initial commit

[old-and-random.git] / ccdc / snort.c

#include <stdio.h>
#include <stdlib.h>

int count, r, c;

unsigned time_seed()
{
  time_t now = time ( 0 );
  unsigned char *p = (unsigned char *)&now;
  unsigned seed = 0;
  size_t i;

  for ( i = 0; i < sizeof now; i++ )
    seed = seed * ( 100 + 2U ) + p[i];

  return seed;
}

unsigned help() {
printf("Options:\n");
printf("        -A         Set alert mode: fast, full, console, test or none ");
printf("                                  (alert file alerts only)\n");
printf("                   \"unsock\" enables UNIX socket logging (experimental).\n");
printf("        -b         Log packets in tcpdump format (much faster!)\n");
printf("        -B <mask>  Obfuscated IP addresses in alerts and packet dumps using CIDR mask\n");
printf("        -c <rules> Use Rules File <rules>\n");
printf("        -C         Print out payloads with character data only (no hex)\n");
printf("        -d         Dump the Application Layer\n");
printf("        -D         Run Snort in background (daemon) mode\n");
printf("        -e         Display the second layer header info\n");
printf("        -f         Turn off fflush() calls after binary log writes\n");
printf("        -F <bpf>   Read BPF filters from file <bpf>\n");
printf("        -g <gname> Run snort gid as <gname> group (or gid) after initialization\n");
printf("        -G <0xid>  Log Identifier (to uniquely id events for multiple snorts)\n");
printf("        -h <hn>    Home network = <hn>\n");
printf("        -H         Make hash tables deterministic.\n");
printf("        -i <if>    Listen on interface <if>\n");
printf("        -I         Add Interface name to alert output\n");
printf("        -J <port>  ipfw divert socket <port> to listen on vice libpcap (FreeBSD only)\n");
printf("        -k <mode>  Checksum mode (all,noip,notcp,noudp,noicmp,none)\n");
printf("        -K <mode>  Logging mode (pcap[default],ascii,none)\n");
printf("        -l <ld>    Log to directory <ld>\n");
printf("        -L <file>  Log to this tcpdump file\n");
printf("        -M         Log messages to syslog (not alerts)\n");
printf("        -m <umask> Set umask = <umask>\n");
printf("        -n <cnt>   Exit after receiving <cnt> packets\n");
printf("        -N         Turn off logging (alerts still work)\n");
printf("        -o         Change the rule testing order to Pass|Alert|Log\n");
printf("        -O         Obfuscate the logged IP addresses\n");
printf("        -p         Disable promiscuous mode sniffing\n");
printf("        -P <snap>  Set explicit snaplen of packet (default: )\n");
printf("        -q         Quiet. Don't show banner and status report\n");
printf("        -Q         Use ip_queue for input vice libpcap (iptables only)\n");
printf("        -r <tf>    Read and process tcpdump file <tf>\n");
printf("        -R <id>    Include 'id' in snort_intf<id>.pid file name\n");
printf("        -s         Log alert messages to syslog\n");
printf("        -S <n=v>   Set rules file variable n equal to value v\n");
printf("        -t <dir>   Chroots process to <dir> after initialization\n");
printf("        -T         Test and report on the current Snort configuration\n");
printf("        -u <uname> Run snort uid as <uname> user (or uid) after initialization\n");
printf("        -U         Use UTC for timestamps\n");
printf("        -v         Be verbose\n");
printf("        -V         Show version number\n");
printf("        -X         Dump the raw packet data starting at the link layer\n");
printf("        -x         Exit if Snort configuration problems occur\n");
printf("        -y         Include year in timestamp in the alert and log files\n");
printf("        -Z <file>  Set the performonitor preprocessor file path and name\n");
printf("        -?         Show this information\n");
printf("<Filter Options> are standard BPF options, as seen in TCPDump\n");
printf("\n");
printf("Longname options and their corresponding single char version\n");
printf("   --logid <0xid>                  Same as -G\n");
printf("   --perfmon-file <file>           Same as -Z\n");
printf("   --pid-path <dir>                Specify the directory for the Snort PID file\n");
printf("   --snaplen <snap>                Same as -P\n");
printf("   --help                          Same as -?\n");
printf("   --version                       Same as -V\n");
printf("   --alert-before-pass             Process alert, drop, sdrop, or reject before pass, default is pass before alert, drop,...\n");
printf("   --treat-drop-as-alert           Converts drop, sdrop, and reject rules into alert rules during startup\n");
printf("   --process-all-events            Process all queued events (drop, alert,...), default stops after 1st action group\n");
printf("   --dynamic-engine-lib <file>     Load a dynamic detection engine\n");
printf("   --dynamic-engine-lib-dir <path> Load all dynamic engines from directory\n");
printf("   --dynamic-detection-lib <file>  Load a dynamic rules library\n");
printf("   --dynamic-detection-lib-dir <path> Load all dynamic rules libraries from directory\n");
printf("   --dump-dynamic-rules <path>     Creates stub rule files of all loaded rules libraries\n");
printf("   --dynamic-preprocessor-lib <file>  Load a dynamic preprocessor library\n");
printf("   --dynamic-preprocessor-lib-dir <path> Load all dynamic preprocessor libraries from directory\n");
printf("   --dump-dynamic-preproc-genmsg <path>  Creates gen-msg.map files of all loaded preprocessor libraries\n");
printf("   --create-pidfile                Create PID file, even when not in Daemon mode\n");
printf("   --nolock-pidfile                Do not try to lock Snort PID file\n");
printf("   --disable-inline-initialization Do not perform the IPTables initialization in inline mode.\n");
printf("   --disable-inline-init-failopen  Do not fail open and pass packets while initializing with inline mode.\n");
printf("   --disable-attribute-reload-thread Do not create a thread to reload the attribute table\n");
printf("   --pcap-single <tf>              Same as -r.\n");
printf("   --pcap-file <file>              file that contains a list of pcaps to read - read mode is implied.\n");
printf("   --pcap-list \"<list>\"            a space separated list of pcaps to read - read mode is implied.\n");
printf("   --pcap-dir <dir>                a directory to recurse to look for pcaps - read mode is implied.\n");
printf("   --pcap-filter <filter>          filter to apply when getting pcaps from file or directory.\n");
printf("   --pcap-no-filter                reset to use no filter when getting pcaps from file or directory.\n");
printf("   --pcap-loop <count>             this option will read the pcaps specified on command line continuously.\n");
printf("                                   for <count> times.  A value of 0 will read until Snort is terminated.\n");
printf("   --pcap-reset                    if reading multiple pcaps, reset snort to post-configuration state before reading next pcap.\n");
printf("   --pcap-show                     print a line saying what pcap is currently being read.\n");
printf("   --exit-check <count>            Signal termination after <count> callbacks from pcap_dispatch(), showing the time it\n");
printf("                                   takes from signaling until pcap_close() is called.\n");
printf("   --conf-error-out                Same as -x\n");

  exit(0);
}
 
int main(int argc, char *argv[ ]) {
  //printf("goodtimes\n");
  sleep(1);
  //usleep
  //printf("now");
  srand ( time_seed() );
  while ((c = getopt(argc, argv, ":hbf:Vbf:?")) != -1) {
    switch(c) {
      case 'h':
        help();
        break;
      case 'V':
        help();
        break;
      case '?':
        help();
        break;
    }
  }
  while(1) {
    //printf("cpu\n");
    //srand ( time_seed() );
    r = rand() %(1000-1)+1;
    while (count<(rand()+rand())) {
      count++;
    }
    //printf("%d - %d\n",r, time_seed());
    usleep(r);
    r=0;
    count=0;
  }
}