+++ /dev/null
-#include <stdio.h>
-#include <stdlib.h>
-#include<string.h>
-#include <time.h>
-//#include <process.h>
-#include "parser.h"
-
-#define printit
-
-extern BOOL bFilter;
-extern int iline;
-extern char * author;
-extern char myipname[];
-extern int justheader;
-extern int gre,sortbysize,fromip,toip;
-int nomac=1;
-int mostird=0;
-char mypbuff[2048];
-// accounting variables
-#define MAXHASH 0xffff
-#define MAXTCPPORT 4096
-unsigned long *iph=NULL; //[MAXHASH];
-
-typedef struct {
- unsigned short from;
- unsigned short to;
- unsigned long byte;
- unsigned short pkt;
- unsigned short sport;
- unsigned short dport;
-} ta;
-
-ta *acc = NULL;
-unsigned long tcppb[MAXTCPPORT];
-unsigned long tcppp[MAXTCPPORT];
-unsigned long typp[255];
-unsigned long typb[255];
-unsigned long udpb,tcpb,udpp,tcpp;
-time_t elapsed=0;
-int iCycle=10;
-int iScreen=1;
-int iFile=0;
-long lNum=0;
-char filename[128];
-char intlist[128];
-int iRun=1;
-int iDetail=0;
-FILE *f=NULL;
-int iProto=0;
-int iSum=0;
-char execname[255];
-char pbuf[8196];
-char str[255];
-extern char pattern[];
-#ifndef LINUX
-int iLnxplus=0; // Windows buffer without the MAC frame !
-#else
-int iLnxplus=14; // Linux plus IP header len =14 !!!
-#endif
-//
-// A list of protocol types in the IP protocol header
-//
-char *szProto[255] = {"IP", // 0
- "ICMP", // 1
- "IGMP", // 2
- "GGP", // 3
- "IP", // 4
- "ST", // 5
- "TCP", // 6
- "UCL", // 7
- "EGP", // 8
- "IGP", // 9
- "BBN-RCC-MON", // 10
- "NVP-II", // 11
- "PUP", // 12
- "ARGUS", // 13
- "EMCON", // 14
- "XNET", // 15
- "CHAOS", // 16
- "UDP", // 17
- "MUX", // 18
- "DCN-MEAS", // 19
- "HMP", // 20
- "PRM", // 21
- "XNS-IDP", // 22
- "TRUNK-1", // 23
- "TRUNK-2", // 24
- "LEAF-1", // 25
- "LEAF-2", // 26
- "RDP", // 27
- "IRTP", // 28
- "ISO-TP4", // 29
- "NETBLT", // 30
- "MFE-NSP", // 31
- "MERIT-INP", // 32
- "SEP", // 33
- "3PC", // 34
- "IDPR", // 35
- "XTP", // 36
- "DDP", // 37
- "IDPR-CMTP", // 38
- "TP++", // 39
- "IL", // 40
- "SIP", // 41
- "SDRP", // 42
- "SIP-SR", // 43
- "SIP-FRAG", // 44
- "IDRP", // 45
- "RSVP", // 46
- "GRE", // 47
- "MHRP", // 48
- "BNA", // 49
- "IPSEC-ESP", // 50
- "IPSEC-AH", // 51
- "I-NLSP", // 52
- "SWIPE", // 53
- "NHRP", // 54
- "?55?", // 55
- "?56?", // 56
- "SKIO", // 57
- "V6ICMP", // 58
- "V6NoNXT", // 59
- "V6OPT", // 60
- "int.host", // 61
- "CFTP", // 62
- "loc.net", // 63
- "SAT-EXPAK", // 64
- "KRYPTOLAN", // 65
- "RVD", // 66
- "IPPC", // 67
- "dist.fs", // 68
- "SAT-MON", // 69
- "VISA", // 70
- "IPCV", // 71
- "CPNX", // 72
- "CPHB", // 73
- "WSN", // 74
- "PVP", // 75
- "BR-SAT-MON", // 76
- "SUN-ND", // 77
- "WB-MON", // 78
- "WB-EXPAK", // 79
- "ISO-IP", // 80
- "VMTP", // 81
- "SECURE-VMTP",// 82
- "VINES", // 83
- "TTP", // 84
- "NSFNET-IGP", // 85
- "DGP", // 86
- "TCF", // 87
- "IGRP", // 88
- "OSPF", // 89
- "Sprite-RPC", // 90
- "LARP", // 91
- "MTP", // 92
- "AX.25", // 93
- "IPIP", // 94
- "MICP", // 95
- "SCC-SP", // 96
- "ETHERIP", // 97
- "ENCAP", // 98
- "priv.enc", // 99
- "GMTP" // 99
- };
-//
-// The types of IGMP messages
-//
-char *szIgmpType[] = {"",
- "Host Membership Query",
- "HOst Membership Report",
- "",
- "",
- "",
- "Version 2 Membership Report",
- "Leave Group",
- "",
- ""
- };
-
-//
-// Function: PrintRawBytes
-//
-// Description:
-// This function simply prints out a series of bytes
-// as hexadecimal digits.
-//
-void PrintRawBytes(BYTE *ptr, DWORD len)
-{
- int i,j;
-// if (! iFile) {
-*(ptr+len)=0;
-if ((*pattern==0) || strstr(ptr,pattern) ) {
- fprintf(iFile?f:stdout,"%s",pbuf);
- fprintf(iFile?f:stdout," " );
- while (len > 0) {
- for(i=0; i < 16; i++) {
- fprintf(iFile?f:stdout,"%x%x ", HI_WORD(*ptr), LO_WORD(*ptr));
- len--;
- ptr++;
- if (len == 0) {j=i++; while(++j < 16) fprintf(iFile?f:stdout," "); break; }
- }
- fprintf(iFile?f:stdout," ");
- for(j=0; j < i; j++) fprintf(iFile?f:stdout,"%c",isprint(*(ptr-i+j))?*(ptr-i+j):'.');
- if (len) fprintf(iFile?f:stdout,"\n ");
- }
-// } else {
-// fwrite(ptr,sizeof(BYTE),len,f);
-// }
-}
-}
-
-static char *ICMPTypeTable[]={
- "Echo Reply", "ICMP 1", "ICMP 2", "Dest Unreachable","SrcQuench", "Redirect", "6", "7","Echo Request","9","10",
- "Time Exceed", "ParamPrblm", "Timestamp", "Timestamp reply","InfoRqst", "InfoRply"
-};
-static char *Dstunreach[]={
-"net unreach.","host unreach.","protocol unreach.","port unreach.",
-"frag needed","source route?","",""
-};
-int DecodeICMPHeader(WSABUF *wsabuf, DWORD iphdrlen) {
- BYTE *hdr = (BYTE *)((BYTE *)wsabuf->buf + iphdrlen + iLnxplus );
- unsigned short type,code,chksum,
- id,
- seq;
- unsigned long resptime,r1,r2;
- BYTE *hhh;
- SOCKADDR_IN addr;
- type=*hdr++; code=*hdr++;
- sprintf(str," Type:%-12s Code:%3d,",ICMPTypeTable[type],code);
-
- strcat(pbuf,str);
- memcpy(&chksum, hdr, 2);
- hdr += 2; hhh=hdr;
- memcpy(&id, hdr, 2);
- hdr += 2;
- memcpy(&seq, hdr, 2);
- hdr+=2;
-// memcpy(&resptime, hdr, 4);
-// hdr+=4;
- switch (type) {
- case 3:
- memcpy(&addr.sin_addr.s_addr, hdr+16, 4);
- if (code==4 ) sprintf(str,"frag needed-Max MTU:%u at %-15s\n",ntohs(seq), inet_ntoa(addr.sin_addr));
- else sprintf(str,"%s at %-15s\n",Dstunreach[code&7],inet_ntoa(addr.sin_addr));
- hdr+=iphdrlen;
- break;
- case 11:
- memcpy(&addr.sin_addr.s_addr, hdr+16, 4);
- sprintf(str,"%s at %-15s\n",code?"frag reass. exceed":"ttl exceed",inet_ntoa(addr.sin_addr));
- hdr+=iphdrlen;
- break;
- case 12:
- memcpy(&addr.sin_addr.s_addr, hdr+16, 4);
- sprintf(str," err:%d at %-15s\n",id,inet_ntoa(addr.sin_addr));
- hdr+=iphdrlen;
- break;
- case 4:
- memcpy(&addr.sin_addr.s_addr, hdr+16, 4);
- sprintf(str," wait for %-15s\n",ntohs(id),inet_ntoa(addr.sin_addr));
- hdr+=iphdrlen;
- break;
- case 5:
- memcpy(&addr.sin_addr.s_addr, hhh, 4);
- sprintf(str," from gw: %-15s\n",inet_ntoa(addr.sin_addr));
- hdr+=iphdrlen;
- break;
- case 0:
- case 8:
- sprintf(str," Id:%3u Seq:%3u\n",ntohs(id),ntohs(seq));
- break;
- case 13:
- case 14:
- memcpy(&resptime, hdr, 4);
- hdr+=4;
- memcpy(&r1, hdr, 4);
- hdr+=4;
- memcpy(&r2, hdr, 4);
- hdr+=4;
- sprintf(str," Id:%3u Seq:%3d Rec/Tr %ld/%ld ms\n",ntohs(id),ntohs(seq),ntohl(r1)-ntohl(resptime),ntohl(r2)-ntohl(resptime));
- break;
- case 15:
- case 16:
- sprintf(str," Id:%3u Seq:%3d\n",ntohs(id),ntohs(seq));
- break;
- }
- strcat(pbuf,str);
- return hdr-(BYTE *)(wsabuf->buf + iphdrlen + iLnxplus);
-}
-
-//
-// Function: DecodeIGMPHeader
-//
-// Description:
-// This function takes a pointer to a buffer containing
-// an IGMP packet and prints it out in a readable form.
-//
-
-int DecodeIGMPHeader(WSABUF *wsabuf, DWORD iphdrlen) {
- BYTE *hdr = (BYTE *)((BYTE *)wsabuf->buf + iphdrlen + iLnxplus);
- unsigned short chksum,
- version,
- type,
- maxresptime;
- SOCKADDR_IN addr;
- version = HI_WORD(*hdr);
- type = LO_WORD(*hdr);
-
- hdr++;
- maxresptime = *hdr;
- hdr++;
-
- memcpy(&chksum, hdr, 2);
- chksum = ntohs(chksum);
- hdr += 2;
-
- memcpy(&(addr.sin_addr.s_addr), hdr, 4);
- sprintf(str," IGMP HEADER:\n");
- strcat(pbuf,str);
- if ((type == 1) || (type == 2)) version = 1;
- else version = 2;
- sprintf(str," IGMP Version = %d\n IGMP Type = %s\n",version, szIgmpType[type]);
- strcat(pbuf,str);
- if (version == 2) {
- sprintf(str," Max Resp Time = %d\n", maxresptime);
- strcat(pbuf,str);
- }
- sprintf(str," IGMP Grp Addr = %s\n", inet_ntoa(addr.sin_addr));
- strcat(pbuf,str);
-
- return 8;
-}
-
-//
-// Function: DecodeUDPHeader
-//
-// Description:
-// This function takes a buffer which points to a UDP
-// header and prints it out in a readable form.
-//
-int DecodeUDPHeader(WSABUF *wsabuf, DWORD iphdrlen) {
- BYTE *hdr = (BYTE *)((BYTE *)wsabuf->buf + iphdrlen + iLnxplus);
- unsigned short shortval,
- udp_src_port,
- udp_dest_port,
- udp_len,
- udp_chksum;
- memcpy(&shortval, hdr, 2);
- udp_src_port = ntohs(shortval);
- hdr += 2;
-
- memcpy(&shortval, hdr, 2);
- udp_dest_port = ntohs(shortval);
- hdr += 2;
-
- memcpy(&shortval, hdr, 2);
- udp_len = ntohs(shortval);
- hdr += 2;
-
- memcpy(&shortval, hdr, 2);
- udp_chksum = ntohs(shortval);
- hdr += 2;
-
- sprintf(str," UDP: SPort: %-05d | DPort: %-05d",udp_src_port, udp_dest_port);
- strcat(pbuf,str);
- sprintf(str," | Len: %-05d | CSum: 0x%08x\n",udp_len, udp_chksum);
- strcat(pbuf,str);
- return hdr-(BYTE *)(wsabuf->buf + iphdrlen + iLnxplus);
-}
-
-//
-// Function: DecodeTCPHeader
-//
-// Description:
-// This function takes a buffer pointing to a TCP header
-// and prints it out in a readable form.
-//
-int DecodeTCPHeader(WSABUF *wsabuf, DWORD iphdrlen) {
- BYTE *hdr = (BYTE *)((BYTE *)wsabuf->buf + iphdrlen + iLnxplus);
- unsigned short shortval;
- unsigned long longval;
-
- memcpy(&shortval, hdr, 2);
- shortval = ntohs(shortval);
- sprintf(str," TCP: SPort: %u", shortval);
- strcat(pbuf,str);
- hdr += 2;
-
- memcpy(&shortval, hdr, 2);
- shortval = ntohs(shortval);
- sprintf(str," DPort: %u", shortval);
- strcat(pbuf,str);
- hdr += 2;
-
- memcpy(&longval, hdr, 4);
- longval = ntohl(longval);
- sprintf(str," Seq: %lX", longval);
- strcat(pbuf,str);
- hdr += 4;
-
- memcpy(&longval, hdr, 4);
- longval = ntohl(longval);
- sprintf(str," ACK: %lX", longval);
- strcat(pbuf,str);
- hdr += 4;
-// printf(" Header Len : %d (bytes %d)\n", HI_WORD(*hdr), (HI_WORD(*hdr) * 4));
-
- memcpy(&shortval, hdr, 2);
- shortval = ntohs(shortval) & 0x3F;
- sprintf(str," Flags: ");
- strcat(pbuf,str);
- if (shortval & 0x20) strcat(pbuf,"URG ");
- if (shortval & 0x10) strcat(pbuf,"ACK ");
- if (shortval & 0x08) strcat(pbuf,"PSH ");
- if (shortval & 0x04) strcat(pbuf,"RST ");
- if (shortval & 0x02) strcat(pbuf,"SYN ");
- if (shortval & 0x01) strcat(pbuf,"FIN ");
- strcat(pbuf,"\n");
- hdr += 2;
-
- memcpy(&shortval, hdr, 2);
- shortval = ntohs(shortval);
-// printf(" Window size: %d\n", shortval);
- hdr += 2;
-
- memcpy(&shortval, hdr, 2);
- shortval = ntohs(shortval);
-// printf(" TCP Chksum : %d\n", shortval);
- hdr += 2;
-
- memcpy(&shortval, hdr, 2);
- shortval = ntohs(shortval);
- hdr += 2;
-// printf(" Urgent ptr : %d\n", shortval);
-
- return hdr-(BYTE *)(wsabuf->buf + iphdrlen + iLnxplus);
-}
-
-int DecodeGREHeader(WSABUF *wsabuf, DWORD iphdrlen,DWORD bytesret,
- unsigned int srcip, unsigned short srcport, unsigned long srcnet,unsigned int destip, unsigned short destport, unsigned long destnet,
- unsigned short xport,unsigned int xip, unsigned long xnet)
- {
- BYTE *hdr = (BYTE *)((BYTE *)wsabuf->buf + iphdrlen + iLnxplus);
- unsigned short shortval;
- unsigned long longval;
- int ipe;
- BYTE *orihdr;
- char *sstr;
- SOCKADDR_IN srcaddr;
-
- orihdr=hdr;
- memcpy(&shortval, hdr, 2);
- shortval = ntohs(shortval);
- sprintf(str," GRE Flag: %u Prot:", shortval);
- strcat(mypbuff,str);
- hdr += 2;
-
- memcpy(&shortval, hdr, 2);
- shortval = ntohs(shortval);
- ipe=0;
- sstr=str;
-// sprintf(str," Prot: %u", shortval);
- switch ( shortval ) {
- case 4: sstr="SNA";
- break;
- case 0xfe: sstr="OSI";
- break;
- case 0x200: sstr="PUP";
- break;
- case 0x600: sstr="XNS";
- break;
- case 0x800: sstr="IP";
- ipe=1;
- break;
- case 0x804: sstr="Chaos";
- break;
- case 0x806: sstr="ARP";
- break;
- case 0x6558: sstr="Tr.bridge";
- break;
- default: sprintf(str,"%u", shortval);
- break;
- }
- hdr += 2;
- strcat(mypbuff,sstr);
- if (ipe && gre) {
- int plusment,jj,protoment;
- plusment=iLnxplus;
- protoment=iProto;
- if (iProto==47) iProto=0;
- iLnxplus+=4;
- nomac=0;
- iLnxplus=plusment+24;
- DecodeIPHeader(wsabuf,srcip,srcport,srcnet,destip,destport,destnet,bytesret,xport,xip,xnet);
- nomac=1;
- iLnxplus=plusment;
- iProto=protoment;
- }
-return -1;
-// return hdr-(BYTE *)(wsabuf->buf + iphdrlen + iLnxplus);
-}
-
-
-int ClearIPAcc() {
- unsigned long i;
- ta *tai;
- for(i=0;i<MAXHASH;i++) *(iph + i)=0;
- tai=acc;
- for(i=0;i<MAXHASH;i++) { tai->from=tai->to=0; tai++; }
- for (i=0;i<MAXTCPPORT; i++) tcppb[i]=tcppp[i]=0;
- udpb=udpp=tcpp=tcpb=0;
- for (i=0;i<255; i++) typp[i]=0;
- for (i=0;i<255; i++) typb[i]=0;
- return 0;
- };
-
-int InitIPAcc() {
- acc=malloc(MAXHASH*sizeof(ta));
- iph=malloc(MAXHASH*sizeof(long));
- if (!acc || !iph ) return 0;
- ClearIPAcc();
- time(&elapsed);
- return 1;
-}
-
-int bytesort(const void *s1, const void *s2) { // sorting tale in byte order
- ta *d1;
- ta *d2;
- d1= (ta *)s1; d2=(ta *)s2;
- if (d1->byte > d2->byte) return -1;
- if (d1->byte < d2->byte) return 1;
- return 0;
-}
-int countsort(const void *s1, const void *s2) { // sorting tale in packet count order
- ta *d1;
- ta *d2;
- d1= (ta *)s1; d2=(ta *)s2;
- if (d1->pkt > d2->pkt) return -1;
- if (d1->pkt < d2->pkt) return 1;
- return 0;
-}
-int CloseIPAcc( long ti) {
- unsigned long i;
- ta *tai;
- SOCKADDR_IN srcaddr;
- SOCKADDR_IN dstaddr;
- float ff;
- char str[16];
- unsigned long j,k,l;
- int lin=0;
- int linn;
-
- time(&elapsed);
- if (iFile) f=fopen(filename,"w+");
- k=0;
- if (sortbysize) qsort(acc,MAXHASH,sizeof(ta),bytesort);
- else qsort(acc,MAXHASH,sizeof(ta),countsort);
- ff=0.0;
- for (i=0;i<255;i++) ff+=typb[i];
- for (i=0; i<MAXHASH; i++) {
- tai=acc + i;
- if ((tai->from!=0) && (tai->to!=0)) ++k;
- }
- if (iScreen) {
-#ifndef LINUX
- system("cls");
-#else
- system("clear");
-// printf("\033[1~");
-#endif
- printf("%-16s Speed: %5.2f Kbit/s , %ld IP pairs / %ld secs. %s@%s.hu",myipname,ff/ti/1024*8,k,ti,author,author);
- printf("\nProt:"); j=0; ++lin;
- while (1) {
- l=k=0;
- for (i=0;i<100;i++) if ( typb[i]>k) { k=typb[i]; l=i; }
- if (k==0) break;
- if ((j>0) && ((j%3)==0)) { printf("\n "); ++lin; }
- if (k>1024*1024) printf(" %-8.8s:%5.1fk/%-6.1f M",szProto[l],(float)typp[l]/1024,(float)k/(1024*1024));
- else if (k>1024) printf(" %-8.8s:%5ld/%-6.1f k",szProto[l],typp[l],(float)k/1024);
- else printf(" %-8.8s:%5ld/%-8ld",szProto[l],typp[l],k);
- typb[l]=0;
- ++j;
- }
- printf("\nPort:"); j=0; ++lin;
- k=0; linn=lin;
- while (1) {
- l=k=0;
- for (i=0;i<MAXTCPPORT;i++) if (tcppb[i]>k) { k=tcppb[i]; l=i; }
- if (k==0) break;
- if (j && (j%4)==0) {
- if (lin >= linn+1) break;
- printf("\n ");
- ++lin;
- }
- if (k>1024*1024) printf(" %04d:%4.1fk/%-5.1f M",l,(float)tcppp[l]/1024,(float)k/(1024*1024));
- else if (k>1024) printf(" %04d:%4ld/%-5.1f k",l,tcppp[l],(float)k/1024);
- else printf(" %04d:%4ld/%-7ld",l,tcppp[l],k);
- tcppb[l]=0;
- ++j;
- }
- } else if (f) {
- fprintf(f,"%-16s Speed: %5.2f Kbit/s , %ld IP pairs / %ld secs. %s@%s.hu",myipname,ff/ti/1024*8,k,ti,author,author);
- fprintf(f,"\nProt:"); j=0;
- while (1) {
- l=k=0;
- for (i=0;i<100;i++) if ( typb[i]>k) { k=typb[i]; l=i; }
- if (k==0) break;
- if (k>1024*1024) fprintf(f," %-8.8s:%5.1fk/%-6.1f M",szProto[l],(float)typp[l]/1024,(float)k/(1024*1024));
- else if (k>1024) fprintf(f," %-8.8s:%5ld/%-6.1f k",szProto[l],typp[l],(float)k/1024);
- else fprintf(f," %-8.8s:%5ld/%-8ld",szProto[l],typp[l],k);
- typb[l]=0;
- ++j;
- }
- printf("\nPort:"); j=0;
- k=0; linn=lin;
- while (1) {
- l=k=0;
- for (i=0;i<MAXTCPPORT;i++) if (tcppb[i]>k) { k=tcppb[i]; l=i; }
- if (k==0) break;
- if (k>1024*1024) fprintf(f," %04d:%4.1fk/%-5.1f M",l,(float)tcppp[l]/1024,(float)k/(1024*1024));
- else if (k>1024) fprintf(f," %04d:%4ld/%-5.1f k",l,tcppp[l],(float)k/1024);
- else fprintf(f," %04d:%4ld/%-7ld",l,tcppp[l],k);
- tcppb[l]=0;
- ++j;
- }
- }
-
- for (i=0; i<MAXHASH; i++) {
- tai=acc + i;
- if ((tai->from!=0) && (tai->to!=0)) { ++k;
- if (!iSum) {
- dstaddr.sin_addr.s_addr = htonl(*(iph+tai->from));
- srcaddr.sin_addr.s_addr = htonl(*(iph+(tai->to)));
- strcpy(str,inet_ntoa(dstaddr.sin_addr));
- if (iScreen && (++lin<iline) ) printf("\n%-15s\t%-15s\t%5d pkt, %10ld byte :%7.2f Kbps",str,inet_ntoa(srcaddr.sin_addr),tai->pkt,tai->byte,((float)tai->byte)/ti/1024*8);
- if (f) fprintf(f,"%-15s\t%-15s\t%d\t%ld\n",str,inet_ntoa(srcaddr.sin_addr),tai->pkt,tai->byte);
- }
- }
- }
- if (iScreen) printf("\n");
-#ifdef LINUX
- if (iScreen) fflush(stdout);
-#endif
- ClearIPAcc();
- if (f) {
- char cmdline[255];
- fclose(f);
-// if (*execname) _spawnle(_P_NOWAIT,execname,execname,filename);
-// if (*execname) _execl(execname,execname);
- if (*execname) {
-#ifndef LINUX
- sprintf(cmdline,"%s %s",execname,filename);
-#else
- sprintf(cmdline,"%s %s",execname,filename);
-#endif
- system(cmdline);
-// iRun=0;
- }
- }
- f=NULL;
- return 0;
-}
-
-unsigned short FindIPHash( unsigned long ip ) {
- unsigned short hashval;
- unsigned long *ipt;
-
- hashval = (unsigned short)(((ip&0xFFFF0000)>>16) ^ (ip&0x0000FFFF));
- ipt=iph + hashval;
- while (*ipt != 0 && (*ipt!=ip)) { ipt++; hashval++; }
- if (*ipt==0) *ipt=ip;
- return hashval;
-}
-
-unsigned short SetIPAcc( unsigned long src, unsigned long dst, unsigned long byte, unsigned short typ, unsigned short sport, unsigned short dport) {
- unsigned short from,to,hash;
- ta *tai;
- hash=0;
- if (src) {
-
- if (fromip) from=FindIPHash(src); else from=-1;
- if (toip) to=FindIPHash(dst); else to=-1;
- hash=from^to;
- tai=acc + hash;
- while ( ((tai->from!=from) && (tai->to!=to)) && ((tai->from!=0) && (tai->to!=0)) ) {tai++; hash++; }
- if ((tai->from==0)&&(tai->to==0)) {
- tai->byte=byte; tai->from=from; tai->to=to; tai->pkt=1;
- } else { tai->byte+=byte; tai->pkt++; }
-
- typp[typ]++;
- typb[typ]+=byte;
- if ((sport>0) && (sport<MAXTCPPORT)) { tcppp[sport]++; tcppb[sport]+=byte; }
- if ((dport>0) && (dport<MAXTCPPORT)) { tcppp[dport]++; tcppb[dport]+=byte; }
- }
- return hash;
-}
-
-//
-// Function: DecodeIPHeader
-//
-// Description:
-// This function takes a pointer to an IP header and prints
-// it out in a readable form.
-//
-int DecodeIPHeader(WSABUF *wsabuf, unsigned int srcip, unsigned short srcport, unsigned long srcnet,
- unsigned int destip, unsigned short destport, unsigned long destnet, DWORD bytesret,
- unsigned short xport,unsigned int xip, unsigned long xnet)
-{
- BYTE *hdr = (BYTE *)wsabuf->buf,
- *nexthdr = NULL,
- *ohdr;
- unsigned short shortval;
- SOCKADDR_IN srcaddr,
- destaddr;
-
- unsigned short ip_version,
- ip_hdr_len,
- ip_tos,
- ip_total_len,
- ip_id,
- ip_flags,
- ip_ttl,
- ip_frag_offset,
- ip_proto,
- ip_hdr_chksum,
- ip_src_port,
- ip_dest_port;
- unsigned int ip_src,
- ip_dest;
- BOOL bPrint = FALSE;
- char ip_prtype=0;
- int j;
- time_t tt;
- struct tm *tmm;
-
- ohdr=hdr;
- if (iLnxplus) ip_prtype=*(hdr+iLnxplus-1);
- if (ip_prtype) return 0;
- hdr += iLnxplus;
- ip_version = HI_WORD(*hdr);
- ip_hdr_len = LO_WORD(*hdr) * 4;
- nexthdr = (BYTE *)((BYTE *)hdr + ip_hdr_len);
- hdr++;
-
- ip_tos = *hdr;
- hdr++;
-
- memcpy(&shortval, hdr, 2);
- ip_total_len = ntohs(shortval);
- hdr += 2;
-
- memcpy(&shortval, hdr, 2);
- ip_id = ntohs(shortval);
- hdr += 2;
-
- ip_flags = ((*hdr) >> 5);
-
- memcpy(&shortval, hdr, 2);
- ip_frag_offset = ((ntohs(shortval)) & 0x1FFF);
- hdr += 2;
-
- ip_ttl = *hdr;
- hdr++;
-
- ip_proto = *hdr;
- hdr++;
-
- memcpy(&shortval, hdr, 2);
- ip_hdr_chksum = ntohs(shortval);
- hdr += 2;
-
- memcpy(&srcaddr.sin_addr.s_addr, hdr, 4);
- ip_src = ntohl(srcaddr.sin_addr.s_addr);
- hdr += 4;
-
- memcpy(&destaddr.sin_addr.s_addr, hdr, 4);
- ip_dest = ntohl(destaddr.sin_addr.s_addr);
- hdr += 4;
- //
- // If packet is UDP, TCP, or IGMP read ahead and
- // get the port values.
- //
- ip_src_port=ip_dest_port=0;
- if (((ip_proto == 2) ||
- (ip_proto == 6) ||
- (ip_proto == 17)) ) //&& bFilter)
- {
- memcpy(&ip_src_port, nexthdr, 2);
- ip_src_port = ntohs(ip_src_port);
- memcpy(&ip_dest_port, nexthdr+2, 2);
- ip_dest_port = ntohs(ip_dest_port);
-
- };
- bPrint = 0;
-// xaok= (xip!=0) && (((xip&xnet)==(ip_src&xnet))||((xip&xnet)==(ip_dest&xnet)));
-// saok= ((srcip==0)||((srcip&srcnet)==(ip_src&srcnet)));
-// daok = ((destip==0)||((destip&destnet)==(ip_dest&destnet)));
-// xpok=(xport!=0) && ((xport==ip_src_port)||(xport==ip_dest_port));
-// spok=((srcport==0)||(srcport == ip_src_port));
-// dpok=((destport==0)||(destport == ip_dest_port));
-//printf("\nf:%d xa:%d sa:%d da:%d xp:%d sp:%d dp:%d",bFilter,xaok,saok,daok,xpok,spok,dpok);
-// if (!bFilter || ( (xaok||(saok&&daok)) && (xpok||(spok&&dpok)))) {
-if ((!bFilter) || ((ip_proto==47)&&gre) ||
- (
- ((iProto==0)||(ip_proto==iProto)) &&
- (
- ((xip!=0) && (((xip&xnet)==(ip_src&xnet))||((xip&xnet)==(ip_dest&xnet)))
- ) || (
- ((srcip==0) || ((srcip&srcnet)==(ip_src&srcnet))) && ((destip==0)||((destip&destnet)==(ip_dest&destnet)))
- )
- )
- &&
- (
- ((xport!=0) && ((xport==ip_src_port)||(xport==ip_dest_port))
- ) || (
- ((srcport==0)||(srcport == ip_src_port))&&((destport==0)||(destport == ip_dest_port))
- )
- )
- )
- ) {
- if (! iDetail) {
- if ((ip_proto==47)&&gre) {
- *mypbuff=0;
- DecodeGREHeader(wsabuf, ip_hdr_len, bytesret,
- srcip,srcport,srcnet,destip,destport,destnet,xport,xip,xnet);
-// SetIPAcc(0,0,0,0,0,0);
- return ip_hdr_len;
- }
- SetIPAcc(ip_src,ip_dest,ip_total_len,ip_proto,ip_src_port,ip_dest_port);
- }
- else bPrint=TRUE;
-// printf("%d %ld %ld %ld %ld",ip_proto,xip,xip&xnet,ip_src&xnet,ip_dest&xnet);
- } else {
- if (! iDetail) SetIPAcc(0,0,0,0,0,0);
-// else bPrint=TRUE;
- }
- time(&tt);
- if ((!iSum && ( tt-elapsed > iCycle)) || !iRun || mostird) {
- mostird=0;
- if (! iDetail) CloseIPAcc(tt-elapsed-1);
- else {
- time(&elapsed);
- if (f) fclose(f);
- if (iFile) f=fopen(filename,"a");
- }
- }
- if (lNum) { if (--lNum <= 0) iRun=0; }
-
- //
- *pbuf=0;
- if (bPrint) {
- tmm=localtime(&tt);
-if (! nomac ) {
- strcpy(pbuf,mypbuff);
-} else {
- sprintf(str,"\n%4.4d.%2.2d.%2.2d %2.2d:%2.2d:%2.2d ",
- tmm->tm_year+1900,tmm->tm_mon+1,tmm->tm_mday,tmm->tm_hour,tmm->tm_min,tmm->tm_sec);
- strcat(pbuf,str);
-#ifdef LINUX
- sprintf(str,"%x:%x:%x:%x:%x:%x > %x:%x:%x:%x:%x:%x",*ohdr,*(ohdr+1),*(ohdr+2),*(ohdr+3),*(ohdr+4),*(ohdr+5),
- *(ohdr+6),*(ohdr+7),*(ohdr+8),*(ohdr+9),*(ohdr+10),*(ohdr+11));
- strcat(pbuf,str);
-#endif
-}
- sprintf(str," %d bytes\n%-15s>", ip_total_len, inet_ntoa(srcaddr.sin_addr));
- strcat(pbuf,str);
- sprintf(str,"%-15s", inet_ntoa(destaddr.sin_addr));
- strcat(pbuf,str);
- sprintf(str," TTL:%-3d Proto:%-6s F:%d/%d TOS:%X%X\n",
- ip_ttl, szProto[ip_proto],ip_flags,ip_frag_offset,HI_WORD(ip_tos), LO_WORD(ip_tos));
- strcat(pbuf,str);
- if (iFile) strcat(pbuf,".");
- strcpy(mypbuff,pbuf);
-
- }
- else return ip_hdr_len;
-
- if (justheader) { if (*pbuf) fprintf(iFile?f:stdout,"%s",pbuf); return ip_hdr_len; }
- if (iDetail) {
- switch (ip_proto) {
- case 1: // ICMP
- j=DecodeICMPHeader(wsabuf, ip_hdr_len);
- break;
- case 2: // IGMP
- j=DecodeIGMPHeader(wsabuf, ip_hdr_len);
- break;
- case 6: // TCP
- j=DecodeTCPHeader(wsabuf, ip_hdr_len);
- break;
- case 17: // UDP
- j=DecodeUDPHeader(wsabuf, ip_hdr_len);
- break;
- case 47: // UDP
- j=DecodeGREHeader(wsabuf, ip_hdr_len, bytesret,
- srcip,srcport,srcnet,destip,destport,destnet,xport,xip,xnet);
- break;
- default:
- j=0; hdr=(BYTE *)wsabuf->buf;
- sprintf(str," No decoder installed for protocol\n");
- strcat(pbuf,str);
- break;
- }
- if (j>=0) PrintRawBytes(hdr+j,bytesret-j-ip_hdr_len-12); //(hdr-(BYTE *)(wsabuf->buf + iLnxplus)));
- }
- else if (*pbuf) fprintf(iFile?f:stdout,"%s",pbuf);
-
- return ip_hdr_len;
-}
projects / openwrt / svn-archive / archive.git / blobdiff