Tutorial: Plugin dependencies

In oder to avoid reinventing the wheel, T2 provides the means to access other plugins results. Before we start doing this, clean out your plugin .so directory if this is the first tutorial you follow. Then all unnecessary plugins should be deleted from the plugin folder ./tranalyzer/plugins and compile basicFlow, basicStats and txtSink.

$ t2build -e
Are you sure you want to empty the plugin folder '/home/wurst/.tranalyzer/plugins' (y/N)? y
Plugin folder emptied
$ t2build basicFlow txtSink
...

Compiling the basicFlow took now a bit longer, because t2 had to rebuild the subnetfiles for geolocation. ‘t2build -e’ also removes the subnetfile. You can also use a rm, which does not remove the old subnetfile:

$ rm ~/.tranalyzer/plugins/*.so
$ t2build basicFlow txtSink

Then the compilation will be considerable faster, as the subnetfile already exists.

If you didn’t read the tutorials before, here is the basis plugin which we will extend: tcpWin

The annonymized sample pcap being used in the basic tutorial can be downloaded here: annoloc2.pcap. Please extract it under your data folder, if you not already have. Now you are all set for dependency stuff.

Accessing core internal information

If you need the number of tcp packets or any other global counts defined in global.h, which every plugin includes. So no dependency is needed.

So if you need any of these variables, which denote the aggregated counts over all packets see up to the time of request, just use them. BUT NEVER WRITE TO THEM !!! We will come back to that in the tutorial pluginsummaryfile and pluginsinks.

Accessing other plugins information

If you need the number of tcp packets or any other global counts defined in global.h, no dependency is needed.

For plugins, the following rules apply: * the plugin supplying data must have a number lower than yours * the .h of the plugin must be included at the beginning of your plugin * Swap T2_PLUGIN_INIT with T2_PLUGIN_INIT_WITH_DEPS * the path of the pluing must be added in your Makefile.am * structs you are interested in must be declared as extern

Sounds complicated, actually not, if you stick to the plugin coding rules. So we are interested in the

Open your tcpWin.c and go to T2_PLUGIN_INIT and swap it with the T2_PLUGIN_INIT_WITH_DEPS function. Just add the lines marked by <–

Now open the Makefile.am and uncomment the libtcpWin_la_CFLAGS constant and add the path to the source of the basicStats plugin as outlined below

So we can use the basicStats flow struct now. Open the tcpWin.c and add the lines marked by <– in the onFlowTerminate callback function. There we define a pointer to the struct of that very flowIndex. Then we swap tcpWinFlowP->pktTcpCnt with bSFlowP->numTPkts.

Thats it! Recompile and execute t2:

now change to your results window and look at the flow file.

tcol annoloc2_flows.txt

You will notice that f is not changed, because all packets in a tcp flow match the total packet count in basicStats. For verification you can add an additional column which prints bSFlowP->numTPkts in the flow file. I leave that as an exercise for the user.

Make your Plugin a dependency

This is very easy, open tcpWin.h and look at the end of the file:

The **extern tcpWinFlow_t* statement assures that whoever includes your .h file will have access to the tcpWinFlow_t flow memory and the gwz_t windowsize count structure. The real pointers to the whole struct flow memory are defined in your .c file as a global.

So tcpWin is now set to be used as a dependency later on.