- 論壇徽章:
- 0
|
本帖最后由 bjtulq 于 2011-03-17 16:32 編輯
在編譯的時(shí)候?yàn)槭裁匆B接庫(kù):libgthread-2.0.so?能否講一下libgthread-2.0.so的作用啊?
gcc -o show_tcp_connection tcp.c -lpcap -lnet -lnids -lgthread-2.0;不加-lgthread不能編譯成功!
謝謝了! - #include "nids.h"
- /* Libnids的頭文件,必須包含 */
- char ascii_string[10000];
- char *char_to_ascii(char ch)
- /* 此函數(shù)的功能主要用于把協(xié)議數(shù)據(jù)進(jìn)行顯示 */
- {
- char *string;
- ascii_string[0] = 0;
- string = ascii_string;
- if (isgraph(ch))
- /* 可打印字符 */
- {
- *string++ = ch;
- }
- else if (ch == ' ')
- /* 空格 */
- {
- *string++ = ch;
- }
- else if (ch == '\n' || ch == '\r')
- /* 回車(chē)和換行 */
- {
- *string++ = ch;
- }
- else
- /* 其它字符以點(diǎn)"."表示 */
- {
- *string++ = '.';
- }
- *string = 0;
- return ascii_string;
- }
- /*
- =======================================================================================================================
- 下面的函數(shù)是回調(diào)函數(shù),用于分析TCP連接,分析TCP連接狀態(tài),對(duì)TCP協(xié)議傳輸?shù)臄?shù)據(jù)進(jìn)行分析
- =======================================================================================================================
- */
- void tcp_protocol_callback(struct tcp_stream *tcp_connection, void **arg)
- {
- int i;
- char address_string[1024];
- char content[65535];
- char content_urgent[65535];
- struct tuple4 ip_and_port = tcp_connection->addr;
- /* 獲取TCP連接的地址和端口對(duì) */
- strcpy(address_string, inet_ntoa(*((struct in_addr*) &(ip_and_port.saddr))));
- /* 獲取源地址 */
- sprintf(address_string + strlen(address_string), " : %i", ip_and_port.source);
- /* 獲取源端口 */
- strcat(address_string, " <---> ");
- strcat(address_string, inet_ntoa(*((struct in_addr*) &(ip_and_port.daddr))));
- /* 獲取目的地址 */
- sprintf(address_string + strlen(address_string), " : %i", ip_and_port.dest);
- /* 獲取目的端口 */
- strcat(address_string, "\n");
- switch (tcp_connection->nids_state) /* 判斷LIBNIDS的狀態(tài) */
- {
- case NIDS_JUST_EST:
- /* 表示TCP客戶端和TCP服務(wù)器端建立連接狀態(tài) */
- tcp_connection->client.collect++;
- /* 客戶端接收數(shù)據(jù) */
- tcp_connection->server.collect++;
- /* 服務(wù)器接收數(shù)據(jù) */
- tcp_connection->server.collect_urg++;
- /* 服務(wù)器接收緊急數(shù)據(jù) */
- tcp_connection->client.collect_urg++;
- /* 客戶端接收緊急數(shù)據(jù) */
- printf("%sTCP連接建立\n", address_string);
- return ;
- case NIDS_CLOSE:
- /* 表示TCP連接正常關(guān)閉 */
- printf("--------------------------------\n");
- printf("%sTCP連接正常關(guān)閉\n", address_string);
- return ;
- case NIDS_RESET:
- /* 表示TCP連接被RST關(guān)閉 */
- printf("--------------------------------\n");
- printf("%sTCP連接被RST關(guān)閉\n", address_string);
- return ;
- case NIDS_DATA:
- /* 表示有新的數(shù)據(jù)到達(dá) */
- {
- struct half_stream *hlf;
- /* 表示TCP連接的一端的信息,可以是客戶端,也可以是服務(wù)器端 */
- if (tcp_connection->server.count_new_urg)
- {
- /* 表示TCP服務(wù)器端接收到新的緊急數(shù)據(jù) */
- printf("--------------------------------\n");
- strcpy(address_string, inet_ntoa(*((struct in_addr*) &(ip_and_port.saddr))));
- sprintf(address_string + strlen(address_string), " : %i", ip_and_port.source);
- strcat(address_string, " urgent---> ");
- strcat(address_string, inet_ntoa(*((struct in_addr*) &(ip_and_port.daddr))));
- sprintf(address_string + strlen(address_string), " : %i", ip_and_port.dest);
- strcat(address_string, "\n");
- address_string[strlen(address_string) + 1] = 0;
- address_string[strlen(address_string)] = tcp_connection->server.urgdata;
- printf("%s", address_string);
- return ;
- }
- if (tcp_connection->client.count_new_urg)
- {
- /* 表示TCP客戶端接收到新的緊急數(shù)據(jù) */
- printf("--------------------------------\n");
- strcpy(address_string, inet_ntoa(*((struct in_addr*) &(ip_and_port.saddr))));
- sprintf(address_string + strlen(address_string), " : %i", ip_and_port.source);
- strcat(address_string, " <--- urgent ");
- strcat(address_string, inet_ntoa(*((struct in_addr*) &(ip_and_port.daddr))));
- sprintf(address_string + strlen(address_string), " : %i", ip_and_port.dest);
- strcat(address_string, "\n");
- address_string[strlen(address_string) + 1] = 0;
- address_string[strlen(address_string)] = tcp_connection->client.urgdata;
- printf("%s", address_string);
- return ;
- }
- if (tcp_connection->client.count_new)
- {
- /* 表示客戶端接收到新的數(shù)據(jù) */
- hlf = &tcp_connection->client;
- /* 此時(shí)hlf表示的是客戶端的TCP連接信息 */
- strcpy(address_string, inet_ntoa(*((struct in_addr*) &(ip_and_port.saddr))));
- sprintf(address_string + strlen(address_string), ":%i", ip_and_port.source);
- strcat(address_string, " <--- ");
- strcat(address_string, inet_ntoa(*((struct in_addr*) &(ip_and_port.daddr))));
- sprintf(address_string + strlen(address_string), ":%i", ip_and_port.dest);
- strcat(address_string, "\n");
- printf("--------------------------------\n");
- printf("%s", address_string);
- memcpy(content, hlf->data, hlf->count_new);
- content[hlf->count_new] = '\0';
- printf("客戶端接收數(shù)據(jù)\n");
- for (i = 0; i < hlf->count_new; i++)
- {
- printf("%s", char_to_ascii(content[i]));
- /* 輸出客戶端接收的新的數(shù)據(jù),以可打印字符進(jìn)行顯示 */
- }
- printf("\n");
- }
- else
- {
- /* 表示服務(wù)器端接收到新的數(shù)據(jù) */
- hlf = &tcp_connection->server;
- /* 此時(shí)hlf表示服務(wù)器端的TCP連接信息 */
- strcpy(address_string, inet_ntoa(*((struct in_addr*) &(ip_and_port.saddr))));
- sprintf(address_string + strlen(address_string), ":%i", ip_and_port.source);
- strcat(address_string, " ---> ");
- strcat(address_string, inet_ntoa(*((struct in_addr*) &(ip_and_port.daddr))));
- sprintf(address_string + strlen(address_string), ":%i", ip_and_port.dest);
- strcat(address_string, "\n");
- printf("--------------------------------\n");
- printf("%s", address_string);
- memcpy(content, hlf->data, hlf->count_new);
- content[hlf->count_new] = '\0';
- printf("服務(wù)器端接收數(shù)據(jù)\n");
- for (i = 0; i < hlf->count_new; i++)
- {
- printf("%s", char_to_ascii(content[i]));
- /* 輸出服務(wù)器接收到的新的數(shù)據(jù) */
- }
- printf("\n");
- }
- }
- default:
- break;
- }
- return ;
- }
- void main()
- {
- if (!nids_init())
- /* Libnids初始化 */
- {
- printf("出現(xiàn)錯(cuò)誤:%s\n", nids_errbuf);
- exit(1);
- }
- nids_register_tcp(tcp_protocol_callback);
- /* 注冊(cè)回調(diào)函數(shù) */
- nids_run();
- /* Libnids進(jìn)入循環(huán)捕獲數(shù)據(jù)包狀態(tài) */
- }
復(fù)制代碼 |
|