NAME

CAIDA::Traffic2::Interval - Storage/reading object for intervals

SYNOPSIS

    use CAIDA::Traffic2::Interval;
    use CAIDA::Traffic2::FileReader;
    # Set up $reader and $interval with initialization data
    my @id_infos = $interval->get_id_infos();
    my $table = $interval->get_table($id_infos[0], $type);
    my $pkt_drop = $interval->get_metadata('dropped pkt');
    my $accumulator = new CAIDA::Traffic2::Interval;
    $accumulator->add($interval);
    $accumulator->nadd($interval);

DESCRIPTION

Interval is a class that assists in the reading of Traffic2-style output files. Traffic2-style is that which is output by crl_traffic2 (or crl_flow -I). Interval objects are generally created by the FileReader class, but one could use a stand-alone Interval object as an accumulator over several different Intervals. When created by FileReader, these objects are initialized with a list of desired table types, which Interval will autogenerate whenever possible.

Interval has the following member functions:

new ()
Creates a new Interval object.

get_id_infos ()
Returns a list of the IDs (or subinterfaces) contained within the interval, which consists of SubinterfaceInfo objects.

get_table (SUBINTERFACEINFO, TYPE)
Returns the table data for the specified SUBINTERFACEINFO, of the specified TYPE.

add (INTERVAL)
nadd (INTERVAL)
Adds another INTERVAL to the current one. This assumes that INTERVAL has been properly initialized (ie, created via FileReader). It also assumes that the two objects are contiguous in time, and that they have been preloaded. nadd() is the same as add(), but it is free to do destructive operations on INTERVAL. INTERVAL should not be used again for anything after calling nadd().

get_metadata (FIELD)
Returns metadata related to the interval. FIELD is the name of the specific piece of metadata. Valid FIELD values are:
start
The start timestamp of the interval.

duration
The duration of the interval.

end
The end timestamp of the interval.

ip
The number of IP packets in the interval.

non-ip
The number of non-IP packets in the interval.

dropped pdu
The number of level 2 PDUs dropped in the interval.

dropped pkt
The number of packets dropped in the interval.

ERRORS

EXAMPLES

A typical case involving Traffic2-style file format would involve an input file with only Tuple Tables. The following code will read that file (from STDIN), and automatically convert the Tuple Tables into Proto Tables, which the user might also want:

    use CAIDA::Traffic2::FileReader;
    my $reader = new CAIDA::Traffic2::FileReader(*STDIN);
    $reader->set_desired_table_types("Tuple Table", "Proto Table");
    while (my $interval = $reader->get_next_interval()) {
        foreach my $id_info ($interval->get_id_infos()) {
            foreach my $type ($id_info->get_table_types()) {
                my $table = $interval->get_table($id_info, $type);
                if (not defined $table) {
                    # Issue some warning or ignore
                } else {
                    # Do fun stuff with $table.
                }
            }
        }
    }

ENVIRONMENT

SEE ALSO

The CAIDA::Tables, CAIDA::Traffic2::SubinterfaceInfo, CAIDA::Traffic2::FileWriter and CAIDA::Traffic2::FileReader manpages.

NOTES

crl_flow can output in several different formats than the 'Traffic2' format, which are readable by Interval objects, but cause possibly unexpected behavior. crl_flow allows multiple different expiration algorithms, which can cause the output of multiple entries with the same key. These separate entries will be added together when read by these classes. In addition, 'active' flows are currently ignored entirely.

For best results, use crl_flow -I.

If you have any ideas about how better to deal with this (creating different tables for active and expired flows, creating tables that accept multiple separate entries with the same key), please write us at coral-bugs@caida.org

WARNINGS

DIAGNOSTICS

BUGS

RESTRICTIONS

AUTHOR

Ryan Koga <rkoga@caida.org>