othptab.c

一个网络流量分析的完整的程序

	scrollok(table->othpwin, 0);
	wattrset(table->othpwin, UNKNATTR);
	wprintw(table->othpwin, sp_buf, ' ');
	scrollok(table->othpwin, 1);
	wmove(table->othpwin, target_row, 1);

	switch (entry->protocol) {
	case ETH_P_ARP:
	    sprintf(msgstring, "ARP ");
	    switch (ntohs(entry->un.arp.opcode)) {
	    case ARPOP_REQUEST:
		strcat(msgstring, "request for ");
		memcpy(&(saddr.s_addr), entry->un.arp.dest_ip_address, 4);
		break;
	    case ARPOP_REPLY:
		strcat(msgstring, "reply from ");
		memcpy(&(saddr.s_addr), entry->un.arp.src_ip_address, 4);
		break;
	    }

	    sprintf(scratchpad, inet_ntoa(saddr));
	    strcat(msgstring, scratchpad);
	    wattrset(table->othpwin, ARPATTR);
	    break;
	case ETH_P_RARP:
	    sprintf(msgstring, "RARP ");
	    memset(rarp_mac_addr, 0, 15);
	    switch (ntohs(entry->un.rarp.opcode)) {
	    case ARPOP_RREQUEST:
		strcat(msgstring, "request for ");
		convmacaddr(entry->un.rarp.dest_mac_address,
			    rarp_mac_addr);
		break;
	    case ARPOP_RREPLY:
		strcat(msgstring, "reply from ");
		convmacaddr(entry->un.rarp.src_mac_address, rarp_mac_addr);
		break;
	    }

	    sprintf(scratchpad, rarp_mac_addr);
	    strcat(msgstring, scratchpad);
	    wattrset(table->othpwin, ARPATTR);
	    break;
	default:
	    packet_type = packetlookup(entry->protocol);
	    if (packet_type == NULL)
		sprintf(msgstring, "Non-IP (0x%x)", entry->protocol);
	    else
		sprintf(msgstring, "Non-IP (%s)", packet_type);

	    wattrset(table->othpwin, UNKNATTR);
	}

	strcpy(protname, msgstring);
	sprintf(scratchpad, " (%u bytes)", entry->pkt_length);
	strcat(msgstring, scratchpad);

	if ((entry->linkproto == LINK_ETHERNET) ||
	    (entry->linkproto == LINK_PLIP) ||
	    (entry->linkproto == LINK_FDDI)) {
	    sprintf(scratchpad, " from %s to %s on %s",
		    entry->smacaddr, entry->dmacaddr, entry->iface);

	    strcat(msgstring, scratchpad);
	}
	startstr = msgstring + table->strindex;
	waddnstr(table->othpwin, startstr, COLS - 4);
	writeothplog(logging, logfile, protname, "", "", 0, 0,
		     entry);
	return;
    }
    strcpy(additional, "");
    strcpy(description, "");

    switch (entry->protocol) {
    case IPPROTO_UDP:
	wattrset(table->othpwin, UDPATTR);
	strcpy(protname, "UDP");
	break;
    case IPPROTO_ICMP:
	wattrset(table->othpwin, STDATTR);
	strcpy(protname, "ICMP");
	break;
    case IPPROTO_OSPFIGP:
	wattrset(table->othpwin, OSPFATTR);
	strcpy(protname, "OSPF");
	break;
    case IPPROTO_IGP:
	wattrset(table->othpwin, IGPATTR);
	strcpy(protname, "IGP");
	break;
    case IPPROTO_IGMP:
	wattrset(table->othpwin, IGMPATTR);
	strcpy(protname, "IGMP");
	break;
    case IPPROTO_IGRP:
	wattrset(table->othpwin, IGRPATTR);
	strcpy(protname, "IGRP");
	break;
    case IPPROTO_GRE:  
        wattrset(table->othpwin, GREATTR);
        strcpy(protname, "GRE");
        break;
    default:
	wattrset(table->othpwin, UNKNATTR);
	sprintf(protname, "IP protocol");
	unknown = 1;
    }

    if (!(entry->fragment)) {
	if (entry->protocol == IPPROTO_ICMP) {
	    switch (entry->un.icmp.type) {
	    case ICMP_ECHOREPLY:
		strcpy(description, "echo rply");
		break;
	    case ICMP_ECHO:
		strcpy(description, "echo req");
		break;
	    case ICMP_DEST_UNREACH:
		strcpy(description, "dest unrch");
		switch (entry->un.icmp.code) {
		case ICMP_NET_UNREACH:
		    strcpy(additional, "ntwk");
		    break;
		case ICMP_HOST_UNREACH:
		    strcpy(additional, "host");
		    break;
		case ICMP_PROT_UNREACH:
		    strcpy(additional, "proto");
		    break;
		case ICMP_PORT_UNREACH:
		    strcpy(additional, "port");
		    break;
		case ICMP_FRAG_NEEDED:
		    strcpy(additional, "DF set");
		    break;
		case ICMP_SR_FAILED:
		    strcpy(additional, "src rte fail");
		    break;
		case ICMP_NET_UNKNOWN:
		    strcpy(additional, "net unkn");
		    break;
		case ICMP_HOST_UNKNOWN:
		    strcpy(additional, "host unkn");
		    break;
		case ICMP_HOST_ISOLATED:
		    strcpy(additional, "src isltd");
		    break;
		case ICMP_NET_ANO:
		    strcpy(additional, "net comm denied");
		    break;
		case ICMP_HOST_ANO:
		    strcpy(additional, "host comm denied");
		    break;
		case ICMP_NET_UNR_TOS:
		    strcpy(additional, "net unrch for TOS");
		    break;
		case ICMP_HOST_UNR_TOS:
		    strcpy(additional, "host unrch for TOS");
		    break;
		case ICMP_PKT_FILTERED:
		    strcpy(additional, "pkt fltrd");
		    break;
		case ICMP_PREC_VIOLATION:
		    strcpy(additional, "prec violtn");
		    break;
		case ICMP_PREC_CUTOFF:
		    strcpy(additional, "prec cutoff");
		    break;
		}

		break;
	    case ICMP_SOURCE_QUENCH:
		strcpy(description, "src qnch");
		break;
	    case ICMP_REDIRECT:
		strcpy(description, "redirct");
		break;
	    case ICMP_TIME_EXCEEDED:
		strcpy(description, "time excd");
		break;
	    case ICMP_PARAMETERPROB:
		strcpy(description, "param prob");
		break;
	    case ICMP_TIMESTAMP:
		strcpy(description, "timestmp req");
		break;
	    case ICMP_INFO_REQUEST:
		strcpy(description, "info req");
		break;
	    case ICMP_INFO_REPLY:
		strcpy(description, "info rep");
		break;
	    case ICMP_ADDRESS:
		strcpy(description, "addr mask req");
		break;
	    case ICMP_ADDRESSREPLY:
		strcpy(description, "addr mask rep");
		break;
	    default:
		strcpy(description, "bad/unkn");
		break;
	    }

	} else if (entry->protocol == IPPROTO_OSPFIGP) {
	    switch (entry->un.ospf.type) {
	    case OSPF_TYPE_HELLO:
		strcpy(description, "hlo");
		break;
	    case OSPF_TYPE_DB:
		strcpy(description, "DB desc");
		break;
	    case OSPF_TYPE_LSR:
		strcpy(description, "LSR");
		break;
	    case OSPF_TYPE_LSU:
		strcpy(description, "LSU");
		break;
	    case OSPF_TYPE_LSA:
		strcpy(description, "LSA");
		break;
	    }
	    sprintf(additional, "a=%lu r=%s", entry->un.ospf.area,
		    entry->un.ospf.routerid);
	}
    } else
	strcpy(description, "fragment");

    strcpy(msgstring, protname);
    strcat(msgstring, " ");

    if (strcmp(description, "") != 0) {
	strcat(msgstring, description);
	strcat(msgstring, " ");
    }
    if (strcmp(additional, "") != 0) {
	sprintf(scratchpad, "(%s) ", additional);
	strcat(msgstring, scratchpad);
    }
    if (unknown) {
	sprintf(scratchpad, "%u ", entry->protocol);
	strcat(msgstring, scratchpad);
    }
    sprintf(scratchpad, "(%u bytes) ", entry->pkt_length);
    strcat(msgstring, scratchpad);

    if ((entry->protocol == IPPROTO_UDP) && (!(entry->fragment))) {
	sprintf(scratchpad, "from %.25s:%s to %.25s:%s",
		entry->s_fqdn, entry->un.udp.s_sname,
		entry->d_fqdn, entry->un.udp.d_sname);
    } else {
	sprintf(scratchpad, "from %.25s to %.25s", entry->s_fqdn,
		entry->d_fqdn);
    }

    strcat(msgstring, scratchpad);
    
    if (((entry->smacaddr)[0] != '\0') && (table->mac)) {
        snprintf(scratchpad, MSGSTRING_MAX, " (src HWaddr %s)", entry->smacaddr); 
        strcat(msgstring, scratchpad);
    }
    strcat(msgstring, " on ");
    strcat(msgstring, entry->iface);

    wmove(table->othpwin, target_row, 0);
    scrollok(table->othpwin, 0);
    wprintw(table->othpwin, sp_buf, ' ');
    scrollok(table->othpwin, 1);
    wmove(table->othpwin, target_row, 1);
    startstr = msgstring + table->strindex;
    waddnstr(table->othpwin, startstr, COLS - 4);

    if (logging)
	writeothplog(logging, logfile, protname, description, additional,
		     1, table->mac, entry);
}

void refresh_othwindow(struct othptable *table)
{
    int target_row = 0;
    struct othptabent *entry;

    wattrset(table->othpwin, STDATTR);
    tx_colorwin(table->othpwin);

    entry = table->firstvisible;

    while ((entry != NULL) && (entry != table->lastvisible->next_entry)) {
	printothpentry(table, entry, target_row, 0, (FILE *) NULL);
	target_row++;
	entry = entry->next_entry;
    }

    update_panels();
    doupdate();
}

void destroyothptable(struct othptable *table)
{
    struct othptabent *ctemp;
    struct othptabent *ctemp_next;

    if (table->head != NULL) {
	ctemp = table->head;
	ctemp_next = table->head->next_entry;

	while (ctemp != NULL) {
	    free(ctemp);
	    ctemp = ctemp_next;

	    if (ctemp_next != NULL)
		ctemp_next = ctemp_next->next_entry;
	}
    }
}