From efc02fd2e3734a7bdca3955854fa27419449d9cc Mon Sep 17 00:00:00 2001 From: guy Date: Mon, 10 Dec 2001 07:14:14 +0000 Subject: [PATCH] Put more information into the comments for "pcap_stats()". --- pcap-bpf.c | 8 ++++++-- pcap-dlpi.c | 10 ++++++++-- pcap-linux.c | 36 +++++++++++++++++++++++++++--------- pcap-nit.c | 10 ++++++++-- pcap-pf.c | 42 +++++++++++++++++++++++++++++++++--------- pcap-snit.c | 10 ++++++++-- pcap-snoop.c | 4 +++- 7 files changed, 93 insertions(+), 27 deletions(-) diff --git a/pcap-bpf.c b/pcap-bpf.c index 5ccf4e6..75e3c1e 100644 --- a/pcap-bpf.c +++ b/pcap-bpf.c @@ -20,7 +20,7 @@ */ #ifndef lint static const char rcsid[] = - "@(#) $Header: /tcpdump/master/libpcap/pcap-bpf.c,v 1.47 2001-11-17 21:24:09 guy Exp $ (LBL)"; + "@(#) $Header: /tcpdump/master/libpcap/pcap-bpf.c,v 1.48 2001-12-10 07:14:14 guy Exp $ (LBL)"; #endif #ifdef HAVE_CONFIG_H @@ -69,12 +69,16 @@ pcap_stats(pcap_t *p, struct pcap_stat *ps) /* * "ps_recv" counts packets handed to the filter, not packets - * that passed the filter. + * that passed the filter. This includes packets later dropped + * because we ran out of buffer space. * * "ps_drop" counts packets dropped inside the BPF device * because we ran out of buffer space. It doesn't count * packets dropped by the interface driver. It counts * only packets that passed the filter. + * + * Both statistics include packets not yet read from the kernel + * by libpcap, and thus not yet seen by the application. */ if (ioctl(p->fd, BIOCGSTATS, (caddr_t)&s) < 0) { snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGSTATS: %s", diff --git a/pcap-dlpi.c b/pcap-dlpi.c index 7a4660b..3208ce3 100644 --- a/pcap-dlpi.c +++ b/pcap-dlpi.c @@ -38,7 +38,7 @@ #ifndef lint static const char rcsid[] = - "@(#) $Header: /tcpdump/master/libpcap/pcap-dlpi.c,v 1.73 2001-11-17 21:07:59 guy Exp $ (LBL)"; + "@(#) $Header: /tcpdump/master/libpcap/pcap-dlpi.c,v 1.74 2001-12-10 07:14:15 guy Exp $ (LBL)"; #endif #ifdef HAVE_CONFIG_H @@ -130,7 +130,9 @@ pcap_stats(pcap_t *p, struct pcap_stat *ps) /* * "ps_recv" counts packets handed to the filter, not packets - * that passed the filter. + * that passed the filter. As filtering is done in userland, + * this does not include packets dropped because we ran out + * of buffer space. * * "ps_drop" counts packets dropped inside the DLPI service * provider device device because of flow control requirements @@ -138,6 +140,10 @@ pcap_stats(pcap_t *p, struct pcap_stat *ps) * the interface driver, or packets dropped upstream. As * filtering is done in userland, it counts packets regardless * of whether they would've passed the filter. + * + * These statistics don't include packets not yet read from + * the kernel by libpcap, but they may include packets not + * yet read from libpcap by the application. */ *ps = p->md.stat; return (0); diff --git a/pcap-linux.c b/pcap-linux.c index 1fc9054..1265ae9 100644 --- a/pcap-linux.c +++ b/pcap-linux.c @@ -26,7 +26,7 @@ */ #ifndef lint static const char rcsid[] = - "@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.72 2001-12-10 05:49:40 guy Exp $ (LBL)"; + "@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.73 2001-12-10 07:14:16 guy Exp $ (LBL)"; #endif /* @@ -657,11 +657,6 @@ pcap_stats(pcap_t *handle, struct pcap_stat *stats) * platforms, but the best approximation is to return * "tp_packets" as the count of packets and "tp_drops" * as the count of drops. - * - * Note that "tp_packets" may include packets not yet - * processed by libpcap; the packets may have been - * queued on the socket but not read yet. (The equivalent - * may be true on other platforms.) */ handle->md.stat.ps_recv = kstats.tp_packets; handle->md.stat.ps_drop = kstats.tp_drops; @@ -683,10 +678,33 @@ pcap_stats(pcap_t *handle, struct pcap_stat *stats) } #endif /* - * "ps_recv" counts only packets that passed the filter. + * On systems where the PACKET_STATISTICS "getsockopt()" argument + * is supported on PF_PACKET sockets: * - * "ps_drop" is maintained only on systems that support - * the PACKET_STATISTICS "getsockopt()" argument. + * "ps_recv" counts only packets that *passed* the filter, + * not packets that didn't pass the filter. This includes + * packets later dropped because we ran out of buffer space. + * + * "ps_drop" counts packets dropped because we ran out of + * buffer space. It doesn't count packets dropped by the + * interface driver. It counts only packets that passed + * the filter. + * + * Both statistics include packets not yet read from the + * kernel by libpcap, and thus not yet seen by the application. + * + * On systems where the PACKET_STATISTICS "getsockopt()" argument + * is not supported on PF_PACKET sockets: + * + * "ps_recv" counts only packets that *passed* the filter, + * not packets that didn't pass the filter. It does not + * count packets dropped because we ran out of buffer + * space. + * + * "ps_drop" is not supported. + * + * "ps_recv" doesn't include packets not yet read from + * the kernel by libpcap. */ *stats = handle->md.stat; return 0; diff --git a/pcap-nit.c b/pcap-nit.c index 44fce5e..5b91314 100644 --- a/pcap-nit.c +++ b/pcap-nit.c @@ -20,7 +20,7 @@ */ #ifndef lint static const char rcsid[] = - "@(#) $Header: /tcpdump/master/libpcap/pcap-nit.c,v 1.40 2001-07-29 01:22:41 guy Exp $ (LBL)"; + "@(#) $Header: /tcpdump/master/libpcap/pcap-nit.c,v 1.41 2001-12-10 07:14:18 guy Exp $ (LBL)"; #endif #ifdef HAVE_CONFIG_H @@ -77,13 +77,19 @@ pcap_stats(pcap_t *p, struct pcap_stat *ps) /* * "ps_recv" counts packets handed to the filter, not packets - * that passed the filter. + * that passed the filter. As filtering is done in userland, + * this does not include packets dropped because we ran out + * of buffer space. * * "ps_drop" presumably counts packets dropped by the socket * because of flow control requirements or resource exhaustion; * it doesn't count packets dropped by the interface driver. * As filtering is done in userland, it counts packets regardless * of whether they would've passed the filter. + * + * These statistics don't include packets not yet read from the + * kernel by libpcap or packets not yet read from libpcap by the + * application. */ *ps = p->md.stat; return (0); diff --git a/pcap-pf.c b/pcap-pf.c index 176d45c..01e791c 100644 --- a/pcap-pf.c +++ b/pcap-pf.c @@ -24,7 +24,7 @@ #ifndef lint static const char rcsid[] = - "@(#) $Header: /tcpdump/master/libpcap/pcap-pf.c,v 1.64 2001-07-29 01:22:42 guy Exp $ (LBL)"; + "@(#) $Header: /tcpdump/master/libpcap/pcap-pf.c,v 1.65 2001-12-10 07:14:19 guy Exp $ (LBL)"; #endif #ifdef HAVE_CONFIG_H @@ -196,16 +196,40 @@ pcap_stats(pcap_t *p, struct pcap_stat *ps) { /* - * "ps_recv" counts only packets that passed the filter. + * If packet filtering is being done in the kernel: * - * "ps_drop" counts packets that passed the kernel filter - * (if any) but were dropped because the input queue was - * full. It counts packets regardless of whether they would - * have passed a userland filter. + * "ps_recv" counts only packets that passed the filter. + * This does not include packets dropped because we + * ran out of buffer space. (XXX - perhaps it should, + * by adding "ps_drop" to "ps_recv", for compatibility + * with some other platforms. On the other hand, on + * some platforms "ps_recv" counts only packets that + * passed the filter, and on others it counts packets + * that didn't pass the filter....) * - * "ps_ifdrop" counts packets dropped by the network - * inteface (regardless of whether they would have passed - * the input filter, of course). + * "ps_drop" counts packets that passed the kernel filter + * (if any) but were dropped because the input queue was + * full. + * + * "ps_ifdrop" counts packets dropped by the network + * inteface (regardless of whether they would have passed + * the input filter, of course). + * + * If packet filtering is not being done in the kernel: + * + * "ps_recv" counts only packets that passed the filter. + * + * "ps_drop" counts packets that were dropped because the + * input queue was full, regardless of whether they passed + * the userland filter. + * + * "ps_ifdrop" counts packets dropped by the network + * inteface (regardless of whether they would have passed + * the input filter, of course). + * + * These statistics don't include packets not yet read from + * the kernel by libpcap, but they may include packets not + * yet read from libpcap by the application. */ ps->ps_recv = p->md.TotAccepted; ps->ps_drop = p->md.TotDrops; diff --git a/pcap-snit.c b/pcap-snit.c index a44812f..03e564e 100644 --- a/pcap-snit.c +++ b/pcap-snit.c @@ -25,7 +25,7 @@ #ifndef lint static const char rcsid[] = - "@(#) $Header: /tcpdump/master/libpcap/pcap-snit.c,v 1.55 2001-07-29 01:22:42 guy Exp $ (LBL)"; + "@(#) $Header: /tcpdump/master/libpcap/pcap-snit.c,v 1.56 2001-12-10 07:14:20 guy Exp $ (LBL)"; #endif #ifdef HAVE_CONFIG_H @@ -90,7 +90,9 @@ pcap_stats(pcap_t *p, struct pcap_stat *ps) /* * "ps_recv" counts packets handed to the filter, not packets - * that passed the filter. + * that passed the filter. As filtering is done in userland, + * this does not include packets dropped because we ran out + * of buffer space. * * "ps_drop" counts packets dropped inside the "/dev/nit" * device because of flow control requirements or resource @@ -98,6 +100,10 @@ pcap_stats(pcap_t *p, struct pcap_stat *ps) * interface driver, or packets dropped upstream. As filtering * is done in userland, it counts packets regardless of whether * they would've passed the filter. + * + * These statistics don't include packets not yet read from the + * kernel by libpcap or packets not yet read from libpcap by the + * application. */ *ps = p->md.stat; return (0); diff --git a/pcap-snoop.c b/pcap-snoop.c index c4119fb..76c4715 100644 --- a/pcap-snoop.c +++ b/pcap-snoop.c @@ -20,7 +20,7 @@ */ #ifndef lint static const char rcsid[] = - "@(#) $Header: /tcpdump/master/libpcap/pcap-snoop.c,v 1.32 2001-07-29 01:22:43 guy Exp $ (LBL)"; + "@(#) $Header: /tcpdump/master/libpcap/pcap-snoop.c,v 1.33 2001-12-10 07:14:21 guy Exp $ (LBL)"; #endif #ifdef HAVE_CONFIG_H @@ -134,6 +134,8 @@ pcap_stats(pcap_t *p, struct pcap_stat *ps) /* * "ps_recv" counts only packets that passed the filter. + * As filtering is done in userland, this does not include + * packets dropped because we ran out of buffer space. */ *ps = p->md.stat; return (0);