libnids 一例

#include "nids.h"
#include
#include
#include
#include
#include
#include
void tcp_call_back(struct tcp_stream *tcp_connection,void **arg){
        char  address_string[1024]={0};
        char  filter_ip[1024]={0};
        struct tuple4 ip_and_port = tcp_connection->addr;
        strcpy(address_string,inet_ntoa(*(struct in_addr *)&(ip_and_port.saddr))) ;
        sprintf(address_string+strlen(address_string),":%i",ip_and_port.source) ;
        strcat(address_string,"----------------->"); //这里仅为方便，如果为服务器到客户端，方向应该反过来
        sprintf(address_string+strlen(address_string),"%s",inet_ntoa(*(struct in_addr *)&(ip_and_port.daddr))) ;
        sprintf(address_string+strlen(address_string),":%i",ip_and_port.dest) ;
        strcpy(filter_ip,inet_ntoa(*(struct in_addr *)&(ip_and_port.daddr))) ;
        switch(tcp_connection->nids_state){
                case NIDS_JUST_EST:
                        if (strcmp(filter_ip,"127.0.0.1")==0){
                                nids_killtcp(tcp_connection);
                        }
                        tcp_connection->client.collect++;
                        tcp_connection->server.collect++;
                        tcp_connection->server.collect_urg++;
                        tcp_connection->client.collect_urg++;
                        printf("%s tcp est\n",address_string);
                        break;

                case NIDS_CLOSE:
                        printf("%s tcp close\n",address_string);
                        break;
                case NIDS_RESET:
                        printf("%s tcp rest\n",address_string);
                default:
                        printf("%s tcp data\n",address_string);
        }
}
int main(){
        nids_init();
        nids_register_tcp(tcp_call_back);
        nids_run();
        return 0;
}