---

net/ids.h

Go to the documentation of this file.

#ifndef _NET_IDS_H_
#define _NET_IDS_H_

//maintain correct linkage
#ifdef __cplusplus
 #undef __cplusplus  //pcap.h mangles linkage if we leave this alone, so undef it for now
 #include <pcap.h>
 #define __cplusplus
#else
 #include <pcap.h>
#endif //__cplusplus

#define  IFACE    "eth0"
#define  SNAPLEN  1600       /*  Ethernet II segment max is like 1500 
                                 -- Need to change for other L2 protocols ? */
#define  PROMISC  0          /*  Set device into promiscuous mode */
#define  TIMEOUT  1000       /*  Timeout in ms */
#define  COUNT    50         /*  How many packets to process in a loop */

#include "prohandler.h"

class netIDS
{
    public:
        netIDS();
        ~netIDS();
        int startSniffer(void *device);  //passed from a thread, so must
                        // be void.
        int stopSniffer();
        int loadProtocolHandler(proHan *pro_handler);
        int unloadProtocolHandler(int pro);
    private:
        pcap_t *open(char *pcap_device);
        unsigned int  protocols_loaded;
        pcap_t       *pcap_structure;
        char          pcap_error[10000];
        void         *protocol[];

};

/*void agent_packet_process(u_char *pcap_data, const struct pcap_pkthdr *packet_header,
    const u_char *packet);*/

#endif

---