nids首先初始化:
int nids_init()
{
if (nids_params.filename) {
if ((desc = pcap_open_offline(nids_params.filename,
nids_errbuf)) == NULL)
return 0;
} else if (!open_live())
return 0;
if (nids_params.pcap_filter != NULL) {
u_int mask = 0;
struct bpf_program fcode;
if (pcap_compile(desc, &fcode, nids_params.pcap_filter, 1, mask) <
0) return 0;
if (pcap_setfilter(desc, &fcode) == -1)
return 0;
}
switch ((linktype = pcap_datalink(desc))) {
#ifdef DLT_IEEE802_11
#ifdef DLT_PRISM_HEADER
case DLT_PRISM_HEADER:
#endif
case DLT_IEEE802_11:
/* wireless, need to calculate offset per frame */
break;
#endif
#ifdef DLT_NULL
case DLT_NULL:
linkoffset = 4;
break;
#endif
case DLT_EN10MB:
linkoffset = 14;
break;
case DLT_PPP:
linkoffset = 4;
break;
/* Token Ring Support by vacuum@technotronic.com, thanks dugsong! */
case DLT_IEEE802:
linkoffset = 22;
break;
case DLT_RAW:
case DLT_SLIP:
linkoffset = 0;
break;
#define DLT_LINUX_SLL 113
case DLT_LINUX_SLL:
linkoffset = 16;
break;
#ifdef DLT_FDDI
case DLT_FDDI:
linkoffset = 21;
break;
#endif
#ifdef DLT_PPP_SERIAL
case DLT_PPP_SERIAL:
linkoffset = 4;
break;
#endif
default:
strcpy(nids_errbuf, "link type unknown");
return 0;
}
if (nids_params.dev_addon == -1) {
if (linktype == DLT_EN10MB)
nids_params.dev_addon = 16;
else
nids_params.dev_addon = 0;
}
if (nids_params.syslog == nids_syslog)
openlog("libnids", 0, LOG_LOCAL0);
init_procs();
tcp_init(nids_params.n_tcp_streams);
ip_frag_init(nids_params.n_hosts);
scan_init();
return 1;
}
static void init_procs()
{
ip_frag_procs = mknew(struct proc_node);
ip_frag_procs->item = gen_ip_frag_proc;
ip_frag_procs->next = 0;
ip_procs = mknew(struct proc_node);
ip_procs->item = gen_ip_proc;
ip_procs->next = 0;
tcp_procs = 0;
udp_procs = 0;
}
int tcp_init(int size)
{
int i;
if (!size) return 0;
tcp_stream_table_size = size;
tcp_stream_table = malloc(tcp_stream_table_size * sizeof(char *));
if (!tcp_stream_table)
nids_params.no_mem("tcp_init");
memset(tcp_stream_table, 0, tcp_stream_table_size * sizeof(char *));
max_stream = 3 * tcp_stream_table_size / 4;
streams_pool = (struct tcp_stream *) malloc((max_stream + 1) * sizeof(struct tcp_stream));
if (!streams_pool)
nids_params.no_mem("tcp_init");
for (i = 0; i < max_stream; i++)
streams_pool[i].next_free = &(streams_pool[i + 1]);
streams_pool[max_stream].next_free = 0;
free_streams = streams_pool;
init_hash();
return 0;
}