Article 2688 of comp.sources.unix:
Path: nntpd.lkg.dec.com!crl.dec.com!crl.dec.com!caen!reeve.research.aa.wl.com!decwrl!news1.digital.com!vixie!vixie!not-for-mail
From: argus@SEI.CMU.EDU
Newsgroups: comp.sources.unix
Subject: v29i032: argus-1.5 - a generic IP network transaction auditing tool, Part02/06
Date: 16 Oct 1995 23:06:56 -0700
Organization: Vixie Enterprises
Lines: 2868
Sender: vixie@vix.com
Approved: vixie@gw.home.vix.com
Message-ID: <45vh60$21o@gw.home.vix.com>
References: <1.813909952.2078@gw.home.vix.com>
NNTP-Posting-Host: gw.home.vix.com

Submitted-By: argus@SEI.CMU.EDU
Posting-Number: Volume 29, Issue 32
Archive-Name: argus-1.5/part02

#!/bin/sh
# This is `part02' (part 2 of a multipart archive).
# Do not concatenate these parts, unpack them in order with `/bin/sh'.
# File `argus-1.5/include/argus.h' is being continued...
#
touch -am 1231235999 $$.touch >/dev/null 2>&1
if test ! -f 1231235999 && test -f $$.touch; then
  shar_touch=touch
else
  shar_touch=:
  echo
  echo 'WARNING: not restoring timestamps.  Consider getting and'
  echo "installing GNU \`touch', distributed in GNU File Utilities..."
  echo
fi
rm -f 1231235999 $$.touch
#
if test ! -r _sharseq.tmp; then
  echo 'Please unpack part 1 first!'
  exit 1
fi
shar_sequence=`cat _sharseq.tmp`
if test "$shar_sequence" != 2; then
  echo "Please unpack part $shar_sequence next!"
  exit 1
fi
if test ! -f _sharnew.tmp; then
  echo 'x - still skipping argus-1.5/include/argus.h'
else
  echo 'x - continuing file argus-1.5/include/argus.h'
  sed 's/^X//' << 'SHAR_EOF' >> 'argus-1.5/include/argus.h' &&
Xvoid cons_udp_init ();
Xvoid cons_udp ();
Xvoid check_udp_timeouts ();
Xint tcp_wrapper ();
X
Xint sock_names();
X
Xextern struct QUEUE tcp_display_list;
Xextern struct QUEUE udp_display_list;
Xextern struct QUEUE ip_display_list;
X
X#include <cons_def.h>
X
Xtypedef void (*proc)();
X
X#define TSEQ_HASHSIZE		9029
X#define MAX_LISTEN		5
X
X
Xstruct QUEUE_HEADER {
X   struct QUEUE_HEADER *nxt;
X   struct QUEUE_HEADER *prv;
X   struct QUEUE *queue;
X   struct timeval last_time, logtime;
X};
X 
X
Xstruct QUEUE {
X   struct QUEUE_HEADER *start;
X   proc timerRoutine, logRoutine;
X   int count;
X};
X
Xstruct HASH_TABLE_HEADER {
X   struct HASH_TABLE_HEADER *nxt;
X   struct HASH_TABLE_HEADER *prv;
X   struct tha tha;
X   u_int hash;
X   struct OBJECT *object;
X};
X 
Xstruct HASH_TABLE {
X   struct HASH_TABLE_HEADER **hash_array;
X   u_int size;
X};
SHAR_EOF
  echo 'File argus-1.5/include/argus.h is complete' &&
  $shar_touch -am 0508141295 'argus-1.5/include/argus.h' &&
  chmod 0444 'argus-1.5/include/argus.h' ||
  echo 'restore of argus-1.5/include/argus.h failed'
  shar_count="`wc -c < 'argus-1.5/include/argus.h'`"
  test 2883 -eq "$shar_count" ||
    echo "argus-1.5/include/argus.h: original size 2883, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/argus_util.h ==============
if test -f 'argus-1.5/include/argus_util.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/argus_util.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/argus_util.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/argus_util.h' &&
X
X/*
X * Copyright (c) 1993, 1994 Carnegie Mellon University.
X * All rights reserved.
X *
X * Permission to use, copy, modify, and distribute this software and
X * its documentation for any purpose and without fee is hereby granted, 
X * provided that the above copyright notice appear in all copies and
X * that both that copyright notice and this permission notice appear
X * in supporting documentation, and that the name of CMU not be
X * used in advertising or publicity pertaining to distribution of the
X * software without specific, written prior permission.  
X * 
X * CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
X * ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
X * CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
X * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
X * WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
X * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
X * SOFTWARE.
X *
X */
X
X
X#include <sys/types.h>
X#include <sys/socket.h>
X#include <net/if.h>
X#include <netinet/in.h>
X#include <netinet/if_ether.h>
X#include <netinet/in_systm.h>
X#include <netinet/ip.h>
X#include <netinet/ip_var.h>
X#include <netinet/udp.h>
X#include <netinet/udp_var.h>
X#include <arpa/inet.h>
X#include <cons_out.h>
X#include <cons_util.h>
X#include <cons_def.h>
X
Xtypedef void (*proc)();
X
Xstruct QUEUE_HEADER {
X   struct QUEUE_HEADER *nxt;
X   struct QUEUE_HEADER *prv;
X   struct QUEUE *queue;
X   struct timeval last_time, logtime;
X};
X
X
Xstruct QUEUE {
X   struct QUEUE_HEADER *start;
X   proc timerRoutine, logRoutine;
X   int count;
X};
X
Xstruct HASH_TABLE_HEADER {
X   struct HASH_TABLE_HEADER *nxt;
X   struct HASH_TABLE_HEADER *prv;
X   int hash;
X};
X 
Xstruct HASH_TABLE {
X   struct HASH_TABLE_HEADER **hash_array;
X   int size;
X};
X
X
X#include <cons_tcp.h>
X
Xstruct FILE_ENTRY {
X   struct FILE_ENTRY *nxt;
X   char *str;
X};
X
Xstruct IP_ENTRY {
X   struct IP_ENTRY *nxt;
X   u_long addr;
X};
X
X#define TSEQ_HASHSIZE      9029
X
X#define MACHINE  1
X#define NET      2
X#define HASHNAMESIZE  4096
X
Xextern u_long ipaddrtonetmask ();
Xextern u_long thisnet, localaddr, localnet, netmask;
SHAR_EOF
  $shar_touch -am 0508141295 'argus-1.5/include/argus_util.h' &&
  chmod 0444 'argus-1.5/include/argus_util.h' ||
  echo 'restore of argus-1.5/include/argus_util.h failed'
  shar_count="`wc -c < 'argus-1.5/include/argus_util.h'`"
  test 2168 -eq "$shar_count" ||
    echo "argus-1.5/include/argus_util.h: original size 2168, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/compat.h ==============
if test -f 'argus-1.5/include/compat.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/compat.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/compat.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/compat.h' &&
X
X/*
X * Copyright (c) 1993, 1994 Carnegie Mellon University.
X * All rights reserved.
X *
X * Permission to use, copy, modify, and distribute this software and
X * its documentation for any purpose and without fee is hereby granted, 
X * provided that the above copyright notice appear in all copies and
X * that both that copyright notice and this permission notice appear
X * in supporting documentation, and that the name of CMU not be
X * used in advertising or publicity pertaining to distribution of the
X * software without specific, written prior permission.  
X * 
X * CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
X * ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
X * CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
X * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
X * WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
X * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
X * SOFTWARE.
X *
X */
X
X
X#ifdef __sgi
X
X#include <bstring.h>
X#include <ulimit.h>
X
X#undef TCPSTATES
X
Xstruct ether_addr {
X        u_char  ether_addr_octet[6];
X};
X#endif
X
SHAR_EOF
  $shar_touch -am 0508141295 'argus-1.5/include/compat.h' &&
  chmod 0444 'argus-1.5/include/compat.h' ||
  echo 'restore of argus-1.5/include/compat.h failed'
  shar_count="`wc -c < 'argus-1.5/include/compat.h'`"
  test 1162 -eq "$shar_count" ||
    echo "argus-1.5/include/compat.h: original size 1162, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/cons_ether.h ==============
if test -f 'argus-1.5/include/cons_ether.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/cons_ether.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/cons_ether.h (empty)'
  > 'argus-1.5/include/cons_ether.h' &&
  $shar_touch -am 0508141295 'argus-1.5/include/cons_ether.h' &&
  chmod 0444 'argus-1.5/include/cons_ether.h' ||
  echo 'restore of argus-1.5/include/cons_ether.h failed'
  shar_count="`wc -c < 'argus-1.5/include/cons_ether.h'`"
  test 0 -eq "$shar_count" ||
    echo "argus-1.5/include/cons_ether.h: original size 0, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/cons_icmp.h ==============
if test -f 'argus-1.5/include/cons_icmp.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/cons_icmp.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/cons_icmp.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/cons_icmp.h' &&
X
X/*
X * Copyright (c) 1993, 1994 Carnegie Mellon University.
X * All rights reserved.
X *
X * Permission to use, copy, modify, and distribute this software and
X * its documentation for any purpose and without fee is hereby granted, 
X * provided that the above copyright notice appear in all copies and
X * that both that copyright notice and this permission notice appear
X * in supporting documentation, and that the name of CMU not be
X * used in advertising or publicity pertaining to distribution of the
X * software without specific, written prior permission.  
X * 
X * CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
X * ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
X * CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
X * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
X * WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
X * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
X * SOFTWARE.
X *
X */
X
X
Xstruct icmpStruct {
X   unsigned char type, code;
X   unsigned short data;
X   struct in_addr srcaddr, dstaddr, gwaddr;
X};
X
SHAR_EOF
  $shar_touch -am 0508141295 'argus-1.5/include/cons_icmp.h' &&
  chmod 0444 'argus-1.5/include/cons_icmp.h' ||
  echo 'restore of argus-1.5/include/cons_icmp.h failed'
  shar_count="`wc -c < 'argus-1.5/include/cons_icmp.h'`"
  test 1141 -eq "$shar_count" ||
    echo "argus-1.5/include/cons_icmp.h: original size 1141, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/cons_ip.h ==============
if test -f 'argus-1.5/include/cons_ip.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/cons_ip.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/cons_ip.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/cons_ip.h' &&
X
X/*
X * Copyright (c) 1993, 1994 Carnegie Mellon University.
X * All rights reserved.
X *
X * Permission to use, copy, modify, and distribute this software and
X * its documentation for any purpose and without fee is hereby granted, 
X * provided that the above copyright notice appear in all copies and
X * that both that copyright notice and this permission notice appear
X * in supporting documentation, and that the name of CMU not be
X * used in advertising or publicity pertaining to distribution of the
X * software without specific, written prior permission.  
X * 
X * CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
X * ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
X * CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
X * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
X * WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
X * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
X * SOFTWARE.
X *
X */
X
X
X#define MAXQUEUE  1024
X#define IPTIMEOUT 360
X
Xextern struct timeval update_time;
X
Xstruct IP_CON_OBJECT {
X   int count, bytes;
X   int lastcount, lastbytes;
X};
X
Xstruct ipcb {
X   struct timeval startime, lasttime;
X   int t_state, rev, status;
X   struct IP_CON_OBJECT src, dst;
X};
X
X
Xstruct IP_OBJECT {
X   struct QUEUE_HEADER qhdr;
X   struct physLink link;
X   struct tha addr;
X   struct ipcb ip_cb;
X};
X
X
X#define IPSEQ_HASHSIZE 919
X
Xstruct HASH_TABLE ip_hash_table;
Xstruct QUEUE ip_display_list;
X
SHAR_EOF
  $shar_touch -am 0508141295 'argus-1.5/include/cons_ip.h' &&
  chmod 0444 'argus-1.5/include/cons_ip.h' ||
  echo 'restore of argus-1.5/include/cons_ip.h failed'
  shar_count="`wc -c < 'argus-1.5/include/cons_ip.h'`"
  test 1511 -eq "$shar_count" ||
    echo "argus-1.5/include/cons_ip.h: original size 1511, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/cons_out.h ==============
if test -f 'argus-1.5/include/cons_out.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/cons_out.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/cons_out.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/cons_out.h' &&
X
X/*
X * Copyright (c) 1993, 1994 Carnegie Mellon University.
X * All rights reserved.
X *
X * Permission to use, copy, modify, and distribute this software and
X * its documentation for any purpose and without fee is hereby granted, 
X * provided that the above copyright notice appear in all copies and
X * that both that copyright notice and this permission notice appear
X * in supporting documentation, and that the name of CMU not be
X * used in advertising or publicity pertaining to distribution of the
X * software without specific, written prior permission.  
X * 
X * CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
X * ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
X * CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
X * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
X * WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
X * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
X * SOFTWARE.
X *
X */
X
X#include <sys/types.h>
X#include <sys/time.h>
X#include <sys/socket.h>
X#include <net/if.h>
X#include <netinet/in.h>
X#include <netinet/if_ether.h>
X
X
Xstruct tha {
X   struct in_addr src;
X   struct in_addr dst;
X   u_int port;
X};
X
Xstruct writeStruct {
X   u_int status;
X   struct timeval startime, lasttime;
X   struct ether_addr ethersrc;
X   struct ether_addr etherdst;
X   struct tha addr;
X   int src_count, dst_count;
X   int src_bytes, dst_bytes;
X};
X
X
Xstruct tcpWriteStruct {
X   int src_count, dst_count;
X   int src_bytes, dst_bytes;
X};
X
Xstruct udpWriteStruct {
X   int src_count, dst_count;
X   int src_bytes, dst_bytes;
X};
X
Xstruct icmpWriteStruct {
X   unsigned char type, code;
X   unsigned short data;
X   struct in_addr srcaddr, dstaddr, gwaddr;
X};
X
Xstruct physWriteStruct {
X   struct ether_addr ethersrc;
X   struct ether_addr etherdst;
X};
X
Xstruct argWriteStruct {
X   struct timeval time;
X};
X
Xstruct arpWriteStruct {
X   struct timeval time;
X   struct physWriteStruct phys;
X   struct ether_arp arp;
X};
X
Xstruct  ipWriteStruct {
X   struct timeval startime, lasttime;
X   struct physWriteStruct ws_phys;
X   struct in_addr src;
X   struct in_addr dst;
X   u_int port;
X   union {
X      struct  tcpWriteStruct  tcp;
X      struct  udpWriteStruct  udp;
X      struct icmpWriteStruct icmp;
X   } ipws_trans_union;
X};
X
Xstruct manWriteStruct {
X   struct timeval now, uptime;
X   unsigned short reportInterval;
X   unsigned char  interfaceType, interfaceStatus;
X   unsigned long  pktsRcvd, bytesRcvd, pktsDrop;
X   unsigned short rollpktsRcvd, rollbytesRcvd, rollpktsDrop;
X   unsigned short actTCPcons, watTCPcons, cloTCPcons;
X   unsigned short actUDPcons, cloUDPcons;
X   unsigned short actIPcons,  cloIPcons;
X   unsigned char  connAccess, denyAccess;
X};
X
Xstruct WriteStruct {
X   u_int status;
X   union {
X      struct   argWriteStruct arg;
X      struct    ipWriteStruct ip;
X      struct   arpWriteStruct arp;
X      struct   manWriteStruct man;
X   } ws_trans_union;
X};
X
X#define ws_arg ws_trans_union.arg
X#define ws_ip  ws_trans_union.ip
X#define ws_arp ws_trans_union.arp
X#define ws_man ws_trans_union.man
X
X#define ws_ip_src  ws_trans_union.ip.src
X#define ws_ip_dst  ws_trans_union.ip.dst
X#define ws_ip_port ws_trans_union.ip.port
X#define ws_ip_tcp  ws_trans_union.ip.ipws_trans_union.tcp
X#define ws_ip_ucp  ws_trans_union.ip.ipws_trans_union.ucp
X#define ws_ip_icmp ws_trans_union.ip.ipws_trans_union.icmp
X
SHAR_EOF
  $shar_touch -am 0508141295 'argus-1.5/include/cons_out.h' &&
  chmod 0444 'argus-1.5/include/cons_out.h' ||
  echo 'restore of argus-1.5/include/cons_out.h failed'
  shar_count="`wc -c < 'argus-1.5/include/cons_out.h'`"
  test 3395 -eq "$shar_count" ||
    echo "argus-1.5/include/cons_out.h: original size 3395, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/cons_tcp.h ==============
if test -f 'argus-1.5/include/cons_tcp.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/cons_tcp.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/cons_tcp.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/cons_tcp.h' &&
X
X/*
X * Copyright (c) 1993, 1994 Carnegie Mellon University.
X * All rights reserved.
X *
X * Permission to use, copy, modify, and distribute this software and
X * its documentation for any purpose and without fee is hereby granted, 
X * provided that the above copyright notice appear in all copies and
X * that both that copyright notice and this permission notice appear
X * in supporting documentation, and that the name of CMU not be
X * used in advertising or publicity pertaining to distribution of the
X * software without specific, written prior permission.  
X * 
X * CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
X * ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
X * CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
X * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
X * WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
X * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
X * SOFTWARE.
X *
X */
X
X
X#include <netinet/tcp.h>
X
X#define TCPOUTFLAGS
X#define TCPSTATES
X#define TCPTIMEOUT    120
X#define MAXQUEUE  1024
X#define MAX_KLUDGE   10000
X
X#define FIN_WAIT                0x800
X#define SYNSENT                 0x1000
X#define SYNRECEIVED             0x2000
X#define ESTABLISHED             0x4000
X#define CLOSED                  0x8000
X
X
Xstruct TCP_CON_OBJECT {
X   tcp_seq seq_base, seq, ack;
X   int retrans, strays, count, lastcount, lastbytes;
X   u_short win, pad;
X};
X
Xstruct tcpcb {
X   struct timeval startime, lasttime;
X   int t_state, rev, status;
X   struct TCP_CON_OBJECT src, dst;
X};
X
Xstruct TCP_OBJECT {
X   struct QUEUE_HEADER qhdr;
X   struct physLink link;
X   struct tha addr;
X   struct tcpcb tcp_cb;
X};
X
X
X#define TSEQ_HASHSIZE 9029
X
X#ifdef CONS_TCP
X
Xstatic int closed = 0;
Xstruct HASH_TABLE tcp_hash_table;
Xstruct QUEUE tcp_display_list;
Xstruct QUEUE tcp_timeout_list;
X
X#else
X
Xextern int closed;
Xextern struct QUEUE tcp_display_list;
Xextern struct QUEUE tcp_timeout_list;
X#endif
SHAR_EOF
  $shar_touch -am 0508141295 'argus-1.5/include/cons_tcp.h' &&
  chmod 0444 'argus-1.5/include/cons_tcp.h' ||
  echo 'restore of argus-1.5/include/cons_tcp.h failed'
  shar_count="`wc -c < 'argus-1.5/include/cons_tcp.h'`"
  test 2008 -eq "$shar_count" ||
    echo "argus-1.5/include/cons_tcp.h: original size 2008, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/cons_udp.h ==============
if test -f 'argus-1.5/include/cons_udp.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/cons_udp.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/cons_udp.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/cons_udp.h' &&
X
X/*
X * Copyright (c) 1993, 1994 Carnegie Mellon University.
X * All rights reserved.
X *
X * Permission to use, copy, modify, and distribute this software and
X * its documentation for any purpose and without fee is hereby granted, 
X * provided that the above copyright notice appear in all copies and
X * that both that copyright notice and this permission notice appear
X * in supporting documentation, and that the name of CMU not be
X * used in advertising or publicity pertaining to distribution of the
X * software without specific, written prior permission.  
X * 
X * CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
X * ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
X * CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
X * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
X * WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
X * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
X * SOFTWARE.
X *
X */
X
X
X#define UDPTIMEOUT  900
X#define UDPMAXQUEUE  16384
X
Xstruct UDP_CON_OBJECT {
X   int count, lastcount, bytes, lastbytes;
X};
X
Xstruct udpcb {
X   struct timeval startime, lasttime;
X   int rev, status;
X   struct UDP_CON_OBJECT src, dst;
X};
X
X
Xstruct UDP_OBJECT {
X   struct QUEUE_HEADER qhdr;
X   struct physLink link;
X   struct tha addr;
X   struct udpcb udp_cb;
X};
X
X#define USEQ_HASHSIZE 9029
X
Xstruct HASH_TABLE udp_hash_table;
Xstruct QUEUE udp_display_list;
X
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/include/cons_udp.h' &&
  chmod 0444 'argus-1.5/include/cons_udp.h' ||
  echo 'restore of argus-1.5/include/cons_udp.h failed'
  shar_count="`wc -c < 'argus-1.5/include/cons_udp.h'`"
  test 1472 -eq "$shar_count" ||
    echo "argus-1.5/include/cons_udp.h: original size 1472, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/etherent.h ==============
if test -f 'argus-1.5/include/etherent.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/etherent.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/etherent.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/etherent.h' &&
X/*
X * Copyright (c) 1990 The Regents of the University of California.
X * All rights reserved.
X *
X * Redistribution and use in source and binary forms, with or without
X * modification, are permitted provided that: (1) source code distributions
X * retain the above copyright notice and this paragraph in its entirety, (2)
X * distributions including binary code include the above copyright notice and
X * this paragraph in its entirety in the documentation or other materials
X * provided with the distribution, and (3) all advertising materials mentioning
X * features or use of this software display the following acknowledgement:
X * ``This product includes software developed by the University of California,
X * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
X * the University nor the names of its contributors may be used to endorse
X * or promote products derived from this software without specific prior
X * written permission.
X * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
X * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
X * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
X *
X * @(#) $Header: /usr/users/poepping/src/argus/argus-1.5/include/RCS/etherent.h,v 1.1 1995/02/08 21:06:41 poepping Exp $ (LBL)
X */
X
X/* File name of ethernet address data base. */
X
X#define ETHERS_FILE "/etc/ethers"
X
Xstruct etherent {
X	u_char addr[6];
X	char name[122];
X};
X
Xstruct etherent *next_etherent();
X
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/include/etherent.h' &&
  chmod 0444 'argus-1.5/include/etherent.h' ||
  echo 'restore of argus-1.5/include/etherent.h failed'
  shar_count="`wc -c < 'argus-1.5/include/etherent.h'`"
  test 1465 -eq "$shar_count" ||
    echo "argus-1.5/include/etherent.h: original size 1465, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/etherproto.h ==============
if test -f 'argus-1.5/include/etherproto.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/etherproto.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/etherproto.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/etherproto.h' &&
X/*
X * Copyright (c) 1988-1990 The Regents of the University of California.
X * All rights reserved.
X *
X * Redistribution and use in source and binary forms, with or without
X * modification, are permitted provided that: (1) source code distributions
X * retain the above copyright notice and this paragraph in its entirety, (2)
X * distributions including binary code include the above copyright notice and
X * this paragraph in its entirety in the documentation or other materials
X * provided with the distribution, and (3) all advertising materials mentioning
X * features or use of this software display the following acknowledgement:
X * ``This product includes software developed by the University of California,
X * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
X * the University nor the names of its contributors may be used to endorse
X * or promote products derived from this software without specific prior
X * written permission.
X * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
X * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
X * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
X *
X * @(#) $Header: /usr/users/poepping/src/argus/argus-1.5/include/RCS/etherproto.h,v 1.1 1995/02/08 21:06:41 poepping Exp $ (LBL)
X */
X
X/* Map between Ethernet protocol types and names */
X
X/* Add other Ethernet packet types here */
X#ifndef	ETHERTYPE_SPRITE
X#define	ETHERTYPE_SPRITE	0x0500
X#endif
X#ifndef	ETHERTYPE_MOPDL
X#define	ETHERTYPE_MOPDL		0x6001
X#endif
X#ifndef	ETHERTYPE_MOPRC
X#define	ETHERTYPE_MOPRC		0x6002
X#endif
X#ifndef	ETHERTYPE_MOP
X#define	ETHERTYPE_MOP		0x6001
X#endif
X#ifndef	ETHERTYPE_LAVC
X#define	ETHERTYPE_LAVC		0x6007
X#endif
X#ifndef	ETHERTYPE_DN
X#define	ETHERTYPE_DN		0x6003
X#endif
X#ifndef	ETHERTYPE_LAT
X#define	ETHERTYPE_LAT		0x6004
X#endif
X#ifndef	ETHERTYPE_LANBRIDGE
X#define	ETHERTYPE_LANBRIDGE	0x8038
X#endif
X#ifndef	ETHERTYPE_VEXP
X#define	ETHERTYPE_VEXP		0x805b
X#endif
X#ifndef	ETHERTYPE_VPROD
X#define	ETHERTYPE_VPROD		0x805c
X#endif
X#ifndef	ETHERTYPE_LOOPBACK
X#define	ETHERTYPE_LOOPBACK	0x9000
X#endif
X
X#ifndef ETHERTYPE_ATALK
X#define ETHERTYPE_ATALK		0x809b /* XXX */
X#endif
X#ifndef ETHERTYPE_AARP
X#define ETHERTYPE_AARP		0x80f3
X#endif
X#ifndef ETHERTYPE_NS
X#define ETHERTYPE_NS		0x0600
X#endif
X
Xstruct eproto {
X	char *s;
X	u_short p;
X};
X
Xextern struct eproto eproto_db[];
X#ifndef ETHERTYPE_PUP
X#define ETHERTYPE_PUP           0x0200
X#endif
X#ifndef ETHERTYPE_PUPAT
X#define ETHERTYPE_PUPAT         0x0201
X#endif
X#ifndef ETHERTYPE_XNSIDP
X#define ETHERTYPE_XNSIDP        0x0600
X#endif
X#ifndef ETHERTYPE_X_75
X#define ETHERTYPE_X_75          0x0801
X#endif
X#ifndef ETHERTYPE_NBS
X#define ETHERTYPE_NBS           0x0802
X#endif
X#ifndef ETHERTYPE_ECMA
X#define ETHERTYPE_ECMA          0x0803
X#endif
X#ifndef ETHERTYPE_CHAOSNET
X#define ETHERTYPE_CHAOSNET      0x0804
X#endif
X#ifndef ETHERTYPE_X_25
X#define ETHERTYPE_X_25          0x0805
X#endif
X#ifndef ETHERTYPE_SYMBOLICS
X#define ETHERTYPE_SYMBOLICS     0x081C
X#endif
X#ifndef ETHERTYPE_IEEE802_3PUP
X#define ETHERTYPE_IEEE802_3PUP  0x0A00
X#endif
X#ifndef ETHERTYPE_IEEE802_3PUPAT
X#define ETHERTYPE_IEEE802_3PUPAT 0x0A01
X#endif
X#ifndef ETHERTYPE_BANYAN
X#define ETHERTYPE_BANYAN        0x0BAD
X#endif
X#ifndef ETHERTYPE_VALID
X#define ETHERTYPE_VALID         0x1600
X#endif
X#ifndef ETHERTYPE_PCS
X#define ETHERTYPE_PCS           0x4242
X#endif
X#ifndef ETHERTYPE_SIMNET
X#define ETHERTYPE_SIMNET        0x5208
X#endif
X#ifndef ETHERTYPE_3COM
X#define ETHERTYPE_3COM          0x6010
X#endif
X#ifndef ETHERTYPE_3COM
X#define ETHERTYPE_3COM          0x6011
X#endif
X#ifndef ETHERTYPE_3COM
X#define ETHERTYPE_3COM          0x6012
X#endif
X#ifndef ETHERTYPE_3COM
X#define ETHERTYPE_3COM          0x6013
X#endif
X#ifndef ETHERTYPE_3COM
X#define ETHERTYPE_3COM          0x6014
X#endif
X#ifndef ETHERTYPE_UBDOWNLOAD
X#define ETHERTYPE_UBDOWNLOAD    0x7000
X#endif
X#ifndef ETHERTYPE_UBDIAGNOSTIC
X#define ETHERTYPE_UBDIAGNOSTIC  0x7002
X#endif
X#ifndef ETHERTYPE_UBUNKNOWN
X#define ETHERTYPE_UBUNKNOWN     0x7005
X#endif
X#ifndef ETHERTYPE_LRT
X#define ETHERTYPE_LRT           0x7020
X#endif
X#ifndef ETHERTYPE_LRT
X#define ETHERTYPE_LRT           0x7021
X#endif
X#ifndef ETHERTYPE_LRT
X#define ETHERTYPE_LRT           0x7022
X#endif
X#ifndef ETHERTYPE_LRT
X#define ETHERTYPE_LRT           0x7023
X#endif
X#ifndef ETHERTYPE_LRT
X#define ETHERTYPE_LRT           0x7024
X#endif
X#ifndef ETHERTYPE_LRT
X#define ETHERTYPE_LRT           0x7025
X#endif
X#ifndef ETHERTYPE_LRT
X#define ETHERTYPE_LRT           0x7026
X#endif
X#ifndef ETHERTYPE_LRT
X#define ETHERTYPE_LRT           0x7027
X#endif
X#ifndef ETHERTYPE_LRT
X#define ETHERTYPE_LRT           0x7028
X#endif
X#ifndef ETHERTYPE_LRT
X#define ETHERTYPE_LRT           0x7029
X#endif
X#ifndef ETHERTYPE_PROTEON
X#define ETHERTYPE_PROTEON       0x7030
X#endif
X#ifndef ETHERTYPE_CABLETRON
X#define ETHERTYPE_CABLETRON     0x7034
X#endif
X#ifndef ETHERTYPE_CRONUSVLN
X#define ETHERTYPE_CRONUSVLN     0x8003
X#endif
X#ifndef ETHERTYPE_CRONUSDIRECT
X#define ETHERTYPE_CRONUSdIRECT  0x8004
X#endif
X#ifndef ETHERTYPE_HPPROBE
X#define ETHERTYPE_HPPROBE       0x8005
X#endif
X#ifndef ETHERTYPE_NESTAR
X#define ETHERTYPE_NESTAR        0x8006
X#endif
X#ifndef ETHERTYPE_ATT
X#define ETHERTYPE_ATT           0x8008
X#endif
X#ifndef ETHERTYPE_EXCELAN
X#define ETHERTYPE_EXCELAN       0x8010
X#endif
X#ifndef ETHERTYPE_SGIDIAGNOSTIC
X#define ETHERTYPE_SGIDIAGNOSTIC 0x8013
X#endif
X#ifndef ETHERTYPE_SGIGAMES
X#define ETHERTYPE_SGIGAMES      0x8014
X#endif
X#ifndef ETHERTYPE_SGIRESERVED
X#define ETHERTYPE_SGIRESERVED   0x8015
X#endif
X#ifndef ETHERTYPE_SGIXNS
X#define ETHERTYPE_SGIXNS        0x8016
X#endif
X#ifndef ETHERTYPE_APOLLO
X#define ETHERTYPE_APOLLO        0x8019
X#endif
X#ifndef ETHERTYPE_TYMSHARE
X#define ETHERTYPE_TYMSHARE      0x802E
X#endif
X#ifndef ETHERTYPE_TIGAN
X#define ETHERTYPE_TIGAN         0x802F
X#endif
X#ifndef ETHERTYPE_AEONIC
X#define ETHERTYPE_AEONIC        0x8036
X#endif
X#ifndef ETHERTYPE_PLANNING
X#define ETHERTYPE_PLANNING      0x8044
X#endif
X#ifndef ETHERTYPE_ATT
X#define ETHERTYPE_ATT           0x8046
X#endif
X#ifndef ETHERTYPE_ATT
X#define ETHERTYPE_ATT           0x8047
X#endif
X#ifndef ETHERTYPE_EXPERDATA
X#define ETHERTYPE_EXPERDATA     0x8049
X#endif
X#ifndef ETHERTYPE_VEXPERIMENTAL
X#define ETHERTYPE_VEXPERIMENTAL 0x805B
X#endif
X#ifndef ETHERTYPE_VPRODUCTION
X#define ETHERTYPE_VPRODUCTION   0x805C
X#endif
X#ifndef ETHERTYPE_ES
X#define ETHERTYPE_ES            0x805D
X#endif
X#ifndef ETHERTYPE_LITTLE
X#define ETHERTYPE_LITTLE        0x8060
X#endif
X#ifndef ETHERTYPE_COUNTERPOINT
X#define ETHERTYPE_COUNTERPOINT  0x8062
X#endif
X#ifndef ETHERTYPE_UOFM
X#define ETHERTYPE_UOFM          0x8065
X#endif
X#ifndef ETHERTYPE_UOFM
X#define ETHERTYPE_UOFM          0x8066
X#endif
X#ifndef ETHERTYPE_VEECO
X#define ETHERTYPE_VEECO         0x8067
X#endif
X#ifndef ETHERTYPE_GD
X#define ETHERTYPE_GD            0x8068
X#endif
X#ifndef ETHERTYPE_ATT
X#define ETHERTYPE_ATT           0x8069
X#endif
X#ifndef ETHERTYPE_AUTOPHON
X#define ETHERTYPE_AUTOPHON      0x806A
X#endif
X#ifndef ETHERTYPE_COMDESIGN
X#define ETHERTYPE_COMDESIGN     0x806C
X#endif
X#ifndef ETHERTYPE_COMPUGRAPHIC
X#define ETHERTYPE_COMPUGRAPHIC  0x806D
X#endif
X#ifndef ETHERTYPE_MANTRA
X#define ETHERTYPE_MANTRA        0x807A
X#endif
X#ifndef ETHERTYPE_DANSK
X#define ETHERTYPE_DANSK         0x807B
X#endif
X#ifndef ETHERTYPE_MERIT
X#define ETHERTYPE_MERIT         0x807C
X#endif
X#ifndef ETHERTYPE_VITALINK
X#define ETHERTYPE_VITALINK      0x807D
X#endif
X#ifndef ETHERTYPE_VITALINK
X#define ETHERTYPE_VITALINK      0x807E
X#endif
X#ifndef ETHERTYPE_VITALINK
X#define ETHERTYPE_VITALINK      0x807F
X#endif
X#ifndef ETHERTYPE_VITALINK
X#define ETHERTYPE_VITALINK      0x8080
X#endif
X#ifndef ETHERTYPE_COUNTERPOINT
X#define ETHERTYPE_COUNTERPOINT  0x8081
X#endif
X#ifndef ETHERTYPE_COUNTERPOINT
X#define ETHERTYPE_COUNTERPOINT  0x8082
X#endif
X#ifndef ETHERTYPE_COUNTERPOINT
X#define ETHERTYPE_COUNTERPOINT  0x8083
X#endif
X#ifndef ETHERTYPE_ETHERTALK
X#define ETHERTYPE_ETHERTALK     0x809B
X#endif
X#ifndef ETHERTYPE_DATABILITY
X#define ETHERTYPE_DATABILITY    0x809C
X#endif
X#ifndef ETHERTYPE_DATABILITY
X#define ETHERTYPE_DATABILITY    0x809D
X#endif
X#ifndef ETHERTYPE_DATABILITY
X#define ETHERTYPE_DATABILITY    0x809E
X#endif
X#ifndef ETHERTYPE_SPIDER
X#define ETHERTYPE_SPIDER        0x809F
X#endif
X#ifndef ETHERTYPE_NIXDORF
X#define ETHERTYPE_NIXDORF       0x80A3
X#endif
X#ifndef ETHERTYPE_SIEMENS
X#define ETHERTYPE_SIEMENS       0x80A4
X#endif
X#ifndef ETHERTYPE_SIEMENS
X#define ETHERTYPE_SIEMENS       0x80A5
X#endif
X#ifndef ETHERTYPE_SIEMENS
X#define ETHERTYPE_SIEMENS       0x80A6
X#endif
X#ifndef ETHERTYPE_SIEMENS
X#define ETHERTYPE_SIEMENS       0x80A7
X#endif
X#ifndef ETHERTYPE_SIEMENS
X#define ETHERTYPE_SIEMENS       0x80A8
X#endif
X#ifndef ETHERTYPE_SIEMENS
X#define ETHERTYPE_SIEMENS       0x80A9
X#endif
X#ifndef ETHERTYPE_SIEMENS
X#define ETHERTYPE_SIEMENS       0x80AA
X#endif
X#ifndef ETHERTYPE_SIEMENS
X#define ETHERTYPE_SIEMENS       0x80AB
X#endif
X#ifndef ETHERTYPE_SIEMENS
X#define ETHERTYPE_SIEMENS       0x80AC
X#endif
X#ifndef ETHERTYPE_SIEMENS
X#define ETHERTYPE_SIEMENS       0x80AD
X#endif
X#ifndef ETHERTYPE_SIEMENS
X#define ETHERTYPE_SIEMENS       0x80AE
X#endif
X#ifndef ETHERTYPE_SIEMENS
X#define ETHERTYPE_SIEMENS       0x80AF
X#endif
X#ifndef ETHERTYPE_SIEMENS
X#define ETHERTYPE_SIEMENS       0x80B0
X#endif
X#ifndef ETHERTYPE_SIEMENS
X#define ETHERTYPE_SIEMENS       0x80B1
X#endif
X#ifndef ETHERTYPE_SIEMENS
X#define ETHERTYPE_SIEMENS       0x80B2
X#endif
X#ifndef ETHERTYPE_SIEMENS
X#define ETHERTYPE_SIEMENS       0x80B3
X#endif
X#ifndef ETHERTYPE_DCA
X#define ETHERTYPE_DCA           0x80C0
X#endif
X#ifndef ETHERTYPE_DCA
X#define ETHERTYPE_DCA           0x80C1
X#endif
X#ifndef ETHERTYPE_DCA
X#define ETHERTYPE_DCA           0x80C2
X#endif
X#ifndef ETHERTYPE_DCA
X#define ETHERTYPE_DCA           0x80C3
X#endif
X#ifndef ETHERTYPE_PACER
X#define ETHERTYPE_PACER         0x80C6
X#endif
X#ifndef ETHERTYPE_APPLITEK
X#define ETHERTYPE_APPLITEK      0x80C7
X#endif
X#ifndef ETHERTYPE_INTERGRAPH
X#define ETHERTYPE_INTERGRAPH    0x80C8
X#endif
X#ifndef ETHERTYPE_INTERGRAPH
X#define ETHERTYPE_INTERGRAPH    0x80C9
X#endif
X#ifndef ETHERTYPE_INTERGRAPH
X#define ETHERTYPE_INTERGRAPH    0x80CA
X#endif
X#ifndef ETHERTYPE_INTERGRAPH
X#define ETHERTYPE_INTERGRAPH    0x80CB
X#endif
X#ifndef ETHERTYPE_INTERGRAPH
X#define ETHERTYPE_INTERGRAPH    0x80CC
X#endif
X#ifndef ETHERTYPE_HARRIS
X#define ETHERTYPE_HARRIS        0x80CD
X#endif
X#ifndef ETHERTYPE_HARRIS
X#define ETHERTYPE_HARRIS        0x80CE
X#endif
X#ifndef ETHERTYPE_TAYLOR
X#define ETHERTYPE_TAYLOR        0x80CF
X#endif
X#ifndef ETHERTYPE_TAYLOR
X#define ETHERTYPE_TAYLOR        0x80D0
X#endif
X#ifndef ETHERTYPE_TAYLOR
X#define ETHERTYPE_TAYLOR        0x80D1
X#endif
X#ifndef ETHERTYPE_TAYLOR
X#define ETHERTYPE_TAYLOR        0x80D2
X#endif
X#ifndef ETHERTYPE_ROSEMOUNT
X#define ETHERTYPE_ROSEMOUNT     0x80D3
X#endif
X#ifndef ETHERTYPE_ROSEMOUNT
X#define ETHERTYPE_ROSEMOUNT     0x80D4
X#endif
X#ifndef ETHERTYPE_SNA
X#define ETHERTYPE_SNA           0x80D5
X#endif
X#ifndef ETHERTYPE_VARIAN
X#define ETHERTYPE_VARIAN        0x80DD
X#endif
X#ifndef ETHERTYPE_TRFS
X#define ETHERTYPE_TRFS          0x80DE
X#endif
X#ifndef ETHERTYPE_INTEGRATED
X#define ETHERTYPE_INTEGRATED    0x80DF
X#endif
X#ifndef ETHERTYPE_ALLENBRADLEY
X#define ETHERTYPE_ALLENBRADLEY  0x80E0
X#endif
X#ifndef ETHERTYPE_ALLENBRADLEY
X#define ETHERTYPE_ALLENBRADLEY  0x80E1
X#endif
X#ifndef ETHERTYPE_ALLENBRADLEY
X#define ETHERTYPE_ALLENBRADLEY  0x80E2
X#endif
X#ifndef ETHERTYPE_ALLENBRADLEY
X#define ETHERTYPE_ALLENBRADLEY  0x80E3
X#endif
X#ifndef ETHERTYPE_DATABILITY
X#define ETHERTYPE_DATABILITY    0x80E4
X#endif
X#ifndef ETHERTYPE_DATABILITY
X#define ETHERTYPE_DATABILITY    0x80E5
X#endif
X#ifndef ETHERTYPE_DATABILITY
X#define ETHERTYPE_DATABILITY    0x80E6
X#endif
X#ifndef ETHERTYPE_DATABILITY
X#define ETHERTYPE_DATABILITY    0x80E7
X#endif
X#ifndef ETHERTYPE_DATABILITY
X#define ETHERTYPE_DATABILITY    0x80E8
X#endif
X#ifndef ETHERTYPE_DATABILITY
X#define ETHERTYPE_DATABILITY    0x80E9
X#endif
X#ifndef ETHERTYPE_DATABILITY
X#define ETHERTYPE_DATABILITY    0x80EA
X#endif
X#ifndef ETHERTYPE_DATABILITY
X#define ETHERTYPE_DATABILITY    0x80EB
X#endif
X#ifndef ETHERTYPE_DATABILITY
X#define ETHERTYPE_DATABILITY    0x80EC
X#endif
X#ifndef ETHERTYPE_DATABILITY
X#define ETHERTYPE_DATABILITY    0x80ED
X#endif
X#ifndef ETHERTYPE_DATABILITY
X#define ETHERTYPE_DATABILITY    0x80EE
X#endif
X#ifndef ETHERTYPE_DATABILITY
X#define ETHERTYPE_DATABILITY    0x80EF
X#endif
X#ifndef ETHERTYPE_DATABILITY
X#define ETHERTYPE_DATABILITY    0x80F0
X#endif
X#ifndef ETHERTYPE_RETIX
X#define ETHERTYPE_RETIX         0x80F2
X#endif
X#ifndef ETHERTYPE_KINETICS
X#define ETHERTYPE_KINETICS      0x80F4
X#endif
X#ifndef ETHERTYPE_KINETICS
X#define ETHERTYPE_KINETICS      0x80F5
X#endif
X#ifndef ETHERTYPE_APOLLO
X#define ETHERTYPE_APOLLO        0x80F7
X#endif
X#ifndef ETHERTYPE_WELLFLEET
X#define ETHERTYPE_WELLFLEET     0x80FF
X#endif
X#ifndef ETHERTYPE_WELLFLEET
X#define ETHERTYPE_WELLFLEET     0x8100
X#endif
X#ifndef ETHERTYPE_WELLFLEET
X#define ETHERTYPE_WELLFLEET     0x8101
X#endif
X#ifndef ETHERTYPE_WELLFLEET
X#define ETHERTYPE_WELLFLEET     0x8102
X#endif
X#ifndef ETHERTYPE_WELLFLEET
X#define ETHERTYPE_WELLFLEET     0x8103
X#endif
X#ifndef ETHERTYPE_SYMBOLICS
X#define ETHERTYPE_SYMBOLICS     0x8107
X#endif
X#ifndef ETHERTYPE_SYMBOLICS
X#define ETHERTYPE_SYMBOLICS     0x8108
X#endif
X#ifndef ETHERTYPE_SYMBOLICS
X#define ETHERTYPE_SYMBOLICS     0x8109
X#endif
X#ifndef ETHERTYPE_WATERLOO
X#define ETHERTYPE_WATERLOO      0x8130
X#endif
X#ifndef ETHERTYPE_VGLABS
X#define ETHERTYPE_VGLABS        0x8131
X#endif
X#ifndef ETHERTYPE_NOVELL
X#define ETHERTYPE_NOVELL        0x8137
X#endif
X#ifndef ETHERTYPE_NOVELL
X#define ETHERTYPE_NOVELL        0x8138
X#endif
X#ifndef ETHERTYPE_KTI
X#define ETHERTYPE_KTI           0x8139
X#endif
X#ifndef ETHERTYPE_KTI
X#define ETHERTYPE_KTI           0x813A
X#endif
X#ifndef ETHERTYPE_KTI
X#define ETHERTYPE_KTI           0x813B
X#endif
X#ifndef ETHERTYPE_KTI
X#define ETHERTYPE_KTI           0x813C
X#endif
X#ifndef ETHERTYPE_KTI
X#define ETHERTYPE_KTI           0x813D
X#endif
X#ifndef ETHERTYPE_SNMP
X#define ETHERTYPE_SNMP          0x814C
X#endif
X#ifndef ETHERTYPE_LOOPBACK
X#define ETHERTYPE_LOOPBACK      0x9000
X#endif
X#ifndef ETHERTYPE_BRIDGE
X#define ETHERTYPE_BRIDGE        0x9001
X#endif
X#ifndef ETHERTYPE_BRIDGE
X#define ETHERTYPE_BRIDGE        0x9002
X#endif
X#ifndef ETHERTYPE_BRIDGE
X#define ETHERTYPE_BRIDGE        0x9003
X#endif
X#ifndef ETHERTYPE_VITAL
X#define ETHERTYPE_VITAL         0xFF00
X#endif
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/include/etherproto.h' &&
  chmod 0444 'argus-1.5/include/etherproto.h' ||
  echo 'restore of argus-1.5/include/etherproto.h failed'
  shar_count="`wc -c < 'argus-1.5/include/etherproto.h'`"
  test 14240 -eq "$shar_count" ||
    echo "argus-1.5/include/etherproto.h: original size 14240, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/extract.h ==============
if test -f 'argus-1.5/include/extract.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/extract.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/extract.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/extract.h' &&
X/*
X * Copyright (c) 1992, 1993, 1994
X *	The Regents of the University of California.  All rights reserved.
X *
X * Redistribution and use in source and binary forms, with or without
X * modification, are permitted provided that: (1) source code distributions
X * retain the above copyright notice and this paragraph in its entirety, (2)
X * distributions including binary code include the above copyright notice and
X * this paragraph in its entirety in the documentation or other materials
X * provided with the distribution, and (3) all advertising materials mentioning
X * features or use of this software display the following acknowledgement:
X * ``This product includes software developed by the University of California,
X * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
X * the University nor the names of its contributors may be used to endorse
X * or promote products derived from this software without specific prior
X * written permission.
X * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
X * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
X * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
X *
X * @(#) $Header: /usr/users/poepping/src/argus/argus-1.5/include/RCS/extract.h,v 1.1 1995/02/08 21:06:41 poepping Exp $ (LBL)
X */
X
X#ifdef TCPDUMP_ALIGN
X#if BYTEORDER == LITTLE_ENDIAN
X#define EXTRACT_SHORT(p)\
X	((u_short)\
X		((u_short)*((u_char *)p+1)<<8|\
X		 (u_short)*((u_char *)p+0)<<0))
X#define EXTRACT_LONG(p)\
X		((u_int32)*((u_char *)p+3)<<24|\
X		 (u_int32)*((u_char *)p+2)<<16|\
X		 (u_int32)*((u_char *)p+1)<<8|\
X		 (u_int32)*((u_char *)p+0)<<0)
X#else
X#define EXTRACT_SHORT(p)\
X	((u_short)\
X		((u_short)*((u_char *)p+0)<<8|\
X		 (u_short)*((u_char *)p+1)<<0))
X#define EXTRACT_LONG(p)\
X		((u_int32)*((u_char *)p+0)<<24|\
X		 (u_int32)*((u_char *)p+1)<<16|\
X		 (u_int32)*((u_char *)p+2)<<8|\
X		 (u_int32)*((u_char *)p+3)<<0)
X#endif
X#else
X#define EXTRACT_SHORT(p)	((u_short)ntohs(*(u_short *)p))
X#define EXTRACT_LONG(p)		(ntohl(*(u_int32 *)p))
X#endif
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/include/extract.h' &&
  chmod 0444 'argus-1.5/include/extract.h' ||
  echo 'restore of argus-1.5/include/extract.h failed'
  shar_count="`wc -c < 'argus-1.5/include/extract.h'`"
  test 2024 -eq "$shar_count" ||
    echo "argus-1.5/include/extract.h: original size 2024, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/fddi.h ==============
if test -f 'argus-1.5/include/fddi.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/fddi.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/fddi.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/fddi.h' &&
X/*
X * Copyright (c) 1992, 1993, 1994
X *	The Regents of the University of California.  All rights reserved.
X *
X * Redistribution and use in source and binary forms, with or without
X * modification, are permitted provided that: (1) source code distributions
X * retain the above copyright notice and this paragraph in its entirety, (2)
X * distributions including binary code include the above copyright notice and
X * this paragraph in its entirety in the documentation or other materials
X * provided with the distribution, and (3) all advertising materials mentioning
X * features or use of this software display the following acknowledgement:
X * ``This product includes software developed by the University of California,
X * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
X * the University nor the names of its contributors may be used to endorse
X * or promote products derived from this software without specific prior
X * written permission.
X * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
X * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
X * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
X *
X * @(#) $Header: /usr/users/poepping/src/argus/argus-1.5/include/RCS/fddi.h,v 1.1 1995/02/08 21:06:41 poepping Exp $ (LBL)
X */
X
X/*
X * Based on Ultrix if_fddi.h
X */
X
X/*
X * This stuff should come from a system header file, but there's no
X * obviously portable way to do that and it's not really going
X * to change from system to system (except for the padding business).
X */
X
Xstruct fddi_header {
X#if defined(ultrix) || defined(__alpha)
X	/* Ultrix pads to make everything line up on a nice boundary */
X#define	FDDIPAD	3
X	u_char  fddi_ph[FDDIPAD];
X#else
X#define	FDDIPAD	0
X#endif
X	u_char  fddi_fc;		/* frame control */
X	u_char  fddi_dhost[6];
X	u_char  fddi_shost[6];
X};
X
X
X/* Useful values for fddi_fc (frame control) field */
X
X/*
X * FDDI Frame Control bits
X */
X#define	FDDIFC_C		0x80		/* Class bit */
X#define	FDDIFC_L		0x40		/* Address length bit */
X#define	FDDIFC_F		0x30		/* Frame format bits */
X#define	FDDIFC_Z		0x0f		/* Control bits */
X
X/*
X * FDDI Frame Control values. (48-bit addressing only).
X */
X#define	FDDIFC_VOID		0x40		/* Void frame */
X#define	FDDIFC_NRT		0x80		/* Nonrestricted token */
X#define	FDDIFC_RT		0xc0		/* Restricted token */
X#define	FDDIFC_SMT_INFO		0x41		/* SMT Info */
X#define	FDDIFC_SMT_NSA		0x4F		/* SMT Next station adrs */
X#define	FDDIFC_MAC_BEACON	0xc2		/* MAC Beacon frame */
X#define	FDDIFC_MAC_CLAIM	0xc3		/* MAC Claim frame */
X#define	FDDIFC_LLC_ASYNC	0x50		/* Async. LLC frame */
X#define	FDDIFC_LLC_SYNC		0xd0		/* Sync. LLC frame */
X#define	FDDIFC_IMP_ASYNC	0x60		/* Implementor Async. */
X#define	FDDIFC_IMP_SYNC		0xe0		/* Implementor Synch. */
X#define FDDIFC_SMT		0x40		/* SMT frame */
X#define FDDIFC_MAC		0xc0		/* MAC frame */
X
X#define	FDDIFC_CLFF		0xF0		/* Class/Length/Format bits */
X#define	FDDIFC_ZZZZ		0x0F		/* Control bits */
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/include/fddi.h' &&
  chmod 0444 'argus-1.5/include/fddi.h' ||
  echo 'restore of argus-1.5/include/fddi.h failed'
  shar_count="`wc -c < 'argus-1.5/include/fddi.h'`"
  test 2937 -eq "$shar_count" ||
    echo "argus-1.5/include/fddi.h: original size 2937, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/inet.h ==============
if test -f 'argus-1.5/include/inet.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/inet.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/inet.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/inet.h' &&
X/*
X * Copyright (c) 1988-1990 The Regents of the University of California.
X * All rights reserved.
X *
X * Redistribution and use in source and binary forms, with or without
X * modification, are permitted provided that: (1) source code distributions
X * retain the above copyright notice and this paragraph in its entirety, (2)
X * distributions including binary code include the above copyright notice and
X * this paragraph in its entirety in the documentation or other materials
X * provided with the distribution, and (3) all advertising materials mentioning
X * features or use of this software display the following acknowledgement:
X * ``This product includes software developed by the University of California,
X * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
X * the University nor the names of its contributors may be used to endorse
X * or promote products derived from this software without specific prior
X * written permission.
X * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
X * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
X * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
X *
X * @(#) $Header: /usr/users/poepping/src/argus/argus-1.5/include/RCS/inet.h,v 1.1 1995/02/08 21:06:41 poepping Exp $ (LBL)
X */
X
X#ifndef __STDC__
X#define const
X#endif
X#ifdef __GNUC__
X#define inline __inline
X#else
X#define inline
X#endif
X
X#define	LOCAL_NETS(i)		(((long)(i) & 0x82cf0000) == 0x82cf0000)
X
X
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/include/inet.h' &&
  chmod 0444 'argus-1.5/include/inet.h' ||
  echo 'restore of argus-1.5/include/inet.h failed'
  shar_count="`wc -c < 'argus-1.5/include/inet.h'`"
  test 1465 -eq "$shar_count" ||
    echo "argus-1.5/include/inet.h: original size 1465, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/interface.h ==============
if test -f 'argus-1.5/include/interface.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/interface.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/interface.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/interface.h' &&
X/*
X * Copyright (c) 1988-1990 The Regents of the University of California.
X * All rights reserved.
X *
X * Redistribution and use in source and binary forms, with or without
X * modification, are permitted provided that: (1) source code distributions
X * retain the above copyright notice and this paragraph in its entirety, (2)
X * distributions including binary code include the above copyright notice and
X * this paragraph in its entirety in the documentation or other materials
X * provided with the distribution, and (3) all advertising materials mentioning
X * features or use of this software display the following acknowledgement:
X * ``This product includes software developed by the University of California,
X * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
X * the University nor the names of its contributors may be used to endorse
X * or promote products derived from this software without specific prior
X * written permission.
X * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
X * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
X * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
X *
X * @(#) $Header: /usr/users/poepping/src/argus/argus-1.5/include/RCS/interface.h,v 1.1 1995/02/08 21:06:41 poepping Exp $ (LBL)
X */
X
X#ifndef __STDC__
X#define const
X#endif
X#ifdef __GNUC__
X#define inline __inline
X#else
X#define inline
X#endif
X
X#include "md.h"			/* machine dependent stuff */
X#include "os.h"			/* os dependent stuff */
X
X#ifndef SIGRET
X#define SIGRET void             /* default */
X#endif
X 
Xstruct token {
X        int v;                  /* value */
X        char *s;                /* string */
X};
X
X
X#ifndef __STDC__
Xextern char *malloc();
Xextern char *calloc();
X#endif
X
Xtypedef u_long u_int32;
X
X#ifdef ARGUS
X
X#define MIN_SNAPLEN 96
X
Xint dflag = 0;		/* print interval code */
Xint wflag = 0;		/* write tcp connection data to wfile*/
Xint nflag = 0;		/* leave addresses as numbers*/
Xint debugflag = 0;	/* set debug level */
Xint tcptimeout = 0;	/* set TCP timeout value (default TCPTIMEOUT) */
Xint udptimeout = 0;	/* set UDP timeout value (default UDPTIMEOUT) */
Xint  iptimeout = 0;	/* set  IP timeout value (default  IPTIMEOUT) */
Xint Nflag;               /* remove domains from printed host names */
X
Xchar *wfile;
Xchar *program_name;
X
Xdouble update_interval = 1.0, update_time = 0.0;
Xint updatecounter = 0;
X 
Xextern pcap_handler lookup_pcap_callback ();
X 
Xint lfd = -1;
Xint snaplen = MIN_SNAPLEN;
X
Xfd_set readmask, writemask, exceptmask;
X
Xpcap_t *pd = NULL;
X
X#define ARGUS_PORT      561
X
X#else
X
Xextern int dflag;		/* print interval code */
Xextern int wflag;		/* write tcp connection data */
Xextern int nflag;		/* leave addresses as numbers*/
Xextern int debugflag;		/* set debug level */
Xextern int tcptimeout;		/* set TCP timeout value (default TCPTIMEOUT) */
Xextern int udptimeout;		/* set UDP timeout value (default UDPTIMEOUT) */
Xextern int  iptimeout;		/* set  IP timeout value (default  IPTIMEOUT) */
Xextern int Nflag;               /* remove domains from printed host names */
X
Xextern double update_interval;
Xextern int updatecounter;
X
Xextern char *wfile;
Xextern char *program_name;
X
Xextern int lfd;
Xextern int snaplen;
X
Xextern fd_set readmask, writemask, exceptmask;
Xextern pcap_t *pd;
X#endif
X
X#define min(a,b) ((a)>(b)?(b):(a))
X#define max(a,b) ((b)>(a)?(b):(a))
X
Xextern char timestamp_fmt[];
Xextern long timestamp_scale;
Xextern void timestampinit();
X
Xextern int fn_print(const u_char *, const u_char *);
Xextern int fn_printn(const u_char *, u_int, const u_char *);
Xextern const char *tok2str(const struct token *, const char *, int);
Xextern char *dnaddr_string(u_short);
Xextern char *savestr(const char *);
X
Xextern char *isonsap_string(const u_char *);
Xextern char *llcsap_string(u_char);
Xextern char *protoid_string(const u_char *);
Xextern char *dnname_string(u_short);
Xextern char *dnnum_string(u_short);
X
X
X
X#ifndef BIG_ENDIAN
X#define BIG_ENDIAN 4321
X#define LITTLE_ENDIAN 1234
X#endif
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/include/interface.h' &&
  chmod 0444 'argus-1.5/include/interface.h' ||
  echo 'restore of argus-1.5/include/interface.h failed'
  shar_count="`wc -c < 'argus-1.5/include/interface.h'`"
  test 3969 -eq "$shar_count" ||
    echo "argus-1.5/include/interface.h: original size 3969, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/llc.h ==============
if test -f 'argus-1.5/include/llc.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/llc.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/llc.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/llc.h' &&
X/*
X * Copyright (c) 1993, 1994
X *	The Regents of the University of California.  All rights reserved.
X *
X * Redistribution and use in source and binary forms, with or without
X * modification, are permitted provided that: (1) source code distributions
X * retain the above copyright notice and this paragraph in its entirety, (2)
X * distributions including binary code include the above copyright notice and
X * this paragraph in its entirety in the documentation or other materials
X * provided with the distribution, and (3) all advertising materials mentioning
X * features or use of this software display the following acknowledgement:
X * ``This product includes software developed by the University of California,
X * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
X * the University nor the names of its contributors may be used to endorse
X * or promote products derived from this software without specific prior
X * written permission.
X * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
X * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
X * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
X *
X * @(#) $Header: /usr/users/poepping/src/argus/argus-1.5/include/RCS/llc.h,v 1.1 1995/02/08 21:06:41 poepping Exp $ (LBL)
X */
X
X/*
X * This stuff should come from a system header file, but there's no
X * obviously portable way to do that and it's not really going
X * to change from system to system.
X */
X
X/*
X * A somewhat abstracted view of the LLC header
X */
X
Xstruct llc {
X	u_char dsap;
X	u_char ssap;
X	union {
X		u_char u_ctl;
X		u_short is_ctl;
X		struct {
X			u_char snap_ui;
X			u_char snap_pi[5];
X		} snap;
X		struct {
X			u_char snap_ui;
X			u_char snap_orgcode[3];
X			u_char snap_ethertype[2];
X		} snap_ether;
X	} ctl;
X};
X
X#define	llcui		ctl.snap.snap_ui
X#define	llcpi		ctl.snap.snap_pi
X#define	orgcode		ctl.snap_ether.snap_orgcode
X#define	ethertype	ctl.snap_ether.snap_ethertype
X#define	llcis		ctl.is_ctl
X#define	llcu		ctl.u_ctl
X
X#define	LLC_U_FMT	3
X#define	LLC_GSAP	1
X#define LLC_S_FMT	1
X
X#define	LLC_U_POLL	0x10
X#define	LLC_IS_POLL	0x0001
X#define	LLC_XID_FI	0x81
X
X#define	LLC_U_CMD(u)	((u) & 0xef)
X#define	LLC_UI		0x03
X#define	LLC_UA		0x63
X#define	LLC_DISC	0x43
X#define	LLC_DM		0x0f
X#define	LLC_SABME	0x6f
X#define	LLC_TEST	0xe3
X#define	LLC_XID		0xaf
X#define	LLC_FRMR	0x87
X
X#define	LLC_S_CMD(is)	(((is) >> 10) & 0x03)
X#define	LLC_RR		0x0100
X#define	LLC_RNR		0x0500
X#define	LLC_REJ		0x0900
X
X#define LLC_IS_NR(is)	(((is) >> 9) & 0x7f)
X#define LLC_I_NS(is)	(((is) >> 1) & 0x7f)
X
X#ifndef LLCSAP_NULL
X#define	LLCSAP_NULL		0x00
X#endif
X#ifndef LLCSAP_GLOBAL
X#define	LLCSAP_GLOBAL		0xff
X#endif
X#ifndef LLCSAP_8021B
X#define	LLCSAP_8021B_I		0x02
X#endif
X#ifndef LLCSAP_8021B
X#define	LLCSAP_8021B_G		0x03
X#endif
X#ifndef LLCSAP_IP
X#define	LLCSAP_IP		0x06
X#endif
X#ifndef LLCSAP_PROWAYNM
X#define	LLCSAP_PROWAYNM		0x0e
X#endif
X#ifndef LLCSAP_8021D
X#define	LLCSAP_8021D		0x42
X#endif
X#ifndef LLCSAP_RS511
X#define	LLCSAP_RS511		0x4e
X#endif
X#ifndef LLCSAP_ISO8208
X#define	LLCSAP_ISO8208		0x7e
X#endif
X#ifndef LLCSAP_PROWAY
X#define	LLCSAP_PROWAY		0x8e
X#endif
X#ifndef LLCSAP_SNAP
X#define	LLCSAP_SNAP		0xaa
X#endif
X#ifndef LLCSAP_ISONS
X#define	LLCSAP_ISONS		0xfe
X#endif
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/include/llc.h' &&
  chmod 0444 'argus-1.5/include/llc.h' ||
  echo 'restore of argus-1.5/include/llc.h failed'
  shar_count="`wc -c < 'argus-1.5/include/llc.h'`"
  test 3207 -eq "$shar_count" ||
    echo "argus-1.5/include/llc.h: original size 3207, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/md.h ==============
if test -f 'argus-1.5/include/md.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/md.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/md.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/md.h' &&
X/*
X * Copyright (c) 1990 The Regents of the University of California.
X * All rights reserved.
X *
X * Redistribution and use in source and binary forms, with or without
X * modification, are permitted provided that: (1) source code distributions
X * retain the above copyright notice and this paragraph in its entirety, (2)
X * distributions including binary code include the above copyright notice and
X * this paragraph in its entirety in the documentation or other materials
X * provided with the distribution, and (3) all advertising materials mentioning
X * features or use of this software display the following acknowledgement:
X * ``This product includes software developed by the University of California,
X * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
X * the University nor the names of its contributors may be used to endorse
X * or promote products derived from this software without specific prior
X * written permission.
X * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
X * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
X * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
X *
X * @(#) $Header: /usr/users/poepping/src/argus/argus-1.5/include/RCS/md.h,v 1.1 1995/02/08 21:06:41 poepping Exp $ (LBL)
X */
X
X#define ALIGN
X
X#ifndef BYTE_ORDER
X#define BYTE_ORDER BIG_ENDIAN
X#endif
X
X#ifndef NTOHL
X#define NTOHL(x)
X#define NTOHS(x)
X#define HTONL(x)
X#define HTONS(x)
X#endif
X
X#ifndef ntohl
X#define	ntohl(x) (x)
X#define	ntohs(x) (x)
X#define	htonl(x) (x)
X#define	htons(x) (x)
X#endif
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/include/md.h' &&
  chmod 0444 'argus-1.5/include/md.h' ||
  echo 'restore of argus-1.5/include/md.h failed'
  shar_count="`wc -c < 'argus-1.5/include/md.h'`"
  test 1552 -eq "$shar_count" ||
    echo "argus-1.5/include/md.h: original size 1552, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/nametoaddr.h ==============
if test -f 'argus-1.5/include/nametoaddr.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/nametoaddr.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/nametoaddr.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/nametoaddr.h' &&
X/*
X * Copyright (c) 1988-1990 The Regents of the University of California.
X * All rights reserved.
X *
X * Redistribution and use in source and binary forms, with or without
X * modification, are permitted provided that: (1) source code distributions
X * retain the above copyright notice and this paragraph in its entirety, (2)
X * distributions including binary code include the above copyright notice and
X * this paragraph in its entirety in the documentation or other materials
X * provided with the distribution, and (3) all advertising materials mentioning
X * features or use of this software display the following acknowledgement:
X * ``This product includes software developed by the University of California,
X * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
X * the University nor the names of its contributors may be used to endorse
X * or promote products derived from this software without specific prior
X * written permission.
X * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
X * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
X * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
X *
X * @(#) $Header: /usr/users/poepping/src/argus/argus-1.5/include/RCS/nametoaddr.h,v 1.1 1995/02/08 21:06:41 poepping Exp $ (LBL)
X *
X * Address to name translation routines.
X */
X
Xextern u_long **s_nametoaddr();
Xextern u_long s_nametonetaddr();
X
Xextern int s_nametoport();
Xextern int s_nametoproto();
Xextern int s_nametoeproto();
X
Xextern u_char *ETHER_hostton();
Xextern u_char *ETHER_aton();
X
X/*
X * If a protocol is unknown, PROTO_UNDEF is returned.
X * Also, s_nametoport() returns the protocol along with the port number.
X * If there are ambiguous entried in /etc/services (i.e. domain
X * can be either tcp or udp) PROTO_UNDEF is returned.
X */
X#define PROTO_UNDEF		-1
X
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/include/nametoaddr.h' &&
  chmod 0444 'argus-1.5/include/nametoaddr.h' ||
  echo 'restore of argus-1.5/include/nametoaddr.h failed'
  shar_count="`wc -c < 'argus-1.5/include/nametoaddr.h'`"
  test 1832 -eq "$shar_count" ||
    echo "argus-1.5/include/nametoaddr.h: original size 1832, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/os.h ==============
if test -f 'argus-1.5/include/os.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/os.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/os.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/os.h' &&
X/*
X * Copyright (c) 1990 The Regents of the University of California.
X * All rights reserved.
X *
X * Redistribution and use in source and binary forms, with or without
X * modification, are permitted provided that: (1) source code distributions
X * retain the above copyright notice and this paragraph in its entirety, (2)
X * distributions including binary code include the above copyright notice and
X * this paragraph in its entirety in the documentation or other materials
X * provided with the distribution, and (3) all advertising materials mentioning
X * features or use of this software display the following acknowledgement:
X * ``This product includes software developed by the University of California,
X * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
X * the University nor the names of its contributors may be used to endorse
X * or promote products derived from this software without specific prior
X * written permission.
X * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
X * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
X * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
X *
X * @(#) $Header: /usr/users/poepping/src/argus/argus-1.5/include/RCS/os.h,v 1.1 1995/02/08 21:06:41 poepping Exp $ (LBL)
X */
X
X#define ETHER_SERVICE
Xu_char *ETHER_hostton();
Xchar *ETHER_ntohost();
X
X#ifdef sun
X/* Map things in the ether_arp struct */
X#define SHA(ap) ((ap)->arp_sha.ether_addr_octet)
X#define SPA(ap) ((ap)->arp_spa)
X#define THA(ap) ((ap)->arp_tha.ether_addr_octet)
X#define TPA(ap) ((ap)->arp_tpa)
X
X#define EDST(ep) ((ep)->ether_dhost.ether_addr_octet)
X#define ESRC(ep) ((ep)->ether_shost.ether_addr_octet)
X
X/* Map protocol types */
X#define ETHERPUP_IPTYPE ETHERTYPE_IP
X#define ETHERPUP_REVARPTYPE ETHERTYPE_REVARP
X#define ETHERPUP_ARPTYPE ETHERTYPE_ARP
X#endif
X
X#ifdef __sgi
X#define SHA(ap) ((ap)->arp_sha)
X#define SPA(ap) ((ap)->arp_spa)
X#define THA(ap) ((ap)->arp_tha)
X#define TPA(ap) ((ap)->arp_tpa)
X 
X#define EDST(ep) ((ep)->ether_dhost)
X#define ESRC(ep) ((ep)->ether_shost)
X 
X#ifndef ETHERTYPE_REVARP
X#define ETHERTYPE_REVARP 0x8035
X#endif
X
X#ifndef IPPROTO_ND
X/* From <netinet/in.h> on a Sun somewhere. */
X#define IPPROTO_ND      77
X#endif
X
X#ifndef REVARP_REQUEST
X#define REVARP_REQUEST 3
X#endif
X#ifndef REVARP_REPLY
X#define REVARP_REPLY 4
X#endif
X 
X/* newish RIP commands */
X#ifndef RIPCMD_POLL
X#define RIPCMD_POLL 5
X#endif
X#ifndef RIPCMD_POLLENTRY
X#define RIPCMD_POLLENTRY 6
X#endif
X#endif
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/include/os.h' &&
  chmod 0444 'argus-1.5/include/os.h' ||
  echo 'restore of argus-1.5/include/os.h failed'
  shar_count="`wc -c < 'argus-1.5/include/os.h'`"
  test 2467 -eq "$shar_count" ||
    echo "argus-1.5/include/os.h: original size 2467, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/policy.h ==============
if test -f 'argus-1.5/include/policy.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/policy.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/policy.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/policy.h' &&
X
X/*
X * Copyright (c) 1993, 1994 Carnegie Mellon University.
X * All rights reserved.
X *
X * Permission to use, copy, modify, and distribute this software and
X * its documentation for any purpose and without fee is hereby granted, 
X * provided that the above copyright notice appear in all copies and
X * that both that copyright notice and this permission notice appear
X * in supporting documentation, and that the name of CMU not be
X * used in advertising or publicity pertaining to distribution of the
X * software without specific, written prior permission.  
X * 
X * CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
X * ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
X * CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
X * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
X * WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
X * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
X * SOFTWARE.
X *
X */
X
X
X#define DEFAULT_POLICY   "policy.conf"
X#define POLICY_STRING    "access-list"
X
X#define POLICYFIELDNUM     11
X
X#define POLICYSTRING       0
X#define POLICYID           1
X#define POLICYACTION       2
X#define POLICYPROTO        3
X#define POLICYSRCADDR      4
X#define POLICYSRCMASK      5
X#define POLICYDSTADDR      6
X#define POLICYDSTMASK      7
X#define POLICYPORTACT      8
X#define POLICYPORT         9
X#define POLICYNOTIFICATION 10
X
X#define POLICYTESTCRITERIA 4
X
X#define POLICYTESTPROTO    0
X#define POLICYTESTSRC      1
X#define POLICYTESTDST      2
X#define POLICYTESTPORT     3
X
X#define PERMIT    0x10000
X#define DENY      0x20000
X
X#define ICMP      0x01
X#define TCP       0x02
X#define UDP       0x04
X#define IP        0x08
X
X#define EQ        0x01
X#define LT        0x02
X#define GT        0x04
X#define NEQ       0x08
X#define EST       0x10
X
X#define SRCROUTED      0x01
X#define ACCESSLIST     0x02
X
Xstruct netStruct {
X   int operator;
X   u_long addr;
X   u_long mask;
X};
X
Xstruct policyStruct {
X   struct policyStruct *prv, *nxt;
X   int type, policyID;
X   int flags;
X   struct netStruct src, dst;
X   u_short port, action;
X   int notification;
X   char *str;
X};
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/include/policy.h' &&
  chmod 0444 'argus-1.5/include/policy.h' ||
  echo 'restore of argus-1.5/include/policy.h failed'
  shar_count="`wc -c < 'argus-1.5/include/policy.h'`"
  test 2176 -eq "$shar_count" ||
    echo "argus-1.5/include/policy.h: original size 2176, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/adjacency.h ==============
if test -f 'argus-1.5/include/adjacency.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/adjacency.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/adjacency.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/adjacency.h' &&
X
X/*
X * Copyright (c) 1993, 1994 Carnegie Mellon University.
X * All rights reserved.
X *
X * Permission to use, copy, modify, and distribute this software and
X * its documentation for any purpose and without fee is hereby granted, 
X * provided that the above copyright notice appear in all copies and
X * that both that copyright notice and this permission notice appear
X * in supporting documentation, and that the name of CMU not be
X * used in advertising or publicity pertaining to distribution of the
X * software without specific, written prior permission.  
X * 
X * CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
X * ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
X * CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
X * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
X * WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
X * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
X * SOFTWARE.
X *
X */
X
X
X
X#define NUM_PORTS  32
X
X#define MACHINE  1
X#define NET      2
X
Xextern u_long ipaddrtonetmask ();
Xextern u_long thisnet, localaddr, localnet, netmask;
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/include/adjacency.h' &&
  chmod 0444 'argus-1.5/include/adjacency.h' ||
  echo 'restore of argus-1.5/include/adjacency.h failed'
  shar_count="`wc -c < 'argus-1.5/include/adjacency.h'`"
  test 1170 -eq "$shar_count" ||
    echo "argus-1.5/include/adjacency.h: original size 1170, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/services.h ==============
if test -f 'argus-1.5/include/services.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/services.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/services.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/services.h' &&
X
X/*
X * Copyright (c) 1993, 1994 Carnegie Mellon University.
X * All rights reserved.
X *
X * Permission to use, copy, modify, and distribute this software and
X * its documentation for any purpose and without fee is hereby granted, 
X * provided that the above copyright notice appear in all copies and
X * that both that copyright notice and this permission notice appear
X * in supporting documentation, and that the name of CMU not be
X * used in advertising or publicity pertaining to distribution of the
X * software without specific, written prior permission.  
X * 
X * CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
X * ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
X * CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
X * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
X * WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
X * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
X * SOFTWARE.
X *
X */
X
X
X
X#define NUM_PORTS  32
X
X#define MACHINE  1
X#define NET      2
X
Xextern u_long ipaddrtonetmask ();
Xextern u_long thisnet, localaddr, localnet, netmask;
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/include/services.h' &&
  chmod 0444 'argus-1.5/include/services.h' ||
  echo 'restore of argus-1.5/include/services.h failed'
  shar_count="`wc -c < 'argus-1.5/include/services.h'`"
  test 1170 -eq "$shar_count" ||
    echo "argus-1.5/include/services.h: original size 1170, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/cons_util.h ==============
if test -f 'argus-1.5/include/cons_util.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/cons_util.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/cons_util.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/cons_util.h' &&
X
X/*
X * Copyright (c) 1993, 1994 Carnegie Mellon University.
X * All rights reserved.
X *
X * Permission to use, copy, modify, and distribute this software and
X * its documentation for any purpose and without fee is hereby granted, 
X * provided that the above copyright notice appear in all copies and
X * that both that copyright notice and this permission notice appear
X * in supporting documentation, and that the name of CMU not be
X * used in advertising or publicity pertaining to distribution of the
X * software without specific, written prior permission.  
X * 
X * CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
X * ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
X * CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
X * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
X * WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
X * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
X * SOFTWARE.
X *
X */
X
X
Xstruct physLink {
X   struct physLink *prv, *nxt;
X   struct physWriteStruct phys;
X};
X
X
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/include/cons_util.h' &&
  chmod 0444 'argus-1.5/include/cons_util.h' ||
  echo 'restore of argus-1.5/include/cons_util.h failed'
  shar_count="`wc -c < 'argus-1.5/include/cons_util.h'`"
  test 1106 -eq "$shar_count" ||
    echo "argus-1.5/include/cons_util.h: original size 1106, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/argus_client.h ==============
if test -f 'argus-1.5/include/argus_client.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/argus_client.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/argus_client.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/argus_client.h' &&
X
X/*
X * Copyright (c) 1993, 1994 Carnegie Mellon University.
X * All rights reserved.
X *
X * Permission to use, copy, modify, and distribute this software and
X * its documentation for any purpose and without fee is hereby granted, 
X * provided that the above copyright notice appear in all copies and
X * that both that copyright notice and this permission notice appear
X * in supporting documentation, and that the name of CMU not be
X * used in advertising or publicity pertaining to distribution of the
X * software without specific, written prior permission.  
X * 
X * CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
X * ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
X * CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
X * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
X * WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
X * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
X * SOFTWARE.
X *
X */
X
X
X
Xstruct TIME_ENTRY {
X   struct TIME_ENTRY *nxt;
X   u_int startime;
X   u_int lasttime;
X};
X
Xstruct PORT_ENTRY {
X   struct PORT_ENTRY *nxt;
X   u_int port_num;
X};
X
Xstruct ETHER_ENTRY {
X   struct ETHER_ENTRY *nxt;
X   struct ether_addr eaddr;
X   int test;
X};
X
Xstruct STAT {
X   int pkts, bytes;
X   double pkts_sqrd, bytes_sqrd;
X   double bytes_per_pkt, bytes_per_pkt_sqrd;
X};
X
Xstruct STATISTICS {
X   int cons;
X   double secs, secs_sqrd;
X   struct STAT src;
X   struct STAT dst;
X};
X
Xstruct PORT {
X   struct PORT *prv, *nxt;
X   unsigned short port, proto;
X   struct STATISTICS stats;
X};
X
Xstruct NET_OBJECT_PTR {
X   struct NET_OBJECT_PTR *prv, *nxt;
X   struct NET_OBJECT *net_obj;
X};
X
Xstruct NET_OBJECT {
X   struct QUEUE_HEADER  queue;
X   struct NET_OBJECT   *nxt;
X   struct NET_OBJECT   *group;
X   struct NETWORK      *net;
X   struct IP_ENTRY     *ip_addr;
X   struct STATISTICS    src_stats;
X   struct STATISTICS    dst_stats;
X   struct PORT         *ports;
X   int type;
X   int index;
X};
X
Xstruct ROUTE_OBJECT {
X   struct QUEUE_HEADER  header;
X   struct IP_ENTRY *route_list;
X   struct opacket *outpacket;
X   struct sockaddr whereto;
X   struct timeval timeout;
X   int probe, seq, ttl;
X   int ident, port;
X   int got_there, unreachable;
X   u_long lastaddr;
X};
X 
X 
Xstruct NETWORK {
X   struct QUEUE_HEADER queue;
X   struct QUEUE list;
X   struct NETWORK *nxt;
X   struct NET_OBJECT net;
X   struct NET_OBJECT_PTR *ent;
X   u_long  ip_net;
X   u_long  ip_mask;
X   int hosts;
X};
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/include/argus_client.h' &&
  chmod 0444 'argus-1.5/include/argus_client.h' ||
  echo 'restore of argus-1.5/include/argus_client.h failed'
  shar_count="`wc -c < 'argus-1.5/include/argus_client.h'`"
  test 2478 -eq "$shar_count" ||
    echo "argus-1.5/include/argus_client.h: original size 2478, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/argus_parse.h ==============
if test -f 'argus-1.5/include/argus_parse.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/argus_parse.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/argus_parse.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/argus_parse.h' &&
X
X/*
X * Copyright (c) 1993, 1994 Carnegie Mellon University.
X * All rights reserved.
X *
X * Permission to use, copy, modify, and distribute this software and
X * its documentation for any purpose and without fee is hereby granted, 
X * provided that the above copyright notice appear in all copies and
X * that both that copyright notice and this permission notice appear
X * in supporting documentation, and that the name of CMU not be
X * used in advertising or publicity pertaining to distribution of the
X * software without specific, written prior permission.  
X * 
X * CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
X * ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
X * CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
X * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
X * WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
X * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
X * SOFTWARE.
X *
X */
X
X
X#include <cons_def.h>
X
X#ifdef MONITOR_PARSE
X
X#define MAXPROCSTATE  7
Xchar *process_state_strings [MAXPROCSTATE] = {
X   "REQ", "ACC", "EST", "CLO", "TIM", "RST", "FIN",
X};
X
Xint bflag = 0;
Xint eflag = 0;
Xint cflag = 0;
Xint Cflag = 0;
Xint mflag = 0;
Xint Mflag = 0;
Xint nflag = 0;         /* leave addresses as numbers */
Xint Nflag = 0;
Xint Normflag = 0;
Xint Netflag = 0;
Xint notNetflag = 0;
Xint Oflag = 0;
Xint Wflag = 0;
Xint Eflag = 0;
Xint Fflag = 0;
Xint Hflag = 0;
Xint Pflag = 0;
Xint sflag = 0;
Xint dflag = 0;
Xint debugflag = 0;
X 
Xint tflag = 0;
Xint uflag = 0;
Xint vflag = 0;
Xint Vflag = 0;
Xint iflag = 0;
X 
Xint Iflag = 0;
Xint Tflag = 0;
Xint rflag = 0;
Xint Rflag = 0;
Xint Sflag = 0;
Xint Xflag = 0;
X 
Xlong thiszone;         /* gmt to local correction */
X 
Xint total_nets = 0;
Xint total_hosts = 0;
X
Xstruct STATISTICS total_stats;
X
Xint parseerror = 0;
Xchar *parseerrorstr [POLICYFIELDNUM] = {
X   "access-list identifier not found",
X   "policy id number not found",
X   "permit/deny indication not found",
X   "protocol indentifier not found",
X   "no source address defined",
X   "no source address mask defined",
X   "no destination address defined",
X   "no destination address mask defined",
X   "port operator not found",
X   "port number not found",
X   "access violation notification not found",
X};
X
X#else
X 
Xextern char cmdline [];
Xextern char *process_state_strings [];
X
Xextern int bflag;
Xextern int eflag;
Xextern int cflag;
Xextern int Cflag;
Xextern int mflag;
Xextern int Mflag;
Xextern int nflag;         /* leave addresses as numbers */
Xextern int Nflag;
Xextern int Normflag;
Xextern int Netflag;
Xextern int notNetflag;
Xextern int Oflag;
Xextern int Wflag;
Xextern int Eflag;
Xextern int Fflag;
Xextern int Hflag;
Xextern int Pflag;
Xextern int sflag;
Xextern int dflag;
Xextern int debugflag;
X
Xextern int tflag;
Xextern int uflag;
Xextern int vflag;
Xextern int Vflag;
Xextern int iflag;
X
Xextern int Iflag;
Xextern int Tflag;
Xextern int rflag;
Xextern int Rflag;
Xextern int Sflag;
Xextern int Xflag;
X
Xextern long thiszone;         /* gmt to local correction */
X
Xextern int total_nets;
Xextern int total_hosts;
X
Xextern struct STATISTICS total_stats;
X
Xextern int parseerror;
Xextern char *parseerrorstr [];
X
X#endif
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/include/argus_parse.h' &&
  chmod 0444 'argus-1.5/include/argus_parse.h' ||
  echo 'restore of argus-1.5/include/argus_parse.h failed'
  shar_count="`wc -c < 'argus-1.5/include/argus_parse.h'`"
  test 3210 -eq "$shar_count" ||
    echo "argus-1.5/include/argus_parse.h: original size 3210, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/include/cons_def.h ==============
if test -f 'argus-1.5/include/cons_def.h' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/include/cons_def.h (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/include/cons_def.h (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/include/cons_def.h' &&
X
X/*
X * Copyright (c) 1993, 1994 Carnegie Mellon University.
X * All rights reserved.
X *
X * Permission to use, copy, modify, and distribute this software and
X * its documentation for any purpose and without fee is hereby granted, 
X * provided that the above copyright notice appear in all copies and
X * that both that copyright notice and this permission notice appear
X * in supporting documentation, and that the name of CMU not be
X * used in advertising or publicity pertaining to distribution of the
X * software without specific, written prior permission.  
X * 
X * CMU DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
X * ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
X * CMU BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
X * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
X * WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
X * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
X * SOFTWARE.
X *
X */
X
X
X#define VERSION_MAJOR 1
X#define VERSION_MINOR 5
X
X
X/*
X    0                   1                   2                   3
X    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
X   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
X   |0|  Protocol   | L |  IP Opt   |  Exp  |         State         |
X   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
X
X   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
X   |1|  Operation  |                   Data                        |
X   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
X
X                       Argus Status Field Format
X          Note that one tick mark represents one bit position.
X
X*/
X/* Argus Operation */
X
X#define ARGUSCONTROL		0x80000000
X
X#define INIT			0x01000000
X#define STATUS			0x02000000
X#define CLOSE			0x04000000
X
X
X/* Protocol Specification */
X
X#define PROTOCONTROL	        0x00000000
X
X#define IPPROTO			0x01000000
X#define UDPPROTO		0x02000000
X#define ICMPPROTO		0x04000000
X#define TCPPROTO		0x08000000
X#define EPPROTO			0x10000000
X#define ARPPROTO		0x20000000
X#define AARPPROTO		0x40000000
X
X
X/* Link Dependant Bits (L) */
X
X#define FRAGMENTS		0x400000
X#define MULTIADDR		0x800000
X
X
X/* IP Option Status Bits */
X  
X#define TIMESTAMP		0x010000
X#define SECURITY		0x020000
X#define LSRCROUTE		0x040000
X#define RECORDROUTE		0x080000
X#define SSRCROUTE		0x100000
X#define SATNETID		0x200000
X
X#define IPOPTIONMASK            0x3F0000
X
X
X/* Report Status Bits  (Exp) */
X
X#define REVERSE                 0x1000
X#define MODIFIED                0x2000
X#define LOGGED                  0x4000
X#define DETAIL                  0x8000    
X
X
X/* IP, TCP and UDP State Constants and Reporting Values */
X
X#define IP_INIT                 0x0001
X#define UDP_INIT                0x0001
X#define SAW_SYN                 0x0001
X#define SAW_SYN_SENT		0x0002
X#define CON_ESTABLISHED		0x0004
X#define CLOSE_WAITING           0x0008
X#define PKTS_RETRANS            0x0010
X#define SRC_WINDOW_SHUT         0x0020
X#define DST_WINDOW_SHUT         0x0040
X#define NORMAL_CLOSE            0x0080
X#define RESET                   0x0100
X#define TIMED_OUT               0x0200
X#define BLOCKED                 0x0400
X
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/include/cons_def.h' &&
  chmod 0444 'argus-1.5/include/cons_def.h' ||
  echo 'restore of argus-1.5/include/cons_def.h failed'
  shar_count="`wc -c < 'argus-1.5/include/cons_def.h'`"
  test 3235 -eq "$shar_count" ||
    echo "argus-1.5/include/cons_def.h: original size 3235, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/configure ==============
if test -f 'argus-1.5/configure' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/configure (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/configure (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/configure' &&
X#!/bin/csh -f
Xif ( ! -f lib/libpcap.a || ! -d libpcap ) then
Xif ( ! -d libpcap || ! -r libpcap/libpcap.a ) then
X        set libpcapdir
X        set dir=`ls .. | egrep '^libpcap-[0-9]*\.[0-9ab]*$'`
X        if ( $#dir > 1 ) set dir="$dir[$#dir]"
X        foreach d ( /usr/lib /usr/local/lib ../libpcap ../$dir )
X                if ( -d $d && -r $d/libpcap.a ) then
X                        set libpcapdir=$d
X                        break
X                endif
X        end
X        if ( "$libpcapdir" == "" ) then
X                echo "configure: can't find libpcap.a"
X                echo "configure: (see the INSTALL file for more info)"
X                exit 1
X	else
X                ln -s $libpcapdir libpcap
X                echo "configure: using $libpcapdir as ./libpcap"
X        endif
Xelse
X        echo "configure: found ./libpcap"
Xendif
Xif ( ! -f lib/libpcap.a ) then
X        echo "configure: linking lib/libpcap.a from ./libpcap"
X        ln -s ../libpcap/libpcap.a lib/libpcap.a
Xelse
X        echo "configure: using libpcap.a installed in ./lib"
Xendif
Xelse
X        echo "configure: found ./libpcap and ./lib/libpcap.a"
Xendif
X
Xset tcp_wrapperdir
Xif ( ! -f lib/libwrap.a || ! -d wrapper ) then
Xif ( ! -d wrapper || ! -r wrapper/libwrap.a ) then
X        set dir=`ls .. | egrep '^wrapper$|^tcp_wrappers$|^tcp_wrappers[_-.][0-9]*\.[0-9ab]*$'| sort -ru | sed 's/^/..\//'`
X#       if ( $#dir > 1 ) set dir="$dir[$#dir]"
X        foreach d ( /usr/lib /usr/local/lib $dir )
X                if ( -d $d && -r $d/libwrap.a && -r $d/patchlevel.h) then
X                        set tcp_wrapperdir=$d
X                        break
X                endif
X        end
X        if ( "$tcp_wrapperdir" == "" ) then
X                echo "configure: can't find libwrap.a"
X                echo "configure: (see the INSTALL file for more info)"
X                exit 1
X        else
X                ln -s $tcp_wrapperdir wrapper
X                echo "configure: using $tcp_wrapperdir as ./wrapper"
X        endif
Xelse
X        echo "configure: found ./libwrap"
X	set tcp_wrapperdir='./wrapper'
Xendif
Xif ( ! -f lib/libwrap.a ) then
X        echo "configure: linking lib/libwrap.a from ./wrapper"
X        ln -s ../wrapper/libwrap.a lib/libwrap.a
Xelse
X        echo "configure: using libwrap.a installed in ./lib"
Xendif
Xelse
X        echo "configure: found ./wrapper and ./lib/libwrap.a"
X	set tcp_wrapperdir='./wrapper'
Xendif
Xif ( -f $tcp_wrapperdir/patchlevel.h) then
X   set vers=`fgrep patchlevel $tcp_wrapperdir/patchlevel.h | awk '{print $7}' | sed 's/";//'`
X   set wrapper='-e s/^#have-tcpwrapper-'$vers'#//'
X   echo "configure: found tcp_wrappers_"$vers
Xelse
X   echo "configure: cannot determine tcp_wrapper version"
X   echo "configure: (see the INSTALL file for more info)"
X   exit 1
Xendif
X
Xset bison
Xset ethers
Xset flex
Xset gcc
Xset irix
Xset sunos
Xif ( -f libpcap/libpcap.a ) then
Xset pcap=`strings libpcap/libpcap.a | egrep "^pcap-[a-z]*\.c" | sort -u | sed -e 's/pcap-//' -e 's/\.c//'`
Xif (pcap == "") then
X	echo "configure: cannot determine packet capture interface"
X	exit 1
Xendif
Xelse
X	echo "configure: fatal: cannot find lib/libpcap.a!!"
X        exit 1
Xendif
Xecho "configure: using $pcap packet capture interface"
Xset ranlib
Xset solaris
Xif (-f /bin/uname || -f /usr/bin/uname) then
X	set name=`uname -s | tr '[A-Z]' '[a-z]'`
X	set vers=`uname -r | sed -e 's/\..*//' -e 's/T1/v1/'|tr '[A-Z]''[a-z]'`
X	if ( "$name" == "irix" ) set irix='-e s/^#have-irix#//'
X	if ( "$name" == "sunos") then
X		if ( "$name$vers" == "sunos5") then
X			set solaris='-e s/^#have-solaris#//'
X			set path=($path /usr/ccs/bin)
X	        else
X			set sunos='-e s/^#have-sunos#//'
X		endif
X	endif
Xendif
Xif ( -x /usr/local/bin/flex || -x /usr/local/flex ) then
X	set flex='-e s/^#have-flex#//'
X	echo "configure: found flex executable"
Xelse
X	echo "configure: couldn't find flex executable; using lex"
Xendif
Xif ( -x /usr/local/bin/bison || -x /usr/local/bison ) then
X	set bison='-e s/^#have-bison#//'
X	echo "configure: found bison executable"
Xelse
X	echo "configure: couldn't find bison executable; using yacc"
Xendif
Xif ( ( "$flex" == "" && "$bison" != "" ) || \
X     ( "$flex" != "" && "$bison" == "" ) ) then
X	echo "configure: don't have both flex and yacc...reverting to lex/yacc"
X	set flex
X	set bison
Xendif
Xset libc
Xforeach f ( /usr/lib/libc.a /lib/libc.a /usr/lib/libc_s.a )
X	if ( -f $f ) then
X		set libc=$f
X		break
X	endif
Xend
Xif ( "$f" == "" ) then
X	echo "configure: couldn't find libc"
Xelse
X	echo "configure: found libc in "$libc
X	nm $libc | grep ether_ntoa > /dev/null
X	if ( $status == 0 ) then
X		set ethers='-e s/^#have-ethers#//'
X		echo "configure: found support for /etc/ethers"
X	endif
Xendif
Xif ( -x /usr/local/bin/gcc || -x /usr/local/gcc ) then
X	set gcc='-e s/^#have-gcc#//'
Xendif
Xif ( -x /usr/bin/ranlib ) then
X	set ranlib='-e s/^#have-ranlib#//'
Xendif
X
Xif ( ! -f /usr/include/stdlib.h ) ln -s /dev/null include/stdlib.h
X
Xforeach i (. ./server ./common ./clients)
X   echo "configure: making "$i"/Makefile"
X   rm -f $i/Makefile
X   sed -e "s/^#have-$pcap#//" $irix $sunos $solaris $flex $bison $ethers\
X   $gcc $ranlib $wrapper $i/Makefile.in > $i/Makefile
X   chmod ug+w $i/Makefile
Xend
X
Xexit 0
SHAR_EOF
  $shar_touch -am 0508141395 'argus-1.5/configure' &&
  chmod 0555 'argus-1.5/configure' ||
  echo 'restore of argus-1.5/configure failed'
  shar_count="`wc -c < 'argus-1.5/configure'`"
  test 5139 -eq "$shar_count" ||
    echo "argus-1.5/configure: original size 5139, current size $shar_count"
  rm -f _sharnew.tmp
fi
# ============= argus-1.5/common/addrtoname.c ==============
if test ! -d 'argus-1.5/common'; then
  echo 'x - creating directory argus-1.5/common'
  mkdir 'argus-1.5/common'
fi
if test -f 'argus-1.5/common/addrtoname.c' && test X"$1" != X"-c"; then
  echo 'x - skipping argus-1.5/common/addrtoname.c (file already exists)'
  rm -f _sharnew.tmp
else
  > _sharnew.tmp
  echo 'x - extracting argus-1.5/common/addrtoname.c (text)'
  sed 's/^X//' << 'SHAR_EOF' > 'argus-1.5/common/addrtoname.c' &&
X/*
SHAR_EOF
  : || echo 'restore of argus-1.5/common/addrtoname.c failed'
fi
echo 'End of archive part 2'
echo 'File argus-1.5/common/addrtoname.c is continued in part 3'
echo 3 > _sharseq.tmp
exit 0


