unix4lyfe git - darkstat/blob - decode.h

   1 /* darkstat 3
   2  * copyright (c) 2001-2011 Emil Mikulic.
   3  *
   4  * decode.h: packet decoding.
   5  *
   6  * You may use, modify and redistribute this file under the terms of the
   7  * GNU General Public License version 2. (see COPYING.GPL)
   8  */
   9 #ifndef __DARKSTAT_DECODE_H
  10 #define __DARKSTAT_DECODE_H
  11
  12 #include "addr.h"
  13
  14 #ifndef ETHER_ADDR_LEN
  15 # define ETHER_ADDR_LEN 6
  16 #endif
  17
  18 #define IPPROTO_INVALID 254 /* special: means don't do proto accounting */
  19
  20 #ifndef IPPROTO_OSPF
  21 # define IPPROTO_OSPF 89
  22 #endif
  23
  24 #define PPPOE_HDR_LEN 8
  25
  26 /* Decoding creates a summary which is passed to accounting. */
  27 struct pktsummary {
  28    /* Fields are in host byte order (except IPs) */
  29    struct addr src, dst;
  30    time_t time;
  31    uint16_t len;
  32    uint8_t proto; /* IPPROTO_INVALID means don't do proto accounting */
  33    uint8_t tcp_flags;           /* only for TCP */
  34    uint16_t src_port, dst_port; /* only for TCP, UDP */
  35    uint8_t src_mac[ETHER_ADDR_LEN], /* only for Ethernet */
  36            dst_mac[ETHER_ADDR_LEN]; /* only for Ethernet */
  37 };
  38
  39 struct pcap_pkthdr; /* from pcap.h */
  40
  41 #define DECODER_ARGS const struct pcap_pkthdr *pheader, \
  42                      const u_char *pdata, \
  43                      struct pktsummary *sm
  44
  45 /* Returns 0 on decode failure (meaning accounting should not be performed) */
  46 typedef int (decoder_fn)(DECODER_ARGS);
  47
  48 struct linkhdr {
  49    int linktype;
  50    unsigned int hdrlen;
  51    decoder_fn *decoder;
  52 };
  53
  54 const struct linkhdr *getlinkhdr(const int linktype);
  55 int getsnaplen(const struct linkhdr *lh);
  56
  57 #endif /* __DARKSTAT_DECODE_H */
  58 /* vim:set ts=3 sw=3 tw=78 expandtab: */