Timeval 结构：libpcap 的负延迟

Question

我正在尝试计算从捕获的数据包到前一个数据包的延迟，这两个数据包都来自同一连接。我使用的是单链表，每个节点对应一个连接；我区分从 IP1 到 IP2 的数据包和从 IP2 到 IP1 的数据包：我使用一个节点表示连接方向（IP1 到 IP2），另一个节点表示连接的相反方向（IP2 到 IP1）。我总是在列表的末尾添加。

我的结构节点如下：

typedef struct node {
    unsigned int num_pkt; // number of packets coming/going in this connection
    u_int8_t protocol;
    u_int32_t saddr;
    u_int32_t daddr;
    u_int16_t sport;
    u_int16_t dport;
    struct timeval time_begin; // first timestamp when I got pkt from this connection
    struct timeval time_end;   // last timestamp when I got pkt from this connection
    struct timeval old_ts;  // temporary timestamp to calculate delay
    struct node *next;
} node;

全局指针变量，用于获取列表的第一个和最后一个节点：

node *head = NULL;
node *current = NULL;

下面是每次收到数据包时 pcap_loop 调用的回调函数的伪代码：

void my_callback(u_char *arg, const struct pcap_pkthdr* pkthdr, const u_char* packet) 
{ 
    ++count;
    int length_packet = sizeof(packet);
    const struct ether_header *ethh;
    const struct iphdr *iph;
    const struct tcphdr *tcph;
    const struct udphdr *udph;  
    unsigned short int iphdrlen;
    node *tmp; // to iterate over the list
    int protocol, sport, dport;
    unsigned long int delay;

    ethh = (struct ether_header *)packet;
    if (ntohs(ethh->ether_type) == ETHERTYPE_IP) {
        iph = (struct iphdr*)(packet + sizeof(struct ether_header));
        iphdrlen = iph->ihl*4;
        protocol = (iph->protocol);
        switch (protocol) {
            case 6:
                tcph = (struct tcphdr *)(packet + sizeof(struct ether_header) + iphdrlen);
                sport = ntohs(tcph->th_sport);
                dport = ntohs(tcph->th_dport);
                break;
            case 17:
                udph = (struct udphdr *)(packet + sizeof(struct ether_header) + iphdrlen);
                sport = ntohs(udph->uh_sport);
                dport = ntohs(udph->uh_dport);
                break;
            default:
                break;
        }
        /* If the list is empty, add first node, fill it and update pointers */
        if (head == NULL ) {
            node *new_node = (node *)malloc(sizeof(node));
            if (new_node == NULL) {
                printf("MALLOC ERROR\n");
                exit(1);
            }
            new_node->time_begin.tv_sec = pkthdr->ts.tv_sec;
            new_node->time_begin.tv_usec = pkthdr->ts.tv_usec;
            new_node->old_ts.tv_sec = pkthdr->ts.tv_sec;
            new_node->old_ts.tv_usec = pkthdr->ts.tv_usec;
            new_node->time_end.tv_sec = 0;
            new_node->time_end.tv_usec = 0;
            new_node->num_pkt = 1;
            new_node->protocol = protocol;
            new_node->saddr = ntohl(iph->saddr);
            new_node->daddr = ntohl(iph->daddr);
            new_node->sport = sport;
            new_node->dport = dport;
            new_node->next = NULL;
            head = current = new_node;
        } else {
            tmp = head;
            while (tmp != NULL) {
                if ((tmp->saddr == ntohl(iph->saddr)) && (tmp->daddr == ntohl(iph->daddr)) && 
                    (tmp->protocol == protocol) && (tmp->sport == sport) && (tmp->dport == dport)) {
                    tmp->bts = tmp->bts + length_packet;
                    tmp->num_pkt = tmp->num_pkt+1;

                    char src_addr[INET_ADDRSTRLEN], dst_addr[INET_ADDRSTRLEN];
                    /* Function I made, it uses inet_ntop */
                    get_src_addr(src_addr, iph);
                    get_dst_addr(dst_addr, iph);
                    /* How do I calculate delay: getting the total amount of microsecs 
                    from the timeval inside pcap_pkthdr which contains the timestamp 
                    of the caught packet and subtracting to it the total amount of microsecs 
                    from the old_ts timeval, which contains the timestamp of the previous packet 
                    coming from the same connection */
                    delay = ((long)(pkthdr->ts.tv_sec*1000000)+pkthdr->ts.tv_usec) - ((long)(tmp->old_ts.tv_sec*1000000)+tmp->old_ts.tv_usec);
                    printf("%d; %s:%u > %s:%u update timeval: %ld <- %ld (secs), %ld <- %ld (microsecs); delay = %ld\n",
                        tmp->num_pkt, src_addr, tmp->sport, dst_addr, tmp->dport, tmp->old_ts.tv_sec, pkthdr->ts.tv_sec, 
                        tmp->old_ts.tv_usec, pkthdr->ts.tv_usec, delay);
                    /* updating old timestamp */
                    tmp->old_ts.tv_sec = pkthdr->ts.tv_sec;
                    tmp->old_ts.tv_usec = pkthdr->ts.tv_usec;
                    tmp->time_end.tv_sec = pkthdr->ts.tv_sec;
                    tmp->time_end.tv_usec = pkthdr->ts.tv_usec;
                    return;
                } else {
                    tmp = tmp->next;
                }
            }
            /* If we are here, we are at the end of the list and since
 none of the previous packets matches IP address and ports of the new one
caught, we have a new connection. Allocating new node and filling it */
            node *new_node = (node *)malloc(sizeof(node));
            if (new_node == NULL) {
                printf("MALLOC ERROR\n");
                exit(1);
            }
            new_node->time_begin.tv_sec = pkthdr->ts.tv_sec;
            new_node->time_begin.tv_usec = pkthdr->ts.tv_usec;
            new_node->old_ts.tv_sec = pkthdr->ts.tv_sec;
            new_node->old_ts.tv_usec = pkthdr->ts.tv_usec;
            new_node->num_pkt = 1;
            new_node->protocol = protocol;
            new_node->saddr = ntohl(iph->saddr);
            new_node->daddr = ntohl(iph->daddr);
            new_node->sport = sport;
            new_node->dport = dport;
            new_node->time_end.tv_sec = 0;
            new_node->time_end.tv_usec = 0;
            new_node->next = NULL;
            current->next = new_node;
            current = new_node;
        }
    }

这是输出的一个片段，仅用于一个连接：

996; 93.62.101.12:443 > 10.0.0.12:55653 update timeval: 1445773040 <- 1445773040 (secs), 133332 <- 133334 (microsecs); delay = 2
997; 93.62.101.12:443 > 10.0.0.12:55653 update timeval: 1445773040 <- 1445773040 (secs), 133334 <- 133334 (microsecs); delay = 0
998; 93.62.101.12:443 > 10.0.0.12:55653 update timeval: 1445773040 <- 1445773040 (secs), 133334 <- 133336 (microsecs); delay = 2
999; 93.62.101.12:443 > 10.0.0.12:55653 update timeval: 1445773040 <- 1445773040 (secs), 133336 <- 133507 (microsecs); delay = 171
1000; 93.62.101.12:443 > 10.0.0.12:55653 update timeval: 1445773040 <- 1445773040 (secs), 133507 <- 135646 (microsecs); delay = 2139
1001; 93.62.101.12:443 > 10.0.0.12:55653 update timeval: 1445773040 <- 1445773040 (secs), 135646 <- 135652 (microsecs); delay = 6
1002; 93.62.101.12:443 > 10.0.0.12:55653 update timeval: 1445773040 <- 1445773040 (secs), 135652 <- 135852 (microsecs); delay = 200
1003; 93.62.101.12:443 > 10.0.0.12:55653 update timeval: 1445773040 <- 1445773040 (secs), 135852 <- 135654 (microsecs); delay = -198

在包号 1003 中，我得到了 -198 微秒的负延迟；那是因为 pcap_pkthdr 结构中的时间戳比旧时间戳少了微秒，导致负值。知道为什么较新的时间戳比旧的时间戳少微秒吗？

Answer 1

我假设你在 Linux。然后阅读time(7)

注意时间可能不是单调的，例如因为它是使用 adjtimex(2).

调整的（可能是 ntpd）

^{（这也适用于内核时间，包括网络层的时间戳）}

另请参阅 clock_gettime(2) 的文档并注意 CLOCK_REALTIME 和 CLOCK_MONOTONIC

之间的区别

Answer 2

有时，libpcap 使用的 OS 的数据包捕获机制和网络堆栈可能会无序地将数据包传送到 libpcap，不幸的是。如果两个数据包由两个独立的处理器内核处理，则可能会发生这种情况，并且第一个要加盖时间戳的数据包（因此具有较早的时间戳）可能是第二个要交给捕获机制的数据包（因此出现在另一个数据包之后） , 以便 libpcap 在看到具有较早时间戳的数据包之前看到具有较晚时间戳的数据包。

查看 pcap-tstamp 手册页以了解有关时间戳行为的详细信息。

Timeval 结构：libpcap 的负延迟

Timeval structs: negative delay with libpcap

c

delay

libpcap

timeval