2 * netsniff-ng - the packet sniffing beast
3 * By Daniel Borkmann <daniel@netsniff-ng.org>
4 * Copyright 2011 Daniel Borkmann.
5 * Copyright 2011 Emmanuel Roullit.
6 * Subject to the GPL, version 2.
8 * A tiny tool to provide top-like netfilter connection tracking information.
10 * The Dark Lord has Nine. But we have One, mightier than they: the White
11 * Rider. He has passed through the fire and the abyss, and they shall
12 * fear him. We will go where he leads.
14 * -- The Lord of the Rings, Aragorn,
15 * Chapter 'The White Rider'.
28 #include <libnetfilter_conntrack/libnetfilter_conntrack.h>
29 #include <libnetfilter_conntrack/libnetfilter_conntrack_tcp.h>
31 #include <GeoIPCity.h>
32 #include <netinet/in.h>
45 #include "dissector_eth.h"
48 #define INCLUDE_UDP (1 << 0)
49 #define INCLUDE_TCP (1 << 1)
51 #ifndef ATTR_TIMESTAMP_START
52 # define ATTR_TIMESTAMP_START 63
54 #ifndef ATTR_TIMESTAMP_STOP
55 # define ATTR_TIMESTAMP_STOP 64
58 #define SCROLL_MAX 1000
63 struct flow_entry
*next
;
68 uint32_t ip4_src_addr
;
69 uint32_t ip4_dst_addr
;
70 uint32_t ip6_src_addr
[4];
71 uint32_t ip6_dst_addr
[4];
76 uint64_t counter_pkts
;
77 uint64_t counter_bytes
;
78 uint64_t timestamp_start
;
79 uint64_t timestamp_stop
;
80 char country_src
[128];
82 char rev_dns_src
[256];
83 char country_dst
[128];
85 char rev_dns_dst
[256];
92 struct flow_entry
*head
;
96 volatile sig_atomic_t sigint
= 0;
98 static int what
= INCLUDE_TCP
;
100 static int show_src
= 0;
102 static struct flow_list flow_list
;
104 static GeoIP
*gi_country
= NULL
;
105 static GeoIP
*gi_city
= NULL
;
107 static char *path_city_db
= NULL
, *path_country_db
= NULL
;
109 static const char *short_options
= "vhTULKs";
110 static const struct option long_options
[] = {
111 {"tcp", no_argument
, NULL
, 'T'},
112 {"udp", no_argument
, NULL
, 'U'},
113 {"show-src", no_argument
, NULL
, 's'},
114 {"city-db", required_argument
, NULL
, 'L'},
115 {"country-db", required_argument
, NULL
, 'K'},
116 {"version", no_argument
, NULL
, 'v'},
117 {"help", no_argument
, NULL
, 'h'},
121 const char *const l3proto2str
[AF_MAX
] = {
126 const char *const proto2str
[IPPROTO_MAX
] = {
127 [IPPROTO_TCP
] = "tcp",
128 [IPPROTO_UDP
] = "udp",
129 [IPPROTO_UDPLITE
] = "udplite",
130 [IPPROTO_ICMP
] = "icmp",
131 [IPPROTO_ICMPV6
] = "icmpv6",
132 [IPPROTO_SCTP
] = "sctp",
133 [IPPROTO_GRE
] = "gre",
134 [IPPROTO_DCCP
] = "dccp",
135 [IPPROTO_IGMP
] = "igmp",
136 [IPPROTO_IPIP
] = "ipip",
137 [IPPROTO_EGP
] = "egp",
138 [IPPROTO_PUP
] = "pup",
139 [IPPROTO_IDP
] = "idp",
140 [IPPROTO_RSVP
] = "rsvp",
141 [IPPROTO_IPV6
] = "ip6tun",
142 [IPPROTO_ESP
] = "esp",
144 [IPPROTO_PIM
] = "pim",
145 [IPPROTO_COMP
] = "comp",
148 const char *const state2str
[TCP_CONNTRACK_MAX
] = {
149 [TCP_CONNTRACK_NONE
] = "NOSTATE",
150 [TCP_CONNTRACK_SYN_SENT
] = "SYN_SENT",
151 [TCP_CONNTRACK_SYN_RECV
] = "SYN_RECV",
152 [TCP_CONNTRACK_ESTABLISHED
] = "ESTABLISHED",
153 [TCP_CONNTRACK_FIN_WAIT
] = "FIN_WAIT",
154 [TCP_CONNTRACK_CLOSE_WAIT
] = "CLOSE_WAIT",
155 [TCP_CONNTRACK_LAST_ACK
] = "LAST_ACK",
156 [TCP_CONNTRACK_TIME_WAIT
] = "TIME_WAIT",
157 [TCP_CONNTRACK_CLOSE
] = "CLOSE",
158 [TCP_CONNTRACK_SYN_SENT2
] = "SYN_SENT2",
161 const uint8_t states
[] = {
162 TCP_CONNTRACK_SYN_SENT
,
163 TCP_CONNTRACK_SYN_RECV
,
164 TCP_CONNTRACK_ESTABLISHED
,
165 TCP_CONNTRACK_FIN_WAIT
,
166 TCP_CONNTRACK_CLOSE_WAIT
,
167 TCP_CONNTRACK_LAST_ACK
,
168 TCP_CONNTRACK_TIME_WAIT
,
170 TCP_CONNTRACK_SYN_SENT2
,
174 static void signal_handler(int number
)
186 static void help(void)
188 printf("\nflowtop %s, top-like netfilter TCP/UDP flow tracking\n",
190 puts("http://www.netsniff-ng.org\n\n"
191 "Usage: flowtop [options]\n"
193 " -T|--tcp Show only TCP flows (default)\n"
194 " -U|--udp Show only UDP flows\n"
195 " -s|--show-src Also show source, not only dest\n"
196 " --city-db <path> Specifiy path for geoip city database\n"
197 " --country-db <path> Specifiy path for geoip country database\n"
198 " -v|--version Print version\n"
199 " -h|--help Print this help\n\n"
204 " If netfilter is not running, you can activate it with i.e.:\n"
205 " iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\n"
206 " iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\n\n"
207 "Please report bugs to <bugs@netsniff-ng.org>\n"
208 "Copyright (C) 2011-2012 Daniel Borkmann <daniel@netsniff-ng.org>\n"
209 "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel@netsniff-ng.org>\n"
210 "License: GNU GPL version 2.0\n"
211 "This is free software: you are free to change and redistribute it.\n"
212 "There is NO WARRANTY, to the extent permitted by law.\n");
216 static void version(void)
218 printf("\nflowtop %s, top-like netfilter TCP/UDP flow tracking\n",
220 puts("http://www.netsniff-ng.org\n\n"
221 "Please report bugs to <bugs@netsniff-ng.org>\n"
222 "Copyright (C) 2011-2012 Daniel Borkmann <daniel@netsniff-ng.org>\n"
223 "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel@netsniff-ng.org>\n"
224 "License: GNU GPL version 2.0\n"
225 "This is free software: you are free to change and redistribute it.\n"
226 "There is NO WARRANTY, to the extent permitted by law.\n");
230 static void screen_init(WINDOW
**screen
)
232 (*screen
) = initscr();
235 keypad(stdscr
, TRUE
);
236 nodelay(*screen
, TRUE
);
241 static inline uint16_t get_port(uint16_t src
, uint16_t dst
)
248 /* XXX: Is there a better way to determine? */
249 if (src
< dst
&& src
< 1024) {
251 } else if (dst
< src
&& dst
< 1024) {
254 tmp1
= lookup_port_tcp(src
);
255 tmp2
= lookup_port_tcp(dst
);
258 } else if (!tmp1
&& tmp2
) {
269 static void screen_update(WINDOW
*screen
, struct flow_list
*fl
, int skip_lines
)
273 struct flow_entry
*n
;
276 maxy
= getmaxy(screen
);
279 init_pair(1, COLOR_RED
, COLOR_BLACK
);
280 init_pair(2, COLOR_BLUE
, COLOR_BLACK
);
281 init_pair(3, COLOR_YELLOW
, COLOR_BLACK
);
282 init_pair(4, COLOR_GREEN
, COLOR_BLACK
);
289 mvwprintw(screen
, 1, 2, "Kernel netfilter TCP/UDP flow statistics, [+%d]",
292 if (rcu_dereference(fl
->head
) == NULL
)
293 mvwprintw(screen
, line
, 2, "(No active sessions! Is netfilter running?)");
296 /* Yes, that's lame :-P */
297 for (i
= 0; i
< sizeof(states
); i
++) {
298 n
= rcu_dereference(fl
->head
);
300 while (n
&& maxy
> 0) {
303 if (n
->tcp_state
!= states
[i
] ||
304 (i
!= TCP_CONNTRACK_NONE
&&
305 n
->tcp_state
== TCP_CONNTRACK_NONE
) ||
307 get_port(n
->port_src
, n
->port_dst
) == 53) {
308 n
= rcu_dereference(n
->next
);
312 if (skip_lines
> 0) {
313 n
= rcu_dereference(n
->next
);
318 snprintf(tmp
, sizeof(tmp
), "%u/%s", n
->procnum
,
319 basename(n
->cmdline
));
320 tmp
[sizeof(tmp
) - 1] = 0;
322 mvwprintw(screen
, line
, 2, "[");
323 attron(COLOR_PAIR(3));
324 printw("%s", n
->procnum
> 0 ? tmp
: "bridged(?)");
325 attroff(COLOR_PAIR(3));
326 printw("]:%s:%s[", l3proto2str
[n
->l3_proto
],
327 proto2str
[n
->l4_proto
]);
328 attron(COLOR_PAIR(3));
329 printw("%s", state2str
[n
->tcp_state
]);
330 attroff(COLOR_PAIR(3));
333 if (n
->tcp_state
!= TCP_CONNTRACK_NONE
) {
334 printw("%s -> ", lookup_port_tcp(get_port(n
->port_src
,
337 printw("%s -> ", lookup_port_udp(get_port(n
->port_src
,
342 attron(COLOR_PAIR(1));
343 mvwprintw(screen
, ++line
, 8, "src: %s", n
->rev_dns_src
);
344 attroff(COLOR_PAIR(1));
345 printw(":%u (", ntohs(n
->port_src
));
346 attron(COLOR_PAIR(4));
347 printw("%s", (strlen(n
->country_src
) > 0 ?
348 n
->country_src
: "N/A"));
349 attroff(COLOR_PAIR(4));
350 printw(", %s) => ", (strlen(n
->city_src
) > 0 ?
351 n
->city_src
: "N/A"));
353 attron(COLOR_PAIR(2));
354 mvwprintw(screen
, ++line
, 8, "dst: %s", n
->rev_dns_dst
);
355 attroff(COLOR_PAIR(2));
356 printw(":%u (", ntohs(n
->port_dst
));
357 attron(COLOR_PAIR(4));
358 printw("%s", strlen(n
->country_dst
) > 0 ?
359 n
->country_dst
: "N/A");
360 attroff(COLOR_PAIR(4));
361 printw(", %s)", strlen(n
->city_dst
) > 0 ?
362 n
->city_dst
: "N/A");
366 n
= rcu_dereference(n
->next
);
376 static void screen_end(void)
381 static void presenter(void)
384 WINDOW
*screen
= NULL
;
386 dissector_init_ethernet(0);
387 screen_init(&screen
);
388 rcu_register_thread();
406 if (skip_lines
> SCROLL_MAX
)
407 skip_lines
= SCROLL_MAX
;
414 screen_update(screen
, &flow_list
, skip_lines
);
418 rcu_unregister_thread();
420 dissector_cleanup_ethernet();
423 static inline const char *make_n_a(const char *p
)
428 static void walk_process(char *process
, struct flow_entry
*n
)
435 if (snprintf(path
, sizeof(path
), "/proc/%s/fd", process
) == -1)
436 panic("giant process name! %s\n", process
);
442 while ((ent
= readdir(dir
))) {
445 if (snprintf(path
, sizeof(path
), "/proc/%s/fd/%s",
446 process
, ent
->d_name
) < 0)
448 if (stat(path
, &statbuf
) < 0)
450 if (S_ISSOCK(statbuf
.st_mode
) && n
->inode
== statbuf
.st_ino
) {
451 memset(n
->cmdline
, 0, sizeof(n
->cmdline
));
452 snprintf(path
, sizeof(path
), "/proc/%s/exe", process
);
453 rc
= readlink(path
, n
->cmdline
, sizeof(n
->cmdline
) - 1);
456 panic("readlink error: %s\n", strerror(errno
));
458 n
->procnum
= atoi(process
);
465 /* Derived from ifpromisc, Fred N. van Kempen, GPL v2.0 */
466 /* n->inode must be set */
467 static void walk_processes(struct flow_entry
*n
)
473 memset(n
->cmdline
, 0, sizeof(n
->cmdline
));
477 dir
= opendir("/proc");
479 panic("Cannot open /proc!\n");
481 while ((ent
= readdir(dir
)))
482 if (strspn(ent
->d_name
, "0123456789") == strlen(ent
->d_name
))
483 walk_process(ent
->d_name
, n
);
488 static int get_inode_from_local_port(int port
, const char *proto
, int ip6
)
495 memset(path
, 0, sizeof(path
));
496 snprintf(path
, sizeof(path
), "/proc/net/%s%s", proto
, ip6
? "6" : "");
497 proc
= fopen(path
, "r");
500 memset(buff
, 0, sizeof(buff
));
501 while (fgets(buff
, sizeof(buff
), proc
) != NULL
) {
502 int lport
= 0, inode
= 0;
503 buff
[sizeof(buff
) - 1] = 0;
504 if (sscanf(buff
, "%*u: %*X:%X %*X:%*X %*X %*X:%*X %*X:%*X "
505 "%*X %*u %*u %u", &lport
, &inode
) == 2) {
511 memset(buff
, 0, sizeof(buff
));
518 static void flow_entry_from_ct(struct flow_entry
*n
, struct nf_conntrack
*ct
)
520 const uint8_t *ipv6_src
;
521 const uint8_t *ipv6_dst
;
523 n
->flow_id
= nfct_get_attr_u32(ct
, ATTR_ID
);
524 n
->use
= nfct_get_attr_u32(ct
, ATTR_USE
);
525 n
->status
= nfct_get_attr_u32(ct
, ATTR_STATUS
);
526 n
->l3_proto
= nfct_get_attr_u8(ct
, ATTR_ORIG_L3PROTO
);
527 n
->l4_proto
= nfct_get_attr_u8(ct
, ATTR_ORIG_L4PROTO
);
528 n
->ip4_src_addr
= nfct_get_attr_u32(ct
, ATTR_ORIG_IPV4_SRC
);
529 n
->ip4_dst_addr
= nfct_get_attr_u32(ct
, ATTR_ORIG_IPV4_DST
);
531 ipv6_src
= nfct_get_attr(ct
, ATTR_ORIG_IPV6_SRC
);
533 memcpy(n
->ip6_src_addr
, ipv6_src
, sizeof(n
->ip6_src_addr
));
534 ipv6_dst
= nfct_get_attr(ct
, ATTR_ORIG_IPV6_DST
);
536 memcpy(n
->ip6_dst_addr
, ipv6_dst
, sizeof(n
->ip6_dst_addr
));
538 n
->port_src
= nfct_get_attr_u16(ct
, ATTR_ORIG_PORT_SRC
);
539 n
->port_dst
= nfct_get_attr_u16(ct
, ATTR_ORIG_PORT_DST
);
540 n
->tcp_state
= nfct_get_attr_u8(ct
, ATTR_TCP_STATE
);
541 n
->tcp_flags
= nfct_get_attr_u8(ct
, ATTR_TCP_FLAGS_ORIG
);
542 n
->counter_pkts
= nfct_get_attr_u64(ct
, ATTR_ORIG_COUNTER_PACKETS
);
543 n
->counter_bytes
= nfct_get_attr_u64(ct
, ATTR_ORIG_COUNTER_BYTES
);
544 n
->timestamp_start
= nfct_get_attr_u64(ct
, ATTR_TIMESTAMP_START
);
545 n
->timestamp_stop
= nfct_get_attr_u64(ct
, ATTR_TIMESTAMP_STOP
);
548 n
->inode
= get_inode_from_local_port(ntohs(n
->port_src
),
549 proto2str
[n
->l4_proto
],
554 /* if this really runs on a router, we try it once and then let it be */
558 /* TODO: IP4 + IP6 */
559 static void flow_entry_get_extended(struct flow_entry
*n
)
561 struct sockaddr_in sa
;
562 struct hostent
*hent
;
563 GeoIPRecord
*gir_src
, *gir_dst
;
567 if (ntohs(n
->port_src
) == 53 || ntohs(n
->port_dst
) == 53)
570 memset(&sa
, 0, sizeof(sa
));
571 sa
.sin_family
= PF_INET
; //XXX: IPv4
572 sa
.sin_addr
.s_addr
= n
->ip4_src_addr
;
573 getnameinfo((struct sockaddr
*) &sa
, sizeof(sa
), n
->rev_dns_src
,
574 sizeof(n
->rev_dns_src
), NULL
, 0, NI_NUMERICHOST
);
576 hent
= gethostbyaddr(&sa
.sin_addr
, sizeof(sa
.sin_addr
), PF_INET
);
578 memset(n
->rev_dns_src
, 0, sizeof(n
->rev_dns_src
));
579 memcpy(n
->rev_dns_src
, hent
->h_name
,
580 min(sizeof(n
->rev_dns_src
), strlen(hent
->h_name
)));
583 gir_src
= GeoIP_record_by_ipnum(gi_city
, ntohl(n
->ip4_src_addr
));
585 const char *country
=
586 make_n_a(GeoIP_country_name_by_ipnum(gi_country
,
587 ntohl(n
->ip4_src_addr
)));
588 const char *city
= make_n_a(gir_src
->city
);
589 memcpy(n
->country_src
, country
,
590 min(sizeof(n
->country_src
), strlen(country
)));
591 memcpy(n
->city_src
, city
,
592 min(sizeof(n
->city_src
), strlen(city
)));
595 memset(&sa
, 0, sizeof(sa
));
596 sa
.sin_family
= PF_INET
; //XXX: IPv4
597 sa
.sin_addr
.s_addr
= n
->ip4_dst_addr
;
598 getnameinfo((struct sockaddr
*) &sa
, sizeof(sa
), n
->rev_dns_dst
,
599 sizeof(n
->rev_dns_dst
), NULL
, 0, NI_NUMERICHOST
);
601 hent
= gethostbyaddr(&sa
.sin_addr
, sizeof(sa
.sin_addr
), PF_INET
);
603 memset(n
->rev_dns_dst
, 0, sizeof(n
->rev_dns_dst
));
604 memcpy(n
->rev_dns_dst
, hent
->h_name
,
605 min(sizeof(n
->rev_dns_dst
), strlen(hent
->h_name
)));
608 gir_dst
= GeoIP_record_by_ipnum(gi_city
, ntohl(n
->ip4_dst_addr
));
610 const char *country
=
611 make_n_a(GeoIP_country_name_by_ipnum(gi_country
,
612 ntohl(n
->ip4_dst_addr
)));
613 const char *city
= make_n_a(gir_dst
->city
);
614 memcpy(n
->country_dst
, country
,
615 min(sizeof(n
->country_dst
), strlen(country
)));
616 memcpy(n
->city_dst
, city
,
617 min(sizeof(n
->city_dst
), strlen(city
)));
621 static void flow_list_init(struct flow_list
*fl
)
624 spinlock_init(&fl
->lock
);
627 static struct flow_entry
*__flow_list_find_by_id(struct flow_list
*fl
, uint32_t id
)
629 struct flow_entry
*n
= rcu_dereference(fl
->head
);
631 if (n
->flow_id
== id
)
633 n
= rcu_dereference(n
->next
);
638 static struct flow_entry
*__flow_list_find_prev_by_id(struct flow_list
*fl
, uint32_t id
)
640 struct flow_entry
*n
= rcu_dereference(fl
->head
);
641 if (n
->flow_id
== id
)
643 while (rcu_dereference(n
->next
) != NULL
) {
644 if (rcu_dereference(n
->next
)->flow_id
== id
)
646 n
= rcu_dereference(n
->next
);
651 static void flow_list_new_entry(struct flow_list
*fl
, struct nf_conntrack
*ct
)
653 struct flow_entry
*n
= xzmalloc(sizeof(*n
));
655 rcu_assign_pointer(n
->next
, fl
->head
);
656 rcu_assign_pointer(fl
->head
, n
);
657 flow_entry_from_ct(n
, ct
);
658 flow_entry_get_extended(n
);
661 static void flow_list_update_entry(struct flow_list
*fl
, struct nf_conntrack
*ct
)
664 uint32_t id
= nfct_get_attr_u32(ct
, ATTR_ID
);
665 struct flow_entry
*n
;
666 n
= __flow_list_find_by_id(fl
, id
);
668 n
= xzmalloc(sizeof(*n
));
670 rcu_assign_pointer(n
->next
, fl
->head
);
671 rcu_assign_pointer(fl
->head
, n
);
674 flow_entry_from_ct(n
, ct
);
676 flow_entry_get_extended(n
);
679 static void flow_list_destroy_entry(struct flow_list
*fl
, struct nf_conntrack
*ct
)
681 uint32_t id
= nfct_get_attr_u32(ct
, ATTR_ID
);
682 struct flow_entry
*n1
, *n2
;
684 n1
= __flow_list_find_by_id(fl
, id
);
686 n2
= __flow_list_find_prev_by_id(fl
, id
);
688 rcu_assign_pointer(n2
->next
, n1
->next
);
689 rcu_assign_pointer(n1
->next
, NULL
);
693 rcu_assign_pointer(fl
->head
, NULL
);
698 static void flow_list_destroy(struct flow_list
*fl
)
700 struct flow_entry
*n
;
702 while (fl
->head
!= NULL
) {
703 n
= rcu_dereference(fl
->head
->next
);
704 rcu_assign_pointer(fl
->head
->next
, NULL
);
706 rcu_assign_pointer(fl
->head
, n
);
710 spinlock_destroy(&fl
->lock
);
713 static int collector_cb(enum nf_conntrack_msg_type type
,
714 struct nf_conntrack
*ct
,
722 spinlock_lock(&flow_list
.lock
);
725 flow_list_new_entry(&flow_list
, ct
);
728 flow_list_update_entry(&flow_list
, ct
);
731 flow_list_destroy_entry(&flow_list
, ct
);
736 spinlock_unlock(&flow_list
.lock
);
738 return NFCT_CB_CONTINUE
;
741 static int dummy_cb(enum nf_conntrack_msg_type type
, struct nf_conntrack
*ct
,
747 static void *collector(void *null
)
750 u_int32_t family
= AF_INET
;
751 struct nfct_handle
*handle
;
752 struct nfct_filter
*filter
;
753 struct nfct_filter_ipv4 filter_ipv4
= {
754 .addr
= ntohl(INADDR_LOOPBACK
),
757 struct nfct_filter_ipv6 filter_ipv6
= {
758 .addr
= { 0x0, 0x0, 0x0, 0x1 },
759 .mask
= { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff },
762 handle
= nfct_open(CONNTRACK
, NFCT_ALL_CT_GROUPS
);
764 panic("Cannot create a nfct handle!\n");
767 nfct_callback_register(handle
, NFCT_T_ALL
, dummy_cb
, NULL
);
768 nfct_query(handle
, NFCT_Q_DUMP
, &family
);
771 handle
= nfct_open(CONNTRACK
, NFCT_ALL_CT_GROUPS
);
773 panic("Cannot create a nfct handle!\n");
775 nfct_query(handle
, NFCT_Q_FLUSH
, &family
);
777 filter
= nfct_filter_create();
779 panic("Cannot create a nfct filter!\n");
780 if (what
& INCLUDE_UDP
)
781 nfct_filter_add_attr_u32(filter
, NFCT_FILTER_L4PROTO
, IPPROTO_UDP
);
782 if (what
& INCLUDE_TCP
)
783 nfct_filter_add_attr_u32(filter
, NFCT_FILTER_L4PROTO
, IPPROTO_TCP
);
785 nfct_filter_set_logic(filter
, NFCT_FILTER_SRC_IPV4
,
786 NFCT_FILTER_LOGIC_NEGATIVE
);
787 nfct_filter_add_attr(filter
, NFCT_FILTER_SRC_IPV4
, &filter_ipv4
);
789 nfct_filter_set_logic(filter
, NFCT_FILTER_SRC_IPV6
,
790 NFCT_FILTER_LOGIC_NEGATIVE
);
791 nfct_filter_add_attr(filter
, NFCT_FILTER_SRC_IPV6
, &filter_ipv6
);
793 ret
= nfct_filter_attach(nfct_fd(handle
), filter
);
795 panic("Cannot attach filter to handle!\n");
797 nfct_filter_destroy(filter
);
800 gi_country
= GeoIP_open(path_country_db
, GEOIP_MMAP_CACHE
);
802 gi_country
= GeoIP_open_type(GEOIP_COUNTRY_EDITION
,
806 gi_city
= GeoIP_open(path_city_db
, GEOIP_MMAP_CACHE
);
808 gi_city
= GeoIP_open_type(GEOIP_CITY_EDITION_REV1
,
810 if (!gi_country
|| !gi_city
)
811 panic("Cannot open GeoIP database!\n");
813 GeoIP_set_charset(gi_country
, GEOIP_CHARSET_UTF8
);
814 GeoIP_set_charset(gi_city
, GEOIP_CHARSET_UTF8
);
816 flow_list_init(&flow_list
);
818 rcu_register_thread();
820 nfct_callback_register(handle
, NFCT_T_ALL
, collector_cb
, NULL
);
825 rcu_unregister_thread();
827 flow_list_destroy(&flow_list
);
829 GeoIP_delete(gi_city
);
830 GeoIP_delete(gi_country
);
837 xfree(path_country_db
);
842 int main(int argc
, char **argv
)
845 int ret
, c
, opt_index
, what_cmd
= 0;
847 while ((c
= getopt_long(argc
, argv
, short_options
, long_options
,
848 &opt_index
)) != EOF
) {
851 what_cmd
|= INCLUDE_TCP
;
854 what_cmd
|= INCLUDE_UDP
;
860 path_city_db
= xstrdup(optarg
);
863 path_country_db
= xstrdup(optarg
);
875 panic("Option -%c requires an argument!\n",
879 whine("Unknown option character "
880 "`0x%X\'!\n", optopt
);
893 register_signal(SIGINT
, signal_handler
);
894 register_signal(SIGHUP
, signal_handler
);
896 ret
= pthread_create(&tid
, NULL
, collector
, NULL
);
898 panic("Cannot create phthread!\n");