dns-flood-detector/dns_flood_detector.h

71 lines
2.3 KiB
C
Raw Normal View History

2006-11-04 19:54:02 +00:00
/******************************************************************************
Program: dns_flood_detector.h
Author: Dennis Opacki <dopacki@adotout.com>
Date: Tue Mar 18 16:46:53 EST 2003
Purpose: Monitor DNS servers for abusive usage levels
and alarm to syslog
Copyright (C) 2003 Dennis Opacki
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*******************************************************************************/
// definitions
#ifndef ETHER_HDRLEN
#define ETHER_HDRLEN 14
#endif
#define NS_MAXDNAME 1025
2006-11-23 13:44:59 +00:00
#define MAXSYSLOG 192
2006-11-04 19:54:02 +00:00
// evil Solaris hack
#ifdef __sun__
typedef uint8_t u_int8_t;
typedef uint16_t u_int16_t;
typedef uint32_t u_int32_t;
#endif
// prototypes
void handle_IP(u_char *args,const struct pcap_pkthdr* pkthdr,const u_char* packet);
2006-11-23 13:44:59 +00:00
int calculate_averages();
int scour_bucket(int i);
int find_bucket(struct in_addr *ip_src);
int daemonize(void);
int malloc_fail(char * var, int size);
2006-11-04 19:54:02 +00:00
// data structures
struct my_dns {
u_int16_t dns_id; /* query identification number */
u_int8_t dns_flags1; /* first byte of flags */
u_int8_t dns_flags2; /* second byte of flags */
u_int16_t dns_qdcount; /* number of question entries */
u_int16_t dns_ancount; /* number of answer entries */
u_int16_t dns_nscount; /* number of authority entries */
u_int16_t dns_arcount; /* number of resource entries */
};
struct bucket {
2006-11-23 13:44:59 +00:00
struct in_addr ip_addr;
2006-11-04 19:54:02 +00:00
unsigned int tcp_count;
unsigned int udp_count;
unsigned int qps;
int qstats[256];
time_t first_packet;
time_t last_packet;
time_t alarm_set;
};