corsaro_dos.h

/* 
 * corsaro
 *
 * Alistair King, CAIDA, UC San Diego
 * corsaro-info@caida.org
 * 
 * Copyright (C) 2012 The Regents of the University of California.
 * 
 * This file is part of corsaro.
 *
 * corsaro is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * corsaro is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with corsaro.  If not, see <http://www.gnu.org/licenses/>.
 *
 */

#ifndef __CORSARO_DOS_H
#define __CORSARO_DOS_H

#include "corsaro_plugin.h"

CORSARO_PLUGIN_GENERATE_PROTOS(corsaro_dos)


typedef struct corsaro_dos_global_header
{
  uint32_t mismatched_pkt_cnt;

  uint32_t attack_vector_cnt;
  
  uint32_t non_attack_vector_cnt;
} PACKED corsaro_dos_global_header_t;

typedef struct corsaro_dos_header
{
  uint32_t attack_vector_cnt;
} PACKED corsaro_dos_header_t;

typedef struct corsaro_dos_attack_vector_in
{
  uint32_t target_ip;

  uint32_t attacker_ip_cnt;

  uint32_t interval_attacker_ip_cnt;

  uint32_t attack_port_cnt;

  uint32_t target_port_cnt;

  uint64_t packet_cnt;

  uint32_t interval_packet_cnt;

  uint64_t byte_cnt;

  uint32_t interval_byte_cnt;

  uint64_t max_ppm;

  uint32_t start_time_sec;

  uint32_t start_time_usec;

  uint32_t latest_time_sec;

  uint32_t latest_time_usec;

  uint32_t initial_packet_len;

  uint8_t *initial_packet;
} PACKED corsaro_dos_attack_vector_in_t;

void corsaro_dos_attack_vector_get_packet(
                            corsaro_dos_attack_vector_in_t *attack_vector, 
                            libtrace_packet_t *packet);

off_t corsaro_dos_global_header_fprint(corsaro_t *corsaro, 
                                       corsaro_file_t *file, 
                                       corsaro_dos_global_header_t *header);

void corsaro_dos_global_header_print(corsaro_dos_global_header_t *header);

off_t corsaro_dos_attack_vector_fprint(corsaro_t *corsaro, 
                                       corsaro_file_t *file, 
                                       corsaro_dos_attack_vector_in_t *av);

void corsaro_dos_attack_vector_print(corsaro_dos_attack_vector_in_t *av);

off_t corsaro_dos_header_fprint(corsaro_t *corsaro, 
                                corsaro_file_t *file, 
                                corsaro_dos_header_t *header);

void corsaro_dos_header_print(corsaro_dos_header_t *header);

off_t corsaro_dos_record_fprint(corsaro_t *corsaro, 
                                corsaro_file_t *file, 
                                corsaro_in_record_type_t record_type,
                                corsaro_in_record_t *record);

int corsaro_dos_record_print(corsaro_in_record_type_t record_type,
                             corsaro_in_record_t *record);

#endif /* __CORSARO_DOS_H */