trafcalc 1.2 review

interfaceTrafcalc calculates the size of the TCP-payload on a system via packet capturing and connection tracking at the user level i

License: GPL (GNU General Public License) File size: 0K Developer: Mathias Bernhardt

0

interfaceTrafcalc calculates the size of the TCP-payload on a system via packet capturing and connection tracking at the user level instead of the IP level.

The program uses a pcap (a library for Packet CAPturing) callback function which is called for every incoming (tcp) packet. This function has a database in form of a global linked list of structs to manage connenctions (adding new, removing old). If a connection is not found in this database it looks up the user ID for that connection and adds it to the list. Then it gets the size of the packet and adds it to the value of the traffic for that user ID, which is stored in a similar linked list of user IDs. At the end it writes out all the information at a given interval to a file in /var/log/traffic.

Requirements:
Trafcalc depends on pcap for packetcapturing.
Version 0.7 was used in development and any newer version should work.
It might depend on gcc as it is not yet tested on other compilers.