Пример #1
0
static void PcapDissector(u_char *user, const struct pcap_pkthdr *h, const u_char *bytes)
{
    struct cap_ref *ref = (struct cap_ref *)user;
    packet *pkt;
    static time_t tm = 0;
    struct timespec to;
    unsigned long len;
    char tgl;

    pkt = PktNew();

    ref->cnt++;
    pkt->raw = DMemMalloc(h->caplen+sizeof(unsigned long)*2+sizeof(char *)+4);
    memcpy(pkt->raw, bytes, h->caplen);
    pkt->raw_len = h->caplen;
    /* align 4b */
    len = pkt->raw_len;
    len = len + 4 - (len%4);
    *((unsigned long *)&(pkt->raw[len])) = ref->dlt;
    *((unsigned long *)&(pkt->raw[len+sizeof(unsigned long)])) = ref->cnt;
    *((char **)(&(pkt->raw[len+sizeof(unsigned long)*2]))) = ref->file_name;
    if (h->ts.tv_sec < 0)
        pkt->cap_sec = 0;
    else
        pkt->cap_sec = h->ts.tv_sec;
    pkt->cap_usec = h->ts.tv_usec;
    pkt->serial = pkt_serial;
        
    /* crash info */
    crash_pkt_cnt = ref->cnt;
    crash_ref_name = ref->file_name;
    
    /* decode */
    if (!ciao)
        ProtDissec(pcap_prot_id, pkt);

    FlowSetGblTime(h->ts.tv_sec);
    /* next serial number */
    pkt_serial++;
    if (time(NULL) > tm) {
        tgl = 0;
        ReportSplash();
        while (DispatchPeiPending() > DISP_PEI_MAX_QUEUE) {
            tgl = (tgl + 1) % 4;
            to.tv_sec = 0;
            to.tv_nsec = 300000000;
            /* wait some time */
            while (nanosleep(&to, &to) != 0)
                ;
            if (tgl == 0)
                ReportSplash();
        }
        tm = time(NULL) + 2;
    }
}
Пример #2
0
static int SnoopDissector(FILE *fp, struct cap_ref *ref)
{
    struct snoop_packet_header hdr;
    unsigned long hlen, len;
    packet *pkt;
    time_t tm = 0;
    struct timespec to;

    while (1) {
        /* read header */
        hlen = fread(&hdr, 1, sizeof(struct snoop_packet_header), fp);
        if (hlen != sizeof(struct snoop_packet_header)) {
            if (hlen == 0)
                return 0;
            printf("Snoop file error\n");
            return -1;
        }
        pkt = PktNew();
        /* conver values */
        hdr.tlen = ntohl(hdr.tlen);
        hdr.len = ntohl(hdr.len);
        hdr.blen = ntohl(hdr.blen);
        hdr.secs = ntohl(hdr.secs);
        hdr.usecs = ntohl(hdr.usecs);
        len = hdr.blen - hlen;
        ref->cnt++;
        pkt->raw = DMemMalloc(len+sizeof(unsigned long)*2+sizeof(char *)+4);
        len = fread(pkt->raw, 1, len, fp);
        pkt->raw_len = len;
        /* align 4b */
        len = len + 4 - (len%4);
        *((unsigned long *)&(pkt->raw[len])) = ref->dlt;
        *((unsigned long *)&(pkt->raw[len+sizeof(unsigned long)])) = ref->cnt;
        *((char **)(&(pkt->raw[len+sizeof(unsigned long)*2]))) = ref->file_name;
        pkt->cap_sec = hdr.secs;
        pkt->cap_usec = hdr.usecs;
        pkt->serial = pkt_serial;
        
        /* crash info */
        crash_pkt_cnt = ref->cnt;
        crash_ref_name = ref->file_name;
        
        /* decode */
        if (!ciao)
            ProtDissec(pcap_prot_id, pkt);
        
        FlowSetGblTime(hdr.secs);
        /* next serial number */
        pkt_serial++;
        if (time(NULL) > tm) {
            ReportSplash();
            while (DispatchPeiPending() > DISP_PEI_MAX_QUEUE) {
                to.tv_sec = 0;
                to.tv_nsec = 300000000;
                /* wait some time */
                while (nanosleep(&to, &to) != 0)
                    ;
                ReportSplash();
            }
            tm = time(NULL) + 2;
        }
    }

    return 0;
}
Пример #3
0
static void PcapDissector(u_char *user, const struct pcap_pkthdr *h, const u_char *bytes)
{
    struct cap_ref *ref = (struct cap_ref *)user;
    int offset;
    packet *pkt;
    static time_t tm = 0;
    static time_t tstart = 0;
    static size_t tsize = 0;
    struct timespec to;
    FILE *fp;

    pkt = PktNew();
    
    ref->cnt++;
    pkt->raw = DMemMalloc(h->caplen+sizeof(unsigned long)*2+sizeof(char *)+sizeof(unsigned long)*2);
    memcpy(pkt->raw, bytes, h->caplen);
    pkt->raw_len = h->caplen;
    tsize += h->caplen;
    offset = 0;
    *((unsigned long *)&(pkt->raw[pkt->raw_len])) = ref->dlt;
    offset += sizeof(unsigned long);
    *((unsigned long *)&(pkt->raw[pkt->raw_len+offset])) = ref->cnt;
    offset += sizeof(unsigned long);
    *((char **)&(pkt->raw[pkt->raw_len+offset])) = ref->file_name;
    offset += sizeof(char *);
    *((unsigned long *)&(pkt->raw[pkt->raw_len+offset])) = ref->ses_id;
    offset += sizeof(unsigned long);
    *((unsigned long *)&(pkt->raw[pkt->raw_len+offset])) = ref->pol_id;
    if (h->ts.tv_sec < 0)
        pkt->cap_sec = 0;
    else
        pkt->cap_sec = h->ts.tv_sec;
    pkt->cap_usec = h->ts.tv_usec;
    pkt->serial = pkt_serial;
        
    /* crash info */
    crash_pkt_cnt = ref->cnt;
    crash_ref_name = ref->file_name;
    
    /* decode */
    ProtDissec(pol_prot_id, pkt);

    FlowSetGblTime(h->ts.tv_sec);

    /* next serial number */
    pkt_serial++;

    if (time(NULL) > tm) {
        tm = time(NULL);
        ReportSplash();
        while (DispatchPeiPending() > DISP_PEI_MAX_QUEUE) {
            to.tv_sec = 2;
            to.tv_nsec = 1;
            /* wait some time */
            while (nanosleep(&to, &to) != 0)
                ;
            ReportSplash();
        }
        
        if (tstart == 0) {
            tstart = tm;
        }
        else {
            fp = fopen(file_status, "w+");
            if (fp != NULL) {
                fprintf(fp, "s:%lu r:%lu\n", (unsigned long)tsize, (tm - tstart));
                fclose(fp);
            }
        }
        tm += 5;
    }
}
Пример #4
0
static int SnoopDissector(FILE *fp, struct cap_ref *ref)
{
    struct snoop_packet_header hdr;
    unsigned long hlen, len;
    packet *pkt;
    time_t tm = 0;
    static time_t tstart = 0;
    static size_t tsize = 0;
    int offset;
    struct timespec to;
    FILE *fpl;

    while (1) {
        /* read header */
        hlen = fread(&hdr, 1, sizeof(struct snoop_packet_header), fp);
        if (hlen != sizeof(struct snoop_packet_header)) {
            if (hlen == 0)
                return 0;
            printf("Snoop file error\n");
            return -1;
        }
        pkt = PktNew();
        /* conver values */
	hdr.tlen = ntohl(hdr.tlen);
	hdr.len = ntohl(hdr.len);
	hdr.blen = ntohl(hdr.blen);
	hdr.secs = ntohl(hdr.secs);
	hdr.usecs = ntohl(hdr.usecs);
        len = hdr.blen - hlen;
        ref->cnt++;
        pkt->raw = DMemMalloc(len+sizeof(unsigned long)*2+sizeof(char *)+4);
        len = fread(pkt->raw, 1, len, fp);
        pkt->raw_len = len;
        tsize += len;
        offset = 0;
        *((unsigned long *)&(pkt->raw[len])) = ref->dlt;
        offset += sizeof(unsigned long);
        *((unsigned long *)&(pkt->raw[len+offset])) = ref->cnt;
        offset += sizeof(unsigned long);
        *((char **)(&(pkt->raw[len+offset]))) = ref->file_name;
        offset += sizeof(char *);
        *((unsigned long *)&(pkt->raw[len+offset])) = ref->ses_id;
        offset += sizeof(unsigned long);
        *((unsigned long *)&(pkt->raw[len+offset])) = ref->pol_id;
        pkt->cap_sec = hdr.secs;
        pkt->cap_usec = hdr.usecs;
        pkt->serial = pkt_serial;
        
        /* crash info */
        crash_pkt_cnt = ref->cnt;
        crash_ref_name = ref->file_name;
        
        /* decode */
        ProtDissec(pol_prot_id, pkt);
        
        FlowSetGblTime(hdr.secs);

        /* next serial number */
        pkt_serial++;

        if (time(NULL) > tm) {
            tm = time(NULL);
            ReportSplash();
            while (DispatchPeiPending() > DISP_PEI_MAX_QUEUE) {
                to.tv_sec = 2;
                to.tv_nsec = 1;
                /* wait some time */
                while (nanosleep(&to, &to) != 0)
                    ;
                ReportSplash();
            }
            if (tstart == 0)
                tstart = tm;
            else {
                fpl = fopen(file_status, "w+");
                if (fpl != NULL) {
                    fprintf(fpl, "s:%lu r:%lu\n", (unsigned long)tsize, (tm - tstart));
                    fclose(fpl);
                }
            }
            tm += 5;
        }
    }

    return 0;
}
Пример #5
0
static void RltmPolDissector(u_char *user, const struct pcap_pkthdr *h, const u_char *bytes)
{
    struct pcap_ref *ref = (struct pcap_ref *)user;
    packet *pkt;
    static time_t tm = 0;
    int offset;
    struct timespec to;
    struct pcap_pkthdr pckt_header;
    size_t nwrt, wcnt;

    pkt = PktNew();

    ref->cnt++;
    pkt->raw = DMemMalloc(h->caplen+sizeof(unsigned long)*2+sizeof(char *)+sizeof(unsigned long)*2);
    memcpy(pkt->raw, bytes, h->caplen);
    pkt->raw_len = h->caplen;
    offset = 0;
    *((unsigned long *)&(pkt->raw[pkt->raw_len])) = ref->dlt;
    offset += sizeof(unsigned long);
    *((unsigned long *)&(pkt->raw[pkt->raw_len+offset])) = ref->cnt;
    offset += sizeof(unsigned long);
    if (savepcap)
        *((char **)&(pkt->raw[pkt->raw_len+offset])) = pcap_deb;
    else
        *((char **)&(pkt->raw[pkt->raw_len+offset])) = "Real Time";
    offset += sizeof(char *);
    *((unsigned long *)&(pkt->raw[pkt->raw_len+offset])) = ref->ses_id;
    offset += sizeof(unsigned long);
    *((unsigned long *)&(pkt->raw[pkt->raw_len+offset])) = ref->pol_id;
    pkt->cap_sec = h->ts.tv_sec;
    pkt->cap_usec = h->ts.tv_usec;
    pkt->serial = pkt_serial;

    /* crash info */
    crash_pkt_cnt = ref->cnt;
    
    /* decode */
    /* save packet */
    if (fp_pcap != NULL) {
        pckt_header.caplen = pkt->raw_len;
        pckt_header.len = pkt->raw_len;
        pckt_header.ts.tv_sec = pkt->cap_sec;
        pckt_header.ts.tv_usec = pkt->cap_usec;
        wcnt = 0;
        do {
            nwrt = fwrite(((char *)&pckt_header)+wcnt, 1, sizeof(struct pcap_pkthdr)-wcnt, fp_pcap);
            if (nwrt != -1)
                wcnt += nwrt;
            else
                break;
        } while (wcnt != sizeof(struct pcap_pkthdr));
        
        wcnt = 0;
        do {
            nwrt = fwrite(((char *)pkt->raw)+wcnt, 1, pkt->raw_len-wcnt, fp_pcap);
            if (nwrt != -1)
                wcnt += nwrt;
            else
                break;
        } while (wcnt != pkt->raw_len);
    }

    ProtDissec(pol_prot_id, pkt);

    FlowSetGblTime(h->ts.tv_sec);

    /* next serial number */
    pkt_serial++;

    if (time(NULL) > tm) {
        tm = time(NULL) + 5;
        ReportSplash();
        while (DispatchPeiPending() > DISP_PEI_MAX_QUEUE) {
            to.tv_sec = 2;
            to.tv_nsec = 1;
            /* wait some time */
            while (nanosleep(&to, &to) != 0)
                ;
            LogPrintf(LV_WARNING, "Possible data loss!");
            ReportSplash();
        }
    }
}