分析一个 pcap 文件的 TCP SYN flood 情况

Res

• pcap-savefile
• Wiki on SYN flood
• IPv4 Packet structure
• TCP Segment structure

Code

    // cd syn_flood/ && cargo build && cd .. && cat synflood.pcap | syn_flood/target/debug/syn_flood
    // 95829 packets parsed with 56298 connections, 39531 (70.22%) acknowledged
    for packet in f.packets.iter() {
        // link layer header (4 bytes)
        // network layer header
        // transport layer header
        // application layer data
        let ipv4_packet = ipv4::Packet::from_bytes(&packet.payload[4..]).unwrap();
        let tcp_header = tcp::SegmentHeader::from_bytes(&ipv4_packet.payload).unwrap();
        if tcp_header.is_initiated() {
            initiated += 1.;
        }
        if tcp_header.is_acknowledgment() {
            acknowledged += 1.;
        }
    }