qi-hardware/openwrt-xburst
1
0
Fork 0
mirror of git://projects.qi-hardware.com/openwrt-xburst.git synced 2024-12-12 06:28:25 +02:00
Code
6dcf547ef1
openwrt-xburst/openwrt/package/pipacs/src/parser.c

908 lines
30 KiB
C
Raw Normal View History

add pipacs package (thanks to Janos) git-svn-id: svn://svn.openwrt.org/openwrt/trunk@2865 3c298f89-4303-0410-b956-a3cf2f4a3e73
2006-01-09 17:46:03 +02:00
#include <stdio.h>
#include <stdlib.h>
#include<string.h>
#include <time.h>
//#include <process.h>
#include "parser.h"
#define printit
extern BOOL bFilter;
extern int iline;
extern char * author;
extern char myipname[];
extern int justheader;
extern int gre,sortbysize,fromip,toip;
int nomac=1;
int mostird=0;
char mypbuff[2048];
// accounting variables
#define MAXHASH 0xffff
#define MAXTCPPORT 4096
unsigned long *iph=NULL; //[MAXHASH];
typedef struct {
unsigned short from;
unsigned short to;
unsigned long byte;
unsigned short pkt;
unsigned short sport;
unsigned short dport;
} ta;
ta *acc = NULL;
unsigned long tcppb[MAXTCPPORT];
unsigned long tcppp[MAXTCPPORT];
unsigned long typp[255];
unsigned long typb[255];
unsigned long udpb,tcpb,udpp,tcpp;
time_t elapsed=0;
int iCycle=10;
int iScreen=1;
int iFile=0;
long lNum=0;
char filename[128];
char intlist[128];
int iRun=1;
int iDetail=0;
FILE *f=NULL;
int iProto=0;
int iSum=0;
char execname[255];
char pbuf[8196];
char str[255];
extern char pattern[];
#ifndef LINUX
int iLnxplus=0; // Windows buffer without the MAC frame !
#else
int iLnxplus=14; // Linux plus IP header len =14 !!!
#endif
//
// A list of protocol types in the IP protocol header
//
char *szProto[255] = {"IP", // 0
"ICMP", // 1
"IGMP", // 2
"GGP", // 3
"IP", // 4
"ST", // 5
"TCP", // 6
"UCL", // 7
"EGP", // 8
"IGP", // 9
"BBN-RCC-MON", // 10
"NVP-II", // 11
"PUP", // 12
"ARGUS", // 13
"EMCON", // 14
"XNET", // 15
"CHAOS", // 16
"UDP", // 17
"MUX", // 18
"DCN-MEAS", // 19
"HMP", // 20
"PRM", // 21
"XNS-IDP", // 22
"TRUNK-1", // 23
"TRUNK-2", // 24
"LEAF-1", // 25
"LEAF-2", // 26
"RDP", // 27
"IRTP", // 28
"ISO-TP4", // 29
"NETBLT", // 30
"MFE-NSP", // 31
"MERIT-INP", // 32
"SEP", // 33
"3PC", // 34
"IDPR", // 35
"XTP", // 36
"DDP", // 37
"IDPR-CMTP", // 38
"TP++", // 39
"IL", // 40
"SIP", // 41
"SDRP", // 42
"SIP-SR", // 43
"SIP-FRAG", // 44
"IDRP", // 45
"RSVP", // 46
"GRE", // 47
"MHRP", // 48
"BNA", // 49
"IPSEC-ESP", // 50
"IPSEC-AH", // 51
"I-NLSP", // 52
"SWIPE", // 53
"NHRP", // 54
"?55?", // 55
"?56?", // 56
"SKIO", // 57
"V6ICMP", // 58
"V6NoNXT", // 59
"V6OPT", // 60
"int.host", // 61
"CFTP", // 62
"loc.net", // 63
"SAT-EXPAK", // 64
"KRYPTOLAN", // 65
"RVD", // 66
"IPPC", // 67
"dist.fs", // 68
"SAT-MON", // 69
"VISA", // 70
"IPCV", // 71
"CPNX", // 72
"CPHB", // 73
"WSN", // 74
"PVP", // 75
"BR-SAT-MON", // 76
"SUN-ND", // 77
"WB-MON", // 78
"WB-EXPAK", // 79
"ISO-IP", // 80
"VMTP", // 81
"SECURE-VMTP",// 82
"VINES", // 83
"TTP", // 84
"NSFNET-IGP", // 85
"DGP", // 86
"TCF", // 87
"IGRP", // 88
"OSPF", // 89
"Sprite-RPC", // 90
"LARP", // 91
"MTP", // 92
"AX.25", // 93
"IPIP", // 94
"MICP", // 95
"SCC-SP", // 96
"ETHERIP", // 97
"ENCAP", // 98
"priv.enc", // 99
"GMTP" // 99
};
//
// The types of IGMP messages
//
char *szIgmpType[] = {"",
"Host Membership Query",
"HOst Membership Report",
"",
"",
"",
"Version 2 Membership Report",
"Leave Group",
"",
""
};
//
// Function: PrintRawBytes
//
// Description:
// This function simply prints out a series of bytes
// as hexadecimal digits.
//
void PrintRawBytes(BYTE *ptr, DWORD len)
{
int i,j;
// if (! iFile) {
*(ptr+len)=0;
if ((*pattern==0) || strstr(ptr,pattern) ) {
fprintf(iFile?f:stdout,"%s",pbuf);
fprintf(iFile?f:stdout," " );
while (len > 0) {
for(i=0; i < 16; i++) {
fprintf(iFile?f:stdout,"%x%x ", HI_WORD(*ptr), LO_WORD(*ptr));
len--;
ptr++;
if (len == 0) {j=i++; while(++j < 16) fprintf(iFile?f:stdout," "); break; }
}
fprintf(iFile?f:stdout," ");
for(j=0; j < i; j++) fprintf(iFile?f:stdout,"%c",isprint(*(ptr-i+j))?*(ptr-i+j):'.');
if (len) fprintf(iFile?f:stdout,"\n ");
}
// } else {
// fwrite(ptr,sizeof(BYTE),len,f);
// }
}
}
static char *ICMPTypeTable[]={
"Echo Reply", "ICMP 1", "ICMP 2", "Dest Unreachable","SrcQuench", "Redirect", "6", "7","Echo Request","9","10",
"Time Exceed", "ParamPrblm", "Timestamp", "Timestamp reply","InfoRqst", "InfoRply"
};
static char *Dstunreach[]={
"net unreach.","host unreach.","protocol unreach.","port unreach.",
"frag needed","source route?","",""
};
int DecodeICMPHeader(WSABUF *wsabuf, DWORD iphdrlen) {
BYTE *hdr = (BYTE *)((BYTE *)wsabuf->buf + iphdrlen + iLnxplus );
unsigned short type,code,chksum,
id,
seq;
unsigned long resptime,r1,r2;
BYTE *hhh;
SOCKADDR_IN addr;
type=*hdr++; code=*hdr++;
sprintf(str," Type:%-12s Code:%3d,",ICMPTypeTable[type],code);
strcat(pbuf,str);
memcpy(&chksum, hdr, 2);
hdr += 2; hhh=hdr;
memcpy(&id, hdr, 2);
hdr += 2;
memcpy(&seq, hdr, 2);
hdr+=2;
// memcpy(&resptime, hdr, 4);
// hdr+=4;
switch (type) {
case 3:
memcpy(&addr.sin_addr.s_addr, hdr+16, 4);
if (code==4 ) sprintf(str,"frag needed-Max MTU:%u at %-15s\n",ntohs(seq), inet_ntoa(addr.sin_addr));
else sprintf(str,"%s at %-15s\n",Dstunreach[code&7],inet_ntoa(addr.sin_addr));
hdr+=iphdrlen;
break;
case 11:
memcpy(&addr.sin_addr.s_addr, hdr+16, 4);
sprintf(str,"%s at %-15s\n",code?"frag reass. exceed":"ttl exceed",inet_ntoa(addr.sin_addr));
hdr+=iphdrlen;
break;
case 12:
memcpy(&addr.sin_addr.s_addr, hdr+16, 4);
sprintf(str," err:%d at %-15s\n",id,inet_ntoa(addr.sin_addr));
hdr+=iphdrlen;
break;
case 4:
memcpy(&addr.sin_addr.s_addr, hdr+16, 4);
sprintf(str," wait for %-15s\n",ntohs(id),inet_ntoa(addr.sin_addr));
hdr+=iphdrlen;
break;
case 5:
memcpy(&addr.sin_addr.s_addr, hhh, 4);
sprintf(str," from gw: %-15s\n",inet_ntoa(addr.sin_addr));
hdr+=iphdrlen;
break;
case 0:
case 8:
sprintf(str," Id:%3u Seq:%3u\n",ntohs(id),ntohs(seq));
break;
case 13:
case 14:
memcpy(&resptime, hdr, 4);
hdr+=4;
memcpy(&r1, hdr, 4);
hdr+=4;
memcpy(&r2, hdr, 4);
hdr+=4;
sprintf(str," Id:%3u Seq:%3d Rec/Tr %ld/%ld ms\n",ntohs(id),ntohs(seq),ntohl(r1)-ntohl(resptime),ntohl(r2)-ntohl(resptime));
break;
case 15:
case 16:
sprintf(str," Id:%3u Seq:%3d\n",ntohs(id),ntohs(seq));
break;
}
strcat(pbuf,str);
return hdr-(BYTE *)(wsabuf->buf + iphdrlen + iLnxplus);
}
//
// Function: DecodeIGMPHeader
//
// Description:
// This function takes a pointer to a buffer containing
// an IGMP packet and prints it out in a readable form.
//
int DecodeIGMPHeader(WSABUF *wsabuf, DWORD iphdrlen) {
BYTE *hdr = (BYTE *)((BYTE *)wsabuf->buf + iphdrlen + iLnxplus);
unsigned short chksum,
version,
type,
maxresptime;
SOCKADDR_IN addr;
version = HI_WORD(*hdr);
type = LO_WORD(*hdr);
hdr++;
maxresptime = *hdr;
hdr++;
memcpy(&chksum, hdr, 2);
chksum = ntohs(chksum);
hdr += 2;
memcpy(&(addr.sin_addr.s_addr), hdr, 4);
sprintf(str," IGMP HEADER:\n");
strcat(pbuf,str);
if ((type == 1) || (type == 2)) version = 1;
else version = 2;
sprintf(str," IGMP Version = %d\n IGMP Type = %s\n",version, szIgmpType[type]);
strcat(pbuf,str);
if (version == 2) {
sprintf(str," Max Resp Time = %d\n", maxresptime);
strcat(pbuf,str);
}
sprintf(str," IGMP Grp Addr = %s\n", inet_ntoa(addr.sin_addr));
strcat(pbuf,str);
return 8;
}
//
// Function: DecodeUDPHeader
//
// Description:
// This function takes a buffer which points to a UDP
// header and prints it out in a readable form.
//
int DecodeUDPHeader(WSABUF *wsabuf, DWORD iphdrlen) {
BYTE *hdr = (BYTE *)((BYTE *)wsabuf->buf + iphdrlen + iLnxplus);
unsigned short shortval,
udp_src_port,
udp_dest_port,
udp_len,
udp_chksum;
memcpy(&shortval, hdr, 2);
udp_src_port = ntohs(shortval);
hdr += 2;
memcpy(&shortval, hdr, 2);
udp_dest_port = ntohs(shortval);
hdr += 2;
memcpy(&shortval, hdr, 2);
udp_len = ntohs(shortval);
hdr += 2;
memcpy(&shortval, hdr, 2);
udp_chksum = ntohs(shortval);
hdr += 2;
sprintf(str," UDP: SPort: %-05d | DPort: %-05d",udp_src_port, udp_dest_port);
strcat(pbuf,str);
sprintf(str," | Len: %-05d | CSum: 0x%08x\n",udp_len, udp_chksum);
strcat(pbuf,str);
return hdr-(BYTE *)(wsabuf->buf + iphdrlen + iLnxplus);
}
//
// Function: DecodeTCPHeader
//
// Description:
// This function takes a buffer pointing to a TCP header
// and prints it out in a readable form.
//
int DecodeTCPHeader(WSABUF *wsabuf, DWORD iphdrlen) {
BYTE *hdr = (BYTE *)((BYTE *)wsabuf->buf + iphdrlen + iLnxplus);
unsigned short shortval;
unsigned long longval;
memcpy(&shortval, hdr, 2);
shortval = ntohs(shortval);
sprintf(str," TCP: SPort: %u", shortval);
strcat(pbuf,str);
hdr += 2;
memcpy(&shortval, hdr, 2);
shortval = ntohs(shortval);
sprintf(str," DPort: %u", shortval);
strcat(pbuf,str);
hdr += 2;
memcpy(&longval, hdr, 4);
longval = ntohl(longval);
sprintf(str," Seq: %lX", longval);
strcat(pbuf,str);
hdr += 4;
memcpy(&longval, hdr, 4);
longval = ntohl(longval);
sprintf(str," ACK: %lX", longval);
strcat(pbuf,str);
hdr += 4;
// printf(" Header Len : %d (bytes %d)\n", HI_WORD(*hdr), (HI_WORD(*hdr) * 4));
memcpy(&shortval, hdr, 2);
shortval = ntohs(shortval) & 0x3F;
sprintf(str," Flags: ");
strcat(pbuf,str);
if (shortval & 0x20) strcat(pbuf,"URG ");
if (shortval & 0x10) strcat(pbuf,"ACK ");
if (shortval & 0x08) strcat(pbuf,"PSH ");
if (shortval & 0x04) strcat(pbuf,"RST ");
if (shortval & 0x02) strcat(pbuf,"SYN ");
if (shortval & 0x01) strcat(pbuf,"FIN ");
strcat(pbuf,"\n");
hdr += 2;
memcpy(&shortval, hdr, 2);
shortval = ntohs(shortval);
// printf(" Window size: %d\n", shortval);
hdr += 2;
memcpy(&shortval, hdr, 2);
shortval = ntohs(shortval);
// printf(" TCP Chksum : %d\n", shortval);
hdr += 2;
memcpy(&shortval, hdr, 2);
shortval = ntohs(shortval);
hdr += 2;
// printf(" Urgent ptr : %d\n", shortval);
return hdr-(BYTE *)(wsabuf->buf + iphdrlen + iLnxplus);
}
int DecodeGREHeader(WSABUF *wsabuf, DWORD iphdrlen,DWORD bytesret,
unsigned int srcip, unsigned short srcport, unsigned long srcnet,unsigned int destip, unsigned short destport, unsigned long destnet,
unsigned short xport,unsigned int xip, unsigned long xnet)
{
BYTE *hdr = (BYTE *)((BYTE *)wsabuf->buf + iphdrlen + iLnxplus);
unsigned short shortval;
unsigned long longval;
int ipe;
BYTE *orihdr;
char *sstr;
SOCKADDR_IN srcaddr;
orihdr=hdr;
memcpy(&shortval, hdr, 2);
shortval = ntohs(shortval);
sprintf(str," GRE Flag: %u Prot:", shortval);
strcat(mypbuff,str);
hdr += 2;
memcpy(&shortval, hdr, 2);
shortval = ntohs(shortval);
ipe=0;
sstr=str;
// sprintf(str," Prot: %u", shortval);
switch ( shortval ) {
case 4: sstr="SNA";
break;
case 0xfe: sstr="OSI";
break;
case 0x200: sstr="PUP";
break;
case 0x600: sstr="XNS";
break;
case 0x800: sstr="IP";
ipe=1;
break;
case 0x804: sstr="Chaos";
break;
case 0x806: sstr="ARP";
break;
case 0x6558: sstr="Tr.bridge";
break;
default: sprintf(str,"%u", shortval);
break;
}
hdr += 2;
strcat(mypbuff,sstr);
if (ipe && gre) {
int plusment,jj,protoment;
plusment=iLnxplus;
protoment=iProto;
if (iProto==47) iProto=0;
iLnxplus+=4;
nomac=0;
iLnxplus=plusment+24;
DecodeIPHeader(wsabuf,srcip,srcport,srcnet,destip,destport,destnet,bytesret,xport,xip,xnet);
nomac=1;
iLnxplus=plusment;
iProto=protoment;
}
return -1;
// return hdr-(BYTE *)(wsabuf->buf + iphdrlen + iLnxplus);
}
int ClearIPAcc() {
unsigned long i;
ta *tai;
for(i=0;i<MAXHASH;i++) *(iph + i)=0;
tai=acc;
for(i=0;i<MAXHASH;i++) { tai->from=tai->to=0; tai++; }
for (i=0;i<MAXTCPPORT; i++) tcppb[i]=tcppp[i]=0;
udpb=udpp=tcpp=tcpb=0;
for (i=0;i<255; i++) typp[i]=0;
for (i=0;i<255; i++) typb[i]=0;
return 0;
};
int InitIPAcc() {
acc=malloc(MAXHASH*sizeof(ta));
iph=malloc(MAXHASH*sizeof(long));
if (!acc || !iph ) return 0;
ClearIPAcc();
time(&elapsed);
return 1;
}
int bytesort(const void *s1, const void *s2) { // sorting tale in byte order
ta *d1;
ta *d2;
d1= (ta *)s1; d2=(ta *)s2;
if (d1->byte > d2->byte) return -1;
if (d1->byte < d2->byte) return 1;
return 0;
}
int countsort(const void *s1, const void *s2) { // sorting tale in packet count order
ta *d1;
ta *d2;
d1= (ta *)s1; d2=(ta *)s2;
if (d1->pkt > d2->pkt) return -1;
if (d1->pkt < d2->pkt) return 1;
return 0;
}
int CloseIPAcc( long ti) {
unsigned long i;
ta *tai;
SOCKADDR_IN srcaddr;
SOCKADDR_IN dstaddr;
float ff;
char str[16];
unsigned long j,k,l;
int lin=0;
int linn;
time(&elapsed);
if (iFile) f=fopen(filename,"w+");
k=0;
if (sortbysize) qsort(acc,MAXHASH,sizeof(ta),bytesort);
else qsort(acc,MAXHASH,sizeof(ta),countsort);
ff=0.0;
for (i=0;i<255;i++) ff+=typb[i];
for (i=0; i<MAXHASH; i++) {
tai=acc + i;
if ((tai->from!=0) && (tai->to!=0)) ++k;
}
if (iScreen) {
#ifndef LINUX
system("cls");
#else
system("clear");
// printf("\033[1~");
#endif
printf("%-16s Speed: %5.2f Kbit/s , %ld IP pairs / %ld secs. %s@%s.hu",myipname,ff/ti/1024*8,k,ti,author,author);
printf("\nProt:"); j=0; ++lin;
while (1) {
l=k=0;
for (i=0;i<100;i++) if ( typb[i]>k) { k=typb[i]; l=i; }
if (k==0) break;
if ((j>0) && ((j%3)==0)) { printf("\n "); ++lin; }
if (k>1024*1024) printf(" %-8.8s:%5.1fk/%-6.1f M",szProto[l],(float)typp[l]/1024,(float)k/(1024*1024));
else if (k>1024) printf(" %-8.8s:%5ld/%-6.1f k",szProto[l],typp[l],(float)k/1024);
else printf(" %-8.8s:%5ld/%-8ld",szProto[l],typp[l],k);
typb[l]=0;
++j;
}
printf("\nPort:"); j=0; ++lin;
k=0; linn=lin;
while (1) {
l=k=0;
for (i=0;i<MAXTCPPORT;i++) if (tcppb[i]>k) { k=tcppb[i]; l=i; }
if (k==0) break;
if (j && (j%4)==0) {
if (lin >= linn+1) break;
printf("\n ");
++lin;
}
if (k>1024*1024) printf(" %04d:%4.1fk/%-5.1f M",l,(float)tcppp[l]/1024,(float)k/(1024*1024));
else if (k>1024) printf(" %04d:%4ld/%-5.1f k",l,tcppp[l],(float)k/1024);
else printf(" %04d:%4ld/%-7ld",l,tcppp[l],k);
tcppb[l]=0;
++j;
}
} else if (f) {
fprintf(f,"%-16s Speed: %5.2f Kbit/s , %ld IP pairs / %ld secs. %s@%s.hu",myipname,ff/ti/1024*8,k,ti,author,author);
fprintf(f,"\nProt:"); j=0;
while (1) {
l=k=0;
for (i=0;i<100;i++) if ( typb[i]>k) { k=typb[i]; l=i; }
if (k==0) break;
if (k>1024*1024) fprintf(f," %-8.8s:%5.1fk/%-6.1f M",szProto[l],(float)typp[l]/1024,(float)k/(1024*1024));
else if (k>1024) fprintf(f," %-8.8s:%5ld/%-6.1f k",szProto[l],typp[l],(float)k/1024);
else fprintf(f," %-8.8s:%5ld/%-8ld",szProto[l],typp[l],k);
typb[l]=0;
++j;
}
printf("\nPort:"); j=0;
k=0; linn=lin;
while (1) {
l=k=0;
for (i=0;i<MAXTCPPORT;i++) if (tcppb[i]>k) { k=tcppb[i]; l=i; }
if (k==0) break;
if (k>1024*1024) fprintf(f," %04d:%4.1fk/%-5.1f M",l,(float)tcppp[l]/1024,(float)k/(1024*1024));
else if (k>1024) fprintf(f," %04d:%4ld/%-5.1f k",l,tcppp[l],(float)k/1024);
else fprintf(f," %04d:%4ld/%-7ld",l,tcppp[l],k);
tcppb[l]=0;
++j;
}
}
for (i=0; i<MAXHASH; i++) {
tai=acc + i;
if ((tai->from!=0) && (tai->to!=0)) { ++k;
if (!iSum) {
dstaddr.sin_addr.s_addr = htonl(*(iph+tai->from));
srcaddr.sin_addr.s_addr = htonl(*(iph+(tai->to)));
strcpy(str,inet_ntoa(dstaddr.sin_addr));
if (iScreen && (++lin<iline) ) printf("\n%-15s\t%-15s\t%5d pkt, %10ld byte :%7.2f Kbps",str,inet_ntoa(srcaddr.sin_addr),tai->pkt,tai->byte,((float)tai->byte)/ti/1024*8);
if (f) fprintf(f,"%-15s\t%-15s\t%d\t%ld\n",str,inet_ntoa(srcaddr.sin_addr),tai->pkt,tai->byte);
}
}
}
if (iScreen) printf("\n");
#ifdef LINUX
if (iScreen) fflush(stdout);
#endif
ClearIPAcc();
if (f) {
char cmdline[255];
fclose(f);
// if (*execname) _spawnle(_P_NOWAIT,execname,execname,filename);
// if (*execname) _execl(execname,execname);
if (*execname) {
#ifndef LINUX
sprintf(cmdline,"%s %s",execname,filename);
#else
sprintf(cmdline,"%s %s",execname,filename);
#endif
system(cmdline);
// iRun=0;
}
}
f=NULL;
return 0;
}
unsigned short FindIPHash( unsigned long ip ) {
unsigned short hashval;
unsigned long *ipt;
hashval = (unsigned short)(((ip&0xFFFF0000)>>16) ^ (ip&0x0000FFFF));
ipt=iph + hashval;
while (*ipt != 0 && (*ipt!=ip)) { ipt++; hashval++; }
if (*ipt==0) *ipt=ip;
return hashval;
}
unsigned short SetIPAcc( unsigned long src, unsigned long dst, unsigned long byte, unsigned short typ, unsigned short sport, unsigned short dport) {
unsigned short from,to,hash;
ta *tai;
hash=0;
if (src) {
if (fromip) from=FindIPHash(src); else from=-1;
if (toip) to=FindIPHash(dst); else to=-1;
hash=from^to;
tai=acc + hash;
while ( ((tai->from!=from) && (tai->to!=to)) && ((tai->from!=0) && (tai->to!=0)) ) {tai++; hash++; }
if ((tai->from==0)&&(tai->to==0)) {
tai->byte=byte; tai->from=from; tai->to=to; tai->pkt=1;
} else { tai->byte+=byte; tai->pkt++; }
typp[typ]++;
typb[typ]+=byte;
if ((sport>0) && (sport<MAXTCPPORT)) { tcppp[sport]++; tcppb[sport]+=byte; }
if ((dport>0) && (dport<MAXTCPPORT)) { tcppp[dport]++; tcppb[dport]+=byte; }
}
return hash;
}
//
// Function: DecodeIPHeader
//
// Description:
// This function takes a pointer to an IP header and prints
// it out in a readable form.
//
int DecodeIPHeader(WSABUF *wsabuf, unsigned int srcip, unsigned short srcport, unsigned long srcnet,
unsigned int destip, unsigned short destport, unsigned long destnet, DWORD bytesret,
unsigned short xport,unsigned int xip, unsigned long xnet)
{
BYTE *hdr = (BYTE *)wsabuf->buf,
*nexthdr = NULL,
*ohdr;
unsigned short shortval;
SOCKADDR_IN srcaddr,
destaddr;
unsigned short ip_version,
ip_hdr_len,
ip_tos,
ip_total_len,
ip_id,
ip_flags,
ip_ttl,
ip_frag_offset,
ip_proto,
ip_hdr_chksum,
ip_src_port,
ip_dest_port;
unsigned int ip_src,
ip_dest;
BOOL bPrint = FALSE;
char ip_prtype=0;
int j;
time_t tt;
struct tm *tmm;
ohdr=hdr;
if (iLnxplus) ip_prtype=*(hdr+iLnxplus-1);
if (ip_prtype) return 0;
hdr += iLnxplus;
ip_version = HI_WORD(*hdr);
ip_hdr_len = LO_WORD(*hdr) * 4;
nexthdr = (BYTE *)((BYTE *)hdr + ip_hdr_len);
hdr++;
ip_tos = *hdr;
hdr++;
memcpy(&shortval, hdr, 2);
ip_total_len = ntohs(shortval);
hdr += 2;
memcpy(&shortval, hdr, 2);
ip_id = ntohs(shortval);
hdr += 2;
ip_flags = ((*hdr) >> 5);
memcpy(&shortval, hdr, 2);
ip_frag_offset = ((ntohs(shortval)) & 0x1FFF);
hdr += 2;
ip_ttl = *hdr;
hdr++;
ip_proto = *hdr;
hdr++;
memcpy(&shortval, hdr, 2);
ip_hdr_chksum = ntohs(shortval);
hdr += 2;
memcpy(&srcaddr.sin_addr.s_addr, hdr, 4);
ip_src = ntohl(srcaddr.sin_addr.s_addr);
hdr += 4;
memcpy(&destaddr.sin_addr.s_addr, hdr, 4);
ip_dest = ntohl(destaddr.sin_addr.s_addr);
hdr += 4;
//
// If packet is UDP, TCP, or IGMP read ahead and
// get the port values.
//
ip_src_port=ip_dest_port=0;
if (((ip_proto == 2) ||
(ip_proto == 6) ||
(ip_proto == 17)) ) //&& bFilter)
{
memcpy(&ip_src_port, nexthdr, 2);
ip_src_port = ntohs(ip_src_port);
memcpy(&ip_dest_port, nexthdr+2, 2);
ip_dest_port = ntohs(ip_dest_port);
};
bPrint = 0;
// xaok= (xip!=0) && (((xip&xnet)==(ip_src&xnet))||((xip&xnet)==(ip_dest&xnet)));
// saok= ((srcip==0)||((srcip&srcnet)==(ip_src&srcnet)));
// daok = ((destip==0)||((destip&destnet)==(ip_dest&destnet)));
// xpok=(xport!=0) && ((xport==ip_src_port)||(xport==ip_dest_port));
// spok=((srcport==0)||(srcport == ip_src_port));
// dpok=((destport==0)||(destport == ip_dest_port));
//printf("\nf:%d xa:%d sa:%d da:%d xp:%d sp:%d dp:%d",bFilter,xaok,saok,daok,xpok,spok,dpok);
// if (!bFilter || ( (xaok||(saok&&daok)) && (xpok||(spok&&dpok)))) {
if ((!bFilter) || ((ip_proto==47)&&gre) ||
(
((iProto==0)||(ip_proto==iProto)) &&
(
((xip!=0) && (((xip&xnet)==(ip_src&xnet))||((xip&xnet)==(ip_dest&xnet)))
) || (
((srcip==0) || ((srcip&srcnet)==(ip_src&srcnet))) && ((destip==0)||((destip&destnet)==(ip_dest&destnet)))
)
)
&&
(
((xport!=0) && ((xport==ip_src_port)||(xport==ip_dest_port))
) || (
((srcport==0)||(srcport == ip_src_port))&&((destport==0)||(destport == ip_dest_port))
)
)
)
) {
if (! iDetail) {
if ((ip_proto==47)&&gre) {
*mypbuff=0;
DecodeGREHeader(wsabuf, ip_hdr_len, bytesret,
srcip,srcport,srcnet,destip,destport,destnet,xport,xip,xnet);
// SetIPAcc(0,0,0,0,0,0);
return ip_hdr_len;
}
SetIPAcc(ip_src,ip_dest,ip_total_len,ip_proto,ip_src_port,ip_dest_port);
}
else bPrint=TRUE;
// printf("%d %ld %ld %ld %ld",ip_proto,xip,xip&xnet,ip_src&xnet,ip_dest&xnet);
} else {
if (! iDetail) SetIPAcc(0,0,0,0,0,0);
// else bPrint=TRUE;
}
time(&tt);
if ((!iSum && ( tt-elapsed > iCycle)) || !iRun || mostird) {
mostird=0;
if (! iDetail) CloseIPAcc(tt-elapsed-1);
else {
time(&elapsed);
if (f) fclose(f);
if (iFile) f=fopen(filename,"a");
}
}
if (lNum) { if (--lNum <= 0) iRun=0; }
//
*pbuf=0;
if (bPrint) {
tmm=localtime(&tt);
if (! nomac ) {
strcpy(pbuf,mypbuff);
} else {
sprintf(str,"\n%4.4d.%2.2d.%2.2d %2.2d:%2.2d:%2.2d ",
tmm->tm_year+1900,tmm->tm_mon+1,tmm->tm_mday,tmm->tm_hour,tmm->tm_min,tmm->tm_sec);
strcat(pbuf,str);
#ifdef LINUX
sprintf(str,"%x:%x:%x:%x:%x:%x > %x:%x:%x:%x:%x:%x",*ohdr,*(ohdr+1),*(ohdr+2),*(ohdr+3),*(ohdr+4),*(ohdr+5),
*(ohdr+6),*(ohdr+7),*(ohdr+8),*(ohdr+9),*(ohdr+10),*(ohdr+11));
strcat(pbuf,str);
#endif
}
sprintf(str," %d bytes\n%-15s>", ip_total_len, inet_ntoa(srcaddr.sin_addr));
strcat(pbuf,str);
sprintf(str,"%-15s", inet_ntoa(destaddr.sin_addr));
strcat(pbuf,str);
sprintf(str," TTL:%-3d Proto:%-6s F:%d/%d TOS:%X%X\n",
ip_ttl, szProto[ip_proto],ip_flags,ip_frag_offset,HI_WORD(ip_tos), LO_WORD(ip_tos));
strcat(pbuf,str);
if (iFile) strcat(pbuf,".");
strcpy(mypbuff,pbuf);
}
else return ip_hdr_len;
if (justheader) { if (*pbuf) fprintf(iFile?f:stdout,"%s",pbuf); return ip_hdr_len; }
if (iDetail) {
switch (ip_proto) {
case 1: // ICMP
j=DecodeICMPHeader(wsabuf, ip_hdr_len);
break;
case 2: // IGMP
j=DecodeIGMPHeader(wsabuf, ip_hdr_len);
break;
case 6: // TCP
j=DecodeTCPHeader(wsabuf, ip_hdr_len);
break;
case 17: // UDP
j=DecodeUDPHeader(wsabuf, ip_hdr_len);
break;
case 47: // UDP
j=DecodeGREHeader(wsabuf, ip_hdr_len, bytesret,
srcip,srcport,srcnet,destip,destport,destnet,xport,xip,xnet);
break;
default:
j=0; hdr=(BYTE *)wsabuf->buf;
sprintf(str," No decoder installed for protocol\n");
strcat(pbuf,str);
break;
}
if (j>=0) PrintRawBytes(hdr+j,bytesret-j-ip_hdr_len-12); //(hdr-(BYTE *)(wsabuf->buf + iLnxplus)));
}
else if (*pbuf) fprintf(iFile?f:stdout,"%s",pbuf);
return ip_hdr_len;
}
Copy Permalink