ns2 Network Simulator 2.29: http_connect.c File Reference

00250 {
00251   int i;
00252 
00253   /* Parse the command line */
00254   i = 1;
00255   while (i < argc) {
00256     if (strcmp (argv[i], "-r") == 0) {
00257       /* -r flag is followed by name of file to read */
00258       if (++i >= argc) Usage (argv[0]);
00259       strcpy (input_name, argv[i]);
00260     }
00261     else if (strcmp (argv[i], "-w") == 0) {
00262       /* -w flag is followed by the name of file to write */
00263       if (++i >= argc) Usage (argv[0]);
00264       strcpy (output_name, argv[i]);
00265     }
00266     else 
00267       Usage (argv[0]);
00268     i++;
00269   }
00270 
00271   /* Open files */
00272   /* Note: program is written to also be used as a filter */
00273 
00274   if (strcmp(output_name, "") == 0) 
00275     /* if no explicit output file named with -w, use stdout */
00276      outFP = stdout;
00277   else 
00278      {
00279       if ((outFP = fopen (output_name, "w")) == NULL) {
00280           fprintf (stderr, "error opening %s\n", output_name);
00281           exit (-1);
00282           }
00283      }
00284 
00285   if (strcmp(input_name, "") == 0)
00286     /* if no explicit input file named with -r, use stdin */
00287      dumpFP = stdin;
00288   else 
00289      {
00290       if ((dumpFP = fopen (input_name, "r")) == NULL) {
00291           fprintf (stderr, "error opening %s\n", input_name);
00292           exit (-1);
00293          }
00294      }
00295   
00296   strcpy(log_name, output_name);
00297   strcat(log_name, ".log");
00298   if ((logFP = fopen (log_name, "w")) == NULL) {
00299       fprintf (stderr, "error opening %s\n", log_name);
00300       exit (-1);
00301      }
00302 
00303   /* begin main loop; once through loop for each line in the tcpdump */
00304   /* a <continue> anywhere in the loop (usually after an error case)
00305      implies beginning of processing a new tcpdump record */
00306 
00307   while (!feof (dumpFP)) {
00308 
00309 /* printf("State is %d, last_state is %d\n", connection_state, last_state); */
00310 
00311     /* Get and parse line of tcpdump file */
00312 
00313     fgets (new_line, sizeof(new_line), dumpFP);
00314 
00315     /* get line pieces; this works because there are always 8 or more 
00316        fields separated by white space in tcpdump ASCII-format lines */
00317 /*    sscanf (new_line, "%s %s %s %s %s %s %s %s %s",
00318                       &ts, &lt, &sh, &gt, &dh, &fl, &p1, &p2, &p3);
00319 */
00320     sscanf (new_line, "%s %s %s %s %s %s %s %s",
00321                       &ts, &sh, &gt, &dh, &fl, &p1, &p2, &p3);
00322 
00323    /* If any part of the connection tuple (source host.port,destination
00324       host.port) differs from the current values, there are no more 
00325       tcpdump records for that connection so treat as end of connection.
00326       The action taken at the end of a connection depends on the current
00327       state of processing in that connection */  
00328 
00329    if ((strcmp(current_src, sh) != 0) ||  /* new source host/port */
00330        (strcmp(current_dst, dh) != 0))    /* new dest. host/port */
00331        {
00332         log_connection(); 
00333 
00334         /* begin processing this record as being from a potential new
00335            TCP connection so initialize connection's state */
00336 
00337         strcpy(current_src, sh);  /* new connection tuple */
00338         strcpy(current_dst, dh);  /* host and port for src & dest */
00339 
00340         have_pending_acks = 0;
00341         have_pending_fins = 0;
00342         have_pending_rsts = 0;
00343         have_pending_othr = 0;
00344 
00345         current_synseq = 0;
00346         connection_state = PENDING;  /* unconnected pending a SYN */
00347         last_state = PENDING;
00348         new_address = 1;        /* true only for very first record
00349                                    from a different TCP connection -- 
00350                                    avoids multiple error messages */
00351        }
00352    
00353    /* break dump record into essential data fields; initializes the
00354       following variables: begin_seq, end_seq, seq_bytes, new_ack,
00355                            has_ack, has_seq, input_type.
00356       Also checks for suspect sequence and ACK values.
00357    */
00358 
00359    if ((rc = parse_dump_record()) < 0) 
00360        continue;
00361 
00362    /* processing records from a TCP connections is based on a notion of
00363       the current "state" of the connection.  The defined states are
00364         PENDING := record is from different connection than before but
00365                    a beginning SYN has not yet been identified.
00366         SYN_SENT:= have identified SYN sent from source port 80 (server)
00367         FIN_SENT:= have identified a FIN sent from source port 80 (server)
00368                    This terminates any data from server.
00369         RESET   := have identified a Reset sent from source port 80 (server)
00370                    This means that the server should not accept any more
00371                    client data.
00372         IN_REQUEST := processing ACKs sent from source port 80 (server)
00373                       in response to data (request) from the client.  In
00374                       this state, need to identify end of client data (request)
00375                       and start of server data (response).
00376         IN_RESPONSE := processing data sequence #s from source port 80
00377                        In this state, need to identify the end of server data
00378                        (response) and, possibly the beginning of a new request.
00379       Whenever the state changes, the prior state is also noted.
00380 
00381       Fundamental to all of this is the notion that a server cannot  
00382       possibly be sending data in response to a request unless that
00383       data is accompanied or preceeded by an advance in the ACK sequence
00384       indicating receipt of the request data.  Similarly, we assume that
00385       any new data sent by a server that follows or is accompanied by an
00386       advance in the ACK sequence number is a response to the request 
00387       that caused the ACK sequence to advance.  Put another way, response
00388       data (sequence # advance) marks the end of a request and ACK 
00389       advance marks the end of a response.  Of course other events such
00390       as FIN or Reset can mark ends also.  The use of ACK advance to mark
00391       the end of a response assumes that HTTP/1.1 browsers don't overlap 
00392       requests on a single TCP connection even if they may "batch" requests, 
00393       i.e., a new request will not be generated until the response has 
00394       been received. If requests and responses are batched but not 
00395       overlapped this will understate the number of objects requested 
00396       and overstate request and response sizes.
00397 
00398       This use of advancing sequence numbers (ACK or data) to mark
00399       requests and responses is disturbed by segment reorderings in 
00400       the network.  In some cases, such as reordering of only data segments
00401       in a response, there is no problem since only the highest value seen
00402       is used.  Reordering of ACKs (especially with data) presents real
00403       problems since boundaries between requests and responses are missed
00404       which can result in overstating request and response sizes.  For this
00405       reason, all such cases of ACK misordering are logged and reported.
00406    */
00407 
00408    switch (connection_state)
00409 
00410      /* a <break> anywhere ends processing of the current tcpdump record 
00411         by ending the switch (which continues the main read loop) */
00412 
00413       {
00414        case PENDING:
00415      {
00416           switch (input_type)
00417              {
00418          case FIN:
00419             {
00420          /* Ignore random FIN before something useful */ 
00421 
00422                  have_pending_fins++;
00423                  break;
00424                 }
00425 
00426          case SYN:
00427             {
00428           /* normal connection start, initialize connection state */
00429 
00430                  init_connection();
00431                  break;
00432         }
00433 
00434          case RST:
00435                 {
00436           /* Ignore random Reset before something useful */
00437 
00438                  have_pending_rsts++;
00439                  break;
00440                 }
00441 
00442              /* The trace may start after a connection is established and we
00443                 do not see a SYN.  Determine if the connection is most likely
00444                 in a request or in a response and log its status.  As before,
00445                 a request is indicated if the ACK sequence (after the first
00446                 one in the trace) is advancing and a response is indicated if
00447                 the data sequence number is advancing. */
00448 
00449              case ACK_ONLY:
00450             {
00451                   /* ignore initial ACK (has absolute value, not relative) */
00452 
00453                  if (new_address == 1)
00454            {
00455                     new_address = 0;
00456                     have_pending_acks++;
00457                    }
00458                  else
00459             {
00460              /* If ACK advances, the connection is in a request */
00461 
00462                      if ((new_ack > 2) &&
00463                          (new_ack < 16384))
00464                 {
00465                          log_ACT("REQ");
00466 
00467                          last_request_end = 1;
00468                          current_request_end = new_ack;
00469 
00470                          last_response_end = 1;
00471                          current_response_end = 1;
00472 
00473                        /* record the request start time as beginning at the 
00474                           tcpdump time stamp on this record */
00475 
00476                           strcpy(start_request_time, ts);
00477                           strcpy(request_end_time, ts);
00478 
00479                           last_state = connection_state;
00480                           connection_state = IN_REQUEST;
00481  
00482                           init_active();  /* initialize connection state */
00483              }
00484                      else /* ignore ACKs that are not advancing */
00485                         have_pending_acks++;
00486             }
00487                  break;
00488                 }
00489 
00490          case DATA_ACK:          
00491             {
00492          /* If data sequence advances, connection is in response */
00493 
00494                  if ((seq_bytes > 1) &&
00495                      (seq_bytes < 65535))
00496             {
00497                      log_ACT("RSP");
00498 
00499                      /* assume tcpdump relative addressing and initialize */
00500 
00501                      last_request_end = 1;    
00502                      current_request_end = 1;
00503 
00504                      last_response_end = 0;     
00505                      current_response_end = seq_bytes;
00506 
00507                      /* record timestamp of tcpdump record as current
00508                         value of both start and end times of response
00509                         (in case no later end time is found) */
00510 
00511                      strcpy(start_response_time, ts); 
00512                      strcpy(response_end_time, ts);
00513 
00514                      last_state = connection_state;
00515                      connection_state = IN_RESPONSE;
00516  
00517                      init_active();
00518                     }
00519                  else /* ignore data lengths of 0 or 1 */
00520                     have_pending_othr++;
00521                  break;
00522                 }
00523          default:
00524                 break;
00525              }  /* end switch on input_type */
00526           break;
00527      } /* end case PENDING */
00528 
00529        case SYN_SENT:
00530          {
00531 
00532          /* Treat this case as the establishment of a connection.  Usually
00533             the first activity on the connection will be request data from
00534             the client, but some servers appear to "pre-send" data (maybe
00535             the headers) speculatively before ACKing any client data. */
00536 
00537           switch (input_type)
00538              {
00539          case FIN:
00540 
00541               /* A FIN marks the end of either or both request and response */
00542 
00543             {
00544                  if ((has_ack == 1) &&
00545                      (new_ack > (current_request_end + 1)))
00546                                /* ignore possible ACK of FIN */
00547 
00548                { /* this record had advanced the ACK sequence so
00549                         save current request data and log it (since
00550                         the FIN ends the connection it also ends the 
00551                         request). */
00552                
00553                      begin_REQ();
00554                      log_REQ();
00555                     }
00556 
00557                  /* If the data sequence number advances, then there was
00558                     response data.  Save the current response info. and
00559                     log it (since the FIN ends the connection, it also
00560                     ends the response). */
00561 
00562                  if ((has_seq == 1) &&
00563                      (end_seq > current_response_end))  
00564             {
00565                      begin_RSP();
00566                      log_RSP();
00567                     }
00568                  last_state = SYN_SENT;
00569                  connection_state = FIN_SENT;
00570 
00571                  /* record timestamp of first FIN seen on connection */
00572                  if (strcmp(FIN_sent_time, "") == 0)
00573                     strcpy(FIN_sent_time, ts);
00574                  break;
00575                 }
00576 
00577          case SYN:
00578             {
00579           /* In some cases the same host/port pairs are reused in a
00580                      single trace; check for plausible reuse */
00581 
00582                  check_tuple_reuse();
00583                  break;
00584         }
00585 
00586          case RST:
00587                 {
00588                  connection_state = RESET;
00589                  last_state = SYN_SENT;
00590 
00591                  /* record timestamp of first Reset on the connection */
00592 
00593                  if (strcmp(RST_sent_time, "") == 0)
00594                     strcpy(RST_sent_time, ts);
00595                  break;
00596                 }
00597 
00598              case ACK_ONLY:
00599             {
00600                  /* since there is no data sequence # present in the record
00601                     and, therefore, the server is not sending data so
00602                     all the client's data may not have arrived.  Note the
00603                     current extent of ACKed client data and change state */
00604 
00605                  if (new_ack > (current_request_end + 1))
00606                     begin_REQ();
00607                  break;
00608                 }
00609 
00610          case DATA_ACK:          
00611             {
00612                 /* check for presence of data sequence # in the common cases
00613                    in SYN_SENT state, data presence indicates that 
00614                    request data has been received and server is sending data
00615                    that should be a response */
00616 
00617                  if (new_ack > (current_request_end + 1)) 
00618                 {/* this record had advanced the ACK sequence so
00619                      save current request info. and change state */
00620 
00621                      begin_REQ();
00622 
00623                      /* the server's data sequence may not have advanced;
00624                         but if it has, treat it as the start of a response
00625                         and the end of the client (request) data */
00626 
00627                      if (end_seq > current_response_end)
00628                 {
00629                           /* start of response ends the request, log
00630                           it and change state to look for end of response */  
00631 
00632                          log_REQ();
00633                          begin_RSP();
00634                 }
00635             }
00636                  else 
00637            /* some servers appear to send response data immediately
00638                       on completing the TCP connection without receiving 
00639                       any request data */
00640 
00641                     if ((end_seq > last_response_end) && 
00642                         (seq_bytes > 0))
00643                        begin_RSP();
00644                 break;
00645         }
00646          default:
00647                 break;
00648          } /* end switch on input type */
00649           break;
00650      } /* end case SYN_SENT */
00651 
00652        case FIN_SENT:
00653       {
00654            switch (input_type)
00655               {
00656            case SYN:
00657               {
00658           /* In some cases the same host/port pairs are reused in a
00659                      single trace; check for plausible reuse */
00660 
00661                    check_tuple_reuse();
00662                    break;
00663           }
00664 
00665             case FIN:  /* ignore multiple FINs */
00666                    break;
00667 
00668                 case RST:  /* ignore reset after FIN */
00669                    break;
00670 
00671             case ACK_ONLY:
00672                     /* If there is an ACK (only) coming after a FIN is sent, it
00673                       is ether the normal one in the 4-way termination or it
00674                       is to ACK more request data which will be ignored (there
00675                       can be no response).  
00676                       In either case, it is ignored here. */
00677 
00678                    break;
00679 
00680             case DATA_ACK:
00681           {
00682 
00683               /* All others may have sequence number fields.  Treat them as
00684                  errors if they advance the sequence number after a FIN.  
00685                  The usual case here is just retransmissions (including 
00686                  retransmission of the FIN) which should not advance it
00687                  because the highest sequence number possible was on the FIN */
00688 
00689                    if ((end_seq > (current_response_end + 2)) &&
00690                        (have_FINdata_error == 0))
00691               {
00692                        error_state("new data in FIN_SENT state");
00693                        have_FINdata_error = 1;
00694                       }
00695                    break;
00696           }
00697             default:
00698                    break;
00699           } /* end switch on input type */
00700             break; 
00701       } /* end case FIN_SENT */
00702 
00703        case RESET:
00704        {
00705         /* A Reset nominally means an abnormal close of the connection 
00706                with any queued data discarded before transmitting it.  We
00707                observe, however, that under some (unknown) circumstances
00708                segments that advance the data sequence number continue in 
00709                the trace after the Reset.  If these are part of a response, 
00710                it makes sense to count them in the response size since 
00711                the server obviously sent them and the network has to handle 
00712                them.  This also means that a FIN following the Reset may be
00713                a valid indication of the end of a response. Just ignore 
00714                anything else unexpected (e.g., Reset) */
00715 
00716             switch (input_type)
00717                {
00718             case RST:
00719                    break;
00720 
00721             case SYN:
00722               {
00723           /* In some cases the same host/port pairs are reused in a
00724                      single trace; check for plausible reuse */
00725 
00726                    check_tuple_reuse();
00727                    break;
00728           }
00729 
00730             case ACK_ONLY:
00731 
00732                /* an ACK might advance possibly indicating a request.  However,
00733                   since the connection is Reset and there should be no new
00734                   response, just ignore it */
00735 
00736                     break;
00737 
00738             case FIN:
00739           {
00740 
00741             /* Only if the state is IN_RESPONSE do we try to continue looking
00742                for the end of the response.  FIN is treated as the true end
00743                of a response. */
00744 
00745                    if (last_state == IN_RESPONSE)
00746                   {/* ends the current response, ignore any ACK */
00747                        if ((has_seq == 1) &&
00748                            (end_seq > current_response_end)) 
00749                           more_RSP();
00750                        log_RSP();
00751           
00752                        last_state = RESET;
00753                        connection_state = FIN_SENT;
00754 
00755                        /* record timestamp of first FIN on connection */
00756 
00757                        if (strcmp(FIN_sent_time, "") == 0)
00758                           strcpy(FIN_sent_time, ts);
00759               }
00760                     break;
00761            }
00762 
00763            case DATA_ACK:
00764                  {
00765                 /* segments with data may advance the data sequence number as 
00766                    more parts of the response.  They may also advance the ACK
00767                    which normally would indicate a new request.  However,
00768                    after a Reset, it probably will be ignored by the 
00769                    server so it is also ignored here except to mark the end
00770                    of the response. */
00771 
00772                    if (last_state == IN_RESPONSE)
00773               {
00774                        if (new_ack > (last_request_end + 1)) /* new request */
00775                           { /* implies end of current response */
00776                            log_RSP(); 
00777                            last_state = RESET; /* will ignore all else */
00778                            break; 
00779                           }
00780  
00781                      /* As long as the data sequence # advances, continue to
00782                         save info about the current response. */
00783 
00784                        if ((end_seq > current_response_end) &&
00785                            (seq_bytes > 0))
00786                           more_RSP();
00787                       }
00788                   break;
00789          }
00790                default:
00791                   break;
00792            } /* end switch on input type */
00793             break;
00794            } /* end case RESET */
00795 
00796        case IN_RESPONSE:
00797        {
00798             /* In this state, look for events that will indicate the end of
00799                the response data (ACK advances for request, FIN, Reset).  If
00800                the event is ACK advance, this also initiates the start of a
00801                new request.  */
00802 
00803             switch (input_type)
00804                {
00805             case FIN:
00806           {         
00807                    /* FIN is complicated since the segment that carries it may
00808                     also advance the ACK (new request), advance the data
00809                     sequence # and end the connection.  If the ACK advances,
00810                     any sequence # advance is for the new request; otherwise
00811                     a sequence # advance extends and completes the current 
00812                     response. */
00813 
00814                    if (has_ack == 1) 
00815               {
00816                if ((rc = check_ACK_advance(current_request_end)) < 0)
00817                           break;
00818                       }
00819 
00820            /* The ACK advance amount has to be greater than 1 to be
00821                      considered a real new request.  This is primarily to
00822                     filter out just an ACK for a FIN from the client.  Note
00823                     the ACK must advance so duplicate ACKs are ignored. */
00824 
00825                    if ((has_ack == 1) &&
00826                        (new_ack > (current_request_end + 1)))
00827                       { /* implies end of current response, begin request 
00828                            Log the info. for the current response. */
00829 
00830                        log_RSP();  /*end of previous response */
00831 
00832                        /* on FIN, assume end of request also since server is
00833                           closing the connection. */
00834 
00835                        begin_REQ();
00836                        log_REQ(); 
00837 
00838                        /* if the data sequence # also advances, this segment
00839                           (only -- because of the FIN) carries the last part
00840                           of the response */
00841  
00842                        if ((has_seq == 1) &&
00843                            (end_seq > last_response_end)) 
00844                           {/* response begins and ends in the FIN segment */
00845                            begin_RSP();
00846                            log_RSP();  /* also end of any response */
00847                           }
00848 
00849                        /* Note that the null "else" here is the case that the
00850                           data sequence # does not advance (there is no 
00851                           response to the request) -- probably an HTTP/1.1
00852                           broswer attempting multiple requests on a TCP 
00853                           connection where the server doesn't play nice. */
00854 
00855                       }
00856                    else 
00857                       /* the ACK did not advance so no request; if the data
00858                        sequence # advances, it extends the current response */
00859 
00860               {
00861                        if ((has_seq == 1) &&
00862                            (end_seq > current_response_end)) 
00863                           more_RSP();
00864                        log_RSP();    /* FIN always implies end of response */
00865                       }
00866 
00867                    last_state = IN_RESPONSE;
00868                    connection_state = FIN_SENT;
00869 
00870                    if (strcmp(FIN_sent_time, "") == 0)
00871                       strcpy(FIN_sent_time, ts);
00872                    break;
00873           }
00874 
00875                case RST:
00876 
00877                  /* Look for a Reset and only change state to RESET to
00878                    continue processing.  This is explained in comments in 
00879                    processing for the RESET state when the last_state is
00880                    IN_RESPONSE. */
00881 
00882              {/* ignore any advance in seq# on Reset */
00883                   /* it may not be wise to trust ACK on RST */
00884 
00885                   last_state = IN_RESPONSE;
00886                   connection_state = RESET;   
00887 
00888                   if (strcmp(RST_sent_time, "") == 0)
00889                      strcpy(RST_sent_time, ts);
00890                   break;
00891                  }
00892 
00893                case SYN:
00894              {
00895           /* In some cases the same host/port pairs are reused in a
00896                      single trace; check for plausible reuse */
00897 
00898                   check_tuple_reuse();
00899                   break;
00900          }
00901 
00902                case ACK_ONLY:
00903 
00904              /* Begin checking for cases where the ACK may advance
00905                     and really indicate that a new request starts. */
00906 
00907                  {
00908           /* The ACK advance amount has to be greater than 1 to be
00909                      considered a real new request.  This is primarily to
00910                      filter out just an ACK for a FIN from the client.  Note
00911                      the ACK must advance so duplicate or OOO
00912                      ACKs are ignored. */
00913 
00914                   if (new_ack > (last_request_end + 1)) 
00915              { /* implies end of current response, begin request.
00916                          Log the info. for the current response and change
00917                          states. */
00918                       log_RSP();
00919 
00920                     /* since there is no data sequence # present in the record
00921                     and, therefore, the server is not sending data so
00922                     all the client's data may not have arrived.  Note the
00923                     current extent of ACKed client data and start time */
00924 
00925                       begin_REQ();
00926                      }
00927                   break;
00928                  }
00929 
00930                case DATA_ACK:
00931 
00932             /* cases with data and ACKs have two important sub-cases: (a) 
00933                ACK sequence number advances -- implies the start of a
00934                new request and the end of the current response; if the
00935                data sequence number also advances, it is assumed that
00936                all the request data has been received and the first of
00937                the response data is contained in the segment. (b) the
00938                ACK sequence number does not advance so any advance in
00939                the data sequence number is more of the current response. */
00940 
00941            {
00942         if ((rc = check_ACK_advance(last_request_end)) < 0)
00943                    break;
00944 
00945          /* The ACK advance amount has to be greater than 1 to be
00946                     considered a real new request.  This is primarily to
00947                     filter out just an ACK for a FIN from the client.  Note
00948                     the ACK must advance so duplicate ACKs are ignored. */
00949 
00950                 if (new_ack > (last_request_end + 1)) 
00951                { /* implies end of current response, begin request 
00952                          Log the info. for the current response. */
00953 
00954                     log_RSP();  
00955                     begin_REQ();
00956 
00957                     /* If there is also new data (sequence # advances), then
00958                        the request is considered completed and a new response
00959                        has started but not necessarily completed. */
00960 
00961                     if ((end_seq > current_response_end) &&
00962                         (seq_bytes > 0))
00963                {/* Log info. about this request */
00964                         log_REQ();
00965                         begin_RSP();
00966                }
00967            }
00968                 else
00969                     /* the ACK did not advance so no request; if the data
00970                        sequence # advances, it extends the current response */
00971 
00972                     if (end_seq > current_response_end) 
00973                        more_RSP();
00974                 break;
00975                }
00976          default:
00977                 break;
00978         } /* end switch on input type */
00979            break;
00980       }  /* end case IN_RESPONSE */
00981 
00982        case IN_REQUEST:
00983        {
00984         /* In this state check for events that indicate the end of the
00985                request data (advance of data sequence #, FIN, Reset).  An
00986                advance in the data sequence # also marks the beginning of
00987                the response to the request */
00988 
00989             switch (input_type)
00990                {
00991             case FIN:
00992 
00993             /* FIN is somewhat less complicated here since the segment that
00994                implies that the server will send no more data.  Treat this
00995                as effectively ending the request.  If the ACK advances, it
00996                is considered as part of the request and if the data 
00997                sequence # advances, it is the response data (all in this
00998                segment). */
00999 
01000             { /* FIN can ACK more of current request */
01001 
01002           /* The ACK advance amount has to be greater than 1 to be
01003                     considered as extending the request.  This is primarily 
01004                     to filter out just an ACK for a FIN from the client.  Note
01005                     the ACK must advance so duplicate ACKs are ignored. */
01006 
01007                  if ((has_ack == 1) &&
01008                      (new_ack > (current_request_end + 1)))
01009                     more_REQ();
01010                  else
01011                     if (has_ack == 1)
01012                {
01013                 if ((rc = check_ACK_advance(current_request_end)) < 0)
01014                            break;
01015                        }
01016 
01017                  log_REQ();  /* on FIN, assume end of request */
01018 
01019                 /* the server's data sequence may not have advanced;
01020                    but if it has, treat it as the complete response */
01021 
01022                  if ((has_seq == 1) &&
01023                      (end_seq > last_response_end))  
01024                     {
01025                      begin_RSP();
01026                      log_RSP();  /* also end of any response */
01027                     }
01028 
01029                  last_state = IN_REQUEST;
01030                  connection_state = FIN_SENT;
01031 
01032                  if (strcmp(FIN_sent_time, "") == 0)
01033                     strcpy(FIN_sent_time, ts);
01034                  break;
01035         }
01036 
01037          case RST:
01038                {
01039                 /* Treat a Reset as ending the request with no response */
01040             /* ignore any advance in ack on Reset */
01041         /* treat as ending any request */
01042 
01043                 log_REQ();                
01044                 last_state = IN_REQUEST;
01045                 connection_state = RESET;
01046 
01047                 if (strcmp(RST_sent_time, "") == 0)
01048                    strcpy(RST_sent_time, ts);
01049                 break;
01050            }
01051 
01052          case SYN:
01053             {
01054          /* In some cases the same host/port pairs are reused in a
01055                     single trace; check for plausible reuse */
01056 
01057                  check_tuple_reuse();
01058                  break;
01059         }
01060 
01061          case ACK_ONLY:
01062             {
01063          /* The ACK advance amount has to be greater than 1 to be
01064                     considered as extending the requesst.  This is primarily 
01065                     to filter out just an ACK for a FIN from the client.  Note
01066                     the ACK must advance so duplicate or OOO 
01067                     ACKs are ignored. */
01068 
01069                  if (new_ack > (current_request_end + 1))
01070                     more_REQ();
01071                  break;
01072                 }
01073 
01074          case DATA_ACK:
01075                {
01076                 /* cases with data and ACKs have two important sub-cases: 
01077                   (a) ACK sequence number advances which extends the amount
01078                   of request data, and (b) the data sequence # advances
01079                   which ends the request and is the beginning of the 
01080                   response to that request. */
01081         /* The ACK advance amount has to be greater than 1 to be
01082                    considered as extending the request.  This is primarily 
01083                    to filter out just an ACK for a FIN from the client.  Note
01084                    the ACK must advance so duplicate ACKs are ignored. */
01085 
01086                 if (new_ack > (current_request_end + 1))
01087                    more_REQ();
01088                 else
01089             if ((rc = check_ACK_advance(current_request_end)) < 0)
01090                        break;
01091 
01092                 /* the server's data sequence may not have advanced;
01093                    but if it has, treat it as the start of a response
01094                    and the end of the request data */
01095 
01096                 if ((end_seq > last_response_end) && 
01097                     (seq_bytes > 0))
01098                    {
01099             /* record info. for current request and change state 
01100                        to look for the end of the response*/
01101 
01102                     log_REQ();
01103                     begin_RSP();
01104                    }
01105                 break;
01106                }
01107          default:
01108                 break;
01109         } /* end switch on input type */ 
01110           break;
01111      }  /* end case IN_REQUEST */
01112 
01113        default:
01114        break;
01115       } /* end switch on connection state */
01116 
01117    /* save the last known time for the connection from current record */
01118    strcpy(last_connection_time, ts); 
01119 
01120  }  /* end main loop */  
01121   log_log();
01122   close (dumpFP);
01123   close (outFP);
01124   close (logFP);
01125 } /* end main() */

Defines
#define	max(a, b) ((a) >= (b) ? (a) : (b))
#define	min(a, b) ((a) <= (b) ? (a) : (b))
Enumerations
enum	inputs { SYN, FIN, RST, ACK_ONLY, DATA_ACK }
enum	states { PENDING, SYN_SENT, FIN_SENT, RESET, IN_REQUEST, IN_RESPONSE }
Functions
void	begin_REQ (void)
void	begin_RSP (void)
int	check_ACK_advance (unsigned long old_ack)
void	check_tuple_reuse (void)
long	elapsed_ms (char end, char start)
void	error_line (char *s)
void	error_state (char *s)
void	get_host_port (char adr, char host, char *port)
int	get_sequence (char p, unsigned long begin, unsigned long end, unsigned long bytes)
void	init_active (void)
void	init_connection (void)
void	log_ACT (char *how)
void	log_connection (void)
void	log_END (char *how)
void	log_log (void)
void	log_nosyn (void)
void	log_REQ (void)
void	log_RSP (void)
void	log_SYN (void)
void	main (int argc, char *argv[])
void	more_REQ (void)
void	more_RSP (void)
int	parse_dump_record (void)
static void	tvsub (struct timeval tdiff, struct timeval t1, struct timeval *t0)
void	Usage (char *s)
Variables
int	act_req_count = 0
int	act_rsp_count = 0
unsigned long	begin_seq
enum states	connection_state = PENDING
char	current_dst [25] = ""
unsigned long	current_request_end
unsigned long	current_response_end
char	current_src [25] = ""
unsigned long	current_synseq
char	dh [25]
char	dst_host [25]
char	dst_port [10]
FILE *	dumpFP
long	elapsed
unsigned long	end_seq
int	err_count = 0
int	fin_count = 0
char	FIN_sent_time [20]
char	fl [5]
char	gt [3]
int	has_ack
int	has_seq
int	have_ACK_error = 0
int	have_FINdata_error = 0
int	have_pending_acks = 0
int	have_pending_fins = 0
int	have_pending_othr = 0
int	have_pending_rsts = 0
int	have_value_error = 0
char	input_name [256] = ""
enum inputs	input_type
char	last_connection_time [20]
unsigned long	last_request_end
unsigned long	last_response_end
enum states	last_state = PENDING
timeval	lastTime = {0,0}
char	log_name [256] = ""
FILE *	logFP
char	lt [3]
unsigned long	new_ack
int	new_address = 0
char	new_line [500]
FILE *	outFP
char	output_name [256] = ""
char	p1 [50]
char	p2 [50]
char	p3 [50]
int	pending_ack_count = 0
int	pending_cmb_count = 0
int	pending_fin_count = 0
int	pending_oth_count = 0
int	pending_rst_count = 0
int	rc = 0
timeval	recvTime
int	report_ACK_err = 1
int	req_count = 0
char	request_end_time [20]
char	response_end_time [20]
int	rsp_count = 0
int	rst_count = 0
char	RST_sent_time [20]
unsigned long	seq_bytes
char	sh [25]
char	src_host [25]
char	src_port [10]
char	start_request_time [20]
char	start_response_time [20]
int	syn_count = 0
int	trm_count = 0
char	ts [20]
http_connect.c File Reference

Defines

Enumerations

Functions

Variables

Define Documentation

Enumeration Type Documentation

Function Documentation

Variable Documentation
