?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
flowtop: Resolve src host if '-s' option specified
[netsniff-ng.git] / flowtop.c
blob0a498ed47e11ca59ff3271f6e0dd9486d62aafbc
1 /*
2 * netsniff-ng - the packet sniffing beast
3 * Copyright 2011 - 2013 Daniel Borkmann.
4 * Copyright 2011 Emmanuel Roullit.
5 * Subject to the GPL, version 2.
6 */
7
8 #define _LGPL_SOURCE
9 #include <stdio.h>
10 #include <stdint.h>
11 #include <stdlib.h>
12 #include <signal.h>
13 #include <getopt.h>
14 #include <pthread.h>
15 #include <signal.h>
16 #include <netdb.h>
17 #include <ctype.h>
18 #include <netinet/in.h>
19 #include <curses.h>
20 #include <dirent.h>
21 #include <sys/stat.h>
22 #include <sys/fsuid.h>
23 #include <urcu.h>
24 #include <libgen.h>
25 #include <inttypes.h>
26 #include <poll.h>
27 #include <fcntl.h>
28
29 #include "die.h"
30 #include "xmalloc.h"
31 #include "conntrack.h"
32 #include "config.h"
33 #include "str.h"
34 #include "sig.h"
35 #include "lookup.h"
36 #include "geoip.h"
37 #include "built_in.h"
38 #include "locking.h"
39 #include "pkt_buff.h"
40 #include "screen.h"
41 #include "proc.h"
42 #include "sysctl.h"
43
44 struct flow_entry {
45 uint32_t flow_id, use, status;
46 uint8_t l3_proto, l4_proto;
47 uint32_t ip4_src_addr, ip4_dst_addr;
48 uint32_t ip6_src_addr[4], ip6_dst_addr[4];
49 uint16_t port_src, port_dst;
50 uint8_t tcp_state, tcp_flags, sctp_state, dccp_state;
51 uint64_t src_pkts, src_bytes;
52 uint64_t dst_pkts, dst_bytes;
53 uint64_t timestamp_start, timestamp_stop;
54 char country_src[128], country_dst[128];
55 char city_src[128], city_dst[128];
56 char rev_dns_src[256], rev_dns_dst[256];
57 char cmdline[256];
58 struct flow_entry *next;
59 int inode;
60 unsigned int procnum;
61 bool is_visible;
62 struct nf_conntrack *ct;
63 };
64
65 struct flow_list {
66 struct flow_entry *head;
67 struct spinlock lock;
68 };
69
70 #ifndef ATTR_TIMESTAMP_START
71 # define ATTR_TIMESTAMP_START 63
72 #endif
73 #ifndef ATTR_TIMESTAMP_STOP
74 # define ATTR_TIMESTAMP_STOP 64
75 #endif
76
77 #define SCROLL_MAX 1000
78
79 #define INCLUDE_IPV4 (1 << 0)
80 #define INCLUDE_IPV6 (1 << 1)
81 #define INCLUDE_UDP (1 << 2)
82 #define INCLUDE_TCP (1 << 3)
83 #define INCLUDE_DCCP (1 << 4)
84 #define INCLUDE_ICMP (1 << 5)
85 #define INCLUDE_SCTP (1 << 6)
86
87 static volatile bool is_flow_collecting;
88 static volatile sig_atomic_t sigint = 0;
89 static int what = INCLUDE_IPV4 | INCLUDE_IPV6 | INCLUDE_TCP, show_src = 0;
90 static struct flow_list flow_list;
91 static int nfct_acct_val = -1;
92
93 static const char *short_options = "vhTUsDIS46u";
94 static const struct option long_options[] = {
95 {"ipv4", no_argument, NULL, '4'},
96 {"ipv6", no_argument, NULL, '6'},
97 {"tcp", no_argument, NULL, 'T'},
98 {"udp", no_argument, NULL, 'U'},
99 {"dccp", no_argument, NULL, 'D'},
100 {"icmp", no_argument, NULL, 'I'},
101 {"sctp", no_argument, NULL, 'S'},
102 {"show-src", no_argument, NULL, 's'},
103 {"update", no_argument, NULL, 'u'},
104 {"version", no_argument, NULL, 'v'},
105 {"help", no_argument, NULL, 'h'},
106 {NULL, 0, NULL, 0}
107 };
108
109 static const char *copyright = "Please report bugs to <bugs@netsniff-ng.org>\n"
110 "Copyright (C) 2011-2013 Daniel Borkmann <dborkma@tik.ee.ethz.ch>\n"
111 "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel.roullit@gmail.com>\n"
112 "Swiss federal institute of technology (ETH Zurich)\n"
113 "License: GNU GPL version 2.0\n"
114 "This is free software: you are free to change and redistribute it.\n"
115 "There is NO WARRANTY, to the extent permitted by law.";
116
117 static const char *const l3proto2str[AF_MAX] = {
118 [AF_INET] = "ipv4",
119 [AF_INET6] = "ipv6",
120 };
121
122 static const char *const l4proto2str[IPPROTO_MAX] = {
123 [IPPROTO_TCP] = "tcp",
124 [IPPROTO_UDP] = "udp",
125 [IPPROTO_UDPLITE] = "udplite",
126 [IPPROTO_ICMP] = "icmp",
127 [IPPROTO_ICMPV6] = "icmpv6",
128 [IPPROTO_SCTP] = "sctp",
129 [IPPROTO_GRE] = "gre",
130 [IPPROTO_DCCP] = "dccp",
131 [IPPROTO_IGMP] = "igmp",
132 [IPPROTO_IPIP] = "ipip",
133 [IPPROTO_EGP] = "egp",
134 [IPPROTO_PUP] = "pup",
135 [IPPROTO_IDP] = "idp",
136 [IPPROTO_RSVP] = "rsvp",
137 [IPPROTO_IPV6] = "ip6tun",
138 [IPPROTO_ESP] = "esp",
139 [IPPROTO_AH] = "ah",
140 [IPPROTO_PIM] = "pim",
141 [IPPROTO_COMP] = "comp",
142 };
143
144 static const char *const tcp_state2str[TCP_CONNTRACK_MAX] = {
145 [TCP_CONNTRACK_NONE] = "NOSTATE",
146 [TCP_CONNTRACK_SYN_SENT] = "SYN_SENT",
147 [TCP_CONNTRACK_SYN_RECV] = "SYN_RECV",
148 [TCP_CONNTRACK_ESTABLISHED] = "ESTABLISHED",
149 [TCP_CONNTRACK_FIN_WAIT] = "FIN_WAIT",
150 [TCP_CONNTRACK_CLOSE_WAIT] = "CLOSE_WAIT",
151 [TCP_CONNTRACK_LAST_ACK] = "LAST_ACK",
152 [TCP_CONNTRACK_TIME_WAIT] = "TIME_WAIT",
153 [TCP_CONNTRACK_CLOSE] = "CLOSE",
154 [TCP_CONNTRACK_SYN_SENT2] = "SYN_SENT2",
155 };
156
157 static const char *const dccp_state2str[DCCP_CONNTRACK_MAX] = {
158 [DCCP_CONNTRACK_NONE] = "NOSTATE",
159 [DCCP_CONNTRACK_REQUEST] = "REQUEST",
160 [DCCP_CONNTRACK_RESPOND] = "RESPOND",
161 [DCCP_CONNTRACK_PARTOPEN] = "PARTOPEN",
162 [DCCP_CONNTRACK_OPEN] = "OPEN",
163 [DCCP_CONNTRACK_CLOSEREQ] = "CLOSEREQ",
164 [DCCP_CONNTRACK_CLOSING] = "CLOSING",
165 [DCCP_CONNTRACK_TIMEWAIT] = "TIMEWAIT",
166 [DCCP_CONNTRACK_IGNORE] = "IGNORE",
167 [DCCP_CONNTRACK_INVALID] = "INVALID",
168 };
169
170 static const char *const sctp_state2str[SCTP_CONNTRACK_MAX] = {
171 [SCTP_CONNTRACK_NONE] = "NOSTATE",
172 [SCTP_CONNTRACK_CLOSED] = "CLOSED",
173 [SCTP_CONNTRACK_COOKIE_WAIT] = "COOKIE_WAIT",
174 [SCTP_CONNTRACK_COOKIE_ECHOED] = "COOKIE_ECHOED",
175 [SCTP_CONNTRACK_ESTABLISHED] = "ESTABLISHED",
176 [SCTP_CONNTRACK_SHUTDOWN_SENT] = "SHUTDOWN_SENT",
177 [SCTP_CONNTRACK_SHUTDOWN_RECD] = "SHUTDOWN_RECD",
178 [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = "SHUTDOWN_ACK_SENT",
179 };
180
181 static const struct nfct_filter_ipv4 filter_ipv4 = {
182 .addr = __constant_htonl(INADDR_LOOPBACK),
183 .mask = 0xffffffff,
184 };
185
186 static const struct nfct_filter_ipv6 filter_ipv6 = {
187 .addr = { 0x0, 0x0, 0x0, 0x1 },
188 .mask = { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff },
189 };
190
191 static void signal_handler(int number)
192 {
193 switch (number) {
194 case SIGINT:
195 case SIGQUIT:
196 case SIGTERM:
197 sigint = 1;
198 break;
199 case SIGHUP:
200 default:
201 break;
202 }
203 }
204
205 static void flow_entry_from_ct(struct flow_entry *n, struct nf_conntrack *ct);
206 static void flow_entry_get_extended(struct flow_entry *n);
207
208 static void help(void)
209 {
210 printf("flowtop %s, top-like netfilter TCP/UDP/SCTP/.. flow tracking\n",
211 VERSION_STRING);
212 puts("http://www.netsniff-ng.org\n\n"
213 "Usage: flowtop [options]\n"
214 "Options:\n"
215 " -4|--ipv4 Show only IPv4 flows (default)\n"
216 " -6|--ipv6 Show only IPv6 flows (default)\n"
217 " -T|--tcp Show only TCP flows (default)\n"
218 " -U|--udp Show only UDP flows\n"
219 " -D|--dccp Show only DCCP flows\n"
220 " -I|--icmp Show only ICMP/ICMPv6 flows\n"
221 " -S|--sctp Show only SCTP flows\n"
222 " -s|--show-src Also show source, not only dest\n"
223 " -u|--update Update GeoIP databases\n"
224 " -v|--version Print version and exit\n"
225 " -h|--help Print this help and exit\n\n"
226 "Examples:\n"
227 " flowtop\n"
228 " flowtop -46UTDISs\n\n"
229 "Note:\n"
230 " If netfilter is not running, you can activate it with e.g.:\n"
231 " iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\n"
232 " iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\n");
233 puts(copyright);
234 die();
235 }
236
237 static void version(void)
238 {
239 printf("flowtop %s, Git id: %s\n", VERSION_LONG, GITVERSION);
240 puts("top-like netfilter TCP/UDP/SCTP/.. flow tracking\n"
241 "http://www.netsniff-ng.org\n");
242 puts(copyright);
243 die();
244 }
245
246 static inline struct flow_entry *flow_entry_xalloc(void)
247 {
248 return xzmalloc(sizeof(struct flow_entry));
249 }
250
251 static inline void flow_entry_xfree(struct flow_entry *n)
252 {
253 if (n->ct)
254 nfct_destroy(n->ct);
255
256 xfree(n);
257 }
258
259 static inline void flow_list_init(struct flow_list *fl)
260 {
261 fl->head = NULL;
262 spinlock_init(&fl->lock);
263 }
264
265 static void flow_list_new_entry(struct flow_list *fl, struct nf_conntrack *ct)
266 {
267 struct flow_entry *n = flow_entry_xalloc();
268
269 n->ct = nfct_clone(ct);
270
271 flow_entry_from_ct(n, ct);
272 flow_entry_get_extended(n);
273
274 rcu_assign_pointer(n->next, fl->head);
275 rcu_assign_pointer(fl->head, n);
276 }
277
278 static struct flow_entry *flow_list_find_id(struct flow_list *fl,
279 uint32_t id)
280 {
281 struct flow_entry *n = rcu_dereference(fl->head);
282
283 while (n != NULL) {
284 if (n->flow_id == id)
285 return n;
286
287 n = rcu_dereference(n->next);
288 }
289
290 return NULL;
291 }
292
293 static struct flow_entry *flow_list_find_prev_id(struct flow_list *fl,
294 uint32_t id)
295 {
296 struct flow_entry *prev = rcu_dereference(fl->head), *next;
297
298 if (prev->flow_id == id)
299 return NULL;
300
301 while ((next = rcu_dereference(prev->next)) != NULL) {
302 if (next->flow_id == id)
303 return prev;
304
305 prev = next;
306 }
307
308 return NULL;
309 }
310
311 static void flow_list_update_entry(struct flow_list *fl,
312 struct nf_conntrack *ct)
313 {
314 struct flow_entry *n;
315
316 n = flow_list_find_id(fl, nfct_get_attr_u32(ct, ATTR_ID));
317 if (n == NULL) {
318 flow_list_new_entry(fl, ct);
319 return;
320 }
321
322 flow_entry_from_ct(n, ct);
323 }
324
325 static void flow_list_destroy_entry(struct flow_list *fl,
326 struct nf_conntrack *ct)
327 {
328 struct flow_entry *n1, *n2;
329 uint32_t id = nfct_get_attr_u32(ct, ATTR_ID);
330
331 n1 = flow_list_find_id(fl, id);
332 if (n1) {
333 n2 = flow_list_find_prev_id(fl, id);
334 if (n2) {
335 rcu_assign_pointer(n2->next, n1->next);
336 n1->next = NULL;
337
338 flow_entry_xfree(n1);
339 } else {
340 struct flow_entry *next = fl->head->next;
341
342 flow_entry_xfree(fl->head);
343 fl->head = next;
344 }
345 }
346 }
347
348 static void flow_list_destroy(struct flow_list *fl)
349 {
350 struct flow_entry *n;
351
352 while (fl->head != NULL) {
353 n = rcu_dereference(fl->head->next);
354 fl->head->next = NULL;
355
356 flow_entry_xfree(fl->head);
357 rcu_assign_pointer(fl->head, n);
358 }
359
360 synchronize_rcu();
361 spinlock_destroy(&fl->lock);
362 }
363
364 static int walk_process(unsigned int pid, struct flow_entry *n)
365 {
366 int ret;
367 DIR *dir;
368 struct dirent *ent;
369 char path[1024];
370
371 if (snprintf(path, sizeof(path), "/proc/%u/fd", pid) == -1)
372 panic("giant process name! %u\n", pid);
373
374 dir = opendir(path);
375 if (!dir)
376 return 0;
377
378 while ((ent = readdir(dir))) {
379 struct stat statbuf;
380
381 if (snprintf(path, sizeof(path), "/proc/%u/fd/%s",
382 pid, ent->d_name) < 0)
383 continue;
384
385 if (stat(path, &statbuf) < 0)
386 continue;
387
388 if (S_ISSOCK(statbuf.st_mode) && (ino_t) n->inode == statbuf.st_ino) {
389 ret = proc_get_cmdline(pid, n->cmdline, sizeof(n->cmdline));
390 if (ret < 0)
391 panic("Failed to get process cmdline: %s\n", strerror(errno));
392
393 n->procnum = pid;
394 closedir(dir);
395 return 1;
396 }
397 }
398
399 closedir(dir);
400 return 0;
401 }
402
403 static void walk_processes(struct flow_entry *n)
404 {
405 int ret;
406 DIR *dir;
407 struct dirent *ent;
408
409 /* n->inode must be set */
410 if (n->inode <= 0) {
411 n->cmdline[0] = '\0';
412 return;
413 }
414
415 dir = opendir("/proc");
416 if (!dir)
417 panic("Cannot open /proc: %s\n", strerror(errno));
418
419 while ((ent = readdir(dir))) {
420 const char *name = ent->d_name;
421 char *end;
422 unsigned int pid = strtoul(name, &end, 10);
423
424 /* not a PID */
425 if (pid == 0 && end == name)
426 continue;
427
428 ret = walk_process(pid, n);
429 if (ret > 0)
430 break;
431 }
432
433 closedir(dir);
434 }
435
436 static int get_port_inode(uint16_t port, int proto, bool is_ip6)
437 {
438 int ret = -ENOENT;
439 char path[128], buff[1024];
440 FILE *proc;
441
442 memset(path, 0, sizeof(path));
443 snprintf(path, sizeof(path), "/proc/net/%s%s",
444 l4proto2str[proto], is_ip6 ? "6" : "");
445
446 proc = fopen(path, "r");
447 if (!proc)
448 return -EIO;
449
450 memset(buff, 0, sizeof(buff));
451
452 while (fgets(buff, sizeof(buff), proc) != NULL) {
453 int inode = 0;
454 unsigned int lport = 0;
455
456 buff[sizeof(buff) - 1] = 0;
457 if (sscanf(buff, "%*u: %*X:%X %*X:%*X %*X %*X:%*X %*X:%*X "
458 "%*X %*u %*u %u", &lport, &inode) == 2) {
459 if ((uint16_t) lport == port) {
460 ret = inode;
461 break;
462 }
463 }
464
465 memset(buff, 0, sizeof(buff));
466 }
467
468 fclose(proc);
469 return ret;
470 }
471
472 #define CP_NFCT(elem, attr, x) \
473 do { n->elem = nfct_get_attr_u##x(ct,(attr)); } while (0)
474 #define CP_NFCT_BUFF(elem, attr) do { \
475 const uint8_t *buff = nfct_get_attr(ct,(attr)); \
476 if (buff != NULL) \
477 memcpy(n->elem, buff, sizeof(n->elem)); \
478 } while (0)
479
480 static void flow_entry_from_ct(struct flow_entry *n, struct nf_conntrack *ct)
481 {
482 CP_NFCT(l3_proto, ATTR_ORIG_L3PROTO, 8);
483 CP_NFCT(l4_proto, ATTR_ORIG_L4PROTO, 8);
484
485 CP_NFCT(ip4_src_addr, ATTR_ORIG_IPV4_SRC, 32);
486 CP_NFCT(ip4_dst_addr, ATTR_ORIG_IPV4_DST, 32);
487
488 CP_NFCT(port_src, ATTR_ORIG_PORT_SRC, 16);
489 CP_NFCT(port_dst, ATTR_ORIG_PORT_DST, 16);
490
491 CP_NFCT(status, ATTR_STATUS, 32);
492
493 CP_NFCT(tcp_state, ATTR_TCP_STATE, 8);
494 CP_NFCT(tcp_flags, ATTR_TCP_FLAGS_ORIG, 8);
495 CP_NFCT(sctp_state, ATTR_SCTP_STATE, 8);
496 CP_NFCT(dccp_state, ATTR_DCCP_STATE, 8);
497
498 CP_NFCT(src_pkts, ATTR_ORIG_COUNTER_PACKETS, 64);
499 CP_NFCT(src_bytes, ATTR_ORIG_COUNTER_BYTES, 64);
500
501 CP_NFCT(dst_pkts, ATTR_REPL_COUNTER_PACKETS, 64);
502 CP_NFCT(dst_bytes, ATTR_REPL_COUNTER_BYTES, 64);
503
504 CP_NFCT(timestamp_start, ATTR_TIMESTAMP_START, 64);
505 CP_NFCT(timestamp_stop, ATTR_TIMESTAMP_STOP, 64);
506
507 CP_NFCT(flow_id, ATTR_ID, 32);
508 CP_NFCT(use, ATTR_USE, 32);
509
510 CP_NFCT_BUFF(ip6_src_addr, ATTR_ORIG_IPV6_SRC);
511 CP_NFCT_BUFF(ip6_dst_addr, ATTR_ORIG_IPV6_DST);
512
513 n->port_src = ntohs(n->port_src);
514 n->port_dst = ntohs(n->port_dst);
515
516 n->ip4_src_addr = ntohl(n->ip4_src_addr);
517 n->ip4_dst_addr = ntohl(n->ip4_dst_addr);
518 }
519
520 enum flow_entry_direction {
521 flow_entry_src,
522 flow_entry_dst,
523 };
524
525 static inline bool flow_entry_get_extended_is_dns(struct flow_entry *n)
526 {
527 /* We don't want to analyze / display DNS itself, since we
528 * use it to resolve reverse dns.
529 */
530 return n->port_src == 53 || n->port_dst == 53;
531 }
532
533 #define SELFLD(dir,src_member,dst_member) \
534 (((dir) == flow_entry_src) ? n->src_member : n->dst_member)
535
536 static void flow_entry_get_sain4_obj(struct flow_entry *n,
537 enum flow_entry_direction dir,
538 struct sockaddr_in *sa)
539 {
540 memset(sa, 0, sizeof(*sa));
541 sa->sin_family = PF_INET;
542 sa->sin_addr.s_addr = htonl(SELFLD(dir, ip4_src_addr, ip4_dst_addr));
543 }
544
545 static void flow_entry_get_sain6_obj(struct flow_entry *n,
546 enum flow_entry_direction dir,
547 struct sockaddr_in6 *sa)
548 {
549 memset(sa, 0, sizeof(*sa));
550 sa->sin6_family = PF_INET6;
551
552 memcpy(&sa->sin6_addr, SELFLD(dir, ip6_src_addr, ip6_dst_addr),
553 sizeof(sa->sin6_addr));
554 }
555
556 static void
557 flow_entry_geo_city_lookup_generic(struct flow_entry *n,
558 enum flow_entry_direction dir)
559 {
560 struct sockaddr_in sa4;
561 struct sockaddr_in6 sa6;
562 const char *city = NULL;
563
564 switch (n->l3_proto) {
565 default:
566 bug();
567
568 case AF_INET:
569 flow_entry_get_sain4_obj(n, dir, &sa4);
570 city = geoip4_city_name(&sa4);
571 break;
572
573 case AF_INET6:
574 flow_entry_get_sain6_obj(n, dir, &sa6);
575 city = geoip6_city_name(&sa6);
576 break;
577 }
578
579 build_bug_on(sizeof(n->city_src) != sizeof(n->city_dst));
580
581 if (city) {
582 memcpy(SELFLD(dir, city_src, city_dst), city,
583 min(sizeof(n->city_src), strlen(city)));
584 } else {
585 memset(SELFLD(dir, city_src, city_dst), 0,
586 sizeof(n->city_src));
587 }
588 }
589
590 static void
591 flow_entry_geo_country_lookup_generic(struct flow_entry *n,
592 enum flow_entry_direction dir)
593 {
594 struct sockaddr_in sa4;
595 struct sockaddr_in6 sa6;
596 const char *country = NULL;
597
598 switch (n->l3_proto) {
599 default:
600 bug();
601
602 case AF_INET:
603 flow_entry_get_sain4_obj(n, dir, &sa4);
604 country = geoip4_country_name(&sa4);
605 break;
606
607 case AF_INET6:
608 flow_entry_get_sain6_obj(n, dir, &sa6);
609 country = geoip6_country_name(&sa6);
610 break;
611 }
612
613 build_bug_on(sizeof(n->country_src) != sizeof(n->country_dst));
614
615 if (country) {
616 memcpy(SELFLD(dir, country_src, country_dst), country,
617 min(sizeof(n->country_src), strlen(country)));
618 } else {
619 memset(SELFLD(dir, country_src, country_dst), 0,
620 sizeof(n->country_src));
621 }
622 }
623
624 static void flow_entry_get_extended_geo(struct flow_entry *n,
625 enum flow_entry_direction dir)
626 {
627 flow_entry_geo_city_lookup_generic(n, dir);
628 flow_entry_geo_country_lookup_generic(n, dir);
629 }
630
631 static void flow_entry_get_extended_revdns(struct flow_entry *n,
632 enum flow_entry_direction dir)
633 {
634 size_t sa_len;
635 struct sockaddr_in sa4;
636 struct sockaddr_in6 sa6;
637 struct sockaddr *sa;
638 struct hostent *hent;
639
640 switch (n->l3_proto) {
641 default:
642 bug();
643
644 case AF_INET:
645 flow_entry_get_sain4_obj(n, dir, &sa4);
646 sa = (struct sockaddr *) &sa4;
647 sa_len = sizeof(sa4);
648 hent = gethostbyaddr(&sa4.sin_addr, sizeof(sa4.sin_addr), AF_INET);
649 break;
650
651 case AF_INET6:
652 flow_entry_get_sain6_obj(n, dir, &sa6);
653 sa = (struct sockaddr *) &sa6;
654 sa_len = sizeof(sa6);
655 hent = gethostbyaddr(&sa6.sin6_addr, sizeof(sa6.sin6_addr), AF_INET6);
656 break;
657 }
658
659 build_bug_on(sizeof(n->rev_dns_src) != sizeof(n->rev_dns_dst));
660 getnameinfo(sa, sa_len, SELFLD(dir, rev_dns_src, rev_dns_dst),
661 sizeof(n->rev_dns_src), NULL, 0, NI_NUMERICHOST);
662
663 if (hent) {
664 memset(n->rev_dns_dst, 0, sizeof(n->rev_dns_dst));
665 memcpy(SELFLD(dir, rev_dns_src, rev_dns_dst),
666 hent->h_name, min(sizeof(n->rev_dns_src),
667 strlen(hent->h_name)));
668 }
669 }
670
671 static void flow_entry_get_extended(struct flow_entry *n)
672 {
673 if (n->flow_id == 0 || flow_entry_get_extended_is_dns(n))
674 return;
675
676 if (show_src) {
677 flow_entry_get_extended_revdns(n, flow_entry_src);
678 flow_entry_get_extended_geo(n, flow_entry_src);
679 }
680
681 flow_entry_get_extended_revdns(n, flow_entry_dst);
682 flow_entry_get_extended_geo(n, flow_entry_dst);
683
684 /* Lookup application */
685 n->inode = get_port_inode(n->port_src, n->l4_proto,
686 n->l3_proto == AF_INET6);
687 if (n->inode > 0)
688 walk_processes(n);
689 }
690
691 static uint16_t presenter_get_port(uint16_t src, uint16_t dst, bool is_tcp)
692 {
693 if (src < dst && src < 1024) {
694 return src;
695 } else if (dst < src && dst < 1024) {
696 return dst;
697 } else {
698 const char *tmp1, *tmp2;
699 if (is_tcp) {
700 tmp1 = lookup_port_tcp(src);
701 tmp2 = lookup_port_tcp(dst);
702 } else {
703 tmp1 = lookup_port_udp(src);
704 tmp2 = lookup_port_udp(dst);
705 }
706 if (tmp1 && !tmp2) {
707 return src;
708 } else if (!tmp1 && tmp2) {
709 return dst;
710 } else {
711 if (src < dst)
712 return src;
713 else
714 return dst;
715 }
716 }
717 }
718
719 static char *bandw2str(double bytes, char *buf, size_t len)
720 {
721 if (bytes > 1000000000.)
722 snprintf(buf, len, "%.1fG", bytes / 1000000000.);
723 else if (bytes > 1000000.)
724 snprintf(buf, len, "%.1fM", bytes / 1000000.);
725 else if (bytes > 1000.)
726 snprintf(buf, len, "%.1fK", bytes / 1000.);
727 else
728 snprintf(buf, len, "%g", bytes);
729
730 return buf;
731 }
732
733 static void presenter_screen_do_line(WINDOW *screen, struct flow_entry *n,
734 unsigned int *line)
735 {
736 char tmp[128], *pname = NULL;
737 uint16_t port;
738
739 mvwprintw(screen, *line, 2, "");
740
741 /* PID, application name */
742 if (n->procnum > 0) {
743 slprintf(tmp, sizeof(tmp), "%s(%d)", basename(n->cmdline),
744 n->procnum);
745
746 printw("[");
747 attron(COLOR_PAIR(3));
748 printw("%s", tmp);
749 attroff(COLOR_PAIR(3));
750 printw("]:");
751 }
752
753 /* L3 protocol, L4 protocol, states */
754 printw("%s:%s", l3proto2str[n->l3_proto], l4proto2str[n->l4_proto]);
755 printw("[");
756 attron(COLOR_PAIR(3));
757 switch (n->l4_proto) {
758 case IPPROTO_TCP:
759 printw("%s", tcp_state2str[n->tcp_state]);
760 break;
761 case IPPROTO_SCTP:
762 printw("%s", sctp_state2str[n->sctp_state]);
763 break;
764 case IPPROTO_DCCP:
765 printw("%s", dccp_state2str[n->dccp_state]);
766 break;
767 case IPPROTO_UDP:
768 case IPPROTO_UDPLITE:
769 case IPPROTO_ICMP:
770 case IPPROTO_ICMPV6:
771 printw("NOSTATE");
772 break;
773 }
774 attroff(COLOR_PAIR(3));
775 printw("]");
776
777 /* Guess application port */
778 switch (n->l4_proto) {
779 case IPPROTO_TCP:
780 port = presenter_get_port(n->port_src, n->port_dst, true);
781 pname = lookup_port_tcp(port);
782 break;
783 case IPPROTO_UDP:
784 case IPPROTO_UDPLITE:
785 port = presenter_get_port(n->port_src, n->port_dst, false);
786 pname = lookup_port_udp(port);
787 break;
788 }
789 if (pname) {
790 attron(A_BOLD);
791 printw(":%s", pname);
792 attroff(A_BOLD);
793 }
794
795 /* Show source information: reverse DNS, port, country, city, counters */
796 if (show_src) {
797 attron(COLOR_PAIR(1));
798 mvwprintw(screen, ++(*line), 8, "src: %s", n->rev_dns_src);
799 attroff(COLOR_PAIR(1));
800
801 printw(":%"PRIu16, n->port_src);
802
803 if (n->country_src[0]) {
804 printw(" (");
805
806 attron(COLOR_PAIR(4));
807 printw("%s", n->country_src);
808 attroff(COLOR_PAIR(4));
809
810 if (n->city_src[0])
811 printw(", %s", n->city_src);
812
813 printw(")");
814 }
815
816 if (n->src_pkts > 0 && n->src_bytes > 0) {
817 char bytes_str[64];
818
819 printw(" -> (%"PRIu64" pkts, %s bytes)", n->src_pkts,
820 bandw2str(n->src_bytes, bytes_str,
821 sizeof(bytes_str) - 1));
822 }
823
824 printw(" => ");
825 }
826
827 /* Show dest information: reverse DNS, port, country, city, counters */
828 attron(COLOR_PAIR(2));
829 mvwprintw(screen, ++(*line), 8, "dst: %s", n->rev_dns_dst);
830 attroff(COLOR_PAIR(2));
831
832 printw(":%"PRIu16, n->port_dst);
833
834 if (n->country_dst[0]) {
835 printw(" (");
836
837 attron(COLOR_PAIR(4));
838 printw("%s", n->country_dst);
839 attroff(COLOR_PAIR(4));
840
841 if (n->city_dst[0])
842 printw(", %s", n->city_dst);
843
844 printw(")");
845 }
846
847 if (n->dst_pkts > 0 && n->dst_bytes > 0) {
848 char bytes_str[64];
849
850 printw(" -> (%"PRIu64" pkts, %s bytes)", n->dst_pkts,
851 bandw2str(n->dst_bytes, bytes_str,
852 sizeof(bytes_str) - 1));
853 }
854 }
855
856 static inline bool presenter_flow_wrong_state(struct flow_entry *n)
857 {
858 switch (n->l4_proto) {
859 case IPPROTO_TCP:
860 switch (n->tcp_state) {
861 case TCP_CONNTRACK_SYN_SENT:
862 case TCP_CONNTRACK_SYN_RECV:
863 case TCP_CONNTRACK_ESTABLISHED:
864 case TCP_CONNTRACK_FIN_WAIT:
865 case TCP_CONNTRACK_CLOSE_WAIT:
866 case TCP_CONNTRACK_LAST_ACK:
867 case TCP_CONNTRACK_TIME_WAIT:
868 case TCP_CONNTRACK_CLOSE:
869 case TCP_CONNTRACK_SYN_SENT2:
870 case TCP_CONNTRACK_NONE:
871 return false;
872 break;
873 }
874 break;
875 case IPPROTO_SCTP:
876 switch (n->sctp_state) {
877 case SCTP_CONNTRACK_NONE:
878 case SCTP_CONNTRACK_CLOSED:
879 case SCTP_CONNTRACK_COOKIE_WAIT:
880 case SCTP_CONNTRACK_COOKIE_ECHOED:
881 case SCTP_CONNTRACK_ESTABLISHED:
882 case SCTP_CONNTRACK_SHUTDOWN_SENT:
883 case SCTP_CONNTRACK_SHUTDOWN_RECD:
884 case SCTP_CONNTRACK_SHUTDOWN_ACK_SENT:
885 return false;
886 break;
887 }
888 break;
889 case IPPROTO_DCCP:
890 switch (n->dccp_state) {
891 case DCCP_CONNTRACK_NONE:
892 case DCCP_CONNTRACK_REQUEST:
893 case DCCP_CONNTRACK_RESPOND:
894 case DCCP_CONNTRACK_PARTOPEN:
895 case DCCP_CONNTRACK_OPEN:
896 case DCCP_CONNTRACK_CLOSEREQ:
897 case DCCP_CONNTRACK_CLOSING:
898 case DCCP_CONNTRACK_TIMEWAIT:
899 case DCCP_CONNTRACK_IGNORE:
900 case DCCP_CONNTRACK_INVALID:
901 return false;
902 break;
903 }
904 break;
905 case IPPROTO_UDP:
906 case IPPROTO_UDPLITE:
907 case IPPROTO_ICMP:
908 case IPPROTO_ICMPV6:
909 return false;
910 break;
911 }
912
913 return true;
914 }
915
916 static void presenter_screen_update(WINDOW *screen, struct flow_list *fl,
917 int skip_lines)
918 {
919 int maxy;
920 int skip_left = skip_lines;
921 unsigned int flows = 0;
922 unsigned int line = 3;
923 struct flow_entry *n;
924
925 curs_set(0);
926
927 maxy = getmaxy(screen);
928 maxy -= 6;
929
930 start_color();
931 init_pair(1, COLOR_RED, COLOR_BLACK);
932 init_pair(2, COLOR_BLUE, COLOR_BLACK);
933 init_pair(3, COLOR_YELLOW, COLOR_BLACK);
934 init_pair(4, COLOR_GREEN, COLOR_BLACK);
935
936 wclear(screen);
937 clear();
938
939 rcu_read_lock();
940
941 n = rcu_dereference(fl->head);
942 if (!n)
943 mvwprintw(screen, line, 2, "(No active sessions! "
944 "Is netfilter running?)");
945
946 for (; n; n = rcu_dereference(n->next)) {
947 n->is_visible = false;
948 if (presenter_get_port(n->port_src, n->port_dst, false) == 53)
949 continue;
950
951 if (presenter_flow_wrong_state(n))
952 continue;
953
954 /* count only flows which might be showed */
955 flows++;
956
957 if (maxy <= 0)
958 continue;
959
960 if (skip_left > 0) {
961 skip_left--;
962 continue;
963 }
964
965 n->is_visible = true;
966
967 presenter_screen_do_line(screen, n, &line);
968
969 line++;
970 maxy -= (2 + 1 * show_src);
971 }
972
973 mvwprintw(screen, 1, 2,
974 "Kernel netfilter flows(%u) for %s%s%s%s%s%s"
975 "[+%d]", flows, what & INCLUDE_TCP ? "TCP, " : "",
976 what & INCLUDE_UDP ? "UDP, " : "",
977 what & INCLUDE_SCTP ? "SCTP, " : "",
978 what & INCLUDE_DCCP ? "DCCP, " : "",
979 what & INCLUDE_ICMP && what & INCLUDE_IPV4 ? "ICMP, " : "",
980 what & INCLUDE_ICMP && what & INCLUDE_IPV6 ? "ICMP6, " : "",
981 skip_lines);
982
983 if (is_flow_collecting)
984 printw(" [Collecting flows ...]");
985
986 rcu_read_unlock();
987
988 wrefresh(screen);
989 refresh();
990 }
991
992 static void presenter(void)
993 {
994 int skip_lines = 0;
995 WINDOW *screen;
996
997 lookup_init_ports(PORTS_TCP);
998 lookup_init_ports(PORTS_UDP);
999 screen = screen_init(false);
1000
1001 rcu_register_thread();
1002 while (!sigint) {
1003 switch (getch()) {
1004 case 'q':
1005 sigint = 1;
1006 break;
1007 case KEY_UP:
1008 case 'u':
1009 case 'k':
1010 skip_lines--;
1011 if (skip_lines < 0)
1012 skip_lines = 0;
1013 break;
1014 case KEY_DOWN:
1015 case 'd':
1016 case 'j':
1017 skip_lines++;
1018 if (skip_lines > SCROLL_MAX)
1019 skip_lines = SCROLL_MAX;
1020 break;
1021 default:
1022 fflush(stdin);
1023 break;
1024 }
1025
1026 presenter_screen_update(screen, &flow_list, skip_lines);
1027 usleep(200000);
1028 }
1029 rcu_unregister_thread();
1030
1031 screen_end();
1032 lookup_cleanup_ports(PORTS_UDP);
1033 lookup_cleanup_ports(PORTS_TCP);
1034 }
1035
1036 static int flow_event_cb(enum nf_conntrack_msg_type type,
1037 struct nf_conntrack *ct, void *data __maybe_unused)
1038 {
1039 if (sigint)
1040 return NFCT_CB_STOP;
1041
1042 synchronize_rcu();
1043 spinlock_lock(&flow_list.lock);
1044
1045 switch (type) {
1046 case NFCT_T_NEW:
1047 flow_list_new_entry(&flow_list, ct);
1048 break;
1049 case NFCT_T_UPDATE:
1050 flow_list_update_entry(&flow_list, ct);
1051 break;
1052 case NFCT_T_DESTROY:
1053 flow_list_destroy_entry(&flow_list, ct);
1054 break;
1055 default:
1056 break;
1057 }
1058
1059 spinlock_unlock(&flow_list.lock);
1060
1061 return NFCT_CB_CONTINUE;
1062 }
1063
1064 static void restore_sysctl(void *value)
1065 {
1066 int int_val = *(int *)value;
1067
1068 if (int_val == 0)
1069 sysctl_set_int("net/netfilter/nf_conntrack_acct", int_val);
1070 }
1071
1072 static void on_panic_handler(void *arg)
1073 {
1074 restore_sysctl(arg);
1075 screen_end();
1076 }
1077
1078 static void conntrack_acct_enable(void)
1079 {
1080 /* We can still work w/o traffic accounting so just warn about error */
1081 if (sysctl_get_int("net/netfilter/nf_conntrack_acct", &nfct_acct_val)) {
1082 fprintf(stderr, "Can't read net/netfilter/nf_conntrack_acct: %s\n",
1083 strerror(errno));
1084 }
1085
1086 if (nfct_acct_val == 1)
1087 return;
1088
1089 if (sysctl_set_int("net/netfilter/nf_conntrack_acct", 1)) {
1090 fprintf(stderr, "Can't write net/netfilter/nf_conntrack_acct: %s\n",
1091 strerror(errno));
1092 }
1093 }
1094
1095 static int flow_update_cb(enum nf_conntrack_msg_type type,
1096 struct nf_conntrack *ct, void *data __maybe_unused)
1097 {
1098 struct flow_entry *n;
1099
1100 if (type != NFCT_T_UPDATE)
1101 return NFCT_CB_CONTINUE;
1102
1103 if (sigint)
1104 return NFCT_CB_STOP;
1105
1106 n = flow_list_find_id(&flow_list, nfct_get_attr_u32(ct, ATTR_ID));
1107 if (!n)
1108 return NFCT_CB_CONTINUE;
1109
1110 flow_entry_from_ct(n, ct);
1111
1112 return NFCT_CB_CONTINUE;
1113 }
1114
1115 static void collector_refresh_flows(struct nfct_handle *handle)
1116 {
1117 struct flow_entry *n;
1118
1119 n = rcu_dereference(flow_list.head);
1120 for (; n; n = rcu_dereference(n->next)) {
1121 if (!n->is_visible)
1122 continue;
1123
1124 nfct_query(handle, NFCT_Q_GET, n->ct);
1125 }
1126 }
1127
1128 static void collector_create_filter(struct nfct_handle *nfct)
1129 {
1130 struct nfct_filter *filter;
1131 int ret;
1132
1133 filter = nfct_filter_create();
1134 if (!filter)
1135 panic("Cannot create a nfct filter: %s\n", strerror(errno));
1136
1137 if (what & INCLUDE_UDP) {
1138 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDP);
1139 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDPLITE);
1140 }
1141 if (what & INCLUDE_TCP)
1142 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_TCP);
1143 if (what & INCLUDE_DCCP)
1144 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_DCCP);
1145 if (what & INCLUDE_SCTP)
1146 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_SCTP);
1147 if (what & INCLUDE_ICMP && what & INCLUDE_IPV4)
1148 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMP);
1149 if (what & INCLUDE_ICMP && what & INCLUDE_IPV6)
1150 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMPV6);
1151 if (what & INCLUDE_IPV4) {
1152 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV4, NFCT_FILTER_LOGIC_NEGATIVE);
1153 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV4, &filter_ipv4);
1154 }
1155 if (what & INCLUDE_IPV6) {
1156 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV6, NFCT_FILTER_LOGIC_NEGATIVE);
1157 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV6, &filter_ipv6);
1158 }
1159
1160 ret = nfct_filter_attach(nfct_fd(nfct), filter);
1161 if (ret < 0)
1162 panic("Cannot attach filter to handle: %s\n", strerror(errno));
1163
1164 nfct_filter_destroy(filter);
1165 }
1166
1167 /* This hand-crafted filter looks ugly but it allows to do not
1168 * flush nfct connections & filter them by user specified filter.
1169 * May be it is better to replace this one by nfct_cmp. */
1170 static int flow_dump_cb(enum nf_conntrack_msg_type type,
1171 struct nf_conntrack *ct, void *data __maybe_unused)
1172 {
1173 struct flow_entry fl;
1174 struct flow_entry *n = &fl;
1175
1176 if (sigint)
1177 return NFCT_CB_STOP;
1178
1179 synchronize_rcu();
1180 spinlock_lock(&flow_list.lock);
1181
1182 if (!(what & ~(INCLUDE_IPV4 | INCLUDE_IPV6)))
1183 goto check_addr;
1184
1185 CP_NFCT(l4_proto, ATTR_ORIG_L4PROTO, 8);
1186
1187 if (what & INCLUDE_UDP) {
1188 if (n->l4_proto == IPPROTO_UDP)
1189 goto check_addr;
1190
1191 if (n->l4_proto == IPPROTO_UDPLITE)
1192 goto check_addr;
1193
1194 }
1195 if ((what & INCLUDE_TCP) && n->l4_proto == IPPROTO_TCP)
1196 goto check_addr;
1197
1198 if ((what & INCLUDE_DCCP) && n->l4_proto == IPPROTO_DCCP)
1199 goto check_addr;
1200
1201 if ((what & INCLUDE_SCTP) && n->l4_proto == IPPROTO_SCTP)
1202 goto check_addr;
1203
1204 if ((what & INCLUDE_ICMP) && (what & INCLUDE_IPV4) &&
1205 n->l4_proto == IPPROTO_ICMP) {
1206 goto check_addr;
1207 }
1208
1209 if ((what & INCLUDE_ICMP) && (what & INCLUDE_IPV6) &&
1210 n->l4_proto == IPPROTO_ICMPV6) {
1211 goto check_addr;
1212 }
1213
1214 goto skip_flow;
1215
1216 check_addr:
1217 /* filter loopback addresses */
1218 if (what & INCLUDE_IPV4) {
1219 CP_NFCT(ip4_src_addr, ATTR_ORIG_IPV4_SRC, 32);
1220
1221 if (n->ip4_src_addr == filter_ipv4.addr)
1222 goto skip_flow;
1223 }
1224 if (what & INCLUDE_IPV6) {
1225 CP_NFCT_BUFF(ip6_src_addr, ATTR_ORIG_IPV6_SRC);
1226
1227 if (n->ip6_src_addr[0] == 0x0 &&
1228 n->ip6_src_addr[1] == 0x0 &&
1229 n->ip6_src_addr[2] == 0x0 &&
1230 n->ip6_src_addr[3] == 0x1)
1231 goto skip_flow;
1232 }
1233
1234 flow_list_new_entry(&flow_list, ct);
1235
1236 skip_flow:
1237 spinlock_unlock(&flow_list.lock);
1238 return NFCT_CB_CONTINUE;
1239 }
1240
1241 static void collector_dump_flows(void)
1242 {
1243 struct nfct_handle *nfct = nfct_open(CONNTRACK, 0);
1244
1245 if (!nfct)
1246 panic("Cannot create a nfct handle: %s\n", strerror(errno));
1247
1248 nfct_callback_register(nfct, NFCT_T_ALL, flow_dump_cb, NULL);
1249
1250 is_flow_collecting = true;
1251 if (what & INCLUDE_IPV4) {
1252 int family = AF_INET;
1253 nfct_query(nfct, NFCT_Q_DUMP, &family);
1254 }
1255 if (what & INCLUDE_IPV6) {
1256 int family = AF_INET6;
1257 nfct_query(nfct, NFCT_Q_DUMP, &family);
1258 }
1259 is_flow_collecting = false;
1260
1261 nfct_close(nfct);
1262 }
1263
1264 static void *collector(void *null __maybe_unused)
1265 {
1266 struct nfct_handle *ct_update;
1267 struct nfct_handle *ct_event;
1268 struct pollfd poll_fd[1];
1269
1270 flow_list_init(&flow_list);
1271
1272 ct_event = nfct_open(CONNTRACK, NF_NETLINK_CONNTRACK_NEW |
1273 NF_NETLINK_CONNTRACK_UPDATE |
1274 NF_NETLINK_CONNTRACK_DESTROY);
1275 if (!ct_event)
1276 panic("Cannot create a nfct handle: %s\n", strerror(errno));
1277
1278 collector_create_filter(ct_event);
1279
1280 nfct_callback_register(ct_event, NFCT_T_ALL, flow_event_cb, NULL);
1281
1282 ct_update = nfct_open(CONNTRACK, NF_NETLINK_CONNTRACK_UPDATE);
1283 if (!ct_update)
1284 panic("Cannot create a nfct handle: %s\n", strerror(errno));
1285
1286 nfct_callback_register(ct_update, NFCT_T_ALL, flow_update_cb, NULL);
1287
1288 poll_fd[0].fd = nfct_fd(ct_event);
1289 poll_fd[0].events = POLLIN;
1290
1291 if (fcntl(nfct_fd(ct_event), F_SETFL, O_NONBLOCK) == -1)
1292 panic("Cannot set non-blocking socket: fcntl(): %s\n",
1293 strerror(errno));
1294
1295 if (fcntl(nfct_fd(ct_update), F_SETFL, O_NONBLOCK) == -1)
1296 panic("Cannot set non-blocking socket: fcntl(): %s\n",
1297 strerror(errno));
1298
1299 rcu_register_thread();
1300
1301 collector_dump_flows();
1302
1303 while (!sigint) {
1304 int status;
1305
1306 usleep(300000);
1307
1308 collector_refresh_flows(ct_update);
1309
1310 status = poll(poll_fd, 1, 0);
1311 if (status < 0) {
1312 if (errno == EAGAIN || errno == EINTR)
1313 continue;
1314
1315 panic("Error while polling: %s\n", strerror(errno));
1316 } else if (status == 0) {
1317 continue;
1318 }
1319
1320 if (poll_fd[0].revents & POLLIN)
1321 nfct_catch(ct_event);
1322 }
1323
1324 rcu_unregister_thread();
1325
1326 flow_list_destroy(&flow_list);
1327 nfct_close(ct_event);
1328 nfct_close(ct_update);
1329
1330 pthread_exit(NULL);
1331 }
1332
1333 int main(int argc, char **argv)
1334 {
1335 pthread_t tid;
1336 int ret, c, opt_index, what_cmd = 0;
1337
1338 setfsuid(getuid());
1339 setfsgid(getgid());
1340
1341 while ((c = getopt_long(argc, argv, short_options, long_options,
1342 &opt_index)) != EOF) {
1343 switch (c) {
1344 case '4':
1345 what_cmd |= INCLUDE_IPV4;
1346 break;
1347 case '6':
1348 what_cmd |= INCLUDE_IPV6;
1349 break;
1350 case 'T':
1351 what_cmd |= INCLUDE_TCP;
1352 break;
1353 case 'U':
1354 what_cmd |= INCLUDE_UDP;
1355 break;
1356 case 'D':
1357 what_cmd |= INCLUDE_DCCP;
1358 break;
1359 case 'I':
1360 what_cmd |= INCLUDE_ICMP;
1361 break;
1362 case 'S':
1363 what_cmd |= INCLUDE_SCTP;
1364 break;
1365 case 's':
1366 show_src = 1;
1367 break;
1368 case 'u':
1369 update_geoip();
1370 die();
1371 break;
1372 case 'h':
1373 help();
1374 break;
1375 case 'v':
1376 version();
1377 break;
1378 default:
1379 break;
1380 }
1381 }
1382
1383 if (what_cmd > 0) {
1384 what = what_cmd;
1385
1386 if (!(what & (INCLUDE_IPV4 | INCLUDE_IPV6)))
1387 what |= INCLUDE_IPV4 | INCLUDE_IPV6;
1388 }
1389
1390 rcu_init();
1391
1392 register_signal(SIGINT, signal_handler);
1393 register_signal(SIGQUIT, signal_handler);
1394 register_signal(SIGTERM, signal_handler);
1395 register_signal(SIGHUP, signal_handler);
1396
1397 panic_handler_add(on_panic_handler, &nfct_acct_val);
1398
1399 conntrack_acct_enable();
1400
1401 init_geoip(1);
1402
1403 ret = pthread_create(&tid, NULL, collector, NULL);
1404 if (ret < 0)
1405 panic("Cannot create phthread!\n");
1406
1407 presenter();
1408
1409 destroy_geoip();
1410
1411 restore_sysctl(&nfct_acct_val);
1412
1413 return 0;
1414 }
netsniff-ng toolkit, the packet sniffing beast, staging tree