From: Samuel Jero Date: Wed, 2 Feb 2011 06:20:15 +0000 (-0500) Subject: Redesign Sequence number conversion system X-Git-Url: http://sjero.net/git/?p=dccp2tcp;a=commitdiff_plain;h=57e13b610191569ac7812bd308e38a859ea2ffc7 Redesign Sequence number conversion system Correct problems so that Tcptrace can compute RTT --- diff --git a/ChangeLog b/ChangeLog index 538b505..9ef0bff 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +02/01/2011: + Release 1.2 + Bug Fixes: + 1)Sequence number adjustments so that Tcptrace RTT graphing/statistics now work + 01/19/2011: Release 1.1 Bug Fixes: diff --git a/README b/README index 520902e..02c1497 100644 --- a/README +++ b/README @@ -10,6 +10,10 @@ on linux anyway (we need the dccp header include file) and it comprises only one If you have problems, simply modify the make file as needed. Contact me, if major problems arise. +In order to utilize this program effectively you will also need Tcptrace, which you can download +from http://www.tcptrace.org and the version of xplot available from http://www.tcptrace.org under +"Useful Companion Programs" (Note! This is not the xplot that is in the Ubuntu repositories). + Usage is pretty simple: dccp2tcp dccp_file tcp_file [-d] [-y] [-g] [-s] @@ -20,6 +24,12 @@ dccp2tcp dccp_file tcp_file [-d] [-y] [-g] [-s] For typical usage, you probably just want -s. +Once you run dccp2tcp, you will then want to run tcptrace on the tcp_file to generate graphs. The command should be something like this: +tcptrace -lGt tcp_file + +You can then use xplot to view the resulting graphs, like this: +xplot a2b_tsg.xpl a2b_rtt.xpl + This program does have several important limitations: 1)Supports only a single DCCP contection per capture. @@ -46,7 +56,7 @@ You should have received a copy of the GNU General Public License along with dccp2tcp. If not, see . -Copyright 2010 +Copyright 2011 Samuel Jero Computer Science student, Ohio University sj323707@ohio.edu diff --git a/dccp2tcp.c b/dccp2tcp.c index a3d7218..12f6c45 100644 --- a/dccp2tcp.c +++ b/dccp2tcp.c @@ -1,7 +1,7 @@ /****************************************************************************** Author: Samuel Jero -Date: 1/2011 +Date: 2/2011 Description: Program to convert a DCCP flow to a TCP flow for DCCP analysis via tcptrace. @@ -36,7 +36,7 @@ void handle_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *byte void convert_packet(struct pcap_pkthdr *h, const u_char *odata, u_char *ndata); unsigned int interp_ack_vect(u_char* hdr); u_int32_t initialize_seq(struct seq_num **seq, __be16 source, __be32 initial); -u_int32_t add_new_seq(struct seq_num *seq, __be32 num, int ack); +u_int32_t add_new_seq(struct seq_num *seq, __be32 num, int size, enum dccp_pkt_type type); u_int32_t convert_ack(struct seq_num *seq, __be32 num); int acked_packet_size(struct seq_num *seq, __be32 num); void ack_vect2sack(struct seq_num *seq, struct tcphdr *tcph, u_char* tcpopts, u_char* dccphdr, __be32 dccpack); @@ -288,7 +288,7 @@ void convert_packet(struct pcap_pkthdr *h, const u_char *odata, u_char *ndata) }else{ tcph->ack_seq=htonl(convert_ack(s2,ntohl(dccphack->dccph_ack_nr_low)+interp_ack_vect((u_char*)dccph))); } - tcph->seq=htonl(add_new_seq(s1, ntohl(dccphex->dccph_seq_low),datalength)); + tcph->seq=htonl(add_new_seq(s1, ntohl(dccphex->dccph_seq_low),datalength, dccph->dccph_type)); if(yellow){ tcph->window=htons(-interp_ack_vect((u_char*)dccph)*acked_packet_size(s2, ntohl(dccphack->dccph_ack_nr_low))); } @@ -301,7 +301,7 @@ void convert_packet(struct pcap_pkthdr *h, const u_char *odata, u_char *ndata) }else{ tcph->ack_seq=htonl(convert_ack(s1,ntohl(dccphack->dccph_ack_nr_low)+interp_ack_vect((u_char*)dccph))); } - tcph->seq=htonl(add_new_seq(s2, ntohl(dccphex->dccph_seq_low),datalength)); + tcph->seq=htonl(add_new_seq(s2, ntohl(dccphex->dccph_seq_low),datalength,dccph->dccph_type)); if(yellow){ tcph->window=htons(-interp_ack_vect((u_char*)dccph)*acked_packet_size(s1, ntohl(dccphack->dccph_ack_nr_low))); } @@ -324,7 +324,7 @@ void convert_packet(struct pcap_pkthdr *h, const u_char *odata, u_char *ndata) h->caplen=sizeof(struct ether_header) + sizeof(struct iphdr) + tcph->doff*4 + datalength; /*set length in ip header*/ - iph->tot_len=htons(sizeof(struct iphdr) + sizeof(struct tcphdr) + datalength); + iph->tot_len=htons(sizeof(struct iphdr) + tcph->doff*4 + datalength); } if(dccph->dccph_type==DCCP_PKT_ACK){ //DCCP ACK -->TCP ACK with no data @@ -335,7 +335,7 @@ void convert_packet(struct pcap_pkthdr *h, const u_char *odata, u_char *ndata) }else{ tcph->ack_seq=htonl(convert_ack(s2,ntohl(dccphack->dccph_ack_nr_low)+interp_ack_vect((u_char*)dccph))); } - tcph->seq=htonl(add_new_seq(s1, ntohl(dccphex->dccph_seq_low),1)); + tcph->seq=htonl(add_new_seq(s1, ntohl(dccphex->dccph_seq_low),1,dccph->dccph_type)); if(yellow){ tcph->window=htons(-interp_ack_vect((u_char*)dccph)*1400); if(-interp_ack_vect((u_char*)dccph)*1400 > 65535){ @@ -351,7 +351,7 @@ void convert_packet(struct pcap_pkthdr *h, const u_char *odata, u_char *ndata) }else{ tcph->ack_seq=htonl(convert_ack(s1,ntohl(dccphack->dccph_ack_nr_low)+interp_ack_vect((u_char*)dccph))); } - tcph->seq=htonl(add_new_seq(s2, ntohl(dccphex->dccph_seq_low),1)); + tcph->seq=htonl(add_new_seq(s2, ntohl(dccphex->dccph_seq_low),1,dccph->dccph_type)); if(yellow){ tcph->window=htons(-interp_ack_vect((u_char*)dccph)*1400); if(-interp_ack_vect((u_char*)dccph)*1400 > 65535){ @@ -369,11 +369,11 @@ void convert_packet(struct pcap_pkthdr *h, const u_char *odata, u_char *ndata) tcph->rst=0; /*set libpcap header lengths*/ - h->len=sizeof(struct ether_header) + sizeof(struct iphdr) + tcph->doff*4+ 1; - h->caplen=sizeof(struct ether_header) + sizeof(struct iphdr) + tcph->doff*4+ 1; + h->len=sizeof(struct ether_header) + sizeof(struct iphdr) + tcph->doff*4 + 1; + h->caplen=sizeof(struct ether_header) + sizeof(struct iphdr) + tcph->doff*4 + 1; /*set length in ip header*/ - iph->tot_len=htons(sizeof(struct iphdr) + tcph->doff*4+ 1); + iph->tot_len=htons(sizeof(struct iphdr) + tcph->doff*4 + 1); } if(dccph->dccph_type==DCCP_PKT_CLOSEREQ){//DCCP CLOSEREQ----Never seen in packet capture @@ -389,7 +389,7 @@ void convert_packet(struct pcap_pkthdr *h, const u_char *odata, u_char *ndata) }else{ tcph->ack_seq=htonl(convert_ack(s2,ntohl(dccphack->dccph_ack_nr_low)+interp_ack_vect((u_char*)dccph))); } - tcph->seq=htonl(add_new_seq(s1, ntohl(dccphex->dccph_seq_low),1)); + tcph->seq=htonl(add_new_seq(s1, ntohl(dccphex->dccph_seq_low),1,dccph->dccph_type)); if(yellow){ tcph->window=htons(-interp_ack_vect((u_char*)dccph)*acked_packet_size(s2, ntohl(dccphack->dccph_ack_nr_low))); } @@ -402,7 +402,7 @@ void convert_packet(struct pcap_pkthdr *h, const u_char *odata, u_char *ndata) }else{ tcph->ack_seq=htonl(convert_ack(s1,ntohl(dccphack->dccph_ack_nr_low)+interp_ack_vect((u_char*)dccph))); } - tcph->seq=htonl(add_new_seq(s2, ntohl(dccphex->dccph_seq_low),1)); + tcph->seq=htonl(add_new_seq(s2, ntohl(dccphex->dccph_seq_low),1,dccph->dccph_type)); if(yellow){ tcph->window=htons(-interp_ack_vect((u_char*)dccph)*acked_packet_size(s1, ntohl(dccphack->dccph_ack_nr_low))); } @@ -432,7 +432,7 @@ void convert_packet(struct pcap_pkthdr *h, const u_char *odata, u_char *ndata) }else{ tcph->ack_seq=htonl(convert_ack(s2,ntohl(dccphack->dccph_ack_nr_low)+interp_ack_vect((u_char*)dccph))); } - tcph->seq=htonl(add_new_seq(s1, ntohl(dccphex->dccph_seq_low),1)); + tcph->seq=htonl(add_new_seq(s1, ntohl(dccphex->dccph_seq_low),1,dccph->dccph_type)); if(yellow){ tcph->window=htons(-interp_ack_vect((u_char*)dccph)*acked_packet_size(s2, ntohl(dccphack->dccph_ack_nr_low))); } @@ -445,7 +445,7 @@ void convert_packet(struct pcap_pkthdr *h, const u_char *odata, u_char *ndata) }else{ tcph->ack_seq=htonl(convert_ack(s1,ntohl(dccphack->dccph_ack_nr_low)+interp_ack_vect((u_char*)dccph))); } - tcph->seq=htonl(add_new_seq(s2, ntohl(dccphex->dccph_seq_low),1)); + tcph->seq=htonl(add_new_seq(s2, ntohl(dccphex->dccph_seq_low),1,dccph->dccph_type)); if(yellow){ tcph->window=htons(-interp_ack_vect((u_char*)dccph)*acked_packet_size(s1, ntohl(dccphack->dccph_ack_nr_low))); } @@ -475,7 +475,7 @@ void convert_packet(struct pcap_pkthdr *h, const u_char *odata, u_char *ndata) }else{ tcph->ack_seq=htonl(convert_ack(s2,ntohl(dccphack->dccph_ack_nr_low)+interp_ack_vect((u_char*)dccph))); } - tcph->seq=htonl(add_new_seq(s1, ntohl(dccphex->dccph_seq_low),0)); + tcph->seq=htonl(add_new_seq(s1, ntohl(dccphex->dccph_seq_low),0,dccph->dccph_type)); if(yellow){ tcph->window=htons(-interp_ack_vect((u_char*)dccph)*acked_packet_size(s2, ntohl(dccphack->dccph_ack_nr_low))); }else{ @@ -490,7 +490,7 @@ void convert_packet(struct pcap_pkthdr *h, const u_char *odata, u_char *ndata) }else{ tcph->ack_seq=htonl(convert_ack(s1,ntohl(dccphack->dccph_ack_nr_low)+interp_ack_vect((u_char*)dccph))); } - tcph->seq=htonl(add_new_seq(s2, ntohl(dccphex->dccph_seq_low),0)); + tcph->seq=htonl(add_new_seq(s2, ntohl(dccphex->dccph_seq_low),0,dccph->dccph_type)); if(yellow){ tcph->window=htons(-interp_ack_vect((u_char*)dccph)*acked_packet_size(s1, ntohl(dccphack->dccph_ack_nr_low))); }else{ @@ -522,14 +522,14 @@ void convert_packet(struct pcap_pkthdr *h, const u_char *odata, u_char *ndata) }else{ tcph->ack_seq=htonl(convert_ack(s2,ntohl(dccphack->dccph_ack_nr_low)+interp_ack_vect((u_char*)dccph))); } - tcph->seq=htonl(add_new_seq(s1, ntohl(dccphex->dccph_seq_low),0)); + tcph->seq=htonl(add_new_seq(s1, ntohl(dccphex->dccph_seq_low),0,dccph->dccph_type)); if(yellow){ tcph->window=htons(-interp_ack_vect((u_char*)dccph)*acked_packet_size(s2, ntohl(dccphack->dccph_ack_nr_low))); }else{ tcph->window=htons(0); } if(sack){ - ack_vect2sack(s2, tcph, tcpopt, (u_char*)dccph, ntohl(dccphack->dccph_ack_nr_low) ); + ack_vect2sack(s2, tcph, tcpopt, (u_char*)dccph, ntohl(dccphack->dccph_ack_nr_low)); } }else{ if(green){ @@ -537,7 +537,7 @@ void convert_packet(struct pcap_pkthdr *h, const u_char *odata, u_char *ndata) }else{ tcph->ack_seq=htonl(convert_ack(s1,ntohl(dccphack->dccph_ack_nr_low)+interp_ack_vect((u_char*)dccph))); } - tcph->seq=htonl(add_new_seq(s2, ntohl(dccphex->dccph_seq_low),0)); + tcph->seq=htonl(add_new_seq(s2, ntohl(dccphex->dccph_seq_low),0,dccph->dccph_type)); if(yellow){ tcph->window=htons(-interp_ack_vect((u_char*)dccph)*acked_packet_size(s1, ntohl(dccphack->dccph_ack_nr_low))); }else{ @@ -655,14 +655,14 @@ u_int32_t initialize_seq(struct seq_num **seq, __be16 source, __be32 initial) /*add first sequence number*/ (*seq)->table[0].old=initial; (*seq)->table[0].new=initial; - (*seq)->table[0].size=1; /* size is actually zero; this is a convient way to get - these packets counted in the sequence number space*/ + (*seq)->table[0].type=DCCP_PKT_REQUEST; + (*seq)->table[0].size=0; return initial; } /*Convert Sequence Numbers*/ -u_int32_t add_new_seq(struct seq_num *seq, __be32 num, int size) +u_int32_t add_new_seq(struct seq_num *seq, __be32 num, int size, enum dccp_pkt_type type) { int prev; if(seq==NULL){ @@ -678,14 +678,29 @@ u_int32_t add_new_seq(struct seq_num *seq, __be32 num, int size) seq->table[seq->cur].old=seq->table[prev].old+1; seq->table[seq->cur].new=seq->table[prev].new + seq->table[prev].size; seq->table[seq->cur].size=size; + seq->table[seq->cur].type=type; } prev=seq->cur; seq->cur=(seq->cur+1)%(seq->size);/*find next available table slot*/ seq->table[seq->cur].old=num; - seq->table[seq->cur].new=seq->table[prev].new + seq->table[prev].size; seq->table[seq->cur].size=size; -return seq->table[seq->cur].new; + seq->table[seq->cur].type=type; + if(seq->table[prev].type==DCCP_PKT_REQUEST || seq->table[prev].type==DCCP_PKT_RESPONSE){ + seq->table[seq->cur].new=seq->table[prev].new + seq->table[prev].size; + seq->table[seq->cur].size=1; + return seq->table[prev].new + seq->table[prev].size+1; + } + if(type==DCCP_PKT_DATA || type==DCCP_PKT_DATAACK || type==DCCP_PKT_ACK){ + seq->table[seq->cur].new=seq->table[prev].new + seq->table[prev].size; + return seq->table[seq->cur].new+1; + } + if(type==DCCP_PKT_SYNC || type==DCCP_PKT_SYNCACK){ + seq->table[seq->cur].new=seq->table[prev].new + seq->table[prev].size; + return seq->table[seq->cur].new; + } + seq->table[seq->cur].new=seq->table[prev].new + seq->table[prev].size; +return seq->table[seq->cur].new +1; } @@ -700,7 +715,7 @@ u_int32_t convert_ack(struct seq_num *seq, __be32 num) /*loop through table looking for the DCCP ack number*/ for(int i=0; i < seq->size; i++){ if(seq->table[i].old==num){ - return seq->table[i].new +1; /*TCP acks the sequence number plus 1*/ + return seq->table[i].new + seq->table[i].size + 1; /*TCP acks the sequence number plus 1*/ } } diff --git a/dccp2tcp.h b/dccp2tcp.h index e452691..6c08d28 100644 --- a/dccp2tcp.h +++ b/dccp2tcp.h @@ -1,7 +1,7 @@ /****************************************************************************** Author: Samuel Jero -Date: 1/2011 +Date: 2/2011 Description: Header file for program to convert a DCCP flow to a TCP flow for DCCP analysis via tcptrace. @@ -61,6 +61,7 @@ struct tbl{ __be32 old; /*DCCP sequence number */ u_int32_t new; /*TCP sequence number */ int size; /*packet size*/ + enum dccp_pkt_type type; /*packet type*/ }; /*Option flags*/