[prev in list] [next in list] [prev in thread] [next in thread] 

List:       freebsd-hackers
Subject:    Re: tcpdump etc
From:       Dan Busarow <dan () dpcsys ! com>
Date:       1996-06-29 21:29:22
[Download RAW message or body]

On Sat, 29 Jun 1996, Brandon Gillespie wrote:
> I'm looking for a script that will sit on top of tcpdump and simply 
> record the total bytes used by each system it receives information about 

Here's what I use on a log file generated by tcpdump -t -n -q gateway
Each site I'm interested in has their own log file so no site name
logic is required.

Dan
-- 
 Dan Busarow                                                    714 443 4172
 DPC Systems                                                  dan@dpcsys.com
 Dana Point, California      83 09 EF 59 E0 11 89 B4 8D 09 DB FD E1 DD 0C 82

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <string.h>
#include <time.h>

char progname[256];
char errbuf[132];

main(int argc, char **argv)
{
	FILE *fp;
	char *cp;
	long bytes = 0;
	char filename[64];
	char line[255];
	int daily = 0;
	time_t now;

	strcpy(progname, argv[0]);
	while(argc > 1 && argv[1][0] == '-')
	{	switch(argv[1][1])
		{
			case 'd':
				daily = 1;
				break;
		}
		argc--;
		argv++;
	}
	if(argc == 2)
		strcpy(filename, argv[1]);
	else
	{	printf("usage: %s [-d] filename\n", progname);
		printf("       -d daily run\n");
		exit(1);
	}
	if((fp = fopen(filename, "r")) == (FILE *)NULL)
	{	printf("could not open %s\n", filename);
		exit(1);
	}
	while(fgets(line, 132, fp) != (char *)NULL)
	{
		cp = strtok(line, " ");
		while((cp = strtok((char *)NULL, " ")) != (char *)NULL)
		{
			if(!strcmp(cp, "tcp") || !strcmp(cp, "udp"))
			{	cp = strtok((char *)NULL, " ");
				bytes += strtol(cp, (char **)NULL, 10);
			}
		}
	}
	fclose(fp);
	if(daily)
	{	now = time(0);
		strftime(errbuf, 24, "%Y%m%d %H:%M ", localtime(&now));
		printf("%s %12ld\n", errbuf, bytes);
	 	truncate(filename, 0);
	}
	else
		printf("Total bytes = %ld\n", bytes);
}

[prev in list] [next in list] [prev in thread] [next in thread]