The Tcpdump Group git mirrors - tcpdump/blob - tcpdump.c

   1 /*
   2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  * Support for splitting captures into multiple files with a maximum
  22  * file size:
  23  *
  24  * Copyright (c) 2001
  25  *      Seth Webster <swebster@sst.ll.mit.edu>
  26  */
  27
  28 #ifndef lint
  29 static const char copyright[] _U_ =
  30     "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\
  31 The Regents of the University of California.  All rights reserved.\n";
  32 static const char rcsid[] _U_ =
  33     "@(#) $Header: /tcpdump/master/tcpdump/tcpdump.c,v 1.276 2008-01-29 10:49:27 guy Exp $ (LBL)";
  34 #endif
  35
  36 /*
  37  * tcpdump - monitor tcp/ip traffic on an ethernet.
  38  *
  39  * First written in 1987 by Van Jacobson, Lawrence Berkeley Laboratory.
  40  * Mercilessly hacked and occasionally improved since then via the
  41  * combined efforts of Van, Steve McCanne and Craig Leres of LBL.
  42  */
  43
  44 #ifdef HAVE_CONFIG_H
  45 #include "config.h"
  46 #endif
  47
  48 #include <tcpdump-stdinc.h>
  49
  50 #ifdef WIN32
  51 #include "getopt.h"
  52 #include "w32_fzs.h"
  53 extern int strcasecmp (const char *__s1, const char *__s2);
  54 extern int SIZE_BUF;
  55 #define off_t long
  56 #define uint UINT
  57 #endif /* WIN32 */
  58
  59 #ifdef HAVE_SMI_H
  60 #include <smi.h>
  61 #endif
  62
  63 #include <pcap.h>
  64 #include <signal.h>
  65 #include <stdio.h>
  66 #include <stdlib.h>
  67 #include <string.h>
  68 #include <limits.h>
  69 #ifndef WIN32
  70 #include <sys/wait.h>
  71 #include <sys/resource.h>
  72 #include <pwd.h>
  73 #include <grp.h>
  74 #include <errno.h>
  75 #endif /* WIN32 */
  76
  77
  78 #include "netdissect.h"
  79 #include "interface.h"
  80 #include "addrtoname.h"
  81 #include "machdep.h"
  82 #include "setsignal.h"
  83 #include "gmt2local.h"
  84 #include "pcap-missing.h"
  85
  86 #ifndef NAME_MAX
  87 #define NAME_MAX 255
  88 #endif
  89
  90 netdissect_options Gndo;
  91 netdissect_options *gndo = &Gndo;
  92
  93 int dflag;                      /* print filter code */
  94 int Lflag;                      /* list available data link types and exit */
  95 char *zflag = NULL;             /* compress each savefile using a specified command (like gzip or bzip2) */
  96
  97 static int infodelay;
  98 static int infoprint;
  99
 100 char *program_name;
 101
 102 int32_t thiszone;               /* seconds offset from gmt to local time */
 103
 104 /* Forwards */
 105 static RETSIGTYPE cleanup(int);
 106 static RETSIGTYPE child_cleanup(int);
 107 static void usage(void) __attribute__((noreturn));
 108 static void show_dlts_and_exit(pcap_t *pd) __attribute__((noreturn));
 109
 110 static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
 111 static void ndo_default_print(netdissect_options *, const u_char *, u_int);
 112 static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *);
 113 static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
 114 static void droproot(const char *, const char *);
 115 static void ndo_error(netdissect_options *ndo, const char *fmt, ...);
 116 static void ndo_warning(netdissect_options *ndo, const char *fmt, ...);
 117
 118 #ifdef SIGINFO
 119 RETSIGTYPE requestinfo(int);
 120 #endif
 121
 122 #if defined(USE_WIN32_MM_TIMER)
 123   #include <MMsystem.h>
 124   static UINT timer_id;
 125   static void CALLBACK verbose_stats_dump(UINT, UINT, DWORD_PTR, DWORD_PTR, DWORD_PTR);
 126 #elif defined(HAVE_ALARM)
 127   static void verbose_stats_dump(int sig);
 128 #endif
 129
 130 static void info(int);
 131 static u_int packets_captured;
 132
 133 typedef u_int (*if_printer)(const struct pcap_pkthdr *, const u_char *);
 134
 135 struct printer {
 136         if_printer f;
 137         int type;
 138 };
 139
 140 static struct printer printers[] = {
 141         { arcnet_if_print,      DLT_ARCNET },
 142 #ifdef DLT_ARCNET_LINUX
 143         { arcnet_linux_if_print, DLT_ARCNET_LINUX },
 144 #endif
 145         { ether_if_print,       DLT_EN10MB },
 146         { token_if_print,       DLT_IEEE802 },
 147 #ifdef DLT_LANE8023
 148         { lane_if_print,        DLT_LANE8023 },
 149 #endif
 150 #ifdef DLT_CIP
 151         { cip_if_print,         DLT_CIP },
 152 #endif
 153 #ifdef DLT_ATM_CLIP
 154         { cip_if_print,         DLT_ATM_CLIP },
 155 #endif
 156         { sl_if_print,          DLT_SLIP },
 157 #ifdef DLT_SLIP_BSDOS
 158         { sl_bsdos_if_print,    DLT_SLIP_BSDOS },
 159 #endif
 160         { ppp_if_print,         DLT_PPP },
 161 #ifdef DLT_PPP_WITHDIRECTION
 162         { ppp_if_print,         DLT_PPP_WITHDIRECTION },
 163 #endif
 164 #ifdef DLT_PPP_BSDOS
 165         { ppp_bsdos_if_print,   DLT_PPP_BSDOS },
 166 #endif
 167         { fddi_if_print,        DLT_FDDI },
 168         { null_if_print,        DLT_NULL },
 169 #ifdef DLT_LOOP
 170         { null_if_print,        DLT_LOOP },
 171 #endif
 172         { raw_if_print,         DLT_RAW },
 173         { atm_if_print,         DLT_ATM_RFC1483 },
 174 #ifdef DLT_C_HDLC
 175         { chdlc_if_print,       DLT_C_HDLC },
 176 #endif
 177 #ifdef DLT_HDLC
 178         { chdlc_if_print,       DLT_HDLC },
 179 #endif
 180 #ifdef DLT_PPP_SERIAL
 181         { ppp_hdlc_if_print,    DLT_PPP_SERIAL },
 182 #endif
 183 #ifdef DLT_PPP_ETHER
 184         { pppoe_if_print,       DLT_PPP_ETHER },
 185 #endif
 186 #ifdef DLT_LINUX_SLL
 187         { sll_if_print,         DLT_LINUX_SLL },
 188 #endif
 189 #ifdef DLT_IEEE802_11
 190         { ieee802_11_if_print,  DLT_IEEE802_11},
 191 #endif
 192 #ifdef DLT_LTALK
 193         { ltalk_if_print,       DLT_LTALK },
 194 #endif
 195 #if defined(DLT_PFLOG) && defined(HAVE_NET_PFVAR_H)
 196         { pflog_if_print,       DLT_PFLOG },
 197 #endif
 198 #ifdef DLT_FR
 199         { fr_if_print,          DLT_FR },
 200 #endif
 201 #ifdef DLT_FRELAY
 202         { fr_if_print,          DLT_FRELAY },
 203 #endif
 204 #ifdef DLT_SUNATM
 205         { sunatm_if_print,      DLT_SUNATM },
 206 #endif
 207 #ifdef DLT_IP_OVER_FC
 208         { ipfc_if_print,        DLT_IP_OVER_FC },
 209 #endif
 210 #ifdef DLT_PRISM_HEADER
 211         { prism_if_print,       DLT_PRISM_HEADER },
 212 #endif
 213 #ifdef DLT_IEEE802_11_RADIO
 214         { ieee802_11_radio_if_print,    DLT_IEEE802_11_RADIO },
 215 #endif
 216 #ifdef DLT_ENC
 217         { enc_if_print,         DLT_ENC },
 218 #endif
 219 #ifdef DLT_SYMANTEC_FIREWALL
 220         { symantec_if_print,    DLT_SYMANTEC_FIREWALL },
 221 #endif
 222 #ifdef DLT_APPLE_IP_OVER_IEEE1394
 223         { ap1394_if_print,      DLT_APPLE_IP_OVER_IEEE1394 },
 224 #endif
 225 #ifdef DLT_IEEE802_11_RADIO_AVS
 226         { ieee802_11_radio_avs_if_print,        DLT_IEEE802_11_RADIO_AVS },
 227 #endif
 228 #ifdef DLT_JUNIPER_ATM1
 229         { juniper_atm1_print,   DLT_JUNIPER_ATM1 },
 230 #endif
 231 #ifdef DLT_JUNIPER_ATM2
 232         { juniper_atm2_print,   DLT_JUNIPER_ATM2 },
 233 #endif
 234 #ifdef DLT_JUNIPER_MFR
 235         { juniper_mfr_print,    DLT_JUNIPER_MFR },
 236 #endif
 237 #ifdef DLT_JUNIPER_MLFR
 238         { juniper_mlfr_print,   DLT_JUNIPER_MLFR },
 239 #endif
 240 #ifdef DLT_JUNIPER_MLPPP
 241         { juniper_mlppp_print,  DLT_JUNIPER_MLPPP },
 242 #endif
 243 #ifdef DLT_JUNIPER_PPPOE
 244         { juniper_pppoe_print,  DLT_JUNIPER_PPPOE },
 245 #endif
 246 #ifdef DLT_JUNIPER_PPPOE_ATM
 247         { juniper_pppoe_atm_print, DLT_JUNIPER_PPPOE_ATM },
 248 #endif
 249 #ifdef DLT_JUNIPER_GGSN
 250         { juniper_ggsn_print,   DLT_JUNIPER_GGSN },
 251 #endif
 252 #ifdef DLT_JUNIPER_ES
 253         { juniper_es_print,     DLT_JUNIPER_ES },
 254 #endif
 255 #ifdef DLT_JUNIPER_MONITOR
 256         { juniper_monitor_print, DLT_JUNIPER_MONITOR },
 257 #endif
 258 #ifdef DLT_JUNIPER_SERVICES
 259         { juniper_services_print, DLT_JUNIPER_SERVICES },
 260 #endif
 261 #ifdef DLT_JUNIPER_ETHER
 262         { juniper_ether_print, DLT_JUNIPER_ETHER },
 263 #endif
 264 #ifdef DLT_JUNIPER_PPP
 265         { juniper_ppp_print, DLT_JUNIPER_PPP },
 266 #endif
 267 #ifdef DLT_JUNIPER_FRELAY
 268         { juniper_frelay_print, DLT_JUNIPER_FRELAY },
 269 #endif
 270 #ifdef DLT_JUNIPER_CHDLC
 271         { juniper_chdlc_print, DLT_JUNIPER_CHDLC },
 272 #endif
 273 #ifdef DLT_MFR
 274         { mfr_if_print, DLT_MFR },
 275 #endif
 276 #ifdef DLT_BLUETOOTH_HCI_H4_WITH_PHDR
 277         { bt_if_print, DLT_BLUETOOTH_HCI_H4_WITH_PHDR},
 278 #endif
 279         { NULL,                 0 },
 280 };
 281
 282 static if_printer
 283 lookup_printer(int type)
 284 {
 285         struct printer *p;
 286
 287         for (p = printers; p->f; ++p)
 288                 if (type == p->type)
 289                         return p->f;
 290
 291         return NULL;
 292         /* NOTREACHED */
 293 }
 294
 295 static pcap_t *pd;
 296
 297 extern int optind;
 298 extern int opterr;
 299 extern char *optarg;
 300
 301 struct print_info {
 302         if_printer printer;
 303 };
 304
 305 struct dump_info {
 306         char    *WFileName;
 307         char    *CurrentFileName;
 308         pcap_t  *pd;
 309         pcap_dumper_t *p;
 310 };
 311
 312 static void
 313 show_dlts_and_exit(pcap_t *pd)
 314 {
 315         int n_dlts;
 316         int *dlts = 0;
 317         const char *dlt_name;
 318
 319         n_dlts = pcap_list_datalinks(pd, &dlts);
 320         if (n_dlts < 0)
 321                 error("%s", pcap_geterr(pd));
 322         else if (n_dlts == 0 || !dlts)
 323                 error("No data link types.");
 324
 325         (void) fprintf(stderr, "Data link types (use option -y to set):\n");
 326
 327         while (--n_dlts >= 0) {
 328                 dlt_name = pcap_datalink_val_to_name(dlts[n_dlts]);
 329                 if (dlt_name != NULL) {
 330                         (void) fprintf(stderr, "  %s (%s)", dlt_name,
 331                             pcap_datalink_val_to_description(dlts[n_dlts]));
 332
 333                         /*
 334                          * OK, does tcpdump handle that type?
 335                          */
 336                         if (lookup_printer(dlts[n_dlts]) == NULL)
 337                                 (void) fprintf(stderr, " (printing not supported)");
 338                         putchar('\n');
 339                 } else {
 340                         (void) fprintf(stderr, "  DLT %d (printing not supported)\n",
 341                             dlts[n_dlts]);
 342                 }
 343         }
 344         free(dlts);
 345         exit(0);
 346 }
 347
 348 /*
 349  * Set up flags that might or might not be supported depending on the
 350  * version of libpcap we're using.
 351  */
 352 #ifdef WIN32
 353 #define B_FLAG          "B:"
 354 #define B_FLAG_USAGE    " [ -B size ]"
 355 #else /* WIN32 */
 356 #define B_FLAG
 357 #define B_FLAG_USAGE
 358 #endif /* WIN32 */
 359
 360 #ifdef HAVE_PCAP_FINDALLDEVS
 361 #ifndef HAVE_PCAP_IF_T
 362 #undef HAVE_PCAP_FINDALLDEVS
 363 #endif
 364 #endif
 365
 366 #ifdef HAVE_PCAP_FINDALLDEVS
 367 #define D_FLAG  "D"
 368 #else
 369 #define D_FLAG
 370 #endif
 371
 372 #ifdef HAVE_PCAP_DUMP_FLUSH
 373 #define U_FLAG  "U"
 374 #else
 375 #define U_FLAG
 376 #endif
 377
 378 #ifndef WIN32
 379 /* Drop root privileges and chroot if necessary */
 380 static void
 381 droproot(const char *username, const char *chroot_dir)
 382 {
 383         struct passwd *pw = NULL;
 384
 385         if (chroot_dir && !username) {
 386                 fprintf(stderr, "tcpdump: Chroot without dropping root is insecure\n");
 387                 exit(1);
 388         }
 389
 390         pw = getpwnam(username);
 391         if (pw) {
 392                 if (chroot_dir) {
 393                         if (chroot(chroot_dir) != 0 || chdir ("/") != 0) {
 394                                 fprintf(stderr, "tcpdump: Couldn't chroot/chdir to '%.64s': %s\n",
 395                                     chroot_dir, pcap_strerror(errno));
 396                                 exit(1);
 397                         }
 398                 }
 399                 if (initgroups(pw->pw_name, pw->pw_gid) != 0 ||
 400                     setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0) {
 401                         fprintf(stderr, "tcpdump: Couldn't change to '%.32s' uid=%lu gid=%lu: %s\n",
 402                             username,
 403                             (unsigned long)pw->pw_uid,
 404                             (unsigned long)pw->pw_gid,
 405                             pcap_strerror(errno));
 406                         exit(1);
 407                 }
 408         }
 409         else {
 410                 fprintf(stderr, "tcpdump: Couldn't find user '%.32s'\n",
 411                     username);
 412                 exit(1);
 413         }
 414 }
 415 #endif /* WIN32 */
 416
 417 static int
 418 getWflagChars(int x)
 419 {
 420         int c = 0;
 421
 422         x -= 1;
 423         while (x > 0) {
 424                 c += 1;
 425                 x /= 10;
 426         }
 427
 428         return c;
 429 }
 430
 431
 432 static void
 433 MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars)
 434 {
 435         char *filename = malloc(NAME_MAX + 1);
 436
 437         /* Process with strftime if Gflag is set. */
 438         if (Gflag != 0) {
 439           struct tm *local_tm;
 440
 441           /* Convert Gflag_time to a usable format */
 442           if ((local_tm = localtime(&Gflag_time)) == NULL) {
 443                   error("MakeTimedFilename: localtime");
 444           }
 445
 446           /* There's no good way to detect an error in strftime since a return
 447            * value of 0 isn't necessarily failure.
 448            */
 449           strftime(filename, NAME_MAX, orig_name, local_tm);
 450         } else {
 451           strncpy(filename, orig_name, NAME_MAX);
 452         }
 453
 454         if (cnt == 0 && max_chars == 0)
 455                 strncpy(buffer, filename, NAME_MAX + 1);
 456         else
 457                 if (snprintf(buffer, NAME_MAX + 1, "%s%0*d", filename, max_chars, cnt) > NAME_MAX)
 458                   /* Report an error if the filename is too large */
 459                   error("too many output files or filename is too long (> %d)", NAME_MAX);
 460         free(filename);
 461 }
 462
 463 static int tcpdump_printf(netdissect_options *ndo _U_,
 464                           const char *fmt, ...)
 465 {
 466
 467   va_list args;
 468   int ret;
 469
 470   va_start(args, fmt);
 471   ret=vfprintf(stdout, fmt, args);
 472   va_end(args);
 473
 474   return ret;
 475 }
 476
 477 int
 478 main(int argc, char **argv)
 479 {
 480         register int cnt, op, i;
 481         bpf_u_int32 localnet, netmask;
 482         register char *cp, *infile, *cmdbuf, *device, *RFileName, *WFileName;
 483         pcap_handler callback;
 484         int type;
 485         struct bpf_program fcode;
 486 #ifndef WIN32
 487         RETSIGTYPE (*oldhandler)(int);
 488 #endif
 489         struct print_info printinfo;
 490         struct dump_info dumpinfo;
 491         u_char *pcap_userdata;
 492         char ebuf[PCAP_ERRBUF_SIZE];
 493         char *username = NULL;
 494         char *chroot_dir = NULL;
 495 #ifdef HAVE_PCAP_FINDALLDEVS
 496         pcap_if_t *devpointer;
 497         int devnum;
 498 #endif
 499         int status;
 500 #ifdef WIN32
 501         u_int UserBufferSize = 1000000;
 502         if(wsockinit() != 0) return 1;
 503 #endif /* WIN32 */
 504
 505         gndo->ndo_Oflag=1;
 506         gndo->ndo_Rflag=1;
 507         gndo->ndo_dlt=-1;
 508         gndo->ndo_default_print=ndo_default_print;
 509         gndo->ndo_printf=tcpdump_printf;
 510         gndo->ndo_error=ndo_error;
 511         gndo->ndo_warning=ndo_warning;
 512         gndo->ndo_snaplen = DEFAULT_SNAPLEN;
 513
 514         cnt = -1;
 515         device = NULL;
 516         infile = NULL;
 517         RFileName = NULL;
 518         WFileName = NULL;
 519         if ((cp = strrchr(argv[0], '/')) != NULL)
 520                 program_name = cp + 1;
 521         else
 522                 program_name = argv[0];
 523
 524         if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0)
 525                 error("%s", ebuf);
 526
 527 #ifdef LIBSMI
 528         smiInit("tcpdump");
 529 #endif
 530
 531         opterr = 0;
 532         while (
 533             (op = getopt(argc, argv, "aA" B_FLAG "c:C:d" D_FLAG "eE:fF:G:i:KlLm:M:nNOpqr:Rs:StT:u" U_FLAG "vw:W:xXy:Yz:Z:")) != -1)
 534                 switch (op) {
 535
 536                 case 'a':
 537                         /* compatibility for old -a */
 538                         break;
 539
 540                 case 'A':
 541                         ++Aflag;
 542                         break;
 543
 544 #ifdef WIN32
 545                 case 'B':
 546                         UserBufferSize = atoi(optarg)*1024;
 547                         if (UserBufferSize < 0)
 548                                 error("invalid packet buffer size %s", optarg);
 549                         break;
 550 #endif /* WIN32 */
 551
 552                 case 'c':
 553                         cnt = atoi(optarg);
 554                         if (cnt <= 0)
 555                                 error("invalid packet count %s", optarg);
 556                         break;
 557
 558                 case 'C':
 559                         Cflag = atoi(optarg) * 1000000;
 560                         if (Cflag < 0)
 561                                 error("invalid file size %s", optarg);
 562                         break;
 563
 564                 case 'd':
 565                         ++dflag;
 566                         break;
 567
 568 #ifdef HAVE_PCAP_FINDALLDEVS
 569                 case 'D':
 570                         if (pcap_findalldevs(&devpointer, ebuf) < 0)
 571                                 error("%s", ebuf);
 572                         else {
 573                                 for (i = 0; devpointer != 0; i++) {
 574                                         printf("%d.%s", i+1, devpointer->name);
 575                                         if (devpointer->description != NULL)
 576                                                 printf(" (%s)", devpointer->description);
 577                                         printf("\n");
 578                                         devpointer = devpointer->next;
 579                                 }
 580                         }
 581                         return 0;
 582 #endif /* HAVE_PCAP_FINDALLDEVS */
 583
 584                 case 'L':
 585                         Lflag++;
 586                         break;
 587
 588                 case 'e':
 589                         ++eflag;
 590                         break;
 591
 592                 case 'E':
 593 #ifndef HAVE_LIBCRYPTO
 594                         warning("crypto code not compiled in");
 595 #endif
 596                         gndo->ndo_espsecret = optarg;
 597                         break;
 598
 599                 case 'f':
 600                         ++fflag;
 601                         break;
 602
 603                 case 'F':
 604                         infile = optarg;
 605                         break;
 606
 607                 case 'G':
 608                         Gflag = atoi(optarg);
 609                         if (Gflag < 0)
 610                                 error("invalid number of seconds %s", optarg);
 611
 612                         /* We will create one file initially. */
 613                         Gflag_count = 0;
 614
 615                         /* Grab the current time for rotation use. */
 616                         if ((Gflag_time = time(NULL)) == (time_t)-1) {
 617                                 error("main: can't get current time: %s",
 618                                     pcap_strerror(errno));
 619                         }
 620                         break;
 621
 622                 case 'i':
 623                         if (optarg[0] == '0' && optarg[1] == 0)
 624                                 error("Invalid adapter index");
 625
 626 #ifdef HAVE_PCAP_FINDALLDEVS
 627                         /*
 628                          * If the argument is a number, treat it as
 629                          * an index into the list of adapters, as
 630                          * printed by "tcpdump -D".
 631                          *
 632                          * This should be OK on UNIX systems, as interfaces
 633                          * shouldn't have names that begin with digits.
 634                          * It can be useful on Windows, where more than
 635                          * one interface can have the same name.
 636                          */
 637                         if ((devnum = atoi(optarg)) != 0) {
 638                                 if (devnum < 0)
 639                                         error("Invalid adapter index");
 640
 641                                 if (pcap_findalldevs(&devpointer, ebuf) < 0)
 642                                         error("%s", ebuf);
 643                                 else {
 644                                         for (i = 0; i < devnum-1; i++){
 645                                                 devpointer = devpointer->next;
 646                                                 if (devpointer == NULL)
 647                                                         error("Invalid adapter index");
 648                                         }
 649                                 }
 650                                 device = devpointer->name;
 651                                 break;
 652                         }
 653 #endif /* HAVE_PCAP_FINDALLDEVS */
 654                         device = optarg;
 655                         break;
 656
 657                 case 'l':
 658 #ifdef WIN32
 659                         /*
 660                          * _IOLBF is the same as _IOFBF in Microsoft's C
 661                          * libraries; the only alternative they offer
 662                          * is _IONBF.
 663                          *
 664                          * XXX - this should really be checking for MSVC++,
 665                          * not WIN32, if, for example, MinGW has its own
 666                          * C library that is more UNIX-compatible.
 667                          */
 668                         setvbuf(stdout, NULL, _IONBF, 0);
 669 #else /* WIN32 */
 670 #ifdef HAVE_SETLINEBUF
 671                         setlinebuf(stdout);
 672 #else
 673                         setvbuf(stdout, NULL, _IOLBF, 0);
 674 #endif
 675 #endif /* WIN32 */
 676                         break;
 677
 678                 case 'K':
 679                         ++Kflag;
 680                         break;
 681
 682                 case 'm':
 683 #ifdef LIBSMI
 684                         if (smiLoadModule(optarg) == 0) {
 685                                 error("could not load MIB module %s", optarg);
 686                         }
 687                         sflag = 1;
 688 #else
 689                         (void)fprintf(stderr, "%s: ignoring option `-m %s' ",
 690                                       program_name, optarg);
 691                         (void)fprintf(stderr, "(no libsmi support)\n");
 692 #endif
 693                         break;
 694
 695                 case 'M':
 696                         /* TCP-MD5 shared secret */
 697 #ifndef HAVE_LIBCRYPTO
 698                         warning("crypto code not compiled in");
 699 #endif
 700                         tcpmd5secret = optarg;
 701                         break;
 702
 703                 case 'n':
 704                         ++nflag;
 705                         break;
 706
 707                 case 'N':
 708                         ++Nflag;
 709                         break;
 710
 711                 case 'O':
 712                         Oflag = 0;
 713                         break;
 714
 715                 case 'p':
 716                         ++pflag;
 717                         break;
 718
 719                 case 'q':
 720                         ++qflag;
 721                         ++suppress_default_print;
 722                         break;
 723
 724                 case 'r':
 725                         RFileName = optarg;
 726                         break;
 727
 728                 case 'R':
 729                         Rflag = 0;
 730                         break;
 731
 732                 case 's': {
 733                         char *end;
 734
 735                         snaplen = strtol(optarg, &end, 0);
 736                         if (optarg == end || *end != '\0'
 737                             || snaplen < 0 || snaplen > 65535)
 738                                 error("invalid snaplen %s", optarg);
 739                         else if (snaplen == 0)
 740                                 snaplen = 65535;
 741                         break;
 742                 }
 743
 744                 case 'S':
 745                         ++Sflag;
 746                         break;
 747
 748                 case 't':
 749                         ++tflag;
 750                         break;
 751
 752                 case 'T':
 753                         if (strcasecmp(optarg, "vat") == 0)
 754                                 packettype = PT_VAT;
 755                         else if (strcasecmp(optarg, "wb") == 0)
 756                                 packettype = PT_WB;
 757                         else if (strcasecmp(optarg, "rpc") == 0)
 758                                 packettype = PT_RPC;
 759                         else if (strcasecmp(optarg, "rtp") == 0)
 760                                 packettype = PT_RTP;
 761                         else if (strcasecmp(optarg, "rtcp") == 0)
 762                                 packettype = PT_RTCP;
 763                         else if (strcasecmp(optarg, "snmp") == 0)
 764                                 packettype = PT_SNMP;
 765                         else if (strcasecmp(optarg, "cnfp") == 0)
 766                                 packettype = PT_CNFP;
 767                         else if (strcasecmp(optarg, "tftp") == 0)
 768                                 packettype = PT_TFTP;
 769                         else if (strcasecmp(optarg, "aodv") == 0)
 770                                 packettype = PT_AODV;
 771                         else
 772                                 error("unknown packet type `%s'", optarg);
 773                         break;
 774
 775                 case 'u':
 776                         ++uflag;
 777                         break;
 778
 779 #ifdef HAVE_PCAP_DUMP_FLUSH
 780                 case 'U':
 781                         ++Uflag;
 782                         break;
 783 #endif
 784
 785                 case 'v':
 786                         ++vflag;
 787                         break;
 788
 789                 case 'w':
 790                         WFileName = optarg;
 791                         break;
 792
 793                 case 'W':
 794                         Wflag = atoi(optarg);
 795                         if (Wflag < 0)
 796                                 error("invalid number of output files %s", optarg);
 797                         WflagChars = getWflagChars(Wflag);
 798                         break;
 799
 800                 case 'x':
 801                         ++xflag;
 802                         ++suppress_default_print;
 803                         break;
 804
 805                 case 'X':
 806                         ++Xflag;
 807                         ++suppress_default_print;
 808                         break;
 809
 810                 case 'y':
 811                         gndo->ndo_dltname = optarg;
 812                         gndo->ndo_dlt =
 813                           pcap_datalink_name_to_val(gndo->ndo_dltname);
 814                         if (gndo->ndo_dlt < 0)
 815                                 error("invalid data link type %s", gndo->ndo_dltname);
 816                         break;
 817
 818 #if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG)
 819                 case 'Y':
 820                         {
 821                         /* Undocumented flag */
 822 #ifdef HAVE_PCAP_DEBUG
 823                         extern int pcap_debug;
 824                         pcap_debug = 1;
 825 #else
 826                         extern int yydebug;
 827                         yydebug = 1;
 828 #endif
 829                         }
 830                         break;
 831 #endif
 832                 case 'z':
 833                         if (optarg) {
 834                                 zflag = strdup(optarg);
 835                         } else {
 836                                 usage();
 837                                 /* NOTREACHED */
 838                         }
 839                         break;
 840
 841                 case 'Z':
 842                         if (optarg) {
 843                                 username = strdup(optarg);
 844                         }
 845                         else {
 846                                 usage();
 847                                 /* NOTREACHED */
 848                         }
 849                         break;
 850
 851                 default:
 852                         usage();
 853                         /* NOTREACHED */
 854                 }
 855
 856         switch (tflag) {
 857
 858         case 0: /* Default */
 859         case 4: /* Default + Date*/
 860                 thiszone = gmt2local(0);
 861                 break;
 862
 863         case 1: /* No time stamp */
 864         case 2: /* Unix timeval style */
 865         case 3: /* Microseconds since previous packet */
 866         case 5: /* Microseconds since first packet */
 867                 break;
 868
 869         default: /* Not supported */
 870                 error("only -t, -tt, -ttt, -tttt and -ttttt are supported");
 871                 break;
 872         }
 873
 874 #ifdef WITH_CHROOT
 875         /* if run as root, prepare for chrooting */
 876         if (getuid() == 0 || geteuid() == 0) {
 877                 /* future extensibility for cmd-line arguments */
 878                 if (!chroot_dir)
 879                         chroot_dir = WITH_CHROOT;
 880         }
 881 #endif
 882
 883 #ifdef WITH_USER
 884         /* if run as root, prepare for dropping root privileges */
 885         if (getuid() == 0 || geteuid() == 0) {
 886                 /* Run with '-Z root' to restore old behaviour */
 887                 if (!username)
 888                         username = WITH_USER;
 889         }
 890 #endif
 891
 892         if (RFileName != NULL) {
 893                 int dlt;
 894                 const char *dlt_name;
 895
 896 #ifndef WIN32
 897                 /*
 898                  * We don't need network access, so relinquish any set-UID
 899                  * or set-GID privileges we have (if any).
 900                  *
 901                  * We do *not* want set-UID privileges when opening a
 902                  * trace file, as that might let the user read other
 903                  * people's trace files (especially if we're set-UID
 904                  * root).
 905                  */
 906                 if (setgid(getgid()) != 0 || setuid(getuid()) != 0 )
 907                         fprintf(stderr, "Warning: setgid/setuid failed !\n");
 908 #endif /* WIN32 */
 909                 pd = pcap_open_offline(RFileName, ebuf);
 910                 if (pd == NULL)
 911                         error("%s", ebuf);
 912                 dlt = pcap_datalink(pd);
 913                 dlt_name = pcap_datalink_val_to_name(dlt);
 914                 if (dlt_name == NULL) {
 915                         fprintf(stderr, "reading from file %s, link-type %u\n",
 916                             RFileName, dlt);
 917                 } else {
 918                         fprintf(stderr,
 919                             "reading from file %s, link-type %s (%s)\n",
 920                             RFileName, dlt_name,
 921                             pcap_datalink_val_to_description(dlt));
 922                 }
 923                 localnet = 0;
 924                 netmask = 0;
 925                 if (fflag != 0)
 926                         error("-f and -r options are incompatible");
 927         } else {
 928                 if (device == NULL) {
 929                         device = pcap_lookupdev(ebuf);
 930                         if (device == NULL)
 931                                 error("%s", ebuf);
 932                 }
 933 #ifdef WIN32
 934                 if(strlen(device) == 1) //we assume that an ASCII string is always longer than 1 char
 935                 {                                               //a Unicode string has a \0 as second byte (so strlen() is 1)
 936                         fprintf(stderr, "%s: listening on %ws\n", program_name, device);
 937                 }
 938                 else
 939                 {
 940                         fprintf(stderr, "%s: listening on %s\n", program_name, device);
 941                 }
 942
 943                 fflush(stderr);
 944 #endif /* WIN32 */
 945                 *ebuf = '\0';
 946                 pd = pcap_open_live(device, snaplen, !pflag, 1000, ebuf);
 947                 if (pd == NULL)
 948                         error("%s", ebuf);
 949                 else if (*ebuf)
 950                         warning("%s", ebuf);
 951                 /*
 952                  * Let user own process after socket has been opened.
 953                  */
 954 #ifndef WIN32
 955                 if (setgid(getgid()) != 0 || setuid(getuid()) != 0)
 956                         fprintf(stderr, "Warning: setgid/setuid failed !\n");
 957 #endif /* WIN32 */
 958 #ifdef WIN32
 959                 if(UserBufferSize != 1000000)
 960                         if(pcap_setbuff(pd, UserBufferSize)==-1){
 961                                 error("%s", pcap_geterr(pd));
 962                         }
 963 #endif /* WIN32 */
 964                 if (Lflag)
 965                         show_dlts_and_exit(pd);
 966                 if (gndo->ndo_dlt >= 0) {
 967 #ifdef HAVE_PCAP_SET_DATALINK
 968                         if (pcap_set_datalink(pd, gndo->ndo_dlt) < 0)
 969                                 error("%s", pcap_geterr(pd));
 970 #else
 971                         /*
 972                          * We don't actually support changing the
 973                          * data link type, so we only let them
 974                          * set it to what it already is.
 975                          */
 976                         if (gndo->ndo_dlt != pcap_datalink(pd)) {
 977                                 error("%s is not one of the DLTs supported by this device\n",
 978                                       gndo->ndo_dltname);
 979                         }
 980 #endif
 981                         (void)fprintf(stderr, "%s: data link type %s\n",
 982                                       program_name, gndo->ndo_dltname);
 983                         (void)fflush(stderr);
 984                 }
 985                 i = pcap_snapshot(pd);
 986                 if (snaplen < i) {
 987                         warning("snaplen raised from %d to %d", snaplen, i);
 988                         snaplen = i;
 989                 }
 990                 if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) {
 991                         localnet = 0;
 992                         netmask = 0;
 993                         warning("%s", ebuf);
 994                 }
 995         }
 996         if (infile)
 997                 cmdbuf = read_infile(infile);
 998         else
 999                 cmdbuf = copy_argv(&argv[optind]);
1000
1001         if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
1002                 error("%s", pcap_geterr(pd));
1003         if (dflag) {
1004                 bpf_dump(&fcode, dflag);
1005                 pcap_close(pd);
1006                 exit(0);
1007         }
1008         init_addrtoname(localnet, netmask);
1009         init_checksum();
1010
1011 #ifndef WIN32
1012         (void)setsignal(SIGPIPE, cleanup);
1013         (void)setsignal(SIGTERM, cleanup);
1014         (void)setsignal(SIGINT, cleanup);
1015         (void)setsignal(SIGCHLD, child_cleanup);
1016 #endif /* WIN32 */
1017         /* Cooperate with nohup(1) */
1018 #ifndef WIN32
1019         if ((oldhandler = setsignal(SIGHUP, cleanup)) != SIG_DFL)
1020                 (void)setsignal(SIGHUP, oldhandler);
1021 #endif /* WIN32 */
1022
1023         if (pcap_setfilter(pd, &fcode) < 0)
1024                 error("%s", pcap_geterr(pd));
1025         if (WFileName) {
1026                 pcap_dumper_t *p;
1027                 /* Do not exceed the default NAME_MAX for files. */
1028                 dumpinfo.CurrentFileName = (char *)malloc(NAME_MAX + 1);
1029
1030                 if (dumpinfo.CurrentFileName == NULL)
1031                         error("malloc of dumpinfo.CurrentFileName");
1032
1033                 /* We do not need numbering for dumpfiles if Cflag isn't set. */
1034                 if (Cflag != 0)
1035                   MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, WflagChars);
1036                 else
1037                   MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0);
1038
1039                 p = pcap_dump_open(pd, dumpinfo.CurrentFileName);
1040                 if (p == NULL)
1041                         error("%s", pcap_geterr(pd));
1042                 if (Cflag != 0 || Gflag != 0) {
1043                         callback = dump_packet_and_trunc;
1044                         dumpinfo.WFileName = WFileName;
1045                         dumpinfo.pd = pd;
1046                         dumpinfo.p = p;
1047                         pcap_userdata = (u_char *)&dumpinfo;
1048                 } else {
1049                         callback = dump_packet;
1050                         pcap_userdata = (u_char *)p;
1051                 }
1052         } else {
1053                 type = pcap_datalink(pd);
1054                 printinfo.printer = lookup_printer(type);
1055                 if (printinfo.printer == NULL) {
1056                         gndo->ndo_dltname = pcap_datalink_val_to_name(type);
1057                         if (gndo->ndo_dltname != NULL)
1058                                 error("unsupported data link type %s",
1059                                       gndo->ndo_dltname);
1060                         else
1061                                 error("unsupported data link type %d", type);
1062                 }
1063                 callback = print_packet;
1064                 pcap_userdata = (u_char *)&printinfo;
1065         }
1066 #ifndef WIN32
1067         /*
1068          * We cannot do this earlier, because we want to be able to open
1069          * the file (if done) for writing before giving up permissions.
1070          */
1071         if (getuid() == 0 || geteuid() == 0) {
1072                 if (username || chroot_dir)
1073                         droproot(username, chroot_dir);
1074         }
1075 #endif /* WIN32 */
1076 #ifdef SIGINFO
1077         /*
1078          * We can't get statistics when reading from a file rather
1079          * than capturing from a device.
1080          */
1081         if (RFileName == NULL)
1082                 (void)setsignal(SIGINFO, requestinfo);
1083 #endif
1084
1085         if (vflag > 0 && WFileName) {
1086                 /*
1087                  * When capturing to a file, "-v" means tcpdump should,
1088                  * every 10 secodns, "v"erbosely report the number of
1089                  * packets captured.
1090                  */
1091 #ifdef USE_WIN32_MM_TIMER
1092                 /* call verbose_stats_dump() each 1000 +/-100msec */
1093                 timer_id = timeSetEvent(1000, 100, verbose_stats_dump, 0, TIME_PERIODIC);
1094                 setvbuf(stderr, NULL, _IONBF, 0);
1095 #elif defined(HAVE_ALARM)
1096                 (void)setsignal(SIGALRM, verbose_stats_dump);
1097                 alarm(1);
1098 #endif
1099         }
1100
1101 #ifndef WIN32
1102         if (RFileName == NULL) {
1103                 int dlt;
1104                 const char *dlt_name;
1105
1106                 if (!vflag && !WFileName) {
1107                         (void)fprintf(stderr,
1108                             "%s: verbose output suppressed, use -v or -vv for full protocol decode\n",
1109                             program_name);
1110                 } else
1111                         (void)fprintf(stderr, "%s: ", program_name);
1112                 dlt = pcap_datalink(pd);
1113                 dlt_name = pcap_datalink_val_to_name(dlt);
1114                 if (dlt_name == NULL) {
1115                         (void)fprintf(stderr, "listening on %s, link-type %u, capture size %u bytes\n",
1116                             device, dlt, snaplen);
1117                 } else {
1118                         (void)fprintf(stderr, "listening on %s, link-type %s (%s), capture size %u bytes\n",
1119                             device, dlt_name,
1120                             pcap_datalink_val_to_description(dlt), snaplen);
1121                 }
1122                 (void)fflush(stderr);
1123         }
1124 #endif /* WIN32 */
1125         status = pcap_loop(pd, cnt, callback, pcap_userdata);
1126         if (WFileName == NULL) {
1127                 /*
1128                  * We're printing packets.  Flush the printed output,
1129                  * so it doesn't get intermingled with error output.
1130                  */
1131                 if (status == -2) {
1132                         /*
1133                          * We got interrupted, so perhaps we didn't
1134                          * manage to finish a line we were printing.
1135                          * Print an extra newline, just in case.
1136                          */
1137                         putchar('\n');
1138                 }
1139                 (void)fflush(stdout);
1140         }
1141         if (status == -1) {
1142                 /*
1143                  * Error.  Report it.
1144                  */
1145                 (void)fprintf(stderr, "%s: pcap_loop: %s\n",
1146                     program_name, pcap_geterr(pd));
1147         }
1148         if (RFileName == NULL) {
1149                 /*
1150                  * We're doing a live capture.  Report the capture
1151                  * statistics.
1152                  */
1153                 info(1);
1154         }
1155         pcap_close(pd);
1156         exit(status == -1 ? 1 : 0);
1157 }
1158
1159 /* make a clean exit on interrupts */
1160 static RETSIGTYPE
1161 cleanup(int signo _U_)
1162 {
1163 #ifdef USE_WIN32_MM_TIMER
1164         if (timer_id)
1165                 timeKillEvent(timer_id);
1166         timer_id = 0;
1167 #elif defined(HAVE_ALARM)
1168         alarm(0);
1169 #endif
1170
1171 #ifdef HAVE_PCAP_BREAKLOOP
1172         /*
1173          * We have "pcap_breakloop()"; use it, so that we do as little
1174          * as possible in the signal handler (it's probably not safe
1175          * to do anything with standard I/O streams in a signal handler -
1176          * the ANSI C standard doesn't say it is).
1177          */
1178         pcap_breakloop(pd);
1179 #else
1180         /*
1181          * We don't have "pcap_breakloop()"; this isn't safe, but
1182          * it's the best we can do.  Print the summary if we're
1183          * not reading from a savefile - i.e., if we're doing a
1184          * live capture - and exit.
1185          */
1186         if (pd != NULL && pcap_file(pd) == NULL) {
1187                 /*
1188                  * We got interrupted, so perhaps we didn't
1189                  * manage to finish a line we were printing.
1190                  * Print an extra newline, just in case.
1191                  */
1192                 putchar('\n');
1193                 (void)fflush(stdout);
1194                 info(1);
1195         }
1196         exit(0);
1197 #endif
1198 }
1199
1200 /*
1201   On windows, we do not use a fork, so we do not care less about
1202   waiting a child processes to die
1203  */
1204 #ifndef WIN32
1205 static RETSIGTYPE
1206 child_cleanup(int signo _U_)
1207 {
1208   wait(NULL);
1209 }
1210 #endif /* WIN32 */
1211
1212 static void
1213 info(register int verbose)
1214 {
1215         struct pcap_stat stat;
1216
1217         if (pcap_stats(pd, &stat) < 0) {
1218                 (void)fprintf(stderr, "pcap_stats: %s\n", pcap_geterr(pd));
1219                 infoprint = 0;
1220                 return;
1221         }
1222
1223         if (!verbose)
1224                 fprintf(stderr, "%s: ", program_name);
1225
1226         (void)fprintf(stderr, "%u packets captured", packets_captured);
1227         if (!verbose)
1228                 fputs(", ", stderr);
1229         else
1230                 putc('\n', stderr);
1231         (void)fprintf(stderr, "%d packets received by filter", stat.ps_recv);
1232         if (!verbose)
1233                 fputs(", ", stderr);
1234         else
1235                 putc('\n', stderr);
1236         (void)fprintf(stderr, "%d packets dropped by kernel\n", stat.ps_drop);
1237         infoprint = 0;
1238 }
1239
1240 #ifndef WIN32
1241 static void
1242 compress_savefile(const char *filename)
1243 {
1244         if (fork())
1245                 return;
1246         /*
1247          * Set to lowest priority so that this doesn't disturb the capture
1248          */
1249 #ifdef NZERO
1250         setpriority(PRIO_PROCESS, 0, NZERO - 1);
1251 #else
1252         setpriority(PRIO_PROCESS, 0, 19);
1253 #endif
1254         if (execlp(zflag, zflag, filename, NULL) == -1)
1255                 fprintf(stderr,
1256                         "compress_savefile:execlp(%s, %s): %s\n",
1257                         zflag,
1258                         filename,
1259                         strerror(errno));
1260 }
1261 #else  /* WIN32 */
1262 static void
1263 compress_savefile(const char *filename)
1264 {
1265         fprintf(stderr,
1266                 "compress_savefile failed. Functionality not implemented under windows\n");
1267 }
1268 #endif /* WIN32 */
1269
1270 static void
1271 dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
1272 {
1273         struct dump_info *dump_info;
1274
1275         ++packets_captured;
1276
1277         ++infodelay;
1278
1279         dump_info = (struct dump_info *)user;
1280
1281         /*
1282          * XXX - this won't force the file to rotate on the specified time
1283          * boundary, but it will rotate on the first packet received after the
1284          * specified Gflag number of seconds. Note: if a Gflag time boundary
1285          * and a Cflag size boundary coincide, the time rotation will occur
1286          * first thereby cancelling the Cflag boundary (since the file should
1287          * be 0).
1288          */
1289         if (Gflag != 0) {
1290                 /* Check if it is time to rotate */
1291                 time_t t;
1292
1293                 /* Get the current time */
1294                 if ((t = time(NULL)) == (time_t)-1) {
1295                         error("dump_and_trunc_packet: can't get current_time: %s",
1296                             pcap_strerror(errno));
1297                 }
1298
1299
1300                 /* If the time is greater than the specified window, rotate */
1301                 if (t - Gflag_time >= Gflag) {
1302                         /* Update the Gflag_time */
1303                         Gflag_time = t;
1304                         /* Update Gflag_count */
1305                         Gflag_count++;
1306                         /*
1307                          * Close the current file and open a new one.
1308                          */
1309                         pcap_dump_close(dump_info->p);
1310
1311                         /*
1312                          * Compress the file we just closed, if the user asked for it
1313                          */
1314                         if (zflag != NULL)
1315                                 compress_savefile(dump_info->CurrentFileName);
1316
1317                         /*
1318                          * Check to see if we've exceeded the Wflag (when
1319                          * not using Cflag).
1320                          */
1321                         if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) {
1322                                 (void)fprintf(stderr, "Maximum file limit reached: %d\n",
1323                                     Wflag);
1324                                 exit(0);
1325                                 /* NOTREACHED */
1326                         }
1327                         if (dump_info->CurrentFileName != NULL)
1328                                 free(dump_info->CurrentFileName);
1329                         /* Allocate space for max filename + \0. */
1330                         dump_info->CurrentFileName = (char *)malloc(NAME_MAX + 1);
1331                         if (dump_info->CurrentFileName == NULL)
1332                                 error("dump_packet_and_trunc: malloc");
1333                         /*
1334                          * This is always the first file in the Cflag
1335                          * rotation: e.g. 0
1336                          * We also don't need numbering if Cflag is not set.
1337                          */
1338                         if (Cflag != 0)
1339                                 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0,
1340                                     WflagChars);
1341                         else
1342                                 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 0);
1343
1344                         dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
1345                         if (dump_info->p == NULL)
1346                                 error("%s", pcap_geterr(pd));
1347                 }
1348         }
1349
1350         /*
1351          * XXX - this won't prevent capture files from getting
1352          * larger than Cflag - the last packet written to the
1353          * file could put it over Cflag.
1354          */
1355         if (Cflag != 0 && pcap_dump_ftell(dump_info->p) > Cflag) {
1356                 /*
1357                  * Close the current file and open a new one.
1358                  */
1359                 pcap_dump_close(dump_info->p);
1360
1361                 /*
1362                  * Compress the file we just closed, if the user asked for it
1363                  */
1364                 if (zflag != NULL)
1365                         compress_savefile(dump_info->CurrentFileName);
1366
1367                 Cflag_count++;
1368                 if (Wflag > 0) {
1369                         if (Cflag_count >= Wflag)
1370                                 Cflag_count = 0;
1371                 }
1372                 if (dump_info->CurrentFileName != NULL)
1373                         free(dump_info->CurrentFileName);
1374                 dump_info->CurrentFileName = (char *)malloc(NAME_MAX + 1);
1375                 if (dump_info->CurrentFileName == NULL)
1376                         error("dump_packet_and_trunc: malloc");
1377                 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars);
1378                 dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
1379                 if (dump_info->p == NULL)
1380                         error("%s", pcap_geterr(pd));
1381         }
1382
1383         pcap_dump((u_char *)dump_info->p, h, sp);
1384 #ifdef HAVE_PCAP_DUMP_FLUSH
1385         if (Uflag)
1386                 pcap_dump_flush(dump_info->p);
1387 #endif
1388
1389         --infodelay;
1390         if (infoprint)
1391                 info(0);
1392 }
1393
1394 static void
1395 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
1396 {
1397         ++packets_captured;
1398
1399         ++infodelay;
1400
1401         pcap_dump(user, h, sp);
1402 #ifdef HAVE_PCAP_DUMP_FLUSH
1403         if (Uflag)
1404                 pcap_dump_flush((pcap_dumper_t *)user);
1405 #endif
1406
1407         --infodelay;
1408         if (infoprint)
1409                 info(0);
1410 }
1411
1412 static void
1413 print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
1414 {
1415         struct print_info *print_info;
1416         u_int hdrlen;
1417
1418         ++packets_captured;
1419
1420         ++infodelay;
1421         ts_print(&h->ts);
1422
1423         print_info = (struct print_info *)user;
1424
1425         /*
1426          * Some printers want to check that they're not walking off the
1427          * end of the packet.
1428          * Rather than pass it all the way down, we set this global.
1429          */
1430         snapend = sp + h->caplen;
1431
1432         hdrlen = (*print_info->printer)(h, sp);
1433         if (Xflag) {
1434                 /*
1435                  * Print the raw packet data in hex and ASCII.
1436                  */
1437                 if (Xflag > 1) {
1438                         /*
1439                          * Include the link-layer header.
1440                          */
1441                         hex_and_ascii_print("\n\t", sp, h->caplen);
1442                 } else {
1443                         /*
1444                          * Don't include the link-layer header - and if
1445                          * we have nothing past the link-layer header,
1446                          * print nothing.
1447                          */
1448                         if (h->caplen > hdrlen)
1449                                 hex_and_ascii_print("\n\t", sp + hdrlen,
1450                                     h->caplen - hdrlen);
1451                 }
1452         } else if (xflag) {
1453                 /*
1454                  * Print the raw packet data in hex.
1455                  */
1456                 if (xflag > 1) {
1457                         /*
1458                          * Include the link-layer header.
1459                          */
1460                         hex_print("\n\t", sp, h->caplen);
1461                 } else {
1462                         /*
1463                          * Don't include the link-layer header - and if
1464                          * we have nothing past the link-layer header,
1465                          * print nothing.
1466                          */
1467                         if (h->caplen > hdrlen)
1468                                 hex_print("\n\t", sp + hdrlen,
1469                                     h->caplen - hdrlen);
1470                 }
1471         } else if (Aflag) {
1472                 /*
1473                  * Print the raw packet data in ASCII.
1474                  */
1475                 if (Aflag > 1) {
1476                         /*
1477                          * Include the link-layer header.
1478                          */
1479                         ascii_print(sp, h->caplen);
1480                 } else {
1481                         /*
1482                          * Don't include the link-layer header - and if
1483                          * we have nothing past the link-layer header,
1484                          * print nothing.
1485                          */
1486                         if (h->caplen > hdrlen)
1487                                 ascii_print(sp + hdrlen, h->caplen - hdrlen);
1488                 }
1489         }
1490
1491         putchar('\n');
1492
1493         --infodelay;
1494         if (infoprint)
1495                 info(0);
1496 }
1497
1498 #ifdef WIN32
1499         /*
1500          * XXX - there should really be libpcap calls to get the version
1501          * number as a string (the string would be generated from #defines
1502          * at run time, so that it's not generated from string constants
1503          * in the library, as, on many UNIX systems, those constants would
1504          * be statically linked into the application executable image, and
1505          * would thus reflect the version of libpcap on the system on
1506          * which the application was *linked*, not the system on which it's
1507          * *running*.
1508          *
1509          * That routine should be documented, unlike the "version[]"
1510          * string, so that UNIX vendors providing their own libpcaps
1511          * don't omit it (as a couple of vendors have...).
1512          *
1513          * Packet.dll should perhaps also export a routine to return the
1514          * version number of the Packet.dll code, to supply the
1515          * "Wpcap_version" information on Windows.
1516          */
1517         char WDversion[]="current-cvs.tcpdump.org";
1518 #if !defined(HAVE_GENERATED_VERSION)
1519         char version[]="current-cvs.tcpdump.org";
1520 #endif
1521         char pcap_version[]="current-cvs.tcpdump.org";
1522         char Wpcap_version[]="3.1";
1523 #endif
1524
1525 /*
1526  * By default, print the specified data out in hex and ASCII.
1527  */
1528 static void
1529 ndo_default_print(netdissect_options *ndo _U_, const u_char *bp, u_int length)
1530 {
1531         hex_and_ascii_print("\n\t", bp, length); /* pass on lf and identation string */
1532 }
1533
1534 void
1535 default_print(const u_char *bp, u_int length)
1536 {
1537         ndo_default_print(gndo, bp, length);
1538 }
1539
1540 #ifdef SIGINFO
1541 RETSIGTYPE requestinfo(int signo _U_)
1542 {
1543         if (infodelay)
1544                 ++infoprint;
1545         else
1546                 info(0);
1547 }
1548 #endif
1549
1550 /*
1551  * Called once each second in verbose mode while dumping to file
1552  */
1553 #ifdef USE_WIN32_MM_TIMER
1554 void CALLBACK verbose_stats_dump (UINT timer_id _U_, UINT msg _U_, DWORD_PTR arg _U_,
1555                                   DWORD_PTR dw1 _U_, DWORD_PTR dw2 _U_)
1556 {
1557         struct pcap_stat stat;
1558
1559         if (infodelay == 0 && pcap_stats(pd, &stat) >= 0)
1560                 fprintf(stderr, "Got %u\r", packets_captured);
1561 }
1562 #elif defined(HAVE_ALARM)
1563 static void verbose_stats_dump(int sig _U_)
1564 {
1565         struct pcap_stat stat;
1566
1567         if (infodelay == 0 && pcap_stats(pd, &stat) >= 0)
1568                 fprintf(stderr, "Got %u\r", packets_captured);
1569         alarm(1);
1570 }
1571 #endif
1572
1573 static void
1574 usage(void)
1575 {
1576         extern char version[];
1577 #ifndef HAVE_PCAP_LIB_VERSION
1578 #if defined(WIN32) || defined(HAVE_PCAP_VERSION)
1579         extern char pcap_version[];
1580 #else /* defined(WIN32) || defined(HAVE_PCAP_VERSION) */
1581         static char pcap_version[] = "unknown";
1582 #endif /* defined(WIN32) || defined(HAVE_PCAP_VERSION) */
1583 #endif /* HAVE_PCAP_LIB_VERSION */
1584
1585 #ifdef HAVE_PCAP_LIB_VERSION
1586 #ifdef WIN32
1587         (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version);
1588 #else /* WIN32 */
1589         (void)fprintf(stderr, "%s version %s\n", program_name, version);
1590 #endif /* WIN32 */
1591         (void)fprintf(stderr, "%s\n",pcap_lib_version());
1592 #else /* HAVE_PCAP_LIB_VERSION */
1593 #ifdef WIN32
1594         (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version);
1595         (void)fprintf(stderr, "WinPcap version %s, based on libpcap version %s\n",Wpcap_version, pcap_version);
1596 #else /* WIN32 */
1597         (void)fprintf(stderr, "%s version %s\n", program_name, version);
1598         (void)fprintf(stderr, "libpcap version %s\n", pcap_version);
1599 #endif /* WIN32 */
1600 #endif /* HAVE_PCAP_LIB_VERSION */
1601         (void)fprintf(stderr,
1602 "Usage: %s [-aAd" D_FLAG "efKlLnNOpqRStu" U_FLAG "vxX]" B_FLAG_USAGE " [-c count] [ -C file_size ]\n", program_name);
1603         (void)fprintf(stderr,
1604 "\t\t[ -E algo:secret ] [ -F file ] [ -G seconds ] [ -i interface ]\n");
1605         (void)fprintf(stderr,
1606 "\t\t[ -M secret ] [ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]\n");
1607         (void)fprintf(stderr,
1608 "\t\t[ -W filecount ] [ -y datalinktype ] [ -z command ] [ -Z user ]\n");
1609         (void)fprintf(stderr,
1610 "\t\t[ expression ]\n");
1611         exit(1);
1612 }
1613
1614
1615
1616 /* VARARGS */
1617 static void
1618 ndo_error(netdissect_options *ndo _U_, const char *fmt, ...)
1619 {
1620         va_list ap;
1621
1622         (void)fprintf(stderr, "%s: ", program_name);
1623         va_start(ap, fmt);
1624         (void)vfprintf(stderr, fmt, ap);
1625         va_end(ap);
1626         if (*fmt) {
1627                 fmt += strlen(fmt);
1628                 if (fmt[-1] != '\n')
1629                         (void)fputc('\n', stderr);
1630         }
1631         exit(1);
1632         /* NOTREACHED */
1633 }
1634
1635 /* VARARGS */
1636 static void
1637 ndo_warning(netdissect_options *ndo _U_, const char *fmt, ...)
1638 {
1639         va_list ap;
1640
1641         (void)fprintf(stderr, "%s: WARNING: ", program_name);
1642         va_start(ap, fmt);
1643         (void)vfprintf(stderr, fmt, ap);
1644         va_end(ap);
1645         if (*fmt) {
1646                 fmt += strlen(fmt);
1647                 if (fmt[-1] != '\n')
1648                         (void)fputc('\n', stderr);
1649         }
1650 }
1651