Map Structure not Recognizing Repeat Keys

[sph147]

I'm using a bunch of layed maps to try and store information about some network traffic in a packet sniffing application. For example if I have 4 packets going from 192.1.1.1 from port 1 to 255.255.255.255 port 2 the structure should store the IPs and Ports as Keys and the data should be the frequency

[192.1.1.1, [ 1, [ 255.255.255.255, [ 2 , 4]]]]

would be a good representation of how it should be stored.
Yet when I look at the data, I'll get the same IP's and ports 4 times all with a last field (the number of packets) as 1. I'm not sure if its not recognizing the old keys or what is going wrong. Here is a sample of some of the code.

definition of the map
map <u_char*, map<int, map<u_char*, map<int, int> > > > total_map;

storing to the map
hbkt.total_map[inip][inport][outip][outport] = hbkt.total_map[inip][inport][outip][outport] + 1;

If anyone has any ideas that'd be great. I'm not sure if I'm using the map wrong or if its my logic. Or even if someone has a better idea for storing all this information. Thanks alot, always appreciated.

 

[PerFnurt]

If you use u_char* as key the map won't make any string comparisons when it fiddles with its items, but address comparisons instead.

const char* foo1 = "Foo";
const char* foo2 = "Foo";
// foo1 != foo2

Use std::string or std::wstring as key type instead.



/Per
[sub]
www.perfnurt.se[/sub]

 

[IonelBurtan]

or you can overload the == and != operators for const char*(u_char*) comparison and use the existing code.

HTH

s-)

Blessed is he who in the name of justice and goodwill, sheperds the weak through the valley of darkness...

http://www20.brinkster.com/ionelb

 

[IonelBurtan]

sorry about the above post. I forgot that the compiler does not allow operator overloading for simple types.
For example the MS VC++ compiler will complain with this error:

error C2803: 'operator ==' must have at least one formal parameter of class type

therefore you must wraap everything in some container. wstring or string from std are ok, as PerFnurt says.

s-)

Blessed is he who in the name of justice and goodwill, sheperds the weak through the valley of darkness...

http://www20.brinkster.com/ionelb

 

[uolj]

I would think string/wstring is the best choice. However, you could write your won comparison function for u_char* and add it to the type of the map that uses it for a key.

By the way, I would use

++(hbkt.total_map[inip][inport][outip][outport]); // or
hbkt.total_map[inip][inport][outip][outport] += 1;

to increment the value to avoid two sets of lookups.

 

[sph147]

Ok, I see what everyone is saying. So I'm converting about a million things over to using strings now, but I still have to retrieve information in u_char* form. Any easy way to put the info in a u_char* to a string?

 

[PerFnurt]

Any reason you're using u_char rather than regular char?

char* foo = "foo";
std::string sFoo = foo; // char* to std::string

/Per
[sub]
www.perfnurt.se[/sub]