On Wed, 23 May 2007, Karl SjC6dahl - dunceor wrote:
> On 5/22/07, OBSD <[EMAIL PROTECTED]> wrote:
> > Hi,
> >
> > does anybody get on a OpenBSD 4.x tcpdstat installed?
> > Tcpdstat from
> > http://staff.washington.edu/dittrich/talks/core02/tools/tcpdstat-uw.tar
> > is a very nice tool to get summary information of a tcpdump file.
> >
> > The output includes the number of packets, the average rate and its
standard
> > deviation,
> > the number of unique source and destination address pairs, and the
breakdown
> > of protocols.
> >
> > I would appreciate every help or hint to get it compiled.
> > I can remember me that I could compile it on a OpenBSD 3.6 but on the new
> > one 4.1
> > it fails always.
> >
> > Regards,
> > Stefan
> >
> >
>
> This makes it compile at least:
> --- tcpdstat.h Wed May 23 22:14:28 2007
> +++ new_tcpdstat.h Wed May 23 22:14:17 2007
> @@ -410,7 +410,7 @@
> };
>
> extern long long int read_count;
> -extern struct timeval start_time, end_time;
> +extern struct bpf_timeval start_time, end_time;
> extern struct pkt_cnt tcpdstat[PROTOTYPE_MAX];
> extern int packet_length;
> extern long long int caplen_total;
>
> I bet bpf_timeval is only a typedef or pretty much the same as timeval
> anyway. Worth a try, I haven't been able to test it out.
they are not "pretty much the same"; they happen to have the same
field names (a bad design decisison, but we have to live with that),
but they ARE different:
struct bpf_timeval {
u_int32_t tv_sec;
u_int32_t tv_usec;
};
struct timeval {
long tv_sec; /* seconds */
long tv_usec; /* and microseconds */
};
Apart from the fields being unsigned in the bpf_timeval case, they are
not the same size on 64-bit platforms.
-Otto
