Question

this program can detect http flow and etc….
but it ignores XMPP flow ; i don’t know why ?
(I guess this is a port problem , but i don’t know where i should fix it )

Below are the relevant sections from main.cpp :

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <arpa/inet.h>
#include <string.h>
#include <stdio.h>
#include "nids.h"
#include <cstdlib>
#include <unistd.h>

#define int_ntoa(x) inet_ntoa(*((struct in_addr *)&x))

// struct tuple4 contains addresses and port numbers of the TCP connections
// the following auxiliary function produces a string looking like
// 10.0.0.1,1024,10.0.0.2,23
char *
adres (struct tuple4 addr)
{
  static char buf[256];
  strcpy (buf, int_ntoa (addr.saddr));
  sprintf (buf + strlen (buf), ",%i,", addr.source);
  strcat (buf, int_ntoa (addr.daddr));
  sprintf (buf + strlen (buf), ",%i", addr.dest);
  return buf;
}

void
tcp_callback (struct tcp_stream *a_tcp, void ** this_time_not_needed)
{

    printf("packet captured !\n");

}

int 
main ()
{
  // here we can alter libnids params, for instance:
  // nids_params.n_hosts=256;
        struct nids_chksum_ctl nochksumchk;
        nochksumchk.netaddr = 0;
    nochksumchk.mask = 0;
    nochksumchk.action = NIDS_DONT_CHKSUM;
    //char fileName[] = "/home/test.pcap";
        //nids_params.filename =fileName;     
    nids_register_chksum_ctl(&nochksumchk, 1);

        char myDevice [] = "eth0";
        nids_params.device =myDevice;

    if (!nids_init ())
  {
    fprintf(stderr,"%s\n",nids_errbuf);
    exit(1);
  }
  nids_register_tcp ( (void*)tcp_callback);
  nids_run ();
  return 0;
}

Answer 1

My pcap file has some problem about syncing in tcp connection .

So above snippet code of libnids is correct !