Example
void dispatcher_handler(u_char* state, const struct pcap_pkthdr* header, const u_char* pkt_data)
{
struct timeval* old_ts = (struct timeval*)state;
u_int delay;
LARGE_INTEGER Bps, Pps;
struct tm ltime;
char timestr[16];
time_t local_tv_sec;
/* 以毫秒计算上一次采样的延迟时间 */
/* 这个值通过采样到的时间戳获得 */
delay = (header->ts.tv_sec - old_ts->tv_sec) * 1000000 - old_ts->tv_usec + header->ts.tv_usec;
/* 获取每秒的比特数b/s */
Bps.QuadPart = (((*(LONGLONG*)(pkt_data + 8)) * 8 * 1000000) / (delay));
/* ^ ^
| |
| |
| |
将字节转换成比特 -- |
|
延时是以毫秒表示的 --
*/
/* 得到每秒的数据包数量 */
Pps.QuadPart = (((*(LONGLONG*)(pkt_data)) * 1000000) / (delay));
/* 将时间戳转化为可识别的格式 */
local_tv_sec = header->ts.tv_sec;
localtime_s(<ime, &local_tv_sec);
strftime(timestr, sizeof timestr, "%H:%M:%S", <ime);
/* 打印时间戳*/
printf("%s ", timestr);
/* 打印采样结果 */
printf("BPS=%I64u ", Bps.QuadPart);
printf("PPS=%I64u\n", Pps.QuadPart);
FILE* fptr = fopen("trafficlog.txt", "a+");
if (fptr == NULL) {
printf("Cannot open traffic log file\n");
exit(1);
}
fprintf(fptr, "Timestamp: %s\n", timestr);
fprintf(fptr, "BPS=%I64u ", Bps.QuadPart);
fprintf(fptr, "PPS=%I64u\n", Pps.QuadPart);
fclose(fptr);
//存储当前的时间戳
old_ts->tv_sec = header->ts.tv_sec;
old_ts->tv_usec = header->ts.tv_usec;
}
编译过程中会提示fopen函数unsafe:fopen deprecated warning
解决方式:
在include头文件之前define “_CRT_SECURE_NO_DEPRECATE”
#define _CRT_SECURE_NO_DEPRECATE
#include <stdio.h>
或者:
修改项目文件预处理定义. To do this, add _CRT_SECURE_NO_DEPRECATE
to Project
Properties -> Configuration Properties -> C/C++ -> Preprocessor -> Preprocessor Definitions.