Date: Mon, 20 Mar 2006 13:42:54 -0600 (CST) From: Ben Allen <benjamin@umn.edu> To: FreeBSD-gnats-submit@FreeBSD.org Cc: Ben Allen <benjamin@umn.edu> Subject: ports/94777: [patch] Add --zero-delay option to net-mgmt/etherape Message-ID: <20060321140349.D057D844AC@kryten.oitsec.umn.edu> Resent-Message-ID: <200603211410.k2LEAEux005274@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 94777
>Category: ports
>Synopsis: [patch] Add --zero-delay option to net-mgmt/etherape
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-ports-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: update
>Submitter-Id: current-users
>Arrival-Date: Tue Mar 21 14:10:14 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator: Ben Allen
>Release: FreeBSD 5.4-RELEASE-p11 i386
>Organization:
University of Minnesota
>Environment:
System: FreeBSD kryten.oitsec.umn.edu 5.4-RELEASE-p11 FreeBSD 5.4-RELEASE-p11 #9: Fri Feb 17 12:28:15 CST 2006 root@kryten.oitsec.umn.edu:/usr/obj/usr/src/sys/OITSEC-5_4-BEN i386
CPU: Intel(R) Pentium(R) 4 CPU 2.40GHz (2394.01-MHz 686-class CPU)
libraries:
libgnome-2.12.0.1 & friends
>Description:
When using etherape to analyze long packet captures, the "real-time" mode is frustrating.
This patch adds a command line option to disable the inter-packet timing analysis, and
just read the capture file as fast as possible, and then draw the diagram once. This provides
a fast way to analyze conversations occuring in long packet captures.
>How-To-Repeat:
Using tcpdump, capture an hour's worth of low, volume traffic - DNS/SMTP/HTTP traffic on one
workstation should suffice - to a file. Open the capture file in etherape, and watch it
draw the graph. Note, this will take an hour. The patch below will cause the graph to be
drawn as quickly as possible when the "-z" or "--zero-delay" flag is added on the command line.
>Fix:
The patch below applies to /usr/ports/net-mgmt/etherape/work/etherape-0.9.1/src .
ie:
# cd /usr/ports/net-mgmt/etherape
# make extract
# cd work/etherape-0.9.1/src
# patch < the_patch_below
# cd /usr/ports/net-mgmt/etherape
# make install
The patch below has been submitted to the etherape developers as well. However, based on their
project at sourceforge, it seems that the main project seems to be moving rather slowly at the moment.
--- patch.etherape.zero_delay begins here ---
--- capture.c.orig Mon Mar 20 11:08:13 2006
+++ capture.c Mon Mar 20 11:08:53 2006
@@ -527,7 +527,16 @@
this_time.tv_usec = phdr.ts.tv_usec;
diff = substract_times (this_time, last_time);
- ms_to_next = diff.tv_sec * 1000 + diff.tv_usec / 1000;
+
+ if (pref.zero_delay)
+ {
+ ms_to_next = 0;
+ }
+ else
+ {
+ ms_to_next = diff.tv_sec * 1000 + diff.tv_usec / 1000;
+ }
+
last_time = this_time;
--- globals.h.orig Mon Mar 20 11:06:35 2006
+++ globals.h Mon Mar 20 11:07:16 2006
@@ -342,6 +342,8 @@
gchar *interface; /* Network interface to listen to */
gchar *filter; /* Pcap filter to be used */
+ gboolean zero_delay; /* no delay processing tcpdump files */
+
}
pref;
--- main.c.orig Mon Mar 20 11:07:35 2006
+++ main.c Mon Mar 20 11:07:56 2006
@@ -60,6 +60,9 @@
N_("set the node color"), N_("color")},
{"text-color", 'T', POPT_ARG_STRING, &(pref.text_color), 0,
N_("set the text color"), N_("color")},
+ {"zero-delay", 'z', POPT_ARG_NONE, &(pref.zero_delay), 0,
+ N_("zero delay for reading capture files [cli only]"), NULL},
+
POPT_AUTOHELP {NULL, 0, 0, NULL, 0}
};
--- patch.etherape.zero_delay ends here ---
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060321140349.D057D844AC>