2 * Copyright (c) 1993, 1994, 1995, 1996, 1997, 1998
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by the Computer Systems
16 * Engineering Group at Lawrence Berkeley Laboratory.
17 * 4. Neither the name of the University nor of the Laboratory may be used
18 * to endorse or promote products derived from this software without
19 * specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
39 #include <pcap-stdinc.h>
46 #ifdef HAVE_SYS_BITYPES_H
47 #include <sys/bitypes.h>
49 #include <sys/param.h>
50 #include <sys/types.h>
54 #include <sys/ioctl.h>
55 #include <sys/socket.h>
56 #ifdef HAVE_SYS_SOCKIO_H
57 #include <sys/sockio.h>
60 struct mbuf
; /* Squelch compiler warnings on some platforms for */
61 struct rtentry
; /* declarations in <net/if.h> */
63 #include <netinet/in.h>
70 #if !defined(_MSC_VER) && !defined(__BORLANDC__) && !defined(__MINGW32__)
78 #define INT_MAX 2147483647
81 #ifdef HAVE_OS_PROTO_H
93 #endif /* HAVE_DAG_API */
95 #ifdef HAVE_SEPTEL_API
96 #include "pcap-septel.h"
97 #endif /* HAVE_SEPTEL_API */
100 #include "pcap-snf.h"
101 #endif /* HAVE_SNF_API */
105 #endif /* HAVE_TC_API */
107 #ifdef PCAP_SUPPORT_USB
108 #include "pcap-usb-linux.h"
111 #ifdef PCAP_SUPPORT_BT
112 #include "pcap-bt-linux.h"
115 #ifdef PCAP_SUPPORT_BT_MONITOR
116 #include "pcap-bt-monitor-linux.h"
119 #ifdef PCAP_SUPPORT_NETFILTER
120 #include "pcap-netfilter-linux.h"
123 #ifdef PCAP_SUPPORT_DBUS
124 #include "pcap-dbus.h"
128 pcap_not_initialized(pcap_t
*pcap
)
130 /* in case the caller doesn't check for PCAP_ERROR_NOT_ACTIVATED */
131 (void)pcap_snprintf(pcap
->errbuf
, sizeof(pcap
->errbuf
),
132 "This handle hasn't been activated yet");
133 /* this means 'not initialized' */
134 return (PCAP_ERROR_NOT_ACTIVATED
);
139 pcap_not_initialized_ptr(pcap_t
*pcap
)
141 (void)pcap_snprintf(pcap
->errbuf
, sizeof(pcap
->errbuf
),
142 "This handle hasn't been activated yet");
147 pcap_getevent_not_initialized(pcap_t
*pcap
)
149 (void)pcap_snprintf(pcap
->errbuf
, sizeof(pcap
->errbuf
),
150 "This handle hasn't been activated yet");
151 return (INVALID_HANDLE_VALUE
);
155 pcap_sendqueue_transmit_not_initialized(pcap_t
*pcap
, pcap_send_queue
* queue
, int sync
)
157 (void)pcap_snprintf(pcap
->errbuf
, sizeof(pcap
->errbuf
),
158 "This handle hasn't been activated yet");
162 static PAirpcapHandle
163 pcap_get_airpcap_handle_not_initialized(pcap_t
*pcap
)
165 (void)pcap_snprintf(pcap
->errbuf
, sizeof(pcap
->errbuf
),
166 "This handle hasn't been activated yet");
172 * Returns 1 if rfmon mode can be set on the pcap_t, 0 if it can't,
173 * a PCAP_ERROR value on an error.
176 pcap_can_set_rfmon(pcap_t
*p
)
178 return (p
->can_set_rfmon_op(p
));
182 * For systems where rfmon mode is never supported.
185 pcap_cant_set_rfmon(pcap_t
*p _U_
)
191 * Sets *tstamp_typesp to point to an array 1 or more supported time stamp
192 * types; the return value is the number of supported time stamp types.
193 * The list should be freed by a call to pcap_free_tstamp_types() when
194 * you're done with it.
196 * A return value of 0 means "you don't get a choice of time stamp type",
197 * in which case *tstamp_typesp is set to null.
199 * PCAP_ERROR is returned on error.
202 pcap_list_tstamp_types(pcap_t
*p
, int **tstamp_typesp
)
204 if (p
->tstamp_type_count
== 0) {
206 * We don't support multiple time stamp types.
208 *tstamp_typesp
= NULL
;
210 *tstamp_typesp
= (int*)calloc(sizeof(**tstamp_typesp
),
211 p
->tstamp_type_count
);
212 if (*tstamp_typesp
== NULL
) {
213 (void)pcap_snprintf(p
->errbuf
, sizeof(p
->errbuf
),
214 "malloc: %s", pcap_strerror(errno
));
217 (void)memcpy(*tstamp_typesp
, p
->tstamp_type_list
,
218 sizeof(**tstamp_typesp
) * p
->tstamp_type_count
);
220 return (p
->tstamp_type_count
);
224 * In Windows, you might have a library built with one version of the
225 * C runtime library and an application built with another version of
226 * the C runtime library, which means that the library might use one
227 * version of malloc() and free() and the application might use another
228 * version of malloc() and free(). If so, that means something
229 * allocated by the library cannot be freed by the application, so we
230 * need to have a pcap_free_tstamp_types() routine to free up the list
231 * allocated by pcap_list_tstamp_types(), even though it's just a wrapper
235 pcap_free_tstamp_types(int *tstamp_type_list
)
237 free(tstamp_type_list
);
241 * Default one-shot callback; overridden for capture types where the
242 * packet data cannot be guaranteed to be available after the callback
243 * returns, so that a copy must be made.
246 pcap_oneshot(u_char
*user
, const struct pcap_pkthdr
*h
, const u_char
*pkt
)
248 struct oneshot_userdata
*sp
= (struct oneshot_userdata
*)user
;
255 pcap_next(pcap_t
*p
, struct pcap_pkthdr
*h
)
257 struct oneshot_userdata s
;
263 if (pcap_dispatch(p
, 1, p
->oneshot_callback
, (u_char
*)&s
) <= 0)
269 pcap_next_ex(pcap_t
*p
, struct pcap_pkthdr
**pkt_header
,
270 const u_char
**pkt_data
)
272 struct oneshot_userdata s
;
274 s
.hdr
= &p
->pcap_header
;
278 /* Saves a pointer to the packet headers */
279 *pkt_header
= &p
->pcap_header
;
281 if (p
->rfile
!= NULL
) {
284 /* We are on an offline capture */
285 status
= pcap_offline_read(p
, 1, p
->oneshot_callback
,
289 * Return codes for pcap_offline_read() are:
293 * The first one ('0') conflicts with the return code of
294 * 0 from pcap_read() meaning "no packets arrived before
295 * the timeout expired", so we map it to -2 so you can
296 * distinguish between an EOF from a savefile and a
297 * "no packets arrived before the timeout expired, try
298 * again" from a live capture.
307 * Return codes for pcap_read() are:
310 * - -2: loop was broken out of with pcap_breakloop()
312 * The first one ('0') conflicts with the return code of 0 from
313 * pcap_offline_read() meaning "end of file".
315 return (p
->read_op(p
, 1, p
->oneshot_callback
, (u_char
*)&s
));
319 * Implementation of a pcap_if_list_t.
321 struct pcap_if_list
{
322 pcap_if_t
*beginning
;
325 static struct capture_source_type
{
326 int (*findalldevs_op
)(pcap_if_list_t
*, char *);
327 pcap_t
*(*create_op
)(const char *, char *, int *);
328 } capture_source_types
[] = {
330 { dag_findalldevs
, dag_create
},
332 #ifdef HAVE_SEPTEL_API
333 { septel_findalldevs
, septel_create
},
336 { snf_findalldevs
, snf_create
},
339 { TcFindAllDevs
, TcCreate
},
341 #ifdef PCAP_SUPPORT_BT
342 { bt_findalldevs
, bt_create
},
344 #ifdef PCAP_SUPPORT_BT_MONITOR
345 { bt_monitor_findalldevs
, bt_monitor_create
},
347 #ifdef PCAP_SUPPORT_USB
348 { usb_findalldevs
, usb_create
},
350 #ifdef PCAP_SUPPORT_NETFILTER
351 { netfilter_findalldevs
, netfilter_create
},
353 #ifdef PCAP_SUPPORT_DBUS
354 { dbus_findalldevs
, dbus_create
},
360 * Get a list of all capture sources that are up and that we can open.
361 * Returns -1 on error, 0 otherwise.
362 * The list, as returned through "alldevsp", may be null if no interfaces
363 * were up and could be opened.
366 pcap_findalldevs(pcap_if_t
**alldevsp
, char *errbuf
)
369 pcap_if_list_t devlist
;
372 * Find all the local network interfaces on which we
375 devlist
.beginning
= NULL
;
376 if (pcap_platform_finddevs(&devlist
, errbuf
) == -1) {
378 * Failed - free all of the entries we were given
381 if (devlist
.beginning
!= NULL
)
382 pcap_freealldevs(devlist
.beginning
);
388 * Ask each of the non-local-network-interface capture
389 * source types what interfaces they have.
391 for (i
= 0; capture_source_types
[i
].findalldevs_op
!= NULL
; i
++) {
392 if (capture_source_types
[i
].findalldevs_op(&devlist
, errbuf
) == -1) {
394 * We had an error; free the list we've been
397 if (devlist
.beginning
!= NULL
)
398 pcap_freealldevs(devlist
.beginning
);
405 * Return the first entry of the list of all devices.
407 *alldevsp
= devlist
.beginning
;
411 static struct sockaddr
*
412 dup_sockaddr(struct sockaddr
*sa
, size_t sa_length
)
414 struct sockaddr
*newsa
;
416 if ((newsa
= malloc(sa_length
)) == NULL
)
418 return (memcpy(newsa
, sa
, sa_length
));
422 * Construct a "figure of merit" for an interface, for use when sorting
423 * the list of interfaces, in which interfaces that are up are superior
424 * to interfaces that aren't up, interfaces that are up and running are
425 * superior to interfaces that are up but not running, and non-loopback
426 * interfaces that are up and running are superior to loopback interfaces,
427 * and interfaces with the same flags have a figure of merit that's higher
428 * the lower the instance number.
430 * The goal is to try to put the interfaces most likely to be useful for
431 * capture at the beginning of the list.
433 * The figure of merit, which is lower the "better" the interface is,
434 * has the uppermost bit set if the interface isn't running, the bit
435 * below that set if the interface isn't up, the bit below that set
436 * if the interface is a loopback interface, and the interface index
437 * in the 29 bits below that. (Yes, we assume u_int is 32 bits.)
440 get_figure_of_merit(pcap_if_t
*dev
)
445 if (strcmp(dev
->name
, "any") == 0) {
447 * Give the "any" device an artificially high instance
448 * number, so it shows up after all other non-loopback
451 n
= 0x1FFFFFFF; /* 29 all-1 bits */
454 * A number at the end of the device name string is
455 * assumed to be an instance number. Add 1 to the
456 * instance number, and use 0 for "no instance
457 * number", so we don't put "no instance number"
458 * devices and "instance 0" devices together.
460 cp
= dev
->name
+ strlen(dev
->name
) - 1;
461 while (cp
-1 >= dev
->name
&& *(cp
-1) >= '0' && *(cp
-1) <= '9')
463 if (*cp
>= '0' && *cp
<= '9')
468 if (!(dev
->flags
& PCAP_IF_RUNNING
))
470 if (!(dev
->flags
& PCAP_IF_UP
))
472 if (dev
->flags
& PCAP_IF_LOOPBACK
)
479 * Try to get a description for a given device.
480 * Returns a mallocated description if it could and NULL if it couldn't.
482 * XXX - on FreeBSDs that support it, should it get the sysctl named
483 * "dev.{adapter family name}.{adapter unit}.%desc" to get a description
484 * of the adapter? Note that "dev.an.0.%desc" is "Aironet PC4500/PC4800"
485 * with my Cisco 350 card, so the name isn't entirely descriptive. The
486 * "dev.an.0.%pnpinfo" has a better description, although one might argue
487 * that the problem is really a driver bug - if it can find out that it's
488 * a Cisco 340 or 350, rather than an old Aironet card, it should use
489 * that in the description.
491 * Do NetBSD, DragonflyBSD, or OpenBSD support this as well? FreeBSD
492 * and OpenBSD let you get a description, but it's not generated by the OS,
493 * it's set with another ioctl that ifconfig supports; we use that to get
494 * a description in FreeBSD and OpenBSD, but if there is no such
495 * description available, it still might be nice to get some description
496 * string based on the device type or something such as that.
498 * In OS X, the System Configuration framework can apparently return
499 * names in 10.4 and later.
501 * It also appears that freedesktop.org's HAL offers an "info.product"
502 * string, but the HAL specification says it "should not be used in any
503 * UI" and "subsystem/capability specific properties" should be used
504 * instead and, in any case, I think HAL is being deprecated in
505 * favor of other stuff such as DeviceKit. DeviceKit doesn't appear
506 * to have any obvious product information for devices, but maybe
507 * I haven't looked hard enough.
509 * Using the System Configuration framework, or HAL, or DeviceKit, or
510 * whatever, would require that libpcap applications be linked with
511 * the frameworks/libraries in question. That shouldn't be a problem
512 * for programs linking with the shared version of libpcap (unless
513 * you're running on AIX - which I think is the only UN*X that doesn't
514 * support linking a shared library with other libraries on which it
515 * depends, and having an executable linked only with the first shared
516 * library automatically pick up the other libraries when started -
517 * and using HAL or whatever). Programs linked with the static
518 * version of libpcap would have to use pcap-config with the --static
519 * flag in order to get the right linker flags in order to pick up
520 * the additional libraries/frameworks; those programs need that anyway
521 * for libpcap 1.1 and beyond on Linux, as, by default, it requires
524 * Do any other UN*Xes, or desktop environments support getting a
528 get_if_description(const char *name
)
531 char *description
= NULL
;
533 struct ifreq ifrdesc
;
535 size_t descrlen
= 64;
537 size_t descrlen
= IFDESCRSIZE
;
538 #endif /* IFDESCRSIZE */
541 * Get the description for the interface.
543 memset(&ifrdesc
, 0, sizeof ifrdesc
);
544 strlcpy(ifrdesc
.ifr_name
, name
, sizeof ifrdesc
.ifr_name
);
545 s
= socket(AF_INET
, SOCK_DGRAM
, 0);
549 * On FreeBSD, if the buffer isn't big enough for the
550 * description, the ioctl succeeds, but the description
551 * isn't copied, ifr_buffer.length is set to the description
552 * length, and ifr_buffer.buffer is set to NULL.
556 if ((description
= malloc(descrlen
)) != NULL
) {
557 ifrdesc
.ifr_buffer
.buffer
= description
;
558 ifrdesc
.ifr_buffer
.length
= descrlen
;
559 if (ioctl(s
, SIOCGIFDESCR
, &ifrdesc
) == 0) {
560 if (ifrdesc
.ifr_buffer
.buffer
==
564 descrlen
= ifrdesc
.ifr_buffer
.length
;
567 * Failed to get interface description.
576 #else /* __FreeBSD__ */
578 * The only other OS that currently supports
579 * SIOCGIFDESCR is OpenBSD, and it has no way
580 * to get the description length - it's clamped
581 * to a maximum of IFDESCRSIZE.
583 if ((description
= malloc(descrlen
)) != NULL
) {
584 ifrdesc
.ifr_data
= (caddr_t
)description
;
585 if (ioctl(s
, SIOCGIFDESCR
, &ifrdesc
) != 0) {
587 * Failed to get interface description.
593 #endif /* __FreeBSD__ */
595 if (description
!= NULL
&& strlen(description
) == 0) {
597 * Description is empty, so discard it.
606 * For FreeBSD, if we didn't get a description, and this is
607 * a device with a name of the form usbusN, label it as a USB
610 if (description
== NULL
) {
611 if (strncmp(name
, "usbus", 5) == 0) {
613 * OK, it begins with "usbus".
619 busnum
= strtol(name
+ 5, &p
, 10);
620 if (errno
== 0 && p
!= name
+ 5 && *p
== '\0' &&
621 busnum
>= 0 && busnum
<= INT_MAX
) {
623 * OK, it's a valid number that's not
624 * bigger than INT_MAX. Construct
625 * a description from it.
627 static const char descr_prefix
[] = "USB bus number ";
631 * Allow enough room for a 32-bit bus number.
632 * sizeof (descr_prefix) includes the
635 descr_size
= sizeof (descr_prefix
) + 10;
636 description
= malloc(descr_size
);
637 if (description
!= NULL
) {
638 pcap_snprintf(description
, descr_size
,
639 "%s%ld", descr_prefix
, busnum
);
645 return (description
);
646 #else /* SIOCGIFDESCR */
648 #endif /* SIOCGIFDESCR */
652 * Look for a given device in the specified list of devices.
654 * If we find it, return a pointer to its entry.
656 * If we don't find it, attempt to add an entry for it, with the specified
657 * IFF_ flags and description, and, if that succeeds, return a pointer to
658 * the new entry, otherwise return NULL and set errbuf to an error message.
661 find_or_add_if(pcap_if_list_t
*devlistp
, const char *name
,
662 bpf_u_int32 if_flags
, char *errbuf
)
664 bpf_u_int32 pcap_flags
;
667 * Convert IFF_ flags to pcap flags.
671 if (if_flags
& IFF_LOOPBACK
)
672 pcap_flags
|= PCAP_IF_LOOPBACK
;
675 * We don't have IFF_LOOPBACK, so look at the device name to
676 * see if it looks like a loopback device.
678 if (name
[0] == 'l' && name
[1] == 'o' &&
679 (isdigit((unsigned char)(name
[2])) || name
[2] == '\0')
680 pcap_flags
|= PCAP_IF_LOOPBACK
;
683 if (if_flags
& IFF_UP
)
684 pcap_flags
|= PCAP_IF_UP
;
687 if (if_flags
& IFF_RUNNING
)
688 pcap_flags
|= PCAP_IF_RUNNING
;
692 * Attempt to find an entry for this device; if we don't find one,
693 * attempt to add one.
695 return (find_or_add_dev(devlistp
, name
, pcap_flags
,
696 get_if_description(name
), errbuf
));
700 * Look for a given device in the specified list of devices.
702 * If we find it, then, if the specified address isn't null, add it to
703 * the list of addresses for the device and return 0.
705 * If we don't find it, attempt to add an entry for it, with the specified
706 * IFF_ flags and description, and, if that succeeds, add the specified
707 * address to its list of addresses if that address is non-null, and
708 * return 0, otherwise return -1 and set errbuf to an error message.
710 * (We can get called with a null address because we might get a list
711 * of interface name/address combinations from the underlying OS, with
712 * the address being absent in some cases, rather than a list of
713 * interfaces with each interface having a list of addresses, so this
714 * call may be the only call made to add to the list, and we want to
715 * add interfaces even if they have no addresses.)
718 add_addr_to_if(pcap_if_list_t
*devlistp
, const char *name
,
719 bpf_u_int32 if_flags
,
720 struct sockaddr
*addr
, size_t addr_size
,
721 struct sockaddr
*netmask
, size_t netmask_size
,
722 struct sockaddr
*broadaddr
, size_t broadaddr_size
,
723 struct sockaddr
*dstaddr
, size_t dstaddr_size
,
729 * Check whether the device exists and, if not, add it.
731 curdev
= find_or_add_if(devlistp
, name
, if_flags
, errbuf
);
732 if (curdev
== NULL
) {
741 * There's no address to add; this entry just meant
742 * "here's a new interface".
748 * "curdev" is an entry for this interface, and we have an
749 * address for it; add an entry for that address to the
750 * interface's list of addresses.
752 return (add_addr_to_dev(curdev
, addr
, addr_size
, netmask
,
753 netmask_size
, broadaddr
, broadaddr_size
, dstaddr
,
754 dstaddr_size
, errbuf
));
759 * Add an entry to the list of addresses for an interface.
760 * "curdev" is the entry for that interface.
763 add_addr_to_dev(pcap_if_t
*curdev
,
764 struct sockaddr
*addr
, size_t addr_size
,
765 struct sockaddr
*netmask
, size_t netmask_size
,
766 struct sockaddr
*broadaddr
, size_t broadaddr_size
,
767 struct sockaddr
*dstaddr
, size_t dstaddr_size
,
770 pcap_addr_t
*curaddr
, *prevaddr
, *nextaddr
;
773 * Allocate the new entry and fill it in.
775 curaddr
= (pcap_addr_t
*)malloc(sizeof(pcap_addr_t
));
776 if (curaddr
== NULL
) {
777 (void)pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
778 "malloc: %s", pcap_strerror(errno
));
782 curaddr
->next
= NULL
;
784 curaddr
->addr
= (struct sockaddr
*)dup_sockaddr(addr
, addr_size
);
785 if (curaddr
->addr
== NULL
) {
786 (void)pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
787 "malloc: %s", pcap_strerror(errno
));
792 curaddr
->addr
= NULL
;
794 if (netmask
!= NULL
) {
795 curaddr
->netmask
= (struct sockaddr
*)dup_sockaddr(netmask
, netmask_size
);
796 if (curaddr
->netmask
== NULL
) {
797 (void)pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
798 "malloc: %s", pcap_strerror(errno
));
799 if (curaddr
->addr
!= NULL
)
805 curaddr
->netmask
= NULL
;
807 if (broadaddr
!= NULL
) {
808 curaddr
->broadaddr
= (struct sockaddr
*)dup_sockaddr(broadaddr
, broadaddr_size
);
809 if (curaddr
->broadaddr
== NULL
) {
810 (void)pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
811 "malloc: %s", pcap_strerror(errno
));
812 if (curaddr
->netmask
!= NULL
)
813 free(curaddr
->netmask
);
814 if (curaddr
->addr
!= NULL
)
820 curaddr
->broadaddr
= NULL
;
822 if (dstaddr
!= NULL
) {
823 curaddr
->dstaddr
= (struct sockaddr
*)dup_sockaddr(dstaddr
, dstaddr_size
);
824 if (curaddr
->dstaddr
== NULL
) {
825 (void)pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
826 "malloc: %s", pcap_strerror(errno
));
827 if (curaddr
->broadaddr
!= NULL
)
828 free(curaddr
->broadaddr
);
829 if (curaddr
->netmask
!= NULL
)
830 free(curaddr
->netmask
);
831 if (curaddr
->addr
!= NULL
)
837 curaddr
->dstaddr
= NULL
;
840 * Find the end of the list of addresses.
842 for (prevaddr
= curdev
->addresses
; prevaddr
!= NULL
; prevaddr
= nextaddr
) {
843 nextaddr
= prevaddr
->next
;
844 if (nextaddr
== NULL
) {
846 * This is the end of the list.
852 if (prevaddr
== NULL
) {
854 * The list was empty; this is the first member.
856 curdev
->addresses
= curaddr
;
859 * "prevaddr" is the last member of the list; append
862 prevaddr
->next
= curaddr
;
869 * Look for a given device in the specified list of devices.
871 * If we find it, return 0 and set *curdev_ret to point to it.
873 * If we don't find it, attempt to add an entry for it, with the specified
874 * flags and description, and, if that succeeds, return 0, otherwise
875 * return -1 and set errbuf to an error message.
878 find_or_add_dev(pcap_if_list_t
*devlistp
, const char *name
, bpf_u_int32 flags
,
879 const char *description
, char *errbuf
)
884 * Is there already an entry in the list for this device?
886 curdev
= find_dev(devlistp
, name
);
887 if (curdev
!= NULL
) {
895 * No, we didn't find it. Try to add it to the list of devices.
897 return (add_dev(devlistp
, name
, flags
, description
, errbuf
));
901 * Look for a given device in the specified list of devices, and return
902 * the entry for it if we find it or NULL if we don't.
905 find_dev(pcap_if_list_t
*devlistp
, const char *name
)
910 * Is there an entry in the list for this device?
912 for (curdev
= devlistp
->beginning
; curdev
!= NULL
;
913 curdev
= curdev
->next
) {
914 if (strcmp(name
, curdev
->name
) == 0) {
916 * We found it, so, yes, there is. No need to
917 * add it. Provide the entry we found to our
931 * Attempt to add an entry for a device, with the specified flags
932 * and description, and, if that succeeds, return 0 and return a pointer
933 * to the new entry, otherwise return NULL and set errbuf to an error
936 * If we weren't given a description, try to get one.
939 add_dev(pcap_if_list_t
*devlistp
, const char *name
, bpf_u_int32 flags
,
940 const char *description
, char *errbuf
)
942 pcap_if_t
*curdev
, *prevdev
, *nextdev
;
943 u_int this_figure_of_merit
, nextdev_figure_of_merit
;
945 curdev
= malloc(sizeof(pcap_if_t
));
946 if (curdev
== NULL
) {
947 (void)pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
948 "malloc: %s", pcap_strerror(errno
));
956 curdev
->name
= strdup(name
);
957 if (curdev
->name
== NULL
) {
958 (void)pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
959 "malloc: %s", pcap_strerror(errno
));
963 if (description
== NULL
) {
965 * We weren't handed a description for the interface.
967 curdev
->description
= NULL
;
970 * We were handed a description; make a copy.
972 curdev
->description
= strdup(description
);
973 if (curdev
->description
== NULL
) {
974 (void)pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
975 "malloc: %s", pcap_strerror(errno
));
981 curdev
->addresses
= NULL
; /* list starts out as empty */
982 curdev
->flags
= flags
;
985 * Add it to the list, in the appropriate location.
986 * First, get the "figure of merit" for this interface.
988 this_figure_of_merit
= get_figure_of_merit(curdev
);
991 * Now look for the last interface with an figure of merit
992 * less than or equal to the new interface's figure of merit.
994 * We start with "prevdev" being NULL, meaning we're before
995 * the first element in the list.
1000 * Get the interface after this one.
1002 if (prevdev
== NULL
) {
1004 * The next element is the first element.
1006 nextdev
= devlistp
->beginning
;
1008 nextdev
= prevdev
->next
;
1011 * Are we at the end of the list?
1013 if (nextdev
== NULL
) {
1015 * Yes - we have to put the new entry after "prevdev".
1021 * Is the new interface's figure of merit less
1022 * than the next interface's figure of merit,
1023 * meaning that the new interface is better
1024 * than the next interface?
1026 nextdev_figure_of_merit
= get_figure_of_merit(nextdev
);
1027 if (this_figure_of_merit
< nextdev_figure_of_merit
) {
1029 * Yes - we should put the new entry
1030 * before "nextdev", i.e. after "prevdev".
1039 * Insert before "nextdev".
1041 curdev
->next
= nextdev
;
1044 * Insert after "prevdev" - unless "prevdev" is null,
1045 * in which case this is the first interface.
1047 if (prevdev
== NULL
) {
1049 * This is the first interface. Make it
1050 * the first element in the list of devices.
1052 devlistp
->beginning
= curdev
;
1054 prevdev
->next
= curdev
;
1059 * Free a list of interfaces.
1062 pcap_freealldevs(pcap_if_t
*alldevs
)
1064 pcap_if_t
*curdev
, *nextdev
;
1065 pcap_addr_t
*curaddr
, *nextaddr
;
1067 for (curdev
= alldevs
; curdev
!= NULL
; curdev
= nextdev
) {
1068 nextdev
= curdev
->next
;
1071 * Free all addresses.
1073 for (curaddr
= curdev
->addresses
; curaddr
!= NULL
; curaddr
= nextaddr
) {
1074 nextaddr
= curaddr
->next
;
1076 free(curaddr
->addr
);
1077 if (curaddr
->netmask
)
1078 free(curaddr
->netmask
);
1079 if (curaddr
->broadaddr
)
1080 free(curaddr
->broadaddr
);
1081 if (curaddr
->dstaddr
)
1082 free(curaddr
->dstaddr
);
1087 * Free the name string.
1092 * Free the description string, if any.
1094 if (curdev
->description
!= NULL
)
1095 free(curdev
->description
);
1098 * Free the interface.
1105 pcap_create(const char *device
, char *errbuf
)
1113 * A null device name is equivalent to the "any" device -
1114 * which might not be supported on this platform, but
1115 * this means that you'll get a "not supported" error
1116 * rather than, say, a crash when we try to dereference
1120 device_str
= strdup("any");
1124 * If the string appears to be little-endian UCS-2/UTF-16,
1125 * convert it to ASCII.
1127 * XXX - to UTF-8 instead? Or report an error if any
1128 * character isn't ASCII?
1130 if (device
[0] != '\0' && device
[1] == '\0') {
1133 length
= wcslen((wchar_t *)device
);
1134 device_str
= (char *)malloc(length
+ 1);
1135 if (device_str
== NULL
) {
1136 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
1137 "malloc: %s", pcap_strerror(errno
));
1141 pcap_snprintf(device_str
, length
+ 1, "%ws",
1142 (const wchar_t *)device
);
1145 device_str
= strdup(device
);
1147 if (device_str
== NULL
) {
1148 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
1149 "malloc: %s", pcap_strerror(errno
));
1154 * Try each of the non-local-network-interface capture
1155 * source types until we find one that works for this
1156 * device or run out of types.
1158 for (i
= 0; capture_source_types
[i
].create_op
!= NULL
; i
++) {
1160 p
= capture_source_types
[i
].create_op(device_str
, errbuf
,
1164 * The device name refers to a device of the
1165 * type in question; either it succeeded,
1166 * in which case p refers to a pcap_t to
1167 * later activate for the device, or it
1168 * failed, in which case p is null and we
1169 * should return that to report the failure
1174 * We assume the caller filled in errbuf.
1179 p
->opt
.device
= device_str
;
1185 * OK, try it as a regular network interface.
1187 p
= pcap_create_interface(device_str
, errbuf
);
1190 * We assume the caller filled in errbuf.
1195 p
->opt
.device
= device_str
;
1200 initialize_ops(pcap_t
*p
)
1203 * Set operation pointers for operations that only work on
1204 * an activated pcap_t to point to a routine that returns
1205 * a "this isn't activated" error.
1207 p
->read_op
= (read_op_t
)pcap_not_initialized
;
1208 p
->inject_op
= (inject_op_t
)pcap_not_initialized
;
1209 p
->setfilter_op
= (setfilter_op_t
)pcap_not_initialized
;
1210 p
->setdirection_op
= (setdirection_op_t
)pcap_not_initialized
;
1211 p
->set_datalink_op
= (set_datalink_op_t
)pcap_not_initialized
;
1212 p
->getnonblock_op
= (getnonblock_op_t
)pcap_not_initialized
;
1213 p
->setnonblock_op
= (setnonblock_op_t
)pcap_not_initialized
;
1214 p
->stats_op
= (stats_op_t
)pcap_not_initialized
;
1216 p
->stats_ex_op
= (stats_ex_op_t
)pcap_not_initialized_ptr
;
1217 p
->setbuff_op
= (setbuff_op_t
)pcap_not_initialized
;
1218 p
->setmode_op
= (setmode_op_t
)pcap_not_initialized
;
1219 p
->setmintocopy_op
= (setmintocopy_op_t
)pcap_not_initialized
;
1220 p
->getevent_op
= pcap_getevent_not_initialized
;
1221 p
->oid_get_request_op
= (oid_get_request_op_t
)pcap_not_initialized
;
1222 p
->oid_set_request_op
= (oid_set_request_op_t
)pcap_not_initialized
;
1223 p
->sendqueue_transmit_op
= pcap_sendqueue_transmit_not_initialized
;
1224 p
->setuserbuffer_op
= (setuserbuffer_op_t
)pcap_not_initialized
;
1225 p
->live_dump_op
= (live_dump_op_t
)pcap_not_initialized
;
1226 p
->live_dump_ended_op
= (live_dump_ended_op_t
)pcap_not_initialized
;
1227 p
->get_airpcap_handle_op
= pcap_get_airpcap_handle_not_initialized
;
1231 * Default cleanup operation - implementations can override
1232 * this, but should call pcap_cleanup_live_common() after
1233 * doing their own additional cleanup.
1235 p
->cleanup_op
= pcap_cleanup_live_common
;
1238 * In most cases, the standard one-shot callback can
1239 * be used for pcap_next()/pcap_next_ex().
1241 p
->oneshot_callback
= pcap_oneshot
;
1245 pcap_alloc_pcap_t(char *ebuf
, size_t size
)
1251 * Allocate a chunk of memory big enough for a pcap_t
1252 * plus a structure following it of size "size". The
1253 * structure following it is a private data structure
1254 * for the routines that handle this pcap_t.
1256 chunk
= malloc(sizeof (pcap_t
) + size
);
1257 if (chunk
== NULL
) {
1258 pcap_snprintf(ebuf
, PCAP_ERRBUF_SIZE
, "malloc: %s",
1259 pcap_strerror(errno
));
1262 memset(chunk
, 0, sizeof (pcap_t
) + size
);
1265 * Get a pointer to the pcap_t at the beginning.
1267 p
= (pcap_t
*)chunk
;
1270 p
->fd
= -1; /* not opened yet */
1271 p
->selectable_fd
= -1;
1275 /* No private data was requested. */
1279 * Set the pointer to the private data; that's the structure
1280 * of size "size" following the pcap_t.
1282 p
->priv
= (void *)(chunk
+ sizeof (pcap_t
));
1289 pcap_create_common(char *ebuf
, size_t size
)
1293 p
= pcap_alloc_pcap_t(ebuf
, size
);
1298 * Default to "can't set rfmon mode"; if it's supported by
1299 * a platform, the create routine that called us can set
1300 * the op to its routine to check whether a particular
1301 * device supports it.
1303 p
->can_set_rfmon_op
= pcap_cant_set_rfmon
;
1307 /* put in some defaults*/
1308 p
->snapshot
= MAXIMUM_SNAPLEN
; /* max packet size */
1309 p
->opt
.timeout
= 0; /* no timeout specified */
1310 p
->opt
.buffer_size
= 0; /* use the platform's default */
1313 p
->opt
.immediate
= 0;
1314 p
->opt
.tstamp_type
= -1; /* default to not setting time stamp type */
1315 p
->opt
.tstamp_precision
= PCAP_TSTAMP_PRECISION_MICRO
;
1318 * Start out with no BPF code generation flags set.
1320 p
->bpf_codegen_flags
= 0;
1326 pcap_check_activated(pcap_t
*p
)
1329 pcap_snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "can't perform "
1330 " operation on activated capture");
1337 pcap_set_snaplen(pcap_t
*p
, int snaplen
)
1339 if (pcap_check_activated(p
))
1340 return (PCAP_ERROR_ACTIVATED
);
1343 * Turn invalid values, or excessively large values, into
1344 * the maximum allowed value.
1346 * If some application really *needs* a bigger snapshot
1347 * length, we should just increase MAXIMUM_SNAPLEN.
1349 if (snaplen
<= 0 || snaplen
> MAXIMUM_SNAPLEN
)
1350 snaplen
= MAXIMUM_SNAPLEN
;
1351 p
->snapshot
= snaplen
;
1356 pcap_set_promisc(pcap_t
*p
, int promisc
)
1358 if (pcap_check_activated(p
))
1359 return (PCAP_ERROR_ACTIVATED
);
1360 p
->opt
.promisc
= promisc
;
1365 pcap_set_rfmon(pcap_t
*p
, int rfmon
)
1367 if (pcap_check_activated(p
))
1368 return (PCAP_ERROR_ACTIVATED
);
1369 p
->opt
.rfmon
= rfmon
;
1374 pcap_set_timeout(pcap_t
*p
, int timeout_ms
)
1376 if (pcap_check_activated(p
))
1377 return (PCAP_ERROR_ACTIVATED
);
1378 p
->opt
.timeout
= timeout_ms
;
1383 pcap_set_tstamp_type(pcap_t
*p
, int tstamp_type
)
1387 if (pcap_check_activated(p
))
1388 return (PCAP_ERROR_ACTIVATED
);
1391 * The argument should have been u_int, but that's too late
1392 * to change now - it's an API.
1394 if (tstamp_type
< 0)
1395 return (PCAP_WARNING_TSTAMP_TYPE_NOTSUP
);
1398 * If p->tstamp_type_count is 0, we only support PCAP_TSTAMP_HOST;
1399 * the default time stamp type is PCAP_TSTAMP_HOST.
1401 if (p
->tstamp_type_count
== 0) {
1402 if (tstamp_type
== PCAP_TSTAMP_HOST
) {
1403 p
->opt
.tstamp_type
= tstamp_type
;
1408 * Check whether we claim to support this type of time stamp.
1410 for (i
= 0; i
< p
->tstamp_type_count
; i
++) {
1411 if (p
->tstamp_type_list
[i
] == (u_int
)tstamp_type
) {
1415 p
->opt
.tstamp_type
= tstamp_type
;
1422 * We don't support this type of time stamp.
1424 return (PCAP_WARNING_TSTAMP_TYPE_NOTSUP
);
1428 pcap_set_immediate_mode(pcap_t
*p
, int immediate
)
1430 if (pcap_check_activated(p
))
1431 return (PCAP_ERROR_ACTIVATED
);
1432 p
->opt
.immediate
= immediate
;
1437 pcap_set_buffer_size(pcap_t
*p
, int buffer_size
)
1439 if (pcap_check_activated(p
))
1440 return (PCAP_ERROR_ACTIVATED
);
1441 if (buffer_size
<= 0) {
1443 * Silently ignore invalid values.
1447 p
->opt
.buffer_size
= buffer_size
;
1452 pcap_set_tstamp_precision(pcap_t
*p
, int tstamp_precision
)
1456 if (pcap_check_activated(p
))
1457 return (PCAP_ERROR_ACTIVATED
);
1460 * The argument should have been u_int, but that's too late
1461 * to change now - it's an API.
1463 if (tstamp_precision
< 0)
1464 return (PCAP_ERROR_TSTAMP_PRECISION_NOTSUP
);
1467 * If p->tstamp_precision_count is 0, we only support setting
1468 * the time stamp precision to microsecond precision; every
1469 * pcap module *MUST* support microsecond precision, even if
1470 * it does so by converting the native precision to
1473 if (p
->tstamp_precision_count
== 0) {
1474 if (tstamp_precision
== PCAP_TSTAMP_PRECISION_MICRO
) {
1475 p
->opt
.tstamp_precision
= tstamp_precision
;
1480 * Check whether we claim to support this precision of
1483 for (i
= 0; i
< p
->tstamp_precision_count
; i
++) {
1484 if (p
->tstamp_precision_list
[i
] == (u_int
)tstamp_precision
) {
1488 p
->opt
.tstamp_precision
= tstamp_precision
;
1495 * We don't support this time stamp precision.
1497 return (PCAP_ERROR_TSTAMP_PRECISION_NOTSUP
);
1501 pcap_get_tstamp_precision(pcap_t
*p
)
1503 return (p
->opt
.tstamp_precision
);
1507 pcap_activate(pcap_t
*p
)
1512 * Catch attempts to re-activate an already-activated
1513 * pcap_t; this should, for example, catch code that
1514 * calls pcap_open_live() followed by pcap_activate(),
1515 * as some code that showed up in a Stack Exchange
1518 if (pcap_check_activated(p
))
1519 return (PCAP_ERROR_ACTIVATED
);
1520 status
= p
->activate_op(p
);
1524 if (p
->errbuf
[0] == '\0') {
1526 * No error message supplied by the activate routine;
1527 * for the benefit of programs that don't specially
1528 * handle errors other than PCAP_ERROR, return the
1529 * error message corresponding to the status.
1531 pcap_snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "%s",
1532 pcap_statustostr(status
));
1536 * Undo any operation pointer setting, etc. done by
1537 * the activate operation.
1545 pcap_open_live(const char *device
, int snaplen
, int promisc
, int to_ms
, char *errbuf
)
1550 p
= pcap_create(device
, errbuf
);
1553 status
= pcap_set_snaplen(p
, snaplen
);
1556 status
= pcap_set_promisc(p
, promisc
);
1559 status
= pcap_set_timeout(p
, to_ms
);
1563 * Mark this as opened with pcap_open_live(), so that, for
1564 * example, we show the full list of DLT_ values, rather
1565 * than just the ones that are compatible with capturing
1566 * when not in monitor mode. That allows existing applications
1567 * to work the way they used to work, but allows new applications
1568 * that know about the new open API to, for example, find out the
1569 * DLT_ values that they can select without changing whether
1570 * the adapter is in monitor mode or not.
1573 status
= pcap_activate(p
);
1578 if (status
== PCAP_ERROR
)
1579 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "%s: %s", device
,
1581 else if (status
== PCAP_ERROR_NO_SUCH_DEVICE
||
1582 status
== PCAP_ERROR_PERM_DENIED
||
1583 status
== PCAP_ERROR_PROMISC_PERM_DENIED
)
1584 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "%s: %s (%s)", device
,
1585 pcap_statustostr(status
), p
->errbuf
);
1587 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "%s: %s", device
,
1588 pcap_statustostr(status
));
1594 pcap_open_offline_common(char *ebuf
, size_t size
)
1598 p
= pcap_alloc_pcap_t(ebuf
, size
);
1602 p
->opt
.tstamp_precision
= PCAP_TSTAMP_PRECISION_MICRO
;
1608 pcap_dispatch(pcap_t
*p
, int cnt
, pcap_handler callback
, u_char
*user
)
1610 return (p
->read_op(p
, cnt
, callback
, user
));
1614 pcap_loop(pcap_t
*p
, int cnt
, pcap_handler callback
, u_char
*user
)
1619 if (p
->rfile
!= NULL
) {
1621 * 0 means EOF, so don't loop if we get 0.
1623 n
= pcap_offline_read(p
, cnt
, callback
, user
);
1626 * XXX keep reading until we get something
1627 * (or an error occurs)
1630 n
= p
->read_op(p
, cnt
, callback
, user
);
1635 if (!PACKET_COUNT_IS_UNLIMITED(cnt
)) {
1644 * Force the loop in "pcap_read()" or "pcap_read_offline()" to terminate.
1647 pcap_breakloop(pcap_t
*p
)
1653 pcap_datalink(pcap_t
*p
)
1656 return (PCAP_ERROR_NOT_ACTIVATED
);
1657 return (p
->linktype
);
1661 pcap_datalink_ext(pcap_t
*p
)
1664 return (PCAP_ERROR_NOT_ACTIVATED
);
1665 return (p
->linktype_ext
);
1669 pcap_list_datalinks(pcap_t
*p
, int **dlt_buffer
)
1672 return (PCAP_ERROR_NOT_ACTIVATED
);
1673 if (p
->dlt_count
== 0) {
1675 * We couldn't fetch the list of DLTs, which means
1676 * this platform doesn't support changing the
1677 * DLT for an interface. Return a list of DLTs
1678 * containing only the DLT this device supports.
1680 *dlt_buffer
= (int*)malloc(sizeof(**dlt_buffer
));
1681 if (*dlt_buffer
== NULL
) {
1682 (void)pcap_snprintf(p
->errbuf
, sizeof(p
->errbuf
),
1683 "malloc: %s", pcap_strerror(errno
));
1684 return (PCAP_ERROR
);
1686 **dlt_buffer
= p
->linktype
;
1689 *dlt_buffer
= (int*)calloc(sizeof(**dlt_buffer
), p
->dlt_count
);
1690 if (*dlt_buffer
== NULL
) {
1691 (void)pcap_snprintf(p
->errbuf
, sizeof(p
->errbuf
),
1692 "malloc: %s", pcap_strerror(errno
));
1693 return (PCAP_ERROR
);
1695 (void)memcpy(*dlt_buffer
, p
->dlt_list
,
1696 sizeof(**dlt_buffer
) * p
->dlt_count
);
1697 return (p
->dlt_count
);
1702 * In Windows, you might have a library built with one version of the
1703 * C runtime library and an application built with another version of
1704 * the C runtime library, which means that the library might use one
1705 * version of malloc() and free() and the application might use another
1706 * version of malloc() and free(). If so, that means something
1707 * allocated by the library cannot be freed by the application, so we
1708 * need to have a pcap_free_datalinks() routine to free up the list
1709 * allocated by pcap_list_datalinks(), even though it's just a wrapper
1713 pcap_free_datalinks(int *dlt_list
)
1719 pcap_set_datalink(pcap_t
*p
, int dlt
)
1722 const char *dlt_name
;
1727 if (p
->dlt_count
== 0 || p
->set_datalink_op
== NULL
) {
1729 * We couldn't fetch the list of DLTs, or we don't
1730 * have a "set datalink" operation, which means
1731 * this platform doesn't support changing the
1732 * DLT for an interface. Check whether the new
1733 * DLT is the one this interface supports.
1735 if (p
->linktype
!= dlt
)
1739 * It is, so there's nothing we need to do here.
1743 for (i
= 0; i
< p
->dlt_count
; i
++)
1744 if (p
->dlt_list
[i
] == (u_int
)dlt
)
1746 if (i
>= p
->dlt_count
)
1748 if (p
->dlt_count
== 2 && p
->dlt_list
[0] == DLT_EN10MB
&&
1749 dlt
== DLT_DOCSIS
) {
1751 * This is presumably an Ethernet device, as the first
1752 * link-layer type it offers is DLT_EN10MB, and the only
1753 * other type it offers is DLT_DOCSIS. That means that
1754 * we can't tell the driver to supply DOCSIS link-layer
1755 * headers - we're just pretending that's what we're
1756 * getting, as, presumably, we're capturing on a dedicated
1757 * link to a Cisco Cable Modem Termination System, and
1758 * it's putting raw DOCSIS frames on the wire inside low-level
1764 if (p
->set_datalink_op(p
, dlt
) == -1)
1770 dlt_name
= pcap_datalink_val_to_name(dlt
);
1771 if (dlt_name
!= NULL
) {
1772 (void) pcap_snprintf(p
->errbuf
, sizeof(p
->errbuf
),
1773 "%s is not one of the DLTs supported by this device",
1776 (void) pcap_snprintf(p
->errbuf
, sizeof(p
->errbuf
),
1777 "DLT %d is not one of the DLTs supported by this device",
1784 * This array is designed for mapping upper and lower case letter
1785 * together for a case independent comparison. The mappings are
1786 * based upon ascii character sequences.
1788 static const u_char charmap
[] = {
1789 (u_char
)'\000', (u_char
)'\001', (u_char
)'\002', (u_char
)'\003',
1790 (u_char
)'\004', (u_char
)'\005', (u_char
)'\006', (u_char
)'\007',
1791 (u_char
)'\010', (u_char
)'\011', (u_char
)'\012', (u_char
)'\013',
1792 (u_char
)'\014', (u_char
)'\015', (u_char
)'\016', (u_char
)'\017',
1793 (u_char
)'\020', (u_char
)'\021', (u_char
)'\022', (u_char
)'\023',
1794 (u_char
)'\024', (u_char
)'\025', (u_char
)'\026', (u_char
)'\027',
1795 (u_char
)'\030', (u_char
)'\031', (u_char
)'\032', (u_char
)'\033',
1796 (u_char
)'\034', (u_char
)'\035', (u_char
)'\036', (u_char
)'\037',
1797 (u_char
)'\040', (u_char
)'\041', (u_char
)'\042', (u_char
)'\043',
1798 (u_char
)'\044', (u_char
)'\045', (u_char
)'\046', (u_char
)'\047',
1799 (u_char
)'\050', (u_char
)'\051', (u_char
)'\052', (u_char
)'\053',
1800 (u_char
)'\054', (u_char
)'\055', (u_char
)'\056', (u_char
)'\057',
1801 (u_char
)'\060', (u_char
)'\061', (u_char
)'\062', (u_char
)'\063',
1802 (u_char
)'\064', (u_char
)'\065', (u_char
)'\066', (u_char
)'\067',
1803 (u_char
)'\070', (u_char
)'\071', (u_char
)'\072', (u_char
)'\073',
1804 (u_char
)'\074', (u_char
)'\075', (u_char
)'\076', (u_char
)'\077',
1805 (u_char
)'\100', (u_char
)'\141', (u_char
)'\142', (u_char
)'\143',
1806 (u_char
)'\144', (u_char
)'\145', (u_char
)'\146', (u_char
)'\147',
1807 (u_char
)'\150', (u_char
)'\151', (u_char
)'\152', (u_char
)'\153',
1808 (u_char
)'\154', (u_char
)'\155', (u_char
)'\156', (u_char
)'\157',
1809 (u_char
)'\160', (u_char
)'\161', (u_char
)'\162', (u_char
)'\163',
1810 (u_char
)'\164', (u_char
)'\165', (u_char
)'\166', (u_char
)'\167',
1811 (u_char
)'\170', (u_char
)'\171', (u_char
)'\172', (u_char
)'\133',
1812 (u_char
)'\134', (u_char
)'\135', (u_char
)'\136', (u_char
)'\137',
1813 (u_char
)'\140', (u_char
)'\141', (u_char
)'\142', (u_char
)'\143',
1814 (u_char
)'\144', (u_char
)'\145', (u_char
)'\146', (u_char
)'\147',
1815 (u_char
)'\150', (u_char
)'\151', (u_char
)'\152', (u_char
)'\153',
1816 (u_char
)'\154', (u_char
)'\155', (u_char
)'\156', (u_char
)'\157',
1817 (u_char
)'\160', (u_char
)'\161', (u_char
)'\162', (u_char
)'\163',
1818 (u_char
)'\164', (u_char
)'\165', (u_char
)'\166', (u_char
)'\167',
1819 (u_char
)'\170', (u_char
)'\171', (u_char
)'\172', (u_char
)'\173',
1820 (u_char
)'\174', (u_char
)'\175', (u_char
)'\176', (u_char
)'\177',
1821 (u_char
)'\200', (u_char
)'\201', (u_char
)'\202', (u_char
)'\203',
1822 (u_char
)'\204', (u_char
)'\205', (u_char
)'\206', (u_char
)'\207',
1823 (u_char
)'\210', (u_char
)'\211', (u_char
)'\212', (u_char
)'\213',
1824 (u_char
)'\214', (u_char
)'\215', (u_char
)'\216', (u_char
)'\217',
1825 (u_char
)'\220', (u_char
)'\221', (u_char
)'\222', (u_char
)'\223',
1826 (u_char
)'\224', (u_char
)'\225', (u_char
)'\226', (u_char
)'\227',
1827 (u_char
)'\230', (u_char
)'\231', (u_char
)'\232', (u_char
)'\233',
1828 (u_char
)'\234', (u_char
)'\235', (u_char
)'\236', (u_char
)'\237',
1829 (u_char
)'\240', (u_char
)'\241', (u_char
)'\242', (u_char
)'\243',
1830 (u_char
)'\244', (u_char
)'\245', (u_char
)'\246', (u_char
)'\247',
1831 (u_char
)'\250', (u_char
)'\251', (u_char
)'\252', (u_char
)'\253',
1832 (u_char
)'\254', (u_char
)'\255', (u_char
)'\256', (u_char
)'\257',
1833 (u_char
)'\260', (u_char
)'\261', (u_char
)'\262', (u_char
)'\263',
1834 (u_char
)'\264', (u_char
)'\265', (u_char
)'\266', (u_char
)'\267',
1835 (u_char
)'\270', (u_char
)'\271', (u_char
)'\272', (u_char
)'\273',
1836 (u_char
)'\274', (u_char
)'\275', (u_char
)'\276', (u_char
)'\277',
1837 (u_char
)'\300', (u_char
)'\341', (u_char
)'\342', (u_char
)'\343',
1838 (u_char
)'\344', (u_char
)'\345', (u_char
)'\346', (u_char
)'\347',
1839 (u_char
)'\350', (u_char
)'\351', (u_char
)'\352', (u_char
)'\353',
1840 (u_char
)'\354', (u_char
)'\355', (u_char
)'\356', (u_char
)'\357',
1841 (u_char
)'\360', (u_char
)'\361', (u_char
)'\362', (u_char
)'\363',
1842 (u_char
)'\364', (u_char
)'\365', (u_char
)'\366', (u_char
)'\367',
1843 (u_char
)'\370', (u_char
)'\371', (u_char
)'\372', (u_char
)'\333',
1844 (u_char
)'\334', (u_char
)'\335', (u_char
)'\336', (u_char
)'\337',
1845 (u_char
)'\340', (u_char
)'\341', (u_char
)'\342', (u_char
)'\343',
1846 (u_char
)'\344', (u_char
)'\345', (u_char
)'\346', (u_char
)'\347',
1847 (u_char
)'\350', (u_char
)'\351', (u_char
)'\352', (u_char
)'\353',
1848 (u_char
)'\354', (u_char
)'\355', (u_char
)'\356', (u_char
)'\357',
1849 (u_char
)'\360', (u_char
)'\361', (u_char
)'\362', (u_char
)'\363',
1850 (u_char
)'\364', (u_char
)'\365', (u_char
)'\366', (u_char
)'\367',
1851 (u_char
)'\370', (u_char
)'\371', (u_char
)'\372', (u_char
)'\373',
1852 (u_char
)'\374', (u_char
)'\375', (u_char
)'\376', (u_char
)'\377',
1856 pcap_strcasecmp(const char *s1
, const char *s2
)
1858 register const u_char
*cm
= charmap
,
1859 *us1
= (const u_char
*)s1
,
1860 *us2
= (const u_char
*)s2
;
1862 while (cm
[*us1
] == cm
[*us2
++])
1865 return (cm
[*us1
] - cm
[*--us2
]);
1870 const char *description
;
1874 #define DLT_CHOICE(code, description) { #code, description, DLT_ ## code }
1875 #define DLT_CHOICE_SENTINEL { NULL, NULL, 0 }
1877 static struct dlt_choice dlt_choices
[] = {
1878 DLT_CHOICE(NULL
, "BSD loopback"),
1879 DLT_CHOICE(EN10MB
, "Ethernet"),
1880 DLT_CHOICE(IEEE802
, "Token ring"),
1881 DLT_CHOICE(ARCNET
, "BSD ARCNET"),
1882 DLT_CHOICE(SLIP
, "SLIP"),
1883 DLT_CHOICE(PPP
, "PPP"),
1884 DLT_CHOICE(FDDI
, "FDDI"),
1885 DLT_CHOICE(ATM_RFC1483
, "RFC 1483 LLC-encapsulated ATM"),
1886 DLT_CHOICE(RAW
, "Raw IP"),
1887 DLT_CHOICE(SLIP_BSDOS
, "BSD/OS SLIP"),
1888 DLT_CHOICE(PPP_BSDOS
, "BSD/OS PPP"),
1889 DLT_CHOICE(ATM_CLIP
, "Linux Classical IP-over-ATM"),
1890 DLT_CHOICE(PPP_SERIAL
, "PPP over serial"),
1891 DLT_CHOICE(PPP_ETHER
, "PPPoE"),
1892 DLT_CHOICE(SYMANTEC_FIREWALL
, "Symantec Firewall"),
1893 DLT_CHOICE(C_HDLC
, "Cisco HDLC"),
1894 DLT_CHOICE(IEEE802_11
, "802.11"),
1895 DLT_CHOICE(FRELAY
, "Frame Relay"),
1896 DLT_CHOICE(LOOP
, "OpenBSD loopback"),
1897 DLT_CHOICE(ENC
, "OpenBSD encapsulated IP"),
1898 DLT_CHOICE(LINUX_SLL
, "Linux cooked"),
1899 DLT_CHOICE(LTALK
, "Localtalk"),
1900 DLT_CHOICE(PFLOG
, "OpenBSD pflog file"),
1901 DLT_CHOICE(PFSYNC
, "Packet filter state syncing"),
1902 DLT_CHOICE(PRISM_HEADER
, "802.11 plus Prism header"),
1903 DLT_CHOICE(IP_OVER_FC
, "RFC 2625 IP-over-Fibre Channel"),
1904 DLT_CHOICE(SUNATM
, "Sun raw ATM"),
1905 DLT_CHOICE(IEEE802_11_RADIO
, "802.11 plus radiotap header"),
1906 DLT_CHOICE(ARCNET_LINUX
, "Linux ARCNET"),
1907 DLT_CHOICE(JUNIPER_MLPPP
, "Juniper Multi-Link PPP"),
1908 DLT_CHOICE(JUNIPER_MLFR
, "Juniper Multi-Link Frame Relay"),
1909 DLT_CHOICE(JUNIPER_ES
, "Juniper Encryption Services PIC"),
1910 DLT_CHOICE(JUNIPER_GGSN
, "Juniper GGSN PIC"),
1911 DLT_CHOICE(JUNIPER_MFR
, "Juniper FRF.16 Frame Relay"),
1912 DLT_CHOICE(JUNIPER_ATM2
, "Juniper ATM2 PIC"),
1913 DLT_CHOICE(JUNIPER_SERVICES
, "Juniper Advanced Services PIC"),
1914 DLT_CHOICE(JUNIPER_ATM1
, "Juniper ATM1 PIC"),
1915 DLT_CHOICE(APPLE_IP_OVER_IEEE1394
, "Apple IP-over-IEEE 1394"),
1916 DLT_CHOICE(MTP2_WITH_PHDR
, "SS7 MTP2 with Pseudo-header"),
1917 DLT_CHOICE(MTP2
, "SS7 MTP2"),
1918 DLT_CHOICE(MTP3
, "SS7 MTP3"),
1919 DLT_CHOICE(SCCP
, "SS7 SCCP"),
1920 DLT_CHOICE(DOCSIS
, "DOCSIS"),
1921 DLT_CHOICE(LINUX_IRDA
, "Linux IrDA"),
1922 DLT_CHOICE(IEEE802_11_RADIO_AVS
, "802.11 plus AVS radio information header"),
1923 DLT_CHOICE(JUNIPER_MONITOR
, "Juniper Passive Monitor PIC"),
1924 DLT_CHOICE(BACNET_MS_TP
, "BACnet MS/TP"),
1925 DLT_CHOICE(PPP_PPPD
, "PPP for pppd, with direction flag"),
1926 DLT_CHOICE(JUNIPER_PPPOE
, "Juniper PPPoE"),
1927 DLT_CHOICE(JUNIPER_PPPOE_ATM
, "Juniper PPPoE/ATM"),
1928 DLT_CHOICE(GPRS_LLC
, "GPRS LLC"),
1929 DLT_CHOICE(GPF_T
, "GPF-T"),
1930 DLT_CHOICE(GPF_F
, "GPF-F"),
1931 DLT_CHOICE(JUNIPER_PIC_PEER
, "Juniper PIC Peer"),
1932 DLT_CHOICE(ERF_ETH
, "Ethernet with Endace ERF header"),
1933 DLT_CHOICE(ERF_POS
, "Packet-over-SONET with Endace ERF header"),
1934 DLT_CHOICE(LINUX_LAPD
, "Linux vISDN LAPD"),
1935 DLT_CHOICE(JUNIPER_ETHER
, "Juniper Ethernet"),
1936 DLT_CHOICE(JUNIPER_PPP
, "Juniper PPP"),
1937 DLT_CHOICE(JUNIPER_FRELAY
, "Juniper Frame Relay"),
1938 DLT_CHOICE(JUNIPER_CHDLC
, "Juniper C-HDLC"),
1939 DLT_CHOICE(MFR
, "FRF.16 Frame Relay"),
1940 DLT_CHOICE(JUNIPER_VP
, "Juniper Voice PIC"),
1941 DLT_CHOICE(A429
, "Arinc 429"),
1942 DLT_CHOICE(A653_ICM
, "Arinc 653 Interpartition Communication"),
1943 DLT_CHOICE(USB_FREEBSD
, "USB with FreeBSD header"),
1944 DLT_CHOICE(BLUETOOTH_HCI_H4
, "Bluetooth HCI UART transport layer"),
1945 DLT_CHOICE(IEEE802_16_MAC_CPS
, "IEEE 802.16 MAC Common Part Sublayer"),
1946 DLT_CHOICE(USB_LINUX
, "USB with Linux header"),
1947 DLT_CHOICE(CAN20B
, "Controller Area Network (CAN) v. 2.0B"),
1948 DLT_CHOICE(IEEE802_15_4_LINUX
, "IEEE 802.15.4 with Linux padding"),
1949 DLT_CHOICE(PPI
, "Per-Packet Information"),
1950 DLT_CHOICE(IEEE802_16_MAC_CPS_RADIO
, "IEEE 802.16 MAC Common Part Sublayer plus radiotap header"),
1951 DLT_CHOICE(JUNIPER_ISM
, "Juniper Integrated Service Module"),
1952 DLT_CHOICE(IEEE802_15_4
, "IEEE 802.15.4 with FCS"),
1953 DLT_CHOICE(SITA
, "SITA pseudo-header"),
1954 DLT_CHOICE(ERF
, "Endace ERF header"),
1955 DLT_CHOICE(RAIF1
, "Ethernet with u10 Networks pseudo-header"),
1956 DLT_CHOICE(IPMB
, "IPMB"),
1957 DLT_CHOICE(JUNIPER_ST
, "Juniper Secure Tunnel"),
1958 DLT_CHOICE(BLUETOOTH_HCI_H4_WITH_PHDR
, "Bluetooth HCI UART transport layer plus pseudo-header"),
1959 DLT_CHOICE(AX25_KISS
, "AX.25 with KISS header"),
1960 DLT_CHOICE(IEEE802_15_4_NONASK_PHY
, "IEEE 802.15.4 with non-ASK PHY data"),
1961 DLT_CHOICE(MPLS
, "MPLS with label as link-layer header"),
1962 DLT_CHOICE(LINUX_EVDEV
, "Linux evdev events"),
1963 DLT_CHOICE(USB_LINUX_MMAPPED
, "USB with padded Linux header"),
1964 DLT_CHOICE(DECT
, "DECT"),
1965 DLT_CHOICE(AOS
, "AOS Space Data Link protocol"),
1966 DLT_CHOICE(WIHART
, "Wireless HART"),
1967 DLT_CHOICE(FC_2
, "Fibre Channel FC-2"),
1968 DLT_CHOICE(FC_2_WITH_FRAME_DELIMS
, "Fibre Channel FC-2 with frame delimiters"),
1969 DLT_CHOICE(IPNET
, "Solaris ipnet"),
1970 DLT_CHOICE(CAN_SOCKETCAN
, "CAN-bus with SocketCAN headers"),
1971 DLT_CHOICE(IPV4
, "Raw IPv4"),
1972 DLT_CHOICE(IPV6
, "Raw IPv6"),
1973 DLT_CHOICE(IEEE802_15_4_NOFCS
, "IEEE 802.15.4 without FCS"),
1974 DLT_CHOICE(DBUS
, "D-Bus"),
1975 DLT_CHOICE(JUNIPER_VS
, "Juniper Virtual Server"),
1976 DLT_CHOICE(JUNIPER_SRX_E2E
, "Juniper SRX E2E"),
1977 DLT_CHOICE(JUNIPER_FIBRECHANNEL
, "Juniper Fibre Channel"),
1978 DLT_CHOICE(DVB_CI
, "DVB-CI"),
1979 DLT_CHOICE(MUX27010
, "MUX27010"),
1980 DLT_CHOICE(STANAG_5066_D_PDU
, "STANAG 5066 D_PDUs"),
1981 DLT_CHOICE(JUNIPER_ATM_CEMIC
, "Juniper ATM CEMIC"),
1982 DLT_CHOICE(NFLOG
, "Linux netfilter log messages"),
1983 DLT_CHOICE(NETANALYZER
, "Ethernet with Hilscher netANALYZER pseudo-header"),
1984 DLT_CHOICE(NETANALYZER_TRANSPARENT
, "Ethernet with Hilscher netANALYZER pseudo-header and with preamble and SFD"),
1985 DLT_CHOICE(IPOIB
, "RFC 4391 IP-over-Infiniband"),
1986 DLT_CHOICE(MPEG_2_TS
, "MPEG-2 transport stream"),
1987 DLT_CHOICE(NG40
, "ng40 protocol tester Iub/Iur"),
1988 DLT_CHOICE(NFC_LLCP
, "NFC LLCP PDUs with pseudo-header"),
1989 DLT_CHOICE(INFINIBAND
, "InfiniBand"),
1990 DLT_CHOICE(SCTP
, "SCTP"),
1991 DLT_CHOICE(USBPCAP
, "USB with USBPcap header"),
1992 DLT_CHOICE(RTAC_SERIAL
, "Schweitzer Engineering Laboratories RTAC packets"),
1993 DLT_CHOICE(BLUETOOTH_LE_LL
, "Bluetooth Low Energy air interface"),
1994 DLT_CHOICE(NETLINK
, "Linux netlink"),
1995 DLT_CHOICE(BLUETOOTH_LINUX_MONITOR
, "Bluetooth Linux Monitor"),
1996 DLT_CHOICE(BLUETOOTH_BREDR_BB
, "Bluetooth Basic Rate/Enhanced Data Rate baseband packets"),
1997 DLT_CHOICE(BLUETOOTH_LE_LL_WITH_PHDR
, "Bluetooth Low Energy air interface with pseudo-header"),
1998 DLT_CHOICE(PROFIBUS_DL
, "PROFIBUS data link layer"),
1999 DLT_CHOICE(PKTAP
, "Apple DLT_PKTAP"),
2000 DLT_CHOICE(EPON
, "Ethernet with 802.3 Clause 65 EPON preamble"),
2001 DLT_CHOICE(IPMI_HPM_2
, "IPMI trace packets"),
2002 DLT_CHOICE(ZWAVE_R1_R2
, "Z-Wave RF profile R1 and R2 packets"),
2003 DLT_CHOICE(ZWAVE_R3
, "Z-Wave RF profile R3 packets"),
2004 DLT_CHOICE(WATTSTOPPER_DLM
, "WattStopper Digital Lighting Management (DLM) and Legrand Nitoo Open protocol"),
2005 DLT_CHOICE(ISO_14443
, "ISO 14443 messages"),
2006 DLT_CHOICE(RDS
, "IEC 62106 Radio Data System groups"),
2007 DLT_CHOICE(USB_DARWIN
, "USB with Darwin header"),
2012 pcap_datalink_name_to_val(const char *name
)
2016 for (i
= 0; dlt_choices
[i
].name
!= NULL
; i
++) {
2017 if (pcap_strcasecmp(dlt_choices
[i
].name
, name
) == 0)
2018 return (dlt_choices
[i
].dlt
);
2024 pcap_datalink_val_to_name(int dlt
)
2028 for (i
= 0; dlt_choices
[i
].name
!= NULL
; i
++) {
2029 if (dlt_choices
[i
].dlt
== dlt
)
2030 return (dlt_choices
[i
].name
);
2036 pcap_datalink_val_to_description(int dlt
)
2040 for (i
= 0; dlt_choices
[i
].name
!= NULL
; i
++) {
2041 if (dlt_choices
[i
].dlt
== dlt
)
2042 return (dlt_choices
[i
].description
);
2047 struct tstamp_type_choice
{
2049 const char *description
;
2053 static struct tstamp_type_choice tstamp_type_choices
[] = {
2054 { "host", "Host", PCAP_TSTAMP_HOST
},
2055 { "host_lowprec", "Host, low precision", PCAP_TSTAMP_HOST_LOWPREC
},
2056 { "host_hiprec", "Host, high precision", PCAP_TSTAMP_HOST_HIPREC
},
2057 { "adapter", "Adapter", PCAP_TSTAMP_ADAPTER
},
2058 { "adapter_unsynced", "Adapter, not synced with system time", PCAP_TSTAMP_ADAPTER_UNSYNCED
},
2063 pcap_tstamp_type_name_to_val(const char *name
)
2067 for (i
= 0; tstamp_type_choices
[i
].name
!= NULL
; i
++) {
2068 if (pcap_strcasecmp(tstamp_type_choices
[i
].name
, name
) == 0)
2069 return (tstamp_type_choices
[i
].type
);
2071 return (PCAP_ERROR
);
2075 pcap_tstamp_type_val_to_name(int tstamp_type
)
2079 for (i
= 0; tstamp_type_choices
[i
].name
!= NULL
; i
++) {
2080 if (tstamp_type_choices
[i
].type
== tstamp_type
)
2081 return (tstamp_type_choices
[i
].name
);
2087 pcap_tstamp_type_val_to_description(int tstamp_type
)
2091 for (i
= 0; tstamp_type_choices
[i
].name
!= NULL
; i
++) {
2092 if (tstamp_type_choices
[i
].type
== tstamp_type
)
2093 return (tstamp_type_choices
[i
].description
);
2099 pcap_snapshot(pcap_t
*p
)
2102 return (PCAP_ERROR_NOT_ACTIVATED
);
2103 return (p
->snapshot
);
2107 pcap_is_swapped(pcap_t
*p
)
2110 return (PCAP_ERROR_NOT_ACTIVATED
);
2111 return (p
->swapped
);
2115 pcap_major_version(pcap_t
*p
)
2118 return (PCAP_ERROR_NOT_ACTIVATED
);
2119 return (p
->version_major
);
2123 pcap_minor_version(pcap_t
*p
)
2126 return (PCAP_ERROR_NOT_ACTIVATED
);
2127 return (p
->version_minor
);
2131 pcap_file(pcap_t
*p
)
2137 pcap_fileno(pcap_t
*p
)
2142 if (p
->adapter
!= NULL
)
2143 return ((int)(DWORD
)p
->adapter
->hFile
);
2145 return (PCAP_ERROR
);
2149 #if !defined(_WIN32) && !defined(MSDOS)
2151 pcap_get_selectable_fd(pcap_t
*p
)
2153 return (p
->selectable_fd
);
2158 pcap_perror(pcap_t
*p
, const char *prefix
)
2160 fprintf(stderr
, "%s: %s\n", prefix
, p
->errbuf
);
2164 pcap_geterr(pcap_t
*p
)
2170 pcap_getnonblock(pcap_t
*p
, char *errbuf
)
2174 ret
= p
->getnonblock_op(p
, errbuf
);
2177 * In case somebody depended on the bug wherein
2178 * the error message was put into p->errbuf
2179 * by pcap_getnonblock_fd().
2181 strlcpy(p
->errbuf
, errbuf
, PCAP_ERRBUF_SIZE
);
2187 * Get the current non-blocking mode setting, under the assumption that
2188 * it's just the standard POSIX non-blocking flag.
2190 #if !defined(_WIN32) && !defined(MSDOS)
2192 pcap_getnonblock_fd(pcap_t
*p
, char *errbuf
)
2196 fdflags
= fcntl(p
->fd
, F_GETFL
, 0);
2197 if (fdflags
== -1) {
2198 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "F_GETFL: %s",
2199 pcap_strerror(errno
));
2202 if (fdflags
& O_NONBLOCK
)
2210 pcap_setnonblock(pcap_t
*p
, int nonblock
, char *errbuf
)
2214 ret
= p
->setnonblock_op(p
, nonblock
, errbuf
);
2217 * In case somebody depended on the bug wherein
2218 * the error message was put into p->errbuf
2219 * by pcap_setnonblock_fd().
2221 strlcpy(p
->errbuf
, errbuf
, PCAP_ERRBUF_SIZE
);
2226 #if !defined(_WIN32) && !defined(MSDOS)
2228 * Set non-blocking mode, under the assumption that it's just the
2229 * standard POSIX non-blocking flag. (This can be called by the
2230 * per-platform non-blocking-mode routine if that routine also
2231 * needs to do some additional work.)
2234 pcap_setnonblock_fd(pcap_t
*p
, int nonblock
, char *errbuf
)
2238 fdflags
= fcntl(p
->fd
, F_GETFL
, 0);
2239 if (fdflags
== -1) {
2240 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "F_GETFL: %s",
2241 pcap_strerror(errno
));
2245 fdflags
|= O_NONBLOCK
;
2247 fdflags
&= ~O_NONBLOCK
;
2248 if (fcntl(p
->fd
, F_SETFL
, fdflags
) == -1) {
2249 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "F_SETFL: %s",
2250 pcap_strerror(errno
));
2259 * Generate a string for a Win32-specific error (i.e. an error generated when
2260 * calling a Win32 API).
2261 * For errors occurred during standard C calls, we still use pcap_strerror()
2264 pcap_win32_err_to_str(DWORD error
, char *errbuf
)
2269 FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM
, NULL
, error
, 0, errbuf
,
2270 PCAP_ERRBUF_SIZE
, NULL
);
2273 * "FormatMessage()" "helpfully" sticks CR/LF at the end of the
2274 * message. Get rid of it.
2276 errlen
= strlen(errbuf
);
2278 errbuf
[errlen
- 1] = '\0';
2279 errbuf
[errlen
- 2] = '\0';
2281 p
= strchr(errbuf
, '\0');
2282 pcap_snprintf (p
, PCAP_ERRBUF_SIZE
+1-(p
-errbuf
), " (%lu)", error
);
2287 * Generate error strings for PCAP_ERROR_ and PCAP_WARNING_ values.
2290 pcap_statustostr(int errnum
)
2292 static char ebuf
[15+10+1];
2297 return("Generic warning");
2299 case PCAP_WARNING_TSTAMP_TYPE_NOTSUP
:
2300 return ("That type of time stamp is not supported by that device");
2302 case PCAP_WARNING_PROMISC_NOTSUP
:
2303 return ("That device doesn't support promiscuous mode");
2306 return("Generic error");
2308 case PCAP_ERROR_BREAK
:
2309 return("Loop terminated by pcap_breakloop");
2311 case PCAP_ERROR_NOT_ACTIVATED
:
2312 return("The pcap_t has not been activated");
2314 case PCAP_ERROR_ACTIVATED
:
2315 return ("The setting can't be changed after the pcap_t is activated");
2317 case PCAP_ERROR_NO_SUCH_DEVICE
:
2318 return ("No such device exists");
2320 case PCAP_ERROR_RFMON_NOTSUP
:
2321 return ("That device doesn't support monitor mode");
2323 case PCAP_ERROR_NOT_RFMON
:
2324 return ("That operation is supported only in monitor mode");
2326 case PCAP_ERROR_PERM_DENIED
:
2327 return ("You don't have permission to capture on that device");
2329 case PCAP_ERROR_IFACE_NOT_UP
:
2330 return ("That device is not up");
2332 case PCAP_ERROR_CANTSET_TSTAMP_TYPE
:
2333 return ("That device doesn't support setting the time stamp type");
2335 case PCAP_ERROR_PROMISC_PERM_DENIED
:
2336 return ("You don't have permission to capture in promiscuous mode on that device");
2338 case PCAP_ERROR_TSTAMP_PRECISION_NOTSUP
:
2339 return ("That device doesn't support that time stamp precision");
2341 (void)pcap_snprintf(ebuf
, sizeof ebuf
, "Unknown error: %d", errnum
);
2346 * Not all systems have strerror().
2349 pcap_strerror(int errnum
)
2351 #ifdef HAVE_STRERROR
2353 static char errbuf
[PCAP_ERRBUF_SIZE
];
2355 errno
= strerror_s(errbuf
, PCAP_ERRBUF_SIZE
, errnum
);
2356 if (errno
!= 0) /* errno = 0 if successful */
2357 strlcpy(errbuf
, "strerror_s() error", PCAP_ERRBUF_SIZE
);
2360 return (strerror(errnum
));
2363 extern int sys_nerr
;
2364 extern const char *const sys_errlist
[];
2365 static char errbuf
[PCAP_ERRBUF_SIZE
];
2367 if ((unsigned int)errnum
< sys_nerr
)
2368 return ((char *)sys_errlist
[errnum
]);
2369 (void)pcap_snprintf(errbuf
, sizeof errbuf
, "Unknown error: %d", errnum
);
2375 pcap_setfilter(pcap_t
*p
, struct bpf_program
*fp
)
2377 return (p
->setfilter_op(p
, fp
));
2381 * Set direction flag, which controls whether we accept only incoming
2382 * packets, only outgoing packets, or both.
2383 * Note that, depending on the platform, some or all direction arguments
2384 * might not be supported.
2387 pcap_setdirection(pcap_t
*p
, pcap_direction_t d
)
2389 if (p
->setdirection_op
== NULL
) {
2390 pcap_snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
2391 "Setting direction is not implemented on this platform");
2394 return (p
->setdirection_op(p
, d
));
2398 pcap_stats(pcap_t
*p
, struct pcap_stat
*ps
)
2400 return (p
->stats_op(p
, ps
));
2404 pcap_stats_dead(pcap_t
*p
, struct pcap_stat
*ps _U_
)
2406 pcap_snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
2407 "Statistics aren't available from a pcap_open_dead pcap_t");
2413 pcap_stats_ex(pcap_t
*p
, int *pcap_stat_size
)
2415 return (p
->stats_ex_op(p
, pcap_stat_size
));
2419 pcap_setbuff(pcap_t
*p
, int dim
)
2421 return (p
->setbuff_op(p
, dim
));
2425 pcap_setbuff_dead(pcap_t
*p
, int dim
)
2427 pcap_snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
2428 "The kernel buffer size cannot be set on a pcap_open_dead pcap_t");
2433 pcap_setmode(pcap_t
*p
, int mode
)
2435 return (p
->setmode_op(p
, mode
));
2439 pcap_setmode_dead(pcap_t
*p
, int mode
)
2441 pcap_snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
2442 "impossible to set mode on a pcap_open_dead pcap_t");
2447 pcap_setmintocopy(pcap_t
*p
, int size
)
2449 return (p
->setmintocopy_op(p
, size
));
2453 pcap_setmintocopy_dead(pcap_t
*p
, int size
)
2455 pcap_snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
2456 "The mintocopy parameter cannot be set on a pcap_open_dead pcap_t");
2461 pcap_getevent(pcap_t
*p
)
2463 return (p
->getevent_op(p
));
2467 pcap_getevent_dead(pcap_t
*p
)
2469 pcap_snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
2470 "A pcap_open_dead pcap_t has no event handle");
2471 return (INVALID_HANDLE_VALUE
);
2475 pcap_oid_get_request(pcap_t
*p
, bpf_u_int32 oid
, void *data
, size_t *lenp
)
2477 return (p
->oid_get_request_op(p
, oid
, data
, lenp
));
2481 pcap_oid_get_request_dead(pcap_t
*p
, bpf_u_int32 oid _U_
, void *data _U_
,
2484 pcap_snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
2485 "An OID get request cannot be performed on a pcap_open_dead pcap_t");
2486 return (PCAP_ERROR
);
2490 pcap_oid_set_request(pcap_t
*p
, bpf_u_int32 oid
, const void *data
, size_t *lenp
)
2492 return (p
->oid_set_request_op(p
, oid
, data
, lenp
));
2496 pcap_oid_set_request_dead(pcap_t
*p
, bpf_u_int32 oid _U_
, const void *data _U_
,
2499 pcap_snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
2500 "An OID set request cannot be performed on a pcap_open_dead pcap_t");
2501 return (PCAP_ERROR
);
2505 pcap_sendqueue_alloc(u_int memsize
)
2507 pcap_send_queue
*tqueue
;
2509 /* Allocate the queue */
2510 tqueue
= (pcap_send_queue
*)malloc(sizeof(pcap_send_queue
));
2511 if (tqueue
== NULL
){
2515 /* Allocate the buffer */
2516 tqueue
->buffer
= (char *)malloc(memsize
);
2517 if (tqueue
->buffer
== NULL
) {
2522 tqueue
->maxlen
= memsize
;
2529 pcap_sendqueue_destroy(pcap_send_queue
*queue
)
2531 free(queue
->buffer
);
2536 pcap_sendqueue_queue(pcap_send_queue
*queue
, const struct pcap_pkthdr
*pkt_header
, const u_char
*pkt_data
)
2538 if (queue
->len
+ sizeof(struct pcap_pkthdr
) + pkt_header
->caplen
> queue
->maxlen
){
2542 /* Copy the pcap_pkthdr header*/
2543 memcpy(queue
->buffer
+ queue
->len
, pkt_header
, sizeof(struct pcap_pkthdr
));
2544 queue
->len
+= sizeof(struct pcap_pkthdr
);
2546 /* copy the packet */
2547 memcpy(queue
->buffer
+ queue
->len
, pkt_data
, pkt_header
->caplen
);
2548 queue
->len
+= pkt_header
->caplen
;
2554 pcap_sendqueue_transmit(pcap_t
*p
, pcap_send_queue
*queue
, int sync
)
2556 return (p
->sendqueue_transmit_op(p
, queue
, sync
));
2560 pcap_sendqueue_transmit_dead(pcap_t
*p
, pcap_send_queue
*queue
, int sync
)
2562 pcap_snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
2563 "Packets cannot be transmitted on a pcap_open_dead pcap_t");
2568 pcap_setuserbuffer(pcap_t
*p
, int size
)
2570 return (p
->setuserbuffer_op(p
, size
));
2574 pcap_setuserbuffer_dead(pcap_t
*p
, int size
)
2576 pcap_snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
2577 "The user buffer cannot be set on a pcap_open_dead pcap_t");
2582 pcap_live_dump(pcap_t
*p
, char *filename
, int maxsize
, int maxpacks
)
2584 return (p
->live_dump_op(p
, filename
, maxsize
, maxpacks
));
2588 pcap_live_dump_dead(pcap_t
*p
, char *filename
, int maxsize
, int maxpacks
)
2590 pcap_snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
2591 "Live packet dumping cannot be performed on a pcap_open_dead pcap_t");
2596 pcap_live_dump_ended(pcap_t
*p
, int sync
)
2598 return (p
->live_dump_ended_op(p
, sync
));
2602 pcap_live_dump_ended_dead(pcap_t
*p
, int sync
)
2604 pcap_snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
2605 "Live packet dumping cannot be performed on a pcap_open_dead pcap_t");
2610 pcap_get_airpcap_handle(pcap_t
*p
)
2612 PAirpcapHandle handle
;
2614 handle
= p
->get_airpcap_handle_op(p
);
2615 if (handle
== NULL
) {
2616 (void)pcap_snprintf(p
->errbuf
, sizeof(p
->errbuf
),
2617 "This isn't an AirPcap device");
2622 static PAirpcapHandle
2623 pcap_get_airpcap_handle_dead(pcap_t
*p
)
2630 * On some platforms, we need to clean up promiscuous or monitor mode
2631 * when we close a device - and we want that to happen even if the
2632 * application just exits without explicitl closing devices.
2633 * On those platforms, we need to register a "close all the pcaps"
2634 * routine to be called when we exit, and need to maintain a list of
2635 * pcaps that need to be closed to clean up modes.
2637 * XXX - not thread-safe.
2641 * List of pcaps on which we've done something that needs to be
2643 * If there are any such pcaps, we arrange to call "pcap_close_all()"
2644 * when we exit, and have it close all of them.
2646 static struct pcap
*pcaps_to_close
;
2649 * TRUE if we've already called "atexit()" to cause "pcap_close_all()" to
2650 * be called on exit.
2652 static int did_atexit
;
2655 pcap_close_all(void)
2657 struct pcap
*handle
;
2659 while ((handle
= pcaps_to_close
) != NULL
)
2664 pcap_do_addexit(pcap_t
*p
)
2667 * If we haven't already done so, arrange to have
2668 * "pcap_close_all()" called when we exit.
2671 if (atexit(pcap_close_all
) != 0) {
2673 * "atexit()" failed; let our caller know.
2675 strlcpy(p
->errbuf
, "atexit failed", PCAP_ERRBUF_SIZE
);
2684 pcap_add_to_pcaps_to_close(pcap_t
*p
)
2686 p
->next
= pcaps_to_close
;
2691 pcap_remove_from_pcaps_to_close(pcap_t
*p
)
2693 pcap_t
*pc
, *prevpc
;
2695 for (pc
= pcaps_to_close
, prevpc
= NULL
; pc
!= NULL
;
2696 prevpc
= pc
, pc
= pc
->next
) {
2699 * Found it. Remove it from the list.
2701 if (prevpc
== NULL
) {
2703 * It was at the head of the list.
2705 pcaps_to_close
= pc
->next
;
2708 * It was in the middle of the list.
2710 prevpc
->next
= pc
->next
;
2718 pcap_cleanup_live_common(pcap_t
*p
)
2720 if (p
->buffer
!= NULL
) {
2724 if (p
->dlt_list
!= NULL
) {
2729 if (p
->tstamp_type_list
!= NULL
) {
2730 free(p
->tstamp_type_list
);
2731 p
->tstamp_type_list
= NULL
;
2732 p
->tstamp_type_count
= 0;
2734 if (p
->tstamp_precision_list
!= NULL
) {
2735 free(p
->tstamp_precision_list
);
2736 p
->tstamp_precision_list
= NULL
;
2737 p
->tstamp_precision_count
= 0;
2739 pcap_freecode(&p
->fcode
);
2740 #if !defined(_WIN32) && !defined(MSDOS)
2745 p
->selectable_fd
= -1;
2750 pcap_cleanup_dead(pcap_t
*p _U_
)
2752 /* Nothing to do. */
2756 pcap_open_dead_with_tstamp_precision(int linktype
, int snaplen
, u_int precision
)
2760 switch (precision
) {
2762 case PCAP_TSTAMP_PRECISION_MICRO
:
2763 case PCAP_TSTAMP_PRECISION_NANO
:
2769 p
= malloc(sizeof(*p
));
2772 memset (p
, 0, sizeof(*p
));
2773 p
->snapshot
= snaplen
;
2774 p
->linktype
= linktype
;
2775 p
->opt
.tstamp_precision
= precision
;
2776 p
->stats_op
= pcap_stats_dead
;
2778 p
->stats_ex_op
= (stats_ex_op_t
)pcap_not_initialized_ptr
;
2779 p
->setbuff_op
= pcap_setbuff_dead
;
2780 p
->setmode_op
= pcap_setmode_dead
;
2781 p
->setmintocopy_op
= pcap_setmintocopy_dead
;
2782 p
->getevent_op
= pcap_getevent_dead
;
2783 p
->oid_get_request_op
= pcap_oid_get_request_dead
;
2784 p
->oid_set_request_op
= pcap_oid_set_request_dead
;
2785 p
->sendqueue_transmit_op
= pcap_sendqueue_transmit_dead
;
2786 p
->setuserbuffer_op
= pcap_setuserbuffer_dead
;
2787 p
->live_dump_op
= pcap_live_dump_dead
;
2788 p
->live_dump_ended_op
= pcap_live_dump_ended_dead
;
2789 p
->get_airpcap_handle_op
= pcap_get_airpcap_handle_dead
;
2791 p
->cleanup_op
= pcap_cleanup_dead
;
2794 * A "dead" pcap_t never requires special BPF code generation.
2796 p
->bpf_codegen_flags
= 0;
2803 pcap_open_dead(int linktype
, int snaplen
)
2805 return (pcap_open_dead_with_tstamp_precision(linktype
, snaplen
,
2806 PCAP_TSTAMP_PRECISION_MICRO
));
2810 * API compatible with WinPcap's "send a packet" routine - returns -1
2811 * on error, 0 otherwise.
2813 * XXX - what if we get a short write?
2816 pcap_sendpacket(pcap_t
*p
, const u_char
*buf
, int size
)
2818 if (p
->inject_op(p
, buf
, size
) == -1)
2824 * API compatible with OpenBSD's "send a packet" routine - returns -1 on
2825 * error, number of bytes written otherwise.
2828 pcap_inject(pcap_t
*p
, const void *buf
, size_t size
)
2830 return (p
->inject_op(p
, buf
, size
));
2834 pcap_close(pcap_t
*p
)
2836 if (p
->opt
.device
!= NULL
)
2837 free(p
->opt
.device
);
2843 * Given a BPF program, a pcap_pkthdr structure for a packet, and the raw
2844 * data for the packet, check whether the packet passes the filter.
2845 * Returns the return value of the filter program, which will be zero if
2846 * the packet doesn't pass and non-zero if the packet does pass.
2849 pcap_offline_filter(const struct bpf_program
*fp
, const struct pcap_pkthdr
*h
,
2852 const struct bpf_insn
*fcode
= fp
->bf_insns
;
2855 return (bpf_filter(fcode
, pkt
, h
->len
, h
->caplen
));
2860 #include "pcap_version.h"
2864 static char *full_pcap_version_string
;
2866 #ifdef HAVE_VERSION_H
2868 * libpcap being built for Windows, as part of a WinPcap/Npcap source
2869 * tree. Include version.h from that source tree to get the WinPcap/Npcap
2872 * XXX - it'd be nice if we could somehow generate the WinPcap version number
2873 * when building WinPcap. (It'd be nice to do so for the packet.dll version
2876 #include "../../version.h"
2878 static const char wpcap_version_string
[] = WINPCAP_VER_STRING
;
2879 static const char pcap_version_string_fmt
[] =
2880 WINPCAP_PRODUCT_NAME
" version %s, based on %s";
2881 static const char pcap_version_string_packet_dll_fmt
[] =
2882 WINPCAP_PRODUCT_NAME
" version %s (packet.dll version %s), based on %s";
2885 pcap_lib_version(void)
2887 char *packet_version_string
;
2888 size_t full_pcap_version_string_len
;
2890 if (full_pcap_version_string
== NULL
) {
2892 * Generate the version string.
2894 packet_version_string
= PacketGetVersion();
2895 if (strcmp(wpcap_version_string
, packet_version_string
) == 0) {
2897 * WinPcap version string and packet.dll version
2898 * string are the same; just report the WinPcap
2901 full_pcap_version_string_len
=
2902 (sizeof pcap_version_string_fmt
- 4) +
2903 strlen(wpcap_version_string
) +
2904 strlen(pcap_version_string
);
2905 full_pcap_version_string
=
2906 malloc(full_pcap_version_string_len
);
2907 if (full_pcap_version_string
== NULL
)
2909 pcap_snprintf(full_pcap_version_string
,
2910 full_pcap_version_string_len
,
2911 pcap_version_string_fmt
,
2912 wpcap_version_string
,
2913 pcap_version_string
);
2916 * WinPcap version string and packet.dll version
2917 * string are different; that shouldn't be the
2918 * case (the two libraries should come from the
2919 * same version of WinPcap), so we report both
2922 full_pcap_version_string_len
=
2923 (sizeof pcap_version_string_packet_dll_fmt
- 6) +
2924 strlen(wpcap_version_string
) +
2925 strlen(packet_version_string
) +
2926 strlen(pcap_version_string
);
2927 full_pcap_version_string
= malloc(full_pcap_version_string_len
);
2928 if (full_pcap_version_string
== NULL
)
2930 pcap_snprintf(full_pcap_version_string
,
2931 full_pcap_version_string_len
,
2932 pcap_version_string_packet_dll_fmt
,
2933 wpcap_version_string
,
2934 packet_version_string
,
2935 pcap_version_string
);
2938 return (full_pcap_version_string
);
2941 #else /* HAVE_VERSION_H */
2944 * libpcap being built for Windows, not as part of a WinPcap/Npcap source
2947 static const char pcap_version_string_packet_dll_fmt
[] =
2948 "%s (packet.dll version %s)";
2950 pcap_lib_version(void)
2952 char *packet_version_string
;
2953 size_t full_pcap_version_string_len
;
2955 if (full_pcap_version_string
== NULL
) {
2957 * Generate the version string. Report the packet.dll
2960 packet_version_string
= PacketGetVersion();
2961 full_pcap_version_string_len
=
2962 (sizeof pcap_version_string_packet_dll_fmt
- 4) +
2963 strlen(pcap_version_string
) +
2964 strlen(packet_version_string
);
2965 full_pcap_version_string
= malloc(full_pcap_version_string_len
);
2966 if (full_pcap_version_string
== NULL
)
2968 pcap_snprintf(full_pcap_version_string
,
2969 full_pcap_version_string_len
,
2970 pcap_version_string_packet_dll_fmt
,
2971 pcap_version_string
,
2972 packet_version_string
);
2974 return (full_pcap_version_string
);
2977 #endif /* HAVE_VERSION_H */
2979 #elif defined(MSDOS)
2981 static char *full_pcap_version_string
;
2984 pcap_lib_version (void)
2986 char *packet_version_string
;
2987 size_t full_pcap_version_string_len
;
2988 static char dospfx
[] = "DOS-";
2990 if (full_pcap_version_string
== NULL
) {
2992 * Generate the version string.
2994 full_pcap_version_string_len
=
2995 sizeof dospfx
+ strlen(pcap_version_string
);
2996 full_pcap_version_string
=
2997 malloc(full_pcap_version_string_len
);
2998 if (full_pcap_version_string
== NULL
)
3000 strcpy(full_pcap_version_string
, dospfx
);
3001 strcat(full_pcap_version_string
, pcap_version_string
);
3003 return (full_pcap_version_string
);
3009 pcap_lib_version(void)
3011 return (pcap_version_string
);
3017 * Set the internal "debug printout" flag for the filter expression parser.
3018 * The code to print that stuff is present only if YYDEBUG is defined, so
3019 * the flag, and the routine to set it, are defined only if YYDEBUG is
3022 * This is intended for libpcap developers, not for general use.
3023 * If you want to set these in a program, you'll have to declare this
3024 * routine yourself, with the appropriate DLL import attribute on Windows;
3025 * it's not declared in any header file, and won't be declared in any
3026 * header file provided by libpcap.
3028 PCAP_API
void pcap_set_parser_debug(int value
);
3031 pcap_set_parser_debug(int value
)
3033 extern int pcap_debug
;
3041 * Set the internal "debug printout" flag for the filter expression optimizer.
3042 * The code to print that stuff is present only if BDEBUG is defined, so
3043 * the flag, and the routine to set it, are defined only if BDEBUG is
3046 * This is intended for libpcap developers, not for general use.
3047 * If you want to set these in a program, you'll have to declare this
3048 * routine yourself, with the appropriate DLL import attribute on Windows;
3049 * it's not declared in any header file, and won't be declared in any
3050 * header file provided by libpcap.
3052 PCAP_API
void pcap_set_optimizer_debug(int value
);
3055 pcap_set_optimizer_debug(int value
)
3057 extern int pcap_optimizer_debug
;
3059 pcap_optimizer_debug
= value
;