int analyzeTcp(u_char *data, int size){
u_char *ptr;
int lest;
struct tcphdr *tcphdr;
ptr = data;
lest = size;
if(lest < sizeof(struct tcphdr)){
fprintf(stderr, "lest(%d)<sizeof(struct tcphdr)\n", lest);
return -1;
}
tcphdr = (struct tcphdr *)ptr;
ptr += sizeof(struct tcphdr);
lest -= sizeof(struct tcphdr);
printTcp(tcphdr, stdout);
/*
if(tcphdr->rst == 1){
return -1;
}
*/
return 0;
}
void got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet)
{
const struct ether_header *ethernet;
const struct ip *ip;
const struct tcphdr *tcp;
const struct udphdr *udp;
struct arphdr *arp;
u_char* trame;
int size_ethernet = sizeof(struct ether_header);
int size_ip;
int size_tcp;
int size_trame;
int *vFlag = (int *) args;
ethernet = (struct ether_header*)(packet);
ip = (struct ip*)(packet+size_ethernet);
size_ip=IP_HL(ip)*4;
tcp = (struct tcphdr*)(packet+size_ip+size_ethernet);
size_tcp=sizeof(struct tcphdr);
udp = (struct udphdr*)(packet + sizeof(struct ether_header) + ip->ip_len*4);
arp = (struct arphdr*)(packet+14);
printf("Caught packet with length of [%d]\n", header->len);
printEther(ethernet,*vFlag);
switch(ntohs(ethernet->ether_type)){
case ETHERTYPE_IP:
case ETHERTYPE_IPV6:
printIP(ip, *vFlag);
switch(ip->ip_p)
{
case IPPROTO_TCP:
printTcp(tcp, *vFlag);
break;
case IPPROTO_UDP:
printUdp(udp, *vFlag);
if((ntohs(udp->source)==IPPORT_BOOTPS && ntohs(udp->dest)==IPPORT_BOOTPC) ||
(ntohs(udp->dest)==IPPORT_BOOTPS && ntohs(udp->source)==IPPORT_BOOTPC)){
printBootp((struct bootp*) (packet + sizeof(struct ether_header) + ip->ip_len*4+8),*vFlag);
}
else if(ntohs(udp->source)== 53 || ntohs(udp->dest)==53){
printDns((u_char *)packet + sizeof(struct ether_header) + size_ip+8,*vFlag,1);
}
break;
case IPPROTO_ICMP:
printf("ICMP");
break;
case IPPROTO_SCTP:
printf("SCTP");
break;
default:
printf("Unknown Protocol\n");
break;
}
break;
case ETHERTYPE_ARP:
printArp(arp, *vFlag);
break;
default:
printf("EtherType not handled\n");
}
trame = (u_char *)(packet + size_ethernet + size_ip + size_tcp);
size_trame = ntohs(ip->ip_len) - (size_ip + size_tcp);
if (size_trame > 0)
{
printf("DATA (%d bytes):\n", size_trame);
printAscii(trame, size_trame);
}
printf("\n");
printf("\n");
printf("\n");
return;
}
