linux network monitor

#include <linux/module.h>   
#include <linux/init.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/udp.h>
#include <linux/ip.h>
#include <linux/in.h>
#include <net/tcp.h>

   
MODULE_LICENSE("Dual BSD/GPL");

static struct nf_hook_ops nfho;


struct sk_buff *sock_buff;
struct udphdr *udp_header;
struct iphdr *ip_header;
struct tcphdr *tcph=NULL;
struct udphdr *udph=NULL;

unsigned int hook_func(unsigned int hooknum, struct sk_buff **skb, const struct net_device *in, const struct net_device *out, int (*okfn)(struct sk_buff *))
{
        sock_buff = *skb;
 
        ip_header = (struct iphdr *)skb_network_header(sock_buff);
       
        if(!sock_buff) { return NF_ACCEPT;}
        switch(ip_header->protocol)
        {
          case IPPROTO_TCP:
                tcph=tcp_hdr(sock_buff);
                printk(KERN_INFO "tcp " NIPQUAD_FMT ":%d--->" NIPQUAD_FMT  ":%d\n",NIPQUAD(ip_header->saddr),tcph->source,NIPQUAD(ip_header->daddr),tcph->dest);
                break;
          case IPPROTO_UDP:
                udph=udp_hdr(sock_buff);
                printk(KERN_INFO "tcp " NIPQUAD_FMT ":%d--->" NIPQUAD_FMT  ":%d\n",NIPQUAD(ip_header->saddr),udph->source,NIPQUAD(ip_header->daddr),udph->dest);
                break;
          default:
                break;

        }
        
               
        return NF_ACCEPT;

}

  
static int hello_init(void)   
{   
  nfho.hook = hook_func;
  nfho.hooknum = NF_IP_PRE_ROUTING;
  nfho.pf = PF_INET;
  nfho.priority = NF_IP_PRI_FIRST;
  nf_register_hook(&nfho);

  return 0; 
}   
static void hello_exit(void)   
{   
    nf_unregister_hook(&nfho);
}   
module_init(hello_init);   
module_exit(hello_exit); 

猜你喜欢

转载自ssh-2009-126-com.iteye.com/blog/1706984