iftop.c 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846
  1. /*
  2. * iftop.c:
  3. *
  4. */
  5. #include "integers.h"
  6. #include <stdio.h>
  7. #include <stdlib.h>
  8. #include <time.h>
  9. #include <sys/types.h>
  10. #include <sys/ioctl.h>
  11. #include <sys/socket.h>
  12. #include <net/if.h>
  13. /* include <net/bpf.h> -- this was added by the PFLOG patch but seems
  14. * superfluous and breaks on Slackware */
  15. #if defined(HAVE_PCAP_H)
  16. # include <pcap.h>
  17. #elif defined(HAVE_PCAP_PCAP_H)
  18. # include <pcap/pcap.h>
  19. #else
  20. # error No pcap.h
  21. #endif
  22. #include <pthread.h>
  23. #include <curses.h>
  24. #include <signal.h>
  25. #include <string.h>
  26. #include <unistd.h>
  27. #include <locale.h>
  28. #include "iftop.h"
  29. #include "addr_hash.h"
  30. #include "resolver.h"
  31. #include "ui_common.h"
  32. #include "ui.h"
  33. #include "tui.h"
  34. #include "options.h"
  35. #ifdef DLT_LINUX_SLL
  36. #include "sll.h"
  37. #endif /* DLT_LINUX_SLL */
  38. #include "threadprof.h"
  39. #include "ether.h"
  40. #include "ip.h"
  41. #include "tcp.h"
  42. #include "token.h"
  43. #include "llc.h"
  44. #include "extract.h"
  45. #include "ethertype.h"
  46. #include "cfgfile.h"
  47. #include "ppp.h"
  48. #include "addrs_ioctl.h"
  49. #include <netinet/ip6.h>
  50. /* ethernet address of interface. */
  51. int have_hw_addr = 0;
  52. char if_hw_addr[6];
  53. /* IP address of interface */
  54. int have_ip_addr = 0;
  55. int have_ip6_addr = 0;
  56. struct in_addr if_ip_addr;
  57. struct in6_addr if_ip6_addr;
  58. extern options_t options;
  59. hash_type* history;
  60. history_type history_totals;
  61. time_t last_timestamp;
  62. time_t first_timestamp;
  63. int history_pos = 0;
  64. int history_len = 1;
  65. pthread_mutex_t tick_mutex;
  66. pcap_t* pd; /* pcap descriptor */
  67. struct bpf_program pcap_filter;
  68. pcap_handler packet_handler;
  69. sig_atomic_t foad;
  70. static void finish(int sig) {
  71. foad = sig;
  72. }
  73. /* Only need ethernet (plus optional 4 byte VLAN) and IP headers (48) + first 2
  74. * bytes of tcp/udp header */
  75. /* Increase with a further 20 to account for IPv6 header length. */
  76. /* IEEE 802.11 radiotap throws in a variable length header plus 8 (radiotap
  77. * header header) plus 34 (802.11 MAC) plus 40 (IPv6) = 78, plus whatever's in
  78. * the radiotap payload */
  79. /*#define CAPTURE_LENGTH 92 */
  80. #define CAPTURE_LENGTH 256
  81. void init_history() {
  82. history = addr_hash_create();
  83. last_timestamp = time(NULL);
  84. memset(&history_totals, 0, sizeof history_totals);
  85. }
  86. history_type* history_create() {
  87. history_type* h;
  88. h = xcalloc(1, sizeof *h);
  89. return h;
  90. }
  91. void history_rotate() {
  92. hash_node_type* n = NULL;
  93. history_pos = (history_pos + 1) % HISTORY_LENGTH;
  94. hash_next_item(history, &n);
  95. while(n != NULL) {
  96. hash_node_type* next = n;
  97. history_type* d = (history_type*)n->rec;
  98. hash_next_item(history, &next);
  99. if(d->last_write == history_pos) {
  100. addr_pair key = *(addr_pair*)(n->key);
  101. hash_delete(history, &key);
  102. free(d);
  103. }
  104. else {
  105. d->recv[history_pos] = 0;
  106. d->sent[history_pos] = 0;
  107. }
  108. n = next;
  109. }
  110. history_totals.sent[history_pos] = 0;
  111. history_totals.recv[history_pos] = 0;
  112. if(history_len < HISTORY_LENGTH) {
  113. history_len++;
  114. }
  115. }
  116. void tick(int print) {
  117. time_t t;
  118. pthread_mutex_lock(&tick_mutex);
  119. t = time(NULL);
  120. if(t - last_timestamp >= RESOLUTION) {
  121. analyse_data();
  122. if (options.no_curses) {
  123. if (!options.timed_output || (options.timed_output && t - first_timestamp >= options.timed_output)) {
  124. tui_print();
  125. if (options.timed_output) {
  126. finish(SIGINT);
  127. }
  128. }
  129. }
  130. else {
  131. ui_print();
  132. }
  133. history_rotate();
  134. last_timestamp = t;
  135. }
  136. else {
  137. if (options.no_curses) {
  138. tui_tick(print);
  139. }
  140. else {
  141. ui_tick(print);
  142. }
  143. }
  144. pthread_mutex_unlock(&tick_mutex);
  145. }
  146. int in_filter_net(struct in_addr addr) {
  147. int ret;
  148. ret = ((addr.s_addr & options.netfiltermask.s_addr) == options.netfilternet.s_addr);
  149. return ret;
  150. }
  151. static int __inline__ ip_addr_match(struct in_addr addr) {
  152. return addr.s_addr == if_ip_addr.s_addr;
  153. }
  154. static int __inline__ ip6_addr_match(struct in6_addr *addr) {
  155. return IN6_ARE_ADDR_EQUAL(addr, &if_ip6_addr);
  156. }
  157. /**
  158. * Creates an addr_pair from an ip (and tcp/udp) header, swapping src and dst
  159. * if required
  160. */
  161. void assign_addr_pair(addr_pair* ap, struct ip* iptr, int flip) {
  162. unsigned short int src_port = 0;
  163. unsigned short int dst_port = 0;
  164. /* Arrange for predictable values. */
  165. memset(ap, '\0', sizeof(*ap));
  166. if(IP_V(iptr) == 4) {
  167. ap->af = AF_INET;
  168. /* Does this protocol use ports? */
  169. if(iptr->ip_p == IPPROTO_TCP || iptr->ip_p == IPPROTO_UDP) {
  170. /* We take a slight liberty here by treating UDP the same as TCP */
  171. /* Find the TCP/UDP header */
  172. struct tcphdr* thdr = ((void*)iptr) + IP_HL(iptr) * 4;
  173. src_port = ntohs(thdr->th_sport);
  174. dst_port = ntohs(thdr->th_dport);
  175. }
  176. if(flip == 0) {
  177. ap->src = iptr->ip_src;
  178. ap->src_port = src_port;
  179. ap->dst = iptr->ip_dst;
  180. ap->dst_port = dst_port;
  181. }
  182. else {
  183. ap->src = iptr->ip_dst;
  184. ap->src_port = dst_port;
  185. ap->dst = iptr->ip_src;
  186. ap->dst_port = src_port;
  187. }
  188. } /* IPv4 */
  189. else if (IP_V(iptr) == 6) {
  190. /* IPv6 packet seen. */
  191. struct ip6_hdr *ip6tr = (struct ip6_hdr *) iptr;
  192. ap->af = AF_INET6;
  193. if( (ip6tr->ip6_nxt == IPPROTO_TCP) || (ip6tr->ip6_nxt == IPPROTO_UDP) ) {
  194. struct tcphdr *thdr = ((void *) ip6tr) + 40;
  195. src_port = ntohs(thdr->th_sport);
  196. dst_port = ntohs(thdr->th_dport);
  197. }
  198. if(flip == 0) {
  199. memcpy(&ap->src6, &ip6tr->ip6_src, sizeof(ap->src6));
  200. ap->src_port = src_port;
  201. memcpy(&ap->dst6, &ip6tr->ip6_dst, sizeof(ap->dst6));
  202. ap->dst_port = dst_port;
  203. }
  204. else {
  205. memcpy(&ap->src6, &ip6tr->ip6_dst, sizeof(ap->src6));
  206. ap->src_port = dst_port;
  207. memcpy(&ap->dst6, &ip6tr->ip6_src, sizeof(ap->dst6));
  208. ap->dst_port = src_port;
  209. }
  210. }
  211. }
  212. static void handle_ip_packet(struct ip* iptr, int hw_dir)
  213. {
  214. int direction = 0; /* incoming */
  215. history_type* ht;
  216. union {
  217. history_type **ht_pp;
  218. void **void_pp;
  219. } u_ht = { &ht };
  220. addr_pair ap;
  221. unsigned int len = 0;
  222. struct in6_addr scribdst; /* Scratch pad. */
  223. struct in6_addr scribsrc; /* Scratch pad. */
  224. /* Reinterpret packet type. */
  225. struct ip6_hdr* ip6tr = (struct ip6_hdr *) iptr;
  226. memset(&ap, '\0', sizeof(ap));
  227. tick(0);
  228. if( (IP_V(iptr) ==4 && options.netfilter == 0)
  229. || (IP_V(iptr) == 6 && options.netfilter6 == 0) ) {
  230. /*
  231. * Net filter is off, so assign direction based on MAC address
  232. */
  233. if(hw_dir == 1) {
  234. /* Packet leaving this interface. */
  235. assign_addr_pair(&ap, iptr, 0);
  236. direction = 1;
  237. }
  238. else if(hw_dir == 0) {
  239. /* Packet incoming */
  240. assign_addr_pair(&ap, iptr, 1);
  241. direction = 0;
  242. }
  243. /* Packet direction is not given away by h/ware layer. Try IP
  244. * layer
  245. */
  246. else if((IP_V(iptr) == 4) && have_ip_addr && ip_addr_match(iptr->ip_src)) {
  247. /* outgoing */
  248. assign_addr_pair(&ap, iptr, 0);
  249. direction = 1;
  250. }
  251. else if((IP_V(iptr) == 4) && have_ip_addr && ip_addr_match(iptr->ip_dst)) {
  252. /* incoming */
  253. assign_addr_pair(&ap, iptr, 1);
  254. direction = 0;
  255. }
  256. else if((IP_V(iptr) == 6) && have_ip6_addr && ip6_addr_match(&ip6tr->ip6_src)) {
  257. /* outgoing */
  258. assign_addr_pair(&ap, iptr, 0);
  259. direction = 1;
  260. }
  261. else if((IP_V(iptr) == 6) && have_ip6_addr && ip6_addr_match(&ip6tr->ip6_dst)) {
  262. /* incoming */
  263. assign_addr_pair(&ap, iptr, 1);
  264. direction = 0;
  265. }
  266. else if (IP_V(iptr) == 4 && IN_MULTICAST(iptr->ip_dst.s_addr)) {
  267. assign_addr_pair(&ap, iptr, 1);
  268. direction = 0;
  269. }
  270. else if (IP_V(iptr) == 6 && IN6_IS_ADDR_MULTICAST(&ip6tr->ip6_dst)) {
  271. assign_addr_pair(&ap, iptr, 1);
  272. direction = 0;
  273. }
  274. /*
  275. * Cannot determine direction from hardware or IP levels. Therefore
  276. * assume that it was a packet between two other machines, assign
  277. * source and dest arbitrarily (by numerical value) and account as
  278. * incoming.
  279. */
  280. else if (options.promiscuous_but_choosy) {
  281. return; /* junk it */
  282. }
  283. else if((IP_V(iptr) == 4) && (iptr->ip_src.s_addr < iptr->ip_dst.s_addr)) {
  284. assign_addr_pair(&ap, iptr, 1);
  285. direction = 0;
  286. }
  287. else if(IP_V(iptr) == 4) {
  288. assign_addr_pair(&ap, iptr, 0);
  289. direction = 0;
  290. }
  291. /* Drop other uncertain packages. */
  292. else
  293. return;
  294. }
  295. if(IP_V(iptr) == 4 && options.netfilter != 0) {
  296. /*
  297. * Net filter on, assign direction according to netmask
  298. */
  299. if(in_filter_net(iptr->ip_src) && !in_filter_net(iptr->ip_dst)) {
  300. /* out of network */
  301. assign_addr_pair(&ap, iptr, 0);
  302. direction = 1;
  303. }
  304. else if(in_filter_net(iptr->ip_dst) && !in_filter_net(iptr->ip_src)) {
  305. /* into network */
  306. assign_addr_pair(&ap, iptr, 1);
  307. direction = 0;
  308. }
  309. else {
  310. /* drop packet */
  311. return ;
  312. }
  313. }
  314. if(IP_V(iptr) == 6 && options.netfilter6 != 0) {
  315. /*
  316. * Net filter IPv6 active.
  317. */
  318. int j;
  319. //else if((IP_V(iptr) == 6) && have_ip6_addr && ip6_addr_match(&ip6tr->ip6_dst)) {
  320. /* First reduce the participating addresses using the netfilter prefix.
  321. * We need scratch pads to do this.
  322. */
  323. for (j=0; j < 16; ++j) {
  324. scribdst.s6_addr[j] = ip6tr->ip6_dst.s6_addr[j]
  325. & options.netfilter6mask.s6_addr[j];
  326. scribsrc.s6_addr[j] = ip6tr->ip6_src.s6_addr[j]
  327. & options.netfilter6mask.s6_addr[j];
  328. }
  329. /* Now look for any hits. */
  330. //if(in_filter_net(iptr->ip_src) && !in_filter_net(iptr->ip_dst)) {
  331. if (IN6_ARE_ADDR_EQUAL(&scribsrc, &options.netfilter6net)
  332. && ! IN6_ARE_ADDR_EQUAL(&scribdst, &options.netfilter6net)) {
  333. /* out of network */
  334. assign_addr_pair(&ap, iptr, 0);
  335. direction = 1;
  336. }
  337. //else if(in_filter_net(iptr->ip_dst) && !in_filter_net(iptr->ip_src)) {
  338. else if (! IN6_ARE_ADDR_EQUAL(&scribsrc, &options.netfilter6net)
  339. && IN6_ARE_ADDR_EQUAL(&scribdst, &options.netfilter6net)) {
  340. /* into network */
  341. assign_addr_pair(&ap, iptr, 1);
  342. direction = 0;
  343. }
  344. else {
  345. /* drop packet */
  346. return ;
  347. }
  348. }
  349. #if 1
  350. /* Test if link-local IPv6 packets should be dropped. */
  351. if( IP_V(iptr) == 6 && !options.link_local
  352. && (IN6_IS_ADDR_LINKLOCAL(&ip6tr->ip6_dst)
  353. || IN6_IS_ADDR_LINKLOCAL(&ip6tr->ip6_src)) )
  354. return;
  355. #endif
  356. /* Do address resolving. */
  357. switch (IP_V(iptr)) {
  358. case 4:
  359. ap.protocol = iptr->ip_p;
  360. /* Add the addresses to be resolved */
  361. /* The IPv4 address is embedded in a in6_addr structure,
  362. * so it need be copied, and delivered to resolve(). */
  363. memset(&scribdst, '\0', sizeof(scribdst));
  364. memcpy(&scribdst, &iptr->ip_dst, sizeof(struct in_addr));
  365. resolve(ap.af, &scribdst, NULL, 0);
  366. memset(&scribsrc, '\0', sizeof(scribsrc));
  367. memcpy(&scribsrc, &iptr->ip_src, sizeof(struct in_addr));
  368. resolve(ap.af, &scribsrc, NULL, 0);
  369. break;
  370. case 6:
  371. ap.protocol = ip6tr->ip6_nxt;
  372. /* Add the addresses to be resolved */
  373. resolve(ap.af, &ip6tr->ip6_dst, NULL, 0);
  374. resolve(ap.af, &ip6tr->ip6_src, NULL, 0);
  375. default:
  376. break;
  377. }
  378. if(hash_find(history, &ap, u_ht.void_pp) == HASH_STATUS_KEY_NOT_FOUND) {
  379. ht = history_create();
  380. hash_insert(history, &ap, ht);
  381. }
  382. /* Do accounting. */
  383. switch (IP_V(iptr)) {
  384. case 4:
  385. len = ntohs(iptr->ip_len);
  386. break;
  387. case 6:
  388. len = ntohs(ip6tr->ip6_plen) + 40;
  389. default:
  390. break;
  391. }
  392. /* Update record */
  393. ht->last_write = history_pos;
  394. if( ((IP_V(iptr) == 4) && (iptr->ip_src.s_addr == ap.src.s_addr))
  395. || ((IP_V(iptr) == 6) && !memcmp(&ip6tr->ip6_src, &ap.src6, sizeof(ap.src6))) )
  396. {
  397. ht->sent[history_pos] += len;
  398. ht->total_sent += len;
  399. }
  400. else {
  401. ht->recv[history_pos] += len;
  402. ht->total_recv += len;
  403. }
  404. if(direction == 0) {
  405. /* incoming */
  406. history_totals.recv[history_pos] += len;
  407. history_totals.total_recv += len;
  408. }
  409. else {
  410. history_totals.sent[history_pos] += len;
  411. history_totals.total_sent += len;
  412. }
  413. }
  414. static void handle_raw_packet(unsigned char* args, const struct pcap_pkthdr* pkthdr, const unsigned char* packet)
  415. {
  416. handle_ip_packet((struct ip*)packet, -1);
  417. }
  418. #ifdef DLT_PFLOG
  419. static void handle_pflog_packet(unsigned char* args, const struct pcap_pkthdr* pkthdr, const unsigned char* packet)
  420. {
  421. register u_int length = pkthdr->len;
  422. u_int hdrlen;
  423. const struct pfloghdr *hdr;
  424. hdr = (struct pfloghdr *)packet;
  425. hdrlen = BPF_WORDALIGN(hdr->length);
  426. length -= hdrlen;
  427. packet += hdrlen;
  428. handle_ip_packet((struct ip*)packet, -1);
  429. }
  430. #endif
  431. static void handle_null_packet(unsigned char* args, const struct pcap_pkthdr* pkthdr, const unsigned char* packet)
  432. {
  433. handle_ip_packet((struct ip*)(packet + 4), -1);
  434. }
  435. static void handle_llc_packet(const struct llc* llc, int dir) {
  436. struct ip* ip = (struct ip*)((void*)llc + sizeof(struct llc));
  437. /* Taken from tcpdump/print-llc.c */
  438. if(llc->ssap == LLCSAP_SNAP && llc->dsap == LLCSAP_SNAP
  439. && llc->llcui == LLC_UI) {
  440. u_int32_t orgcode;
  441. u_int16_t et;
  442. orgcode = EXTRACT_24BITS(&llc->llc_orgcode[0]);
  443. et = (llc->llc_ethertype[0] << 8) + llc->llc_ethertype[1];
  444. switch(orgcode) {
  445. case OUI_ENCAP_ETHER:
  446. case OUI_CISCO_90:
  447. handle_ip_packet(ip, dir);
  448. break;
  449. case OUI_APPLETALK:
  450. if(et == ETHERTYPE_ATALK) {
  451. handle_ip_packet(ip, dir);
  452. }
  453. break;
  454. default:;
  455. /* Not a lot we can do */
  456. }
  457. }
  458. }
  459. static void handle_tokenring_packet(unsigned char* args, const struct pcap_pkthdr* pkthdr, const unsigned char* packet)
  460. {
  461. struct token_header *trp;
  462. int dir = -1;
  463. trp = (struct token_header *)packet;
  464. if(IS_SOURCE_ROUTED(trp)) {
  465. packet += RIF_LENGTH(trp);
  466. }
  467. packet += TOKEN_HDRLEN;
  468. if(memcmp(trp->token_shost, if_hw_addr, 6) == 0 ) {
  469. /* packet leaving this i/f */
  470. dir = 1;
  471. }
  472. else if(memcmp(trp->token_dhost, if_hw_addr, 6) == 0 || memcmp("\xFF\xFF\xFF\xFF\xFF\xFF", trp->token_dhost, 6) == 0) {
  473. /* packet entering this i/f */
  474. dir = 0;
  475. }
  476. /* Only know how to deal with LLC encapsulated packets */
  477. if(FRAME_TYPE(trp) == TOKEN_FC_LLC) {
  478. handle_llc_packet((struct llc*)packet, dir);
  479. }
  480. }
  481. static void handle_ppp_packet(unsigned char* args, const struct pcap_pkthdr* pkthdr, const unsigned char* packet)
  482. {
  483. register u_int length = pkthdr->len;
  484. register u_int caplen = pkthdr->caplen;
  485. u_int proto;
  486. if (caplen < 2)
  487. return;
  488. if(packet[0] == PPP_ADDRESS) {
  489. if (caplen < 4)
  490. return;
  491. packet += 2;
  492. length -= 2;
  493. proto = EXTRACT_16BITS(packet);
  494. packet += 2;
  495. length -= 2;
  496. if(proto == PPP_IP || proto == ETHERTYPE_IP || proto == ETHERTYPE_IPV6) {
  497. handle_ip_packet((struct ip*)packet, -1);
  498. }
  499. }
  500. }
  501. #ifdef DLT_LINUX_SLL
  502. static void handle_cooked_packet(unsigned char *args, const struct pcap_pkthdr * thdr, const unsigned char * packet)
  503. {
  504. struct sll_header *sptr;
  505. int dir = -1;
  506. sptr = (struct sll_header *) packet;
  507. switch (ntohs(sptr->sll_pkttype))
  508. {
  509. case LINUX_SLL_HOST:
  510. /*entering this interface*/
  511. dir = 0;
  512. break;
  513. case LINUX_SLL_OUTGOING:
  514. /*leaving this interface */
  515. dir=1;
  516. break;
  517. }
  518. handle_ip_packet((struct ip*)(packet+SLL_HDR_LEN), dir);
  519. }
  520. #endif /* DLT_LINUX_SLL */
  521. static void handle_eth_packet(unsigned char* args, const struct pcap_pkthdr* pkthdr, const unsigned char* packet)
  522. {
  523. struct ether_header *eptr;
  524. int ether_type;
  525. const unsigned char *payload;
  526. eptr = (struct ether_header*)packet;
  527. ether_type = ntohs(eptr->ether_type);
  528. payload = packet + sizeof(struct ether_header);
  529. if(ether_type == ETHERTYPE_8021Q) {
  530. struct vlan_8021q_header* vptr;
  531. vptr = (struct vlan_8021q_header*)payload;
  532. ether_type = ntohs(vptr->ether_type);
  533. payload += sizeof(struct vlan_8021q_header);
  534. }
  535. if(ether_type == ETHERTYPE_IP || ether_type == ETHERTYPE_IPV6) {
  536. struct ip* iptr;
  537. int dir = -1;
  538. /*
  539. * Is a direction implied by the MAC addresses?
  540. */
  541. if(have_hw_addr && memcmp(eptr->ether_shost, if_hw_addr, 6) == 0 ) {
  542. /* packet leaving this i/f */
  543. dir = 1;
  544. }
  545. else if(have_hw_addr && memcmp(eptr->ether_dhost, if_hw_addr, 6) == 0 ) {
  546. /* packet entering this i/f */
  547. dir = 0;
  548. }
  549. else if (memcmp("\xFF\xFF\xFF\xFF\xFF\xFF", eptr->ether_dhost, 6) == 0) {
  550. /* broadcast packet, count as incoming */
  551. dir = 0;
  552. }
  553. /* Distinguishing ip_hdr and ip6_hdr will be done later. */
  554. iptr = (struct ip*)(payload); /* alignment? */
  555. handle_ip_packet(iptr, dir);
  556. }
  557. }
  558. #ifdef DLT_IEEE802_11_RADIO
  559. /*
  560. * Packets with a bonus radiotap header.
  561. * See http://www.gsp.com/cgi-bin/man.cgi?section=9&topic=ieee80211_radiotap
  562. */
  563. static void handle_radiotap_packet(unsigned char* args, const struct pcap_pkthdr* pkthdr, const unsigned char* packet)
  564. {
  565. /* 802.11 MAC header is = 34 bytes (not sure if that's universally true) */
  566. /* We could try harder to figure out hardware direction from the MAC header */
  567. handle_ip_packet((struct ip*)(packet + ((struct radiotap_header *)packet)->it_len + 34),-1);
  568. }
  569. #endif
  570. /* set_filter_code:
  571. * Install some filter code. Returns NULL on success or an error message on
  572. * failure. */
  573. char *set_filter_code(const char *filter) {
  574. char *x;
  575. if (filter) {
  576. x = xmalloc(strlen(filter) + sizeof "() and (ip or ip6)");
  577. sprintf(x, "(%s) and (ip or ip6)", filter);
  578. } else
  579. x = xstrdup("ip or ip6");
  580. if (pcap_compile(pd, &pcap_filter, x, 1, 0) == -1) {
  581. xfree(x);
  582. return pcap_geterr(pd);
  583. }
  584. xfree(x);
  585. if (pcap_setfilter(pd, &pcap_filter) == -1)
  586. return pcap_geterr(pd);
  587. else
  588. return NULL;
  589. }
  590. /*
  591. * packet_init:
  592. *
  593. * performs pcap initialisation, called before ui is initialised
  594. */
  595. void packet_init() {
  596. char errbuf[PCAP_ERRBUF_SIZE];
  597. char *m;
  598. int i;
  599. int dlt;
  600. int result;
  601. #ifdef HAVE_DLPI
  602. result = get_addrs_dlpi(options.interface, if_hw_addr, &if_ip_addr);
  603. #else
  604. result = get_addrs_ioctl(options.interface, if_hw_addr,
  605. &if_ip_addr, &if_ip6_addr);
  606. #endif
  607. if (result < 0) {
  608. exit(1);
  609. }
  610. have_hw_addr = result & 0x01;
  611. have_ip_addr = result & 0x02;
  612. have_ip6_addr = result & 0x04;
  613. if(have_ip_addr) {
  614. fprintf(stderr, "IP address is: %s\n", inet_ntoa(if_ip_addr));
  615. }
  616. if(have_ip6_addr) {
  617. char ip6str[INET6_ADDRSTRLEN];
  618. ip6str[0] = '\0';
  619. inet_ntop(AF_INET6, &if_ip6_addr, ip6str, sizeof(ip6str));
  620. fprintf(stderr, "IPv6 address is: %s\n", ip6str);
  621. }
  622. if(have_hw_addr) {
  623. fprintf(stderr, "MAC address is:");
  624. for (i = 0; i < 6; ++i)
  625. fprintf(stderr, "%c%02x", i ? ':' : ' ', (unsigned int)if_hw_addr[i]);
  626. fprintf(stderr, "\n");
  627. }
  628. // exit(0);
  629. resolver_initialise();
  630. pd = pcap_open_live(options.interface, CAPTURE_LENGTH, options.promiscuous, 1000, errbuf);
  631. // DEBUG: pd = pcap_open_offline("tcpdump.out", errbuf);
  632. if(pd == NULL) {
  633. fprintf(stderr, "pcap_open_live(%s): %s\n", options.interface, errbuf);
  634. exit(1);
  635. }
  636. dlt = pcap_datalink(pd);
  637. if(dlt == DLT_EN10MB) {
  638. packet_handler = handle_eth_packet;
  639. }
  640. #ifdef DLT_PFLOG
  641. else if (dlt == DLT_PFLOG) {
  642. packet_handler = handle_pflog_packet;
  643. }
  644. #endif
  645. else if(dlt == DLT_RAW) {
  646. packet_handler = handle_raw_packet;
  647. }
  648. else if(dlt == DLT_NULL) {
  649. packet_handler = handle_null_packet;
  650. }
  651. #ifdef DLT_LOOP
  652. else if(dlt == DLT_LOOP) {
  653. packet_handler = handle_null_packet;
  654. }
  655. #endif
  656. #ifdef DLT_IEEE802_11_RADIO
  657. else if(dlt == DLT_IEEE802_11_RADIO) {
  658. packet_handler = handle_radiotap_packet;
  659. }
  660. #endif
  661. else if(dlt == DLT_IEEE802) {
  662. packet_handler = handle_tokenring_packet;
  663. }
  664. else if(dlt == DLT_PPP) {
  665. packet_handler = handle_ppp_packet;
  666. }
  667. /*
  668. * SLL support not available in older libpcaps
  669. */
  670. #ifdef DLT_LINUX_SLL
  671. else if(dlt == DLT_LINUX_SLL) {
  672. packet_handler = handle_cooked_packet;
  673. }
  674. #endif
  675. else {
  676. fprintf(stderr, "Unsupported datalink type: %d\n"
  677. "Please email pdw@ex-parrot.com, quoting the datalink type and what you were\n"
  678. "trying to do at the time\n.", dlt);
  679. exit(1);
  680. }
  681. if ((m = set_filter_code(options.filtercode))) {
  682. fprintf(stderr, "set_filter_code: %s\n", m);
  683. exit(1);
  684. return;
  685. }
  686. }
  687. /* packet_loop:
  688. * Worker function for packet capture thread. */
  689. void packet_loop(void* ptr) {
  690. pcap_loop(pd,-1,(pcap_handler)packet_handler,NULL);
  691. }
  692. /* main:
  693. * Entry point. See usage(). */
  694. int main(int argc, char **argv) {
  695. pthread_t thread;
  696. struct sigaction sa = {};
  697. setlocale(LC_ALL, "");
  698. /* TODO: tidy this up */
  699. /* read command line options and config file */
  700. config_init();
  701. options_set_defaults();
  702. options_read_args(argc, argv);
  703. /* If a config was explicitly specified, whinge if it can't be found */
  704. read_config(options.config_file, options.config_file_specified);
  705. options_make();
  706. sa.sa_handler = finish;
  707. sigaction(SIGINT, &sa, NULL);
  708. pthread_mutex_init(&tick_mutex, NULL);
  709. packet_init();
  710. init_history();
  711. if (options.no_curses) {
  712. tui_init();
  713. }
  714. else {
  715. ui_init();
  716. }
  717. pthread_create(&thread, NULL, (void*)&packet_loop, NULL);
  718. /* Keep the starting time (used for timed termination) */
  719. first_timestamp = time(NULL);
  720. if (options.no_curses) {
  721. if (options.timed_output) {
  722. while(!foad) {
  723. sleep(1);
  724. }
  725. }
  726. else {
  727. tui_loop();
  728. }
  729. }
  730. else {
  731. ui_loop();
  732. }
  733. pthread_cancel(thread);
  734. ui_finish();
  735. return 0;
  736. }