|
发表于 2007-4-2 10:43:04
|
显示全部楼层
IP数量的问题:
默认是20个IP,这个数量肯定不够,但是多少合适?
关键问题是bandwidthd要生成流量图的,每个 IP 至少两个图。太多的IP数量会导致bandwidthd占用大量的CPU和内存资源。
昨天又看了下源程序,发现设计思路实在不太好。打算和作者联系,让他修改一下。
P2P流量检测也有问题,源端口和目的端口的判断,逻辑关系不对,而且这些端口都应该放到配置文件中,下面是部分源码:
inline void Credit(struct Statistics *Stats, const struct ip *ip)
{
unsigned long size;
const struct tcphdr *tcp;
uint16_t sport, dport;
size = ntohs(ip->ip_len);
Stats->total += size;
switch(ip->ip_p)
{
case 6: // TCP
tcp = (struct tcphdr *)(ip+1);
tcp = (struct tcphdr *) ( ((char *)tcp) + ((ip->ip_hl-5)*4) ); // Compensate for IP Options
Stats->tcp += size;
sport = ntohs(tcp->TCPHDR_SPORT);
dport = ntohs(tcp->TCPHDR_DPORT);
if (sport == 80 || dport == 80 || sport == 443 || dport == 443)
Stats->http += size;
if (sport == 20 || dport == 20 || sport == 21 || dport == 21)
Stats->ftp += size;
if (sport == 1044|| dport == 1044|| // Direct File Express
sport == 1045|| dport == 1045|| // '' <- Dito Marks
sport == 1214|| dport == 1214|| // Grokster, Kaza, Morpheus
sport == 4661|| dport == 4661|| // EDonkey 2000
sport == 4662|| dport == 4662|| // ''
sport == 4665|| dport == 4665|| // ''
sport == 5190|| dport == 5190|| // Song Spy
sport == 5500|| dport == 5500|| // Hotline Connect
sport == 5501|| dport == 5501|| // ''
sport == 5502|| dport == 5502|| // ''
sport == 5503|| dport == 5503|| // ''
sport == 6346|| dport == 6346|| // Gnutella Engine
sport == 6347|| dport == 6347|| // ''
sport == 6666|| dport == 6666|| // Yoink
sport == 6667|| dport == 6667|| // ''
sport == 7788|| dport == 7788|| // Budy Share
sport == 8888|| dport == 8888|| // AudioGnome, OpenNap, Swaptor
sport == 8889|| dport == 8889|| // AudioGnome, OpenNap
sport == 28864|| dport == 28864|| // hotComm
sport == 28865|| dport == 28865) // hotComm
Stats->p2p += size;
break;
case 17:
Stats->udp += size;
break;
case 1:
Stats->icmp += size;
break;
}
} |
|