GitLab

Seems more intuitive that taking a snapshot does overwrite previous snapshots.
Does admit the possibility of excessive logfile buildup.

Nit-picky cleanups.

knows when the logfiles are actually rolled.

Event groups complicated things a bit. To make this work properly, we
no longer subscribe to the link-tracemon event, but instead use a
real event group, created by assign wrapper for all of the linktrace
agents. So, you can know do things like this:

	tevc -w -e testbed/TT now link0_tracemon snapshot
or
	tevc -w -e testbed/TT now __all_tracemon snapshot

where __all_tracemon is a group of all tracemon agents for all links and
lans. I plan to change loghole to use this.

file a meaningful name.

"reload" since that part does not work right. I need to spend some
time rethinking the existing (original) code for doing plain monitor.

begin recording packets, instead, begin recording immediately and take
a snapshot if a TIME STARTED is received.  Need to do this since a
rebooted node will sit for forever waiting for the event.

some details can be found in the advanced tutorial that I wrote up.
See this link:

http://www.emulab.net/tutorial/docwrapper.php3?docname=advanced.html#Tracing

The basic idea is that each virt_lan entry gets a couple of new slots
describing the type of tracing that is desired.

  traced tinyint(1) default '0',
  trace_type enum('header','packet','monitor') NOT NULL default 'header',
  trace_expr tinytext,
  trace_snaplen int(11) NOT NULL default '0',
  trace_endnode tinyint(1) NOT NULL default '0',

There is a new physical table called "traces" that is a little bit
like the current delays table. A new tmcd command returns the trace
configuration to the client nodes (tmcd/common/config/rc.trace).

The delays table got a new boolean called "noshaping" that tells the
delay node to bridge, but not set up any pipes. This allows us to
capture traffic at the delay node, but without much less overhead on
the packets.

The pcapper got bloated up to do packet capture and more event stuff.
I also had to add some mutex locking around calls into the pcap
library and around malloc, since the current setup used linuxthreads,
which is not compatable with the standard libc_r library. I was
getting all kinds of memory corruption, and I am sure that if someone
breathes on the pcapper again, it will break in some new way.

* Add a packet capture mode (-c) option so that pcapper can be used
  the same way that tcpdump is used, to write captured packets to an
  output file. When using capture mode, stats are not collected or spit
  out. I need to think about how feasible it is to do both at once; it
  started to look like a mess.

  I added a snaplen (-l) option to be used with capture mode, to
  specify the snaplen that is passed to the pcap library.

* Beef up the event interface, adding a TRACEINFO event type, so that
  you can send START, STOP, KILL events to the pcapper. So, you can
  start and stop packet capture for a link/lan, or for a single node
  on a link/lan (much the same way as you acn control the delay
  agent).

packet reader thread(s) start up.

* The per-experiment event scheduler now runs on ops instead of boss.
  Boss still runs elvind and uses events internally, but the user part
  of the event system has moved.

* Part of the guts of eventsys_control moved to new script, eventsys.proxy,
  which runs on ops and fires off the event scheduler. The only tricky part
  of this is that the scheduler runs as the user, but killing it has to be
  done as root since a different person might swap out the experiment. So,
  the proxy is a perl wrapper invoked from a root ssh from boss, which
  forks, writes the pid file into /var/run/emulab/evsched/$pid_$eid.pid,
  then flips to the user and execs the event scheduler (which is careful
  not to fork). Obviously, if the kill is done as root, the pid file has to
  be stored someplace the user is not allowed to write.

* The event scheduler has been rewritten to use Tim's C++ interface to the
  sshxmlrpc server on boss. Actually, I reorg'ed the scheduler so that it
  can ...

-I switch now bypasses checks to only run on interfaces that have an
IP addres.

The '-b' switch, which applies the filter to all interfaces
The '-t' switch, which allows you to give a list of alternating
   interface names and filters

2. misc: use more efficient way to get interface addr,
   ignore excess interfaces,
   only consider interfaces with IPV4 addresses assigned

target and changed path of binary.

bytes of framing+CRC

Add pcapper.noevents target to Makefile to build without event system

Event system:

When compiled with -DEVENTSYS, can be made to wait for time to start
in an experiment before starting to count packets. Times are also
reported relative to experiment time start. Use the '-e' flag to
enable.

SUID support:

If compiled with -DDROPROOT, and it seems that pcapper was started
setuid root (euid == 0, and ruid != 0), drops root permissions after
opening BPF (or raw socket in Linux.) This allows it get permissions
to read packets, but still be killed by the user. This is particularly
useful with the testbed's program objects.

New command-line options:

-s: Print out packet counts to stdout, in addition to listening
        on a socket ('-f -' does the same thing, too)
-p: Count only payload sizes, not header sizes
-e: Wait for event system time to start in pid/eid
-z: Don't count zero-length packets in the packet counts (useful
        with '-p')

Also, now creates a GNUmakefile the _right_ way.

Runs on a node and uses libpcap to count packets going by. Opens a
socket, so that remote programs can connect and, say, graph its
output. The client gets to specify the interval at which it wants
counts reported. Supports multiple interfaces, and multiple clients
(with different intervals.) It can also write packet counts to a file,
for analysis later.