1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
|
/*********************************************************************
* IP Flow Meter *
* http://www.via.ecp.fr/~tibob/ipfm *
* ipfm@via.ecp.fr *
*********************************************************************
(c) 1999-2002 Robert Cheramy <robert@cheramy.net>
(c) 2000 Samuel Hocevar <sam@via.ecp.fr>
(c) 1999 Andres Krapf <dae@via.ecp.fr>
*********************************************************************
* This program uses the libpap for best portability. *
* libpcap can be found at ftp://ftp.ee.lbl.gov/libpcap.tar.Z *
*********************************************************************
200010: sam & tibob : clear and dump options
sam : PID file & daemon mode handling
200210: tibob : configurable PID file
*/
/*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include <unistd.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <time.h>
#include "config.h"
#include "data.h"
#include "filter.h"
#include "init.h"
#include "pcap.h"
#include "utils.h"
struct AllLogsType * pAllLogs = NULL;
extern int run_as_daemon;
extern struct OptionsType Options;
int main(int argc, char *argv[]) {
struct ip *p_packet;
struct AllLogsType * pTempLog;
ParseCmdLine(argc, argv);
Init();
if (run_as_daemon) {
/* Check PID */
if (check_pid(Options.PidFile)) {
printf ("Already running, exiting.\n");
exit (1);
}
if (1 != getppid()) {
signal (SIGTTOU, SIG_IGN);
signal (SIGTTIN, SIG_IGN);
signal (SIGTSTP, SIG_IGN);
}
daemon (0, 0);
umask (022);
/* Write PID file */
if (!write_pid(Options.PidFile)) {
exit (1);
}
}
for(;;) {
p_packet = (struct ip *) getnextippkt();
dofilter(p_packet);
/* Well that's an approximation. I should perhaps use an alarm() */
for (pTempLog = pAllLogs; NULL != pTempLog; pTempLog = pTempLog->Next)
{
if (time(NULL) > pTempLog->NextDump) {
data_dump(pTempLog);
/* Check if we have to clear the logs as well */
if (pTempLog->ClearInterval) {
pTempLog->ClearCounter--;
if (0 >= pTempLog->ClearCounter) {
data_clear(pTempLog);
pTempLog->ClearCounter = pTempLog->ClearInterval;
}
}
pTempLog->NextDump += pTempLog->DumpInterval;
}
}
}
/* Exit(0); */ /* unreachable */
}
|
