diff --git a/include/ipfixprobe/parser-stats.hpp b/include/ipfixprobe/parser-stats.hpp index 3c5c7777..a3362326 100644 --- a/include/ipfixprobe/parser-stats.hpp +++ b/include/ipfixprobe/parser-stats.hpp @@ -25,7 +25,9 @@ #pragma once +#include "../../input/topPorts.hpp" #include +#include namespace ipxp { @@ -46,6 +48,8 @@ struct ParserStats { uint64_t seen_packets; uint64_t unknown_packets; + + TopPorts<10> top_ports; }; } // namespace ipxp diff --git a/input/input.cpp b/input/input.cpp index 105615bb..c7cfb9e8 100644 --- a/input/input.cpp +++ b/input/input.cpp @@ -24,6 +24,10 @@ */ #include +#include +#include +#include +#include namespace ipxp { @@ -52,6 +56,17 @@ static telemetry::Content get_parser_stats_content(const ParserStats& parserStat dict["seen_packets"] = parserStats.seen_packets; dict["unknown_packets"] = parserStats.unknown_packets; + const auto& [ports, size] = parserStats.top_ports.get_top_ports(); + if (size == 0) { + dict["top_10_ports"] = ""; + } else { + std::string top_ports = std::to_string(ports[0].first) + ": " + std::to_string(ports[0].second); + dict["top_10_ports"] = std::accumulate(ports.begin() + 1, ports.begin() + size, top_ports, + [](std::string& acc, const std::pair& port_frequency) { + return acc + ", " + std::to_string(port_frequency.first) + ": " + std::to_string(port_frequency.second); + }); + } + return dict; } diff --git a/input/parser.cpp b/input/parser.cpp index 61b696cb..bc94819d 100644 --- a/input/parser.cpp +++ b/input/parser.cpp @@ -37,6 +37,10 @@ #include "headers.hpp" #include +#include +#include +#include +#include namespace ipxp { //#define DEBUG_PARSER @@ -454,7 +458,7 @@ inline uint16_t parse_ipv6_hdr(const u_char *data_ptr, uint16_t data_len, Packet * \param [out] pkt Pointer to Packet structure where parsed fields will be stored. * \return Size of header in bytes. */ -inline uint16_t parse_tcp_hdr(const u_char *data_ptr, uint16_t data_len, Packet *pkt) +inline uint16_t parse_tcp_hdr(ParserStats& stats, const u_char *data_ptr, uint16_t data_len, Packet *pkt) { struct tcphdr *tcp = (struct tcphdr *) data_ptr; if (sizeof(struct tcphdr) > data_len) { @@ -469,6 +473,9 @@ inline uint16_t parse_tcp_hdr(const u_char *data_ptr, uint16_t data_len, Packet pkt->tcp_flags = (uint8_t) *(data_ptr + 13) & 0xFF; pkt->tcp_window = ntohs(tcp->window); + stats.top_ports.increment_frequency(pkt->src_port); + stats.top_ports.increment_frequency(pkt->dst_port); + DEBUG_MSG("TCP header:\n"); DEBUG_MSG("\tSrc port:\t%u\n", ntohs(tcp->source)); DEBUG_MSG("\tDest port:\t%u\n", ntohs(tcp->dest)); @@ -529,7 +536,7 @@ inline uint16_t parse_tcp_hdr(const u_char *data_ptr, uint16_t data_len, Packet * \param [out] pkt Pointer to Packet structure where parsed fields will be stored. * \return Size of header in bytes. */ -inline uint16_t parse_udp_hdr(const u_char *data_ptr, uint16_t data_len, Packet *pkt) +inline uint16_t parse_udp_hdr(ParserStats& stats, const u_char *data_ptr, uint16_t data_len, Packet *pkt) { struct udphdr *udp = (struct udphdr *) data_ptr; if (sizeof(struct udphdr) > data_len) { @@ -539,6 +546,9 @@ inline uint16_t parse_udp_hdr(const u_char *data_ptr, uint16_t data_len, Packet pkt->src_port = ntohs(udp->source); pkt->dst_port = ntohs(udp->dest); + stats.top_ports.increment_frequency(pkt->src_port); + stats.top_ports.increment_frequency(pkt->dst_port); + DEBUG_MSG("UDP header:\n"); DEBUG_MSG("\tSrc port:\t%u\n", ntohs(udp->source)); DEBUG_MSG("\tDest port:\t%u\n", ntohs(udp->dest)); @@ -727,10 +737,10 @@ void parse_packet(parser_opt_t *opt, ParserStats& stats, struct timeval ts, cons l4_hdr_offset = data_offset; if (pkt->ip_proto == IPPROTO_TCP) { - data_offset += parse_tcp_hdr(data + data_offset, caplen - data_offset, pkt); + data_offset += parse_tcp_hdr(stats, data + data_offset, caplen - data_offset, pkt); stats.tcp_packets++; } else if (pkt->ip_proto == IPPROTO_UDP) { - data_offset += parse_udp_hdr(data + data_offset, caplen - data_offset, pkt); + data_offset += parse_udp_hdr(stats, data + data_offset, caplen - data_offset, pkt); stats.udp_packets++; } } catch (const char *err) { diff --git a/input/topPorts.hpp b/input/topPorts.hpp new file mode 100644 index 00000000..a9294d2d --- /dev/null +++ b/input/topPorts.hpp @@ -0,0 +1,60 @@ +/** + * \file topPorts.hpp + * \brief Template class implementing the most popular ports. + * \author Damir Zainullin + * \date 2024 + */ +#pragma once + +#include +#include +#include +#include + +namespace ipxp { +/** + * \brief Top ports counter. + * \tparam TopPortsCount Number of the most popular ports to store. + */ +template +class TopPorts { +public: + /** + * \brief Increments number of times given port has been seen. + * \param port Port to increment its frequency. + */ + void increment_frequency(uint16_t port) noexcept + { + m_port_frequencies[port]++; + } + + /** + * \brief Get the top ports. + * \return Pair of the top ports array and their count. + */ + std::pair, TopPortsCount>, size_t> + get_top_ports() const noexcept + { + std::array, TopPortsCount> res{}; + size_t ports_inserted = 0; + std::for_each(m_port_frequencies.begin(), m_port_frequencies.end(),[&, port = 0](size_t frequency) mutable { + auto port_pos = std::lower_bound(res.begin(), res.end(), frequency, + [](const std::pair& port_frequency, size_t count) { + return port_frequency.second >= count; + }); + + if (port_pos != res.end()) { + std::copy_backward(port_pos, std::prev(res.end()), res.end()); + *port_pos = std::make_pair(port, frequency); + ports_inserted = std::min(TopPortsCount, ports_inserted + 1); + } + port++; + }); + return {res, ports_inserted}; + } + +private: + std::array::max() + 1> m_port_frequencies {}; +}; + +} // namespace ipxp