[Iftop-users] measuring bandwith ?

[Chris Lightfoot]

On Sun, May 02, 2004 at 05:24:27PM +0300, raptor wrote:
> hi,
> 
> I'm tring to use libpcap to measure bandwith..
> the reason I need this is to launch this small program that will measure
> the bandwith usage (tcpdump filter based).. it will not be ncurses based,,

I take it you need to measure the bandwidth used by
particular packets which pass a given bpf filter? If not,
you may be best off reading the sent/received totals from
/proc/net/dev or equivalent.

> My problem is how to set this program to capture the traffic for 10 seconds
> for example ... and most importanly how u calculate that 1 second is passed,
> so that u calc "kbps"...

Most easily, by calling time(), for instance using,

    time_t t;

    t = time(NULL);     /* or time(&t) */

but that only gives times accurate to the nearest second.
Alternatively,

    #include <sys/time.h>

    /* ... */

    struct timeval t;
    gettimeofday(&t, NULL);
    /* now the time is t.tv_sec + t.tv_usec / 1000000 */


> Could u explain...(i'm not a C programmer but have idea what is all about)

So one possibility is to start your program, record the
time, and keep recording packets until ten seconds have
passed.

> Second question I've used pcap sniffer.c example from tcpdump.org, and
> modified so that i calculate the packet sizes in two different ways i.e :
> 
> 	total_len2 += ntohs(ip->ip_len);
> 	total_len += header->len;
> 
> into got_packet() callback function... I see that iftop uses the first one, is it more
> correct...

One gives the on-the-wire size, the other the size of the
IP packet. The former includes the ethernet header, the
latter doesn't. If you care about the amount of IP traffic
-- and if your ISP bills you for `bandwidth', this is
probably how they calculate it -- you need to know the
total amount of IP traffic.

> PS. One second question is what if I put several filters in text files and loop over them
> i.e.  read the first filter, setfilter(), mesure for 10 sec, then read the second filter...etc.etc..
> will there be some calculation error 'cause I'm switching filters i.e. will I have to wait some 
> time before start measuting say  :
>  1. setfilter() 
>  2. wait 1 sec
>  3. measure 10 sec
>  4. goto 1

You shouldn't have to wait between changing filters. All
the packets you receive after setting a filter should
match that filter.

-- 
You cannot win the game, and you are not allowed to stop playing
(the third law)