summaryrefslogtreecommitdiff
path: root/package/pipacs/src/parser.c
diff options
context:
space:
mode:
Diffstat (limited to 'package/pipacs/src/parser.c')
-rw-r--r--package/pipacs/src/parser.c907
1 files changed, 907 insertions, 0 deletions
diff --git a/package/pipacs/src/parser.c b/package/pipacs/src/parser.c
new file mode 100644
index 000000000..330d7cd0a
--- /dev/null
+++ b/package/pipacs/src/parser.c
@@ -0,0 +1,907 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include<string.h>
+#include <time.h>
+//#include <process.h>
+#include "parser.h"
+
+#define printit
+
+extern BOOL bFilter;
+extern int iline;
+extern char * author;
+extern char myipname[];
+extern int justheader;
+extern int gre,sortbysize,fromip,toip;
+int nomac=1;
+int mostird=0;
+char mypbuff[2048];
+// accounting variables
+#define MAXHASH 0xffff
+#define MAXTCPPORT 4096
+unsigned long *iph=NULL; //[MAXHASH];
+
+typedef struct {
+ unsigned short from;
+ unsigned short to;
+ unsigned long byte;
+ unsigned short pkt;
+ unsigned short sport;
+ unsigned short dport;
+} ta;
+
+ta *acc = NULL;
+unsigned long tcppb[MAXTCPPORT];
+unsigned long tcppp[MAXTCPPORT];
+unsigned long typp[255];
+unsigned long typb[255];
+unsigned long udpb,tcpb,udpp,tcpp;
+time_t elapsed=0;
+int iCycle=10;
+int iScreen=1;
+int iFile=0;
+long lNum=0;
+char filename[128];
+char intlist[128];
+int iRun=1;
+int iDetail=0;
+FILE *f=NULL;
+int iProto=0;
+int iSum=0;
+char execname[255];
+char pbuf[8196];
+char str[255];
+extern char pattern[];
+#ifndef LINUX
+int iLnxplus=0; // Windows buffer without the MAC frame !
+#else
+int iLnxplus=14; // Linux plus IP header len =14 !!!
+#endif
+//
+// A list of protocol types in the IP protocol header
+//
+char *szProto[255] = {"IP", // 0
+ "ICMP", // 1
+ "IGMP", // 2
+ "GGP", // 3
+ "IP", // 4
+ "ST", // 5
+ "TCP", // 6
+ "UCL", // 7
+ "EGP", // 8
+ "IGP", // 9
+ "BBN-RCC-MON", // 10
+ "NVP-II", // 11
+ "PUP", // 12
+ "ARGUS", // 13
+ "EMCON", // 14
+ "XNET", // 15
+ "CHAOS", // 16
+ "UDP", // 17
+ "MUX", // 18
+ "DCN-MEAS", // 19
+ "HMP", // 20
+ "PRM", // 21
+ "XNS-IDP", // 22
+ "TRUNK-1", // 23
+ "TRUNK-2", // 24
+ "LEAF-1", // 25
+ "LEAF-2", // 26
+ "RDP", // 27
+ "IRTP", // 28
+ "ISO-TP4", // 29
+ "NETBLT", // 30
+ "MFE-NSP", // 31
+ "MERIT-INP", // 32
+ "SEP", // 33
+ "3PC", // 34
+ "IDPR", // 35
+ "XTP", // 36
+ "DDP", // 37
+ "IDPR-CMTP", // 38
+ "TP++", // 39
+ "IL", // 40
+ "SIP", // 41
+ "SDRP", // 42
+ "SIP-SR", // 43
+ "SIP-FRAG", // 44
+ "IDRP", // 45
+ "RSVP", // 46
+ "GRE", // 47
+ "MHRP", // 48
+ "BNA", // 49
+ "IPSEC-ESP", // 50
+ "IPSEC-AH", // 51
+ "I-NLSP", // 52
+ "SWIPE", // 53
+ "NHRP", // 54
+ "?55?", // 55
+ "?56?", // 56
+ "SKIO", // 57
+ "V6ICMP", // 58
+ "V6NoNXT", // 59
+ "V6OPT", // 60
+ "int.host", // 61
+ "CFTP", // 62
+ "loc.net", // 63
+ "SAT-EXPAK", // 64
+ "KRYPTOLAN", // 65
+ "RVD", // 66
+ "IPPC", // 67
+ "dist.fs", // 68
+ "SAT-MON", // 69
+ "VISA", // 70
+ "IPCV", // 71
+ "CPNX", // 72
+ "CPHB", // 73
+ "WSN", // 74
+ "PVP", // 75
+ "BR-SAT-MON", // 76
+ "SUN-ND", // 77
+ "WB-MON", // 78
+ "WB-EXPAK", // 79
+ "ISO-IP", // 80
+ "VMTP", // 81
+ "SECURE-VMTP",// 82
+ "VINES", // 83
+ "TTP", // 84
+ "NSFNET-IGP", // 85
+ "DGP", // 86
+ "TCF", // 87
+ "IGRP", // 88
+ "OSPF", // 89
+ "Sprite-RPC", // 90
+ "LARP", // 91
+ "MTP", // 92
+ "AX.25", // 93
+ "IPIP", // 94
+ "MICP", // 95
+ "SCC-SP", // 96
+ "ETHERIP", // 97
+ "ENCAP", // 98
+ "priv.enc", // 99
+ "GMTP" // 99
+ };
+//
+// The types of IGMP messages
+//
+char *szIgmpType[] = {"",
+ "Host Membership Query",
+ "HOst Membership Report",
+ "",
+ "",
+ "",
+ "Version 2 Membership Report",
+ "Leave Group",
+ "",
+ ""
+ };
+
+//
+// Function: PrintRawBytes
+//
+// Description:
+// This function simply prints out a series of bytes
+// as hexadecimal digits.
+//
+void PrintRawBytes(BYTE *ptr, DWORD len)
+{
+ int i,j;
+// if (! iFile) {
+*(ptr+len)=0;
+if ((*pattern==0) || strstr(ptr,pattern) ) {
+ fprintf(iFile?f:stdout,"%s",pbuf);
+ fprintf(iFile?f:stdout," " );
+ while (len > 0) {
+ for(i=0; i < 16; i++) {
+ fprintf(iFile?f:stdout,"%x%x ", HI_WORD(*ptr), LO_WORD(*ptr));
+ len--;
+ ptr++;
+ if (len == 0) {j=i++; while(++j < 16) fprintf(iFile?f:stdout," "); break; }
+ }
+ fprintf(iFile?f:stdout," ");
+ for(j=0; j < i; j++) fprintf(iFile?f:stdout,"%c",isprint(*(ptr-i+j))?*(ptr-i+j):'.');
+ if (len) fprintf(iFile?f:stdout,"\n ");
+ }
+// } else {
+// fwrite(ptr,sizeof(BYTE),len,f);
+// }
+}
+}
+
+static char *ICMPTypeTable[]={
+ "Echo Reply", "ICMP 1", "ICMP 2", "Dest Unreachable","SrcQuench", "Redirect", "6", "7","Echo Request","9","10",
+ "Time Exceed", "ParamPrblm", "Timestamp", "Timestamp reply","InfoRqst", "InfoRply"
+};
+static char *Dstunreach[]={
+"net unreach.","host unreach.","protocol unreach.","port unreach.",
+"frag needed","source route?","",""
+};
+int DecodeICMPHeader(WSABUF *wsabuf, DWORD iphdrlen) {
+ BYTE *hdr = (BYTE *)((BYTE *)wsabuf->buf + iphdrlen + iLnxplus );
+ unsigned short type,code,chksum,
+ id,
+ seq;
+ unsigned long resptime,r1,r2;
+ BYTE *hhh;
+ SOCKADDR_IN addr;
+ type=*hdr++; code=*hdr++;
+ sprintf(str," Type:%-12s Code:%3d,",ICMPTypeTable[type],code);
+
+ strcat(pbuf,str);
+ memcpy(&chksum, hdr, 2);
+ hdr += 2; hhh=hdr;
+ memcpy(&id, hdr, 2);
+ hdr += 2;
+ memcpy(&seq, hdr, 2);
+ hdr+=2;
+// memcpy(&resptime, hdr, 4);
+// hdr+=4;
+ switch (type) {
+ case 3:
+ memcpy(&addr.sin_addr.s_addr, hdr+16, 4);
+ if (code==4 ) sprintf(str,"frag needed-Max MTU:%u at %-15s\n",ntohs(seq), inet_ntoa(addr.sin_addr));
+ else sprintf(str,"%s at %-15s\n",Dstunreach[code&7],inet_ntoa(addr.sin_addr));
+ hdr+=iphdrlen;
+ break;
+ case 11:
+ memcpy(&addr.sin_addr.s_addr, hdr+16, 4);
+ sprintf(str,"%s at %-15s\n",code?"frag reass. exceed":"ttl exceed",inet_ntoa(addr.sin_addr));
+ hdr+=iphdrlen;
+ break;
+ case 12:
+ memcpy(&addr.sin_addr.s_addr, hdr+16, 4);
+ sprintf(str," err:%d at %-15s\n",id,inet_ntoa(addr.sin_addr));
+ hdr+=iphdrlen;
+ break;
+ case 4:
+ memcpy(&addr.sin_addr.s_addr, hdr+16, 4);
+ sprintf(str," wait for %-15s\n",ntohs(id),inet_ntoa(addr.sin_addr));
+ hdr+=iphdrlen;
+ break;
+ case 5:
+ memcpy(&addr.sin_addr.s_addr, hhh, 4);
+ sprintf(str," from gw: %-15s\n",inet_ntoa(addr.sin_addr));
+ hdr+=iphdrlen;
+ break;
+ case 0:
+ case 8:
+ sprintf(str," Id:%3u Seq:%3u\n",ntohs(id),ntohs(seq));
+ break;
+ case 13:
+ case 14:
+ memcpy(&resptime, hdr, 4);
+ hdr+=4;
+ memcpy(&r1, hdr, 4);
+ hdr+=4;
+ memcpy(&r2, hdr, 4);
+ hdr+=4;
+ sprintf(str," Id:%3u Seq:%3d Rec/Tr %ld/%ld ms\n",ntohs(id),ntohs(seq),ntohl(r1)-ntohl(resptime),ntohl(r2)-ntohl(resptime));
+ break;
+ case 15:
+ case 16:
+ sprintf(str," Id:%3u Seq:%3d\n",ntohs(id),ntohs(seq));
+ break;
+ }
+ strcat(pbuf,str);
+ return hdr-(BYTE *)(wsabuf->buf + iphdrlen + iLnxplus);
+}
+
+//
+// Function: DecodeIGMPHeader
+//
+// Description:
+// This function takes a pointer to a buffer containing
+// an IGMP packet and prints it out in a readable form.
+//
+
+int DecodeIGMPHeader(WSABUF *wsabuf, DWORD iphdrlen) {
+ BYTE *hdr = (BYTE *)((BYTE *)wsabuf->buf + iphdrlen + iLnxplus);
+ unsigned short chksum,
+ version,
+ type,
+ maxresptime;
+ SOCKADDR_IN addr;
+ version = HI_WORD(*hdr);
+ type = LO_WORD(*hdr);
+
+ hdr++;
+ maxresptime = *hdr;
+ hdr++;
+
+ memcpy(&chksum, hdr, 2);
+ chksum = ntohs(chksum);
+ hdr += 2;
+
+ memcpy(&(addr.sin_addr.s_addr), hdr, 4);
+ sprintf(str," IGMP HEADER:\n");
+ strcat(pbuf,str);
+ if ((type == 1) || (type == 2)) version = 1;
+ else version = 2;
+ sprintf(str," IGMP Version = %d\n IGMP Type = %s\n",version, szIgmpType[type]);
+ strcat(pbuf,str);
+ if (version == 2) {
+ sprintf(str," Max Resp Time = %d\n", maxresptime);
+ strcat(pbuf,str);
+ }
+ sprintf(str," IGMP Grp Addr = %s\n", inet_ntoa(addr.sin_addr));
+ strcat(pbuf,str);
+
+ return 8;
+}
+
+//
+// Function: DecodeUDPHeader
+//
+// Description:
+// This function takes a buffer which points to a UDP
+// header and prints it out in a readable form.
+//
+int DecodeUDPHeader(WSABUF *wsabuf, DWORD iphdrlen) {
+ BYTE *hdr = (BYTE *)((BYTE *)wsabuf->buf + iphdrlen + iLnxplus);
+ unsigned short shortval,
+ udp_src_port,
+ udp_dest_port,
+ udp_len,
+ udp_chksum;
+ memcpy(&shortval, hdr, 2);
+ udp_src_port = ntohs(shortval);
+ hdr += 2;
+
+ memcpy(&shortval, hdr, 2);
+ udp_dest_port = ntohs(shortval);
+ hdr += 2;
+
+ memcpy(&shortval, hdr, 2);
+ udp_len = ntohs(shortval);
+ hdr += 2;
+
+ memcpy(&shortval, hdr, 2);
+ udp_chksum = ntohs(shortval);
+ hdr += 2;
+
+ sprintf(str," UDP: SPort: %-05d | DPort: %-05d",udp_src_port, udp_dest_port);
+ strcat(pbuf,str);
+ sprintf(str," | Len: %-05d | CSum: 0x%08x\n",udp_len, udp_chksum);
+ strcat(pbuf,str);
+ return hdr-(BYTE *)(wsabuf->buf + iphdrlen + iLnxplus);
+}
+
+//
+// Function: DecodeTCPHeader
+//
+// Description:
+// This function takes a buffer pointing to a TCP header
+// and prints it out in a readable form.
+//
+int DecodeTCPHeader(WSABUF *wsabuf, DWORD iphdrlen) {
+ BYTE *hdr = (BYTE *)((BYTE *)wsabuf->buf + iphdrlen + iLnxplus);
+ unsigned short shortval;
+ unsigned long longval;
+
+ memcpy(&shortval, hdr, 2);
+ shortval = ntohs(shortval);
+ sprintf(str," TCP: SPort: %u", shortval);
+ strcat(pbuf,str);
+ hdr += 2;
+
+ memcpy(&shortval, hdr, 2);
+ shortval = ntohs(shortval);
+ sprintf(str," DPort: %u", shortval);
+ strcat(pbuf,str);
+ hdr += 2;
+
+ memcpy(&longval, hdr, 4);
+ longval = ntohl(longval);
+ sprintf(str," Seq: %lX", longval);
+ strcat(pbuf,str);
+ hdr += 4;
+
+ memcpy(&longval, hdr, 4);
+ longval = ntohl(longval);
+ sprintf(str," ACK: %lX", longval);
+ strcat(pbuf,str);
+ hdr += 4;
+// printf(" Header Len : %d (bytes %d)\n", HI_WORD(*hdr), (HI_WORD(*hdr) * 4));
+
+ memcpy(&shortval, hdr, 2);
+ shortval = ntohs(shortval) & 0x3F;
+ sprintf(str," Flags: ");
+ strcat(pbuf,str);
+ if (shortval & 0x20) strcat(pbuf,"URG ");
+ if (shortval & 0x10) strcat(pbuf,"ACK ");
+ if (shortval & 0x08) strcat(pbuf,"PSH ");
+ if (shortval & 0x04) strcat(pbuf,"RST ");
+ if (shortval & 0x02) strcat(pbuf,"SYN ");
+ if (shortval & 0x01) strcat(pbuf,"FIN ");
+ strcat(pbuf,"\n");
+ hdr += 2;
+
+ memcpy(&shortval, hdr, 2);
+ shortval = ntohs(shortval);
+// printf(" Window size: %d\n", shortval);
+ hdr += 2;
+
+ memcpy(&shortval, hdr, 2);
+ shortval = ntohs(shortval);
+// printf(" TCP Chksum : %d\n", shortval);
+ hdr += 2;
+
+ memcpy(&shortval, hdr, 2);
+ shortval = ntohs(shortval);
+ hdr += 2;
+// printf(" Urgent ptr : %d\n", shortval);
+
+ return hdr-(BYTE *)(wsabuf->buf + iphdrlen + iLnxplus);
+}
+
+int DecodeGREHeader(WSABUF *wsabuf, DWORD iphdrlen,DWORD bytesret,
+ unsigned int srcip, unsigned short srcport, unsigned long srcnet,unsigned int destip, unsigned short destport, unsigned long destnet,
+ unsigned short xport,unsigned int xip, unsigned long xnet)
+ {
+ BYTE *hdr = (BYTE *)((BYTE *)wsabuf->buf + iphdrlen + iLnxplus);
+ unsigned short shortval;
+ unsigned long longval;
+ int ipe;
+ BYTE *orihdr;
+ char *sstr;
+ SOCKADDR_IN srcaddr;
+
+ orihdr=hdr;
+ memcpy(&shortval, hdr, 2);
+ shortval = ntohs(shortval);
+ sprintf(str," GRE Flag: %u Prot:", shortval);
+ strcat(mypbuff,str);
+ hdr += 2;
+
+ memcpy(&shortval, hdr, 2);
+ shortval = ntohs(shortval);
+ ipe=0;
+ sstr=str;
+// sprintf(str," Prot: %u", shortval);
+ switch ( shortval ) {
+ case 4: sstr="SNA";
+ break;
+ case 0xfe: sstr="OSI";
+ break;
+ case 0x200: sstr="PUP";
+ break;
+ case 0x600: sstr="XNS";
+ break;
+ case 0x800: sstr="IP";
+ ipe=1;
+ break;
+ case 0x804: sstr="Chaos";
+ break;
+ case 0x806: sstr="ARP";
+ break;
+ case 0x6558: sstr="Tr.bridge";
+ break;
+ default: sprintf(str,"%u", shortval);
+ break;
+ }
+ hdr += 2;
+ strcat(mypbuff,sstr);
+ if (ipe && gre) {
+ int plusment,jj,protoment;
+ plusment=iLnxplus;
+ protoment=iProto;
+ if (iProto==47) iProto=0;
+ iLnxplus+=4;
+ nomac=0;
+ iLnxplus=plusment+24;
+ DecodeIPHeader(wsabuf,srcip,srcport,srcnet,destip,destport,destnet,bytesret,xport,xip,xnet);
+ nomac=1;
+ iLnxplus=plusment;
+ iProto=protoment;
+ }
+return -1;
+// return hdr-(BYTE *)(wsabuf->buf + iphdrlen + iLnxplus);
+}
+
+
+int ClearIPAcc() {
+ unsigned long i;
+ ta *tai;
+ for(i=0;i<MAXHASH;i++) *(iph + i)=0;
+ tai=acc;
+ for(i=0;i<MAXHASH;i++) { tai->from=tai->to=0; tai++; }
+ for (i=0;i<MAXTCPPORT; i++) tcppb[i]=tcppp[i]=0;
+ udpb=udpp=tcpp=tcpb=0;
+ for (i=0;i<255; i++) typp[i]=0;
+ for (i=0;i<255; i++) typb[i]=0;
+ return 0;
+ };
+
+int InitIPAcc() {
+ acc=malloc(MAXHASH*sizeof(ta));
+ iph=malloc(MAXHASH*sizeof(long));
+ if (!acc || !iph ) return 0;
+ ClearIPAcc();
+ time(&elapsed);
+ return 1;
+}
+
+int bytesort(const void *s1, const void *s2) { // sorting tale in byte order
+ ta *d1;
+ ta *d2;
+ d1= (ta *)s1; d2=(ta *)s2;
+ if (d1->byte > d2->byte) return -1;
+ if (d1->byte < d2->byte) return 1;
+ return 0;
+}
+int countsort(const void *s1, const void *s2) { // sorting tale in packet count order
+ ta *d1;
+ ta *d2;
+ d1= (ta *)s1; d2=(ta *)s2;
+ if (d1->pkt > d2->pkt) return -1;
+ if (d1->pkt < d2->pkt) return 1;
+ return 0;
+}
+int CloseIPAcc( long ti) {
+ unsigned long i;
+ ta *tai;
+ SOCKADDR_IN srcaddr;
+ SOCKADDR_IN dstaddr;
+ float ff;
+ char str[16];
+ unsigned long j,k,l;
+ int lin=0;
+ int linn;
+
+ time(&elapsed);
+ if (iFile) f=fopen(filename,"w+");
+ k=0;
+ if (sortbysize) qsort(acc,MAXHASH,sizeof(ta),bytesort);
+ else qsort(acc,MAXHASH,sizeof(ta),countsort);
+ ff=0.0;
+ for (i=0;i<255;i++) ff+=typb[i];
+ for (i=0; i<MAXHASH; i++) {
+ tai=acc + i;
+ if ((tai->from!=0) && (tai->to!=0)) ++k;
+ }
+ if (iScreen) {
+#ifndef LINUX
+ system("cls");
+#else
+ system("clear");
+// printf("\033[1~");
+#endif
+ printf("%-16s Speed: %5.2f Kbit/s , %ld IP pairs / %ld secs. %s@%s.hu",myipname,ff/ti/1024*8,k,ti,author,author);
+ printf("\nProt:"); j=0; ++lin;
+ while (1) {
+ l=k=0;
+ for (i=0;i<100;i++) if ( typb[i]>k) { k=typb[i]; l=i; }
+ if (k==0) break;
+ if ((j>0) && ((j%3)==0)) { printf("\n "); ++lin; }
+ if (k>1024*1024) printf(" %-8.8s:%5.1fk/%-6.1f M",szProto[l],(float)typp[l]/1024,(float)k/(1024*1024));
+ else if (k>1024) printf(" %-8.8s:%5ld/%-6.1f k",szProto[l],typp[l],(float)k/1024);
+ else printf(" %-8.8s:%5ld/%-8ld",szProto[l],typp[l],k);
+ typb[l]=0;
+ ++j;
+ }
+ printf("\nPort:"); j=0; ++lin;
+ k=0; linn=lin;
+ while (1) {
+ l=k=0;
+ for (i=0;i<MAXTCPPORT;i++) if (tcppb[i]>k) { k=tcppb[i]; l=i; }
+ if (k==0) break;
+ if (j && (j%4)==0) {
+ if (lin >= linn+1) break;
+ printf("\n ");
+ ++lin;
+ }
+ if (k>1024*1024) printf(" %04d:%4.1fk/%-5.1f M",l,(float)tcppp[l]/1024,(float)k/(1024*1024));
+ else if (k>1024) printf(" %04d:%4ld/%-5.1f k",l,tcppp[l],(float)k/1024);
+ else printf(" %04d:%4ld/%-7ld",l,tcppp[l],k);
+ tcppb[l]=0;
+ ++j;
+ }
+ } else if (f) {
+ fprintf(f,"%-16s Speed: %5.2f Kbit/s , %ld IP pairs / %ld secs. %s@%s.hu",myipname,ff/ti/1024*8,k,ti,author,author);
+ fprintf(f,"\nProt:"); j=0;
+ while (1) {
+ l=k=0;
+ for (i=0;i<100;i++) if ( typb[i]>k) { k=typb[i]; l=i; }
+ if (k==0) break;
+ if (k>1024*1024) fprintf(f," %-8.8s:%5.1fk/%-6.1f M",szProto[l],(float)typp[l]/1024,(float)k/(1024*1024));
+ else if (k>1024) fprintf(f," %-8.8s:%5ld/%-6.1f k",szProto[l],typp[l],(float)k/1024);
+ else fprintf(f," %-8.8s:%5ld/%-8ld",szProto[l],typp[l],k);
+ typb[l]=0;
+ ++j;
+ }
+ printf("\nPort:"); j=0;
+ k=0; linn=lin;
+ while (1) {
+ l=k=0;
+ for (i=0;i<MAXTCPPORT;i++) if (tcppb[i]>k) { k=tcppb[i]; l=i; }
+ if (k==0) break;
+ if (k>1024*1024) fprintf(f," %04d:%4.1fk/%-5.1f M",l,(float)tcppp[l]/1024,(float)k/(1024*1024));
+ else if (k>1024) fprintf(f," %04d:%4ld/%-5.1f k",l,tcppp[l],(float)k/1024);
+ else fprintf(f," %04d:%4ld/%-7ld",l,tcppp[l],k);
+ tcppb[l]=0;
+ ++j;
+ }
+ }
+
+ for (i=0; i<MAXHASH; i++) {
+ tai=acc + i;
+ if ((tai->from!=0) && (tai->to!=0)) { ++k;
+ if (!iSum) {
+ dstaddr.sin_addr.s_addr = htonl(*(iph+tai->from));
+ srcaddr.sin_addr.s_addr = htonl(*(iph+(tai->to)));
+ strcpy(str,inet_ntoa(dstaddr.sin_addr));
+ if (iScreen && (++lin<iline) ) printf("\n%-15s\t%-15s\t%5d pkt, %10ld byte :%7.2f Kbps",str,inet_ntoa(srcaddr.sin_addr),tai->pkt,tai->byte,((float)tai->byte)/ti/1024*8);
+ if (f) fprintf(f,"%-15s\t%-15s\t%d\t%ld\n",str,inet_ntoa(srcaddr.sin_addr),tai->pkt,tai->byte);
+ }
+ }
+ }
+ if (iScreen) printf("\n");
+#ifdef LINUX
+ if (iScreen) fflush(stdout);
+#endif
+ ClearIPAcc();
+ if (f) {
+ char cmdline[255];
+ fclose(f);
+// if (*execname) _spawnle(_P_NOWAIT,execname,execname,filename);
+// if (*execname) _execl(execname,execname);
+ if (*execname) {
+#ifndef LINUX
+ sprintf(cmdline,"%s %s",execname,filename);
+#else
+ sprintf(cmdline,"%s %s",execname,filename);
+#endif
+ system(cmdline);
+// iRun=0;
+ }
+ }
+ f=NULL;
+ return 0;
+}
+
+unsigned short FindIPHash( unsigned long ip ) {
+ unsigned short hashval;
+ unsigned long *ipt;
+
+ hashval = (unsigned short)(((ip&0xFFFF0000)>>16) ^ (ip&0x0000FFFF));
+ ipt=iph + hashval;
+ while (*ipt != 0 && (*ipt!=ip)) { ipt++; hashval++; }
+ if (*ipt==0) *ipt=ip;
+ return hashval;
+}
+
+unsigned short SetIPAcc( unsigned long src, unsigned long dst, unsigned long byte, unsigned short typ, unsigned short sport, unsigned short dport) {
+ unsigned short from,to,hash;
+ ta *tai;
+ hash=0;
+ if (src) {
+
+ if (fromip) from=FindIPHash(src); else from=-1;
+ if (toip) to=FindIPHash(dst); else to=-1;
+ hash=from^to;
+ tai=acc + hash;
+ while ( ((tai->from!=from) && (tai->to!=to)) && ((tai->from!=0) && (tai->to!=0)) ) {tai++; hash++; }
+ if ((tai->from==0)&&(tai->to==0)) {
+ tai->byte=byte; tai->from=from; tai->to=to; tai->pkt=1;
+ } else { tai->byte+=byte; tai->pkt++; }
+
+ typp[typ]++;
+ typb[typ]+=byte;
+ if ((sport>0) && (sport<MAXTCPPORT)) { tcppp[sport]++; tcppb[sport]+=byte; }
+ if ((dport>0) && (dport<MAXTCPPORT)) { tcppp[dport]++; tcppb[dport]+=byte; }
+ }
+ return hash;
+}
+
+//
+// Function: DecodeIPHeader
+//
+// Description:
+// This function takes a pointer to an IP header and prints
+// it out in a readable form.
+//
+int DecodeIPHeader(WSABUF *wsabuf, unsigned int srcip, unsigned short srcport, unsigned long srcnet,
+ unsigned int destip, unsigned short destport, unsigned long destnet, DWORD bytesret,
+ unsigned short xport,unsigned int xip, unsigned long xnet)
+{
+ BYTE *hdr = (BYTE *)wsabuf->buf,
+ *nexthdr = NULL,
+ *ohdr;
+ unsigned short shortval;
+ SOCKADDR_IN srcaddr,
+ destaddr;
+
+ unsigned short ip_version,
+ ip_hdr_len,
+ ip_tos,
+ ip_total_len,
+ ip_id,
+ ip_flags,
+ ip_ttl,
+ ip_frag_offset,
+ ip_proto,
+ ip_hdr_chksum,
+ ip_src_port,
+ ip_dest_port;
+ unsigned int ip_src,
+ ip_dest;
+ BOOL bPrint = FALSE;
+ char ip_prtype=0;
+ int j;
+ time_t tt;
+ struct tm *tmm;
+
+ ohdr=hdr;
+ if (iLnxplus) ip_prtype=*(hdr+iLnxplus-1);
+ if (ip_prtype) return 0;
+ hdr += iLnxplus;
+ ip_version = HI_WORD(*hdr);
+ ip_hdr_len = LO_WORD(*hdr) * 4;
+ nexthdr = (BYTE *)((BYTE *)hdr + ip_hdr_len);
+ hdr++;
+
+ ip_tos = *hdr;
+ hdr++;
+
+ memcpy(&shortval, hdr, 2);
+ ip_total_len = ntohs(shortval);
+ hdr += 2;
+
+ memcpy(&shortval, hdr, 2);
+ ip_id = ntohs(shortval);
+ hdr += 2;
+
+ ip_flags = ((*hdr) >> 5);
+
+ memcpy(&shortval, hdr, 2);
+ ip_frag_offset = ((ntohs(shortval)) & 0x1FFF);
+ hdr += 2;
+
+ ip_ttl = *hdr;
+ hdr++;
+
+ ip_proto = *hdr;
+ hdr++;
+
+ memcpy(&shortval, hdr, 2);
+ ip_hdr_chksum = ntohs(shortval);
+ hdr += 2;
+
+ memcpy(&srcaddr.sin_addr.s_addr, hdr, 4);
+ ip_src = ntohl(srcaddr.sin_addr.s_addr);
+ hdr += 4;
+
+ memcpy(&destaddr.sin_addr.s_addr, hdr, 4);
+ ip_dest = ntohl(destaddr.sin_addr.s_addr);
+ hdr += 4;
+ //
+ // If packet is UDP, TCP, or IGMP read ahead and
+ // get the port values.
+ //
+ ip_src_port=ip_dest_port=0;
+ if (((ip_proto == 2) ||
+ (ip_proto == 6) ||
+ (ip_proto == 17)) ) //&& bFilter)
+ {
+ memcpy(&ip_src_port, nexthdr, 2);
+ ip_src_port = ntohs(ip_src_port);
+ memcpy(&ip_dest_port, nexthdr+2, 2);
+ ip_dest_port = ntohs(ip_dest_port);
+
+ };
+ bPrint = 0;
+// xaok= (xip!=0) && (((xip&xnet)==(ip_src&xnet))||((xip&xnet)==(ip_dest&xnet)));
+// saok= ((srcip==0)||((srcip&srcnet)==(ip_src&srcnet)));
+// daok = ((destip==0)||((destip&destnet)==(ip_dest&destnet)));
+// xpok=(xport!=0) && ((xport==ip_src_port)||(xport==ip_dest_port));
+// spok=((srcport==0)||(srcport == ip_src_port));
+// dpok=((destport==0)||(destport == ip_dest_port));
+//printf("\nf:%d xa:%d sa:%d da:%d xp:%d sp:%d dp:%d",bFilter,xaok,saok,daok,xpok,spok,dpok);
+// if (!bFilter || ( (xaok||(saok&&daok)) && (xpok||(spok&&dpok)))) {
+if ((!bFilter) || ((ip_proto==47)&&gre) ||
+ (
+ ((iProto==0)||(ip_proto==iProto)) &&
+ (
+ ((xip!=0) && (((xip&xnet)==(ip_src&xnet))||((xip&xnet)==(ip_dest&xnet)))
+ ) || (
+ ((srcip==0) || ((srcip&srcnet)==(ip_src&srcnet))) && ((destip==0)||((destip&destnet)==(ip_dest&destnet)))
+ )
+ )
+ &&
+ (
+ ((xport!=0) && ((xport==ip_src_port)||(xport==ip_dest_port))
+ ) || (
+ ((srcport==0)||(srcport == ip_src_port))&&((destport==0)||(destport == ip_dest_port))
+ )
+ )
+ )
+ ) {
+ if (! iDetail) {
+ if ((ip_proto==47)&&gre) {
+ *mypbuff=0;
+ DecodeGREHeader(wsabuf, ip_hdr_len, bytesret,
+ srcip,srcport,srcnet,destip,destport,destnet,xport,xip,xnet);
+// SetIPAcc(0,0,0,0,0,0);
+ return ip_hdr_len;
+ }
+ SetIPAcc(ip_src,ip_dest,ip_total_len,ip_proto,ip_src_port,ip_dest_port);
+ }
+ else bPrint=TRUE;
+// printf("%d %ld %ld %ld %ld",ip_proto,xip,xip&xnet,ip_src&xnet,ip_dest&xnet);
+ } else {
+ if (! iDetail) SetIPAcc(0,0,0,0,0,0);
+// else bPrint=TRUE;
+ }
+ time(&tt);
+ if ((!iSum && ( tt-elapsed > iCycle)) || !iRun || mostird) {
+ mostird=0;
+ if (! iDetail) CloseIPAcc(tt-elapsed-1);
+ else {
+ time(&elapsed);
+ if (f) fclose(f);
+ if (iFile) f=fopen(filename,"a");
+ }
+ }
+ if (lNum) { if (--lNum <= 0) iRun=0; }
+
+ //
+ *pbuf=0;
+ if (bPrint) {
+ tmm=localtime(&tt);
+if (! nomac ) {
+ strcpy(pbuf,mypbuff);
+} else {
+ sprintf(str,"\n%4.4d.%2.2d.%2.2d %2.2d:%2.2d:%2.2d ",
+ tmm->tm_year+1900,tmm->tm_mon+1,tmm->tm_mday,tmm->tm_hour,tmm->tm_min,tmm->tm_sec);
+ strcat(pbuf,str);
+#ifdef LINUX
+ sprintf(str,"%x:%x:%x:%x:%x:%x > %x:%x:%x:%x:%x:%x",*ohdr,*(ohdr+1),*(ohdr+2),*(ohdr+3),*(ohdr+4),*(ohdr+5),
+ *(ohdr+6),*(ohdr+7),*(ohdr+8),*(ohdr+9),*(ohdr+10),*(ohdr+11));
+ strcat(pbuf,str);
+#endif
+}
+ sprintf(str," %d bytes\n%-15s>", ip_total_len, inet_ntoa(srcaddr.sin_addr));
+ strcat(pbuf,str);
+ sprintf(str,"%-15s", inet_ntoa(destaddr.sin_addr));
+ strcat(pbuf,str);
+ sprintf(str," TTL:%-3d Proto:%-6s F:%d/%d TOS:%X%X\n",
+ ip_ttl, szProto[ip_proto],ip_flags,ip_frag_offset,HI_WORD(ip_tos), LO_WORD(ip_tos));
+ strcat(pbuf,str);
+ if (iFile) strcat(pbuf,".");
+ strcpy(mypbuff,pbuf);
+
+ }
+ else return ip_hdr_len;
+
+ if (justheader) { if (*pbuf) fprintf(iFile?f:stdout,"%s",pbuf); return ip_hdr_len; }
+ if (iDetail) {
+ switch (ip_proto) {
+ case 1: // ICMP
+ j=DecodeICMPHeader(wsabuf, ip_hdr_len);
+ break;
+ case 2: // IGMP
+ j=DecodeIGMPHeader(wsabuf, ip_hdr_len);
+ break;
+ case 6: // TCP
+ j=DecodeTCPHeader(wsabuf, ip_hdr_len);
+ break;
+ case 17: // UDP
+ j=DecodeUDPHeader(wsabuf, ip_hdr_len);
+ break;
+ case 47: // UDP
+ j=DecodeGREHeader(wsabuf, ip_hdr_len, bytesret,
+ srcip,srcport,srcnet,destip,destport,destnet,xport,xip,xnet);
+ break;
+ default:
+ j=0; hdr=(BYTE *)wsabuf->buf;
+ sprintf(str," No decoder installed for protocol\n");
+ strcat(pbuf,str);
+ break;
+ }
+ if (j>=0) PrintRawBytes(hdr+j,bytesret-j-ip_hdr_len-12); //(hdr-(BYTE *)(wsabuf->buf + iLnxplus)));
+ }
+ else if (*pbuf) fprintf(iFile?f:stdout,"%s",pbuf);
+
+ return ip_hdr_len;
+}
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-24 22:23:56 +0000