hello Dave,
Thanks for your previous answer. I have few number of warning. some already solved but this can't come out. all are same problem. please see my code.
void
descry(u_char *u, struct pcap_pkthdr *phdr, u_char *packet)
{
struct libnet_ipv4_hdr *ip;
struct libnet_tcp_hdr *tcp;
struct descry_pack *gp;
struct tcp_connection *c;
struct tcp_connection *rc;
static u_char cleanup = 0;
struct timeval ts;

rc = NULL;
c = NULL;
gp = (struct descry_pack *)u;

/*
* In order to keep the trie from growing boundlessly, we need to
* periodically expire half open connections.
*/
if (cleanup++ > CLEANUP_INTERVAL)
{
ts.tv_usec = phdr->ts.tv_usec;
ts.tv_sec = phdr->ts.tv_sec;

/* expire old connections */
pt_expire(gp, &ts);
cleanup = 0;
}

/*
* Ignore packets that do not have an entire TCP header. Currently
* this code does not handle fragmented TCP headers and will not
* detect scans that use them.
*/
if (phdr->len < (gp->offset + LIBNET_IPV4_H + LIBNET_TCP_H))
{
return;
}

/* overlay IP and TCP headers */
ip = (struct libnet_ipv4_hdr *)(packet + gp->offset);
tcp = (struct libnet_tcp_hdr *)(packet + gp->offset +
(ip->ip_hl << 2));

/* shave off the lower order 6 bits containing the control flags */
switch (tcp->th_flags & 0x3F)
{
case (TH_SYN | TH_ACK):
/* this is a new connection to be added to the trie */

/* get memory for the connection state */
c = malloc(sizeof (struct tcp_connection ));
if (c == NULL)
{
return;
}

/* set connection state */
memcpy(&(c->ts), &(phdr->ts), sizeof(struct timeval));
/*
* The context for the connection state is biased towards
* the initiator of the TCP connection. Since this TCP
* segment is the SYN|ACK (response from server), we reverse
* the source and destination when filling in the connection
* information.
*/
SET_STATE(c, ip->ip_src.s_addr, tcp->th_sport,
ip->ip_dst.s_addr, tcp->th_dport, tcp->th_ack);

/* insert TCP connection into the trie */
if (pt_insert(gp->pt, c) == 0)
{
fprintf(stderr, "pt_insert() failed!\n");
}
break;
case (TH_FIN | TH_ACK):
case (TH_RST):
case (TH_RST | TH_ACK):
/* connection teardown */

/* get memory for the connection state */
c = malloc(sizeof (struct tcp_connection));
if (c == NULL)
{
return;
}
/* set connection state so we can search for the connection */
SET_STATE(c, ip->ip_dst.s_addr, tcp->th_dport,
ip->ip_src.s_addr, tcp->th_sport, tcp->th_seq);

/*
* Search the trie to see if this connection teadown
* corresponds to one of ours. We are looking for TCP
* connections where the initiator sends a SYN segment
* and the destination host is listening and responds
* with a SYN-ACK segment. Next the initiator closes the
* connection with a FIN-ACK, RST-ACK, or RST segment
* WITHOUT ever sending any data on the connection. This
* condition is usually a good indicator of someone doing
* a full-open (connect) port scan to see if a service is
* listening.
*/
if (pt_find(gp->pt, c, &rc))
{
check_state(gp, c, rc); [ previous implicit declaration of ‘check_state’ was here]
pt_delete(gp->pt, rc); [.warning: previous implicit declaration of ‘pt_delete’ was here]
}
else
{
/*
* Did not find the connection. Assuming the initiator
* sent the teardown request, so we will try again
* while making the assumption that the server sent it.
*/
SET_STATE(c, ip->ip_src.s_addr, tcp->th_sport,
ip->ip_dst.s_addr, tcp->th_dport, tcp->th_ack);
pt_delete(gp->pt, c);
}
free(c);
break;
default:
break;
}
}
/***********************************/
void
check_state(struct descry_pack *gp, struct tcp_connection *con1,
struct tcp_connection *con2)
{ [conflicting types for ‘check_state’]
/* check sequence number delta to see if data was sent */
if (ntohl(con1->seq) >= ntohl(con2->seq) &&
ntohl(con1->seq) <= ntohl(con2->seq) + 2)
{
if (gp->flags & DO_SYSLOG)
{
syslog(LOG_NOTICE,
"Possible TCP port scan from %s:%d to %s:%d",
libnet_addr2name4(con1->src_addr.s_addr,
LIBNET_DONT_RESOLVE),
ntohs(con1->src_port),
libnet_addr2name4(con1->dst_addr.s_addr,
LIBNET_DONT_RESOLVE),
ntohs(con1->dst_port));
}
else
{
fprintf(stderr,
"[%s] TCP probe from %s:%d to %s:%d\n",
get_time(),
libnet_addr2name4(con1->src_addr.s_addr,
LIBNET_DONT_RESOLVE),
ntohs(con1->src_port),
libnet_addr2name4(con1->dst_addr.s_addr,
LIBNET_DONT_RESOLVE),
ntohs(con1->dst_port));
}
}
}
/********************************/
void
pt_delete(struct pt_context *pt, struct tcp_connection *c)
{ [ warning: conflicting types for ‘pt_delete]
u_char key[KEY_BYTES];

/* if the trie is empty, just return */
if (pt->head == NULL)
{
return;
}

memset(key, 0, KEY_BYTES);
pt_make_key(key, c);

/* call the recursive search and delete function */
if (pt_remove_r(pt, pt->head, key, NULL))
{
/*
* If we just deleted the last connection record in the trie
* then remove the last node so we have a totally empty trie.
*/
if (pt->n == 1 && (int)(pt->head->con) == CON_REMOVED)
{
free(pt->head);
pt->head = NULL;
pt->n = 0;
}
}
}

/***********************************/
I got this kind of warning. how can i overcome.

You are using functions before they are defined. The compiler processes each file from top to bottom.

Put declarations (prototypes) of the functions somewhere earlier the file so that the compiler will know their return data type and the data types of each function's parameters before the program invokes them.

Regards,

Dave

Footnote: It's neither necessary or desirable to start a new thread when you are asking follow-up advice from a previous thread.