2 * netsniff-ng - the packet sniffing beast
3 * Copyright 2011 - 2013 Daniel Borkmann.
4 * Copyright 2011 Emmanuel Roullit.
5 * Subject to the GPL, version 2.
18 #include <libnetfilter_conntrack/libnetfilter_conntrack.h>
19 #include <libnetfilter_conntrack/libnetfilter_conntrack_tcp.h>
20 #include <libnetfilter_conntrack/libnetfilter_conntrack_dccp.h>
21 #include <libnetfilter_conntrack/libnetfilter_conntrack_sctp.h>
22 #include <netinet/in.h>
26 #include <sys/fsuid.h>
38 #include "dissector_eth.h"
42 uint32_t flow_id
, use
, status
;
43 uint8_t l3_proto
, l4_proto
;
44 uint32_t ip4_src_addr
, ip4_dst_addr
;
45 uint32_t ip6_src_addr
[4], ip6_dst_addr
[4];
46 uint16_t port_src
, port_dst
;
47 uint8_t tcp_state
, tcp_flags
, sctp_state
, dccp_state
;
48 uint64_t counter_pkts
, counter_bytes
;
49 uint64_t timestamp_start
, timestamp_stop
;
50 char country_src
[128], country_dst
[128];
51 char city_src
[128], city_dst
[128];
52 char rev_dns_src
[256], rev_dns_dst
[256];
54 struct flow_entry
*next
;
59 struct flow_entry
*head
;
63 #ifndef ATTR_TIMESTAMP_START
64 # define ATTR_TIMESTAMP_START 63
66 #ifndef ATTR_TIMESTAMP_STOP
67 # define ATTR_TIMESTAMP_STOP 64
70 #define SCROLL_MAX 1000
72 #define INCLUDE_IPV4 (1 << 0)
73 #define INCLUDE_IPV6 (1 << 1)
74 #define INCLUDE_UDP (1 << 2)
75 #define INCLUDE_TCP (1 << 3)
76 #define INCLUDE_DCCP (1 << 4)
77 #define INCLUDE_ICMP (1 << 5)
78 #define INCLUDE_SCTP (1 << 6)
80 static volatile sig_atomic_t sigint
= 0;
81 static int what
= INCLUDE_IPV4
| INCLUDE_IPV6
| INCLUDE_TCP
, show_src
= 0;
82 static struct flow_list flow_list
;
84 static const char *short_options
= "vhTUsDIS46u";
85 static const struct option long_options
[] = {
86 {"ipv4", no_argument
, NULL
, '4'},
87 {"ipv6", no_argument
, NULL
, '6'},
88 {"tcp", no_argument
, NULL
, 'T'},
89 {"udp", no_argument
, NULL
, 'U'},
90 {"dccp", no_argument
, NULL
, 'D'},
91 {"icmp", no_argument
, NULL
, 'I'},
92 {"sctp", no_argument
, NULL
, 'S'},
93 {"show-src", no_argument
, NULL
, 's'},
94 {"update", no_argument
, NULL
, 'u'},
95 {"version", no_argument
, NULL
, 'v'},
96 {"help", no_argument
, NULL
, 'h'},
100 static const char *const l3proto2str
[AF_MAX
] = {
105 static const char *const l4proto2str
[IPPROTO_MAX
] = {
106 [IPPROTO_TCP
] = "tcp",
107 [IPPROTO_UDP
] = "udp",
108 [IPPROTO_UDPLITE
] = "udplite",
109 [IPPROTO_ICMP
] = "icmp",
110 [IPPROTO_ICMPV6
] = "icmpv6",
111 [IPPROTO_SCTP
] = "sctp",
112 [IPPROTO_GRE
] = "gre",
113 [IPPROTO_DCCP
] = "dccp",
114 [IPPROTO_IGMP
] = "igmp",
115 [IPPROTO_IPIP
] = "ipip",
116 [IPPROTO_EGP
] = "egp",
117 [IPPROTO_PUP
] = "pup",
118 [IPPROTO_IDP
] = "idp",
119 [IPPROTO_RSVP
] = "rsvp",
120 [IPPROTO_IPV6
] = "ip6tun",
121 [IPPROTO_ESP
] = "esp",
123 [IPPROTO_PIM
] = "pim",
124 [IPPROTO_COMP
] = "comp",
127 static const char *const tcp_state2str
[TCP_CONNTRACK_MAX
] = {
128 [TCP_CONNTRACK_NONE
] = "NOSTATE",
129 [TCP_CONNTRACK_SYN_SENT
] = "SYN_SENT",
130 [TCP_CONNTRACK_SYN_RECV
] = "SYN_RECV",
131 [TCP_CONNTRACK_ESTABLISHED
] = "ESTABLISHED",
132 [TCP_CONNTRACK_FIN_WAIT
] = "FIN_WAIT",
133 [TCP_CONNTRACK_CLOSE_WAIT
] = "CLOSE_WAIT",
134 [TCP_CONNTRACK_LAST_ACK
] = "LAST_ACK",
135 [TCP_CONNTRACK_TIME_WAIT
] = "TIME_WAIT",
136 [TCP_CONNTRACK_CLOSE
] = "CLOSE",
137 [TCP_CONNTRACK_SYN_SENT2
] = "SYN_SENT2",
140 static const uint8_t tcp_states
[] = {
141 TCP_CONNTRACK_SYN_SENT
,
142 TCP_CONNTRACK_SYN_RECV
,
143 TCP_CONNTRACK_ESTABLISHED
,
144 TCP_CONNTRACK_FIN_WAIT
,
145 TCP_CONNTRACK_CLOSE_WAIT
,
146 TCP_CONNTRACK_LAST_ACK
,
147 TCP_CONNTRACK_TIME_WAIT
,
149 TCP_CONNTRACK_SYN_SENT2
,
153 static const char *const dccp_state2str
[DCCP_CONNTRACK_MAX
] = {
154 [DCCP_CONNTRACK_NONE
] = "NOSTATE",
155 [DCCP_CONNTRACK_REQUEST
] = "REQUEST",
156 [DCCP_CONNTRACK_RESPOND
] = "RESPOND",
157 [DCCP_CONNTRACK_PARTOPEN
] = "PARTOPEN",
158 [DCCP_CONNTRACK_OPEN
] = "OPEN",
159 [DCCP_CONNTRACK_CLOSEREQ
] = "CLOSEREQ",
160 [DCCP_CONNTRACK_CLOSING
] = "CLOSING",
161 [DCCP_CONNTRACK_TIMEWAIT
] = "TIMEWAIT",
162 [DCCP_CONNTRACK_IGNORE
] = "IGNORE",
163 [DCCP_CONNTRACK_INVALID
] = "INVALID",
166 static const uint8_t dccp_states
[] = {
168 DCCP_CONNTRACK_REQUEST
,
169 DCCP_CONNTRACK_RESPOND
,
170 DCCP_CONNTRACK_PARTOPEN
,
172 DCCP_CONNTRACK_CLOSEREQ
,
173 DCCP_CONNTRACK_CLOSING
,
174 DCCP_CONNTRACK_TIMEWAIT
,
175 DCCP_CONNTRACK_IGNORE
,
176 DCCP_CONNTRACK_INVALID
,
179 static const char *const sctp_state2str
[SCTP_CONNTRACK_MAX
] = {
180 [SCTP_CONNTRACK_NONE
] = "NOSTATE",
181 [SCTP_CONNTRACK_CLOSED
] = "CLOSED",
182 [SCTP_CONNTRACK_COOKIE_WAIT
] = "COOKIE_WAIT",
183 [SCTP_CONNTRACK_COOKIE_ECHOED
] = "COOKIE_ECHOED",
184 [SCTP_CONNTRACK_ESTABLISHED
] = "ESTABLISHED",
185 [SCTP_CONNTRACK_SHUTDOWN_SENT
] = "SHUTDOWN_SENT",
186 [SCTP_CONNTRACK_SHUTDOWN_RECD
] = "SHUTDOWN_RECD",
187 [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT
] = "SHUTDOWN_ACK_SENT",
190 static const uint8_t sctp_states
[] = {
192 SCTP_CONNTRACK_CLOSED
,
193 SCTP_CONNTRACK_COOKIE_WAIT
,
194 SCTP_CONNTRACK_COOKIE_ECHOED
,
195 SCTP_CONNTRACK_ESTABLISHED
,
196 SCTP_CONNTRACK_SHUTDOWN_SENT
,
197 SCTP_CONNTRACK_SHUTDOWN_RECD
,
198 SCTP_CONNTRACK_SHUTDOWN_ACK_SENT
,
201 static const struct nfct_filter_ipv4 filter_ipv4
= {
202 .addr
= __constant_htonl(INADDR_LOOPBACK
),
206 static const struct nfct_filter_ipv6 filter_ipv6
= {
207 .addr
= { 0x0, 0x0, 0x0, 0x1 },
208 .mask
= { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff },
211 static void signal_handler(int number
)
223 static void flow_entry_from_ct(struct flow_entry
*n
, struct nf_conntrack
*ct
);
224 static void flow_entry_get_extended(struct flow_entry
*n
);
226 static void help(void)
228 printf("\nflowtop %s, top-like netfilter TCP/UDP flow tracking\n",
230 puts("http://www.netsniff-ng.org\n\n"
231 "Usage: flowtop [options]\n"
233 " -4|--ipv4 Show only IPv4 flows (default)\n"
234 " -6|--ipv6 Show only IPv6 flows (default)\n"
235 " -T|--tcp Show only TCP flows (default)\n"
236 " -U|--udp Show only UDP flows\n"
237 " -D|--dccp Show only DCCP flows\n"
238 " -I|--icmp Show only ICMP/ICMPv6 flows\n"
239 " -S|--sctp Show only SCTP flows\n"
240 " -s|--show-src Also show source, not only dest\n"
241 " -u|--update Update GeoIP databases\n"
242 " -v|--version Print version and exit\n"
243 " -h|--help Print this help and exit\n\n"
246 " flowtop -46UTDISs\n\n"
248 " If netfilter is not running, you can activate it with e.g.:\n"
249 " iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\n"
250 " iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\n\n"
251 "Please report bugs to <bugs@netsniff-ng.org>\n"
252 "Copyright (C) 2011-2013 Daniel Borkmann <dborkma@tik.ee.ethz.ch>\n"
253 "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel.roullit@gmail.com>\n"
254 "Swiss federal institute of technology (ETH Zurich)\n"
255 "License: GNU GPL version 2.0\n"
256 "This is free software: you are free to change and redistribute it.\n"
257 "There is NO WARRANTY, to the extent permitted by law.\n");
261 static void version(void)
263 printf("\nflowtop %s, top-like netfilter TCP/UDP flow tracking\n",
265 puts("http://www.netsniff-ng.org\n\n"
266 "Please report bugs to <bugs@netsniff-ng.org>\n"
267 "Copyright (C) 2011-2013 Daniel Borkmann <dborkma@tik.ee.ethz.ch>\n"
268 "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel.roullit@gmail.com>\n"
269 "Swiss federal institute of technology (ETH Zurich)\n"
270 "License: GNU GPL version 2.0\n"
271 "This is free software: you are free to change and redistribute it.\n"
272 "There is NO WARRANTY, to the extent permitted by law.\n");
276 static inline struct flow_entry
*flow_entry_xalloc(void)
278 return xzmalloc(sizeof(struct flow_entry
));
281 static inline void flow_entry_xfree(struct flow_entry
*n
)
286 static inline void flow_list_init(struct flow_list
*fl
)
289 spinlock_init(&fl
->lock
);
292 static void flow_list_new_entry(struct flow_list
*fl
, struct nf_conntrack
*ct
)
294 struct flow_entry
*n
= flow_entry_xalloc();
296 flow_entry_from_ct(n
, ct
);
297 flow_entry_get_extended(n
);
299 rcu_assign_pointer(n
->next
, fl
->head
);
300 rcu_assign_pointer(fl
->head
, n
);
303 static struct flow_entry
*flow_list_find_id(struct flow_list
*fl
,
306 struct flow_entry
*n
= rcu_dereference(fl
->head
);
309 if (n
->flow_id
== id
)
312 n
= rcu_dereference(n
->next
);
318 static struct flow_entry
*flow_list_find_prev_id(struct flow_list
*fl
,
321 struct flow_entry
*n
= rcu_dereference(fl
->head
), *tmp
;
323 if (n
->flow_id
== id
)
326 while ((tmp
= rcu_dereference(n
->next
)) != NULL
) {
327 if (tmp
->flow_id
== id
)
336 static void flow_list_update_entry(struct flow_list
*fl
,
337 struct nf_conntrack
*ct
)
340 struct flow_entry
*n
;
342 n
= flow_list_find_id(fl
, nfct_get_attr_u32(ct
, ATTR_ID
));
344 n
= flow_entry_xalloc();
348 flow_entry_from_ct(n
, ct
);
350 flow_entry_get_extended(n
);
352 rcu_assign_pointer(n
->next
, fl
->head
);
353 rcu_assign_pointer(fl
->head
, n
);
357 static void flow_list_destroy_entry(struct flow_list
*fl
,
358 struct nf_conntrack
*ct
)
360 struct flow_entry
*n1
, *n2
;
361 uint32_t id
= nfct_get_attr_u32(ct
, ATTR_ID
);
363 n1
= flow_list_find_id(fl
, id
);
365 n2
= flow_list_find_prev_id(fl
, id
);
367 rcu_assign_pointer(n2
->next
, n1
->next
);
370 flow_entry_xfree(n1
);
372 flow_entry_xfree(fl
->head
);
378 static void flow_list_destroy(struct flow_list
*fl
)
380 struct flow_entry
*n
;
382 while (fl
->head
!= NULL
) {
383 n
= rcu_dereference(fl
->head
->next
);
384 fl
->head
->next
= NULL
;
386 flow_entry_xfree(fl
->head
);
387 rcu_assign_pointer(fl
->head
, n
);
391 spinlock_destroy(&fl
->lock
);
394 static int walk_process(char *process
, struct flow_entry
*n
)
401 if (snprintf(path
, sizeof(path
), "/proc/%s/fd", process
) == -1)
402 panic("giant process name! %s\n", process
);
408 while ((ent
= readdir(dir
))) {
411 if (snprintf(path
, sizeof(path
), "/proc/%s/fd/%s",
412 process
, ent
->d_name
) < 0)
415 if (stat(path
, &statbuf
) < 0)
418 if (S_ISSOCK(statbuf
.st_mode
) && n
->inode
== statbuf
.st_ino
) {
419 memset(n
->cmdline
, 0, sizeof(n
->cmdline
));
421 snprintf(path
, sizeof(path
), "/proc/%s/exe", process
);
423 ret
= readlink(path
, n
->cmdline
,
424 sizeof(n
->cmdline
) - 1);
426 panic("readlink error: %s\n", strerror(errno
));
428 n
->procnum
= atoi(process
);
438 static void walk_processes(struct flow_entry
*n
)
444 /* n->inode must be set */
446 memset(n
->cmdline
, 0, sizeof(n
->cmdline
));
450 dir
= opendir("/proc");
452 panic("Cannot open /proc!\n");
454 while ((ent
= readdir(dir
))) {
455 if (strspn(ent
->d_name
, "0123456789") == strlen(ent
->d_name
)) {
456 ret
= walk_process(ent
->d_name
, n
);
465 static int get_port_inode(uint16_t port
, int proto
, int is_ip6
)
468 char path
[128], buff
[1024];
471 memset(path
, 0, sizeof(path
));
472 snprintf(path
, sizeof(path
), "/proc/net/%s%s",
473 l4proto2str
[proto
], is_ip6
? "6" : "");
475 proc
= fopen(path
, "r");
479 memset(buff
, 0, sizeof(buff
));
481 while (fgets(buff
, sizeof(buff
), proc
) != NULL
) {
483 unsigned int lport
= 0;
485 buff
[sizeof(buff
) - 1] = 0;
486 if (sscanf(buff
, "%*u: %*X:%X %*X:%*X %*X %*X:%*X %*X:%*X "
487 "%*X %*u %*u %u", &lport
, &inode
) == 2) {
488 if ((uint16_t) lport
== port
) {
494 memset(buff
, 0, sizeof(buff
));
501 #define CP_NFCT(elem, attr, x) \
502 do { n->elem = nfct_get_attr_u##x(ct,(attr)); } while (0)
503 #define CP_NFCT_BUFF(elem, attr) do { \
504 const uint8_t *buff = nfct_get_attr(ct,(attr)); \
506 memcpy(n->elem, buff, sizeof(n->elem)); \
509 static void flow_entry_from_ct(struct flow_entry
*n
, struct nf_conntrack
*ct
)
511 CP_NFCT(l3_proto
, ATTR_ORIG_L3PROTO
, 8);
512 CP_NFCT(l4_proto
, ATTR_ORIG_L4PROTO
, 8);
514 CP_NFCT(ip4_src_addr
, ATTR_ORIG_IPV4_SRC
, 32);
515 CP_NFCT(ip4_dst_addr
, ATTR_ORIG_IPV4_DST
, 32);
517 CP_NFCT(port_src
, ATTR_ORIG_PORT_SRC
, 16);
518 CP_NFCT(port_dst
, ATTR_ORIG_PORT_DST
, 16);
520 CP_NFCT(status
, ATTR_STATUS
, 32);
522 CP_NFCT(tcp_state
, ATTR_TCP_STATE
, 8);
523 CP_NFCT(tcp_flags
, ATTR_TCP_FLAGS_ORIG
, 8);
524 CP_NFCT(sctp_state
, ATTR_SCTP_STATE
, 8);
525 CP_NFCT(dccp_state
, ATTR_DCCP_STATE
, 8);
527 CP_NFCT(counter_pkts
, ATTR_ORIG_COUNTER_PACKETS
, 64);
528 CP_NFCT(counter_bytes
, ATTR_ORIG_COUNTER_BYTES
, 64);
530 CP_NFCT(timestamp_start
, ATTR_TIMESTAMP_START
, 64);
531 CP_NFCT(timestamp_stop
, ATTR_TIMESTAMP_STOP
, 64);
533 CP_NFCT(flow_id
, ATTR_ID
, 32);
534 CP_NFCT(use
, ATTR_USE
, 32);
536 CP_NFCT_BUFF(ip6_src_addr
, ATTR_ORIG_IPV6_SRC
);
537 CP_NFCT_BUFF(ip6_dst_addr
, ATTR_ORIG_IPV6_DST
);
539 n
->port_src
= ntohs(n
->port_src
);
540 n
->port_dst
= ntohs(n
->port_dst
);
542 n
->ip4_src_addr
= ntohl(n
->ip4_src_addr
);
543 n
->ip4_dst_addr
= ntohl(n
->ip4_dst_addr
);
546 enum flow_entry_direction
{
551 static inline int flow_entry_get_extended_is_dns(struct flow_entry
*n
)
553 /* We don't want to analyze / display DNS itself, since we
554 * use it to resolve reverse dns.
556 return n
->port_src
== 53 || n
->port_dst
== 53;
559 #define SELFLD(dir,src_member,dst_member) \
560 (((dir) == flow_entry_src) ? n->src_member : n->dst_member)
562 static void flow_entry_get_sain4_obj(struct flow_entry
*n
,
563 enum flow_entry_direction dir
,
564 struct sockaddr_in
*sa
)
566 memset(sa
, 0, sizeof(*sa
));
567 sa
->sin_family
= PF_INET
;
568 sa
->sin_addr
.s_addr
= htonl(SELFLD(dir
, ip4_src_addr
, ip4_dst_addr
));
571 static void flow_entry_get_sain6_obj(struct flow_entry
*n
,
572 enum flow_entry_direction dir
,
573 struct sockaddr_in6
*sa
)
575 memset(sa
, 0, sizeof(*sa
));
576 sa
->sin6_family
= PF_INET6
;
578 memcpy(&sa
->sin6_addr
, SELFLD(dir
, ip6_src_addr
, ip6_dst_addr
),
579 sizeof(sa
->sin6_addr
));
583 flow_entry_geo_city_lookup_generic(struct flow_entry
*n
,
584 enum flow_entry_direction dir
)
586 struct sockaddr_in sa4
;
587 struct sockaddr_in6 sa6
;
588 const char *city
= NULL
;
590 switch (n
->l3_proto
) {
595 flow_entry_get_sain4_obj(n
, dir
, &sa4
);
596 city
= geoip4_city_name(sa4
);
600 flow_entry_get_sain6_obj(n
, dir
, &sa6
);
601 city
= geoip6_city_name(sa6
);
605 bug_on(sizeof(n
->city_src
) != sizeof(n
->city_dst
));
608 memcpy(SELFLD(dir
, city_src
, city_dst
), city
,
609 min(sizeof(n
->city_src
), strlen(city
)));
611 memset(SELFLD(dir
, city_src
, city_dst
), 0,
612 sizeof(n
->city_src
));
617 flow_entry_geo_country_lookup_generic(struct flow_entry
*n
,
618 enum flow_entry_direction dir
)
620 struct sockaddr_in sa4
;
621 struct sockaddr_in6 sa6
;
622 const char *country
= NULL
;
624 switch (n
->l3_proto
) {
629 flow_entry_get_sain4_obj(n
, dir
, &sa4
);
630 country
= geoip4_country_name(sa4
);
634 flow_entry_get_sain6_obj(n
, dir
, &sa6
);
635 country
= geoip6_country_name(sa6
);
639 bug_on(sizeof(n
->country_src
) != sizeof(n
->country_dst
));
642 memcpy(SELFLD(dir
, country_src
, country_dst
), country
,
643 min(sizeof(n
->country_src
), strlen(country
)));
645 memset(SELFLD(dir
, country_src
, country_dst
), 0,
646 sizeof(n
->country_src
));
650 static void flow_entry_get_extended_geo(struct flow_entry
*n
,
651 enum flow_entry_direction dir
)
653 flow_entry_geo_city_lookup_generic(n
, dir
);
654 flow_entry_geo_country_lookup_generic(n
, dir
);
657 static void flow_entry_get_extended_revdns(struct flow_entry
*n
,
658 enum flow_entry_direction dir
)
661 struct sockaddr_in sa4
;
662 struct sockaddr_in6 sa6
;
664 struct hostent
*hent
;
666 switch (n
->l3_proto
) {
671 flow_entry_get_sain4_obj(n
, dir
, &sa4
);
672 sa
= (struct sockaddr
*) &sa4
;
673 sa_len
= sizeof(sa4
);
674 hent
= gethostbyaddr(&sa4
.sin_addr
, sizeof(sa4
.sin_addr
), AF_INET
);
678 flow_entry_get_sain6_obj(n
, dir
, &sa6
);
679 sa
= (struct sockaddr
*) &sa6
;
680 sa_len
= sizeof(sa6
);
681 hent
= gethostbyaddr(&sa6
.sin6_addr
, sizeof(sa6
.sin6_addr
), AF_INET6
);
685 bug_on(sizeof(n
->rev_dns_src
) != sizeof(n
->rev_dns_dst
));
686 getnameinfo(sa
, sa_len
, SELFLD(dir
, rev_dns_src
, rev_dns_dst
),
687 sizeof(n
->rev_dns_src
), NULL
, 0, NI_NUMERICHOST
);
690 memset(n
->rev_dns_dst
, 0, sizeof(n
->rev_dns_dst
));
691 memcpy(SELFLD(dir
, rev_dns_src
, rev_dns_dst
),
692 hent
->h_name
, min(sizeof(n
->rev_dns_src
),
693 strlen(hent
->h_name
)));
697 static void flow_entry_get_extended(struct flow_entry
*n
)
699 if (n
->flow_id
== 0 || flow_entry_get_extended_is_dns(n
))
702 flow_entry_get_extended_revdns(n
, flow_entry_src
);
703 flow_entry_get_extended_geo(n
, flow_entry_src
);
705 flow_entry_get_extended_revdns(n
, flow_entry_dst
);
706 flow_entry_get_extended_geo(n
, flow_entry_dst
);
708 /* Lookup application */
709 n
->inode
= get_port_inode(n
->port_src
, n
->l4_proto
,
710 n
->l3_proto
== AF_INET6
);
715 static uint16_t presenter_get_port(uint16_t src
, uint16_t dst
, int tcp
)
717 if (src
< dst
&& src
< 1024) {
719 } else if (dst
< src
&& dst
< 1024) {
722 const char *tmp1
, *tmp2
;
724 tmp1
= lookup_port_tcp(src
);
725 tmp2
= lookup_port_tcp(dst
);
727 tmp1
= lookup_port_udp(src
);
728 tmp2
= lookup_port_udp(dst
);
732 } else if (!tmp1
&& tmp2
) {
743 static WINDOW
*presenter_screen_init(void)
745 WINDOW
*screen
= initscr();
749 keypad(stdscr
, TRUE
);
750 nodelay(screen
, TRUE
);
757 static void presenter_screen_do_line(WINDOW
*screen
, struct flow_entry
*n
,
760 char tmp
[128], *pname
= NULL
;
763 mvwprintw(screen
, *line
, 2, "");
765 /* PID, application name */
766 if (n
->procnum
> 0) {
767 slprintf(tmp
, sizeof(tmp
), "%s(%u)", basename(n
->cmdline
),
771 attron(COLOR_PAIR(3));
773 attroff(COLOR_PAIR(3));
777 /* L3 protocol, L4 protocol, states */
778 printw("%s:%s", l3proto2str
[n
->l3_proto
], l4proto2str
[n
->l4_proto
]);
780 attron(COLOR_PAIR(3));
781 switch (n
->l4_proto
) {
783 printw("%s", tcp_state2str
[n
->tcp_state
]);
786 printw("%s", sctp_state2str
[n
->sctp_state
]);
789 printw("%s", dccp_state2str
[n
->dccp_state
]);
792 case IPPROTO_UDPLITE
:
798 attroff(COLOR_PAIR(3));
801 /* Guess application port */
802 switch (n
->l4_proto
) {
804 port
= presenter_get_port(n
->port_src
, n
->port_dst
, 1);
805 pname
= lookup_port_tcp(port
);
808 case IPPROTO_UDPLITE
:
809 port
= presenter_get_port(n
->port_src
, n
->port_dst
, 0);
810 pname
= lookup_port_udp(port
);
815 printw(":%s", pname
);
820 /* Number packets, bytes */
821 if (n
->counter_pkts
> 0 && n
->counter_bytes
> 0)
822 printw(" (%llu pkts, %llu bytes) ->",
823 n
->counter_pkts
, n
->counter_bytes
);
825 /* Show source information: reverse DNS, port, country, city */
827 attron(COLOR_PAIR(1));
828 mvwprintw(screen
, ++(*line
), 8, "src: %s", n
->rev_dns_src
);
829 attroff(COLOR_PAIR(1));
831 printw(":%u", n
->port_src
);
833 if (n
->country_src
[0]) {
836 attron(COLOR_PAIR(4));
837 printw("%s", n
->country_src
);
838 attroff(COLOR_PAIR(4));
841 printw(", %s", n
->city_src
);
849 /* Show dest information: reverse DNS, port, country, city */
850 attron(COLOR_PAIR(2));
851 mvwprintw(screen
, ++(*line
), 8, "dst: %s", n
->rev_dns_dst
);
852 attroff(COLOR_PAIR(2));
854 printw(":%u", n
->port_dst
);
856 if (n
->country_dst
[0]) {
859 attron(COLOR_PAIR(4));
860 printw("%s", n
->country_dst
);
861 attroff(COLOR_PAIR(4));
864 printw(", %s", n
->city_dst
);
870 static inline int presenter_flow_wrong_state(struct flow_entry
*n
, int state
)
874 switch (n
->l4_proto
) {
876 if (n
->tcp_state
== state
)
880 if (n
->sctp_state
== state
)
884 if (n
->dccp_state
== state
)
888 case IPPROTO_UDPLITE
:
898 static void presenter_screen_update(WINDOW
*screen
, struct flow_list
*fl
,
902 unsigned int line
= 3;
903 struct flow_entry
*n
;
904 uint8_t protocols
[] = {
913 size_t protocol_state_size
[] = {
914 [IPPROTO_TCP
] = array_size(tcp_states
),
915 [IPPROTO_DCCP
] = array_size(dccp_states
),
916 [IPPROTO_SCTP
] = array_size(sctp_states
),
918 [IPPROTO_UDPLITE
] = 1,
920 [IPPROTO_ICMPV6
] = 1,
925 maxy
= getmaxy(screen
);
929 init_pair(1, COLOR_RED
, COLOR_BLACK
);
930 init_pair(2, COLOR_BLUE
, COLOR_BLACK
);
931 init_pair(3, COLOR_YELLOW
, COLOR_BLACK
);
932 init_pair(4, COLOR_GREEN
, COLOR_BLACK
);
937 mvwprintw(screen
, 1, 2, "Kernel netfilter flows for %s%s%s%s%s%s"
938 "[+%d]", what
& INCLUDE_TCP
? "TCP, " : "" ,
939 what
& INCLUDE_UDP
? "UDP, " : "",
940 what
& INCLUDE_SCTP
? "SCTP, " : "",
941 what
& INCLUDE_DCCP
? "DCCP, " : "",
942 what
& INCLUDE_ICMP
&& what
& INCLUDE_IPV4
? "ICMP, " : "",
943 what
& INCLUDE_ICMP
&& what
& INCLUDE_IPV6
? "ICMP6, " : "",
948 if (rcu_dereference(fl
->head
) == NULL
)
949 mvwprintw(screen
, line
, 2, "(No active sessions! "
950 "Is netfilter running?)");
952 for (i
= 0; i
< array_size(protocols
); i
++) {
953 for (j
= 0; j
< protocol_state_size
[protocols
[i
]]; j
++) {
954 n
= rcu_dereference(fl
->head
);
955 while (n
&& maxy
> 0) {
958 if (n
->l4_proto
!= protocols
[i
])
960 if (presenter_flow_wrong_state(n
, j
))
962 if (presenter_get_port(n
->port_src
,
963 n
->port_dst
, 0) == 53)
966 n
= rcu_dereference(n
->next
);
969 if (skip_lines
> 0) {
970 n
= rcu_dereference(n
->next
);
975 presenter_screen_do_line(screen
, n
, &line
);
978 maxy
-= (2 + 1 * show_src
);
979 n
= rcu_dereference(n
->next
);
990 static inline void presenter_screen_end(void)
995 static void presenter(void)
1000 dissector_init_ethernet(0);
1001 screen
= presenter_screen_init();
1003 rcu_register_thread();
1020 if (skip_lines
> SCROLL_MAX
)
1021 skip_lines
= SCROLL_MAX
;
1028 presenter_screen_update(screen
, &flow_list
, skip_lines
);
1031 rcu_unregister_thread();
1033 presenter_screen_end();
1034 dissector_cleanup_ethernet();
1037 static int collector_cb(enum nf_conntrack_msg_type type
,
1038 struct nf_conntrack
*ct
, void *data
)
1041 return NFCT_CB_STOP
;
1044 spinlock_lock(&flow_list
.lock
);
1048 flow_list_new_entry(&flow_list
, ct
);
1051 flow_list_update_entry(&flow_list
, ct
);
1053 case NFCT_T_DESTROY
:
1054 flow_list_destroy_entry(&flow_list
, ct
);
1060 spinlock_unlock(&flow_list
.lock
);
1062 return NFCT_CB_CONTINUE
;
1065 static inline void collector_flush(struct nfct_handle
*handle
, uint8_t family
)
1067 nfct_query(handle
, NFCT_Q_FLUSH
, &family
);
1070 static void *collector(void *null
)
1073 struct nfct_handle
*handle
;
1074 struct nfct_filter
*filter
;
1076 handle
= nfct_open(CONNTRACK
, NF_NETLINK_CONNTRACK_NEW
|
1077 NF_NETLINK_CONNTRACK_UPDATE
|
1078 NF_NETLINK_CONNTRACK_DESTROY
);
1080 panic("Cannot create a nfct handle!\n");
1082 collector_flush(handle
, AF_INET
);
1083 collector_flush(handle
, AF_INET6
);
1085 filter
= nfct_filter_create();
1087 panic("Cannot create a nfct filter!\n");
1089 ret
= nfct_filter_attach(nfct_fd(handle
), filter
);
1091 panic("Cannot attach filter to handle!\n");
1093 if (what
& INCLUDE_UDP
) {
1094 nfct_filter_add_attr_u32(filter
, NFCT_FILTER_L4PROTO
, IPPROTO_UDP
);
1095 nfct_filter_add_attr_u32(filter
, NFCT_FILTER_L4PROTO
, IPPROTO_UDPLITE
);
1097 if (what
& INCLUDE_TCP
)
1098 nfct_filter_add_attr_u32(filter
, NFCT_FILTER_L4PROTO
, IPPROTO_TCP
);
1099 if (what
& INCLUDE_DCCP
)
1100 nfct_filter_add_attr_u32(filter
, NFCT_FILTER_L4PROTO
, IPPROTO_DCCP
);
1101 if (what
& INCLUDE_SCTP
)
1102 nfct_filter_add_attr_u32(filter
, NFCT_FILTER_L4PROTO
, IPPROTO_SCTP
);
1103 if (what
& INCLUDE_ICMP
&& what
& INCLUDE_IPV4
)
1104 nfct_filter_add_attr_u32(filter
, NFCT_FILTER_L4PROTO
, IPPROTO_ICMP
);
1105 if (what
& INCLUDE_ICMP
&& what
& INCLUDE_IPV6
)
1106 nfct_filter_add_attr_u32(filter
, NFCT_FILTER_L4PROTO
, IPPROTO_ICMPV6
);
1107 if (what
& INCLUDE_IPV4
) {
1108 nfct_filter_set_logic(filter
, NFCT_FILTER_SRC_IPV4
, NFCT_FILTER_LOGIC_NEGATIVE
);
1109 nfct_filter_add_attr(filter
, NFCT_FILTER_SRC_IPV4
, &filter_ipv4
);
1111 if (what
& INCLUDE_IPV6
) {
1112 nfct_filter_set_logic(filter
, NFCT_FILTER_SRC_IPV6
, NFCT_FILTER_LOGIC_NEGATIVE
);
1113 nfct_filter_add_attr(filter
, NFCT_FILTER_SRC_IPV6
, &filter_ipv6
);
1116 ret
= nfct_filter_attach(nfct_fd(handle
), filter
);
1118 panic("Cannot attach filter to handle!\n");
1120 nfct_callback_register(handle
, NFCT_T_ALL
, collector_cb
, NULL
);
1121 nfct_filter_destroy(filter
);
1122 flow_list_init(&flow_list
);
1124 rcu_register_thread();
1126 while (!sigint
&& ret
>= 0)
1127 ret
= nfct_catch(handle
);
1129 rcu_unregister_thread();
1131 flow_list_destroy(&flow_list
);
1137 int main(int argc
, char **argv
)
1140 int ret
, c
, opt_index
, what_cmd
= 0;
1145 while ((c
= getopt_long(argc
, argv
, short_options
, long_options
,
1146 &opt_index
)) != EOF
) {
1149 what_cmd
|= INCLUDE_IPV4
;
1152 what_cmd
|= INCLUDE_IPV6
;
1155 what_cmd
|= INCLUDE_TCP
;
1158 what_cmd
|= INCLUDE_UDP
;
1161 what_cmd
|= INCLUDE_DCCP
;
1164 what_cmd
|= INCLUDE_ICMP
;
1167 what_cmd
|= INCLUDE_SCTP
;
1192 register_signal(SIGINT
, signal_handler
);
1193 register_signal(SIGHUP
, signal_handler
);
1197 ret
= pthread_create(&tid
, NULL
, collector
, NULL
);
1199 panic("Cannot create phthread!\n");