Question

From a linux OS I am trying to write my own data usage monitor in C or python. I’ve searched and researched for a couple of days now. Currently I am trying to adapt sniffex.c to suit my needs. I’ve succeeded in verifying the total bytes sent and received during a few ftp sessions.

In sniffex.c the tcp packet size is calculated. My question is how do you calculate the UDP packet size? I’ve searched on this topic, but have not found anything. Does this question make sense?

Update:

The function where the packet sizes are computed looks like this:

got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet)
{
...
int size_payload;
...
case IPPROTO_UDP:
    printf("   Protocol: UDP\n");
    size_payload = header->len;
...
}

Do I still need to add 4 to size_payload?

The callback to this function looks like this:

/* now we can set our callback function */
pcap_loop(handle, num_packets, got_packet, NULL);

Answer 1

If you have an UDP datagram, you can get its size from its header.

For example if you have a pointer char *hdr to UDP datagram header, you can get its length by such a construction

int length = *(int *)(hdr + 4);

More about UDP http://en.wikipedia.org/wiki/User_Datagram_Protocol