[Coral-dev] Printing packet stats: 0 packets received?

[Ken Keys]

On Tue, Jul 06, 2010 at 11:48:51AM -0400, Jeff Terrell wrote:
> Hello,
> 
> I'd like to periodically print the number of packets that CoralReef
> has dropped and the number it has received. ?The interval
> functionality seems to be a great mechanism for this. ?However, I
> think the statistics it is reporting to me are incorrect.
> 
> I wrote a minimal example program to demonstrate my problem, which you
> can see here:
> 
> http://pastebin.com/aAZng31y
> 
> I'm reading packets from a 32-second pcap trace.  My program receives
> a packet from coral_read_pkt() a total of 4,203,253 times, which is
> the same as the number of packets reported by `tcpdump -nnr`.
> However, the stats->pkts_recv counter (and every other counter) is 0,
> both when the statistics are part of the interval received from
> coral_read_pkt() as well as when the statistics are are received from
> coral_get_interface_stats() at the end of the program.  The output of
> the program on my pcap trace can be seen here:
> 
> http://pastebin.com/EXqe83G4
> 
> Am I misunderstanding the purpose of the pkts_recv counter?  Or am I
> not using it correctly?  Or is it really broken?  Please help.
> 
> I'm running CoralReef version 3.8.6-public and libpcap version 1.0.0
> on a (Linode) Ubuntu Linux v2.6.32.12-x86_64 system.
> 
> Thanks,
> -Jeff T.

The problem is that libpcap does not report packets recieved or
dropped when reading from a tracefile, but only when reading from
a live interface.  This isn't stated in the CoralReef documentation,
but CoralReef gets the stats from libpcap, so it has the same
limitation.  (When reading from a live pcap interface, the only
stats available will be pkts_recv and pkts_drop; the others will
always be zero.)

-- 
Ken Keys
kkeys at caida.org
CoralReef:  http://www.caida.org/tools/measurement/coralreef/