find.h

一个入侵检测小程序,用C编写,linux环境

//find.h
#ifndef __FIND_H__
#define __FIND_H__

/*INCLUDE*/
#include"annids.h"


/*DEFINE*/



#define ETHER_HEADER_LEN 14



/*VAR*/
int pnp;//remember how many members of pp[] have been rewriten

struct ether_header *eh;
struct ip *iph;
struct ether_arp *arph;
struct tcphdr *tcph;
struct udphdr *udph;
struct icmphdr *icmph;
struct igmp *igmph;
u_char *eth_index;//point to ether head
u_char *ia_index;//point to ip or arp head
u_char *tuii_index;//point to tcp,udp,icmp or igmp head
int eth_type;
  /************************************  
  int p_eth[96];
  //pp[0]=1,pp[1]=0 behalf ip;pp[0]=0,pp[1]=1 behalf arp
  int p_ip[160];//pp[2]~pp[161]
  int p_arp[104];//WARNNING the segment has been divided!!!pp[2]~pp[105],pp[106]~[161]=0 andpp[162]~pp[229]=0
  //pp[162],[163],[164],[165] behalf the four type
  int p_tcp[64];//pp[166]~pp[229]
  int p_udp[64];
  int p_icmp[64];
  int p_igmp[64];
  ************************************/ 

/*FUNCTION*/
void GetEthernet(char *,struct pcap_pkthdr *,u_char *);
void GetRawIP(char *,struct pcap_pkthdr *,u_char *);
void PrintIntru(int);
void GetBit(u_char *,int);



#endif