Click here to Skip to main content
15,881,715 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
Hello. I am writing simple IDS and I had problems.. And I want to filter if source ip and destination ip detected then print to output.. So I am using Sniffex.. All the structures are defined.. How to do it?

struct sniff_ethernet {
        u_char  ether_dhost[ETHER_ADDR_LEN];    /* destination host address */
        u_char  ether_shost[ETHER_ADDR_LEN];    /* source host address */
        u_short ether_type;                     /* IP? ARP? RARP? etc */
};

/* IP header */
struct sniff_ip {
        u_char  ip_vhl;                 /* version << 4 | header length >> 2 */
        u_char  ip_tos;                 /* type of service */
        u_short ip_len;                 /* total length */
        u_short ip_id;                  /* identification */
        u_short ip_off;                 /* fragment offset field */
        #define IP_RF 0x8000            /* reserved fragment flag */
        #define IP_DF 0x4000            /* dont fragment flag */
        #define IP_MF 0x2000            /* more fragments flag */
        #define IP_OFFMASK 0x1fff       /* mask for fragmenting bits */
        u_char  ip_ttl;                 /* time to live */
        u_char  ip_p;                   /* protocol */
        u_short ip_sum;                 /* checksum */
        struct  in_addr ip_src,ip_dst;  /* source and dest address */

};
#define IP_HL(ip)               (((ip)->ip_vhl) & 0x0f)
#define IP_V(ip)                (((ip)->ip_vhl) >> 4)

/* TCP header */
typedef u_int tcp_seq;

struct sniff_tcp {
        u_short th_sport;               /* source port */
        u_short th_dport;               /* destination port */
        tcp_seq th_seq;                 /* sequence number */
        tcp_seq th_ack;                 /* acknowledgement number */
        u_char  th_offx2;               /* data offset, rsvd */
#define TH_OFF(th)      (((th)->th_offx2 & 0xf0) >> 4)
        u_char  th_flags;
        #define TH_FIN  0x01
        #define TH_SYN  0x02
        #define TH_RST  0x04
        #define TH_PUSH 0x08
        #define TH_ACK  0x10
        #define TH_URG  0x20
        #define TH_ECE  0x40
        #define TH_CWR  0x80
        #define TH_FLAGS        (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
        u_short th_win;                 /* window */
        u_short th_sum;                 /* checksum */
        u_short th_urp;                 /* urgent pointer */
};

void got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet)
{
	const struct sniff_ethernet *ethernet;  /* The ethernet header [1] */
	const struct sniff_ip *ip;              /* The IP header */
	const struct sniff_tcp *tcp;            /* The TCP header */
	const char *payload;                    /* Packet payload */
		
	int size_ip;
	int size_tcp;
	int size_payload;
	

/*if(source ip==destination ip)
then printf("It's Land attack");*/ How to do this?

}
Posted
Updated 10-Dec-13 22:16pm
v2

1 solution

IPHeader structure have
struct  in_addr ip_src,ip_dst;

which contains source and destination address respectively. Capture packet, strip them to analyze these fields and compare for equality.
 
Share this answer
 
Comments
Purevochir 11-Dec-13 4:37am    
I used that bu it takes error ip_src’ undeclared (first use in this function)
se.c:90:5: note: each undeclared identifier is reported only once for each function it appears in
Jayarajantk 11-Dec-13 7:43am    
Usual Causes
> You forgot to include the header file that defines the class/struct/function/etc
> You misspelled the name of the identifier
Please make sure you've included all the header files needed ("netinet/in.h" for in_addr here)
Jayarajantk 11-Dec-13 7:56am    
Usual Causes
> You forgot to include the header file that defines the class/struct/function/etc
> You misspelled the name of the identifier
Please make sure you've included all the header files needed (#include <netinet in.h=""> for in_addr here)

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900