#!/usr/bin/env ruby

# new-simple-stats.rb demonstrates the performance difference
# between the old and busted way to parse pcap files and the
# new hotness of stream parsing. Spoiler alert: Against a pcap
# file of 1GB, the old way would eat all your memory and take
# forever. This still takes kinda forever, but at 5000 packets
# every 11 seconds (my own benchmark) for this script, at least
# it doesn't hog up all your memory.

require './examples' # For path setting slight-of-hand
require 'packetfu'

def print_results(stats)
	stats.each_pair { |k,v| puts "%-12s: %10d" % [k,v] }
end

# Takes a file name, parses the packets, and records the packet
# type based on its PacketFu class.
def count_packet_types(file)
	stats = {}
	count = 0
	elapsed = 0
	start_time = Time.now
	PacketFu::PcapFile.read_packets(file) do |pkt|
		kind = pkt.proto.last.to_sym
		stats[kind] ? stats[kind] += 1 : stats[kind] = 1
		count += 1
		elapsed = (Time.now - start_time).to_i
		if count % 5_000 == 0
			puts "After #{count} packets (#{elapsed} seconds elapsed):"
			print_results(stats)
		end
	end
	puts "Final results for #{count} packets (#{elapsed} seconds elapsed):"
	print_results(stats)
end

if File.readable?(infile = (ARGV[0] || 'in.pcap'))
	title = "Packets by packet type in '#{infile}'"
	puts "-" * title.size
	puts title
	puts "-" * title.size
	count_packet_types(infile)
else
	raise RuntimeError, "Need an infile, like so: #{$0} in.pcap"
end





