1#@!#!123s

: / usr / share / doc / nethogs-0.8.5 /
Filename : DESIGN
back
Rough design notes:

decpcap handles pcap. nethogs.cpp asks to be notified of all IPv4 or IPv6
TCP packets.

the IP callbacks store the source and destination addresses into the user
data. The TCP callback makes a Packet out of it, finds the Connection 
corresponding to that packet, and adds the packet to the connection.

If no connection is found, a new one is constructed, and the process
related to that connection is found though getProcess.

If needed, the screen is refreshed.

If, in getProcess, no corresponding process is found, the connection is
added to the 'unknown' process.

To prevent connections from accidentally ending up in the 'unknown' process,
and then staying there indefinitely, we should maybe walk though
the unknownproc's connections whenever the connection-to-inode table is
refreshed.
And maybe, while there are still unknown connections, the connection-to-inode 
table should be updated regularly.


There are some global data structures:
connection.cpp:
  connections. 'ConnList' list containing all currently known connections.
  A connection removes itself from the global 'connections' list in its 
  destructor.

  processes. 'ProcList *' containing all processes.