forked from visa/moloch
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathdecodeDrops.c
61 lines (51 loc) · 1.65 KB
/
decodeDrops.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
/* Use this tool to decode the /tmp/<node>.tcp.drops.[46] files */
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
int main(int argc, char *argv[])
{
FILE *fp = fopen(argv[1], "r");
if (!fp) {
printf("Couldn't open %s\n", argv[1]);
exit (0);
}
int ver, cnt, i;
char isIp4;
fread(&ver, 4, 1, fp);
printf ("Version: %d\n", ver);
if (ver == 1) {
fread(&cnt, 4, 1, fp);
printf ("Count: %d\n", cnt);
unsigned short port;
unsigned char key[16];
unsigned int expire;
unsigned short flags;
for (i = 0; i < cnt; i++) {
fread(&port, 2, 1, fp);
fread(key, 4, 1, fp);
fread(&expire, 4, 1, fp);
fread(&flags, 2, 1, fp);
time_t texpire = expire;
printf("%24.24s %d.%d.%d.%d:%d\n", ctime(&texpire), key[0], key[1], key[2], key[3], htons(port));
}
} else if (ver == 2) {
fread(&isIp4, 1, 1, fp);
fread(&cnt, 4, 1, fp);
printf ("isIp4: %d\n", isIp4);
printf ("Count: %d\n", cnt);
unsigned short port;
unsigned char key[16];
unsigned int last;
unsigned int goodFor;
unsigned short flags;
for (i = 0; i < cnt; i++) {
fread(&port, 2, 1, fp);
fread(key, (isIp4?4:16), 1, fp);
fread(&last, 4, 1, fp);
fread(&goodFor, 4, 1, fp);
fread(&flags, 2, 1, fp);
time_t texpire = last + goodFor;
printf("%24.24s %d.%d.%d.%d:%d\n", ctime(&texpire), key[0], key[1], key[2], key[3], htons(port));
}
}
}