Ejemplo n.º 1
0
MD read_pcap(std::string inFile,std::string target_ip,int quit_early, short exture_version){
	
	unsigned target = ip_to_int(target_ip.c_str());
	unsigned their_ip;
	long raw_time; 
	long n = 20000000;
	//struct top2 *bbos = (struct top2 *)malloc(n*sizeof(struct top2));
	printf("Parsing pcap file %s ... with target:: %u", inFile.c_str(),target);
	pcap_t *handle;
	char errbuf[PCAP_ERRBUF_SIZE]; //not sure what to do with this, oh well
	handle = pcap_open_offline(inFile.c_str(), errbuf);   //call pcap library function


	MD md;


	if (handle == NULL) {
		fprintf(stderr,"Couldn't open pcap file %s: %s\n", inFile.c_str(), errbuf);
		return(md);
	}
	
	
	md.tick_data.reserve(20000000);

	const u_char *packet;
	struct pcap_pkthdr header;
	unsigned int pktNum(0);

	while (packet = pcap_next(handle, &header)) {
		u_char *pktPtr = (u_char *)packet;

		

		// Parse the header, grabbing the type field.
		int ether_type = ((int)(pktPtr[12]) << 8) | (int)pktPtr[13];
		int ether_offset = 0;

		if (ether_type == ETHER_TYPE_IP) { //most common
			ether_offset = 14;
		} else {
			continue;
		}

		raw_time = header.ts.tv_sec * 1000000000 +header.ts.tv_usec*1000;


		//parse the IP header
		pktPtr += ether_offset;  //skip past the Ethernet II header
		struct ip *ipHdr = (struct ip *)pktPtr; //point to an IP header structure
		int pktLen = ntohs(ipHdr->ip_len);
		int msg_type; //used to branch a0/a1/normal md accordingly

		tick bbo;
		
		if (ipHdr->ip_p == 17) { //UDP BRO
				//TCP MESSAGE EITHER TO OR FROM OUR TARGET IP
				msg_type = processUDP(pktNum,raw_time,ipHdr,pktLen,bbo,exture_version);
				if ( msg_type >= 1){
					//bbos[pktNum] = bbo;
					md.tick_data.push_back(bbo);
				}
		}

		pktNum++; //increment number of packets seen
		if (unlikely(quit_early>0)&&(unlikely(pktNum>quit_early) || unlikely(pktNum>n)))
			break;
	}
	printf("\nParsed %u packets\n",pktNum);
	return md;
	pcap_close(handle);
}	
Ejemplo n.º 2
0
void VBoxNetBaseService::doReceiveLoop()
{
    int rc;
    /* Well we're ready */
    PINTNETRINGBUF  pRingBuf = &m->m_pIfBuf->Recv;

    for (;;)
    {
        /*
         * Wait for a packet to become available.
         */
        rc = waitForIntNetEvent(2000);
        if (rc == VERR_SEM_DESTROYED)
            break;

        if (RT_FAILURE(rc))
        {
            if (rc == VERR_TIMEOUT || rc == VERR_INTERRUPTED)
            {
                /* do we want interrupt anyone ??? */
                continue;
            }
            LogRel(("VBoxNetBaseService: waitForIntNetEvent returned %Rrc\n", rc));
            AssertRCReturnVoid(rc);
        }

        /*
         * Process the receive buffer.
         */
        PCINTNETHDR pHdr;
        while ((pHdr = IntNetRingGetNextFrameToRead(pRingBuf)) != NULL)
        {
            uint8_t const u8Type = pHdr->u8Type;
            size_t        cbFrame = pHdr->cbFrame;
            switch (u8Type)
            {
                case INTNETHDR_TYPE_FRAME:
                {
                    void *pvFrame = IntNetHdrGetFramePtr(pHdr, m->m_pIfBuf);
                    rc = processFrame(pvFrame, cbFrame);
                    if (RT_FAILURE(rc) && rc == VERR_IGNORED)
                    {
                        /* XXX: UDP + ARP for DHCP */
                        VBOXNETUDPHDRS Hdrs;
                        size_t  cb;
                        void   *pv = VBoxNetUDPMatch(m->m_pIfBuf, RTNETIPV4_PORT_BOOTPS, &m->m_MacAddress,
                                                       VBOXNETUDP_MATCH_UNICAST
                                                     | VBOXNETUDP_MATCH_BROADCAST
                                                     | VBOXNETUDP_MATCH_CHECKSUM
                                                     | (m->m_cVerbosity > 2 ? VBOXNETUDP_MATCH_PRINT_STDERR : 0),
                                                     &Hdrs, &cb);
                        if (pv && cb)
                            processUDP(pv, cb);
                        else
                            VBoxNetArpHandleIt(m->m_pSession, m->m_hIf, m->m_pIfBuf, &m->m_MacAddress, m->m_Ipv4Address);
                    }
                    break;
                }
                case INTNETHDR_TYPE_GSO:
                {
                    PCPDMNETWORKGSO pGso = IntNetHdrGetGsoContext(pHdr, m->m_pIfBuf);
                    rc = processGSO(pGso, cbFrame);
                    if (RT_FAILURE(rc) && rc == VERR_IGNORED)
                        break;
                    break;
                }

                case INTNETHDR_TYPE_PADDING:
                    break;

                default:
                    break;
            }
            IntNetRingSkipFrame(&m->m_pIfBuf->Recv);
        } /* loop */
    }
}