Browse Source

add tcp_syn_win table

aidmar.wainakh 6 years ago
parent
commit
76b1a70852

+ 5 - 0
code_boost/src/cxx/pcap_processor.cpp

@@ -206,6 +206,11 @@ void pcap_processor::process_packets(const Packet &pkt) {
                 // Aidmar
                 // MSS distribution
                 stats.incrementMSScount(ipAddressSender, val);
+                // Check window size for SYN noly
+                 if(tcpPkt.get_flag(TCP::SYN)) {
+                    int win = tcpPkt.window();
+                    stats.incrementWinCount(ipAddressSender, win);
+                    }
 
             } catch (Tins::option_not_found) {
                 // Ignore MSS if option not set

+ 11 - 0
code_boost/src/cxx/statistics.cpp

@@ -16,6 +16,16 @@ void statistics::incrementMSScount(std::string ipAddress, int mssValue) {
     mss_distribution[{ipAddress, mssValue}]++;
 }
 
+// Aidmar
+/**
+ * Increments the packet counter for the given IP address and window size.
+ * @param ipAddress The IP address whose window size packet counter should be incremented.
+ * @param winSize The window size of the packet.
+ */
+void statistics::incrementWinCount(std::string ipAddress, int winSize) {
+    win_distribution[{ipAddress, winSize}]++;
+}
+
 /**
  * Increments the packet counter for the given IP address and TTL value.
  * @param ipAddress The IP address whose TTL packet counter should be incremented.
@@ -271,6 +281,7 @@ void statistics::writeToDatabase(std::string database_path) {
     db.writeStatisticsProtocols(protocol_distribution);
     // Aidmar
     db.writeStatisticsMss_dist(mss_distribution);
+    db.writeStatisticsWin(win_distribution);
 }
 
 /**

+ 32 - 0
code_boost/src/cxx/statistics.h

@@ -51,6 +51,22 @@ struct ipAddress_mss {
     }
 };
 
+// Aidmar
+/*
+ * Struct used to represent:
+ * - IP address (IPv4 or IPv6)
+ * - Window size
+ */
+struct ipAddress_win {
+    std::string ipAddress;
+    int winSize;
+
+    bool operator==(const ipAddress_win &other) const {
+        return ipAddress == other.ipAddress
+               && winSize == other.winSize;
+    }
+};
+
 
 /*
  * Struct used to represent:
@@ -149,6 +165,18 @@ namespace std {
         }
     };
 
+    // Aidmar
+      template<>
+    struct hash<ipAddress_win> {
+        std::size_t operator()(const ipAddress_win &k) const {
+            using std::size_t;
+            using std::hash;
+            using std::string;
+            return ((hash<string>()(k.ipAddress)
+                     ^ (hash<int>()(k.winSize) << 1)) >> 1);
+        }
+    };
+
     template<>
     struct hash<ipAddress_protocol> {
         std::size_t operator()(const ipAddress_protocol &k) const {
@@ -192,6 +220,8 @@ public:
 
     // Adimar
     void incrementMSScount(std::string ipAddress, int mssValue);
+    void incrementWinCount(std::string ipAddress, int winSize);
+
 
     void incrementTTLcount(std::string ipAddress, int ttlValue);
 
@@ -248,6 +278,8 @@ private:
     // Aidmar
     // {IP Address, MSS value, count}
     std::unordered_map<ipAddress_mss, int> mss_distribution;
+    // {IP Address, Win size, count}
+    std::unordered_map<ipAddress_win, int> win_distribution;
 
     // {IP Address, Protocol, count}
     std::unordered_map<ipAddress_protocol, int> protocol_distribution;

+ 30 - 0
code_boost/src/cxx/statistics_db.cpp

@@ -271,3 +271,33 @@ void statistics_db::writeStatisticsMss_dist(std::unordered_map<ipAddress_mss, in
     }
 }
 
+// Aidamr
+/**
+ * Writes the window size distribution into the database.
+ * @param winDistribution The window size distribution from class statistics.
+ */
+void statistics_db::writeStatisticsWin(std::unordered_map<ipAddress_win, int> winDistribution) {
+    try {
+        db->exec("DROP TABLE IF EXISTS tcp_syn_win");
+        SQLite::Transaction transaction(*db);
+        const char *createTable = "CREATE TABLE tcp_syn_win ("
+                "ipAddress TEXT,"
+                "winSize INTEGER,"
+                "winCount INTEGER,"
+                "PRIMARY KEY(ipAddress,winSize));";
+        db->exec(createTable);
+        SQLite::Statement query(*db, "INSERT INTO tcp_syn_win VALUES (?, ?, ?)");
+        for (auto it = winDistribution.begin(); it != winDistribution.end(); ++it) {
+            ipAddress_win e = it->first;
+            query.bind(1, e.ipAddress);
+            query.bind(2, e.winSize);
+            query.bind(3, it->second);
+            query.exec();
+            query.reset();
+        }
+        transaction.commit();
+    }
+    catch (std::exception &e) {
+        std::cout << "Exception in statistics_db: " << e.what() << std::endl;
+    }
+}

+ 2 - 0
code_boost/src/cxx/statistics_db.h

@@ -41,6 +41,8 @@ public:
 
     // Aidmar
     void writeStatisticsMss_dist(std::unordered_map<ipAddress_mss, int> mssDistribution);
+    void writeStatisticsWin(std::unordered_map<ipAddress_win, int> winDistribution);
+    
 
 private:
     // Pointer to the SQLite database