Add comments to "pcap_stats()" indicating what the counters mean on the

various platforms (assuming the vendors' documentation is correct and
that I've correctly interpreted it).

diff --git a/pcap-bpf.c b/pcap-bpf.c
index 714c932f10f0dae89673363136f7eefc6fd130a4..c301e36dad5d166d507dc64a02022d001761a3dc 100644 (file)
--- a/pcap-bpf.c
+++ b/pcap-bpf.c
@@ -20,7 +20,7 @@
  */
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-bpf.c,v 1.45 2001-04-30 16:10:51 fenner Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-bpf.c,v 1.46 2001-07-29 01:22:40 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -57,6 +57,15 @@ pcap_stats(pcap_t *p, struct pcap_stat *ps)
 {
        struct bpf_stat s;
 
+       /*
+        * "ps_recv" counts packets handed to the filter, not packets
+        * that passed the filter.
+        *
+        * "ps_drop" counts packets dropped inside the BPF device
+        * because we ran out of buffer space.  It doesn't count
+        * packets dropped by the interface driver.  It counts
+        * only packets that passed the filter.
+        */
        if (ioctl(p->fd, BIOCGSTATS, (caddr_t)&s) < 0) {
                snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGSTATS: %s",
                    pcap_strerror(errno));

diff --git a/pcap-dlpi.c b/pcap-dlpi.c
index fc53f43a186a8eff6319d8f48d58b4a2ecf559c0..f2c9f5800c5688768cd6c5fbf3a685feaf1fb524 100644 (file)
--- a/pcap-dlpi.c
+++ b/pcap-dlpi.c
@@ -38,7 +38,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-dlpi.c,v 1.69 2001-07-28 23:12:48 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-dlpi.c,v 1.70 2001-07-29 01:22:40 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -124,6 +124,17 @@ int
 pcap_stats(pcap_t *p, struct pcap_stat *ps)
 {
 
+       /*
+        * "ps_recv" counts packets handed to the filter, not packets
+        * that passed the filter.
+        *
+        * "ps_drop" counts packets dropped inside the DLPI service
+        * provider device device because of flow control requirements
+        * or resource exhaustion; it doesn't count packets dropped by
+        * the interface driver, or packets dropped upstream.  As
+        * filtering is done in userland, it counts packets regardless
+        * of whether they would've passed the filter.
+        */
        *ps = p->md.stat;
        return (0);
 }

diff --git a/pcap-linux.c b/pcap-linux.c
index fd06df6a3ced532dc2015dd98abbff5e81448afa..ea8b30b9327fb296d1d3bc156d9d257ae7d78cb7 100644 (file)
--- a/pcap-linux.c
+++ b/pcap-linux.c
@@ -26,7 +26,7 @@
  */
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.59 2001-06-18 08:46:30 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.60 2001-07-29 01:22:41 guy Exp $ (LBL)";
 #endif
 
 /*
@@ -454,6 +454,11 @@ pcap_read_packet(pcap_t *handle, pcap_handler callback, u_char *userdata)
 int
 pcap_stats(pcap_t *handle, struct pcap_stat *stats)
 {
+       /*
+        * "ps_recv" counts only packets that passed the filter.
+        *
+        * "ps_drop" isn't maintained.
+        */
        *stats = handle->md.stat;
        return 0;
 }

diff --git a/pcap-nit.c b/pcap-nit.c
index 524d8c38343a8fd2fb073a71392986b0400d0165..44fce5ea3652a1125083ef85441654767291fe86 100644 (file)
--- a/pcap-nit.c
+++ b/pcap-nit.c
@@ -20,7 +20,7 @@
  */
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-nit.c,v 1.39 2000-10-28 00:01:29 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-nit.c,v 1.40 2001-07-29 01:22:41 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -75,6 +75,16 @@ int
 pcap_stats(pcap_t *p, struct pcap_stat *ps)
 {
 
+       /*
+        * "ps_recv" counts packets handed to the filter, not packets
+        * that passed the filter.
+        *
+        * "ps_drop" presumably counts packets dropped by the socket
+        * because of flow control requirements or resource exhaustion;
+        * it doesn't count packets dropped by the interface driver.
+        * As filtering is done in userland, it counts packets regardless
+        * of whether they would've passed the filter.
+        */
        *ps = p->md.stat;
        return (0);
 }

diff --git a/pcap-pf.c b/pcap-pf.c
index 2db35a378e5e43e81d4332ee1bfc056c3231fb56..176d45c3d1d0135c5df9bc403e2b9533154503b3 100644 (file)
--- a/pcap-pf.c
+++ b/pcap-pf.c
@@ -24,7 +24,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-pf.c,v 1.63 2001-07-28 22:53:07 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-pf.c,v 1.64 2001-07-29 01:22:42 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -195,6 +195,18 @@ int
 pcap_stats(pcap_t *p, struct pcap_stat *ps)
 {
 
+       /*
+        * "ps_recv" counts only packets that passed the filter.
+        *
+        * "ps_drop" counts packets that passed the kernel filter
+        * (if any) but were dropped because the input queue was
+        * full.  It counts packets regardless of whether they would
+        * have passed a userland filter.
+        *
+        * "ps_ifdrop" counts packets dropped by the network
+        * inteface (regardless of whether they would have passed
+        * the input filter, of course).
+        */
        ps->ps_recv = p->md.TotAccepted;
        ps->ps_drop = p->md.TotDrops;
        ps->ps_ifdrop = p->md.TotMissed - p->md.OrigMissed;

diff --git a/pcap-snit.c b/pcap-snit.c
index 47818e4fe01bb174acb20cfbc567c46f4867f8a1..a44812fea218578f2b24df1f9a48fe281654aa05 100644 (file)
--- a/pcap-snit.c
+++ b/pcap-snit.c
@@ -25,7 +25,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-snit.c,v 1.54 2000-10-28 00:01:30 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-snit.c,v 1.55 2001-07-29 01:22:42 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -88,6 +88,17 @@ int
 pcap_stats(pcap_t *p, struct pcap_stat *ps)
 {
 
+       /*
+        * "ps_recv" counts packets handed to the filter, not packets
+        * that passed the filter.
+        *
+        * "ps_drop" counts packets dropped inside the "/dev/nit"
+        * device because of flow control requirements or resource
+        * exhaustion; it doesn't count packets dropped by the
+        * interface driver, or packets dropped upstream.  As filtering
+        * is done in userland, it counts packets regardless of whether
+        * they would've passed the filter.
+        */
        *ps = p->md.stat;
        return (0);
 }

diff --git a/pcap-snoop.c b/pcap-snoop.c
index 4eccc80e763256a190a16739b094ddf7577850a1..c4119fbacd0163eb77bdf34473f9b170f9883f71 100644 (file)
--- a/pcap-snoop.c
+++ b/pcap-snoop.c
@@ -20,7 +20,7 @@
  */
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-snoop.c,v 1.31 2001-06-05 03:48:41 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-snoop.c,v 1.32 2001-07-29 01:22:43 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -115,10 +115,26 @@ pcap_stats(pcap_t *p, struct pcap_stat *ps)
                return (-1);
        }
 
+       /*
+        * "ifdrops" are those dropped by the network interface
+        * due to resource shortages or hardware errors.
+        *
+        * "sbdrops" are those dropped due to socket buffer limits.
+        *
+        * As filter is done in userland, "sbdrops" counts packets
+        * regardless of whether they would've passed the filter.
+        *
+        * XXX - does this count *all* Snoop or Drain sockets,
+        * rather than just this socket?  If not, why does it have
+        * both Snoop and Drain statistics?
+        */
        p->md.stat.ps_drop =
            rs->rs_snoop.ss_ifdrops + rs->rs_snoop.ss_sbdrops +
            rs->rs_drain.ds_ifdrops + rs->rs_drain.ds_sbdrops;
 
+       /*
+        * "ps_recv" counts only packets that passed the filter.
+        */
        *ps = p->md.stat;
        return (0);
 }