資源簡介
linux入侵檢測源代碼基于libnids的非常簡單的功能,實現(xiàn)了端口掃描,tcp,udp異常數(shù)據(jù)包的檢測要兩臺linux系統(tǒng)聯(lián)網(wǎng),用nmap掃描
代碼片段和文件信息
#include?“stdio.h“
#include?“string.h“
#include?“nids.h“
#include?
#include?
#include?
#include?
#include?
#include?
#include?
#include?
#include?
#include?
struct?scan
{
????????u_int?addr;
????????unsigned?short?port;
????????u_char?flags;
};
/*??????????????????????????????*/
struct?host
{
????????struct?host*?next;????????????????????????????????????????/*?????????????*/
????????struct?host*?prev;????????????????????????????????????????/*????????????*/
????????u_int?addr;????????????????????????????????????????????????????????/*???*/
????????int?modtime;????????????????????????????????????????????????/*???*/
????????int?n_packets;????????????????????????????????????????????????/*????*/
????????struct?scan*?packets;????????????????????????????????/*??????*/
};
/*??????IPЭ????????????*/
struct?ip_header
{
#if?defined?(WORDS_BIGENDIAN)
unsigned?char?ip_version:4
???????ip_header_length:4;
#else
unsigned?char?ip_header_length:4
ip_version:4;
#endif
unsigned?char?ip_tos;
unsigned?short?ip_length;
unsigned?short?ip_id;
unsigned?short?ip_off;
unsigned?char?ip_ttl;
unsigned?char?ip_protocol;
unsigned?short?ip_checksum;
struct?in_addr?ip_source_address;
struct?in_addr?ip_destination_address;
};
struct?tcp_header
{
????????unsigned?char?th_sport;????????????????????????????????/*?????*/
????????unsigned?char?th_dport;????????????????????????????????/*??????*/
????????unsigned?short?th_seq;????????????????????????????????/*???к?*/
????????unsigned?short?th_ack;????????????????????????????????/*????*/
#ifdef?WORDS_BIGENDIAN
????????unsigned?int?th_off?:?4????????????????????????/*???????*/
????????????????th_x2?:?4;????????????????????????????????????????????????/*????*/
#else
????????unsigned?int?th_x2?:?4????????????????????????????????/*????*/
????????????????th_off?:?4;????????????????????????????????????????????????/*???????*/
#endif
????????unsigned?int?th_flags;
????????unsigned?char?th_win;????????????????????????????????/*?????С*/
????????unsigned?char?th_sum;????????????????????????????????/*У????*/
????????unsigned?char?th_urp;????????????????????????????????/*???????*/
};
struct?udp_header
{
unsigned?short?udp_source_port;
unsigned?short?udp_destination_port;
unsigned?short?udp_length;
unsigned?short?udp_checksum;
};
char?ascii_string[10000];
void?sound_alarm()
{
????int?fd?=?open(“/dev/tty10“?O_RDONLY);
char?*ch1=“100“;
char?*ch2=“2000“;
?ioctl(fd?KDMKTONE?(atoi(ch1)<<16)+(1193180/atoi(ch2)));
}
char*?char_to_ascii(char?ch)
{
char*string;
ascii_string[0]=0;
string=ascii_string;
if(isgraph(ch))
{
*string++=ch;
}
else?if(ch==‘\n‘?||?ch==‘\r‘)
{
*string++=ch;
}
else
{
*string++=‘.‘;
}
*string=0;
return?ascii_string;
}
void?udp_protocol_packet_callback?(?u_char?*?packet_content)
{
struct?udp_header*?udp_protocol;
unsigned?short?source_port;
u_short?destination_port;
u_short?length;
udp_proto
評論
共有 條評論