void processPacket(u_char *args, const struct pcap_pkthdr* pkthdr, const u_char* packet)
{
Sniffer *snf = (Sniffer *)args;
map<string, ConnInfo>::iterator it;
u_long dstIp = snf->getDstIpRaw(packet);
int dstPort = snf->getTcpDstPort(packet);
if(snf->isRst(packet)) {
if(v)cout << "Got RST-ACK packet from " << snf->getSrcIp(packet) << " to " << snf->getDstIp(packet) << endl;
} else if(snf->isFin(packet)) {
if(v)cout << "Got FIN-ACK packet from " << snf->getSrcIp(packet) << " to " << snf->getDstIp(packet) << endl;
pthread_mutex_lock(&connMutex);
it = connsEstab.find(connId(dstIp, dstPort));
if(it != connsEstab.end()) { // we received FIN for an established TCP connection
connsEstab.erase(it); // delete the established connections
pthread_mutex_unlock(&connMutex);
pthread_mutex_lock(&countMutex);
(*snf->finNo)++; // increase number of finished connections
pthread_mutex_unlock(&countMutex);
} else {
pthread_mutex_unlock(&connMutex);
}
} else {
if(v)cout << "Got SYN-ACK packet from " << snf->getSrcIp(packet) << " to " << snf->getDstIp(packet) << endl;
}
pthread_mutex_lock(&connMutex);
it = connsInited.find(connId(dstIp, dstPort));
if(it != connsInited.end()) {
if(v)cout << "Found session " << endl;
connsInited.erase(it);
pthread_mutex_unlock(&connMutex);
if(snf->isRst(packet)) {
pthread_mutex_lock(&countMutex);
(*snf->rstNo)++;
pthread_mutex_unlock(&countMutex);
return;
} else if(snf->isFin(packet)) {
pthread_mutex_lock(&countMutex);
(*snf->finNo)++;
pthread_mutex_unlock(&countMutex);
return;
}
Pkt pkt; //This is the ACK packet that we send
pkt.srcIp = snf->getDstIpRaw(packet);
pkt.dstIp = snf->getSrcIpRaw(packet);
pkt.srcPort = snf->getTcpDstPort(packet);
pkt.dstPort = snf->getTcpSrcPort(packet);
pkt.seqn = snf->getTcpACK(packet);
pkt.ackn = snf->getTcpSEQ(packet) + 1;
pthread_mutex_lock(&ackMutex);
pktsToSend.push_back(pkt); //ACKs will be sent from this queue (to complete 3-way handshake)
pthread_mutex_unlock(&ackMutex);
} else {
pthread_mutex_unlock(&connMutex);
}
}
void* capEngineThread(void *arg)
{
if(v)cout << "Capture Engine started " << endl;
Sniffer *snf = (Sniffer *)arg;
snf->readPackets(processPacket, (u_char *)arg);
if(v)cout << "Capture Engine stopped " << endl;
return 0;
}
void *thread_proc(void *param) {
// IP address is our parameter.
sniffer_data *data = (sniffer_data*)param;
Sniffer *sniffer = data->first;
sniffer->set_filter("tcp and ip src " + data->second + " and tcp[tcpflags] & (tcp-rst|tcp-syn) != 0");
// Sniff loop. Only sniff TCP PDUs comming from the given IP and have either RST or SYN flag on.
sniffer->sniff_loop(handler);
return 0;
}
void SnifferConfiguration::configure_sniffer_post_activation(Sniffer& sniffer) const
{
if ((_flags & PACKET_FILTER) != 0) {
if (!sniffer.set_filter(_filter)) {
throw std::runtime_error("Could not set the filter! ");
}
}
if (!sniffer.set_direction(_direction)) {
throw std::runtime_error("Could not set the direction! ");
}
}
int main(int argc, char *argv[])
{
Sniffer snfr;
snfr.startCapturing();
while(1)
{
cout<<"Packet Count : "<<PacketList::packetList.size()<<endl;
sleep(1);
}
return 0;
}
void SnifferConfiguration::configure_sniffer_post_activation(Sniffer& sniffer) const {
if ((flags_ & PACKET_FILTER) != 0) {
if (!sniffer.set_filter(filter_)) {
throw invalid_pcap_filter(pcap_geterr(sniffer.get_pcap_handle()));
}
}
// TODO: see how to actually do this on winpcap
#ifndef _WIN32
if ((flags_ & DIRECTION) != 0) {
if (!sniffer.set_direction(direction_)) {
throw pcap_error(pcap_geterr(sniffer.get_pcap_handle()));
}
}
#endif // _WIN32
}
void arp_monitor::run(Sniffer& sniffer) {
sniffer.sniff_loop(
bind(
&arp_monitor::callback,
this,
std::placeholders::_1
)
);
}
void SnifferConfiguration::configure_sniffer_pre_activation(Sniffer& sniffer) const {
sniffer.set_snap_len(snap_len_);
sniffer.set_timeout(timeout_);
if ((flags_ & BUFFER_SIZE) != 0) {
sniffer.set_buffer_size(buffer_size_);
}
if ((flags_ & PROMISCUOUS) != 0) {
sniffer.set_promisc_mode(promisc_);
}
if ((flags_ & RFMON) != 0) {
sniffer.set_rfmon(rfmon_);
}
if ((flags_ & IMMEDIATE_MODE) != 0) {
sniffer.set_immediate_mode(immediate_mode_);
}
}
void SnifferConfiguration::configure_sniffer_pre_activation(Sniffer& sniffer) const
{
sniffer.set_snap_len(_snap_len);
sniffer.set_timeout(_timeout);
if ((_flags & BUFFER_SIZE) != 0) {
sniffer.set_buffer_size(_buffer_size);
}
if ((_flags & PROMISCUOUS) != 0) {
sniffer.set_promisc_mode(_promisc);
}
if ((_flags & RFMON) != 0) {
sniffer.set_rfmon(_rfmon);
}
if ((_flags & IMMEDIATE_MODE) != 0) {
sniffer.set_immediate_mode(_immediate_mode);
}
}
extern "C" DLL_EXPORT void AddDestinationIP(std::string NewIP)
{
RSSniffer.AddDestinationIP(NewIP);
}
extern "C" DLL_EXPORT int GetInterface()
{
return RSSniffer.GetInterface();
}
extern "C" DLL_EXPORT bool Initialize()
{
return RSSniffer.Initialize();
}
extern "C" DLL_EXPORT void DeInitialize()
{
RSSniffer.DeInitialize();
}
extern "C" DLL_EXPORT void ListenDestination(bool Listen)
{
RSSniffer.ListenDestination(Listen);
}
extern "C" DLL_EXPORT void SetInterface(int Interf)
{
RSSniffer.SetInterface(Interf);
}
extern "C" DLL_EXPORT void FilterIP(bool FilterIPs)
{
RSSniffer.FilterIP(FilterIPs);
}
extern "C" DLL_EXPORT void ListenSource(bool Listen)
{
RSSniffer.ListenSource(Listen);
}
int main(int argc, char *argv[])
{
std::cout << "PACMAN v" << "0.0.0.0.1" << std::endl;
options tcpOptions;
tcpOptions.get_options(argc, argv);
tcpOptions.print_options();
Sniffer mySniffer;
mySniffer.log("tcpdump starting up!");
//check if we should print out pcap capabile devices
if ( tcpOptions.is_ls )
{
mySniffer.log( "Server started with -ls option printing devices and halting..." );
mySniffer.printDevices();
exit(-1);
}
if(tcpOptions.is_filter)
mySniffer.setFilter(std::string(tcpOptions.get_filter()));
if(tcpOptions.is_pcapDev)
mySniffer.setInputDevice(std::string(tcpOptions.get_pcapDev()));
else if(tcpOptions.is_inputPcapFile)
mySniffer.setInputPcapFile(std::string(tcpOptions.get_inputPcapFile()));
if(tcpOptions.is_outputPcapFile)
mySniffer.setOutPcapFile(std::string(tcpOptions.get_outputPcapFile()));
mySniffer.start();
int count = 0;
while(count++ < 10)
{
Packet p = mySniffer.popPacket();
std::cout<<"Packet count:"<<count<<std::endl;
}
std::cout << "Done" << std::endl;
mySniffer.stop();
mySniffer.log( "tcpdump halting!" );
return 0;
}
extern "C" DLL_EXPORT void Stop()
{
RSSniffer.Stop();
}
extern "C" DLL_EXPORT void RemoveSourceIP(std::string OldIP)
{
RSSniffer.RemoveSourceIP(OldIP);
}
extern "C" DLL_EXPORT void RemoveDestinationIP(std::string OldIP)
{
RSSniffer.RemoveDestinationIP(OldIP);
}
extern "C" DLL_EXPORT std::string GetIP(std::string Address)
{
return RSSniffer.GetIP(Address);
}
extern "C" DLL_EXPORT void AddSourceIP(std::string NewIP)
{
RSSniffer.AddSourceIP(NewIP);
}
int main()
{
Sniffer sniffer;
sniffer.startSniffer(".");
sniffer.saveFiles();
std::set<std::string> filelist = sniffer.getSniffedFiles();
std::set<std::string> t4ports = sniffer.getTcp4();
std::set<std::string> u4ports = sniffer.getUdp4();
std::set<std::string> t6ports = sniffer.getTcp6();
std::set<std::string> u6ports = sniffer.getUdp6();
sniffer.saveProcesses();
sniffer.savetcp4Ports();
sniffer.savetcp6Ports();
sniffer.saveudp4Ports();
sniffer.saveudp6Ports();
std::cin.get();
return 0;
}
