1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
/* darkstat 3
* copyright (c) 2001-2012 Emil Mikulic.
*
* decode.h: packet decoding.
*
* You may use, modify and redistribute this file under the terms of the
* GNU General Public License version 2. (see COPYING.GPL)
*/
#ifndef __DARKSTAT_DECODE_H
#define __DARKSTAT_DECODE_H
#include "addr.h"
#ifndef ETHER_ADDR_LEN
# define ETHER_ADDR_LEN 6
#endif
#define IPPROTO_INVALID 254 /* special: means don't do proto accounting */
#ifndef IPPROTO_OSPF
# define IPPROTO_OSPF 89
#endif
#define PPPOE_HDR_LEN 8
/* Decoding creates a summary which is passed to accounting. */
struct pktsummary {
/* Fields are in host byte order (except IPs) */
struct addr src, dst;
uint16_t len;
uint8_t proto; /* IPPROTO_INVALID means don't do proto accounting */
uint8_t tcp_flags; /* only for TCP */
uint16_t src_port, dst_port; /* only for TCP, UDP */
uint8_t src_mac[ETHER_ADDR_LEN], /* only for Ethernet */
dst_mac[ETHER_ADDR_LEN]; /* only for Ethernet */
};
struct pcap_pkthdr; /* from pcap.h */
#define DECODER_ARGS const struct pcap_pkthdr *pheader, \
const u_char *pdata, \
struct pktsummary *sm
/* Returns 0 on decode failure (meaning accounting should not be performed) */
typedef int (decoder_fn)(DECODER_ARGS);
struct linkhdr {
int linktype;
unsigned int hdrlen;
decoder_fn *decoder;
};
const struct linkhdr *getlinkhdr(const int linktype);
int getsnaplen(const struct linkhdr *lh);
#endif /* __DARKSTAT_DECODE_H */
/* vim:set ts=3 sw=3 tw=78 expandtab: */
|
