void hostmon(time_t facilitytime, char *ifptr)
{
int logging = options.logging;
struct ethtab table;
struct ethtabent *entry;
char scratch_saddr[ETH_ALEN];
char scratch_daddr[ETH_ALEN];
unsigned int idx = 1;
int is_ip;
int ch;
char *ifname = ifptr;
struct timeval tv;
struct timeval tv_rate;
time_t now = 0;
time_t statbegin = 0;
time_t startlog = 0;
struct timeval updtime;
struct eth_desc *list = NULL;
FILE *logfile = NULL;
int pkt_result;
WINDOW *sortwin;
PANEL *sortpanel;
int keymode = 0;
int fd;
if (ifptr && !dev_up(ifptr)) {
err_iface_down();
return;
}
LIST_HEAD(promisc);
if (options.promisc) {
promisc_init(&promisc, ifptr);
promisc_set_list(&promisc);
}
hostmonhelp();
initethtab(&table);
/* Ethernet description list */
struct eth_desc *elist = load_eth_desc(ARPHRD_ETHER);
/* FDDI description list */
struct eth_desc *flist = load_eth_desc(ARPHRD_FDDI);
if (logging) {
if (strcmp(current_logfile, "") == 0) {
strncpy(current_logfile,
gen_instance_logname(LANLOG, getpid()), 80);
if (!daemonized)
input_logfile(current_logfile, &logging);
}
}
if (logging) {
opentlog(&logfile, current_logfile);
if (logfile == NULL)
logging = 0;
}
if (logging) {
signal(SIGUSR1, rotate_lanlog);
rotate_flag = 0;
writelog(logging, logfile,
"******** LAN traffic monitor started ********");
}
leaveok(table.tabwin, TRUE);
fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
if(fd == -1) {
write_error("Unable to obtain monitoring socket");
goto err;
}
if(ifptr && dev_bind_ifname(fd, ifptr) == -1) {
write_error("Unable to bind interface on the socket");
goto err_close;
}
exitloop = 0;
gettimeofday(&tv, NULL);
tv_rate = tv;
updtime = tv;
statbegin = startlog = tv.tv_sec;
PACKET_INIT(pkt);
do {
gettimeofday(&tv, NULL);
now = tv.tv_sec;
unsigned long msecs = timeval_diff_msec(&tv, &tv_rate);
if (msecs >= 1000) {
printelapsedtime(statbegin, now, LINES - 3, 15,
table.borderwin);
updateethrates(&table, msecs, idx);
tv_rate = tv;
}
if (logging) {
check_rotate_flag(&logfile);
if ((now - startlog) >= options.logspan) {
writeethlog(table.head, now - statbegin,
logfile);
startlog = now;
}
}
if (screen_update_needed(&tv, &updtime)) {
update_panels();
doupdate();
updtime = tv;
}
if ((facilitytime != 0)
&& (((now - statbegin) / 60) >= facilitytime))
exitloop = 1;
if (packet_get(fd, &pkt, &ch, table.tabwin) == -1) {
write_error("Packet receive failed");
exitloop = 1;
break;
}
if (ch != ERR) {
if (keymode == 0) {
switch (ch) {
case KEY_UP:
scrollethwin(&table, SCROLLDOWN, &idx);
break;
case KEY_DOWN:
scrollethwin(&table, SCROLLUP, &idx);
break;
case KEY_PPAGE:
case '-':
pageethwin(&table, SCROLLDOWN, &idx);
break;
case KEY_NPAGE:
case ' ':
pageethwin(&table, SCROLLUP, &idx);
break;
case 12:
case 'l':
case 'L':
tx_refresh_screen();
break;
case 's':
case 'S':
show_hostsort_keywin(&sortwin,
&sortpanel);
keymode = 1;
break;
case 'q':
case 'Q':
case 'x':
case 'X':
case 27:
case 24:
exitloop = 1;
}
} else if (keymode == 1) {
del_panel(sortpanel);
delwin(sortwin);
sort_hosttab(&table, &idx, ch);
keymode = 0;
}
}
if (pkt.pkt_len <= 0)
continue;
char ifnamebuf[IFNAMSIZ];
pkt_result =
packet_process(&pkt, NULL, NULL, NULL,
MATCH_OPPOSITE_USECONFIG,
0);
if (pkt_result != PACKET_OK)
continue;
if (!ifptr) {
/* we're capturing on "All interfaces", */
/* so get the name of the interface */
/* of this packet */
int r = dev_get_ifname(pkt.pkt_ifindex, ifnamebuf);
if (r != 0) {
write_error("Unable to get interface name");
break; /* can't get interface name, get out! */
}
ifname = ifnamebuf;
}
/* get HW addresses */
switch (pkt.pkt_hatype) {
case ARPHRD_ETHER: {
memcpy(scratch_saddr, pkt.ethhdr->h_source, ETH_ALEN);
memcpy(scratch_daddr, pkt.ethhdr->h_dest, ETH_ALEN);
list = elist;
break; }
case ARPHRD_FDDI: {
memcpy(scratch_saddr, pkt.fddihdr->saddr, FDDI_K_ALEN);
memcpy(scratch_daddr, pkt.fddihdr->daddr, FDDI_K_ALEN);
list = flist;
break; }
default:
/* unknown link protocol */
continue;
}
switch(pkt.pkt_protocol) {
case ETH_P_IP:
case ETH_P_IPV6:
is_ip = 1;
break;
default:
is_ip = 0;
break;
}
/* Check source address entry */
entry = in_ethtable(&table, pkt.pkt_hatype,
scratch_saddr);
if (!entry)
entry = addethentry(&table, pkt.pkt_hatype,
ifname, scratch_saddr, list);
if (entry != NULL) {
updateethent(entry, pkt.pkt_len, is_ip, 1);
if (!entry->prev_entry->un.desc.printed)
printethent(&table, entry->prev_entry,
idx);
printethent(&table, entry, idx);
}
/* Check destination address entry */
entry = in_ethtable(&table, pkt.pkt_hatype,
scratch_daddr);
if (!entry)
entry = addethentry(&table, pkt.pkt_hatype,
ifname, scratch_daddr, list);
if (entry != NULL) {
updateethent(entry, pkt.pkt_len, is_ip, 0);
if (!entry->prev_entry->un.desc.printed)
printethent(&table, entry->prev_entry,
idx);
printethent(&table, entry, idx);
}
} while (!exitloop);
err_close:
close(fd);
err:
if (options.promisc) {
promisc_restore_list(&promisc);
promisc_destroy(&promisc);
}
if (logging) {
signal(SIGUSR1, SIG_DFL);
writeethlog(table.head, time(NULL) - statbegin, logfile);
writelog(logging, logfile,
"******** LAN traffic monitor stopped ********");
fclose(logfile);
}
del_panel(table.tabpanel);
delwin(table.tabwin);
del_panel(table.borderpanel);
delwin(table.borderwin);
update_panels();
doupdate();
destroyethtab(&table);
free_eth_desc(elist);
free_eth_desc(flist);
strcpy(current_logfile, "");
}
void hostmon(const struct OPTIONS *options, time_t facilitytime, char *ifptr,
struct filterstate *ofilter)
{
int logging = options->logging;
struct ethtab table;
struct ethtabent *entry;
char scratch_saddr[ETH_ALEN];
char scratch_daddr[ETH_ALEN];
unsigned int idx = 1;
int is_ip;
int ch;
char *ifname = ifptr;
struct timeval tv;
time_t starttime;
time_t now = 0;
unsigned long long unow = 0;
time_t statbegin = 0;
time_t startlog = 0;
time_t updtime = 0;
unsigned long long updtime_usec = 0;
struct eth_desc *list = NULL;
FILE *logfile = NULL;
int pkt_result;
WINDOW *sortwin;
PANEL *sortpanel;
int keymode = 0;
int instance_id;
int fd;
struct promisc_states *promisc_list;
if (!facility_active(LANMONIDFILE, ifptr))
mark_facility(LANMONIDFILE, "LAN monitor", ifptr);
else {
write_error("LAN station monitor already running on %s",
gen_iface_msg(ifptr));
return;
}
if (ifptr != NULL) {
if (!dev_up(ifptr)) {
err_iface_down();
unmark_facility(LANMONIDFILE, ifptr);
return;
}
}
if ((first_active_facility()) && (options->promisc)) {
init_promisc_list(&promisc_list);
save_promisc_list(promisc_list);
srpromisc(1, promisc_list);
destroy_promisc_list(&promisc_list);
}
adjust_instance_count(PROCCOUNTFILE, 1);
instance_id = adjust_instance_count(LANMONCOUNTFILE, 1);
hostmonhelp();
initethtab(&table, options->actmode);
/* Ethernet description list */
struct eth_desc *elist = load_eth_desc(ARPHRD_ETHER);
/* FDDI description list */
struct eth_desc *flist = load_eth_desc(ARPHRD_FDDI);
if (logging) {
if (strcmp(current_logfile, "") == 0) {
strncpy(current_logfile,
gen_instance_logname(LANLOG, instance_id), 80);
if (!daemonized)
input_logfile(current_logfile, &logging);
}
}
if (logging) {
opentlog(&logfile, current_logfile);
if (logfile == NULL)
logging = 0;
}
if (logging) {
signal(SIGUSR1, rotate_lanlog);
rotate_flag = 0;
writelog(logging, logfile,
"******** LAN traffic monitor started ********");
}
leaveok(table.tabwin, TRUE);
fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
if(fd == -1) {
write_error("Unable to obtain monitoring socket");
goto err;
}
if(ifptr && dev_bind_ifname(fd, ifptr) == -1) {
write_error("Unable to bind interface on the socket");
goto err_close;
}
exitloop = 0;
gettimeofday(&tv, NULL);
starttime = statbegin = startlog = tv.tv_sec;
PACKET_INIT(pkt);
do {
gettimeofday(&tv, NULL);
now = tv.tv_sec;
unow = tv.tv_sec * 1000000ULL + tv.tv_usec;
if ((now - starttime) >= 5) {
printelapsedtime(statbegin, now, LINES - 3, 15,
table.borderwin);
updateethrates(&table, options->actmode, starttime, now,
idx);
starttime = now;
}
if (logging) {
check_rotate_flag(&logfile);
if ((now - startlog) >= options->logspan) {
writeethlog(table.head, options->actmode,
now - statbegin, logfile);
startlog = now;
}
}
if (((options->updrate != 0)
&& (now - updtime >= options->updrate))
|| ((options->updrate == 0)
&& (unow - updtime_usec >= DEFAULT_UPDATE_DELAY))) {
update_panels();
doupdate();
updtime = now;
updtime_usec = unow;
}
if ((facilitytime != 0)
&& (((now - statbegin) / 60) >= facilitytime))
exitloop = 1;
if (packet_get(fd, &pkt, &ch, table.tabwin) == -1) {
write_error("Packet receive failed");
exitloop = 1;
break;
}
if (ch != ERR) {
if (keymode == 0) {
switch (ch) {
case KEY_UP:
scrollethwin(&table, SCROLLDOWN, &idx);
break;
case KEY_DOWN:
scrollethwin(&table, SCROLLUP, &idx);
break;
case KEY_PPAGE:
case '-':
pageethwin(&table, SCROLLDOWN, &idx);
break;
case KEY_NPAGE:
case ' ':
pageethwin(&table, SCROLLUP, &idx);
break;
case 12:
case 'l':
case 'L':
tx_refresh_screen();
break;
case 's':
case 'S':
show_hostsort_keywin(&sortwin,
&sortpanel);
keymode = 1;
break;
case 'q':
case 'Q':
case 'x':
case 'X':
case 27:
case 24:
exitloop = 1;
}
} else if (keymode == 1) {
del_panel(sortpanel);
delwin(sortwin);
sort_hosttab(&table, &idx, ch);
keymode = 0;
}
}
if (pkt.pkt_len > 0) {
char ifnamebuf[IFNAMSIZ];
pkt_result =
packet_process(&pkt, NULL, NULL, NULL,
ofilter,
MATCH_OPPOSITE_USECONFIG,
0);
if (pkt_result != PACKET_OK)
continue;
if (!ifptr) {
/* we're capturing on "All interfaces", */
/* so get the name of the interface */
/* of this packet */
int r = dev_get_ifname(pkt.pkt_ifindex, ifnamebuf);
if (r != 0) {
write_error("Unable to get interface name");
break; /* can't get interface name, get out! */
}
ifname = ifnamebuf;
}
/* get HW addresses */
switch (pkt.pkt_hatype) {
case ARPHRD_ETHER: {
struct ethhdr *hdr_eth =
(struct ethhdr *)pkt.pkt_buf;
memcpy(scratch_saddr, hdr_eth->h_source,
ETH_ALEN);
memcpy(scratch_daddr, hdr_eth->h_dest,
ETH_ALEN);
list = elist;
break; }
case ARPHRD_FDDI: {
struct fddihdr *hdr_fddi =
(struct fddihdr *)pkt.pkt_buf;
memcpy(scratch_saddr, hdr_fddi->saddr,
FDDI_K_ALEN);
memcpy(scratch_daddr, hdr_fddi->daddr,
FDDI_K_ALEN);
list = flist;
break; }
case ARPHRD_IEEE802:
case ARPHRD_IEEE802_TR: {
struct trh_hdr *hdr_trh =
(struct trh_hdr *)pkt.pkt_buf;
memcpy(scratch_saddr, hdr_trh->saddr,
TR_ALEN);
memcpy(scratch_daddr, hdr_trh->daddr,
TR_ALEN);
list = flist;
break; }
default:
/* unknown link protocol */
continue;
}
switch(pkt.pkt_protocol) {
case ETH_P_IP:
case ETH_P_IPV6:
is_ip = 1;
break;
default:
is_ip = 0;
break;
}
/* Check source address entry */
entry = in_ethtable(&table, pkt.pkt_hatype,
scratch_saddr);
if (!entry)
entry = addethentry(&table, pkt.pkt_hatype,
ifname, scratch_saddr, list);
if (entry != NULL) {
updateethent(entry, pkt.pkt_len, is_ip, 1);
if (!entry->prev_entry->un.desc.printed)
printethent(&table, entry->prev_entry,
idx);
printethent(&table, entry, idx);
}
/* Check destination address entry */
entry = in_ethtable(&table, pkt.pkt_hatype,
scratch_daddr);
if (!entry)
entry = addethentry(&table, pkt.pkt_hatype,
ifname, scratch_daddr, list);
if (entry != NULL) {
updateethent(entry, pkt.pkt_len, is_ip, 0);
if (!entry->prev_entry->un.desc.printed)
printethent(&table, entry->prev_entry,
idx);
printethent(&table, entry, idx);
}
}
} while (!exitloop);
err_close:
close(fd);
err:
if ((options->promisc) && (is_last_instance())) {
load_promisc_list(&promisc_list);
srpromisc(0, promisc_list);
destroy_promisc_list(&promisc_list);
}
adjust_instance_count(PROCCOUNTFILE, -1);
adjust_instance_count(LANMONCOUNTFILE, -1);
if (logging) {
signal(SIGUSR1, SIG_DFL);
writeethlog(table.head, options->actmode,
time(NULL) - statbegin, logfile);
writelog(logging, logfile,
"******** LAN traffic monitor stopped ********");
fclose(logfile);
}
del_panel(table.tabpanel);
delwin(table.tabwin);
del_panel(table.borderpanel);
delwin(table.borderwin);
update_panels();
doupdate();
destroyethtab(&table);
free_eth_desc(elist);
free_eth_desc(flist);
unmark_facility(LANMONIDFILE, ifptr);
strcpy(current_logfile, "");
}
