Re: libpcap pcap_stats() integer wrap in struct pcap_stat u_int

[Brandon Enright <bmenrigh () ucsd edu>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Fri, 7 Jan 2011 00:01:59 +0000
Brandon Enright <bmenrigh () ucsd edu> wrote:
> Hey all, this in my first post to this list.  I searched the archives
> and without any luck so it seemed reasonable to ask.  I typed up a
> long question regarding 32 bit integer wrap of the elements in struct
> pcap_stat.
>
> Then I looked at the source and I see that struct pcap_stat_ex
> declares everything as u_long and can be filled with pcap_stats_ex()
> which solves my problem.
>
> I figured I'd send a note to the list anyways since I assume there
> will be others searching about this.

Oops, I spoke too soon.  pcap_stats_ex() and struct pcap_stat_ex are
wrapped in a #ifdef MSDOS and aren't available on Unix systems.

So the issue I'm having is that statistics are kept in u_ints rather
than u_long which causes the received and drop counts to wrap and
report bogus values.

I haven't yet looked at the implementation of pcap_stats() or
pcap_stats_ex() but is it possible to make pcap_stats_ex() available on
Unix (specifically recent x86_64 Linux kernels)?  I understand that
there is a good chance not all of the fields filled in by
pcap_stats_ex() on MSDOS could be filled in by Linux.

If there is another way to get statistics in 64 bit integers?

Regards,

Brandon
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)

iEYEARECAAYFAk0mYHUACgkQqaGPzAsl94Kl2gCcDbA9h8BXwbaTEgWkFiQPFgDO
6hMAoIWXqiQIb0Wv3mobpAeBKoP/FInc
=we3O
-----END PGP SIGNATURE-----
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.