% Written by Maciej Korczynski, 2009
%
% This function reads a given trace file and count how many TCP, UDP 
% and ICMP packets are originated from given ragne of ip addresses 
% represented by ip address and mask (input parameters).
%
% summary = ipAddessesAnalysis(a,b,name)
%
%INPUT
%   name            a trace file name
%   a			  an IP address
%   b			  an IP mask
%OUTPUT
%   summary     	  three integers, which indicates how many TCP, UDP 
%			  and ICP packets were sent from specified range of 
%			  addresses (e.g. from LAN)
%......................................................................
function summary = ipAddessesAnalysis(a,b,name)

if nargin<3;  
    error('Not enought input parameters. To run the function you need to give an ip address, mask and a file name.');
end

% TracesPlay is run and data is inserted in matrix called "Data".

command = sprintf('-o IP.pro IP.src IP.dst -r %s -e', name);
[Data] = TracesPlay(command);

%......................................................................
% Processing of input variables: 
% a - range of addresses in LAN, b - network mask 
% we need do change input parameters from String to decimal format.  
% e.g. '192.168.0.0' -> 3232235520; '255.255.0.0 -> 4294901760'
% and compute range od addresses in decimal format

A = dec2bin(sscanf(a, '%d. %d. %d. %d'),8);
M = dec2bin(sscanf(b, '%d. %d. %d. %d'),8);

for i=1:4
	for j=1:8
	   Address(i,j) = str2num(A(i,j));
	   Mask(i,j) = str2num(M(i,j));
	end
end

format long % precision is set

Range = and(Address, Mask);
Wildcard = ~Mask;
RangeDec = 0;
WildcardDec = 0;
c = 32;

for i=1:4
	for j=1:8
	   c = c-1;
	   RangeDec = (RangeDec + Range(i,j)*2^c);
	   WildcardDec = (WildcardDec + Wildcard(i,j)*2^c);
	end
end

RangeMinDec = RangeDec + 1;
RangeMaxDec = RangeDec + WildcardDec - 1;

%......................................................................

TCPcounter = 0;
UDPcounter = 0;
ICMPcounter = 0;

for i=1:length(Data) % rows that contain data packets
	
% we need to check if data in originated from range of addresses from 
% Local Area Network and the destination is outside the LAN 

	if (Data(2,i) > RangeMinDec && Data(2,i) < RangeMaxDec && (Data(3,i) < RangeMinDec || Data(3,i) < RangeMaxDec)) 
		if(Data(1,i) == 1)
			UDPcounter = UDPcounter + 1;
		elseif(Data(1,i) == 17)
			ICMPcounter = ICMPcounter + 1;
		elseif(Data(1,i) == 6)
			TCPcounter = TCPcounter + 1;
		end
	end
end

%.....................................................................

disp('SUMMARY:')
disp(['Amount of TCP packets originated from LAN is: ', num2str(TCPcounter)]);

disp(['Amount of UDP packets originated from LAN is: ', num2str(UDPcounter)]);

disp(['Amount of ICMP packets originated from LAN is: ', num2str(ICMPcounter)]);		

summary = [TCPcounter, UDPcounter, ICMPcounter];

%.....................................................................

% additional information on how to run the function

% in linux environment from bash using command:
%
% matlab -r "ipAddessesAnalysis 192.168.0.0 255.255.0.0 file.pcap;exit" > outputFile
% 
% directly from matlab environment by the use of command: 
% 
% ipAddessesAnalysis('192.168.0.0', '255.255.0.0', 'file.pcap')

%.....................................................................