1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
|
network.c:126: off=ntohs(p.ip->ip_off);
network.c:134: hlen=p.ip->ip_hl * 4;
network.c:136: p.len =ntohs(p.ip->ip_len)-hlen;
network.c:139: switch(p.ip->ip_p){
network.c:159: memcpy(&p->ts,&in->ts,sizeof(struct timeval));
network.c:160: if(!(p->base=(UCHAR *)malloc(in->_len)))
network.c:162: memcpy(p->base,in->base,p->_len=in->_len);
network.c:164: p->data=p->base + (in->data -> in->base);
network.c:165: p->len=in->len;
network.c:167: p->ip=(struct ip *)(p->base + ((UCHAR *)in->ip - in->base));
network.c:168: p->tcp=(struct tcphdr *)(p->base + ((UCHAR *)in->tcp - in->base));
network.c:186: FREE(p->base);
pcap-snoop.c:2: pcap-snoop.c
pcap-snoop.c:40: $Id: pcap-snoop.c,v 1.12 2002/01/21 17:36:51 ekr Exp $
pcap-snoop.c:47:static char *RCSSTRING="$Id: pcap-snoop.c,v 1.12 2002/01/21 17:36:51 ekr Exp $";
tcppack.c:84: p->tcp=(struct tcphdr *)p->data;
tcppack.c:88: if(r=tcp_find_conn(&conn,&direction,&p->ip->ip_src,
tcppack.c:89: ntohs(p->tcp->th_sport),&p->ip->ip_dst,ntohs(p->tcp->th_dport))){
tcppack.c:96: if((p->tcp->th_flags & (TH_SYN|TH_ACK))!=TH_SYN){
tcppack.c:104: conn->i2r.seq=ntohl(p->tcp->th_seq)+1;
tcppack.c:114: if((p->tcp->th_flags & (TH_SYN|TH_ACK))!=(TH_SYN|TH_ACK))
tcppack.c:116: conn->r2i.seq=ntohl(p->tcp->th_seq)+1;
tcppack.c:117: conn->r2i.ack=ntohl(p->tcp->th_ack)+1;
tcppack.c:127: conn->i2r.ack=ntohl(p->tcp->th_ack)+1;
tcppack.c:148: if(p->tcp->th_flags & TH_SYN)
tcppack.c:150: length=p->len - (p->tcp->th_off * 4);
tcppack.c:178: if(r=tcp_create_conn(&conn,&p->ip->ip_src,ntohs(p->tcp->th_sport),
tcppack.c:179: &p->ip->ip_dst,ntohs(p->tcp->th_dport)))
tcppack.c:183: memcpy(&conn->start_time,&p->ts,sizeof(struct timeval));
tcppack.c:184: if(r=create_proto_handler(handler,ctx,&conn->analyzer,conn,&p->ts))
tcppack.c:197: off=(s)->p->tcp->th_off*4; \
tcppack.c:198: if(l>((s)->p->len-off)) ERETURN(R_BAD_DATA);\
tcppack.c:199: (s)->data=(s)->p->data + off + (l) ; \
tcppack.c:200: (s)->len=(s)->p->len - off + (l); \
tcppack.c:227: l=p->len - p->tcp->th_off * 4;
tcppack.c:238: seq=ntohl(p->tcp->th_seq);
tcppack.c:241: if(p->tcp->th_flags & TH_ACK){
tcppack.c:245: acknum=ntohl(p->tcp->th_ack);
tcppack.c:250: if(r=timestamp_diff(&p->ts,&conn->start_time,&dt))
tcppack.c:268: if(!(p->tcp->th_flags & (TH_RST)) && SEQ_LT(seq,stream->seq))
tcppack.c:310: if(_seg.p->tcp->th_flags & (TH_RST)){
tcppack.c:311: stream->close=_seg.p->tcp->th_flags & (TH_RST);
tcppack.c:319: if(_seg.p->tcp->th_flags & (TH_FIN)){
tcppack.c:320: stream->close=_seg.p->tcp->th_flags & (TH_FIN);
tcppack.c:325: if(seg->p->tcp->th_flags & (TH_FIN)){
tcppack.c:326: stream->close=_seg.p->tcp->th_flags & (TH_FIN);
tcppack.c:338: if(seg->p->tcp->th_flags & (TH_FIN) ){
tcppack.c:374: lookuphostname(&p->ip->ip_src,&src);
tcppack.c:375: lookuphostname(&p->ip->ip_dst,&dst);
tcppack.c:379: ntohs(p->tcp->th_sport),
tcppack.c:381: ntohs(p->tcp->th_dport));
tcppack.c:384: ntohl(p->tcp->th_seq),
tcppack.c:385: p->len - p->tcp->th_off *4);
tcppack.c:387: if(p->tcp->th_flags & TH_ACK)
tcppack.c:388: printf("ACK %ld ",ntohl(p->tcp->th_ack));
tcppack.c:390: if(p->tcp->th_flags & TH_FIN)
tcppack.c:392: if(p->tcp->th_flags & TH_SYN)
tcppack.c:394: if(p->tcp->th_flags & TH_RST)
tcppack.c:396: if(p->tcp->th_flags & TH_PUSH)
tcppack.c:398: if(p->tcp->th_flags & TH_URG)
|
