Top ports - update parser

Author: Zadamsa

src/plugins/input/CMakeLists.txt

@@ -1,4 +1,5 @@
 add_subdirectory(raw)
+add_subdirectory(parser)
 
 if (ENABLE_INPUT_PCAP)
 	add_subdirectory(pcap)

src/plugins/input/parser/parser.cpp

@@ -465,7 +465,8 @@ inline uint16_t parse_ipv6_hdr(const u_char* data_ptr, uint16_t data_len, Packet
  * \param [out] pkt Pointer to Packet structure where parsed fields will be stored.
  * \return Size of header in bytes.
  */
-inline uint16_t parse_tcp_hdr(const u_char* data_ptr, uint16_t data_len, Packet* pkt)
+inline uint16_t
+parse_tcp_hdr(const u_char* data_ptr, uint16_t data_len, Packet* pkt, ParserStats& stats)
 {
 	struct tcphdr* tcp = (struct tcphdr*) data_ptr;
 	if (sizeof(struct tcphdr) > data_len) {
@@ -479,6 +480,9 @@ inline uint16_t parse_tcp_hdr(const u_char* data_ptr, uint16_t data_len, Packet*
 	pkt->tcp_flags = (uint8_t) *(data_ptr + 13) & 0xFF;
 	pkt->tcp_window = ntohs(tcp->window);
 
+	stats.top_ports.increment_tcp_frequency(pkt->src_port);
+	stats.top_ports.increment_tcp_frequency(pkt->dst_port);
+
 	DEBUG_MSG("TCP header:\n");
 	DEBUG_MSG("\tSrc port:\t%u\n", ntohs(tcp->source));
 	DEBUG_MSG("\tDest port:\t%u\n", ntohs(tcp->dest));
@@ -544,7 +548,8 @@ inline uint16_t parse_tcp_hdr(const u_char* data_ptr, uint16_t data_len, Packet*
  * \param [out] pkt Pointer to Packet structure where parsed fields will be stored.
  * \return Size of header in bytes.
  */
-inline uint16_t parse_udp_hdr(const u_char* data_ptr, uint16_t data_len, Packet* pkt)
+inline uint16_t
+parse_udp_hdr(const u_char* data_ptr, uint16_t data_len, Packet* pkt, ParserStats& stats)
 {
 	struct udphdr* udp = (struct udphdr*) data_ptr;
 	if (sizeof(struct udphdr) > data_len) {
@@ -554,6 +559,9 @@ inline uint16_t parse_udp_hdr(const u_char* data_ptr, uint16_t data_len, Packet*
 	pkt->src_port = ntohs(udp->source);
 	pkt->dst_port = ntohs(udp->dest);
 
+	stats.top_ports.increment_udp_frequency(pkt->src_port);
+	stats.top_ports.increment_udp_frequency(pkt->dst_port);
+
 	DEBUG_MSG("UDP header:\n");
 	DEBUG_MSG("\tSrc port:\t%u\n", ntohs(udp->source));
 	DEBUG_MSG("\tDest port:\t%u\n", ntohs(udp->dest));
@@ -749,10 +757,10 @@ void parse_packet(
 
 		l4_hdr_offset = data_offset;
 		if (pkt->ip_proto == IPPROTO_TCP) {
-			data_offset += parse_tcp_hdr(data + data_offset, caplen - data_offset, pkt);
+			data_offset += parse_tcp_hdr(data + data_offset, caplen - data_offset, pkt, stats);
 			stats.tcp_packets++;
 		} else if (pkt->ip_proto == IPPROTO_UDP) {
-			data_offset += parse_udp_hdr(data + data_offset, caplen - data_offset, pkt);
+			data_offset += parse_udp_hdr(data + data_offset, caplen - data_offset, pkt, stats);
 			stats.udp_packets++;
 		}
 	} catch (const char* err) {