拒绝服务攻击原理及解决方法

拒绝服务攻击原理及解决方法(6)
　　cd ngrep； ./configure

　　然后把ngrep.c复制到ngrep目录里。你可以覆盖也可以备份原始的ngrep.c文件。在这里，您应当回顾在修改过的ngrep.c里的配置，至少您应当把DNS_SERVER_IP更改为您所使用的DNS的地址。更改完毕后你就可以运行'make'，这样就建立了ngrep应用程序。

Modified ngrep.c source code
/* this code is available for download from http://www.wiretrip.net/na/ngrep.c */
/*
* $Id: ngrep.c,v 1.35 1999/10/13 16:44:16 jpr5 EXP $
*
*/
/* TFN detection code added by Rain Forest Puppy / rfp@wiretrip.net
and Night Axis / na@wiretrip.net */

/********* TFN detection defines *******************************/

/* how many DNS and ICMP requests to track */
#define DNS_REQUEST_MAX 5000
#define ICMP_REQUEST_MAX 1000

/* flood threshold is matches per 10 seconds */
#define FLOOD_THRESHOLD 20

/* IP of your DNS server */
#define DNS_SERVER_IP "10.9.100.8"

/* TFN syn uses ttl between 200-255. Assuming less than 50 hops,
flag stuff with ttl > TTL_THRESHOLD (other critera are used
as well) */
#define TTL_THRESHOLD 150

/**************************************************************/

#include
#include
#include
#ifdef LINUX
#include
#endif
#if defined(BSD)