload;

	// the number of packet	

	printf("\nPKGID:%d", count);

	count++;

	//change the time foramte

	local_tv_sec=header->ts.tv_sec;

	ltime=localtime(&local_tv_sec);

	strftime(timestr,sizeof(timestr),"%H:%M:%S",ltime);

	printf(" %s ",timestr);



	/* define ethernet header */

	ethernet = (struct sniff_ethernet*)(packet);

	

	/* define/compute ip header offset */

	ip = (struct sniff_ip*)(packet + SIZE_ETHERNET);

	size_ip = IP_HL(ip)*4;

	if (size_ip < 20) {

		printf("   * Invalid IP header length: %u bytes\n", size_ip);

		return;

	}



	/* print source and destination IP addresses 

	*QUESTION:printf(" scr: %s > dst %s", inet_ntoa(ip->ip_src),inet_ntoa(ip->ip_dst));

	*/

	printf(" scr: %s > dst ", inet_ntoa(ip->ip_src)/*,inet_ntoa(ip->ip_dst)*/);

	printf("%s",inet_ntoa(ip->ip_dst));



	/* determine protocol */	

	switch(ip->ip_p) {

		case IPPROTO_TCP:

			{

			printf(" TCP ");

			/* define/compute tcp header offset */

			tcp = (struct sniff_tcp*)(packet + SIZE_ETHERNET + size_ip);

			/*the TCP header length*/

			size_tcp = TH_OFF(tcp)*4;

			

			if (size_tcp < 20) {

				printf("   * Invalid TCP header length: %u bytes\n", size_tcp);

				return;

			}

			//tcp scr port and dst port

			printf(" Sp: %d,dp %d\n", ntohs(tcp->th_sport), ntohs(tcp->th_dport));

			/* compute tcp payload (segment) size */

			size_payload = ntohs(ip->ip_len) - (size_ip + size_tcp);

			/*the download of every packet we get in a seccond*/

			msec_load=ntohs(ip->ip_len)-size_payload;

			break;

			}

		case IPPROTO_UDP:

			{

			printf(" UDP ");

			/* define/compute tcp header offset */

			//tcp = (struct sniff_tcp*)(packet + SIZE_ETHERNET + size_ip);

			/*the TCP header length*/

			//size_tcp = TH_OFF(tcp)*4;

			

			//if (size_tcp < 20) {

			//	printf("   * Invalid UDP header length: %u bytes\n", size_tcp);

			//	return;

			//}

			//tcp scr port and dst port

			//printf(" Sp: %d,dp %d\n", ntohs(tcp->th_sport), ntohs(tcp->th_dport));



			size_payload=size_ip;

			msec_load=ntohs(ip->ip_len)-size_payload;

			break;

			}

		case IPPROTO_ICMP:

			{

			printf(" ICMP ");

			size_payload=size_ip;

			msec_load=ntohs(ip->ip_len)-size_payload;

			break;

			}

		case IPPROTO_IP:

			{

			printf(" IP ");

			size_payload=size_ip;

			msec_load=ntohs(ip->ip_len)-size_payload;

			break;

			}

		default:

			printf(" unknown ");

			return;

	}



			

	msec_delay=(header->ts.tv_sec-old_ts->tv_sec)*1000000-old_ts->tv_usec+header->ts.tv_usec;

	/*the position of the last dot in ip*/	

	int length=strlen(local_ip)-strlen(strrchr(local_ip,'.'));

	/* decide whether upload or download */

	if(!strncmp(local_ip,inet_ntoa(ip->ip_src),length))

	{/* the source ip equal local ip :upload */

		up_sec_load += msec_load;

		sec_delay += msec_delay;	

	}

	else

	{/* the dest ip equal local ip :download */

		down_sec_load += msec_load;

		sec_delay += msec_delay;

	}



	up_total_load += up_sec_load;

	down_total_load += down_sec_load;

	//printf("msec_delay:%lu msec_load:%lu ",msec_delay,msec_load);

	//printf("sec_delay:%lu sec_load:%lu ",sec_delay,sec_load);

	/* print BPS where the sec_delay greater one second and set sec_delay sec_load to zero*/

	if(sec_delay>=1000000)

	{

		UP_BPS=(up_sec_load*1000000)/(msec_delay*2^10);

		DOWN_BPS=(down_sec_load*1000000)/(msec_delay*2^10);

		sec_delay=0;

		up_sec_load=0;

		down_sec_load=0;		

		printf("UP_BPS:%4.2f kb/s,DOWN_BPS:%4.2f kb/s",UP_BPS,DOWN_BPS);

		printf(" UP_TOTAL: %lu bytes, DOWN_TOTAL: %lu bytes ",up_total_load,down_total_load);

	}		

	/*save the time stamp*/

	old_ts->tv_sec=header->ts.tv_sec;

	old_ts->tv_usec=header->ts.tv_usec;



return;

}



int main(int argc, char **argv)

{



	char *dev = NULL;			/* capture device name */

	char errbuf[PCAP_ERRBUF_SIZE];		/* erroebuffer */

	pcap_t *handle;				/* packet capture handle */



	char *filter_exp = NULL;		/* filter expression */

	struct bpf_program fp;			/* compiled filter program (expression) */

	bpf_u_int32 mask;			/* subnet mask */

	bpf_u_int32 net;			/* ip */

	int num_packets = 0;			/* number of packets to capture */

	struct timeval original_ts;		/*the original time set the loopback function*/

	print_app_banner();			/*print program name*/

	print_app_usage();			/*print the help message*/

	

	

	/* check for capture device name on command-line */

	if (argc == 2) 

	{

		dev = argv[1];

	}

	if(argc==3)

	{

		dev=argv[1];

		filter_exp=argv[2];

	}

	else if (argc > 3) {

		fprintf(stderr ,"error: unrecognized command-line options\n\n");

		print_app_usage();

		exit(EXIT_FAILURE);

	}

	else {

		/* find a capture device if not specified on command-line */

		filter_exp="ip";

		dev = pcap_lookupdev(errbuf);

		if (dev == NULL) {

			fprintf(stderr, "Couldn't find default device: %s\n", errbuf);

			exit(EXIT_FAILURE);

		}

	}

	

	

	if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) {

		fprintf(stderr, "Couldn't get netmask for device %s: %s\n",

		    dev, errbuf);

		net = 0;

		mask = 0;

	}

	

	tmp_ip.s_addr=net;	

	strcpy(local_ip,inet_ntoa(tmp_ip));

	printf("----%s------",local_ip);	

	

	printf("Device: %s\n", dev);

	printf("Number of packets: %d\n", num_packets);

	printf("Filter expression: %s\n", filter_exp);

	

	handle = pcap_open_live(dev, SNAP_LEN, 1, 1000, errbuf);

	if (handle == NULL) {

		fprintf(stderr, "Couldn't open device %s: %s\n", dev, errbuf);

		exit(EXIT_FAILURE);

	}



	

	if (pcap_datalink(handle) != DLT_EN10MB) {

		fprintf(stderr, "%s is not an Ethernet\n", dev);

		exit(EXIT_FAILURE);

	}



	

	if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {

		fprintf(stderr, "Couldn't parse filter %s: %s\n",

		    filter_exp, pcap_geterr(handle));

		exit(EXIT_FAILURE);

	}



	

	if (pcap_setfilter(handle, &fp) == -1) {

		fprintf(stderr, "Couldn't install filter %s: %s\n",

		    filter_exp, pcap_geterr(handle));

		exit(EXIT_FAILURE);

	}



	

	pcap_loop(handle, num_packets, got_packet, (unsigned char*)&original_ts);



	/* cleanup */

	pcap_freecode(&fp);

	pcap_close(handle);



	printf("\nCapture complete.\n");



return 0;

}
heimaofj 2010-05-31
  • 打赏
  • 举报
 回复
这段时间一直在看libpcap库，经过这段时间的学习，对上面数据原因做以下解释
1>得到IP数据包后，应该把各个数据包头占的字节数去除，才能真正得到正确的数据字节。
2>所谓速度其实是一个平均值，一般应该以秒为单位，即每秒通过的数据量，时间差应该是抓包前后的时间差。
3>我进行计算网络速度思路：首先把抓包前后的时间差相加，同时得到的不包括头在内的数据字节相加，如果抓包前后的时间差之和大于一秒的话，就输出（抓包前后的时间差之和）除以（不包括头在内数据字节之和），然后设置时间差之和变量、不包括头在内数据字节之和变量为零，即得当前的网速。

这是我的理解，如果有什么地方欠妥请大家指正，谢谢。
heimaofj 2010-05-24
  • 打赏
  • 举报
 回复
运行结果：

Device: eth0
Number of packets: 0
Filter expression:
15:55:55 KBPS= 0.00 kbps Total byte: 14336 bytes
15:55:55 KBPS= 4.00 kbps Total byte: 31744 bytes
15:55:55 KBPS= 13.00 kbps Total byte: 49152 bytes
15:55:55 KBPS= 2723.00 kbps Total byte: 67584 bytes
15:55:55 KBPS= 11.00 kbps Total byte: 93184 bytes
15:55:56 KBPS= 7.00 kbps Total byte: 118784 bytes
15:55:57 KBPS= 2.00 kbps Total byte: 144384 bytes
15:56:08 KBPS= 1.00 kbps Total byte: 160512 bytes
15:56:08 KBPS= 5.00 kbps Total byte: 200448 bytes
15:56:08 KBPS= 5811.00 kbps Total byte: 216576 bytes
15:56:08 KBPS= 14.00 kbps Total byte: 260096 bytes
15:56:08 KBPS= 15.00 kbps Total byte: 276224 bytes
15:56:08 KBPS= 30.00 kbps Total byte: 316160 bytes
15:56:08 KBPS= 3948.00 kbps Total byte: 332288 bytes
15:56:08 KBPS= 14.00 kbps Total byte: 375808 bytes
15:56:08 KBPS= 2029.00 kbps Total byte: 391168 bytes
15:56:08 KBPS= 6.00 kbps Total byte: 402432 bytes
15:56:08 KBPS= 20658.00 kbps Total byte: 412672 bytes
15:56:08 KBPS= 1247.00 kbps Total byte: 443907 bytes
15:56:08 KBPS= 2603.00 kbps Total byte: 454147 bytes
15:56:09 KBPS= 1.00 kbps Total byte: 510472 bytes
15:56:09 KBPS= 29840.00 kbps Total byte: 520712 bytes
15:56:09 KBPS= 6301.00 kbps Total byte: 577037 bytes
15:56:09 KBPS= 201424.00 kbps Total byte: 587277 bytes
15:56:09 KBPS= 15964.00 kbps Total byte: 643602 bytes
15:56:09 KBPS= 146490.00 kbps Total byte: 653842 bytes
15:56:09 KBPS= 7602.00 kbps Total byte: 710167 bytes
15:56:09 KBPS= 161139.00 kbps Total byte: 720407 bytes
15:56:09 KBPS= 12280.00 kbps Total byte: 776732 bytes
15:56:09 KBPS= 179043.00 kbps Total byte: 786972 bytes
15:56:09 KBPS= 15964.00 kbps Total byte: 843297 bytes
15:56:09 KBPS= 230198.00 kbps Total byte: 853537 bytes
Linux常用网络工具总结
本文不会深入研究这些命令的强大用法，因为每个命令都足以写一篇文章，本文只是简单地介绍并辅以几个简单demo实例，旨在大脑中留个印象，平时遇到问题时能够快速搜索出这些工具，利用强大的man工具，提供一定的思路...
流量抓包和网络问题排查，网工不要只会Wireshark，用好TCPdump才是大神！零基础入门到精通，收藏这篇就够了
tcpdump是一款功能强大的命令行网络数据包分析工具。它由Lawrence Berkeley National Laboratory开发并作为开源项目发布。...TCPdump 运行在用户态，本质上是通过调用 Libpcap 库的各种 API 来实现数据包的抓取功能。
Linux——linux常用网络工具总结
原文链接：http://int32bit.me/2016/05/04/Linux常用网络工具...本文不会深入研究这些命令的强大用法，因为每个命令都足以写一篇文章，本文只是简单地介绍并辅以几个简单demo实例，旨在大脑中留个印象，平时遇到问...
实用运维工具汇总推荐
学习路线图 攻击和防守要学的东西也不少，具体要学的东西我都写在了上面的路线图，如果你能学完它们，你去就业和接私活完全没有问题。 2.视频教程 网上虽然也有很多的学习资源，但基本上都残缺不全的，这是我自己录...
Linux阶段
Linux是由Unix操作系统为内核的类Unix操作系统，Mac OS也属于类Unix操作系统的。Linux第一个用户就是，密码默认没有的可以直接进入。登录后最前方会出现一段字符字符串，#为管理员而$是普通用户。在远程登录可以连接...
C语言

70,022

社区成员

243,263

社区内容

发帖
与我相关
我的任务
社区描述
C语言相关问题讨论
社区管理员
  • C语言
  • 花神庙码农
  • 架构师李肯
加入社区
  • 近7日
  • 近30日
  • 至今

加载中

查看更多榜单
社区公告
暂无公告

试试用AI创作助手写篇文章吧

+ 用AI写文章