<?php
/*
$Id: packet.php 727 2023-11-16 20:40:20Z bhockney $
(C) 2003-2023 by Bob Hockney <zeus@ix.netcom.com>

packet detail web output

This code is distributed under the terms of GNU GPL
*/
?>
<!DOCTYPE html>
<html lang="en">
<head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  <title><?php print "{$config["title"]}"; ?></title>
  <LINK REL=StyleSheet HREF="style.css" TYPE="text/css" MEDIA=screen>
</head>

<body>
<?php if ($config["debug"]) include "include/debug.php"; ?>
<h1 class="report"><?php print "{$config["title"]}"; ?></h1>
<?php
	$link = db("open", "$database");

	$rownum = 0;

	if ($source == "syslog") {
		$FWLOG["c_oob_in"]=0;
		$FWLOG["c_oob_out"]=0;
		$FWLOG["c_id"]=0;
		$FWLOG["c_raw_mac"]=0;
		$FWLOG["c_local_time"]=0;
		$FWLOG["c_local_hostname"]=0;
		$FWLOG["c_oob_prefix"]=0;
		$FWLOG["c_oob_mark"]=0;
		$FWLOG["c_oob_family"]=0;
		$FWLOG["c_ip_protocol"]=0;
		$FWLOG["c_ip_saddr"]=0;
		$FWLOG["c_ip_daddr"]=0;
		$FWLOG["c_ip_tos"]=0;
		$FWLOG["c_ip_ttl"]=0;
		$FWLOG["c_ip_totlen"]=0;
		$FWLOG["c_ip_ihl"]=0;
		$FWLOG["c_ip_id"]=0;
		$FWLOG["c_ip_fragoff"]=0;
		$FWLOG["c_ip6_flowlabel"]=0;
		$FWLOG["c_ip6_payloadlen"]=0;
		$FWLOG["c_sport"]=0;
		$FWLOG["c_src_service"]=0;
		$FWLOG["c_dport"]=0;
		$FWLOG["c_dst_service"]=0;
		$FWLOG["c_tcp_seq"]=0;
		$FWLOG["c_tcp_ackseq"]=0;
		$FWLOG["c_tcp_window"]=0;
		$FWLOG["c_tcp_options"]=0;
		$FWLOG["c_tcp_urgp"]=0;
		$FWLOG["c_udp_len"]=0;
		$FWLOG["c_icmptype"]=0;
		$FWLOG["c_icmpcode"]=0;
		$FWLOG["c_icmpechoid"]=0;
		$FWLOG["c_icmpechoseq"]=0;
		$FWLOG["c_icmp_gateway"]=0;
		$FWLOG["c_icmp_fragmtu"]=0;
		$FWLOG["c_oob_protocol"]=0;
		$FWLOG["c_mac_saddr_str"]=0;
		$FWLOG["c_mac_daddr_str"]=0;
		$FWLOG["c_ahesp_spi"]=0;
		$FWLOG["c_tcp_options"]=0;
		$FWLOG["c_continent_code_s"]=0;
		$FWLOG["c_continent_name_s"]=0;
		$FWLOG["c_country_iso_code_s"]=0;
		$FWLOG["c_country_name_s"]=0;
		$FWLOG["c_subdivision_1_iso_code_s"]=0;
		$FWLOG["c_subdivision_1_name_s"]=0;
		$FWLOG["c_subdivision_2_iso_code_s"]=0;
		$FWLOG["c_subdivision_2_name_s"]=0;
		$FWLOG["c_city_name_s"]=0;
		$FWLOG["c_metro_code_s"]=0;
		$FWLOG["c_time_zone_s"]=0;
		$FWLOG["c_accuracy_radius_s"]=0;
		$FWLOG["c_registered_country_geoname_id_s"]=0;
		$FWLOG["c_represented_country_geoname_id_s"]=0;
		$FWLOG["c_is_anonymous_proxy_s"]=0;
		$FWLOG["c_is_satellite_provider_s"]=0;
		$FWLOG["c_postal_code_s"]=0;
		$FWLOG["c_latitude_s"]=0;
		$FWLOG["c_longitude_s"]=0;
		$FWLOG["c_is_in_european_union_s"]=0;
		$FWLOG["c_autonomous_system_number_s"]=0;
		$FWLOG["c_autonomous_system_organization_s"]=0;
		$FWLOG["c_continent_code_d"]=0;
		$FWLOG["c_continent_name_d"]=0;
		$FWLOG["c_country_iso_code_d"]=0;
		$FWLOG["c_country_name_d"]=0;
		$FWLOG["c_subdivision_1_iso_code_d"]=0;
		$FWLOG["c_subdivision_1_name_d"]=0;
		$FWLOG["c_subdivision_2_iso_code_d"]=0;
		$FWLOG["c_subdivision_2_name_d"]=0;
		$FWLOG["c_city_name_d"]=0;
		$FWLOG["c_metro_code_d"]=0;
		$FWLOG["c_time_zone_d"]=0;
		$FWLOG["c_accuracy_radius_d"]=0;
		$FWLOG["c_registered_country_geoname_id_d"]=0;
		$FWLOG["c_represented_country_geoname_id_d"]=0;
		$FWLOG["c_is_anonymous_proxy_d"]=0;
		$FWLOG["c_is_satellite_provider_d"]=0;
		$FWLOG["c_postal_code_d"]=0;
		$FWLOG["c_latitude_d"]=0;
		$FWLOG["c_longitude_d"]=0;
		$FWLOG["c_is_in_european_union_d"]=0;
		$FWLOG["c_autonomous_system_number_d"]=0;
		$FWLOG["c_autonomous_system_organization_d"]=0;

		require "include/syslog.php";

		$fields = array();

		if ($config["debug"] >= 2) print "<pre class=\"report\">".htmlspecialchars("$query", ENT_QUOTES)."</pre>";

		print "<pre class=\"report\">";
		if (isset($FWLOG["be_verbose"]) and $config["allow_be_verbose"]) {
			print htmlspecialchars("{$query}", ENT_QUOTES);
			print "Exit code: $retval\n";
			print htmlspecialchars("$prog_params", ENT_QUOTES)."\n";
			while(true) {
				$line = db("nextrow", $result, "$source");
				if ($line == "%%")
					break;
				print htmlspecialchars("$line", ENT_QUOTES)."\n";
			}
		} else {
			while(true) {
				$line = db("nextrow", $result, "$source");
				if ($line == "%%")
					break;
				if ($retval) //bad exit status
					print htmlspecialchars("{$line}", ENT_QUOTES)."\n";
			}
		}
		$line = db("nextrow", $result, "$source");
		$config["have_locations"] = $line;
		$line = db("nextrow", $result, "$source");
		$config["have_asns"] = $line;
		$line = db("nextrow", $result, "$source");
		print "</pre>\n";

		$colnum = 0;
		while ($name = db("nextfield", $result, $source)) {
			$fields[] = "$name";
		}
		$rownum = $rownum + 1;
	} else { // $source = "sql"
		$query = "SELECT * FROM {$FWLOG['w_sname']} t WHERE t.{$config["data_id"]}={$FWLOG["w_id"]}";
		if (isset($FWLOG["be_verbose"]) and $config["allow_be_verbose"]) {
			print "<pre class=\"report\">";
			print htmlspecialchars("$query", ENT_QUOTES)."\n";
			print "</pre>\n\n";
		}
		if (isset($FWLOG["upd_hosts"]) or (isset($FWLOG["action"])
				and strtolower("{$FWLOG["action"]}") == "update hosts")) {
			$sql_update = "yes";
			if (isset($FWLOG["action"]) and strtolower("{$FWLOG["action"]}") == "update hosts") {
				$FWLOG["c_src_host"] = "yes";
				$FWLOG["c_dst_host"] = "yes";
			}
			$where = "t.{$config["data_id"]}={$FWLOG["w_id"]}\n";
			db("statement", "CREATE TEMPORARY TABLE $tmp_output AS\n$query", $link);
			include "include/update_cache.php";
		}
		$result = db("statement", "$query", $link);
		$rownum = 0;
	}

	if ($line = db("nextrow", $result, "$source")) {

	foreach ($line as $key => $value) {
		if (is_numeric($value) and isset($config["format.$key"]))
			$line["$key"] = sprintf($config["format.$key"], $value);
	}
?>
<h2 class="report">
	<?php
		if ($source == "syslog") {
			print "Details for log file ".htmlspecialchars("{$FWLOG['syslog_file']}", ENT_QUOTES).
				", line ".htmlspecialchars("{$FWLOG['w_id']}", ENT_QUOTES);
		} else {
			print "Details for packet ".htmlspecialchars("{$line["{$config["data_id"]}"]}", ENT_QUOTES);
		}
	?>
</h2>

<div class="align_center">
<table class="align_table">
<tr>
<td>
	<table class="align_left">
	<tr>
	<td class="valign_top_text">
	<table>
	<caption class="packet"><strong>Local Info</strong></caption>
		<?php if (isset($line["local_hostname"]) and $line["local_hostname"]) { ?>
		<tr>
			<td class="packet_row"><?php print "{$longnames["local_hostname"]}"; ?></td>
			<td class="packet_row"><?php print "".htmlspecialchars("{$line["local_hostname"]}", ENT_QUOTES); ?></td>
		</tr>
		<?php } if (isset($line["local_time"]) and $line["local_time"]) { ?>
		<tr>
			<td class="packet_row"><?php print "{$longnames["local_time"]}"; ?></td>
			<td class="packet_row"><?php print date("{$config["dformat"]}", $line["local_time"]); ?></td>
		</tr>
		<?php } if (isset($line["oob_time_sec"]) and $line["oob_time_sec"]) { ?>
		<tr>
			<td class="packet_row"><?php print "{$longnames["oob_time_sec"]}"; ?></td>
			<td class="packet_row"><?php print date("{$config["dformat"]}", $line["oob_time_sec"]); ?></td>
		</tr>
		<?php } ?>
<?php
	$localdata = array();
	if (!($source == "syslog"))
			$localdata[] = "oob_time_usec";
	$localdata[] = "oob_hook";
	$localdata[] = "oob_in";
	$localdata[] = "oob_out";
	$localdata[] = "oob_prefix";
	$localdata[] = "oob_family";
	$localdata[] = "oob_mark";
	$localdata[] = "raw_type";
	$localdata[] = "oob_protocol";
	$localdata[] = "mac_saddr_str";
	$localdata[] = "mac_daddr_str";
	$localdata[] = "raw_mac";

	foreach ($localdata as $l) {
			if ("$l" == "raw_mac")
					$m = $config["mac_str"];
			else
					$m = $l;
			if (isset($line["$m"]) and $line["$m"]) {
			$extra_class = "";
			if ($m == $config["mac_str"]) {
				$lineout = chunk_split($line["$m"], 3, " ");
				$extra_class = "mac_str";
			}
			else
				$lineout = $line["$m"];
 ?>
		<tr>
			<td class="packet_row"><?php print "{$longnames["$l"]}"; ?></td>
			<td class="packet_row <?php print "$extra_class"?>"><?php print "".htmlspecialchars("$lineout", ENT_QUOTES); ?></td>
		</tr>
<?php	}
	} ?>
	</table>
	</td>
	<td class="valign_top_text">
<?php
	$locations_data = array();
	$locations_data["continent_code"]                 = "Continent Code";
	$locations_data["continent_name"]                 = "Continent";
	$locations_data["country_iso_code"]               = "Country ISO Code";
	$locations_data["country_name"]                   = "Country Name";
	$locations_data["subdivision_1_iso_code"]         = "Subdivision 1 Code";
	$locations_data["subdivision_1_name"]             = "Subdivision 1 Name";
	$locations_data["subdivision_2_iso_code"]         = "Subdivision 2 Code";
	$locations_data["subdivision_2_name"]             = "Subdivision 2 Name";
	$locations_data["city_name"]                      = "City Name";
	$locations_data["metro_code"]                     = "Metro Code";
	$locations_data["time_zone"]                      = "Time Zone";
	$locations_data["accuracy_radius"]                = "Location Accuracy";
	$locations_data["registered_country_geoname_id"]  = "Registered Country";
	$locations_data["represented_country_geoname_id"] = "Represented Country";
	$locations_data["is_anonymous_proxy"]             = "Is Anonymous Proxy?";
	$locations_data["is_satellite_provider"]          = "Is Satellite Provider?";
	$locations_data["is_in_european_union"]           = "In European Union?";
	$locations_data["postal_code"]                    = "Postal Code";
	$locations_data["latitude"]                       = "Latitude";
	$locations_data["longitude"]                      = "Longitude";

	$asns_data = array();
	$asns_data["autonomous_system_number"	]	= "ASN";
	$asns_data["autonomous_system_organization"]	= "AS Organization";

	$loc_data = $locations_data + $asns_data;

	if ($source != "syslog") { // sql

		$loc_s = array();
		$loc_d = array();
		$loc_asn_s = array();
		$loc_asn_d = array();
		$loc_saddr = $line["ip_saddr{$config["addr_type"]}"];
		$loc_daddr = $line["ip_daddr{$config["addr_type"]}"];

		if (!$config["have_locations"]) {
			foreach ($locations_data as $k => $v) {
				$loc_s["$k"] = get_geoip_value("{$k}_s", "", $line);
				$loc_d["$k"] = get_geoip_value("{$k}_d", "", $line);
			}
		} else {
			$res_s = db("statement", "SELECT * FROM $geoip2_blocks AS b\n"
					."\tLEFT JOIN $geoip2_locations AS l ON (b.geoname_id=l.geoname_id AND l.locale_code='{$config["geoip2_locale"]}')\n"
					."WHERE '$loc_saddr'::inet <<= b.network" ,$link);
			$res_d = db("statement", "SELECT * FROM $geoip2_blocks AS b\n"
					."\tLEFT JOIN $geoip2_locations AS l ON (b.geoname_id=l.geoname_id AND l.locale_code='{$config["geoip2_locale"]}')\n"
					."WHERE '$loc_daddr'::inet <<= b.network" ,$link);
			$rownum = 0;
			$loc_s = db("nextrow", $res_s, $link);
			$rownum = 0;
			$loc_d = db("nextrow", $res_d, $link);
			if (!$loc_s) $loc_s = array();
			if (!$loc_d) $loc_d = array();

			$loc_special = array();
			$loc_special[] = "is_anonymous_proxy";
			$loc_special[] = "is_satellite_provider";
			$loc_special[] = "is_in_european_union";
			$loc_special[] = "registered_country_geoname_id";
			$loc_special[] = "represented_country_geoname_id";

			foreach ($loc_special as $s) {
				switch ("$s") {
				case "is_anonymous_proxy":
				case "is_satellite_provider":
				case "is_in_european_union":
						if (isset($loc_s["$s"]) and $loc_s["$s"] == "t") $loc_s["$s"] = "Yes";
						if (isset($loc_d["$s"]) and $loc_d["$s"] == "t") $loc_d["$s"] = "Yes";
						if (isset($loc_s["$s"]) and $loc_s["$s"] == "f") $loc_s["$s"] = "No";
						if (isset($loc_d["$s"]) and $loc_d["$s"] == "f") $loc_d["$s"] = "No";
						break;
				case "registered_country_geoname_id":
				case "represented_country_geoname_id":
						if (isset($loc_s["$s"]) and $loc_s["$s"]) {
								$res = db("statement", "SELECT country_name FROM $geoip2_locations WHERE geoname_id = {$loc_s["$s"]}", $link);
								$rownum = 0;
								$g_id = db("nextrow", $res, $link);
								$loc_s["$s"] = $g_id["country_name"];
						}
						if (isset($loc_d["$s"]) and $loc_d["$s"]) {
								$res = db("statement", "SELECT country_name FROM $geoip2_locations WHERE geoname_id = {$loc_d["$s"]}", $link);
								$rownum = 0;
								$g_id = db("nextrow", $res, $link);
								$loc_d["$s"] = $g_id["country_name"];
						}

						break;
				default:
						break;
				}
			}
		}

		if (!$config["have_asns"]) {
			foreach ($asns_data as $k => $v) {
				$loc_s["$k"] = get_geoip_value("{$k}_s", "", $line);
				$loc_d["$k"] = get_geoip_value("{$k}_d", "", $line);
			}
		} else {
			$asn_s = db("statement", "SELECT * FROM $geoip2_asns AS a\n"
					."WHERE '$loc_saddr'::inet <<= a.network" ,$link);
			$asn_d = db("statement", "SELECT * FROM $geoip2_asns AS a\n"
					."WHERE '$loc_daddr'::inet <<= a.network" ,$link);
			$rownum = 0;
			$loc_asn_s = db("nextrow", $asn_s, $link);
			$rownum = 0;
			$loc_asn_d = db("nextrow", $asn_d, $link);
			if (!$loc_asn_s) $loc_asn_s = array();
			if (!$loc_asn_d) $loc_asn_d = array();
		}

			$loc_s = $loc_s + $loc_asn_s;
			$loc_d = $loc_d + $loc_asn_d;

			$have_geoip_records = false;
			foreach ($loc_data as $l => $j) {
					if ((isset($loc_s["$l"]) and $loc_s["$l"]) or (isset($loc_d["$l"]) and $loc_d["$l"])) {
							if (! isset($loc_s["$l"]) or ! $loc_s["$l"])
									$loc_s["$l"] = '-';
							if (! isset($loc_d["$l"]) or ! $loc_d["$l"])
									$loc_d["$l"] = '-';

							if (! $have_geoip_records) {
?>
		<table>
		<caption class=packet><strong>GeoIP Info</strong></caption>
			<tr>
				<th class="packet_row">Description</th>
				<th class="packet_row">Source</th>
				<th class="packet_row">Destination</th>
			</tr>
<?php
									$have_geoip_records = true;
							}
?>
		<tr>
			<td class="packet_row"><?php print "{$loc_data["$l"]}"; ?></td>
			<td class="packet_row"><?php print "".htmlspecialchars("{$loc_s["$l"]}", ENT_QUOTES); ?></td>
			<td class="packet_row"><?php print "".htmlspecialchars("{$loc_d["$l"]}", ENT_QUOTES); ?></td>
		</tr>
<?php		}
			}
			if ($have_geoip_records) {
?>
		</table>
<?php
					;
			}
	} else { // syslog

			$have_geoip_records = false;
			foreach ($loc_data as $l => $j) {
					$line["{$l}_s"] = get_geoip_value("{$l}_s", $line["{$l}_s"], $line);
					$line["{$l}_d"] = get_geoip_value("{$l}_d", $line["{$l}_d"], $line);
					if ((isset($line["{$l}_s"]) and $line["{$l}_s"]) or (isset($line["{$l}_d"]) and $line["{$l}_d"])) {
							if (! isset($line["{$l}_s"]) or ! $line["{$l}_s"])
									$line["{$l}_s"] = '-';
							if (! isset($line["{$l}_d"]) or ! $line["{$l}_d"])
									$line["{$l}_d"] = '-';

							if (! $have_geoip_records) {
?>
		<table>
		<caption class=packet><strong>GeoIP Info</strong></caption>
			<tr>
				<th class="packet_row">Description</th>
				<th class="packet_row">Source</th>
				<th class="packet_row">Destination</th>
			</tr>
<?php
									$have_geoip_records = true;
							}
?>
		<tr>
			<td class="packet_row"><?php print "{$loc_data["$l"]}"; ?></td>
			<td class="packet_row"><?php print "".htmlspecialchars("{$line["{$l}_s"]}", ENT_QUOTES); ?></td>
			<td class="packet_row"><?php print "".htmlspecialchars("{$line["{$l}_d"]}", ENT_QUOTES); ?></td>
		</tr>
<?php		}
			}
			if ($have_geoip_records) {
?>
		</table>
<?php
					;
			}
	}
	geoip2_close($config);
?>
	</td>
	</tr>
	</table>
</td>
</tr>
<tr><td>&nbsp;</td></tr>
<tr>
<td>
	<table class="align_left">
	<tr><td class="valign_top_text">
	<table>
	<caption class="packet"><strong>IP headers</strong></caption>
		<tr>
			<td class="packet_row">
			<?php print "{$longnames["ip_saddr"]}"; ?></td>
			<td class="packet_row">
<?php
	if ($config["iptype"] == "int") {
			if (isset ($line["ip_saddr{$config["addr_type"]}"])) $addr = long2ip($line["ip_saddr{$config["addr_type"]}"]);
			if ($config["wfwl_iptype"] <> "int") {
					$line["ip_saddr{$config["addr_type"]}"] = long2ip("{$line["ip_saddr{$config["addr_type"]}"]}");
			}
	} elseif ($config["iptype"] == "bin") {
			if (isset ($line["ip_saddr{$config["addr_type"]}"]))
					if (bin2hex(substr($line["ip_saddr{$config["addr_type"]}"],0,12)) == "00000000000000000000ffff")
							$addr = $php_inet_ntop(substr($line["ip_saddr{$config["addr_type"]}"],12));
					else
							$addr = $php_inet_ntop($line["ip_saddr{$config["addr_type"]}"]);
	} else {
			if (isset ($line["ip_saddr{$config["addr_type"]}"])) $addr = "{$line["ip_saddr{$config["addr_type"]}"]}";
			if ($config["wfwl_iptype"] == "int") {
					$line["ip_saddr{$config["addr_type"]}"] = ip2long("{$line["ip_saddr{$config["addr_type"]}"]}");
					if ($line["ip_saddr{$config["addr_type"]}"] < 0) $line["ip_saddr{$config["addr_type"]}"] += pow(2,32);
			}
	}
	print "$addr";
?>
			</td>
		</tr>
<?php
	if (isset($line["src_host"]) and "{$line["src_host"]}" <> "-") {
			$host = "{$line["src_host"]}";
	} else {
			if ($config["have_hostnames"]) {
					if ($config["wfwl_iptype"] == "int")
							$res = db("statement", "SELECT hostname FROM $hostnames WHERE ip_addr=$inet_aton('$addr');", $link);
					elseif ($config["wfwl_iptype"] == "bin")
							$res = db("statement", "SELECT hostname FROM $hostnames WHERE ip_addr=$inet_pton(".AF_INET6.", '$addr');", $link);
					else
							$res = db("statement", "SELECT hostname FROM $hostnames WHERE ip_addr='{$line["ip_saddr{$config["addr_type"]}"]}'::inet;", $link);
					$rownum = 0;
					$l = db("nextrow", $res);
					if (! $l)
						$host = "-";
					else
						$host = $l["hostname"];
			} else {
					$host = "-";
			}
	}
?>
		<tr>
			<td colspan="2" class="align_center packet_row"><?php print "$host"; ?></td>
		</tr>
		<tr>
			<td class="packet_row"><?php print "{$longnames["ip_daddr"]}"; ?></td>
			<td class="packet_row">
<?php
	if ($config["iptype"] == "int") {
			if (isset ($line["ip_daddr{$config["addr_type"]}"])) $addr = long2ip($line["ip_daddr{$config["addr_type"]}"]);
			if ($config["wfwl_iptype"] <> "int") {
					$line["ip_daddr{$config["addr_type"]}"] = long2ip("{$line["ip_daddr{$config["addr_type"]}"]}");
			}
	} elseif ($config["iptype"] == "bin") {
			if (isset ($line["ip_daddr{$config["addr_type"]}"]))
					if (bin2hex(substr($line["ip_daddr{$config["addr_type"]}"],0,12)) == "00000000000000000000ffff")
							$addr = $php_inet_ntop(substr($line["ip_daddr{$config["addr_type"]}"],12));
					else
							$addr = $php_inet_ntop($line["ip_daddr{$config["addr_type"]}"]);
	} else {
			if (isset ($line["ip_daddr{$config["addr_type"]}"])) $addr = "{$line["ip_daddr{$config["addr_type"]}"]}";
			if ($config["wfwl_iptype"] == "int") {
					$line["ip_daddr{$config["addr_type"]}"] = ip2long("{$line["ip_daddr{$config["addr_type"]}"]}");
					if ($line["ip_daddr{$config["addr_type"]}"] < 0) $line["ip_daddr{$config["addr_type"]}"] += pow(2,32);
			}
	}
	print "$addr";
?>
			</td>
		</tr>
<?php
	if (isset ($line["dst_host"]) and "{$line["dst_host"]}" <> "-") {
			$host = "{$line["dst_host"]}";
	} else {
			if ($config["have_hostnames"]) {
					if ($config["wfwl_iptype"] == "int")
						$res = db("statement", "SELECT hostname FROM $hostnames WHERE ip_addr=$inet_aton('$addr');", $link);
					elseif ($config["wfwl_iptype"] == "bin")
						$res = db("statement", "SELECT hostname FROM $hostnames WHERE ip_addr=$inet_pton(".AF_INET6.", '$addr');", $link);
					else
						$res = db("statement", "SELECT hostname FROM $hostnames WHERE ip_addr='{$line["ip_daddr{$config["addr_type"]}"]}'::inet;", $link);
					$rownum = 0;
					$l = db("nextrow", $res);
					if (is_null($l) or !$l)
						$host = "";
					else
						$host = $l["hostname"];

					if ($host == "") $host = "-";
			} else {
					$host = "-";
			}
	}
?>
		<tr>
			<td colspan="2" class="align_center packet_row"><?php print "$host"; ?></td>
		</tr>
<?php

	$ipdata = array(
			"ip_protocol",
			"ip_tos",
			"ip_ttl",
			"ip_totlen",
			"ip_ihl",
			"ip6_payloadlen",
			"ip6_priority",
			"ip6_hoplimit",
			"ip6_flowlabel",
			"ip_id",
			"ip_fragoff",
			"ip6_fragid",
			"ip6_fragoff",
			"ip_csum"
	);

	if (!($source == "syslog")){
			$proto_out["pnum"] = $line["ip_protocol"];
			$proto_out["pname"] = getprotobynumber($line["ip_protocol"]);
	} else {
			$proto_out["pnum"] = getprotobyname($line["ip_protocol"]);
			$proto_out["pname"] = $line["ip_protocol"];
			if ($proto_out["pnum"] < 0 or !$proto_out["pnum"]) {
					$proto_out["pnum"] = $proto_out["pname"];
			}
	}

	foreach ($ipdata as $l) {
			if (isset($line["$l"]) and $line["$l"]) {
					switch ("$l") {
					case "ip_fragoff":
							$flags = " ";
							$offset = $line["$l"] & ~0x4000; // IP_DF
							$offset = $offset & ~0x2000; // IP_MF
							if (($line["$l"] & 0x4000) <> 0 ) $flags = $flags . "DF ";
							if (($line["$l"] & 0x2000) <> 0 ) $flags = $flags . "MF ";
?>
			<tr>
				<td class="packet_row"><?php print "Fragment Flags"; ?></td>
				<td class="packet_row"><?php print "$flags";?></td>
			</tr>
			<tr>
				<td class="packet_row"><?php print "Fragment offset"; ?></td>
				<td class="packet_row"><?php print "$offset";?></td>
			</tr>
<?php 	break;
case "ip_protocol": ?>
			<tr>
				<td class="packet_row"><?php print "{$longnames["$l"]}"; ?></td>
				<td class="packet_row"><?php print "{$proto_out["pnum"]}";
			if ($proto_out["pname"] and $proto_out["pnum"] <> $proto_out["pname"]) print " --&gt; {$proto_out["pname"]}" ?></td>
			</tr>
<?php	break;
default: ?>
			<tr>
				<td class="packet_row"><?php if (isset($line["$l"])) print "{$longnames["$l"]}"; ?></td>
				<td class="packet_row"><?php print "{$line["$l"]}" ?></td>
			</tr>
<?php
		break;
					}
			}
	}
?>
	</table>
</td>
<td class="valign_top_text">
<?php
	switch ($proto_out["pnum"]) {
	case 17:
			$udpdata = array(
					"udp_sport",
					"udp_dport",
					"udp_len",
					"udp_csum",
			);
?>
	<table>
	<caption class=packet><strong>Protocol UDP</strong></caption>
<?php
			foreach ($udpdata as $l) {
					unset ($servicename);
					if ($l == "udp_dport" or $l == "udp_sport") {
							if ($source == "syslog") {
									$l = substr($l, 4);
									if ("$l" == "sport") $servicename = "{$line["src_service"]}";
									if ("$l" == "dport") $servicename = "{$line["dst_service"]}";
							}
							if (!isset($servicename) or "$servicename" == "-"){
									$servicename = getservbyport($line["$l"], "udp");
							}
?>
		<tr>
			<td class="packet_row"><?php print "{$longnames["$l"]}"; ?></td>
			<td class="packet_row"><?php print "{$line["$l"]}" ?></td>
			<td class="packet_row"><?php print "&nbsp; $servicename"; ?></td>
		</tr>
<?php
					} else {
							if (isset($line["$l"]) and $line["$l"]) {
?>
		<tr>
			<td class="packet_row"><?php print "{$longnames["$l"]}"; ?></td>
			<td class="packet_row"><?php print "{$line["$l"]}" ?></td>
			<td class="packet_row">&nbsp;</td>
		</tr>
<?php	}
					}
			}
?>
	</table>

<?php
			break;
	case  6:
			$tcpdata = array(
					"tcp_sport",
					"tcp_dport",
					"tcp_seq",
					"tcp_ackseq",
					"tcp_window",
					"tcp_csum",
			);
?>
	<table>
	<caption class=packet><strong>Protocol TCP</strong></caption>
<?php
			foreach ($tcpdata as $l) {
					unset ($servicename);
					if ($l == "tcp_dport" or $l == "tcp_sport") {
							if ($source == "syslog") {
									$l = substr($l, 4);
									if ("$l" == "sport") $servicename = "{$line["src_service"]}";
									if ("$l" == "dport") $servicename = "{$line["dst_service"]}";
							}
							if (!isset($servicename) or "$servicename" == "-"){
									$servicename = getservbyport($line["$l"], "tcp");
							}
?>
		<tr>
			<td class="packet_row"><?php print "{$longnames["$l"]}"; ?></td>
			<td class="packet_row"><?php print "{$line["$l"]}" ?></td>
			<td class="packet_row"><?php print "&nbsp; $servicename"; ?></td>
		</tr>
<?php
					} else {
							if (isset($line["$l"]) and $line["$l"]) {
?>
		<tr>
			<td class="packet_row"><?php print "{$longnames["$l"]}"; ?></td>
			<td class="packet_row"><?php print "{$line["$l"]}" ?></td>
			<td class="packet_row">&nbsp;</td>
		</tr>
<?php
							}
					}
			}
?>
	</table>
	<table>
		<tr>
			<td class="packet_row">SYN</td>
			<td class="packet_row">ACK</td>
			<td class="packet_row">FIN</td>
			<td class="packet_row">RST</td>
			<td class="packet_row">PSH</td>
			<td class="packet_row">URG</td>
			<td class="packet_row">URGP</td>
		</tr>

<?php
			if ($source == "syslog") {
					$flags = $line["tcp_options"];
					if (preg_match("/s...../", $flags ) or $flags == "SYN" ) { $line["tcp_syn"] = 1; } else { $line["tcp_syn"] = 0; } 
					if (preg_match("/.a..../", $flags )) { $line["tcp_ack"] = 1; } else { $line["tcp_ack"] = 0; }
					if (preg_match("/..f.../", $flags )) { $line["tcp_fin"] = 1; } else { $line["tcp_fin"] = 0; }
					if (preg_match("/...r../", $flags )) { $line["tcp_rst"] = 1; } else { $line["tcp_rst"] = 0; }
					if (preg_match("/....p./", $flags )) { $line["tcp_psh"] = 1; } else { $line["tcp_psh"] = 0; }
					if (preg_match("/.....u/", $flags )) { $line["tcp_urg"] = 1; } else { $line["tcp_urg"] = 0; }
			}
?>
		<tr>

		<td class="packet_row"><?php if ("{$line["tcp_syn"]}" == 't' or $line["tcp_syn"] == 1)
		print 1; else print 0; ?></td>
		<td class="packet_row"><?php if ("{$line["tcp_ack"]}" == 't' or $line["tcp_ack"] == 1)
		print 1; else print 0; ?></td>
		<td class="packet_row"><?php if ("{$line["tcp_fin"]}" == 't' or $line["tcp_fin"] == 1)
		print 1; else print 0; ?></td>
		<td class="packet_row"><?php if ("{$line["tcp_rst"]}" == 't' or $line["tcp_rst"] == 1)
		print 1; else print 0; ?></td>
		<td class="packet_row"><?php if ("{$line["tcp_psh"]}" == 't' or $line["tcp_psh"] == 1)
		print 1; else print 0; ?></td>
		<td class="packet_row"><?php if ("{$line["tcp_urg"]}" == 't' or $line["tcp_urg"] == 1)
		print 1; else print 0; ?></td>
		<td class="packet_row"><?php if (isset ($line["tcp_urgp"])) print "{$line["tcp_urgp"]}" ?></td>
		</tr>
	</table>
<?php			break;
case  1:
		if ("$source" == "syslog")
				$icmpdata = array(
						"icmptype",
						"icmpcode",
						"icmpechoid",
						"icmpechoseq",
						"icmp_gateway",
						"icmp_fragmtu",
				);
		else
				$icmpdata = array(
						"icmp_type",
						"icmp_code",
						"icmp_echoid",
						"icmp_echoseq",
						"icmp_gateway",
						"icmp_fragmtu",
						"icmp_csum",
				);
?>
	<table>
	<caption class=packet><strong>Protocol&nbsp;ICMP</strong></caption>
<?php
		foreach ($icmpdata as $l) {
				if (preg_match("/icmp_?(type|code)/", "$l") or (isset($line["$l"]) and is_numeric($line["$l"]))) {
?>
		<tr>
			<td class="packet_row"><?php print "{$longnames["$l"]}"; ?></td>
<?php		if ("$l" == "icmp_gateway" and "{$line["$l"]}" and $config["iptype_g"] == "int") { ?>
			<td class="packet_row"><?php print long2ip($line["$l"]);?></td>
<?php		} else { ?>
			<td class="packet_row"><?php print "{$line["$l"]}" ?></td>
<?php		} ?>
		</tr>
<?php
				}
		}
?>
	</table>
<?php
		break;
case  58:
		if ("$source" == "syslog")
				$icmpdata = array(
						"icmptype",
						"icmpcode",
						"icmpechoid",
						"icmpechoseq",
						"icmpcsum",
				);
		else
				$icmpdata = array(
						"icmpv6_type",
						"icmpv6_code",
						"icmpv6_echoid",
						"icmpv6_echoseq",
						"icmpv6_csum",
				);
?>
	<table>
	<caption class=packet><strong>Protocol&nbsp;ICMPv6</strong></caption>
<?php
	foreach ($icmpdata as $l) {
		if (preg_match("/icmp(v6)?_?(type|code)/", "$l") or (isset($line["$l"]) and is_numeric($line["$l"]))) {
?>
		<tr>
			<td class="packet_row"><?php print "{$longnames["$l"]}"; ?></td>
			<td class="packet_row"><?php print "{$line["$l"]}" ?></td>
		</tr>
<?php
		}
	}
?>
	</table>
<?php
			break;
		default:
			if ($proto_out["pname"]) {
				$p = $proto_out["pname"];
			} else {
				$p = $proto_out["pnum"];
			}
?>
	<table>
	<caption class=packet><strong>Protocol&nbsp;<?php print "$p" ?></strong></caption>
		<tr>
			<td class="packet_row"><?php print "No header information available for protocol $p" ?></td>
		</tr>
	</table>
<?php
			break;
	}
?>
	</td>
	</tr>
	</table>
<tr><td>&nbsp;</td></tr>
<tr>
<td class="align_left">
	<form action="<?php print "$self"; ?>" method="post">
		<input class="submit" type="submit" name="action" value="Resolve Hosts">
		<input type="hidden" name="w_id" value="<?php print "{$FWLOG["w_id"]}"; ?>">
<?php
		if (is_array($FWLOG))
			foreach ($FWLOG as $k => $v) {
				if ("$k" == "action" or "$k" == "w_id" or "$k" == "data_tables") continue;
				print "\t\t<input type=\"hidden\" name=\"".htmlspecialchars("$k", ENT_QUOTES).
					"\" value=\"".htmlspecialchars("$v", ENT_QUOTES)."\">\n";
			}
?>
	</form>
</td>
</tr>
</table>
</div>
<?php
	} else
		print "<PRE><strong>Error: No data for Line {$FWLOG["syslog_file"]} {$FWLOG["w_id"]}<strong></PRE>";
	db("close", $link);
?>

</body>
</html>

<!-- vim:set ts=4: -->
