lcrzo_sniff(3)

NAME
lcrzo_sniff - lcrzo library : sniffing

CONTENTS
/*    Laurent Constantin's network library (lcrzo)
                 lcrzo_sniff module
  Functions herein allow to sniff network packets.
*/
/*-------------------------------------------------------------*/
/* definition of a lcrzo_sniff. You should not use its
   fields directly. */
typedef struct
{ void *ppcapt;
  lcrzo_list seenippackets;
  lcrzo_list waitingippackets;
  lcrzo_list seentcppackets;
  lcrzo_list waitingtcppackets;
  lcrzo_uint16 para_ipreastimeout1;
  lcrzo_uint16 para_ipreastimeout2;
  lcrzo_uint16 para_tcpreortimeout1;
  lcrzo_uint16 para_tcpreortimeout2;
  lcrzo_int32 linktype;
  lcrzo_int16 snifftype;
  lcrzo_bool dataend;
  lcrzo_data storeddata;
  lcrzo_int32 storeddatasize;
  int pcapfd;
} lcrzo_sniff;
/*-------------------------------------------------------------*/
/***************************************************************
 * Note about sniff filters :                                  *
 * Filters permit to select network packets we sniff.          *
 * Basic elements of a bpf filter are :                        *
 *    host 1.2.3.4                                             *
 *    net 192.168.10                                           *
 *    net 192.168.10.0 mask 255.255.255.0                      *
 *    net 192.168.10.0/24                                      *
 *    port 21                                                  *
 *    dst host 1.2.3.4                                         *
 *    src port 2345                                            *
 *    ether host a:b:c:d:e:f ("ether a:b:c:d:e:f" is not working)
 *    ether src aa:bb:cc:dd:ee:ff                              *
 *    ip                                                       *
 *    arp                                                      *
 *    rarp                                                     *
 *    tcp                                                      *
 *    icmp                                                     *
 *    udp                                                      *
 * Here are filter examples :                                  *
 *    host 1.2.3.4                                             *
 *    net 192.168 and icmp                                     *
 *    host 1.2.3.4 or dst port 80                              *
 *    (udp or tcp) and not host 1.2.3.4                        *
 ***************************************************************/
/*-------------------------------------------------------------*/
/***************************************************************
 * Note about LCRZO_SNIFF_TYPE_xx :                            *
 * The sniff functions can return several kinds of packets :   *
 *   LCRZO_SNIFF_TYPE_NORMAL :                                 *
 *    - return all the packets, as they are on the network     *
 *   LCRZO_SNIFF_TYPE_IPREAS :                                 *
 *    - reassemble fragmented IP packets                       *
 *    - remove duplicate IP packets                            *
 *    - do nothing with other packets                          *
 *   LCRZO_SNIFF_TYPE_TCPREOR :                                *
 *    - reassemble fragmented IP packets                       *
 *    - remove duplicate IP packets                            *
 *    - reorder sequences of TCP packets                       *
 *    - do nothing with other packets                          *
 ***************************************************************/
#define LCRZO_SNIFF_TYPE_NORMAL  1
#define LCRZO_SNIFF_TYPE_IPREAS  2
#define LCRZO_SNIFF_TYPE_TCPREOR 3
/*-------------------------------------------------------------*/
/* Name : lcrzo_sniff_init
   Description :
     Initialize a lcrzo_sniff.
   Input parameter(s) :
     device : device where we sniff
     maxsniffedsize : maximum size of sniffed packets
     snifftype : type of sniff (see above frame)
     filter : sniff filter ("" to sniff everything)
   Input/output parameter(s) :
   Output parameter(s) :
     *psniff : lcrzo_sniff initialized
   Normal return values :
     LCRZO_ERR_OK : ok
*/
int lcrzo_sniff_init(lcrzo_constdevice device,
		     lcrzo_int32 maxsniffedsize,
		     lcrzo_int16 snifftype,
		     lcrzo_conststring filter,
		     lcrzo_sniff *psniff);
/* Name : lcrzo_sniff_close
   Description :
     Close a lcrzo_sniff.
   Input parameter(s) :
   Input/output parameter(s) :
     *psniff : lcrzo_sniff to close
   Output parameter(s) :
   Normal return values :
     LCRZO_ERR_OK : ok
*/
int lcrzo_sniff_close(lcrzo_sniff *psniff);
/* Name : lcrzo_sniff_nextm
   Description :
     Sniff one packet from the network.
   Input parameter(s) :
     *pmaxwaitingtime : maximum waiting time (can be a lcrzo_time,
                        LCRZO_WAIT_NODELAY or LCRZO_WAIT_INFINITE)
   Input/output parameter(s) :
     *psniff : lcrzo_sniff to use
   Output parameter(s) :
     *pdataout : pointer which will be malloced (so, the
                 memory will have to be freed by the
                 user with 'free(*pdataout)').
                 The allocated memory will be set with the read data
     *pdataoutsize : reached size of dataout
   Normal return values :
     LCRZO_ERR_OK : ok
     LCRZO_ERR_OKTEMPDATAEND : the function received nothing
                               before pmaxwaitingtime, so it
                               exited without reading data
*/
int lcrzo_sniff_nextm(lcrzo_sniff *psniff,
 		      lcrzo_time *pmaxwaitingtime,
		      lcrzo_data *pdataout,
		      lcrzo_int32 *pdataoutsize);
/*-------------------------------------------------------------*/
/* Name : lcrzo_sniff_loop
   Description :
     Call a function for each sniffed packet.
   Input parameter(s) :
     device : device where we sniff
     maxsniffedsize : maximum size of sniffed packets
     filter : sniff filter ("" to sniff everything)
     beblocking : if we want to block until receiving data
     snifftype : type of sniff (see above frame)
     pfunc : memory address of the function which will be called
             for each sniffed packet. For
             each call, the first/second parameter ('data',
	     'datasize') will be set
             with the packet, and the third parameter ('pinfos')
             will be set with the optional parameter below.
   Input/output parameter(s) :
     pinfos : optional parameter (can be NULL) which will be
              used as the second parameter for *pfunc. This may be
              used to send information to *pfunc.
   Output parameter(s) :
   Normal return values :
     LCRZO_ERR_OK : ok
*/
int lcrzo_sniff_loop(lcrzo_constdevice device,
		     lcrzo_int32 maxsniffedsize,
		     lcrzo_int16 snifftype,
		     lcrzo_conststring filter,
		     lcrzo_time *pmaxwaitingtime,
		     int (*pfunc)(lcrzo_constdata data,
				  lcrzo_int32 datasize,
				  void *pinfos),
		     void *pinfos);
/*-------------------------------------------------------------*/
/***************************************************************
 * Note about the following functions :                        *
 * The default values are correct for most applications.       *
 * You should modify their parameters only if you know         *
 * what you are doing.                                         *
 ***************************************************************/
/* with LCRZO_SNIFF_TYPE_IPREAS, how long to keep
   seen packets */
int lcrzo_sniff_set_ipreas1timeout(lcrzo_sniff *psniff,
				   lcrzo_uint16 timeout);
int lcrzo_sniff_get_ipreas1timeout(lcrzo_sniff *psniff,
				   lcrzo_uint16 *ptimeout);
/* with LCRZO_SNIFF_TYPE_IPREAS, how long to keep
   waiting packets*/
int lcrzo_sniff_set_ipreas2timeout(lcrzo_sniff *psniff,
				   lcrzo_uint16 timeout);
int lcrzo_sniff_get_ipreas2timeout(lcrzo_sniff *psniff,
				   lcrzo_uint16 *ptimeout);
/* with LCRZO_SNIFF_TYPE_TCPREOR, how long to keep
   seen packets */
int lcrzo_sniff_set_tcpreor1timeout(lcrzo_sniff *psniff,
				    lcrzo_uint16 timeout);
int lcrzo_sniff_get_tcpreor1timeout(lcrzo_sniff *psniff,
				    lcrzo_uint16 *ptimeout);
/* with LCRZO_SNIFF_TYPE_TCPREOR, how long to keep
   waiting packets*/
int lcrzo_sniff_set_tcpreor2timeout(lcrzo_sniff *psniff,
				    lcrzo_uint16 timeout);
int lcrzo_sniff_get_tcpreor2timeout(lcrzo_sniff *psniff,
				    lcrzo_uint16 *ptimeout);

SEE ALSO
lcrzo(3), lcrzo_types(3), lcrzo_data(3), lcrzo_string(3), lcrzo_time(3), lcrzo_file(3), lcrzo_address(3), lcrzo_device(3), lcrzo_list(3), lcrzo_process(3), lcrzo_ipc(3), lcrzo_header(3), lcrzo_ipopt(3), lcrzo_tcpopt(3), lcrzo_packet(3), lcrzo_icmp(3), lcrzo_print(3), lcrzo_record(3), lcrzo_conf(3), lcrzo_spoof(3), lcrzo_sniff(3), lcrzo_sock(3), lcrzo_wait(3), lcrzo_global(3), lcrzo_error(3) lcrzo_misc(3), lcrzo_obso(3),