MD read_pcap(std::string inFile,std::string target_ip,int quit_early, short exture_version){ unsigned target = ip_to_int(target_ip.c_str()); unsigned their_ip; long raw_time; long n = 20000000; //struct top2 *bbos = (struct top2 *)malloc(n*sizeof(struct top2)); printf("Parsing pcap file %s ... with target:: %u", inFile.c_str(),target); pcap_t *handle; char errbuf[PCAP_ERRBUF_SIZE]; //not sure what to do with this, oh well handle = pcap_open_offline(inFile.c_str(), errbuf); //call pcap library function MD md; if (handle == NULL) { fprintf(stderr,"Couldn't open pcap file %s: %s\n", inFile.c_str(), errbuf); return(md); } md.tick_data.reserve(20000000); const u_char *packet; struct pcap_pkthdr header; unsigned int pktNum(0); while (packet = pcap_next(handle, &header)) { u_char *pktPtr = (u_char *)packet; // Parse the header, grabbing the type field. int ether_type = ((int)(pktPtr[12]) << 8) | (int)pktPtr[13]; int ether_offset = 0; if (ether_type == ETHER_TYPE_IP) { //most common ether_offset = 14; } else { continue; } raw_time = header.ts.tv_sec * 1000000000 +header.ts.tv_usec*1000; //parse the IP header pktPtr += ether_offset; //skip past the Ethernet II header struct ip *ipHdr = (struct ip *)pktPtr; //point to an IP header structure int pktLen = ntohs(ipHdr->ip_len); int msg_type; //used to branch a0/a1/normal md accordingly tick bbo; if (ipHdr->ip_p == 17) { //UDP BRO //TCP MESSAGE EITHER TO OR FROM OUR TARGET IP msg_type = processUDP(pktNum,raw_time,ipHdr,pktLen,bbo,exture_version); if ( msg_type >= 1){ //bbos[pktNum] = bbo; md.tick_data.push_back(bbo); } } pktNum++; //increment number of packets seen if (unlikely(quit_early>0)&&(unlikely(pktNum>quit_early) || unlikely(pktNum>n))) break; } printf("\nParsed %u packets\n",pktNum); return md; pcap_close(handle); }
void VBoxNetBaseService::doReceiveLoop() { int rc; /* Well we're ready */ PINTNETRINGBUF pRingBuf = &m->m_pIfBuf->Recv; for (;;) { /* * Wait for a packet to become available. */ rc = waitForIntNetEvent(2000); if (rc == VERR_SEM_DESTROYED) break; if (RT_FAILURE(rc)) { if (rc == VERR_TIMEOUT || rc == VERR_INTERRUPTED) { /* do we want interrupt anyone ??? */ continue; } LogRel(("VBoxNetBaseService: waitForIntNetEvent returned %Rrc\n", rc)); AssertRCReturnVoid(rc); } /* * Process the receive buffer. */ PCINTNETHDR pHdr; while ((pHdr = IntNetRingGetNextFrameToRead(pRingBuf)) != NULL) { uint8_t const u8Type = pHdr->u8Type; size_t cbFrame = pHdr->cbFrame; switch (u8Type) { case INTNETHDR_TYPE_FRAME: { void *pvFrame = IntNetHdrGetFramePtr(pHdr, m->m_pIfBuf); rc = processFrame(pvFrame, cbFrame); if (RT_FAILURE(rc) && rc == VERR_IGNORED) { /* XXX: UDP + ARP for DHCP */ VBOXNETUDPHDRS Hdrs; size_t cb; void *pv = VBoxNetUDPMatch(m->m_pIfBuf, RTNETIPV4_PORT_BOOTPS, &m->m_MacAddress, VBOXNETUDP_MATCH_UNICAST | VBOXNETUDP_MATCH_BROADCAST | VBOXNETUDP_MATCH_CHECKSUM | (m->m_cVerbosity > 2 ? VBOXNETUDP_MATCH_PRINT_STDERR : 0), &Hdrs, &cb); if (pv && cb) processUDP(pv, cb); else VBoxNetArpHandleIt(m->m_pSession, m->m_hIf, m->m_pIfBuf, &m->m_MacAddress, m->m_Ipv4Address); } break; } case INTNETHDR_TYPE_GSO: { PCPDMNETWORKGSO pGso = IntNetHdrGetGsoContext(pHdr, m->m_pIfBuf); rc = processGSO(pGso, cbFrame); if (RT_FAILURE(rc) && rc == VERR_IGNORED) break; break; } case INTNETHDR_TYPE_PADDING: break; default: break; } IntNetRingSkipFrame(&m->m_pIfBuf->Recv); } /* loop */ } }