tcp.c

Nast是一个基于Libnet 和Libpcap的sniffer包和LAN分析器。它可以在通常模式或混合模式下检查通过网络接口的数据包

/*
    nast

    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
    Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.

*/

#include "include/nast.h"

/* handle a tcp packet */
void handle_TCP (u_short d, u_short x, FILE *output, FILE *ldd)
{
   struct libnet_ipv4_hdr *ip;
   struct libnet_tcp_hdr *tcp;
   struct servent *service;
   u_char flags;
   u_short size_ip, size_tcp, size_buf;

   size_ip = LIBNET_IPV4_H;
   size_buf = 0;

   ip = (struct libnet_ipv4_hdr *) (packet+offset);
   tcp = (struct libnet_tcp_hdr *) (packet+size_ip+offset);

   size_tcp = (tcp->th_off) * 4;

   fprintf(output, "\n---[ TCP ]-----------------------------------------------------------\n");
   service = getservbyport(htons(ntohs(tcp->th_sport)), "tcp");
   fprintf(output, "%s:%d(%s)",inet_ntoa(ip->ip_src),ntohs(tcp->th_sport),(service) ? service->s_name : "unknown");
   service = getservbyport(htons(ntohs(tcp->th_dport)), "tcp");
   fprintf(output, " -> ");
   fprintf(output, "%s:%d(%s)\n",inet_ntoa(ip->ip_dst),ntohs(tcp->th_dport),(service) ? service->s_name : "unknown");
   fprintf(output, "TTL: %d \t", ip->ip_ttl);
   fprintf(output, "Window: %d\t", ntohs(tcp->th_win));
   fprintf(output, "Version: %d\t", ip->ip_v);
   fprintf(output, "Lenght: %d\n", ntohs(ip->ip_len));
   fprintf(output, "FLAGS: ");

   /* modifed by embyte */
   flags = tcp->th_flags;

   if (flags & TH_FIN) /* se mascherando con il fin ottengo 1 vuol dire che c