main.c

#include <assert.h>
#include <pcap/pcap.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

typedef struct {
    uint8_t dst[6];
    uint8_t src[6];
    uint16_t ether_type;
} eth_hdr_t;

// DLT_LINUX_SLL2 header
// https://www.tcpdump.org/linktypes/LINKTYPE_LINUX_SLL2.html
// used when you capture 'any' device on some linuxes
typedef struct {
    uint16_t protocol_type;
    uint16_t reserved;
    int32_t interface_index;
    uint16_t arphrd_type;
    uint8_t packet_type;
    uint8_t link_layer_addrlen;
    uint8_t link_layer_addr[8];
} sll_hdr_t;

typedef struct {
    uint8_t v_and_hl;
    uint8_t tos;
    uint16_t tot_len;
    uint16_t id;
    uint16_t frag_off;
    uint8_t ttl;
    uint8_t protocol;
    uint16_t checksum;
    uint32_t saddr;
    uint32_t daddr;
    // options start
} ip4_hdr_t;

typedef struct {
    uint32_t flow; // 4 bits version, 8 bits tc, 20 bits flow id
    uint16_t payload_len;
    uint8_t next_header;
    uint8_t hop_limit;
    uint8_t src[16];
    uint8_t dst[16];
} ip6_hdr_t;

struct {
    char *filter;
    char *read_file;
    char *interface;
    bool generate_graphs;
} opts;

typedef struct ip_flow_s ip_flow_t;

struct ip_flow_s {
    char saddr[INET6_ADDRSTRLEN];
    char daddr[INET6_ADDRSTRLEN];

    ip_flow_t *hash_next;

    FILE *graph_file;

    struct timeval start_time;
    struct timeval last_time;

    uint64_t packets_this_second;
    uint64_t bytes_this_second;
};

#define HASH_SIZE 1024
ip_flow_t *flow_table[HASH_SIZE];

int dlt;

ip_flow_t *
lookup (char *saddr, char *daddr) {
    uint32_t hash = 0;

    for (char *p = saddr; *p != '\0'; p++) {
        hash = *p + (hash << 6) + (hash << 16) - hash;
    }

    for (char *p = daddr; *p != '\0'; p++) {
        hash = *p + (hash << 6) + (hash << 16) - hash;
    }

    hash &= (HASH_SIZE - 1);

    ip_flow_t **p = &flow_table[hash];

    while (*p != NULL) {
        if (strcmp(saddr, (*p)->saddr) == 0 && strcmp(daddr, (*p)->daddr) == 0) {
            return *p;
        }
        p = &(*p)->hash_next;
    }

    if (*p == NULL) {
        *p = calloc(1, sizeof(ip_flow_t));
        memcpy((*p)->saddr, saddr, INET6_ADDRSTRLEN);
        memcpy((*p)->daddr, daddr, INET6_ADDRSTRLEN);
    }
    return *p;
}

struct sockaddr_storage source;
struct sockaddr_storage dest;

char source_name[INET6_ADDRSTRLEN];
char dest_name[INET6_ADDRSTRLEN];

void
update_flow (ip_flow_t *f, const struct pcap_pkthdr *pcap) {

    if (f->start_time.tv_sec == 0) {
        f->start_time = pcap->ts;
        f->last_time = pcap->ts;
    }

    if (opts.generate_graphs) {
        if (f->graph_file == NULL) {
            char filename[120];
            snprintf(filename, 120, "%s:%s.dat", source_name, dest_name);
            f->graph_file = fopen(filename, "w+");
        }

        if (f->graph_file && f->last_time.tv_sec < pcap->ts.tv_sec) {
            int t_sec = pcap->ts.tv_sec - f->start_time.tv_sec;
            fprintf(f->graph_file, "%d %ld %ld\n", t_sec, f->packets_this_second, f->bytes_this_second);
        }
    }

    if (f->last_time.tv_sec < pcap->ts.tv_sec) {
        f->packets_this_second = 0;
        f->bytes_this_second = 0;
    }

    f->last_time = pcap->ts;
    f->packets_this_second++;
    f->bytes_this_second += pcap->len;
}

void
parse_ipv4 (const struct pcap_pkthdr *pcap, const u_char *payload, int len) {

    ip4_hdr_t *ip4 = (ip4_hdr_t *) payload;

    memset(&source, 0, sizeof(source));
    memset(&dest, 0, sizeof(dest));

    assert((ip4->v_and_hl >> 4) == 4);

    struct sockaddr_in *saddr = (struct sockaddr_in *) &source;
    struct sockaddr_in *daddr = (struct sockaddr_in *) &dest;

    memcpy(&saddr->sin_addr, &ip4->saddr, 4);
    memcpy(&daddr->sin_addr, &ip4->daddr, 4);

    inet_ntop(AF_INET, &saddr->sin_addr, source_name, sizeof(source_name));
    inet_ntop(AF_INET, &daddr->sin_addr, dest_name, sizeof(dest_name));

    ip_flow_t *f = lookup(source_name, dest_name);

    update_flow(f, pcap);

    return;
}

void
parse_ipv6 (const struct pcap_pkthdr *pcap, const u_char *payload, int len) {
    ip6_hdr_t *ip6 = (ip6_hdr_t *) payload;

    memset(&source, 0, sizeof(source));
    memset(&dest, 0, sizeof(dest));

    struct sockaddr_in6 *saddr = (struct sockaddr_in6 *) &source;
    struct sockaddr_in6 *daddr = (struct sockaddr_in6 *) &dest;

    memcpy(&saddr->sin6_addr, &ip6->src, 16);
    memcpy(&daddr->sin6_addr, &ip6->dst, 16);

    inet_ntop(AF_INET6, &saddr->sin6_addr, source_name, sizeof(source_name));
    inet_ntop(AF_INET6, &daddr->sin6_addr, dest_name, sizeof(dest_name));

    ip_flow_t *f = lookup(source_name, dest_name);

    update_flow(f, pcap);

    return;
}

void
on_packet (u_char *ctx, const struct pcap_pkthdr *pcap, const u_char *payload) {

    int proto;
    int llhdr_size;
    if (dlt == DLT_EN10MB) {

        eth_hdr_t *eth = (eth_hdr_t *) payload;

        proto = htons(eth->ether_type);

        llhdr_size = sizeof(eth_hdr_t);

    } else if (dlt == DLT_LINUX_SLL2) {
        sll_hdr_t *sll = (sll_hdr_t *) payload;

        int arphrd_type = ntohs(sll->arphrd_type);

        proto = ntohs(sll->protocol_type);
        llhdr_size = sizeof(sll_hdr_t);
        printf("proto=%d apphdr_type=%d\n", proto, arphrd_type);
    }

    if (proto == 0x800) {
        parse_ipv4(pcap, payload + llhdr_size, pcap->len - llhdr_size);
    } else if (proto == 0x86dd) {
        parse_ipv6(pcap, payload + llhdr_size, pcap->len - llhdr_size);
    } else {
        return;
    }

    return;
}

int
main (int argc, char **argv) {

    int current_option = 0; // option being parsed

    // opts.filter = "udp"; // default - at least filter out non-udp traffic

    for (int i = 1; i < argc; i++) {

        char *arg = argv[i];
        printf("arg %d %s\n", i, argv[i]);

        switch (current_option) {
        case 0:
            break;
        case 'i':
            opts.interface = arg;
            current_option = 0;
            continue;
        case 'r':
            opts.read_file = arg;
            current_option = 0;
            continue;
        case 'f':
            opts.filter = arg;
            current_option = 0;
            continue;
        default:
            fprintf(stderr, "error: unknown option -%c\n", current_option);
            return 1;
        }
        if (arg[0] == '-') {
            if (arg[1] == 'i') {
                current_option = 'i';
                continue;
            }
            if (arg[1] == 'r') {
                current_option = 'r';
                continue;
            }
            if (arg[1] == 'f') {
                current_option = 'f';
                continue;
            }
            if (arg[1] == 'g') {
                opts.generate_graphs = true;
                continue;
            }
        }
        fprintf(stderr, "unknown option '%s'\n", arg);
        return 1;
    }

    int rc;

    char errbuf[PCAP_ERRBUF_SIZE];
    rc = pcap_init(PCAP_CHAR_ENC_UTF_8, errbuf);
    if (rc != 0) {
        fprintf(stderr, "pcap_init: %s\n", errbuf);
        return 1;
    }
    pcap_t *handle = NULL;

    if (opts.read_file) {
        handle = pcap_open_offline(opts.read_file, errbuf);
        if (handle == NULL) {
            fprintf(stderr, "pcap_open_offline: %s\n", errbuf);
            return 1;
        }
    } else if (opts.interface) {
        // handle = pcap_create(opts.interface, errbuf);
        handle = pcap_open_live(opts.interface, BUFSIZ, 1, 1000, errbuf);
        if (handle == NULL) {
            fprintf(stderr, "pcap_open_offline: %s\n", errbuf);
            return 1;
        }
    } else {
        pcap_if_t *alldevs = NULL;
        rc = pcap_findalldevs(&alldevs, errbuf);

        if (rc != 0 || alldevs == NULL /* no error but no devices */) {
            fprintf(stderr, "couldn't find default device. err=%s\n", errbuf);
            return 1;
        }

        pcap_if_t *dev = alldevs;

        handle = pcap_open_live(dev->name, BUFSIZ, 1, 1000, errbuf);

        if (handle == NULL) {
            fprintf(stderr, "couldn't open device %s: %s\n", dev->name, errbuf);
            pcap_freealldevs(alldevs);
            return 1;
        }
        pcap_freealldevs(alldevs);
    }

    dlt = pcap_datalink(handle);

    if (dlt != DLT_EN10MB && dlt != DLT_LINUX_SLL2) {
        fprintf(stderr, "selected device doesn't provide ethernet headers, datalink type=%d", pcap_datalink(handle));
        return 1;
    }

    if (opts.filter) {
        struct bpf_program fp;
        rc = pcap_compile(handle, &fp, opts.filter, 0, PCAP_NETMASK_UNKNOWN);
        if (rc != 0) {
            fprintf(stderr, "couldn't compile filter %s: %s\n", opts.filter, pcap_geterr(handle));
            return 1;
        }
        rc = pcap_setfilter(handle, &fp);

        if (rc != 0) {
            fprintf(stderr, "couldn't install filter %s: %s\n", opts.filter, pcap_geterr(handle));
            return 1;
        }
    }

    rc = pcap_loop(handle, -1, on_packet, NULL);
    if (rc != 0) {
        fprintf(stderr, "pcap loop\n");
        return 1;
    }

    fflush(NULL); // flush all streams

    for (int i = 0; i < HASH_SIZE; i++) {
        ip_flow_t *s = flow_table[i];
        while (s != NULL) {
            if (s->graph_file) fclose(s->graph_file);
            s = s->hash_next;
        }
    }
}