struct module { Bool module_inuse; char *module_name; char *module_descr; int (*module_init) (int argc, char *argv[]); void (*module_read) ( struct ip *pip, /* the packet */ tcp_pair *ptp, /* info I have about this connection */ void *plast, /* pointer to last byte */ void *pmodstruct); /* module-specific structure */ void (*module_done) (void); void (*module_usage)(void); void (*module_newfile)( char *filename, /* the name of the current file */ u_long filesize, /* number of bytes in file (might be compressed) */ Bool fcompressed); /* is the file compressed? */ void *(*module_newconn)( tcp_pair *ptp); /* info I have about this connection */ void (*module_udp_read) ( struct ip *pip, /* the packet */ udp_pair *pup, /* info I have about this connection */ void *plast, /* pointer to last byte */ void *pmodstruct); /* module-specific structure */ void *(*module_udp_newconn)( udp_pair *ptp); /* info I have about this connection */ void (*module_nontcpudp_read) ( struct ip *pip, /* the packet */ void *plast); /* pointer to last byte */ void (*module_deleteconn) ( tcp_pair *ptp, /* info I have about this connection */ void *pmodstruct); /* module-specific structure */ };
As shown above, each module definition consists of fields that store a basic description of the module followed by a list of function pointers that need to be filled with functions specific to the module. The module_inuse variable is used by tcptrace to see if the module has been selected and is active. The module_name, and module_descr fields store the name and a short description of the module and are useful for debugging purposes. The list of function pointers that follow need to be set to appropriate module specific functions.
The function pointers and their assignments for the Real-Time module (from the modules.h file) are shown below. These functions are defined in the mod_realtime.c file.
{TRUE, /* make FALSE if you don't want to call it at all */ "realtime", /* name of the module */ "example real-time package",/* description of the module */ realtime_init, /* routine to call to init the module */ realtime_read, /* routine to pass each TCP segment */ realtime_done, /* routine to call at program end */ realtime_usage, /* routine to call to print module usage */ NULL, /* routine to call on each new file */ realtime_newconn, /* routine to call on each new connection */ realtime_udp_read, /* routine to pass each UDP segment */ NULL, /* routine to call on each new UDP conn */ realtime_nontcpudp_read, /* routine to pass each non-tcp and non-udp packets*/ realtime_deleteconn}
For example, the realtime_init function assigned by the Real-Time module looks for the command-line argument -xrealtime to decide if the module is being invoked or not and returns 1 if found, and 0 otherwise. If you want your module mymod to be able to handle module specific arguments as in -xmymod''ARGS'', look into the traffic module code in mod_traffic.c for example.
With the Real-Time module for example, tcptrace returns the rtconn structure associated with the connection by the realtime_newconn function when the connection was opened as the fourth argument in the realtime_read function (called for every TCP packet of the connection).
Note that the Real-Time module sets the function pointer corresponding to this function to NULL meaning that the module does not want to be notified of the event. Similarly, you may set any of the function pointers you are not interested in to NULL if you do not want to be notified of the corresponding event by tcptrace .
See the realtime_newconn for an example of how a module specific connection structure is initialized and returned.