Getting the source
==================

$ git clone git://github.com/sch3m4/libntoh.git ~/libntoh-ro
Cloning into '/home/<user>/libntoh-ro'...
remote: Counting objects: 70, done.
remote: Compressing objects: 100% (64/64), done.
remote: Total 70 (delta 31), reused 34 (delta 2)
Receiving objects: 100% (70/70), 46.61 KiB | 39 KiB/s, done.
Resolving deltas: 100% (31/31), done.
$


Introduction
============

Q: What is libntoh?
A: Libntoh aims to be an user-friendly library to provide a easy way to perform defragmentation and reassembly of network/transport/(more?) protocols.

Q: Why libntoh?
A: It's true there are some libraries which aims to do the same things (like libnids), but libntoh is intended to provide a flexible, thread-safe and highly configurable environment for the final user. And most of all, libntoh is released under Modified BSD License to avoid many license issues.

Q: Which protocols does libntoh support?
A: Currently libntoh performs IPv4 defragmentation and TCP reassembly


Dependencies
============

To successfully compile libntoh you only need gcc, make, cmake, pkg-config and libpthread-dev.

Debian-like OS:

	$ sudo apt-get install cmake libpthread-dev gcc make build-essential pkg-config

If you want to generate the source code documentation, you will also need doxygen:

	$ sudo apt-get install doxygen

Note: pkg-config isn't really needed but it helps. (See "ntohexample" compilation)


You need CMake to compile libntoh and ntohexample.


Compilation instructions
========================

../src$ mkdir build
../src$ cd build
../src/build$ cmake ../
(...)
../src/build$ make
(...)
../src/build$ sudo make install
[sudo] password for sch3m4: 
(...)
../src/build$

For a more detailed description refer to
	https://github.com/sch3m4/libntoh/wiki	
	

"ntohexample" Compilation instructions
======================================

../libntoh$ cd example
../libntoh/example$ ./build.sh 
[i] pkg-config found: /usr/bin/pkg-config
[i] cmake found: /usr/bin/cmake
[i] make found: /usr/bin/make
[i] PKG_CONFIG_PATH set to: /usr/local/lib/pkgconfig
(...)
Linking C executable ntohexample
[100%] Built target ntohexample
../libntoh/example$

The default installation prefix is "/usr/local", so if you plan to link against libntoh using pkg-config
remember to add "/usr/local/lib/pkgconfig" to PKG_CONFIG_PATH:

$ export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
$ pkg-config --libs --cflags ntoh
-I/usr/local/include/libntoh  -L/usr/local/lib -lntoh

On the other hand you can change the installation prefix by defining CMAKE_INSTALL_PREFIX:

$ cmake ../ -DCMAKE_INSTALL_PREFIX=/usr

So the new installation prefix will be "/usr"

For more information, refer to the wiki page.


"ntohexample" Output:
=====================

$ sudo ./ntohexample 

###########################
#     libntoh Example     #
# ----------------------- #
# Written by Chema Garcia #
# ----------------------- #
#  http://safetybits.net  #
#   chema@safetybits.net  #
#   sch3m4@brutalsec.net  #
###########################

[i] libntoh version: 0.4a

[+] Usage: ./ntohexample <options>

+ Options:
	-i | --iface <val> -----> Interface to read packets from
	-f | --file <val> ------> File path to read packets from
	-F | --filter <val> ----> Capture filter (must contain "tcp" or "ip")
	-c | --client ----------> Receive client data only
	-s | --server ----------> Receive server data only

$ sudo ./ntohexample -i eth0 -F "tcp and host 10.0.0.1 and port 22"

###########################
#     libntoh Example     #
# ----------------------- #
# Written by Chema Garcia #
# ----------------------- #
#  http://safetybits.net  #
#   chema@safetybits.net  #
#   sch3m4@brutalsec.net  #
###########################

[i] libntoh version: 0.4a

[i] Source: eth0 / Ethernet
[i] Filter: tcp and host 10.0.0.1 and port 22
[i] Receive data from client: Yes
[i] Receive data from server: Yes
[i] Max. TCP streams allowed: 1024
[i] Max. IPv4 flows allowed: 1024


[SYN Sent] 10.0.0.2:40819 (SYN Sent | Window: 233600) ---> 10.0.0.1:22 (Listen | Window: 0)
	
[SYN Rcv] 10.0.0.1:22 (SYN Rcv | Window: 4194240) ---> 10.0.0.2:40819 (SYN Sent | Window: 233600)
	
[Established] 10.0.0.2:40819 (Established | Window: 233600) ---> 10.0.0.1:22 (Established | Window: 4194240)
	
[Established] 10.0.0.1:22 (Established | Window: 4194240) ---> 10.0.0.2:40819 (Established | Window: 233600)
	+ Data segment | Bytes: 49 SEQ: 1 ACK: 1 Next SEQ: 50
		
[Established] 10.0.0.2:40819 (Established | Window: 233600) ---> 10.0.0.1:22 (Established | Window: 4193384)
	+ Data segment | Bytes: 32 SEQ: 1 ACK: 50 Next SEQ: 33
		
[Established] 10.0.0.1:22 (Established | Window: 4194240) ---> 10.0.0.2:40819 (Established | Window: 233600)
	+ Data segment | Bytes: 856 SEQ: 50 ACK: 33 Next SEQ: 906
		
[Established] 10.0.0.2:40819 (Established | Window: 233600) ---> 10.0.0.1:22 (Established | Window: 4194240)
	+ Data segment | Bytes: 1272 SEQ: 33 ACK: 906 Next SEQ: 1305
		
[Established] 10.0.0.2:40819 (Established | Window: 233600) ---> 10.0.0.1:22 (Established | Window: 4193928)
	+ Data segment | Bytes: 80 SEQ: 1305 ACK: 906 Next SEQ: 1385
		
[Established] 10.0.0.1:22 (Established | Window: 4194240) ---> 10.0.0.2:40819 (Established | Window: 233600)
	+ Data segment | Bytes: 312 SEQ: 906 ACK: 1385 Next SEQ: 1218
		
[Established] 10.0.0.2:40819 (Established | Window: 233600) ---> 10.0.0.1:22 (Established | Window: 4194240)
	+ Data segment | Bytes: 16 SEQ: 1385 ACK: 1218 Next SEQ: 1401
		
[Established] 10.0.0.2:40819 (Established | Window: 233600) ---> 10.0.0.1:22 (Established | Window: 4194192)
	+ Data segment | Bytes: 48 SEQ: 1401 ACK: 1218 Next SEQ: 1449
		
[Established] 10.0.0.1:22 (Established | Window: 4194240) ---> 10.0.0.2:40819 (Established | Window: 233600)
	+ Data segment | Bytes: 48 SEQ: 1218 ACK: 1449 Next SEQ: 1266
		
[Established] 10.0.0.2:40819 (Established | Window: 233600) ---> 10.0.0.1:22 (Established | Window: 4194176)
	+ Data segment | Bytes: 64 SEQ: 1449 ACK: 1266 Next SEQ: 1513
		
[Established] 10.0.0.1:22 (Established | Window: 4194240) ---> 10.0.0.2:40819 (Established | Window: 233600)
	+ Data segment | Bytes: 64 SEQ: 1266 ACK: 1513 Next SEQ: 1330
		
[Established] 10.0.0.2:40819 (Established | Window: 233600) ---> 10.0.0.1:22 (Established | Window: 4193920)
	+ Data segment | Bytes: 368 SEQ: 1513 ACK: 1330 Next SEQ: 1881
		
[Established] 10.0.0.1:22 (Established | Window: 4194240) ---> 10.0.0.2:40819 (Established | Window: 233600)
	+ Data segment | Bytes: 320 SEQ: 1330 ACK: 1881 Next SEQ: 1650
		
[Established] 10.0.0.2:40819 (Established | Window: 233600) ---> 10.0.0.1:22 (Established | Window: 4194208)
	+ Data segment | Bytes: 640 SEQ: 1881 ACK: 1650 Next SEQ: 2521
		
[Established] 10.0.0.1:22 (Established | Window: 4194240) ---> 10.0.0.2:40819 (Established | Window: 233600)
	+ Data segment | Bytes: 32 SEQ: 1650 ACK: 2521 Next SEQ: 1682
		
[Established] 10.0.0.2:40819 (Established | Window: 233600) ---> 10.0.0.1:22 (Established | Window: 4194192)
	+ Data segment | Bytes: 128 SEQ: 2521 ACK: 1682 Next SEQ: 2649
		
[Established] 10.0.0.1:22 (Established | Window: 4194240) ---> 10.0.0.2:40819 (Established | Window: 233488)
	+ Data segment | Bytes: 48 SEQ: 1682 ACK: 2649 Next SEQ: 1730
		
[Established] 10.0.0.2:40819 (Established | Window: 233600) ---> 10.0.0.1:22 (Established | Window: 4194160)
	+ Data segment | Bytes: 112 SEQ: 2649 ACK: 1730 Next SEQ: 2761
		
[Established] 10.0.0.1:22 (Established | Window: 4194208) ---> 10.0.0.2:40819 (Established | Window: 233600)
	+ Data segment | Bytes: 80 SEQ: 1730 ACK: 2761 Next SEQ: 1810
		
[Established] 10.0.0.1:22 (Established | Window: 4194240) ---> 10.0.0.2:40819 (Established | Window: 233600)
	+ Data segment | Bytes: 32 SEQ: 1810 ACK: 2761 Next SEQ: 1842
		
[Established] 10.0.0.1:22 (Established | Window: 4194240) ---> 10.0.0.2:40819 (Established | Window: 233568)
	+ Data segment | Bytes: 160 SEQ: 1842 ACK: 2761 Next SEQ: 2002
		
[Established] 10.0.0.2:40819 (Established | Window: 233536) ---> 10.0.0.1:22 (Established | Window: 4194240)
	+ Data segment | Bytes: 32 SEQ: 2761 ACK: 2002 Next SEQ: 2793
		
[Established] 10.0.0.2:40819 (Established | Window: 233600) ---> 10.0.0.1:22 (Established | Window: 4194240)
	+ Data segment | Bytes: 64 SEQ: 2793 ACK: 2002 Next SEQ: 2857
		
[Closing] 10.0.0.2:40819 (Fin Wait1 | Window: 233600) ---> 10.0.0.1:22 (Close Wait | Window: 4194240)
	
[Closing] 10.0.0.1:22 (Last ACK | Window: 4194240) ---> 10.0.0.2:40819 (Closing | Window: 233600)
	
[Closed] 10.0.0.2:40819 (Time Wait | Window: 233600) ---> 10.0.0.1:22 (Closed | Window: 4194240)

[+] Capture finished!
$