show_tcp.rar_show_tcp

#include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> #include <netinet/in_systm.h> #include <arpa/inet.h> #include <stdio.h> #include <fcntl.h> #include "nids.h" #include <string.h> #define int_ntoa(x) inet_ntoa(*((struct in_addr *)&x)) char ascii_string[10000]; char* char_to_ascii(char ch) { char* string; ascii_string[0]=0; string=ascii_string; if(isgraph(ch)) { *string++=ch; } else if(ch==' ') { *string++=ch; } else if(ch=='\n'||ch=='\r') { *string++=ch; } else { *string++='.'; } *string=0; return ascii_string; } /* 回调函数 */ void tcp_protocol_callback(struct tcp_stream* tcp_connection, void** arg) { int i; char address_string[1024]; char content[65535]; char content_urgent[65535]; struct tuple4 ip_and_port=tcp_connection->addr; strcpy(address_string, inet_ntoa(*((struct in_addr *)&(ip_and_port.saddr)))); sprintf(address_string+strlen(address_string), ":%i", ip_and_port.source); strcat(address_string, "<--->"); strcat(address_string, inet_ntoa(*((struct in_addr *) & (ip_and_port.daddr)))); sprintf(address_string+strlen(address_string),":%i", ip_and_port.dest); strcat(address_string, "\n"); switch (tcp_connection->nids_state) { case NIDS_JUST_EST: tcp_connection->client.collect++; tcp_connection->server.collect++; tcp_connection->server.collect_urg++; tcp_connection->client.collect_urg++; printf("%sTCP is now establishing\n", address_string); return; case NIDS_CLOSE: printf("--------------------\n"); printf("%sTCP has closed normally\n", address_string); return; case NIDS_RESET: printf("------------------\n"); printf(" %sTCP has been reseted\n ", address_string); return; case NIDS_DATA: { struct half_stream* hlf; if(tcp_connection->server.count_new_urg) { printf("--------------\n"); strcpy(address_string, inet_ntoa(*((struct in_addr *)&(ip_and_port.saddr)))); sprintf(address_string+strlen(address_string),":%i", ip_and_port.source); strcat(address_string," urgent--->"); strcat(address_string, inet_ntoa(*((struct in_addr *) & (ip_and_port.daddr)))); sprintf(address_string+strlen(address_string),":%i",ip_and_port.dest); strcat(address_string, "\n"); address_string[strlen(address_string)+1]=0; address_string[strlen(address_string)]=tcp_connection->server.urgdata; printf("%s", address_string); return; } if(tcp_connection->client.count_new_urg) { printf("---------------\n"); strcpy(address_string, inet_ntoa(*((struct in_addr *)&(ip_and_port.saddr)))); sprintf(address_string+strlen(address_string),":%i",ip_and_port.source); strcat(address_string," <---urgent "); strcat(address_string, inet_ntoa(*((struct in_addr *)& (ip_and_port.daddr)))); sprintf(address_string+strlen(address_string),":%i",ip_and_port.dest); strcat(address_string, "\n"); address_string[strlen(address_string)+1]=0; address_string[strlen(address_string)]=tcp_connection->client.urgdata; printf("%s", address_string); return; } if(tcp_connection->client.count_new) { hlf=&tcp_connection->client; strcpy(address_string, inet_ntoa(*((struct in_addr *)&(ip_and_port.saddr)))); sprintf(address_string + strlen(address_string),":%i", ip_and_port.source); strcat(address_string," <--- "); strcat(address_string, inet_ntoa(*((struct in_addr *)& (ip_and_port.daddr)))); sprintf(address_string+strlen(address_string),":%i",ip_and_port.dest); strcat(address_string, "\n"); printf("-----------------\n"); printf("%s",address_string); memcpy(content,hlf->data,hlf->count_new); content[hlf->count_new]='\0'; printf("The client has recieved new datas are as follow:\n"); for (i=0; i<hlf->count_new; i++) { printf("%s", char_to_ascii(content[i])); } printf("\n"); } else { hlf=&tcp_connection->server; strcpy(address_string, inet_ntoa(*((struct in_addr *)&(ip_and_port.saddr)))); sprintf(address_string+strlen(address_string),":%i",ip_and_port.source); strcat(address_string, " ---> "); strcat(address_string, inet_ntoa(*((struct in_addr *)&(ip_and_port.daddr)))); sprintf(address_string+strlen(address_string),":%i",ip_and_port.dest); strcat(address_string, "\n"); printf("-----------------\n"); printf("%s",address_string); memcpy(content,hlf->data,hlf->count_new); content[hlf->count_new]='\0'; printf("The server has recieved new datas are as follow:\n"); for (i=0; i<hlf->count_new;i++) { printf("%s", char_to_ascii(content[i])); } printf("\n"); } } default: break; } return; } /* 主程序 */ int main() { if(!nids_init()) { printf("Error!\n",nids_errbuf); exit(1); } nids_register_tcp(tcp_protocol_callback); nids_run(); }