head.h

作者自己修改的一个基于网络的入侵检测系统

#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <netinet/ip_icmp.h>
#include <netinet/if_ether.h>

#include <string.h>
#include <stdlib.h>
#include <stdio.h>
#include <signal.h>
#include <unistd.h>

#include <sys/types.h> 
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <linux/sockios.h>
#include <linux/if.h>

#define MAXBUFFSIZE 65536  
#define MAX_URL_LEN 200   
#define MAX_SYN 5
#define MAX_ECHO 5
#define MAX_ECHOREPLY 5

#ifndef IP_OFFSET
#define IP_OFFSET 0x1FFF
#endif
FILE *logfd;

struct record {
long saddr,daddr;
unsigned int sport,dport;
unsigned int status;
unsigned long start_time,last_time;
};

struct trafflog {
unsigned long ippacket;
unsigned long fragment;	
unsigned long bad_ippacket;	
unsigned long tcppacket;
unsigned long bad_tcppacket;
unsigned long udppacket;
unsigned long bad_udppacket;
unsigned long icmppacket;
unsigned long bad_icmppacket;
unsigned long igmppacket;
unsigned long unknownpacket;
unsigned long totalbytes;
};


struct sbuff
{
   union{
   struct tcphdr *tcph;
   struct udphdr *udph;
   struct icmphdr *icmph;
   struct igmphdr *igmph;
   } h;
   
   union{
   struct iphdr *iph;
   } nh;
   
   unsigned char *data;
} ;


struct attack_stats {
    unsigned int synflood;
    struct sbuff synsbuff;
    unsigned int pingflood;
    struct sbuff pingsbuff;
    unsigned int smurf;
    struct sbuff smurfsbuff;
};


extern void print_iph(const struct iphdr *iph);
extern void print_tcph(const struct tcphdr *tcph);
extern void print_udph(const struct udphdr *udph);
extern void print_icmph(const struct icmphdr *icmph);

extern void do_log(char *msg, \
                   const struct sbuff *sb);

extern void err_quit(char * errbuff);
extern void final_quit();

extern void process_tcp(const struct sbuff *sbuffptr);
extern void process_udp(const struct sbuff *sbuffptr);
extern void process_icmp(const struct sbuff *sbuffptr);
extern void process_igmp(const struct sbuff *sbuffptr);
extern void stats();

extern int findport(__u16 port);
extern void process_cfg();

extern void check_dos_land(const struct sbuff *sbuffptr);
extern void check_dos_winnuke(const struct sbuff *sbuffptr);
extern void check_probe_cgi(const struct sbuff *sbuffptr);
extern void check_scan_tcp(const struct sbuff *sbuffptr);
extern void check_dos_longurl(const struct sbuff *sbuffptr);

extern void check_dos_pingofdeath(const struct sbuff *sbuffptr);