<?PHP 

/*

Program to analyze TCPdump output of name servers. We look only at the reply packets because
every reply contains the question to which it is a reply. It stops after processing 48 hours, 
whether or not the data continues. 

	
Brian Reid, Internet Systems Consortium
December 2006


This program is invoked from the following shell snippet:

	(for gzfile in `cat list-of-files-to-be-processed`
	 do
	   gunzip < $gzfile |  tcpdump -s 512 -n -vv -tt -r -
	 done
	) | \
		php -f ./tcpdump.php


*/
$IntervalToProcess = 48*60*60;

$PacketCount = 0;
$FailureCount = 0;
$TCPcount = 0;
$TCPsessions = 0;
$TCPclosed = 0;
$UDPcount = 0;
$ErrorCount = 0;
$AAcount = 0;
$RQcount = 0;
$RQfail = 0;
$Time1 = 999999999999999;
$TimeN = -1;
$PrevTime = 0;
$AvgRate = 0;
$BurstMax = 0;
$Queries = array();
$Exits = array();
$QFailures = array ();
$BurstRates = array();

$ReachedStart = FALSE;

while (TRUE) {
	$rawline = fgets(STDIN);
	if ($rawline === FALSE) break;
	$line = trim($rawline);
/* Tally TCP packets and sessions, but otherwise don't process TCP packets */
	if (FALSE !== strpos($line, "[tcp sum ok]")) {
	    $TCPcount++;
		if (FALSE !== strpos($line, " S [tcp sum ok]")) $TCPsessions++;
		if (FALSE !== strpos($line, " S [tcp sum ok]")) $TCPclosed++;

		continue;
	}
/* Parse a UDP packet up to the first variable-format part */
	sscanf($line,"%f IP (%[^)]) %s %s %s [%s sum ok] ", $ptime, $filler1, $paddr1, $pdirection, $paddr2, $pudptcp);
	if ($pudptcp == "") continue;
	
	$DateData = getdate($ptime);
	if ($DateData["minutes"] == 0 && $DateData["seconds"] == 0) $ReachedStart = TRUE;
	if (! $ReachedStart) continue;
	
	$UDPcount++;
	
	$firstVariablePart = strpos($line, " sum ok] ");
	if ($firstVariablePart === FALSE) {
		$ErrorCount++;
		continue;
	} else {
	    $FVP = substr($line, $firstVariablePart+strlen(" sum ok] "));
	}

/* If the reply code is null, it is utterly omitted and the field count is reduced by 1 */
	$FirstToken = strtok($FVP," ");
	$SecondToken = strtok(" ");
	
    if ($SecondToken == "q:") {
	    sscanf($FVP, "%s", $pqidf);
		$precurse = FALSE !== strpos($pqidf, "-");
		$pauthorit = FALSE !== strpos($pqidf, "*");
		$errcode = "";
		$pqueryid = str_replace(array("-","*"), array("", ""), $pqidf);
		$failed = FALSE;

	} else {
	    sscanf($FVP, "%s %s", $pqueryid, $retcode);
		$errcode = str_replace(array("-","*"), array("", ""), $retcode);
		$precurse = FALSE !== strpos($retcode, "-");
		$pauthorit = FALSE !== strpos($retcode, "*");
		$failed = TRUE;
	}
/* The query type can contain an embedded space. If it does, then the part after the space is actually CLASS,
   and not part of QTYPE. */
	$Qpart = substr($FVP, 3+strpos($FVP, "q: "));
	$Vpart = substr($Qpart, 2+strpos($Qpart, "?"));
	$pqcode = substr($Qpart, 0, strpos($Qpart, "?"));
	
	if (strpos($pqcode, " ANY") !== FALSE) {
	    $pqcode = "CLASS ANY";
	}
	
	sscanf($Vpart,"%s %s", $pqarg, $panswercount);

	sscanf($panswercount,"%d/%d/%d",$pna, $pnns, $pnalt);
    if ($ptime < $Time1) $Time1 = $ptime;
    if ($ptime > $TimeN) $TimeN = $ptime;
	$DeltaT = $ptime - $PrevTime;
/* Check for time warp and don't include it in our statistics. */
	if ($DeltaT > 0 && $DeltaT < 10) {
/* Perform RC single-exponential smoothing on the data, to compute a sliding-average rate */
	    $TimeConstant = 1.0;
	    $decay = exp(-$DeltaT/$TimeConstant);
		$InstantaneousRate = 1.0/$DeltaT;
	    $AvgRate = ($AvgRate * $decay) + (1.0-$decay)*$InstantaneousRate;
		if ($AvgRate > $BurstMax) $BurstMax = $AvgRate;
/* We will use Time Bins to compute the 95th percentile burst rate, below */
		$TimeBin = intval($ptime - $Time1);
		$BurstRates[$TimeBin] = (int) $AvgRate;
/*		printf ("%8.4f  %10d  %10.8f      %12.6f\n",$DeltaT,$TimeBin,$decay,$AvgRate); */
	    $Duration = $TimeBin;       /* final time bin is integer duration of sample */

	}
    $PrevTime = $ptime;

	
	$answerloc = strpos($line, $panswercount);
	if (! $answerloc === FALSE) {
		   $answer = substr($line,$answerloc+strlen($panswercount));
		} else {
		   $answer = "";
	    }
	
	/*
	printf ("%20s %15s %1s %15s %s %7d %s\nQuery: %s %s\nReply: %s   %d  %d  %d\n", $ptime, 
		$paddr1, $pdirection, $paddr2, $pudptcp, 
		$pqueryid, $pqidfc, $pqcode, $pqarg, $panswercount, $pna, $pnns, $pnalt);
	 */
	
	$PacketCount++;
	if ($failed) $FailureCount++;
	if ($precurse) {
	    $RQcount++;
		if ($failed) $RQfail++;
	}
	if ($pauthorit) $AAcount++;
    if (array_key_exists($pqcode, $Queries)) {
	    $Queries[$pqcode]++;
    } else {
	    $Queries[$pqcode] = 1;
		$QFailures[$pqcode] = 0;
	}
	if ($errcode != "") {
	    if (array_key_exists($errcode, $Exits)) {
		    $Exits[$errcode]++;
		} else {
		    $Exits[$errcode] = 1;
		}
		$QFailures[$pqcode]++;
	}
    $elapsed = $TimeN - $Time1;
	if ($elapsed > $IntervalToProcess) break;

}

/* Compute 95th percentile burst rate by counting down from the maximum burst rate*/

$Percentiles = array(); $Dcount = 0;
for ($i=0; $i<=$BurstMax; $i++) {$Percentiles[$i] = 0;};

foreach ($BurstRates as $rate) {
    $Percentiles[$rate]++; $Dcount++;
}
$Down5 = 0.05*$Duration;
$Sum = 0.0; $Index = intval($BurstMax);
while($Sum < $Down5) {$Sum += $Percentiles[$Index--];};
$Burst95 = $Index;

/* Print the final summary */

printf ("Start: %s, duration: %1.2f seconds. \n", gmdate("r",$Time1), $elapsed);
printf ("%d requests (%1.1f%% failed)\n", $PacketCount, (100*$FailureCount/$PacketCount));
printf ("Avg rate (requests/second) = %1.1f, 95%%ile burst = %1.1f, Max burst = %1.1f\n", $PacketCount / $elapsed, $Burst95,  $BurstMax);
printf ("%d recursive queries (%1.1f%% failed); %d authoritative replies\n", $RQcount, (100*$RQfail/$RQcount),$AAcount);
printf ("%d TCP packets in %d sessions (%d never closed) not analyzed (%1.1f%% of total packets)\n", $TCPcount, $TCPsessions, $TCPsessions-$TCPclosed, 100*$TCPcount/$PacketCount);

arsort($Queries, SORT_NUMERIC);
print "\nBy type of query in default class:\n";
foreach ($Queries as $what => $count) {
    if ($what == "CLASS ANY") continue;
    printf (" %10d/%5.1f%%   %-25s %10d failed %8s\n", $count, 100*$count/$PacketCount,
	$what, $QFailures[$what],
		 sprintf("(%1.1f%%)", 100*$QFailures[$what]/$count));
}

if (array_key_exists("CLASS ANY", $Queries)) {
    print "\nClass ANY:\n"; 
    $what = "CLASS ANY"; $count = $Queries[$what];
    printf (" %10d/%5.1f%%   %-25s %10d failed %8s\n", $count, 100*$count/$PacketCount,
	"", $QFailures[$what],
		 sprintf("(%1.1f%%)", 100*$QFailures[$what]/$count));
}

arsort($Exits, SORT_NUMERIC);
print "\nReturn codes (percentages are of total query count):\n";
foreach ($Exits as $what => $count) {
	    printf (" %10d %5.1f%%  %s \n", $count, 100*$count/$PacketCount, $what);
}
?>