#include #include #include #include #include #include #include #include #include "logging.h" #if 0 static int is_same_mac(uint8_t *a, uint8_t *b) { return ((a[0] ^ b[0]) | (a[1] ^ b[1]) | (a[2] ^ b[2]) | (a[3] ^ b[3]) | (a[4] ^ b[4]) | (a[5] ^ b[5])) == 0x00; } static int is_null_mac(uint8_t *a) { return (a[0] | a[1] | a[2] | a[3] | a[4] | a[5]) == 0x00; } static int is_broadcast_mac(uint8_t *a) { return (a[0] & a[1] & a[2] & a[3] & a[4] & a[5]) == 0xFF; } #endif int parse_ulog_packet(void *data) { ebt_ulog_packet_msg_t *pkt = (ebt_ulog_packet_msg_t *)data; struct ether_header *eh = (struct ether_header *)pkt->data; struct ether_arp *ah = (struct ether_arp *)(eh +1); /* only ARP packets with ETHER <-> IPv4 */ if (eh->ether_type != 0x0608 || ah->ea_hdr.ar_hrd != 0x0100 || ah->ea_hdr.ar_pro != 0x0008) return 0; char time_str[40]; struct tm *ptm = localtime(&pkt->stamp.tv_sec); strftime(time_str, sizeof(time_str), "%Y-%m-%d %H:%M:%S", ptm); char *op = "unknown op "; if (ah->ea_hdr.ar_op == 0x0100) op = "ARP Request"; else if (ah->ea_hdr.ar_op == 0x0200) op = "ARP Reply "; char sip[16], dip[16]; inet_ntop(AF_INET, ah->arp_spa, sip, sizeof(sip)); inet_ntop(AF_INET, ah->arp_tpa, dip, sizeof(dip)); log_print(LOG_DEBUG, "%s: %s(%s): %02x:%02x:%02x:%02x:%02x:%02x => %02x:%02x:%02x:%02x:%02x:%02x %s %02x:%02x:%02x:%02x:%02x:%02x (%s) => %02x:%02x:%02x:%02x:%02x:%02x (%s)", time_str, pkt->indev, pkt->physindev, eh->ether_shost[0], eh->ether_shost[1], eh->ether_shost[2], eh->ether_shost[3], eh->ether_shost[4], eh->ether_shost[5], eh->ether_dhost[0], eh->ether_dhost[1], eh->ether_dhost[2], eh->ether_dhost[3], eh->ether_dhost[4], eh->ether_dhost[5], op, ah->arp_sha[0], ah->arp_sha[1], ah->arp_sha[2], ah->arp_sha[3], ah->arp_sha[4], ah->arp_sha[5], sip, ah->arp_tha[0], ah->arp_tha[1], ah->arp_tha[2], ah->arp_tha[3], ah->arp_tha[4], ah->arp_tha[5], dip); return 0; }