package src;



import java.util.StringTokenizer;
import java.lang.Math;
import jpcap.*;
import jpcap.packet.Packet;

	public class AttackDetector implements PacketReceiver {
		
		
		public void receivePacket(Packet packet) {
			
			//tokenize packet
			String packetString = packet.toString();
			StringTokenizer packetToken = new StringTokenizer(packetString, " ");
			
			packetToken.nextToken(); 
			String srcip = packetToken.nextToken(); //get the src IP token in the packet
			StringTokenizer ipToken = new StringTokenizer(srcip, "/"); //separate the src and dst IP
			srcip = ipToken.nextToken();
			String dstip = ipToken.nextToken(); //dst IP
			StringTokenizer srcToken = new StringTokenizer(srcip, "-");
			srcip = srcToken.nextToken(); //src IP
			
			//packet header
			byte[] header = packet.header;
						
			//get src port
			for(int i = 0; i < 6; i++)
				packetToken.nextToken();
			
			int srcport = Integer.parseInt(packetToken.nextToken());
			
			//get dst port
			packetToken.nextToken();
			int dstport = Integer.parseInt(packetToken.nextToken());
			
		
			//printing out what kind of packet has been detected
			if(((int)header[47])== 2) {
				//SYN Flag
				System.out.println("** SYN scan detected with dst: " + dstip + ":" + dstport + " and src: " + srcip + ":" + srcport +" **");
			}
			else if(((int)header[47])== 41) {
				//URG, PSH, FIN flag on
				System.out.println("** XMAS scan detected with dst: " + dstip + ":" + dstport + " and src: " + srcip + ":" + srcport +" **");
			}
			else if(((int)header[47])== 0) {
				//no flags on
				System.out.println("** NULL scan detected with dst: " + dstip + ":" + dstport + " and src: " + srcip + ":" + srcport +" **");
			}
			
			//print out the packet
			System.out.println("Packet sent by scan: ");
			System.out.println(packet);
			System.out.println("**---------------------End of Packet--------------------------**");
			System.out.println(" ");
		}
				   
	
		public static void main(String[] args) throws Exception {
			NetworkInterface[] devices = JpcapCaptor.getDeviceList();
			
			//checks what interfaces are available to listen on
			if(args.length<1){
				System.out.println("usage: java Tcpdump <select a number from the following>");
			
			System.out.println("Starting Detection...");
			
				for (int i = 0; i < devices.length; i++) {
					System.out.println(i+" :"+devices[i].name + "(" + devices[i].description+")");
					System.out.println("    data link:"+devices[i].datalink_name + "("
							+ devices[i].datalink_description+")");
					System.out.print("    MAC address:");
					for (byte b : devices[i].mac_address)
						System.out.print(Integer.toHexString(b&0xff) + ":");
					System.out.println();
					for (NetworkInterfaceAddress a : devices[i].addresses)
						System.out.println("    address:"+a.address + " " + a.subnet + " "
								+ a.broadcast);
				}
			}
			else { //loops to detect packets 
				JpcapCaptor jpcap = JpcapCaptor.openDevice(devices[Integer.parseInt(args[0])], 2000, false, 20);
				
				//set a filter so that only packets with XMAS, SYN and NULL properties are picked up 
				jpcap.setFilter("(tcp[13] == 41) || (tcp[13] == 0) || (tcp[13] == 2)", false);
				//loop
				jpcap.loopPacket(-1, new AttackDetector());
			}
		}
	}