Initial commit from project. lib dependencies need checking

[packeteer.git] / packeteer.c

/*
 * Packeteer 
 * Copyright August 2007 TJ <linux@tjworld.net>
 *
 * Checks that network packets seen by pcap are seen at the netfilters
 * level and haven't been silently discarded by the kernel.
 * 
 * Depends on libcap and netfilters.
 * 
 * To work correctly the rule set for pcap (using -p) must match the
 * iptables rule set for netfilters. If the rules don't match then
 * the pcap and netfilters monitors will receive different packets and
 * lots of false positives reporting LOST packets will be generated
 * 
 * 
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program in the file LICENSE-GPLv3.txt;
 * if not, you can view it online at http://www.gnu.org/copyleft/gpl.html
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>
#include <string.h>
#include <signal.h>
#include <time.h>
#include <netinet/in.h>
#include <netinet/ether.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <arpa/inet.h>
#include <netinet/if_ether.h>
#include <pthread.h>
#include "packeteer.h"
#include "pcap.h"
#include "netfilters.h"

// program version
#define VER "0.99"
// size of string buffer used to receive pcap rule text
#define FILTER_BUF 1024
// default maximum number of packets in the tracker at any one time
#define TRACKER_DEFAULT_MAX_PACKETS 256

extern unsigned long pcap_count; // packet counters
extern unsigned long netfilters_count;
extern int pcap_control; // thread control flags
extern int netfilters_control;
extern unsigned long netfilters_lag; // simulate lag in circuit

// indexes of strings can act as bit-shift values. e.g. tcp_flags_strings[4], 1 << 4 = 0x10 == ACK
char *tcp_flags_strings[] = {"FIN", "SYN", "RST", "PUSH", "ACK", "URG", "ECN" ,"CWNR" };

// value of 'ret' is index into this array
unsigned char *error_messages[] = {
                "Success",
                "Unused",
                "allocate memory for trackers",
                "initialise pcap",
                "initialise netfilters_queue",
                "start pcap",
                "start netfilters_queue"
};

unsigned int tracker_max_packets = TRACKER_DEFAULT_MAX_PACKETS; // number of entries in the tracker table; default 256
unsigned long pcap_count_max = 1000; // default; maximum number of packets to monitor before quitting
struct in_addr_filter *ip_addr_filters = NULL; // linked-list of ip addresses for filter matching
unsigned char tcp_flags_filter = 0; // TCP flags for filter matching
unsigned char tracker_tcp_flags_filter = 0; // TCP flags to be tracked
unsigned int discarded_packet_count = 0; // count how many packets appear to have been silently discarded 
unsigned int simulation = 0; // flag controlling whether to simulate packet-loss
unsigned int verbose = 0; // flag controlling verbose debugging messages
unsigned int headers_done = 0; // flag controlling printing of column headers for packet-reporting
unsigned int tracker_allow = 1; // flag permitting new packets to be added to the tracker table 
int interrupted = 0; // flag controlling main loop. SIGINT (Ctrl-C) sets it
char time_string[10]; // the log-file timestamp

// protect tracker data structures from multi-thread corruption
pthread_mutex_t tracker_mutex = PTHREAD_MUTEX_INITIALIZER;

// calculate header sizes once and use in all modules
int size_ethernet = sizeof(struct ether_header); 
int size_ip = sizeof(struct iphdr);
int size_tcp = sizeof(struct tcphdr);
int size_headers;  // used to calculate memory allocation for tracker

// array of packet trackers
struct packet_track *tracker_packets; 


/* useful function not in the standard C string library */
char *strupr(char *str) {
 char *pos;
 if (str != NULL) {
  for(pos=str; *pos != 0; pos++) {
   if(*pos >= 'a' && *pos <= 'z') {
    *pos = *pos & 0xDF; // mask the upper/lower case bit (uppercase | 0x20 = lowercase)
   }
  }
 }
 return str;
}


/* get the time for prefixing to loggging 
   @timestamp if NULL, current time is used
 * */
char *print_time(time_t *timestamp) {
 struct tm now;
 time_t t;
 if (timestamp == NULL) // use the current time 
  time(&t);
 else // use the timestamp
  memcpy(&t, timestamp, sizeof(t));
 
 localtime_r(timestamp == NULL ? &t : timestamp, &now);
 sprintf(time_string, "%2.2d:%2.2d:%2.2d ",now.tm_hour, now.tm_min, now.tm_sec);
 
 return time_string;
}


/* prints the column headers for the packet reporting */
void headers_print(void) {
 if (!headers_done) {
  fprintf(stderr, "       Time               #    IP           checksums SYN ACK Seq        Ack        skb->len\n");
  headers_done = 1; // don't print again
 }
}


/* calculate IP header checksum 
   Uses the standard summing-checksum algorithm defined for IP and TCP 
 * */
static unsigned short ip_checksum(struct iphdr *iph) {
 u_int16_t tmp;
 unsigned int size;
 u_int16_t *end, *position = (u_int16_t *) iph;
 unsigned long checksum = 0;
 
 tmp = iph->check; // back-up of the header checksum
 iph->check = 0; // temporarily zero the checksum whilst calculating
 size = iph->ihl * 4 / 2; // number of 16-bit words in IP header
 end = position + size;
 for (position = (u_int16_t *) iph; position < end; position++)
  checksum += ntohs(*position);

 iph->check = tmp; // return original value
 checksum = (checksum >> 16) + (checksum & 0xFFFF);
 checksum += (checksum >> 16);

 return((unsigned short)~checksum);
}


/* calculate the actual sizes and locations of the Ether, IP and TCP headers in a packet */
void headers_calc(unsigned char *packet) {
 
 // calculate the headers based on the length values stored in them (rather than using those defined in the static header files)
 headers.ether = (struct ether_header *)packet;
 headers.ether_len = size_ethernet; // fixed-size 
 headers.ip = (struct iphdr *)((unsigned char *)headers.ether + headers.ether_len);
 headers.ip_len = headers.ip->ihl * 4;
 headers.tcp = (struct tcphdr *)((unsigned char *)headers.ip + headers.ip_len);
 headers.tcp_len = headers.tcp->doff * 4; 
 headers.payload = ((unsigned char *)headers.tcp + (headers.tcp_len * 4));
 headers.pkt_len = ntohs(headers.ip->tot_len) + headers.ether_len;
 headers.payload_len = headers.pkt_len - headers.tcp_len - headers.ip_len - headers.ether_len;
 headers.headers_len =  headers.tcp_len + headers.ip_len + headers.ether_len;
 
 //fprintf(stdout, "Addr: Ether=0x%lX IP=0x%lX TCP=0x%lX Payload=0x%lX\n", headers.ether, headers.ip, headers.tcp, headers.payload);    
 //fprintf(stdout, "Size: Ether=%10d  IP=%10d  TCP=%10d  Packet =%10d\n", headers.ether_len, headers.ip_len, headers.tcp_len, headers.pkt_len); 
}


/* allocate tracker memory and set all packets unallocated */
int tracker_init(void) {
 int i, ret = -1; // default result; failed 
 size_headers = size_ethernet + size_ip + size_tcp;

 tracker_packets = (struct packet_track *)malloc(tracker_max_packets * sizeof(struct packet_track) );
 if (tracker_packets != NULL) {
  for(i=0; i < tracker_max_packets; i++) {
   tracker_packets[i].packet = NULL;
   tracker_packets[i].checksum = 0;
   tracker_packets[i].allocated = 0;
   tracker_packets[i].pcap = 0;
   tracker_packets[i].netf = 0;
  }
  ret = i;
  
  if (tcp_flags_filter == 0) // no user-defined TCP flags to match
   tcp_flags_filter = 0xFF; // so set to match all TCP flags  

  if (tracker_tcp_flags_filter == 0) // no user-defined TCP flags to track
   tracker_tcp_flags_filter = 0xFF; // so set to track all TCP flags  
 }
 if (verbose) fprintf(stderr, "tracker_init(): resulted in %d trackers\n", ret);
 return ret; // number of trackers initialised, or -1 for failure
}


/* Get index of existing packet, or -1 if it doesn't exist */
static int tracker_findby_checksum(u_int32_t checksum) {
 int i, ret = -1; // default; packet isn't in tracker
 
 for(i=0; i < tracker_max_packets; i++) {
  if (tracker_packets[i].allocated) { // valid packet
   if (tracker_packets[i].checksum == checksum ) {
    ret = i; // report matching entry
    if (verbose) fprintf(stderr, "tracker_findby_checksum() = %d\n", i);
    break; // leave the loop now
   }
  }
 }
 return ret;
}


/* Get index of existing packet, matching source and destination, or -1 if it doesn't exist */
tracker_findby_address(u_int32_t ip_src, u_int32_t ip_dst, u_int16_t port_src, u_int16_t port_dst) {
 int i, ret = -1; // default; packet isn't in tracker
 
 for(i=0; i < tracker_max_packets; i++) {
  if (tracker_packets[i].allocated) { // valid packet
   if (tracker_packets[i].packet != NULL ) {
    if (ip_src == tracker_packets[i].ip->saddr && ip_dst == tracker_packets[i].ip->daddr) {
     if (port_src == tracker_packets[i].tcp->source && port_dst == tracker_packets[i].tcp->dest) {
      ret = i; // report matching entry
      if (verbose) fprintf(stderr, "tracker_findby_address() = %d\n", i);
      break; // leave the loop now
     }
    }
   }
  }
 }
 return ret;
}


/* allocate a tracker slot prior to allocating memory */
static int tracker_allocate(void) {
 int i, ret = -1; // default; failed
 
 for(i=0; i < tracker_max_packets; i++) {
  if (!tracker_packets[i].allocated) { // empty slot
   tracker_packets[i].allocated = 1;
   // in simulation mode, randomly choose packets to be retained in tracker, thus appearing to be LOST
   if (simulation) { 
    tracker_packets[i].simulation = rand() > RAND_MAX/2 ? 1 : 0; // 50% chance of 'losing' a packet
   }
   
   ret = i;
   break;
  }
 }
 return ret;
}


/* Add packet data to the tracker */
static int tracker_packet_add(unsigned char *raw, u_int32_t skb_len) {
 int ret = -1; // default; failed
 int tracker;
 unsigned char *tmp, *packet;
 const struct iphdr *ip; /* The IP header */
 const struct tcphdr *tcp; /* The TCP header */

 if (raw != NULL) {
  tracker = tracker_allocate(); // reserve a slot
  if (tracker != -1) {
   headers_calc(raw); // how much memory do we need to allocate?
   packet = malloc(headers.headers_len); // allocate memory to copy headers into
   if (packet != NULL) { // ok, got the memory needed
    tmp = memcpy(packet, raw, headers.headers_len); // copy packet into tracker memory
    tracker_packets[tracker].packet = packet;
    tracker_packets[tracker].ether = (struct ether_header *)packet;
    tracker_packets[tracker].ip = (struct iphdr*)(packet + headers.ether_len);
    tracker_packets[tracker].tcp = (struct tcphdr*)(packet + headers.ether_len + headers.ip_len);
    tracker_packets[tracker].checksum = (ntohs(tracker_packets[tracker].ip->check) << 16) 
                                        | ntohs(tracker_packets[tracker].tcp->check); // combine the checksums
    tracker_packets[tracker].skb_len = skb_len; // skb->len from net/ipv4/ip_input.c::rcv() via libpcap pkthdr->len
    tracker_packets[tracker].pcap = 1;
    time(&tracker_packets[tracker].timestamp); // record the time the packet was tracked 
    ret = tracker; // success
    if (verbose) fprintf(stderr, "packet_add: %d %8.8x\n", tracker, tracker_packets[tracker].checksum);
   }
  }
 }
 return ret;
}


/* allocate a tracker and set the checksum, but don't copy any packet data */
static int tracker_checksum_add(checksum) {
 int ret = -1; // default status; failed
 int tracker;
 
 if (checksum != 0) {
  tracker = tracker_allocate(); // reserve a slot
  if (tracker != -1) {
   tracker_packets[tracker].checksum = checksum; // set the checksum, so when pcap adds the complete packet it'll use this slot
   tracker_packets[tracker].netf = 1;
   ret = tracker;
   if (verbose) fprintf(stderr, "checksum_add: %d %8.8x\n", tracker, tracker_packets[tracker].checksum);
   
  }
 }
 return ret;
}


/* remove packet from tracker */
static int tracker_packet_remove(int tracker) {
 int ret = -1;
 if (tracker >= 0 && tracker < tracker_max_packets) { // within bounds
  if (tracker_packets[tracker].allocated) { // make sure it is in use
   if (!tracker_packets[tracker].simulation) { // don't remove if it is flagged to be 'LOST'  
    if (verbose) fprintf(stderr, "tracker_remove: %d %8.8x\n", tracker, tracker_packets[tracker].checksum);
    if(tracker_packets[tracker].packet != NULL) {         
     free(tracker_packets[tracker].packet); // release memory
     tracker_packets[tracker].packet = NULL; // mark as definitely empty
    }
    tracker_packets[tracker].checksum = 0;
    tracker_packets[tracker].pcap = 0;
    tracker_packets[tracker].netf = 0;
    tracker_packets[tracker].allocated = 0;
    ret = tracker; // success; report slot ID of removed packet
   }
  }
 }
 return ret;
}


/* release memory used by trackers */
static int tracker_free(void) {
 int i, count = 0;
 
 for(i=0; i < tracker_max_packets; i++) {
  if (tracker_packets[i].allocated) { // in use
   if (tracker_packets[i].packet != NULL) { // memory allocated
        tracker_packet_remove(i); // release
        count++;
   }
  }
 }

 return count;
}


/* print the hex values of a series of bytes 
   @start the address of the first byte
   @end the address of the last byte+1 (optional, can be NULL) in which case...
   @qty the number of bytes to display (ignored if @end is not NULL)
 */
int print_bytes_as_hex(unsigned char *start, unsigned char *end, unsigned int qty) {
 unsigned char *pos, *stop;
 unsigned int count = 0;

 if (verbose) fprintf(stderr, "start=0x%lX end=0x%lX %s qty=%d\n", start, end, (end==NULL ? "(NULL)" : ""), qty);
 
 stop = end != NULL ? end : start + qty;
 for (pos = start; pos < stop; pos++, count++) {
  fprintf(stdout, " %2.2X", *pos);
  fflush(stdout);
  if (count >= 1024) break; // something might have gone wrong - limit the damage!
 }
 
 return count;
}


/* Test the packet using the same discard-checks net/ipv4/ip_input.c::rcv() performs */
static int test_lost_packet(int tracker) {
 int ret = 0; // default is a pass
 u_int16_t recalc_checksum;
 unsigned int ip_len_struct;
 
 if (tracker >= 0 && tracker < tracker_max_packets) {

  // fill global headers structure will info about this packet
  headers_calc(tracker_packets[tracker].packet);

  // compare IP header version and minimum length 
  if (tracker_packets[tracker].ip->ihl < 5 || tracker_packets[tracker].ip->version != 4) {
   fprintf(stdout, "ip.ihl < 5 || ip.version != 4\n");
   ret = -1;
  }
  
  // compare IP header checksum with a freshly calculated one
  recalc_checksum = ip_checksum(tracker_packets[tracker].ip);
  fprintf(stdout, "Kernel IP checksum calc:   %4.4X", recalc_checksum);
  if (recalc_checksum != ntohs(tracker_packets[tracker].ip->check)) {
   fprintf(stdout, " *** BAD CHECKSUM *** ");
   ret = -1;
  }
  
  // compare IP header length to IP header structure size
  fprintf(stdout, ", IP header length = %d", headers.ip_len);
  if (headers.ip_len != size_ip) {
   fprintf(stdout, " *** DIFFERENT *** ");
   ret = -1;
  }
  
  // compare IP packet 'total length' + ethernet header to size of packet buffer
  fprintf(stdout, ", IP total length = %d", headers.pkt_len);
  if (headers.pkt_len != tracker_packets[tracker].skb_len) {
   fprintf(stdout, " *** PACKET LENGTH DIFFERENCE *** ");
   ret = -1;
  }

  fprintf(stdout, "\n");

  fprintf(stdout, "Ethernet:");
  fprintf(stdout, " = %d bytes\n", print_bytes_as_hex((unsigned char *)headers.ether, NULL, headers.ether_len));
  fprintf(stdout, "IP      :");
  fprintf(stdout, " = %d bytes\n", print_bytes_as_hex((unsigned char *)headers.ip, NULL, headers.ip_len));
  fprintf(stdout, "TCP     :");
  fprintf(stdout, " = %d bytes\n", print_bytes_as_hex((unsigned char *)headers.tcp, NULL, headers.tcp_len));
 }
}


/* log packets that didn't make it through to netfilters */
static int report_lost_packet(int tracker) {
 int ret = tracker;
 struct in_addr s;

 s.s_addr = tracker_packets[tracker].ip->saddr;
 fprintf(stdout, "LOST: %10s %4d %15s %4.4X %4.4X  %1d   %1d  %10u %10u %6d\n",
             print_time(&tracker_packets[tracker].timestamp), tracker, inet_ntoa(s), 
             ntohs(tracker_packets[tracker].ip->check), ntohs(tracker_packets[tracker].tcp->check),
             tracker_packets[tracker].tcp->syn, tracker_packets[tracker].tcp->ack,
             tracker_packets[tracker].tcp->seq, tracker_packets[tracker].tcp->ack_seq,
             tracker_packets[tracker].skb_len);
 fflush(stdout);
 
 return ret;
}


/* Check if any packets in the tracker are orphaned 
   @report flag controlling printing report; 0 = no report, 1 = report 
   @return qty of LOST packets
 * */
static int detect_lost_packets(unsigned int report) {
 int ret=0;
 int i, header_done=0;
 
 if (verbose) fprintf(stderr, "Detecting lost packets\n");
 pthread_mutex_lock(&tracker_mutex);
 if (verbose) fprintf(stderr, "Scanning\n");
 
 discarded_packet_count = 0; // reset counter

 for(i=0; i < tracker_max_packets; i++) {
  if (tracker_packets[i].allocated) { // in use
   if (tracker_packets[i].packet != NULL) { // pcap has been here
    if (!tracker_packets[i].netf) { // netfilters hasn't reported this packet
     discarded_packet_count++;  
     if (report) {
      if (header_done) fprintf(stdout, "\n"); // prefix each report with a linefeed for clarity
      else header_done++; // except for the first report, because the columns headers should be right above the first line of data

      fprintf(stdout, "       Time         #    IP           checksums SYN ACK Seq        Ack        skb->len\n");
      report_lost_packet(i);
      test_lost_packet(i);
     }
    }
   }
  }
 }
 if (verbose) fprintf(stderr, "Scanning complete\n");

 pthread_mutex_unlock(&tracker_mutex);
 
 return discarded_packet_count;
}


/* pcap reporting a new packet 
   @return slot number in tracker of packet
 */
int packet_pcap(int count, const struct ether_header *ethernet, const struct iphdr *ip, const struct tcphdr *tcp, u_int32_t skb_len) {
 u_int32_t checksum = (ntohs(ip->check)  << 16) | ntohs(tcp->check); // combine the checksums
 unsigned char tracker_tcp_flags_match = 0;

 if (verbose) fprintf(stderr, "packet_pcap(): checksum %8.8x ip %x tcp %x\n", checksum, ntohs(ip->check), ntohs(tcp->check));
 pthread_mutex_lock(&tracker_mutex);
 
 int tracker = tracker_findby_checksum(checksum); // is it in the tracker already?
 if (tracker == -1 && tracker_allow) { // no, so add it
  /* check if this packet matches -F rules. *Only* if it does should it be aded.
   * 
   * This allows a packet matching -F rule(s) to be added to the tracker, and subsequent packets
   * in the same connection to remove it. A neat way of checking handshaking and other scenarios
   * 
   * any packets dropped by the network stack as part of the conversation will thus cause a LOST
   * packet as far as packeteer is concerned, and the first packet in the sequence will be reported
   * by packeteer.
   * 
   * If the rule is -F SYN then the captured packet will be the initial request for a connection
   */
  tracker_tcp_flags_match =  *( ((unsigned char *)tcp) + 13)  & tracker_tcp_flags_filter;
  if (tracker_tcp_flags_match) { // only add packets that match the tracking rule
   tracker = tracker_packet_add((unsigned char *)ethernet, skb_len);
  }
 }
 else { // yes, so 'tick it off' and remove - don't need to save the packet data into memory
  tracker_tcp_flags_match = *( ((unsigned char *)tcp) + 13)  & tracker_tcp_flags_filter;
  if (!tracker_tcp_flags_match) { // don't remove starting packets of conversations
   tracker = tracker_packet_remove(tracker);
  }
 }

 pthread_mutex_unlock(&tracker_mutex);
 
 return tracker;
}


/* netfilters reporting a new packet 
   It is possible for netfilters to report *before* pcap does, so we need to set
   the checksum so when pcap reports the tracker is updated, not duplicated
 */
int packet_netf(int count, const struct iphdr *ip, const struct tcphdr *tcp) {
 int r, remove = 1; // simulation control
 unsigned char tracker_tcp_flags_match = 0;
 u_int32_t checksum = (ntohs(ip->check) << 16) | ntohs(tcp->check); // combine the checksums

 if (verbose) fprintf(stderr, "packet_netf(): checksum %8.8x ip %x tcp %x\n", checksum, ntohs(ip->check), ntohs(tcp->check));

 pthread_mutex_lock(&tracker_mutex);

 int tracker = tracker_findby_checksum(checksum); // is it in the tracker already?
 if (tracker == -1) // the same packet isn't, but this might be a packet in the same conversation
  tracker = tracker_findby_address(ip->saddr, ip->daddr, tcp->source, tcp->dest);
 
 if (tracker == -1 && tracker_allow) { // no, so add it
  tracker = tracker_checksum_add(checksum);
 }
 else { // yes, so 'tick it off' and remove
  /* check if this packet matches -F rules. If it does, *do not* remove it. That will be done
   * when a subsequent packet comes through with the same source & destination IP address/ports
   * 
   * This allows a packet matching -F rule(s) to be added to the tracker, and subsequent packets
   * in the same connection to remove it. A neat way of checking handshaking and other scenarios
   * 
   * any packets dropped by the network stack as part of the conversation will thus cause a LOST
   * packet as far as packeteer is concerned, and the first packet in the sequence will be reported
   * by packeteer.
   * 
   * If the rule is -F SYN then the captured packet will be the initial request for a connection
   */
  tracker_tcp_flags_match = *( ((unsigned char *)tcp) + 13)  & tracker_tcp_flags_filter;
  if (!tracker_tcp_flags_match) { // don't remove starting packets of conversations
   if (remove) tracker = tracker_packet_remove(tracker);
  }
 }

 pthread_mutex_unlock(&tracker_mutex);
         
 return tracker;
}

/* SIGINT handler - will cause the main loop to break */
void sig_int(int sig) {
 interrupted++; // the main loop's while() clause will break
}


/* 
   Sets up two child threads to monitor pcap and netfilters view of arriving packets,
   then detects discrepencies and reports them
 */
int main(int argc, char **argv) {
 int arg, len = 0,lost = 0, lastlost = 0;
 int i, ret = 0; 
 int showOptions=0;
 int queue = -1; // netfilters queue number; -1 indicates to use default value (80)
 char pcap_filter[FILTER_BUF];
 char *part = NULL; 
 char *device = NULL; // name of device to monitor
 struct in_addr_filter *tmp;
 struct in_addr ipaddr;
 
 printf("\n"
        "Packeteer version %s © 2007 TJ http://intuitivenipple.net\n"
        "Licensed on the terms of GPL version 3\n\n"
        "Monitors network packets at pcap and netfilters stages looking for packets silently dropped by the kernel.\n\n", VER);
   
 for (arg=1; arg < argc; arg++) {
  if (argv[arg][0] == '-' && strlen(argv[arg]) > 1) {
   switch(argv[arg][1]) {
   case 'a': // IP address
    if (arg+1 < argc) {
     if (inet_aton(argv[arg+1], &ipaddr)) { // try converting text to an IP number
      tmp = (struct in_addr_filter *)malloc(sizeof(ip_addr_filter));
      if (tmp != NULL) { // allocated memory
       memcpy(&tmp->ip_addr, &ipaddr, sizeof(struct in_addr)); // set ip address
       tmp->next = ip_addr_filters;  // link into existing list
       ip_addr_filters = tmp; // put this filter at head of list         
        fprintf(stdout, "Will match IP address %s\n", inet_ntoa(ip_addr_filters->ip_addr));
      }
     }
    }
    break;
    
    case 'f': // flag TCP (CWNR, ECN, URG, ACK, PUSH, RST, SYN, FIN) 
     if (arg+1 < argc) {
      for(i=0; i < TCP_FLAGS_MAX; i++) { // scan the tcp flags string array
       if (strcmp(tcp_flags_strings[i], strupr(argv[arg+1])) == 0) { // compare regardless of case
        tcp_flags_filter |= 1 << i; // bitwise-OR the flag (index in tcp_flags_string is also the bit-shift)
        fprintf(stdout, "Will match TCP flag %s\n", tcp_flags_strings[i]);
        break;
       }
      }
     }
     break;
     
    case 'F': // flag to track TCP (CWNR, ECN, URG, ACK, PUSH, RST, SYN, FIN) 
     if (arg+1 < argc) {
      for(i=0; i < TCP_FLAGS_MAX; i++) { // scan the tcp flags string array
       if (strcmp(tcp_flags_strings[i], strupr(argv[arg+1])) == 0) { // compare regardless of case
        tracker_tcp_flags_filter |= 1 << i; // bitwise-OR the flag (index in tcp_flags_string is also the bit-shift)
        fprintf(stdout, "Tracking TCP flag %s\n", tcp_flags_strings[i]);
        break;
       }
      }
     }
     break;
     
    case 'i': // interface
     if (arg+1 < argc) {
          device = argv[arg+1];
      printf("Monitoring interface: %s\n", device);
     }
     break;
    
    case 'l': // simulate X milliseconds of lag in circuit
     if (arg+1 < argc) {
          netfilters_lag = atol(argv[arg+1]) * 1000; // adjust to microseconds
      printf("Introducing %d milliseconds of lag\n", netfilters_lag/1000);
     }
     break;
  
    case 'n': // number of packets seen by pcap before quitting
     if (arg+1 < argc) {
          pcap_count_max = atol(argv[arg+1]);
      printf("Will stop after %u packets\n", pcap_count_max);
     }
     break;
  
    case 'p': // pcap filter rule
     if (arg+1 < argc) {
          pcap_filter[0] = 0;
          for(arg++; arg < argc; arg++) {
           part = argv[arg];
           if (part[0] == '"') {
            part++; // start after "     
           }
           if ( ( len + strlen(part) ) > FILTER_BUF ) {
            fprintf(stderr, "Error: pcap filter rule exceeds %d bytes in length\n", FILTER_BUF);
            ret = 1; // error code
            break; // drop out of for() loop and exit
           }
           strcat(pcap_filter, part);
           len = strlen(pcap_filter);
           if (pcap_filter[ len-1 ] == '"') {
            pcap_filter[len-1] = 0; // replace " with string-terminator
            break; // end of filter-rule, so leave loop
           }
           strcat(pcap_filter, " "); // insert space between operands
          }

          printf("pcap filter: %s\n", pcap_filter);
     }
     break;

    case 'q': // queue-num for NFQUEUE
     if (arg+1 < argc) {
      queue = atoi(argv[arg+1]);
          if (queue < 0 || queue > 65535) {
       queue = -1; // out of bounds, so reset so default is used
           fprintf(stderr, "Error: queue-num out of bounds; using default (80)\n");
          }
          else
       printf("iptables -j NFQUEUE --queue-num %d\n", queue);
     }
     break;
     
    case 's': // simulation
     simulation = 1; // enable simulation of 'lost' packets
     printf("Simulating 'lost' packets\n");
     break;
     
    case 't': // tracker table size
     if (arg+1 < argc) {
          tracker_max_packets = atol(argv[arg+1]);
          
          if (tracker_max_packets < TRACKER_DEFAULT_MAX_PACKETS) //  check and adjust bounds 
       tracker_max_packets = TRACKER_DEFAULT_MAX_PACKETS;
          if (tracker_max_packets > 4096) 
       tracker_max_packets = 4096;

      printf("Tracker table has %d entries\n", tracker_max_packets);
     }
     break;
  
    case 'v': // verbose
     verbose = 1; // enable lots of progress messages
     printf("Verbose messages\n");
     break;
     
    case 'h': // help
    default:
     showOptions=1;
     break;
   } // end switch
  }
 }
 if (queue == -1) queue = 80; // use default value

 if ( ret == 1 || argc == 1 || showOptions || device == NULL) {
  printf("\n"
         "\t-a\t<source IP> address to match, e.g. 10.0.100.4 (-a can be repeated)\n"
         "\t-f\t<TCP flag> to match. One of CWNR ECN URG ACK PUSH RST SYN FIN. (-f repeated ORs flags)\n"
         "\t-F\t<TCP flag> to TRACK. One of CWNR ECN URG ACK PUSH RST SYN FIN. (-F repeated ORs flags)\n"
         "\t-h\tshow this help\n"
         "\t-i\t<interface> e.g. eth0\n"
         "\t-l\t<millisconds> simulate lag in circuit (applied in the netfilters monitor)\n"
         "\t-n\t<0-%u> Number of packets to monitor before stopping (defaults to 1000)\n"
         "\t-p\t\"pcap filter rule (see man tcpdump)\"\n"
         "\t-q\t<0-65535> iptables target queue (-j NFQUEUE --queue-num %u)  (defaults to 80)\n"
         "\t-s\tSimulate - randomly 'lose' packets to test packeteer\n"
         "\t-t\t<256-4096> Number of entries in the tracking table (defaults to %u)\n"
         "\t-v\tVerbose messages\n"
         "\nE.g.\tiptables -t raw -I PREROUTING -p tcp -d 10.0.0.1 --dport 80 -j NFQUEUE --queue-num 80\n\n"
         "\tpacketeer -i eth1 -n 2000000 -q 80 -p \"dst host 10.0.0.1 and tcp dst port 80\"\n\n"
         "\tiptables -t raw -D PREROUTING -p tcp -d 10.0.0.1 --dport 80 -j NFQUEUE --queue-num 80\n\n",
         ( (long) -1), queue, TRACKER_DEFAULT_MAX_PACKETS );  
 }
 else if (ret == 0) { // run the filters
  if (tracker_init() > 0) { // prepare the trackers
   if (pcap_init(device, pcap_filter) == 0) {
    if (netfilters_init( (u_int16_t)queue) == 0) {
     if (pcap_start() == 0) {
      if (netfilters_start() == 0) {
           fprintf(stdout, "Monitoring a maximum of %u packets, using %u tracker slots. press Ctrl-C to stop\n",
                           pcap_count_max, tracker_max_packets);
           signal(SIGINT, sig_int);
       while (pcap_count < pcap_count_max && !interrupted) {
        // fprintf(stderr, "C"); // prove the timer is running
        sleep(1); // wait one second
     
        lost = detect_lost_packets(0); // no reporting, just the total qty
        if (lastlost != lost) { // only report when the count changes
         fprintf(stdout, "LOST: %10s %d packets\n", print_time(NULL), lost);
         lastlost = lost;
        }
        // run out of tracker slots, or a thread has stopped, so shutdown program
        // TRACKER_MAX_PACKETS-64 is used to leave some headroom for packets being processed
        if (lost >= (tracker_max_packets-64) || !pcap_control || !netfilters_control) break; 
       }
       fprintf(stdout, "Stopping...");
       tracker_allow = 0; // refuse to add any more packets to the tracker

       pcap_exit(); // shutdown the pcap monitor first, to allow time for netfilters to 'see' packets still in the queue
       sleep(2); // give netfilters time to process outstanding packets 
       netfilters_exit(); // shutdown the netfilters monitor cleanly

       fprintf(stdout, " after %u packets\n", pcap_count);
       detect_lost_packets(1); // report LOST packets
      }
      else {
       pcap_exit(); // shutdown pcap cleanly
       ret = 6;
      }
     }
     else ret = 5; 

     fprintf(stdout, "Lost packets count=%d\n", discarded_packet_count);
     arg = tracker_free();
     if (verbose) fprintf(stderr, "Released %d trackers\n", arg); // release allocated memory
    }
    else ret = 4;
   }
   else ret = 3;

   free(tracker_packets); // release tracker memory
  }
  else ret = 2;
 }
 if (ret > 0) fprintf(stderr, "Error: failed to %s\n", error_messages[ret]);
 
 return ret;
}