Component index
Section index

Component tcpdump


Search

Type

Function

Summary

TCP packet sniffer with session management

Description

It uses the pcap library to listen in promiscuous mode on a network interface. It monitors TCP session and collect statistics on each. Using functags, it lets application do special processing on each session.

void endsession (int no, const TCPSESSION &session, ARRAY_OBJ *data, bool &end, bool clientending)
void missing (int no, const TCPSESSION &session, bool from, ARRAY_OBJ *data, bool &end, bool &discard, unsigned long expect, unsigned long got)
void newsession (int no, const TCPSESSION &session, ARRAY_OBJ *&data, bool &end, bool &discard, bool &reverse)
void pzcket (int no, const TCPSESSION &session, ARRAY_OBJ *data, bool &end, bool from, TCPDUMP_STATS &stats, const void *data, int len)

Examples

samples / tcpdump
samples / tcpdump / data statistics
samples / tcpdump / selecting session

Prototypes

void tcpdump (const char *dev, const char *filter)

Starts the sniffer on one or all network interface using an optional filter (same syntax as the tcpdump utility)

Functags

void endsession (int no, const TCPSESSION &session, ARRAY_OBJ *data, bool &end, bool clientending) Mandatory

Called when a TCP session ends

We ahve seen the last TCP packet (fin and ack sequence). We won't be called for this TCP session from now on.

void missing (int no, const TCPSESSION &session, bool from, ARRAY_OBJ *data, bool &end, bool &discard, unsigned long expect, unsigned long got) Optional

Called when an out of order packet is seen

Either the sniffer is too slow (missing packet) or something else is happening. the tcpdump component assume all packet are sent in proper order

void newsession (int no, const TCPSESSION &session, ARRAY_OBJ *&data, bool &end, bool &discard, bool &reverse) Mandatory

Do some processing when a new TCP session is seen

New mean "Not seen since we start the sniffer", so the TCP session may not be completly new.

void pzcket (int no, const TCPSESSION &session, ARRAY_OBJ *data, bool &end, bool from, TCPDUMP_STATS &stats, const void *data, int len) Mandatory

Some data was sent

THe functag is only called when some user data is available in a TCP packet. Other data less packet (ack) are not visible here.

Fhelpers

int getnbsession ()

Return the number of TCP session known to the sniffer