1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
|
/*
* $Id: ngrep.h,v 1.32 2005/06/30 17:08:56 jpr5 Exp $
*
* Copyright (c) 2005 Jordan Ritter <jpr5@darkridge.com>
*
* Please refer to the LICENSE file for more information.
*
*/
#define VERSION "1.44"
/*
* We cache the standard frame sizes here to save us time and
* additional dependencies on more operating system include files.
*/
#define ETHHDR_SIZE 14
#define TOKENRING_SIZE 22
#define PPPHDR_SIZE 4
#define SLIPHDR_SIZE 16
#define RAWHDR_SIZE 0
#define LOOPHDR_SIZE 4
#define FDDIHDR_SIZE 21
#define ISDNHDR_SIZE 16
#define IEEE80211HDR_SIZE 32
/*
* Default patterns for BPF and regular expression filters.
*/
#if USE_IPv6
#define BPF_FILTER_IP "(ip or ip6)"
#else
#define BPF_FILTER_IP "(ip)"
#endif
#define BPF_FILTER_OTHER " and ( %s)"
#define BPF_MAIN_FILTER BPF_FILTER_IP BPF_FILTER_OTHER
#define WORD_REGEX "((^%s\\W)|(\\W%s$)|(\\W%s\\W))"
/*
* For retarded operating systems like Solaris that don't have this,
* when everyone else does. Good job, Sun!
*/
#ifndef IP_OFFMASK
#define IP_OFFMASK 0x1fff
#endif
/*
* "Newer" flags that older operating systems don't yet recognize.
*/
#ifndef TH_ECE
#define TH_ECE 0x40
#endif
#ifndef TH_CWR
#define TH_CWR 0x80
#endif
/*
* Single-char packet "ident" flags.
*/
typedef enum {
TCP = 'T', UDP = 'U', ICMP = 'I', ICMPv6 = 'I', IGMP = 'G', UNKNOWN = '?'
} netident_t;
/*
* Prototypes function signatures.
*/
void process(u_char *, struct pcap_pkthdr *, u_char *);
void version(void);
void usage(int8_t);
void clean_exit(int32_t);
void dump_packet(struct pcap_pkthdr *, u_char *, uint8_t, unsigned char *, uint32_t,
const char *, const char *, uint16_t, uint16_t, uint8_t,
uint16_t, uint8_t, uint16_t, uint32_t);
void dump_unwrapped(unsigned char *, uint32_t);
void dump_formatted(unsigned char *, uint32_t);
void dump_byline (unsigned char *, uint32_t);
void dump_delay_proc_init(struct pcap_pkthdr *);
void dump_delay_proc (struct pcap_pkthdr *);
int8_t re_match_func (unsigned char *, uint32_t);
int8_t bin_match_func (unsigned char *, uint32_t);
int8_t blank_match_func(unsigned char *, uint32_t);
void print_time_absolute(struct pcap_pkthdr *);
void print_time_diff (struct pcap_pkthdr *);
char *get_filter_from_string(char *);
char *get_filter_from_argv (char **);
uint8_t strishex(char *);
#if !defined(_WIN32)
void update_windowsize(int32_t);
void drop_privs(void);
#endif
#if defined(_WIN32)
int8_t win32_initwinsock(void);
void win32_listdevices(void);
char *win32_usedevice(const char *);
#endif
|
