On Wed, 23 May 2007, Karl SjC6dahl - dunceor wrote:

quoted text
> On 5/22/07, OBSD <obsd@freenet.de> wrote:
> > Hi,
> >
> > does anybody get on a OpenBSD 4.x tcpdstat installed?
> > Tcpdstat from
> > http://staff.washington.edu/dittrich/talks/core02/tools/tcpdstat-uw.tar
> > is a very nice tool to get summary information of a tcpdump file.
> >
> > The output includes the number of packets, the average rate and its
standard
quoted text
> > deviation,
> > the number of unique source and destination address pairs, and the
breakdown
quoted text
> > of protocols.
> >
> > I would appreciate every help or hint to get it compiled.
> > I can remember me that I could compile it on a OpenBSD 3.6 but on the new
> > one 4.1
> > it fails always.
> >
> > Regards,
> > Stefan
> >
> >
>
> This makes it compile at least:
> --- tcpdstat.h Wed May 23 22:14:28 2007
> +++ new_tcpdstat.h  Wed May 23 22:14:17 2007
> @@ -410,7 +410,7 @@
> };
>
> extern long long int read_count;
> -extern struct timeval start_time, end_time;
> +extern struct bpf_timeval start_time, end_time;
> extern struct pkt_cnt tcpdstat[PROTOTYPE_MAX];
> extern int packet_length;
> extern long long int caplen_total;
>
> I bet bpf_timeval is only a typedef or pretty much the same as timeval
> anyway. Worth a try, I haven't been able to test it out.

they are not "pretty much the same"; they happen to have the same
field names (a bad design decisison, but we have to live with that),
but they ARE different:

struct bpf_timeval {
        u_int32_t       tv_sec;
        u_int32_t       tv_usec;
};

struct timeval {
        long    tv_sec;         /* seconds */
        long    tv_usec;        /* and microseconds */
};

Apart from the fields being unsigned in the bpf_timeval case, they are
not the same size on 64-bit platforms.

	-Otto