2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 * Support for splitting captures into multiple files with a maximum
25 * Seth Webster <swebster@sst.ll.mit.edu>
36 #include "netdissect-stdinc.h"
38 #include "netdissect.h"
39 #include "addrtoname.h"
41 #include "netdissect-alloc.h"
43 #include "pcap-missing.h"
55 static const struct uint_printer uint_printers
[] = {
56 #if defined(DLT_PFLOG) && defined(HAVE_NET_IF_PFLOG_H)
57 { pflog_if_print
, DLT_PFLOG
},
62 static const struct void_printer void_printers
[] = {
63 #ifdef DLT_APPLE_IP_OVER_IEEE1394
64 { ap1394_if_print
, DLT_APPLE_IP_OVER_IEEE1394
},
66 { arcnet_if_print
, DLT_ARCNET
},
67 #ifdef DLT_ARCNET_LINUX
68 { arcnet_linux_if_print
, DLT_ARCNET_LINUX
},
70 { atm_if_print
, DLT_ATM_RFC1483
},
71 #ifdef DLT_DSA_TAG_BRCM
72 { brcm_tag_if_print
, DLT_DSA_TAG_BRCM
},
74 #ifdef DLT_DSA_TAG_BRCM_PREPEND
75 { brcm_tag_prepend_if_print
, DLT_DSA_TAG_BRCM_PREPEND
},
77 #ifdef DLT_BLUETOOTH_HCI_H4_WITH_PHDR
78 { bt_if_print
, DLT_BLUETOOTH_HCI_H4_WITH_PHDR
},
81 { chdlc_if_print
, DLT_C_HDLC
},
84 { chdlc_if_print
, DLT_HDLC
},
87 { cip_if_print
, DLT_ATM_CLIP
},
90 { cip_if_print
, DLT_CIP
},
92 #ifdef DLT_DSA_TAG_DSA
93 { dsa_if_print
, DLT_DSA_TAG_DSA
},
95 #ifdef DLT_DSA_TAG_EDSA
96 { edsa_if_print
, DLT_DSA_TAG_EDSA
},
99 { enc_if_print
, DLT_ENC
},
101 { ether_if_print
, DLT_EN10MB
},
102 { fddi_if_print
, DLT_FDDI
},
104 { fr_if_print
, DLT_FR
},
107 { fr_if_print
, DLT_FRELAY
},
109 #ifdef DLT_IEEE802_11
110 { ieee802_11_if_print
, DLT_IEEE802_11
},
112 #ifdef DLT_IEEE802_11_RADIO_AVS
113 { ieee802_11_radio_avs_if_print
, DLT_IEEE802_11_RADIO_AVS
},
115 #ifdef DLT_IEEE802_11_RADIO
116 { ieee802_11_radio_if_print
, DLT_IEEE802_11_RADIO
},
118 #ifdef DLT_IEEE802_15_4
119 { ieee802_15_4_if_print
, DLT_IEEE802_15_4
},
121 #ifdef DLT_IEEE802_15_4_NOFCS
122 { ieee802_15_4_if_print
, DLT_IEEE802_15_4_NOFCS
},
124 #ifdef DLT_IEEE802_15_4_TAP
125 { ieee802_15_4_tap_if_print
, DLT_IEEE802_15_4_TAP
},
127 #ifdef DLT_IP_OVER_FC
128 { ipfc_if_print
, DLT_IP_OVER_FC
},
131 { ipnet_if_print
, DLT_IPNET
},
134 { ipoib_if_print
, DLT_IPOIB
},
136 #ifdef DLT_JUNIPER_ATM1
137 { juniper_atm1_if_print
, DLT_JUNIPER_ATM1
},
139 #ifdef DLT_JUNIPER_ATM2
140 { juniper_atm2_if_print
, DLT_JUNIPER_ATM2
},
142 #ifdef DLT_JUNIPER_CHDLC
143 { juniper_chdlc_if_print
, DLT_JUNIPER_CHDLC
},
145 #ifdef DLT_JUNIPER_ES
146 { juniper_es_if_print
, DLT_JUNIPER_ES
},
148 #ifdef DLT_JUNIPER_ETHER
149 { juniper_ether_if_print
, DLT_JUNIPER_ETHER
},
151 #ifdef DLT_JUNIPER_FRELAY
152 { juniper_frelay_if_print
, DLT_JUNIPER_FRELAY
},
154 #ifdef DLT_JUNIPER_GGSN
155 { juniper_ggsn_if_print
, DLT_JUNIPER_GGSN
},
157 #ifdef DLT_JUNIPER_MFR
158 { juniper_mfr_if_print
, DLT_JUNIPER_MFR
},
160 #ifdef DLT_JUNIPER_MLFR
161 { juniper_mlfr_if_print
, DLT_JUNIPER_MLFR
},
163 #ifdef DLT_JUNIPER_MLPPP
164 { juniper_mlppp_if_print
, DLT_JUNIPER_MLPPP
},
166 #ifdef DLT_JUNIPER_MONITOR
167 { juniper_monitor_if_print
, DLT_JUNIPER_MONITOR
},
169 #ifdef DLT_JUNIPER_PPP
170 { juniper_ppp_if_print
, DLT_JUNIPER_PPP
},
172 #ifdef DLT_JUNIPER_PPPOE_ATM
173 { juniper_pppoe_atm_if_print
, DLT_JUNIPER_PPPOE_ATM
},
175 #ifdef DLT_JUNIPER_PPPOE
176 { juniper_pppoe_if_print
, DLT_JUNIPER_PPPOE
},
178 #ifdef DLT_JUNIPER_SERVICES
179 { juniper_services_if_print
, DLT_JUNIPER_SERVICES
},
182 { ltalk_if_print
, DLT_LTALK
},
185 { mfr_if_print
, DLT_MFR
},
187 #ifdef DLT_NETANALYZER
188 { netanalyzer_if_print
, DLT_NETANALYZER
},
190 #ifdef DLT_NETANALYZER_TRANSPARENT
191 { netanalyzer_transparent_if_print
, DLT_NETANALYZER_TRANSPARENT
},
194 { nflog_if_print
, DLT_NFLOG
},
196 { null_if_print
, DLT_NULL
},
198 { null_if_print
, DLT_LOOP
},
201 { pktap_if_print
, DLT_PKTAP
},
204 { ppi_if_print
, DLT_PPI
},
207 { ppp_bsdos_if_print
, DLT_PPP_BSDOS
},
209 #ifdef DLT_PPP_SERIAL
210 { ppp_hdlc_if_print
, DLT_PPP_SERIAL
},
212 { ppp_if_print
, DLT_PPP
},
213 #ifdef DLT_PPP_WITHDIRECTION
214 { ppp_if_print
, DLT_PPP_WITHDIRECTION
},
217 { pppoe_if_print
, DLT_PPP_ETHER
},
219 #ifdef DLT_PRISM_HEADER
220 { prism_if_print
, DLT_PRISM_HEADER
},
222 { raw_if_print
, DLT_RAW
},
224 { raw_if_print
, DLT_IPV4
},
227 { raw_if_print
, DLT_IPV6
},
229 #ifdef DLT_SLIP_BSDOS
230 { sl_bsdos_if_print
, DLT_SLIP_BSDOS
},
232 { sl_if_print
, DLT_SLIP
},
234 { sll_if_print
, DLT_LINUX_SLL
},
236 #ifdef DLT_LINUX_SLL2
237 { sll2_if_print
, DLT_LINUX_SLL2
},
240 { sunatm_if_print
, DLT_SUNATM
},
242 #ifdef DLT_SYMANTEC_FIREWALL
243 { symantec_if_print
, DLT_SYMANTEC_FIREWALL
},
245 { token_if_print
, DLT_IEEE802
},
247 { usb_linux_48_byte_if_print
, DLT_USB_LINUX
},
248 #endif /* DLT_USB_LINUX */
249 #ifdef DLT_USB_LINUX_MMAPPED
250 { usb_linux_64_byte_if_print
, DLT_USB_LINUX_MMAPPED
},
251 #endif /* DLT_USB_LINUX_MMAPPED */
253 { vsock_if_print
, DLT_VSOCK
},
258 static void ndo_default_print(netdissect_options
*ndo
, const u_char
*bp
,
261 static void NORETURN
ndo_error(netdissect_options
*ndo
,
262 status_exit_codes_t status
,
263 FORMAT_STRING(const char *fmt
), ...)
265 static void ndo_warning(netdissect_options
*ndo
,
266 FORMAT_STRING(const char *fmt
), ...)
269 static int ndo_printf(netdissect_options
*ndo
,
270 FORMAT_STRING(const char *fmt
), ...)
274 init_print(netdissect_options
*ndo
, uint32_t localnet
, uint32_t mask
)
277 init_addrtoname(ndo
, localnet
, mask
);
282 lookup_uint_printer(int type
)
284 const struct uint_printer
*p
;
286 for (p
= uint_printers
; p
->f
; ++p
)
290 #if defined(DLT_USER2) && defined(DLT_PKTAP)
292 * Apple incorrectly chose to use DLT_USER2 for their PKTAP
295 * We map DLT_PKTAP, whether it's DLT_USER2 as it is on Darwin-
296 * based OSes or the same value as LINKTYPE_PKTAP as it is on
297 * other OSes, to LINKTYPE_PKTAP, so files written with
298 * this version of libpcap for a DLT_PKTAP capture have a link-
299 * layer header type of LINKTYPE_PKTAP.
301 * However, files written on OS X Mavericks for a DLT_PKTAP
302 * capture have a link-layer header type of LINKTYPE_USER2.
303 * If we don't have a printer for DLT_USER2, and type is
304 * DLT_USER2, we look up the printer for DLT_PKTAP and use
307 if (type
== DLT_USER2
) {
308 for (p
= uint_printers
; p
->f
; ++p
)
309 if (DLT_PKTAP
== p
->type
)
319 lookup_void_printer(int type
)
321 const struct void_printer
*p
;
323 for (p
= void_printers
; p
->f
; ++p
)
327 #if defined(DLT_USER2) && defined(DLT_PKTAP)
329 * Apple incorrectly chose to use DLT_USER2 for their PKTAP
332 * We map DLT_PKTAP, whether it's DLT_USER2 as it is on Darwin-
333 * based OSes or the same value as LINKTYPE_PKTAP as it is on
334 * other OSes, to LINKTYPE_PKTAP, so files written with
335 * this version of libpcap for a DLT_PKTAP capture have a link-
336 * layer header type of LINKTYPE_PKTAP.
338 * However, files written on OS X Mavericks for a DLT_PKTAP
339 * capture have a link-layer header type of LINKTYPE_USER2.
340 * If we don't have a printer for DLT_USER2, and type is
341 * DLT_USER2, we look up the printer for DLT_PKTAP and use
344 if (type
== DLT_USER2
) {
345 for (p
= void_printers
; p
->f
; ++p
)
346 if (DLT_PKTAP
== p
->type
)
356 lookup_printer(netdissect_options
*ndo
, int type
)
358 if_printer_t printer
;
360 printer
.void_printer
= lookup_void_printer(type
);
361 ndo
->ndo_void_printer
= TRUE
;
362 if (printer
.void_printer
== NULL
) {
363 printer
.uint_printer
= lookup_uint_printer(type
);
364 ndo
->ndo_void_printer
= FALSE
;
370 has_printer(int type
)
372 return (lookup_void_printer(type
) != NULL
||
373 lookup_uint_printer(type
) != NULL
);
377 get_if_printer(netdissect_options
*ndo
, int type
)
379 if_printer_t printer
;
381 printer
= lookup_printer(ndo
, type
);
382 if (printer
.printer
== NULL
)
383 printer
.void_printer
= unsupported_if_print
;
388 pretty_print_packet(netdissect_options
*ndo
, const struct pcap_pkthdr
*h
,
389 const u_char
*sp
, u_int packets_captured
)
392 int invalid_header
= 0;
394 if (ndo
->ndo_packet_number
)
395 ND_PRINT("%5u ", packets_captured
);
397 /* Sanity checks on packet length / capture length */
398 if (h
->caplen
== 0) {
400 ND_PRINT("[Invalid header: caplen==0");
403 if (!invalid_header
) {
405 ND_PRINT("[Invalid header:");
409 } else if (h
->len
< h
->caplen
) {
410 if (!invalid_header
) {
412 ND_PRINT("[Invalid header:");
415 ND_PRINT(" len(%u) < caplen(%u)", h
->len
, h
->caplen
);
417 if (h
->caplen
> MAXIMUM_SNAPLEN
) {
418 if (!invalid_header
) {
420 ND_PRINT("[Invalid header:");
423 ND_PRINT(" caplen(%u) > %u", h
->caplen
, MAXIMUM_SNAPLEN
);
425 if (h
->len
> MAXIMUM_SNAPLEN
) {
426 if (!invalid_header
) {
428 ND_PRINT("[Invalid header:");
431 ND_PRINT(" len(%u) > %u", h
->len
, MAXIMUM_SNAPLEN
);
433 if (invalid_header
) {
440 * capture length != 0,
441 * packet length != 0,
442 * capture length <= MAXIMUM_SNAPLEN,
443 * packet length <= MAXIMUM_SNAPLEN,
444 * packet length >= capture length.
446 * Currently, there is no D-Bus printer, thus no need for
450 ts_print(ndo
, &h
->ts
);
453 * Printers must check that they're not walking off the end of
455 * Rather than pass it all the way down, we set this member
456 * of the netdissect_options structure.
458 ndo
->ndo_snapend
= sp
+ h
->caplen
;
460 ndo
->ndo_protocol
= "";
461 ndo
->ndo_ll_hdr_len
= 0;
462 if (setjmp(ndo
->ndo_truncated
) == 0) {
463 /* Print the packet. */
464 if (ndo
->ndo_void_printer
== TRUE
) {
465 (ndo
->ndo_if_printer
.void_printer
)(ndo
, h
, sp
);
466 hdrlen
= ndo
->ndo_ll_hdr_len
;
468 hdrlen
= (ndo
->ndo_if_printer
.uint_printer
)(ndo
, h
, sp
);
470 /* A printer quit because the packet was truncated; report it */
471 ND_PRINT(" [|%s]", ndo
->ndo_protocol
);
472 hdrlen
= ndo
->ndo_ll_hdr_len
;
476 * Empty the stack of packet information, freeing all pushed buffers;
477 * if we got here by a printer quitting, we need to release anything
478 * that didn't get released because we longjmped out of the code
479 * before it popped the packet information.
481 nd_pop_all_packet_info(ndo
);
484 * Restore the original snapend, as a printer might have
487 ndo
->ndo_snapend
= sp
+ h
->caplen
;
488 if (ndo
->ndo_Xflag
) {
490 * Print the raw packet data in hex and ASCII.
492 if (ndo
->ndo_Xflag
> 1) {
494 * Include the link-layer header.
496 hex_and_ascii_print(ndo
, "\n\t", sp
, h
->caplen
);
499 * Don't include the link-layer header - and if
500 * we have nothing past the link-layer header,
503 if (h
->caplen
> hdrlen
)
504 hex_and_ascii_print(ndo
, "\n\t", sp
+ hdrlen
,
507 } else if (ndo
->ndo_xflag
) {
509 * Print the raw packet data in hex.
511 if (ndo
->ndo_xflag
> 1) {
513 * Include the link-layer header.
515 hex_print(ndo
, "\n\t", sp
, h
->caplen
);
518 * Don't include the link-layer header - and if
519 * we have nothing past the link-layer header,
522 if (h
->caplen
> hdrlen
)
523 hex_print(ndo
, "\n\t", sp
+ hdrlen
,
526 } else if (ndo
->ndo_Aflag
) {
528 * Print the raw packet data in ASCII.
530 if (ndo
->ndo_Aflag
> 1) {
532 * Include the link-layer header.
534 ascii_print(ndo
, sp
, h
->caplen
);
537 * Don't include the link-layer header - and if
538 * we have nothing past the link-layer header,
541 if (h
->caplen
> hdrlen
)
542 ascii_print(ndo
, sp
+ hdrlen
, h
->caplen
- hdrlen
);
551 * By default, print the specified data out in hex and ASCII.
554 ndo_default_print(netdissect_options
*ndo
, const u_char
*bp
, u_int length
)
556 hex_and_ascii_print(ndo
, "\n\t", bp
, length
); /* pass on lf and indentation string */
561 ndo_error(netdissect_options
*ndo
, status_exit_codes_t status
,
562 const char *fmt
, ...)
566 if (ndo
->program_name
)
567 (void)fprintf(stderr
, "%s: ", ndo
->program_name
);
569 (void)vfprintf(stderr
, fmt
, ap
);
574 (void)fputc('\n', stderr
);
583 ndo_warning(netdissect_options
*ndo
, const char *fmt
, ...)
587 if (ndo
->program_name
)
588 (void)fprintf(stderr
, "%s: ", ndo
->program_name
);
589 (void)fprintf(stderr
, "WARNING: ");
591 (void)vfprintf(stderr
, fmt
, ap
);
596 (void)fputc('\n', stderr
);
601 ndo_printf(netdissect_options
*ndo
, const char *fmt
, ...)
607 ret
= vfprintf(stdout
, fmt
, args
);
611 ndo_error(ndo
, S_ERR_ND_WRITE_FILE
,
612 "Unable to write output: %s", pcap_strerror(errno
));
617 ndo_set_function_pointers(netdissect_options
*ndo
)
619 ndo
->ndo_default_print
=ndo_default_print
;
620 ndo
->ndo_printf
=ndo_printf
;
621 ndo
->ndo_error
=ndo_error
;
622 ndo
->ndo_warning
=ndo_warning
;