tcpip.h (tcpflow-1.5.0) | : | tcpip.h (tcpflow-1.6.1) | ||
---|---|---|---|---|
skipping to change at line 159 | skipping to change at line 159 | |||
/* | /* | |||
* A flow is a flow_addr that has additional information regarding when it was s een | * A flow is a flow_addr that has additional information regarding when it was s een | |||
* and how many packets were seen. The address is used to locate the flow in the array. | * and how many packets were seen. The address is used to locate the flow in the array. | |||
* Notice that it contains no pointers, so it can be copied with the default ope rator. | * Notice that it contains no pointers, so it can be copied with the default ope rator. | |||
*/ | */ | |||
class flow : public flow_addr { | class flow : public flow_addr { | |||
public:; | public:; | |||
static void usage(); // print information on flow nota tion | static void usage(); // print information on flow nota tion | |||
static std::string filename_template; // | static std::string filename_template; // | |||
static std::string outdir; // where the output gets written | static std::string outdir; // where the output gets written | |||
flow():id(),vlan(),mac_daddr(),mac_saddr(),tstart(),tlast(),len(),caplen(),p acket_count(){}; | flow():id(),vlan(),mac_daddr(),mac_saddr(),tstart(),tlast(),len(),caplen(),p acket_count(),session_id(){}; | |||
flow(const flow_addr &flow_addr_,uint64_t id_,const be13::packet_info &pi): | flow(const flow_addr &flow_addr_,uint64_t id_,const be13::packet_info &pi): | |||
flow_addr(flow_addr_),id(id_),vlan(pi.vlan()), | flow_addr(flow_addr_),id(id_),vlan(pi.vlan()), | |||
mac_daddr(), | mac_daddr(), | |||
mac_saddr(), | mac_saddr(), | |||
tstart(pi.ts),tlast(pi.ts), | tstart(pi.ts),tlast(pi.ts), | |||
len(0), | len(0), | |||
caplen(0), | caplen(0), | |||
packet_count(0){ | packet_count(0), | |||
session_id(0) { | ||||
if(pi.pcap_hdr){ | if(pi.pcap_hdr){ | |||
memcpy(mac_daddr,pi.get_ether_dhost(),sizeof(mac_daddr)); | memcpy(mac_daddr,pi.get_ether_dhost(),sizeof(mac_daddr)); | |||
memcpy(mac_saddr,pi.get_ether_shost(),sizeof(mac_saddr)); | memcpy(mac_saddr,pi.get_ether_shost(),sizeof(mac_saddr)); | |||
} | } | |||
} | } | |||
virtual ~flow(){}; | virtual ~flow(){}; | |||
uint64_t id; // flow_counter when this flow was create d | uint64_t id; // flow_counter when this flow was create d | |||
int32_t vlan; // vlan interface we first observed; -1 m eans no vlan | int32_t vlan; // vlan interface we first observed; -1 m eans no vlan | |||
uint8_t mac_daddr[6]; // dst mac address of first packet | uint8_t mac_daddr[6]; // dst mac address of first packet | |||
uint8_t mac_saddr[6]; // source mac address of first packet | uint8_t mac_saddr[6]; // source mac address of first packet | |||
struct timeval tstart; // when first seen | struct timeval tstart; // when first seen | |||
struct timeval tlast; // when last seen | struct timeval tlast; // when last seen | |||
uint64_t len; // off-wire length | uint64_t len; // off-wire length | |||
uint64_t caplen; // captured length | uint64_t caplen; // captured length | |||
uint64_t packet_count; // packet count | uint64_t packet_count; // packet count | |||
uint64_t session_id; // session unique id (used to match client->server and server->client flows | ||||
// return a filename for a flow based on the template and the connection cou nt | // return a filename for a flow based on the template and the connection cou nt | |||
std::string filename(uint32_t connection_count); | std::string filename(uint32_t connection_count, bool); | |||
// return a new filename for a flow based on the temlate, | // return a new filename for a flow based on the temlate, | |||
// optionally opening the file and returning a fd if &fd is provided | // optionally opening the file and returning a fd if &fd is provided | |||
std::string new_filename(int *fd,int flags,int mode); | std::string new_filename(int *fd,int flags,int mode); | |||
std::string new_pcap_filename(); | ||||
bool has_mac_daddr(){ | bool has_mac_daddr(){ | |||
return mac_daddr[0] || mac_daddr[1] || mac_daddr[2] || mac_daddr[3] || m ac_daddr[4] || mac_daddr[5]; | return mac_daddr[0] || mac_daddr[1] || mac_daddr[2] || mac_daddr[3] || m ac_daddr[4] || mac_daddr[5]; | |||
} | } | |||
bool has_mac_saddr(){ | bool has_mac_saddr(){ | |||
return mac_saddr[0] || mac_saddr[1] || mac_saddr[2] || mac_saddr[3] || m ac_saddr[4] || mac_saddr[5]; | return mac_saddr[0] || mac_saddr[1] || mac_saddr[2] || mac_saddr[3] || m ac_saddr[4] || mac_saddr[5]; | |||
} | } | |||
}; | }; | |||
/* | /* | |||
skipping to change at line 364 | skipping to change at line 368 | |||
saved_flow(tcpip *tcp):addr(tcp->myflow), | saved_flow(tcpip *tcp):addr(tcp->myflow), | |||
saved_filename(tcp->flow_pathname), | saved_filename(tcp->flow_pathname), | |||
isn(tcp->isn) {} | isn(tcp->isn) {} | |||
flow_addr addr; // flow address | flow_addr addr; // flow address | |||
std::string saved_filename; // where the flow was saved | std::string saved_filename; // where the flow was saved | |||
be13::tcp_seq isn; // the flow's ISN | be13::tcp_seq isn; // the flow's ISN | |||
virtual ~saved_flow(){}; | virtual ~saved_flow(){}; | |||
}; | }; | |||
class sparse_saved_flow { | ||||
public: | ||||
sparse_saved_flow (const flow_addr &idx, FILE *_fcap):addr(idx),fcap(_fcap) | ||||
{} | ||||
flow_addr addr; // flow address | ||||
FILE *fcap; // output pcap file | ||||
virtual ~sparse_saved_flow() | ||||
{ | ||||
if(fcap) fclose(fcap); | ||||
} | ||||
/* these are not implemented */ | ||||
private: | ||||
sparse_saved_flow(const sparse_saved_flow &t); | ||||
sparse_saved_flow &operator=(const sparse_saved_flow &that); | ||||
}; | ||||
#endif | #endif | |||
End of changes. 6 change blocks. | ||||
3 lines changed or deleted | 24 lines changed or added |