2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 * Support for splitting captures into multiple files with a maximum
25 * Seth Webster <swebster@sst.ll.mit.edu>
36 #include "netdissect-stdinc.h"
38 #include "netdissect.h"
39 #include "addrtoname.h"
41 #include "netdissect-alloc.h"
43 #include "pcap-missing.h"
55 static const struct uint_printer uint_printers
[] = {
56 { ether_if_print
, DLT_EN10MB
},
57 #ifdef DLT_IEEE802_15_4
58 { ieee802_15_4_if_print
, DLT_IEEE802_15_4
},
60 #ifdef DLT_IEEE802_15_4_NOFCS
61 { ieee802_15_4_if_print
, DLT_IEEE802_15_4_NOFCS
},
63 #ifdef DLT_IEEE802_15_4_TAP
64 { ieee802_15_4_tap_if_print
, DLT_IEEE802_15_4_TAP
},
66 #ifdef DLT_NETANALYZER
67 { netanalyzer_if_print
, DLT_NETANALYZER
},
69 #ifdef DLT_NETANALYZER_TRANSPARENT
70 { netanalyzer_transparent_if_print
, DLT_NETANALYZER_TRANSPARENT
},
73 { cip_if_print
, DLT_CIP
},
76 { cip_if_print
, DLT_ATM_CLIP
},
79 { ipfc_if_print
, DLT_IP_OVER_FC
},
82 { lane_if_print
, DLT_LANE8023
},
85 { ipoib_if_print
, DLT_IPOIB
},
88 { chdlc_if_print
, DLT_C_HDLC
},
91 { chdlc_if_print
, DLT_HDLC
},
94 { pppoe_if_print
, DLT_PPP_ETHER
},
96 #if defined(DLT_PFLOG) && defined(HAVE_NET_IF_PFLOG_H)
97 { pflog_if_print
, DLT_PFLOG
},
99 { token_if_print
, DLT_IEEE802
},
100 { fddi_if_print
, DLT_FDDI
},
102 { sll_if_print
, DLT_LINUX_SLL
},
104 #ifdef DLT_LINUX_SLL2
105 { sll2_if_print
, DLT_LINUX_SLL2
},
108 { fr_if_print
, DLT_FR
},
111 { fr_if_print
, DLT_FRELAY
},
114 { mfr_if_print
, DLT_MFR
},
116 { atm_if_print
, DLT_ATM_RFC1483
},
118 { ltalk_if_print
, DLT_LTALK
},
120 #ifdef DLT_JUNIPER_ATM1
121 { juniper_atm1_if_print
, DLT_JUNIPER_ATM1
},
123 #ifdef DLT_JUNIPER_ATM2
124 { juniper_atm2_if_print
, DLT_JUNIPER_ATM2
},
126 #ifdef DLT_JUNIPER_MFR
127 { juniper_mfr_if_print
, DLT_JUNIPER_MFR
},
129 #ifdef DLT_JUNIPER_MLFR
130 { juniper_mlfr_if_print
, DLT_JUNIPER_MLFR
},
132 #ifdef DLT_JUNIPER_MLPPP
133 { juniper_mlppp_if_print
, DLT_JUNIPER_MLPPP
},
135 #ifdef DLT_JUNIPER_PPPOE
136 { juniper_pppoe_if_print
, DLT_JUNIPER_PPPOE
},
138 #ifdef DLT_JUNIPER_PPPOE_ATM
139 { juniper_pppoe_atm_if_print
, DLT_JUNIPER_PPPOE_ATM
},
141 #ifdef DLT_JUNIPER_GGSN
142 { juniper_ggsn_if_print
, DLT_JUNIPER_GGSN
},
144 #ifdef DLT_JUNIPER_ES
145 { juniper_es_if_print
, DLT_JUNIPER_ES
},
147 #ifdef DLT_JUNIPER_MONITOR
148 { juniper_monitor_if_print
, DLT_JUNIPER_MONITOR
},
150 #ifdef DLT_JUNIPER_SERVICES
151 { juniper_services_if_print
, DLT_JUNIPER_SERVICES
},
153 #ifdef DLT_JUNIPER_ETHER
154 { juniper_ether_if_print
, DLT_JUNIPER_ETHER
},
156 #ifdef DLT_JUNIPER_PPP
157 { juniper_ppp_if_print
, DLT_JUNIPER_PPP
},
159 #ifdef DLT_JUNIPER_FRELAY
160 { juniper_frelay_if_print
, DLT_JUNIPER_FRELAY
},
162 #ifdef DLT_JUNIPER_CHDLC
163 { juniper_chdlc_if_print
, DLT_JUNIPER_CHDLC
},
165 #ifdef DLT_IEEE802_11_RADIO
166 { ieee802_11_radio_if_print
, DLT_IEEE802_11_RADIO
},
168 #ifdef DLT_IEEE802_11
169 { ieee802_11_if_print
, DLT_IEEE802_11
},
171 #ifdef DLT_IEEE802_11_RADIO_AVS
172 { ieee802_11_radio_avs_if_print
, DLT_IEEE802_11_RADIO_AVS
},
174 #ifdef DLT_PRISM_HEADER
175 { prism_if_print
, DLT_PRISM_HEADER
},
177 { ppp_if_print
, DLT_PPP
},
178 #ifdef DLT_PPP_WITHDIRECTION
179 { ppp_if_print
, DLT_PPP_WITHDIRECTION
},
182 { ppp_bsdos_if_print
, DLT_PPP_BSDOS
},
184 #ifdef DLT_PPP_SERIAL
185 { ppp_hdlc_if_print
, DLT_PPP_SERIAL
},
187 #ifdef DLT_DSA_TAG_BRCM
188 { brcm_tag_if_print
, DLT_DSA_TAG_BRCM
},
190 #ifdef DLT_DSA_TAG_BRCM_PREPEND
191 { brcm_tag_prepend_if_print
, DLT_DSA_TAG_BRCM_PREPEND
},
194 { vsock_if_print
, DLT_VSOCK
},
196 #ifdef DLT_DSA_TAG_DSA
197 { dsa_if_print
, DLT_DSA_TAG_DSA
},
199 #ifdef DLT_DSA_TAG_EDSA
200 { edsa_if_print
, DLT_DSA_TAG_EDSA
},
205 static const struct void_printer void_printers
[] = {
206 #ifdef DLT_APPLE_IP_OVER_IEEE1394
207 { ap1394_if_print
, DLT_APPLE_IP_OVER_IEEE1394
},
209 { arcnet_if_print
, DLT_ARCNET
},
210 #ifdef DLT_ARCNET_LINUX
211 { arcnet_linux_if_print
, DLT_ARCNET_LINUX
},
213 #ifdef DLT_BLUETOOTH_HCI_H4_WITH_PHDR
214 { bt_if_print
, DLT_BLUETOOTH_HCI_H4_WITH_PHDR
},
217 { enc_if_print
, DLT_ENC
},
220 { ipnet_if_print
, DLT_IPNET
},
223 { nflog_if_print
, DLT_NFLOG
},
225 { null_if_print
, DLT_NULL
},
227 { null_if_print
, DLT_LOOP
},
230 { pktap_if_print
, DLT_PKTAP
},
233 { ppi_if_print
, DLT_PPI
},
235 { raw_if_print
, DLT_RAW
},
237 { raw_if_print
, DLT_IPV4
},
240 { raw_if_print
, DLT_IPV6
},
242 #ifdef DLT_SLIP_BSDOS
243 { sl_bsdos_if_print
, DLT_SLIP_BSDOS
},
245 { sl_if_print
, DLT_SLIP
},
247 { sunatm_if_print
, DLT_SUNATM
},
249 #ifdef DLT_SYMANTEC_FIREWALL
250 { symantec_if_print
, DLT_SYMANTEC_FIREWALL
},
253 { usb_linux_48_byte_if_print
, DLT_USB_LINUX
},
254 #endif /* DLT_USB_LINUX */
255 #ifdef DLT_USB_LINUX_MMAPPED
256 { usb_linux_64_byte_if_print
, DLT_USB_LINUX_MMAPPED
},
257 #endif /* DLT_USB_LINUX_MMAPPED */
261 static void ndo_default_print(netdissect_options
*ndo
, const u_char
*bp
,
264 static void NORETURN
ndo_error(netdissect_options
*ndo
,
265 status_exit_codes_t status
,
266 FORMAT_STRING(const char *fmt
), ...)
268 static void ndo_warning(netdissect_options
*ndo
,
269 FORMAT_STRING(const char *fmt
), ...)
272 static int ndo_printf(netdissect_options
*ndo
,
273 FORMAT_STRING(const char *fmt
), ...)
277 init_print(netdissect_options
*ndo
, uint32_t localnet
, uint32_t mask
)
280 init_addrtoname(ndo
, localnet
, mask
);
285 lookup_uint_printer(int type
)
287 const struct uint_printer
*p
;
289 for (p
= uint_printers
; p
->f
; ++p
)
293 #if defined(DLT_USER2) && defined(DLT_PKTAP)
295 * Apple incorrectly chose to use DLT_USER2 for their PKTAP
298 * We map DLT_PKTAP, whether it's DLT_USER2 as it is on Darwin-
299 * based OSes or the same value as LINKTYPE_PKTAP as it is on
300 * other OSes, to LINKTYPE_PKTAP, so files written with
301 * this version of libpcap for a DLT_PKTAP capture have a link-
302 * layer header type of LINKTYPE_PKTAP.
304 * However, files written on OS X Mavericks for a DLT_PKTAP
305 * capture have a link-layer header type of LINKTYPE_USER2.
306 * If we don't have a printer for DLT_USER2, and type is
307 * DLT_USER2, we look up the printer for DLT_PKTAP and use
310 if (type
== DLT_USER2
) {
311 for (p
= uint_printers
; p
->f
; ++p
)
312 if (DLT_PKTAP
== p
->type
)
322 lookup_void_printer(int type
)
324 const struct void_printer
*p
;
326 for (p
= void_printers
; p
->f
; ++p
)
330 #if defined(DLT_USER2) && defined(DLT_PKTAP)
332 * Apple incorrectly chose to use DLT_USER2 for their PKTAP
335 * We map DLT_PKTAP, whether it's DLT_USER2 as it is on Darwin-
336 * based OSes or the same value as LINKTYPE_PKTAP as it is on
337 * other OSes, to LINKTYPE_PKTAP, so files written with
338 * this version of libpcap for a DLT_PKTAP capture have a link-
339 * layer header type of LINKTYPE_PKTAP.
341 * However, files written on OS X Mavericks for a DLT_PKTAP
342 * capture have a link-layer header type of LINKTYPE_USER2.
343 * If we don't have a printer for DLT_USER2, and type is
344 * DLT_USER2, we look up the printer for DLT_PKTAP and use
347 if (type
== DLT_USER2
) {
348 for (p
= void_printers
; p
->f
; ++p
)
349 if (DLT_PKTAP
== p
->type
)
359 lookup_printer(netdissect_options
*ndo
, int type
)
361 if_printer_t printer
;
363 printer
.void_printer
= lookup_void_printer(type
);
364 ndo
->ndo_void_printer
= TRUE
;
365 if (printer
.void_printer
== NULL
) {
366 printer
.uint_printer
= lookup_uint_printer(type
);
367 ndo
->ndo_void_printer
= FALSE
;
373 has_printer(int type
)
375 return (lookup_void_printer(type
) != NULL
||
376 lookup_uint_printer(type
) != NULL
);
380 get_if_printer(netdissect_options
*ndo
, int type
)
383 if_printer_t printer
;
385 printer
= lookup_printer(ndo
, type
);
386 if (printer
.printer
== NULL
) {
387 dltname
= pcap_datalink_val_to_name(type
);
389 (*ndo
->ndo_error
)(ndo
, S_ERR_ND_NO_PRINTER
,
390 "packet printing is not supported for link type %s: use -w",
393 (*ndo
->ndo_error
)(ndo
, S_ERR_ND_NO_PRINTER
,
394 "packet printing is not supported for link type %d: use -w", type
);
400 pretty_print_packet(netdissect_options
*ndo
, const struct pcap_pkthdr
*h
,
401 const u_char
*sp
, u_int packets_captured
)
404 int invalid_header
= 0;
406 if (ndo
->ndo_packet_number
)
407 ND_PRINT("%5u ", packets_captured
);
409 /* Sanity checks on packet length / capture length */
410 if (h
->caplen
== 0) {
412 ND_PRINT("[Invalid header: caplen==0");
415 if (!invalid_header
) {
417 ND_PRINT("[Invalid header:");
421 } else if (h
->len
< h
->caplen
) {
422 if (!invalid_header
) {
424 ND_PRINT("[Invalid header:");
427 ND_PRINT(" len(%u) < caplen(%u)", h
->len
, h
->caplen
);
429 if (h
->caplen
> MAXIMUM_SNAPLEN
) {
430 if (!invalid_header
) {
432 ND_PRINT("[Invalid header:");
435 ND_PRINT(" caplen(%u) > %u", h
->caplen
, MAXIMUM_SNAPLEN
);
437 if (h
->len
> MAXIMUM_SNAPLEN
) {
438 if (!invalid_header
) {
440 ND_PRINT("[Invalid header:");
443 ND_PRINT(" len(%u) > %u", h
->len
, MAXIMUM_SNAPLEN
);
445 if (invalid_header
) {
452 * capture length != 0,
453 * packet length != 0,
454 * capture length <= MAXIMUM_SNAPLEN,
455 * packet length <= MAXIMUM_SNAPLEN,
456 * packet length >= capture length.
458 * Currently, there is no D-Bus printer, thus no need for
462 ts_print(ndo
, &h
->ts
);
465 * Printers must check that they're not walking off the end of
467 * Rather than pass it all the way down, we set this member
468 * of the netdissect_options structure.
470 ndo
->ndo_snapend
= sp
+ h
->caplen
;
472 ndo
->ndo_protocol
= "";
473 ndo
->ndo_ll_header_length
= 0;
474 if (setjmp(ndo
->ndo_truncated
) == 0) {
475 /* Print the packet. */
476 if (ndo
->ndo_void_printer
== TRUE
) {
477 (ndo
->ndo_if_printer
.void_printer
)(ndo
, h
, sp
);
478 hdrlen
= ndo
->ndo_ll_header_length
;
480 hdrlen
= (ndo
->ndo_if_printer
.uint_printer
)(ndo
, h
, sp
);
482 /* A printer quit because the packet was truncated; report it */
483 ND_PRINT(" [|%s]", ndo
->ndo_protocol
);
484 hdrlen
= ndo
->ndo_ll_header_length
;
488 * Empty the stack of packet information, freeing all pushed buffers;
489 * if we got here by a printer quitting, we need to release anything
490 * that didn't get released because we longjmped out of the code
491 * before it popped the packet information.
493 nd_pop_all_packet_info(ndo
);
496 * Restore the original snapend, as a printer might have
499 ndo
->ndo_snapend
= sp
+ h
->caplen
;
500 if (ndo
->ndo_Xflag
) {
502 * Print the raw packet data in hex and ASCII.
504 if (ndo
->ndo_Xflag
> 1) {
506 * Include the link-layer header.
508 hex_and_ascii_print(ndo
, "\n\t", sp
, h
->caplen
);
511 * Don't include the link-layer header - and if
512 * we have nothing past the link-layer header,
515 if (h
->caplen
> hdrlen
)
516 hex_and_ascii_print(ndo
, "\n\t", sp
+ hdrlen
,
519 } else if (ndo
->ndo_xflag
) {
521 * Print the raw packet data in hex.
523 if (ndo
->ndo_xflag
> 1) {
525 * Include the link-layer header.
527 hex_print(ndo
, "\n\t", sp
, h
->caplen
);
530 * Don't include the link-layer header - and if
531 * we have nothing past the link-layer header,
534 if (h
->caplen
> hdrlen
)
535 hex_print(ndo
, "\n\t", sp
+ hdrlen
,
538 } else if (ndo
->ndo_Aflag
) {
540 * Print the raw packet data in ASCII.
542 if (ndo
->ndo_Aflag
> 1) {
544 * Include the link-layer header.
546 ascii_print(ndo
, sp
, h
->caplen
);
549 * Don't include the link-layer header - and if
550 * we have nothing past the link-layer header,
553 if (h
->caplen
> hdrlen
)
554 ascii_print(ndo
, sp
+ hdrlen
, h
->caplen
- hdrlen
);
563 * By default, print the specified data out in hex and ASCII.
566 ndo_default_print(netdissect_options
*ndo
, const u_char
*bp
, u_int length
)
568 hex_and_ascii_print(ndo
, "\n\t", bp
, length
); /* pass on lf and indentation string */
573 ndo_error(netdissect_options
*ndo
, status_exit_codes_t status
,
574 const char *fmt
, ...)
578 if (ndo
->program_name
)
579 (void)fprintf(stderr
, "%s: ", ndo
->program_name
);
581 (void)vfprintf(stderr
, fmt
, ap
);
586 (void)fputc('\n', stderr
);
595 ndo_warning(netdissect_options
*ndo
, const char *fmt
, ...)
599 if (ndo
->program_name
)
600 (void)fprintf(stderr
, "%s: ", ndo
->program_name
);
601 (void)fprintf(stderr
, "WARNING: ");
603 (void)vfprintf(stderr
, fmt
, ap
);
608 (void)fputc('\n', stderr
);
613 ndo_printf(netdissect_options
*ndo
, const char *fmt
, ...)
619 ret
= vfprintf(stdout
, fmt
, args
);
623 ndo_error(ndo
, S_ERR_ND_WRITE_FILE
,
624 "Unable to write output: %s", pcap_strerror(errno
));
629 ndo_set_function_pointers(netdissect_options
*ndo
)
631 ndo
->ndo_default_print
=ndo_default_print
;
632 ndo
->ndo_printf
=ndo_printf
;
633 ndo
->ndo_error
=ndo_error
;
634 ndo
->ndo_warning
=ndo_warning
;