是在Ubuntu 14.04 LTS上实现的pcap_stats

Is pcap_stats implemented on Ubuntu 14.04 LTS?

本文关键字：pcap stats 实现 Ubuntu LTS 是在      更新时间：2023-10-16

阅读pcap手册页，我看到了关于pcap_stats（）的简介：

统计数据在所有平台上的表现并不相同。ps_recv可能会统计数据包，无论它们是否通过了任何带有pcap_setfilter（3PCAP）的过滤器集，也可能只统计通过过滤器的数据包。它还可以计数丢弃的数据包，也可以不计数，因为数据包到达时操作系统的缓冲区中没有空间。ps_drop并非在所有平台上都可用；在不可用的平台上为零。如果数据包过滤是在libpcap中完成的，而不是在操作系统中，它会对未通过过滤器的数据包进行计数。ps_recv和ps_drop都可能计数尚未从操作系统读取的数据包，因此应用程序尚未看到这些数据包。ps_ifdrop可能实现，也可能不实现；如果为零，则可能意味着接口没有丢弃任何数据包，或者可能意味着统计信息不可用，因此不应将其视为接口没有丢弃所有数据包的指示。

所有这些"可能或不可能"子句并没有真正激发人们对这个函数调用会给我带来任何有用东西的信心。

有人知道Ubuntu 14.04 LTS是否以一种有意义的方式支持pcap_stats（）调用吗？

所有这些"may or may not"子句并没有真正激发人们对这个函数调用会给我带来任何有用东西的信心。

这就是目的。libpcap位于许多不同的底层数据包捕获机制之上，这些机制提供统计信息的能力各不相同，不幸的是，pcap_stats()在缺乏指示哪些统计信息有效和指示数据包计数位置的能力方面并没有变化。

有人知道Ubuntu 14.04 LTS是否以一种有意义的方式支持pcap_stats（）调用吗？

内核版本很重要，因为它控制运行libpcap的数据包捕获代码。14.04.4版本将有一个4.2内核。

14.04似乎也有libpcap 1.5.3。引用libpcap1.5.3:中pcap-linux.c中的注释

     * On systems where the PACKET_STATISTICS "getsockopt()"
     * argument is supported on PF_PACKET sockets:
     *
     *  "ps_recv" counts only packets that *passed* the
     *  filter, not packets that didn't pass the filter.
     *  This includes packets later dropped because we
     *  ran out of buffer space.
     *
     *  "ps_drop" counts packets dropped because we ran
     *  out of buffer space.  It doesn't count packets
     *  dropped by the interface driver.  It counts only
     *  packets that passed the filter.
     *
     *  See above for ps_ifdrop. 
     *
     *  Both statistics include packets not yet read from
     *  the kernel by libpcap, and thus not yet seen by
     *  the application.
     *
     * In "linux/net/packet/af_packet.c", at least in the
     * 2.4.9 kernel, "tp_packets" is incremented for every
     * packet that passes the packet filter *and* is
     * successfully queued on the socket; "tp_drops" is
     * incremented for every packet dropped because there's
     * not enough free space in the socket buffer.
     *
     * When the statistics are returned for a PACKET_STATISTICS
     * "getsockopt()" call, "tp_drops" is added to "tp_packets",
     * so that "tp_packets" counts all packets handed to
     * the PF_PACKET socket, including packets dropped because
     * there wasn't room on the socket buffer - but not
     * including packets that didn't pass the filter.
     *
     * In the BSD BPF, the count of received packets is
     * incremented for every packet handed to BPF, regardless
     * of whether it passed the filter.
     *
     * We can't make "pcap_stats()" work the same on both
     * platforms, but the best approximation is to return
     * "tp_packets" as the count of packets and "tp_drops"
     * as the count of drops.
相关文章：