Add to the packet counts a count of packets that tcpdump has seen and

processed - people often get confused by the "received by filter" count,
as they might not realize that, in some systems, it counts packets that
were handed to the filter mechanism regardless of whether they pass or,
if they pass, they have yet been read by the application and, on some
other systems, it counts packets that passed the filter but still counts
them in the kernel before they're read by the application.

They're probably mostly interested in the count of packets processed by
tcpdump; the "received by filter" count is probably of interest only if
you want to know how effective your filter is (and even then it's of
interest only if it counts packets handed to the filter rather than
packets that passed the filter).

Give more details on why the "received by filter" count doesn't
necessarily mean what you think it means.

diff --git a/tcpdump.1 b/tcpdump.1
index bf2a8f14c1f9cabe87f4ceed63ced42057df996d..6b1d626f945f4cf7b2b54394a8ff8bb2ec17a943 100644 (file)
--- a/tcpdump.1
+++ b/tcpdump.1
@@ -118,14 +118,23 @@ When
 .I tcpdump
 finishes capturing packets, it will report counts of:
 .IP
 .I tcpdump
 finishes capturing packets, it will report counts of:
 .IP

+packets ``captured'' (this is the number of packets that
+.I tcpdump
+has received and processed);
+.IP

 packets ``received by filter'' (the meaning of this depends on the OS on
 which you're running
 .IR tcpdump ,
 and possibly on the way the OS was configured - if a filter was
 specified on the command line, on some OSes it counts packets regardless
 packets ``received by filter'' (the meaning of this depends on the OS on
 which you're running
 .IR tcpdump ,
 and possibly on the way the OS was configured - if a filter was
 specified on the command line, on some OSes it counts packets regardless

-of whether they were matched by the filter expression, and on other OSes
-it counts only packets that were matched by the filter expression and
-were processed by
+of whether they were matched by the filter expression and, even if they
+were matched by the filter expression, regardless of whether
+.I tcpdump
+has read and processed them yet, on other OSes it counts only packets that were
+matched by the filter expression regardless of whether
+.I tcpdump
+has read and processed them yet, and on other OSes it counts only
+packets that were matched by the filter expression and were processed by

 .IR tcpdump );
 .IP
 packets ``dropped by kernel'' (this is the number of packets that were
 .IR tcpdump );
 .IP
 packets ``dropped by kernel'' (this is the number of packets that were

diff --git a/tcpdump.c b/tcpdump.c
index ce32be5eaca23a5eba21ff26bb3ae6dc33ec7f35..3b744f4079f582ae4d839e9af308171e30d3f307 100644 (file)
--- a/tcpdump.c
+++ b/tcpdump.c
@@ -30,7 +30,7 @@ static const char copyright[] =
     "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\
 The Regents of the University of California.  All rights reserved.\n";
 static const char rcsid[] =
     "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\
 The Regents of the University of California.  All rights reserved.\n";
 static const char rcsid[] =

-    "@(#) $Header: /tcpdump/master/tcpdump/tcpdump.c,v 1.214 2003-08-08 09:47:45 risso Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/tcpdump/tcpdump.c,v 1.215 2003-09-16 21:02:52 guy Exp $ (LBL)";

 #endif
 
 /*
 #endif
 
 /*


@@ -118,6 +118,7 @@ RETSIGTYPE requestinfo(int);
 #endif
 
 static void info(int);
 #endif
 
 static void info(int);

+static u_int packets_captured;

 
 /* Length of saved portion of packet. */
 int snaplen = DEFAULT_SNAPLEN;
 
 /* Length of saved portion of packet. */
 int snaplen = DEFAULT_SNAPLEN;


@@ -816,6 +817,11 @@ info(register int verbose)
        if (!verbose)
                fprintf(stderr, "%s: ", program_name);
 
        if (!verbose)
                fprintf(stderr, "%s: ", program_name);
 

+       (void)fprintf(stderr, "%u packets captured", packets_captured);
+       if (!verbose)
+               fputs(", ", stderr);
+       else
+               putc('\n', stderr);

        (void)fprintf(stderr, "%d packets received by filter", stat.ps_recv);
        if (!verbose)
                fputs(", ", stderr);
        (void)fprintf(stderr, "%d packets received by filter", stat.ps_recv);
        if (!verbose)
                fputs(", ", stderr);


@@ -859,6 +865,8 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s
        static uint cnt = 2;
        char *name;
 
        static uint cnt = 2;
        char *name;
 

+       ++packets_captured;
+

        ++infodelay;
 
        dump_info = (struct dump_info *)user;
        ++infodelay;
 
        dump_info = (struct dump_info *)user;


@@ -896,6 +904,8 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s
 static void
 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
 {
 static void
 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
 {

+       ++packets_captured;
+

        ++infodelay;
 
        pcap_dump(user, h, sp);
        ++infodelay;
 
        pcap_dump(user, h, sp);


@@ -915,6 +925,8 @@ print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
        struct print_info *print_info;
        u_int hdrlen;
 
        struct print_info *print_info;
        u_int hdrlen;
 

+       ++packets_captured;
+

        ++infodelay;
        ts_print(&h->ts);
 
        ++infodelay;
        ts_print(&h->ts);