diff options
| author | Florian Westphal <fw@strlen.de> | 2025-01-09 14:15:37 +0100 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2025-02-07 13:15:29 +0100 |
| commit | 9bc5384ff8699cda4aa9f3ec0eea738cf0cfb5bc (patch) | |
| tree | e379ec65a6ed6f1c179007156a9d3b614f31cc2d /src/conntrack.c | |
| parent | 7ab577898f83105e3aa38ac96f3ac70c91ecb2ac (diff) | |
If kernel provided the event timestamp, then use it, else fall back
to gettimeofday.
This needs a recent kernel with
netfilter: conntrack: add conntrack event timestamp
and net.netfilter.nf_conntrack_timestamp sysctl set to 1.
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/conntrack.c')
| -rw-r--r-- | src/conntrack.c | 23 |
1 files changed, 20 insertions, 3 deletions
diff --git a/src/conntrack.c b/src/conntrack.c index 52ba4ac..2d4e864 100644 --- a/src/conntrack.c +++ b/src/conntrack.c @@ -1914,6 +1914,25 @@ static char *get_progname(uint32_t portid) return NULL; } +static void event_print_timestamp(const struct nf_conntrack *ct) +{ + struct timeval tv; + + /* nfct_attr_is_set returns -1 if attr is unknown */ + if (nfct_attr_is_set(ct, ATTR_TIMESTAMP_EVENT) > 0) { + uint64_t event_ts = nfct_get_attr_u64(ct, ATTR_TIMESTAMP_EVENT); + static const uint64_t ns_per_s = 1000000000ul; + static const uint64_t ns_to_usec = 1000ul; + + tv.tv_sec = event_ts / ns_per_s; + tv.tv_usec = (event_ts % ns_per_s) / ns_to_usec; + } else { + gettimeofday(&tv, NULL); + } + + printf("[%-.8ld.%-.6ld]\t", tv.tv_sec, tv.tv_usec); +} + static int event_cb(const struct nlmsghdr *nlh, void *data) { struct nfgenmsg *nfh = mnl_nlmsg_get_payload(nlh); @@ -1969,9 +1988,7 @@ static int event_cb(const struct nlmsghdr *nlh, void *data) op_flags = NFCT_OF_SHOW_LAYER3; if (output_mask & _O_TMS) { if (!(output_mask & _O_XML)) { - struct timeval tv; - gettimeofday(&tv, NULL); - printf("[%-.8ld.%-.6ld]\t", tv.tv_sec, tv.tv_usec); + event_print_timestamp(ct); } else op_flags |= NFCT_OF_TIME; } |