ipretperro.c

记录IP/TCP/UDP/ICMP网络包日志

              */
             case 130: /* opt_copied == 1 && opt_class == 0 && opt_number == 2 */
                       /* 10000010 = 130 */
                       printf( "%-30.30s %4d | %6d | %6d | Security.\n", " ", opt_class, opt_number, opt_len); 
                       break;
             /* DoD Extended Security, RFC 1108 */
             case 133: /* opt_copied == 1 && opt_class == 0 && opt_number == 5 */
                       printf( "%-30.30s %4d | %6d | %6d | Extended Security.\n", " ", opt_class, opt_number, opt_len); 
                       break;
             /* 
              * CIPSO, Commercial IP Security Option.
              * I don't know where it came from...
              * I saw it in RFC 1700, but this RFC doesn't have information
              * about it.
              */
             case 134: /* opt_copied == 1 && opt_class == 0 && opt_number == 6 */
                       printf( "%-30.30s %4d | %6d | %6d | Commercial Security.\n", " ", opt_class, opt_number, opt_len); 
                       break;
             /* Loose Source Routing option */
             case 131: /* opt_copied == 1 && opt_class == 0 && opt_number == 3 */
                       printf( "%-30.30s %4d | %6d | %6d | Loose Source Routing.\n" , " ", opt_class, opt_number, opt_len);
                       print_ipoptions_route( buf + 3, opt_len, routing_ptr);
                       break;
             /* Strict Source Routing option */
             case 137: /* opt_copied == 1 && opt_class == 0 && opt_number == 9 */
                       printf( "%-30.30s %4d | %6d | %6d | Strict Source Routing.\n", " ", opt_class, opt_number, opt_len); 
                       print_ipoptions_route( buf + 3, opt_len, routing_ptr);
                       break;
             /* 
                EIP
                The Extended Internet Protocol
                See RFC 1385.
                I think it isn't implemented.
                AFAIK it isn't an IP option (see the rfc), but it appears
                as an IP option for host & routers that don't understand it.
             */
             case 138: /* opt_copied == 1 && opt_class == 0 && opt_number == 10 */
                       printf( "%-30.30s %4d | %6d | %6d | EIP ID.\n", " ", opt_class, opt_number, opt_len); 
                       break;
             /* Experimental Measurement, RFC 1700 */
             case  10: /* opt_copied == 0 && opt_class == 0 && opt_number == 10 */
                       printf( "%-30.30s %4d | %6d | %6d | Experimental Measurement.\n", " ", opt_class, opt_number, opt_len); 
                       break;
             /* MTU Probe RFC1191 & RFC1700 */
             case  11: /* opt_copied == 0 && opt_class == 0 && opt_number == 11 */
                       printf( "%-30.30s %4d | %6d | %6d | MTU Probe.\n", " ", opt_class, opt_number, opt_len); 
                       break;
             /* MTU Reply RFC1191 & RFC1700 */
             case  12: /* opt_copied == 0 && opt_class == 0 && opt_number == 12 */
                       printf( "%-30.30s %4d | %6d | %6d | MTU Reply.\n", " ", opt_class, opt_number, opt_len); 
                       break;
             /* Experimental Flow Control RFC1700 */
             case 205: /* opt_copied == 1 && opt_class == 2 && opt_number == 13 */
                       printf( "%-30.30s %4d | %6d | %6d | Experimental Flow Control.\n", " ", opt_class, opt_number, opt_len); 
                       break;
             /* Experimental Access Control RFC1700 */
             case 142: /* opt_copied == 1 && opt_class == 0 && opt_number == 14 */
                       printf( "%-30.30s %4d | %6d | %6d | Experimental Access Control.\n", " ", opt_class, opt_number, opt_len); 
                       break;
             /* ENCODE ??? RFC 1700 */
             case  15: /* opt_copied == 0 && opt_class == 0 && opt_number == 15 */
                       printf( "%-30.30s %4d | %6d | %6d | ENCODE ???.\n", " ", opt_class, opt_number, opt_len); 
                       break;
             /* IMI Traffic Descriptor, RFC 1700 */
             case 144: /* opt_copied == 1 && opt_class == 0 && opt_number == 16 */
                       printf( "%-30.30s %4d | %6d | %6d | IMI Traffic Descriptor.\n", " ", opt_class, opt_number, opt_len); 
                       break;
             /* EIP ??? RFC 1700 */
             case 145: /* opt_copied == 1 && opt_class == 0 && opt_number == 17 */
                       printf( "%-30.30s %4d | %6d | %6d | EIP ???.\n", " ", opt_class, opt_number, opt_len); 
                       break;
             /* Address Extension RFC 1700 */
             case 147: /* opt_copied == 1 && opt_class == 0 && opt_number == 19 */
                       printf( "%-30.30s %4d | %6d | %6d | Address Extension.\n", " ", opt_class, opt_number, opt_len); 
                       break;
             /* Record route option */
             case   7: /* opt_copied == 0 && opt_class == 0 && opt_number == 7 */
                       printf( "%-30.30s %4d | %6d | %6d | Record Route.\n"         , " ", opt_class, opt_number, opt_len); 
                       print_ipoptions_route( buf + 3, opt_len, routing_ptr);
                       break;
             /* 
              * Stream ID option
              * Another obsolete option. See RFC 1122.
              */
             case 136: /* opt_copied == 1 && opt_class == 0 && opt_number == 8 */
                       printf( "%-30.30s %4d | %6d | %6d | Stream ID.\n"            , " ", opt_class, opt_number, opt_len); 
                       memcpy( &stream_id, &buf[ 2], 2);
                       printf( "%-30.30sStream ID: %d (0x%x)\n", " ", stream_id, stream_id);
                       break;
             /* Router Alert option, RFC 2113 */
             case 148: /* opt_copied == 1 && opt_class == 0 && opt_number == 20 */
                       printf( "%-30.30s %4d | %6d | %6d | Router Alert.\n", " ", opt_class, opt_number, opt_len); 
                       memcpy( &router_alert, &buf[ 2], 2);
                       printf( "%-30.30sValue: %d (0x%x): ", " ", router_alert, router_alert);
                       switch( router_alert) {
                               case  0: printf( "Router shall examine packet\n");
                                        break;
                               default: printf( "Reserved\n");
                                        break;
                       }
                       break;
             /*
              * IP Traceroute option
              * (Is it implemented?)
              * See RFC 1393
              */
             case  82: /* opt_copied == 0 && opt_class == 2 && opt_number == 18 */
                       printf( "%-30.30s %4d | %6d | %6d | IP Traceroute option.\n", " ", opt_class, opt_number, opt_len); 
                       memcpy( &tmp, &buf[ 2], 2);
                       printf( "%-30.30sID number: %-5d (0x%x)\n", " ", tmp, tmp); 
                       memcpy( &tmp, &buf[ 4], 2);
                       printf( "%-30.30sOHC      : %-5d (0x%x)\n", " ", tmp, tmp); 
                       memcpy( &tmp, &buf[ 6], 2);
                       printf( "%-30.30sRHC      : %-5d (0x%x)\n", " ", tmp, tmp); 
                       memcpy( &ts_ipaddr.s_addr, &buf[ 8], 4);
                       printf( "%-30.30sOrig. IP : %s\n", " ", inet_ntoa( ts_ipaddr));
                       break;
             /* Internet Timestamp option, RFC 781 and 791 */
             case  68: /* opt_copied == 1 && opt_class == 2 && opt_number == 4  */
                       printf( "%-30.30s %4d | %6d | %6d | Internet Timestamp.\n"   , " ", opt_class, opt_number, opt_len); 
                       printf( "%-30.30sPointer : %-5d (0x%x)\n", " ", routing_ptr, routing_ptr);
                       timestamp_overflow = timestamp_flag = 0;
                       timestamp_overflow = ( buf[ 3] & 0xF0) >> 4;
                       timestamp_flag     = buf[ 3] & 0x0F;
                       printf( "%-30.30sOverflow: %-5d (0x%x)\n", " ", timestamp_overflow, timestamp_overflow);
                       printf( "%-30.30sFlags   : %-5d: "       , " ", timestamp_flag);
                       switch( timestamp_flag) {
                               case 0: printf( "Time stamps only\n");
                                       break;
                               case 1: printf( "Internet Address + Timestamp\n");
                                       break;
                               case 3: printf( "Internet address fields prespecified\n");
                                       break;
                       }

                       k = opt_len;
                       k -= 3;
                       i = 4;
                       while( k > 0) {
                              if( timestamp_flag == 0) {
                                  memcpy( &ts_date, &buf[ i], 4);
                                  printf( "%-30.30s(0x%lx)\n", " ", ts_date);
                                  k -= 4;
                                  i += 4;
                              } else {
                                  memcpy( &ts_ipaddr.s_addr, &buf[ i], 4);
                                  i += 4;
                                  printf( "%-30.30sIP address: %s\n", " ", inet_ntoa( ts_ipaddr));
                                  memcpy( &ts_date, &buf[ i], 4);
                                  i += 4;
                                  printf( "%-30.30s(0x%lx)\n", " ", ts_date);
                                  k -= 8;
                              }
                       }
                       break;
     } /* end if( opt_class == 0) */
     printf( "IP options raw hex data     :\n");
 } /* end if( verbose) */

 print_ala_hexdump( buf, size);
}

void print_ipoptions_route( char *buf, unsigned char opt_len, unsigned char routing_ptr)
{
 struct in_addr route_ip;
 int i, j, k;

 printf( "%-30.30sPointer: %d (0x%x)\n", " ", routing_ptr, routing_ptr);

 /* if opt_len < 4 then it is a wrong packet,
    it is already droped by the kernel, so don't check it. */

 k = opt_len;
 k -= 3;

 i = 0;
 j = 0;

 while( k > 0) {
        memcpy( &route_ip.s_addr, &buf[ j], 4);
        k -= 4;
        j += 4;
        i++;
        printf( "%-30.30sAddress number %-5d: %s\n", " ", i, inet_ntoa( route_ip));
 }
}

void print_header_tcp( struct perro_tcphdr tcph)
{
 int tcphl;
 char buf[ 16];
 int res;

 printf( "******* TCP Header *******\n");

 printf( "Source port address (From)  : %d/%s\n", htons( tcph.th_sport), get_serv_name( tcph.th_sport, "tcp"));
 printf( "Destination port address    : %d/%s\n", htons( tcph.th_dport), get_serv_name( tcph.th_dport, "tcp"));
 
 printf( "Sequence Number             : %lu (0x%lx)\n", htonl( tcph.th_seq), htonl( tcph.th_seq));
 printf( "Acknowledgement Number      : %lu (0x%lx)\n", htonl( tcph.th_ack), htonl( tcph.th_ack));

 tcphl = ( tcph.th_do & 0xF0) >> 4;

 printf( "TCP Header Length           : %-5d (0x%x) == %d bytes\n", tcphl, tcphl, tcphl * 4);

 buf[ 0] = tcph.th_do;
 buf[ 1] = tcph.th_flags;
 buf[ 3] = 0;

 res = atoi( buf);
 res = (res & 0x0FC0) >> 6;

 printf( "Reserved                    : %-5d (0x%x)\n", res, res);
 printf( "URG flag                    : %s\n", tcph.th_flags & PERRO_TH_URG ? "ON" : "OFF");
 printf( "ACK flag                    : %s\n", tcph.th_flags & PERRO_TH_ACK ? "ON" : "OFF");
 printf( "PUSH flag                   : %s\n", tcph.th_flags & PERRO_TH_PSH ? "ON" : "OFF");
 printf( "RST flag                    : %s\n", tcph.th_flags & PERRO_TH_RST ? "ON" : "OFF");
 printf( "SYN flag                    : %s\n", tcph.th_flags & PERRO_TH_SYN ? "ON" : "OFF");
 printf( "FIN flag                    : %s\n", tcph.th_flags & PERRO_TH_FIN ? "ON" : "OFF");
 printf( "Window size                 : %-5d (0x%x)\n", htons( tcph.th_win), htons( tcph.th_win));
 printf( "TCP checksum                : %-5d (0x%x)\n", htons( tcph.th_sum), htons( tcph.th_sum));
 printf( "Urgent pointer              : %-5d (0x%x)\n", htons( tcph.th_urp), htons( tcph.th_urp));

}

void print_header_tcp_options( char *buf, int tcpol)
{
 PERRO_U8  opt_kind; /* Option kind             */
 PERRO_U8  opt_len;  /* Option length           */
 PERRO_U16 opt_mss;  /* Maximum Segment Size    */
 PERRO_U16 opt_ro;   /* Relative Origin         */ /* RFC 1072 (Obsolete)*/
 PERRO_U16 opt_bs;   /* Block Size              */
 PERRO_U32 opt_echo; /* Echo bytes              */
 PERRO_U32 opt_ts;   /* Timestamp value         */
 PERRO_U8  pocsp;    /* TCP POC-service-profile */
 int i;

 printf( "TCP Options                 : ");

 opt_kind = ( PERRO_U8) buf[ 0];

 printf( "Kind   : %-5d (0x%x)\n", opt_kind, opt_kind);
 printf( "%-30.30sMeaning: ", " ");

 /* See RFC 1700 [Page 72] */
 switch( opt_kind) {
         /* See RFC 793 */
         case  0: printf( "End of option list.\n"  ); break;
         case  1: printf( "No-Operation.\n"        ); break;
         case  2: printf( "Maximum Segment Size.\n"); break;
         /* RFC 1323 */
         case  3: printf( "WSOPT - Window Scale.\n"); break; 
         /* RFC 1072 */
         case  4: printf( "SACK Permitted.\n");       break;
         case  5: printf( "SACK.\n");                 break;
         case  6: printf( "Echo.\n");                 break;
         case  7: printf( "Echo Reply.\n");           break;
         /* RFC 1323 */
         case  8: printf( "TSOPT - Time Stamp Option.\n"); break;
         /* RFC 1693 */
         case  9: printf( "Partial Order Connection Permitted.\n"); break;
         case 10: printf( "Partial Order Service Profile.\n");      break;
         /* RFC 1700 */
         case 11: printf( "CC.\n");      break;
         case 12: printf( "CC.NEW.\n");  break;
         case 13: printf( "CC.ECHO.\n"); break;
         /* RFC 1146 */
         case 14: printf( "TCP Alternate Checksum Request.\n"); break;
         case 15: printf( "TCP Alternate Checksum Data.\n");    break;
         /* RFC 1700 */
         case 16: printf( "Skeeter.\n");                 break;
         case 17: printf( "Bubba.\n");                   break;
         case 18: printf( "Trailer Checksum Option.\n"); break;
 }

 printf( "%-30.30sLength : ", " ");

 opt_len  = ( PERRO_U8) buf[ 1];

 switch( opt_kind) {
         case  0: 
         case  1: printf( "N/A\n");
                  opt_len = 0;
                  break;
         case  2: 
         case  3: 
         case  4: 
         case  5: 
         case  6:
         case  7:
         case  8:
         case  9:
         case 10:
         case 11:
         case 12:
         case 13:
         case 14:
         case 15:
         case 16:
         case 17:
         case 18:
                  printf( "%-5d (0x%x)\n", opt_len, opt_len);
                  break;
 }

 switch( opt_kind) {/*
         case  0:  nothing 
         case  1: 
         case  4: 
         case  9: 
         case 11: 
         case 12: 
         case 13: 
         case 16: 
         case 17: 
         case 18: 
                  break;*/
         case  2: memcpy( &opt_mss, &buf[ 2], 2);
                  opt_mss = htons( opt_mss);
                  printf( "%-30.30sMax. Seg. Size: %-5d (0x%x)\n", " ", opt_mss, opt_mss);
                  break;
         case  3: printf( "%-30.30sShift count   : %d (0x%x)\n", " ", ( PERRO_U8) buf[ 2], ( PERRO_U8) buf[ 2]);
                  break;
         case  5: i = 2;
                  while( i < opt_len) {  
                         memcpy( &opt_ro, &buf[ i], 2);
                         i += 2;
                         memcpy( &opt_bs, &buf[ i], 2);
                         i += 2;
                         printf( "%-30.30sRelat. origin : %-5d (0x%x)\n", " ", opt_ro, opt_ro);
                         printf( "%-30.30sBlock size    : %-5d (0x%x)\n", " ", opt_bs, opt_bs);
                  }
                  break;
         case  6: 
         case  7: 
                  memcpy( &opt_echo, &buf[ 2], 4);
                  printf( "%-30.30sEcho bytes    : %-5ld (0x%lx)\n", " ", opt_echo, opt_echo);
                  break;
         case  8:
                  memcpy( &opt_ts, &buf[ 2], 4);
                  printf( "%-30.30sTimestamp Val.: %-5ld (0x%lx)\n", " ", opt_ts, opt_ts);
                  memcpy( &opt_ts, &buf[ 6], 4);
                  printf( "%-30.30sTS Echo Reply : %-5ld (0x%lx)\n", " ", opt_ts, opt_ts);
                  break;
         case 10:
                  pocsp = ( PERRO_U8) buf[ 2];
                  pocsp = (pocsp & 0x80) >> 7;
                  printf( "%-30.30sStart flag    : %s (0x%x)\n", " ", pocsp ? "ON": "OFF", pocsp);
                  pocsp = ( PERRO_U8) buf[ 2];
                  pocsp = (pocsp & 0x40) >> 6;
                  printf( "%-30.30sEnd flag      : %s (0x%x)\n", " ", pocsp ? "ON": "OFF", pocsp);
                  pocsp = ( PERRO_U8) buf[ 2];
                  pocsp = pocsp & 0x3F;
                  printf( "%-30.30sFiller        : %d (0x%x)\n", " ", pocsp, pocsp); 
                  break;
         case 14:
                  printf( "%-30.30sChecksum      : %d (0x%x)\n", " ", ( PERRO_U8) buf[ 2], ( PERRO_U8) buf[ 2]);
                  printf( "%-30.30sKind of cksum : ", " ");
                  switch( ( PERRO_U8) buf[ 2]) {
                          case 0: printf( "TCP checksum.\n");
                                  break;
                          case 1: printf( "8-bit Fletcher's algorithm.\n");
                                  break;
                          case 2: printf( "16-bit Fletcher's algorithm.\n");