Question

这个程序可以检测http流等... 但它忽略了XMPP流程;我不知道为什么？（我想这是一个端口问题，但我不知道应该在哪里修复它）

以下是main.cpp的相关章节：

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <arpa/inet.h>
#include <string.h>
#include <stdio.h>
#include "nids.h"
#include <cstdlib>
#include <unistd.h>

#define int_ntoa(x) inet_ntoa(*((struct in_addr *)&x))

// struct tuple4 contains addresses and port numbers of the TCP connections
// the following auxiliary function produces a string looking like
// 10.0.0.1,1024,10.0.0.2,23
char *
adres (struct tuple4 addr)
{
  static char buf[256];
  strcpy (buf, int_ntoa (addr.saddr));
  sprintf (buf + strlen (buf), ",%i,", addr.source);
  strcat (buf, int_ntoa (addr.daddr));
  sprintf (buf + strlen (buf), ",%i", addr.dest);
  return buf;
}

void
tcp_callback (struct tcp_stream *a_tcp, void ** this_time_not_needed)
{

    printf("packet captured !\n");

}

int 
main ()
{
  // here we can alter libnids params, for instance:
  // nids_params.n_hosts=256;
        struct nids_chksum_ctl nochksumchk;
        nochksumchk.netaddr = 0;
    nochksumchk.mask = 0;
    nochksumchk.action = NIDS_DONT_CHKSUM;
    //char fileName[] = "/home/test.pcap";
        //nids_params.filename =fileName;     
    nids_register_chksum_ctl(&nochksumchk, 1);

        char myDevice [] = "eth0";
        nids_params.device =myDevice;

    if (!nids_init ())
  {
    fprintf(stderr,"%s\n",nids_errbuf);
    exit(1);
  }
  nids_register_tcp ( (void*)tcp_callback);
  nids_run ();
  return 0;
}

Answer 1

我的pcap文件在tcp连接中有同步问题。

所以上面的libnids代码片段是正确的！

libnids没有捕获xmpp数据包

1 个答案: