The Tcpdump Group git mirrors - tcpdump/blob - tcpdump.c

   1 /*
   2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  * Support for splitting captures into multiple files with a maximum
  22  * file size:
  23  *
  24  * Copyright (c) 2001
  25  *      Seth Webster <swebster@sst.ll.mit.edu>
  26  */
  27
  28 #ifndef lint
  29 static const char copyright[] _U_ =
  30     "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\
  31 The Regents of the University of California.  All rights reserved.\n";
  32 static const char rcsid[] _U_ =
  33     "@(#) $Header: /tcpdump/master/tcpdump/tcpdump.c,v 1.266 2005-12-13 13:44:30 hannes Exp $ (LBL)";
  34 #endif
  35
  36 /*
  37  * tcpdump - monitor tcp/ip traffic on an ethernet.
  38  *
  39  * First written in 1987 by Van Jacobson, Lawrence Berkeley Laboratory.
  40  * Mercilessly hacked and occasionally improved since then via the
  41  * combined efforts of Van, Steve McCanne and Craig Leres of LBL.
  42  */
  43
  44 #ifdef HAVE_CONFIG_H
  45 #include "config.h"
  46 #endif
  47
  48 #include <tcpdump-stdinc.h>
  49
  50 #ifdef WIN32
  51 #include "getopt.h"
  52 #include "w32_fzs.h"
  53 extern int strcasecmp (const char *__s1, const char *__s2);
  54 extern int SIZE_BUF;
  55 #define off_t long
  56 #define uint UINT
  57 #endif /* WIN32 */
  58
  59 #ifdef HAVE_SMI_H
  60 #include <smi.h>
  61 #endif
  62
  63 #include <pcap.h>
  64 #include <signal.h>
  65 #include <stdio.h>
  66 #include <stdlib.h>
  67 #include <string.h>
  68 #ifndef WIN32
  69 #include <pwd.h>
  70 #include <grp.h>
  71 #include <errno.h>
  72 #endif /* WIN32 */
  73
  74 #include "netdissect.h"
  75 #include "interface.h"
  76 #include "addrtoname.h"
  77 #include "machdep.h"
  78 #include "setsignal.h"
  79 #include "gmt2local.h"
  80 #include "pcap-missing.h"
  81
  82 #ifndef NAME_MAX
  83 #define NAME_MAX 255
  84 #endif
  85
  86 netdissect_options Gndo;
  87 netdissect_options *gndo = &Gndo;
  88
  89 int dflag;                      /* print filter code */
  90 int Lflag;                      /* list available data link types and exit */
  91
  92 static int infodelay;
  93 static int infoprint;
  94
  95 char *program_name;
  96
  97 int32_t thiszone;               /* seconds offset from gmt to local time */
  98
  99 /* Forwards */
 100 static RETSIGTYPE cleanup(int);
 101 static void usage(void) __attribute__((noreturn));
 102 static void show_dlts_and_exit(pcap_t *pd) __attribute__((noreturn));
 103
 104 static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
 105 static void ndo_default_print(netdissect_options *, const u_char *, u_int);
 106 static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *);
 107 static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
 108 static void droproot(const char *, const char *);
 109 static void ndo_error(netdissect_options *ndo, const char *fmt, ...);
 110 static void ndo_warning(netdissect_options *ndo, const char *fmt, ...);
 111
 112 #ifdef SIGINFO
 113 RETSIGTYPE requestinfo(int);
 114 #endif
 115
 116 #if defined(USE_WIN32_MM_TIMER)
 117   #include <MMsystem.h>
 118   static UINT timer_id;
 119   static void CALLBACK verbose_stats_dump(UINT, UINT, DWORD_PTR, DWORD_PTR, DWORD_PTR);
 120 #elif defined(HAVE_ALARM)
 121   static void verbose_stats_dump(int sig);
 122 #endif
 123
 124 static void info(int);
 125 static u_int packets_captured;
 126
 127 typedef u_int (*if_printer)(const struct pcap_pkthdr *, const u_char *);
 128
 129 struct printer {
 130         if_printer f;
 131         int type;
 132 };
 133
 134 static struct printer printers[] = {
 135         { arcnet_if_print,      DLT_ARCNET },
 136 #ifdef DLT_ARCNET_LINUX
 137         { arcnet_linux_if_print, DLT_ARCNET_LINUX },
 138 #endif
 139         { ether_if_print,       DLT_EN10MB },
 140         { token_if_print,       DLT_IEEE802 },
 141 #ifdef DLT_LANE8023
 142         { lane_if_print,        DLT_LANE8023 },
 143 #endif
 144 #ifdef DLT_CIP
 145         { cip_if_print,         DLT_CIP },
 146 #endif
 147 #ifdef DLT_ATM_CLIP
 148         { cip_if_print,         DLT_ATM_CLIP },
 149 #endif
 150         { sl_if_print,          DLT_SLIP },
 151 #ifdef DLT_SLIP_BSDOS
 152         { sl_bsdos_if_print,    DLT_SLIP_BSDOS },
 153 #endif
 154         { ppp_if_print,         DLT_PPP },
 155 #ifdef DLT_PPP_WITHDIRECTION
 156         { ppp_if_print,         DLT_PPP_WITHDIRECTION },
 157 #endif
 158 #ifdef DLT_PPP_BSDOS
 159         { ppp_bsdos_if_print,   DLT_PPP_BSDOS },
 160 #endif
 161         { fddi_if_print,        DLT_FDDI },
 162         { null_if_print,        DLT_NULL },
 163 #ifdef DLT_LOOP
 164         { null_if_print,        DLT_LOOP },
 165 #endif
 166         { raw_if_print,         DLT_RAW },
 167         { atm_if_print,         DLT_ATM_RFC1483 },
 168 #ifdef DLT_C_HDLC
 169         { chdlc_if_print,       DLT_C_HDLC },
 170 #endif
 171 #ifdef DLT_HDLC
 172         { chdlc_if_print,       DLT_HDLC },
 173 #endif
 174 #ifdef DLT_PPP_SERIAL
 175         { ppp_hdlc_if_print,    DLT_PPP_SERIAL },
 176 #endif
 177 #ifdef DLT_PPP_ETHER
 178         { pppoe_if_print,       DLT_PPP_ETHER },
 179 #endif
 180 #ifdef DLT_LINUX_SLL
 181         { sll_if_print,         DLT_LINUX_SLL },
 182 #endif
 183 #ifdef DLT_IEEE802_11
 184         { ieee802_11_if_print,  DLT_IEEE802_11},
 185 #endif
 186 #ifdef DLT_LTALK
 187         { ltalk_if_print,       DLT_LTALK },
 188 #endif
 189 #ifdef DLT_PFLOG
 190         { pflog_if_print,       DLT_PFLOG },
 191 #endif
 192 #ifdef DLT_FR
 193         { fr_if_print,          DLT_FR },
 194 #endif
 195 #ifdef DLT_FRELAY
 196         { fr_if_print,          DLT_FRELAY },
 197 #endif
 198 #ifdef DLT_SUNATM
 199         { sunatm_if_print,      DLT_SUNATM },
 200 #endif
 201 #ifdef DLT_IP_OVER_FC
 202         { ipfc_if_print,        DLT_IP_OVER_FC },
 203 #endif
 204 #ifdef DLT_PRISM_HEADER
 205         { prism_if_print,       DLT_PRISM_HEADER },
 206 #endif
 207 #ifdef DLT_IEEE802_11_RADIO
 208         { ieee802_11_radio_if_print,    DLT_IEEE802_11_RADIO },
 209 #endif
 210 #ifdef DLT_ENC
 211         { enc_if_print,         DLT_ENC },
 212 #endif
 213 #ifdef DLT_SYMANTEC_FIREWALL
 214         { symantec_if_print,    DLT_SYMANTEC_FIREWALL },
 215 #endif
 216 #ifdef DLT_APPLE_IP_OVER_IEEE1394
 217         { ap1394_if_print,      DLT_APPLE_IP_OVER_IEEE1394 },
 218 #endif
 219 #ifdef DLT_JUNIPER_ATM1
 220         { juniper_atm1_print,   DLT_JUNIPER_ATM1 },
 221 #endif
 222 #ifdef DLT_JUNIPER_ATM2
 223         { juniper_atm2_print,   DLT_JUNIPER_ATM2 },
 224 #endif
 225 #ifdef DLT_JUNIPER_MFR
 226         { juniper_mfr_print,    DLT_JUNIPER_MFR },
 227 #endif
 228 #ifdef DLT_JUNIPER_MLFR
 229         { juniper_mlfr_print,   DLT_JUNIPER_MLFR },
 230 #endif
 231 #ifdef DLT_JUNIPER_MLPPP
 232         { juniper_mlppp_print,  DLT_JUNIPER_MLPPP },
 233 #endif
 234 #ifdef DLT_JUNIPER_PPPOE
 235         { juniper_pppoe_print,  DLT_JUNIPER_PPPOE },
 236 #endif
 237 #ifdef DLT_JUNIPER_PPPOE_ATM
 238         { juniper_pppoe_atm_print, DLT_JUNIPER_PPPOE_ATM },
 239 #endif
 240 #ifdef DLT_JUNIPER_GGSN
 241         { juniper_ggsn_print,   DLT_JUNIPER_GGSN },
 242 #endif
 243 #ifdef DLT_JUNIPER_ES
 244         { juniper_es_print,     DLT_JUNIPER_ES },
 245 #endif
 246 #ifdef DLT_JUNIPER_MONITOR
 247         { juniper_monitor_print, DLT_JUNIPER_MONITOR },
 248 #endif
 249 #ifdef DLT_JUNIPER_SERVICES
 250         { juniper_services_print, DLT_JUNIPER_SERVICES },
 251 #endif
 252 #ifdef DLT_JUNIPER_ETHER
 253         { juniper_ether_print, DLT_JUNIPER_ETHER },
 254 #endif
 255 #ifdef DLT_JUNIPER_PPP
 256         { juniper_ppp_print, DLT_JUNIPER_PPP },
 257 #endif
 258 #ifdef DLT_JUNIPER_FRELAY
 259         { juniper_frelay_print, DLT_JUNIPER_FRELAY },
 260 #endif
 261 #ifdef DLT_JUNIPER_CHDLC
 262         { juniper_chdlc_print, DLT_JUNIPER_CHDLC },
 263 #endif
 264 #ifdef DLT_MFR
 265         { mfr_if_print, DLT_MFR },
 266 #endif
 267         { NULL,                 0 },
 268 };
 269
 270 static if_printer
 271 lookup_printer(int type)
 272 {
 273         struct printer *p;
 274
 275         for (p = printers; p->f; ++p)
 276                 if (type == p->type)
 277                         return p->f;
 278
 279         return NULL;
 280         /* NOTREACHED */
 281 }
 282
 283 static pcap_t *pd;
 284
 285 extern int optind;
 286 extern int opterr;
 287 extern char *optarg;
 288
 289 struct print_info {
 290         if_printer printer;
 291 };
 292
 293 struct dump_info {
 294         char    *WFileName;
 295         pcap_t  *pd;
 296         pcap_dumper_t *p;
 297 };
 298
 299 static void
 300 show_dlts_and_exit(pcap_t *pd)
 301 {
 302         int n_dlts;
 303         int *dlts = 0;
 304         const char *dlt_name;
 305
 306         n_dlts = pcap_list_datalinks(pd, &dlts);
 307         if (n_dlts < 0)
 308                 error("%s", pcap_geterr(pd));
 309         else if (n_dlts == 0 || !dlts)
 310                 error("No data link types.");
 311
 312         (void) fprintf(stderr, "Data link types (use option -y to set):\n");
 313
 314         while (--n_dlts >= 0) {
 315                 dlt_name = pcap_datalink_val_to_name(dlts[n_dlts]);
 316                 if (dlt_name != NULL) {
 317                         (void) fprintf(stderr, "  %s (%s)", dlt_name,
 318                             pcap_datalink_val_to_description(dlts[n_dlts]));
 319
 320                         /*
 321                          * OK, does tcpdump handle that type?
 322                          */
 323                         if (lookup_printer(dlts[n_dlts]) == NULL)
 324                                 (void) fprintf(stderr, " (not supported)");
 325                         putchar('\n');
 326                 } else {
 327                         (void) fprintf(stderr, "  DLT %d (not supported)\n",
 328                             dlts[n_dlts]);
 329                 }
 330         }
 331         free(dlts);
 332         exit(0);
 333 }
 334
 335 /*
 336  * Set up flags that might or might not be supported depending on the
 337  * version of libpcap we're using.
 338  */
 339 #ifdef WIN32
 340 #define B_FLAG          "B:"
 341 #define B_FLAG_USAGE    " [ -B size ]"
 342 #else /* WIN32 */
 343 #define B_FLAG
 344 #define B_FLAG_USAGE
 345 #endif /* WIN32 */
 346
 347 #ifdef HAVE_PCAP_FINDALLDEVS
 348 #ifndef HAVE_PCAP_IF_T
 349 #undef HAVE_PCAP_FINDALLDEVS
 350 #endif
 351 #endif
 352
 353 #ifdef HAVE_PCAP_FINDALLDEVS
 354 #define D_FLAG  "D"
 355 #else
 356 #define D_FLAG
 357 #endif
 358
 359 #ifdef HAVE_PCAP_DUMP_FLUSH
 360 #define U_FLAG  "U"
 361 #else
 362 #define U_FLAG
 363 #endif
 364
 365 #ifndef WIN32
 366 /* Drop root privileges and chroot if necessary */
 367 static void
 368 droproot(const char *username, const char *chroot_dir)
 369 {
 370         struct passwd *pw = NULL;
 371
 372         if (chroot_dir && !username) {
 373                 fprintf(stderr, "tcpdump: Chroot without dropping root is insecure\n");
 374                 exit(1);
 375         }
 376
 377         pw = getpwnam(username);
 378         if (pw) {
 379                 if (chroot_dir) {
 380                         if (chroot(chroot_dir) != 0 || chdir ("/") != 0) {
 381                                 fprintf(stderr, "tcpdump: Couldn't chroot/chdir to '%.64s': %s\n",
 382                                     chroot_dir, pcap_strerror(errno));
 383                                 exit(1);
 384                         }
 385                 }
 386                 if (initgroups(pw->pw_name, pw->pw_gid) != 0 ||
 387                     setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0) {
 388                         fprintf(stderr, "tcpdump: Couldn't change to '%.32s' uid=%lu gid=%lu: %s\n",
 389                             username,
 390                             (unsigned long)pw->pw_uid,
 391                             (unsigned long)pw->pw_gid,
 392                             pcap_strerror(errno));
 393                         exit(1);
 394                 }
 395         }
 396         else {
 397                 fprintf(stderr, "tcpdump: Couldn't find user '%.32s'\n",
 398                     username);
 399                 exit(1);
 400         }
 401 }
 402 #endif /* WIN32 */
 403
 404 static int
 405 getWflagChars(int x)
 406 {
 407         int c = 0;
 408
 409         x -= 1;
 410         while (x > 0) {
 411                 c += 1;
 412                 x /= 10;
 413         }
 414
 415         return c;
 416 }
 417
 418
 419 static void
 420 MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars)
 421 {
 422         char *filename = malloc(NAME_MAX + 1);
 423
 424         /* Process with strftime if Gflag is set. */
 425         if (Gflag != 0) {
 426           struct tm *local_tm;
 427
 428           /* Convert Gflag_time to a usable format */
 429           if ((local_tm = localtime(&Gflag_time)) == NULL) {
 430                   error("MakeTimedFilename: localtime");
 431           }
 432
 433           /* There's no good way to detect an error in strftime since a return
 434            * value of 0 isn't necessarily failure.
 435            */
 436           strftime(filename, NAME_MAX, orig_name, local_tm);
 437         } else {
 438           strncpy(filename, orig_name, NAME_MAX);
 439         }
 440
 441         if (cnt == 0 && max_chars == 0)
 442                 strncpy(buffer, filename, NAME_MAX + 1);
 443         else
 444                 if (snprintf(buffer, NAME_MAX + 1, "%s%0*d", filename, max_chars, cnt) > NAME_MAX)
 445                   /* Report an error if the filename is too large */
 446                   error("too many output files or filename is too long (> %d)", NAME_MAX);
 447         free(filename);
 448 }
 449
 450 static int tcpdump_printf(netdissect_options *ndo _U_,
 451                           const char *fmt, ...)
 452 {
 453
 454   va_list args;
 455   int ret;
 456
 457   va_start(args, fmt);
 458   ret=vfprintf(stdout, fmt, args);
 459   va_end(args);
 460
 461   return ret;
 462 }
 463
 464 int
 465 main(int argc, char **argv)
 466 {
 467         register int cnt, op, i;
 468         bpf_u_int32 localnet, netmask;
 469         register char *cp, *infile, *cmdbuf, *device, *RFileName, *WFileName, *WFileNameAlt;
 470         pcap_handler callback;
 471         int type;
 472         struct bpf_program fcode;
 473 #ifndef WIN32
 474         RETSIGTYPE (*oldhandler)(int);
 475 #endif
 476         struct print_info printinfo;
 477         struct dump_info dumpinfo;
 478         u_char *pcap_userdata;
 479         char ebuf[PCAP_ERRBUF_SIZE];
 480         char *username = NULL;
 481         char *chroot_dir = NULL;
 482 #ifdef HAVE_PCAP_FINDALLDEVS
 483         pcap_if_t *devpointer;
 484         int devnum;
 485 #endif
 486         int status;
 487 #ifdef WIN32
 488         u_int UserBufferSize = 1000000;
 489         if(wsockinit() != 0) return 1;
 490 #endif /* WIN32 */
 491
 492         gndo->ndo_Oflag=1;
 493         gndo->ndo_Rflag=1;
 494         gndo->ndo_dlt=-1;
 495         gndo->ndo_default_print=ndo_default_print;
 496         gndo->ndo_printf=tcpdump_printf;
 497         gndo->ndo_error=ndo_error;
 498         gndo->ndo_warning=ndo_warning;
 499         gndo->ndo_snaplen = DEFAULT_SNAPLEN;
 500
 501         cnt = -1;
 502         device = NULL;
 503         infile = NULL;
 504         RFileName = NULL;
 505         WFileName = NULL;
 506         if ((cp = strrchr(argv[0], '/')) != NULL)
 507                 program_name = cp + 1;
 508         else
 509                 program_name = argv[0];
 510
 511         if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0)
 512                 error("%s", ebuf);
 513
 514 #ifdef LIBSMI
 515         smiInit("tcpdump");
 516 #endif
 517
 518         opterr = 0;
 519         while (
 520             (op = getopt(argc, argv, "aA" B_FLAG "c:C:d" D_FLAG "eE:fF:G:i:lLm:M:nNOpqr:Rs:StT:u" U_FLAG "vw:W:xXy:YZ:")) != -1)
 521                 switch (op) {
 522
 523                 case 'a':
 524                         /* compatibility for old -a */
 525                         break;
 526
 527                 case 'A':
 528                         ++Aflag;
 529                         break;
 530
 531 #ifdef WIN32
 532                 case 'B':
 533                         UserBufferSize = atoi(optarg)*1024;
 534                         if (UserBufferSize < 0)
 535                                 error("invalid packet buffer size %s", optarg);
 536                         break;
 537 #endif /* WIN32 */
 538
 539                 case 'c':
 540                         cnt = atoi(optarg);
 541                         if (cnt <= 0)
 542                                 error("invalid packet count %s", optarg);
 543                         break;
 544
 545                 case 'C':
 546                         Cflag = atoi(optarg) * 1000000;
 547                         if (Cflag < 0)
 548                                 error("invalid file size %s", optarg);
 549                         break;
 550
 551                 case 'd':
 552                         ++dflag;
 553                         break;
 554
 555 #ifdef HAVE_PCAP_FINDALLDEVS
 556                 case 'D':
 557                         if (pcap_findalldevs(&devpointer, ebuf) < 0)
 558                                 error("%s", ebuf);
 559                         else {
 560                                 for (i = 0; devpointer != 0; i++) {
 561                                         printf("%d.%s", i+1, devpointer->name);
 562                                         if (devpointer->description != NULL)
 563                                                 printf(" (%s)", devpointer->description);
 564                                         printf("\n");
 565                                         devpointer = devpointer->next;
 566                                 }
 567                         }
 568                         return 0;
 569 #endif /* HAVE_PCAP_FINDALLDEVS */
 570
 571                 case 'L':
 572                         Lflag++;
 573                         break;
 574
 575                 case 'e':
 576                         ++eflag;
 577                         break;
 578
 579                 case 'E':
 580 #ifndef HAVE_LIBCRYPTO
 581                         warning("crypto code not compiled in");
 582 #endif
 583                         gndo->ndo_espsecret = optarg;
 584                         break;
 585
 586                 case 'f':
 587                         ++fflag;
 588                         break;
 589
 590                 case 'F':
 591                         infile = optarg;
 592                         break;
 593
 594                 case 'G':
 595                         Gflag = atoi(optarg);
 596                         if (Gflag < 0)
 597                                 error("invalid number of seconds %s", optarg);
 598
 599                         /* We will create one file initially. */
 600                         Gflag_count = 0;
 601
 602                         /* Grab the current time for rotation use. */
 603                         if ((Gflag_time = time(NULL)) == (time_t)-1) {
 604                                 error("main: can't get current time: %s",
 605                                     pcap_strerror(errno));
 606                         }
 607                         break;
 608
 609                 case 'i':
 610                         if (optarg[0] == '0' && optarg[1] == 0)
 611                                 error("Invalid adapter index");
 612
 613 #ifdef HAVE_PCAP_FINDALLDEVS
 614                         /*
 615                          * If the argument is a number, treat it as
 616                          * an index into the list of adapters, as
 617                          * printed by "tcpdump -D".
 618                          *
 619                          * This should be OK on UNIX systems, as interfaces
 620                          * shouldn't have names that begin with digits.
 621                          * It can be useful on Windows, where more than
 622                          * one interface can have the same name.
 623                          */
 624                         if ((devnum = atoi(optarg)) != 0) {
 625                                 if (devnum < 0)
 626                                         error("Invalid adapter index");
 627
 628                                 if (pcap_findalldevs(&devpointer, ebuf) < 0)
 629                                         error("%s", ebuf);
 630                                 else {
 631                                         for (i = 0; i < devnum-1; i++){
 632                                                 devpointer = devpointer->next;
 633                                                 if (devpointer == NULL)
 634                                                         error("Invalid adapter index");
 635                                         }
 636                                 }
 637                                 device = devpointer->name;
 638                                 break;
 639                         }
 640 #endif /* HAVE_PCAP_FINDALLDEVS */
 641                         device = optarg;
 642                         break;
 643
 644                 case 'l':
 645 #ifdef WIN32
 646                         /*
 647                          * _IOLBF is the same as _IOFBF in Microsoft's C
 648                          * libraries; the only alternative they offer
 649                          * is _IONBF.
 650                          *
 651                          * XXX - this should really be checking for MSVC++,
 652                          * not WIN32, if, for example, MinGW has its own
 653                          * C library that is more UNIX-compatible.
 654                          */
 655                         setvbuf(stdout, NULL, _IONBF, 0);
 656 #else /* WIN32 */
 657 #ifdef HAVE_SETLINEBUF
 658                         setlinebuf(stdout);
 659 #else
 660                         setvbuf(stdout, NULL, _IOLBF, 0);
 661 #endif
 662 #endif /* WIN32 */
 663                         break;
 664
 665                 case 'n':
 666                         ++nflag;
 667                         break;
 668
 669                 case 'N':
 670                         ++Nflag;
 671                         break;
 672
 673                 case 'm':
 674 #ifdef LIBSMI
 675                         if (smiLoadModule(optarg) == 0) {
 676                                 error("could not load MIB module %s", optarg);
 677                         }
 678                         sflag = 1;
 679 #else
 680                         (void)fprintf(stderr, "%s: ignoring option `-m %s' ",
 681                                       program_name, optarg);
 682                         (void)fprintf(stderr, "(no libsmi support)\n");
 683 #endif
 684                         break;
 685
 686                 case 'M':
 687                         /* TCP-MD5 shared secret */
 688 #ifndef HAVE_LIBCRYPTO
 689                         warning("crypto code not compiled in");
 690 #endif
 691                         tcpmd5secret = optarg;
 692                         break;
 693
 694                 case 'O':
 695                         Oflag = 0;
 696                         break;
 697
 698                 case 'p':
 699                         ++pflag;
 700                         break;
 701
 702                 case 'q':
 703                         ++qflag;
 704                         ++suppress_default_print;
 705                         break;
 706
 707                 case 'r':
 708                         RFileName = optarg;
 709                         break;
 710
 711                 case 'R':
 712                         Rflag = 0;
 713                         break;
 714
 715                 case 's': {
 716                         char *end;
 717
 718                         snaplen = strtol(optarg, &end, 0);
 719                         if (optarg == end || *end != '\0'
 720                             || snaplen < 0 || snaplen > 65535)
 721                                 error("invalid snaplen %s", optarg);
 722                         else if (snaplen == 0)
 723                                 snaplen = 65535;
 724                         break;
 725                 }
 726
 727                 case 'S':
 728                         ++Sflag;
 729                         break;
 730
 731                 case 't':
 732                         ++tflag;
 733                         break;
 734
 735                 case 'T':
 736                         if (strcasecmp(optarg, "vat") == 0)
 737                                 packettype = PT_VAT;
 738                         else if (strcasecmp(optarg, "wb") == 0)
 739                                 packettype = PT_WB;
 740                         else if (strcasecmp(optarg, "rpc") == 0)
 741                                 packettype = PT_RPC;
 742                         else if (strcasecmp(optarg, "rtp") == 0)
 743                                 packettype = PT_RTP;
 744                         else if (strcasecmp(optarg, "rtcp") == 0)
 745                                 packettype = PT_RTCP;
 746                         else if (strcasecmp(optarg, "snmp") == 0)
 747                                 packettype = PT_SNMP;
 748                         else if (strcasecmp(optarg, "cnfp") == 0)
 749                                 packettype = PT_CNFP;
 750                         else if (strcasecmp(optarg, "tftp") == 0)
 751                                 packettype = PT_TFTP;
 752                         else if (strcasecmp(optarg, "aodv") == 0)
 753                                 packettype = PT_AODV;
 754                         else
 755                                 error("unknown packet type `%s'", optarg);
 756                         break;
 757
 758                 case 'u':
 759                         ++uflag;
 760                         break;
 761
 762 #ifdef HAVE_PCAP_DUMP_FLUSH
 763                 case 'U':
 764                         ++Uflag;
 765                         break;
 766 #endif
 767
 768                 case 'v':
 769                         ++vflag;
 770                         break;
 771
 772                 case 'w':
 773                         WFileName = optarg;
 774                         break;
 775
 776                 case 'W':
 777                         Wflag = atoi(optarg);
 778                         if (Wflag < 0)
 779                                 error("invalid number of output files %s", optarg);
 780                         WflagChars = getWflagChars(Wflag);
 781                         break;
 782
 783                 case 'x':
 784                         ++xflag;
 785                         ++suppress_default_print;
 786                         break;
 787
 788                 case 'X':
 789                         ++Xflag;
 790                         ++suppress_default_print;
 791                         break;
 792
 793                 case 'y':
 794                         gndo->ndo_dltname = optarg;
 795                         gndo->ndo_dlt =
 796                           pcap_datalink_name_to_val(gndo->ndo_dltname);
 797                         if (gndo->ndo_dlt < 0)
 798                                 error("invalid data link type %s", gndo->ndo_dltname);
 799                         break;
 800
 801 #if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG)
 802                 case 'Y':
 803                         {
 804                         /* Undocumented flag */
 805 #ifdef HAVE_PCAP_DEBUG
 806                         extern int pcap_debug;
 807                         pcap_debug = 1;
 808 #else
 809                         extern int yydebug;
 810                         yydebug = 1;
 811 #endif
 812                         }
 813                         break;
 814 #endif
 815                 case 'Z':
 816                         if (optarg) {
 817                                 username = strdup(optarg);
 818                         }
 819                         else {
 820                                 usage();
 821                                 /* NOTREACHED */
 822                         }
 823                         break;
 824
 825                 default:
 826                         usage();
 827                         /* NOTREACHED */
 828                 }
 829
 830         switch (tflag) {
 831
 832         case 0: /* Default */
 833         case 4: /* Default + Date*/
 834                 thiszone = gmt2local(0);
 835                 break;
 836
 837         case 1: /* No time stamp */
 838         case 2: /* Unix timeval style */
 839         case 3: /* Microseconds since previous packet */
 840         case 5: /* Microseconds since first packet */
 841                 break;
 842
 843         default: /* Not supported */
 844                 error("only -t, -tt, -ttt, -tttt and -ttttt are supported");
 845                 break;
 846         }
 847
 848 #ifdef WITH_CHROOT
 849         /* if run as root, prepare for chrooting */
 850         if (getuid() == 0 || geteuid() == 0) {
 851                 /* future extensibility for cmd-line arguments */
 852                 if (!chroot_dir)
 853                         chroot_dir = WITH_CHROOT;
 854         }
 855 #endif
 856
 857 #ifdef WITH_USER
 858         /* if run as root, prepare for dropping root privileges */
 859         if (getuid() == 0 || geteuid() == 0) {
 860                 /* Run with '-Z root' to restore old behaviour */
 861                 if (!username)
 862                         username = WITH_USER;
 863         }
 864 #endif
 865
 866         if (RFileName != NULL) {
 867                 int dlt;
 868                 const char *dlt_name;
 869
 870 #ifndef WIN32
 871                 /*
 872                  * We don't need network access, so relinquish any set-UID
 873                  * or set-GID privileges we have (if any).
 874                  *
 875                  * We do *not* want set-UID privileges when opening a
 876                  * trace file, as that might let the user read other
 877                  * people's trace files (especially if we're set-UID
 878                  * root).
 879                  */
 880                 if (setgid(getgid()) != 0 || setuid(getuid()) != 0 )
 881                         fprintf(stderr, "Warning: setgid/setuid failed !\n");
 882 #endif /* WIN32 */
 883                 pd = pcap_open_offline(RFileName, ebuf);
 884                 if (pd == NULL)
 885                         error("%s", ebuf);
 886                 dlt = pcap_datalink(pd);
 887                 dlt_name = pcap_datalink_val_to_name(dlt);
 888                 if (dlt_name == NULL) {
 889                         fprintf(stderr, "reading from file %s, link-type %u\n",
 890                             RFileName, dlt);
 891                 } else {
 892                         fprintf(stderr,
 893                             "reading from file %s, link-type %s (%s)\n",
 894                             RFileName, dlt_name,
 895                             pcap_datalink_val_to_description(dlt));
 896                 }
 897                 localnet = 0;
 898                 netmask = 0;
 899                 if (fflag != 0)
 900                         error("-f and -r options are incompatible");
 901         } else {
 902                 if (device == NULL) {
 903                         device = pcap_lookupdev(ebuf);
 904                         if (device == NULL)
 905                                 error("%s", ebuf);
 906                 }
 907 #ifdef WIN32
 908                 if(strlen(device) == 1) //we assume that an ASCII string is always longer than 1 char
 909                 {                                               //a Unicode string has a \0 as second byte (so strlen() is 1)
 910                         fprintf(stderr, "%s: listening on %ws\n", program_name, device);
 911                 }
 912                 else
 913                 {
 914                         fprintf(stderr, "%s: listening on %s\n", program_name, device);
 915                 }
 916
 917                 fflush(stderr);
 918 #endif /* WIN32 */
 919                 *ebuf = '\0';
 920                 pd = pcap_open_live(device, snaplen, !pflag, 1000, ebuf);
 921                 if (pd == NULL)
 922                         error("%s", ebuf);
 923                 else if (*ebuf)
 924                         warning("%s", ebuf);
 925                 /*
 926                  * Let user own process after socket has been opened.
 927                  */
 928 #ifndef WIN32
 929                 if (setgid(getgid()) != 0 || setuid(getuid()) != 0)
 930                         fprintf(stderr, "Warning: setgid/setuid failed !\n");
 931 #endif /* WIN32 */
 932 #ifdef WIN32
 933                 if(UserBufferSize != 1000000)
 934                         if(pcap_setbuff(pd, UserBufferSize)==-1){
 935                                 error("%s", pcap_geterr(pd));
 936                         }
 937 #endif /* WIN32 */
 938                 if (Lflag)
 939                         show_dlts_and_exit(pd);
 940                 if (gndo->ndo_dlt >= 0) {
 941 #ifdef HAVE_PCAP_SET_DATALINK
 942                         if (pcap_set_datalink(pd, gndo->ndo_dlt) < 0)
 943                                 error("%s", pcap_geterr(pd));
 944 #else
 945                         /*
 946                          * We don't actually support changing the
 947                          * data link type, so we only let them
 948                          * set it to what it already is.
 949                          */
 950                         if (gndo->ndo_dlt != pcap_datalink(pd)) {
 951                                 error("%s is not one of the DLTs supported by this device\n",
 952                                       gndo->ndo_dltname);
 953                         }
 954 #endif
 955                         (void)fprintf(stderr, "%s: data link type %s\n",
 956                                       program_name, gndo->ndo_dltname);
 957                         (void)fflush(stderr);
 958                 }
 959                 i = pcap_snapshot(pd);
 960                 if (snaplen < i) {
 961                         warning("snaplen raised from %d to %d", snaplen, i);
 962                         snaplen = i;
 963                 }
 964                 if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) {
 965                         localnet = 0;
 966                         netmask = 0;
 967                         warning("%s", ebuf);
 968                 }
 969         }
 970         if (infile)
 971                 cmdbuf = read_infile(infile);
 972         else
 973                 cmdbuf = copy_argv(&argv[optind]);
 974
 975         if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
 976                 error("%s", pcap_geterr(pd));
 977         if (dflag) {
 978                 bpf_dump(&fcode, dflag);
 979                 pcap_close(pd);
 980                 exit(0);
 981         }
 982         init_addrtoname(localnet, netmask);
 983
 984 #ifndef WIN32
 985         (void)setsignal(SIGPIPE, cleanup);
 986 #endif /* WIN32 */
 987         (void)setsignal(SIGTERM, cleanup);
 988         (void)setsignal(SIGINT, cleanup);
 989         /* Cooperate with nohup(1) */
 990 #ifndef WIN32
 991         if ((oldhandler = setsignal(SIGHUP, cleanup)) != SIG_DFL)
 992                 (void)setsignal(SIGHUP, oldhandler);
 993 #endif /* WIN32 */
 994
 995         if (pcap_setfilter(pd, &fcode) < 0)
 996                 error("%s", pcap_geterr(pd));
 997         if (WFileName) {
 998                 pcap_dumper_t *p;
 999                 /* Do not exceed the default NAME_MAX for files. */
1000                 WFileNameAlt = (char *)malloc(NAME_MAX + 1);
1001
1002                 if (WFileNameAlt == NULL)
1003                         error("malloc of WFileNameAlt");
1004
1005                 /* We do not need numbering for dumpfiles if Cflag isn't set. */
1006                 if (Cflag != 0)
1007                   MakeFilename(WFileNameAlt, WFileName, 0, WflagChars);
1008                 else
1009                   MakeFilename(WFileNameAlt, WFileName, 0, 0);
1010
1011                 p = pcap_dump_open(pd, WFileNameAlt);
1012                 free(WFileNameAlt);
1013                 if (p == NULL)
1014                         error("%s", pcap_geterr(pd));
1015                 if (Cflag != 0 || Gflag != 0) {
1016                         callback = dump_packet_and_trunc;
1017                         dumpinfo.WFileName = WFileName;
1018                         dumpinfo.pd = pd;
1019                         dumpinfo.p = p;
1020                         pcap_userdata = (u_char *)&dumpinfo;
1021                 } else {
1022                         callback = dump_packet;
1023                         pcap_userdata = (u_char *)p;
1024                 }
1025         } else {
1026                 type = pcap_datalink(pd);
1027                 printinfo.printer = lookup_printer(type);
1028                 if (printinfo.printer == NULL) {
1029                         gndo->ndo_dltname = pcap_datalink_val_to_name(type);
1030                         if (gndo->ndo_dltname != NULL)
1031                                 error("unsupported data link type %s",
1032                                       gndo->ndo_dltname);
1033                         else
1034                                 error("unsupported data link type %d", type);
1035                 }
1036                 callback = print_packet;
1037                 pcap_userdata = (u_char *)&printinfo;
1038         }
1039 #ifndef WIN32
1040         /*
1041          * We cannot do this earlier, because we want to be able to open
1042          * the file (if done) for writing before giving up permissions.
1043          */
1044         if (getuid() == 0 || geteuid() == 0) {
1045                 if (username || chroot_dir)
1046                         droproot(username, chroot_dir);
1047         }
1048 #endif /* WIN32 */
1049 #ifdef SIGINFO
1050         (void)setsignal(SIGINFO, requestinfo);
1051 #endif
1052
1053         if (vflag > 0 && WFileName) {
1054                 /*
1055                  * When capturing to a file, "-v" means tcpdump should,
1056                  * every 10 secodns, "v"erbosely report the number of
1057                  * packets captured.
1058                  */
1059 #ifdef USE_WIN32_MM_TIMER
1060                 /* call verbose_stats_dump() each 1000 +/-100msec */
1061                 timer_id = timeSetEvent(1000, 100, verbose_stats_dump, 0, TIME_PERIODIC);
1062                 setvbuf(stderr, NULL, _IONBF, 0);
1063 #elif defined(HAVE_ALARM)
1064                 (void)setsignal(SIGALRM, verbose_stats_dump);
1065                 alarm(1);
1066 #endif
1067         }
1068
1069 #ifndef WIN32
1070         if (RFileName == NULL) {
1071                 int dlt;
1072                 const char *dlt_name;
1073
1074                 if (!vflag && !WFileName) {
1075                         (void)fprintf(stderr,
1076                             "%s: verbose output suppressed, use -v or -vv for full protocol decode\n",
1077                             program_name);
1078                 } else
1079                         (void)fprintf(stderr, "%s: ", program_name);
1080                 dlt = pcap_datalink(pd);
1081                 dlt_name = pcap_datalink_val_to_name(dlt);
1082                 if (dlt_name == NULL) {
1083                         (void)fprintf(stderr, "listening on %s, link-type %u, capture size %u bytes\n",
1084                             device, dlt, snaplen);
1085                 } else {
1086                         (void)fprintf(stderr, "listening on %s, link-type %s (%s), capture size %u bytes\n",
1087                             device, dlt_name,
1088                             pcap_datalink_val_to_description(dlt), snaplen);
1089                 }
1090                 (void)fflush(stderr);
1091         }
1092 #endif /* WIN32 */
1093         status = pcap_loop(pd, cnt, callback, pcap_userdata);
1094         if (WFileName == NULL) {
1095                 /*
1096                  * We're printing packets.  Flush the printed output,
1097                  * so it doesn't get intermingled with error output.
1098                  */
1099                 if (status == -2) {
1100                         /*
1101                          * We got interrupted, so perhaps we didn't
1102                          * manage to finish a line we were printing.
1103                          * Print an extra newline, just in case.
1104                          */
1105                         putchar('\n');
1106                 }
1107                 (void)fflush(stdout);
1108         }
1109         if (status == -1) {
1110                 /*
1111                  * Error.  Report it.
1112                  */
1113                 (void)fprintf(stderr, "%s: pcap_loop: %s\n",
1114                     program_name, pcap_geterr(pd));
1115         }
1116         if (RFileName == NULL) {
1117                 /*
1118                  * We're doing a live capture.  Report the capture
1119                  * statistics.
1120                  */
1121                 info(1);
1122         }
1123         pcap_close(pd);
1124         exit(status == -1 ? 1 : 0);
1125 }
1126
1127 /* make a clean exit on interrupts */
1128 static RETSIGTYPE
1129 cleanup(int signo _U_)
1130 {
1131 #ifdef USE_WIN32_MM_TIMER
1132         if (timer_id)
1133                 timeKillEvent(timer_id);
1134         timer_id = 0;
1135 #elif defined(HAVE_ALARM)
1136         alarm(0);
1137 #endif
1138
1139 #ifdef HAVE_PCAP_BREAKLOOP
1140         /*
1141          * We have "pcap_breakloop()"; use it, so that we do as little
1142          * as possible in the signal handler (it's probably not safe
1143          * to do anything with standard I/O streams in a signal handler -
1144          * the ANSI C standard doesn't say it is).
1145          */
1146         pcap_breakloop(pd);
1147 #else
1148         /*
1149          * We don't have "pcap_breakloop()"; this isn't safe, but
1150          * it's the best we can do.  Print the summary if we're
1151          * not reading from a savefile - i.e., if we're doing a
1152          * live capture - and exit.
1153          */
1154         if (pd != NULL && pcap_file(pd) == NULL) {
1155                 /*
1156                  * We got interrupted, so perhaps we didn't
1157                  * manage to finish a line we were printing.
1158                  * Print an extra newline, just in case.
1159                  */
1160                 putchar('\n');
1161                 (void)fflush(stdout);
1162                 info(1);
1163         }
1164         exit(0);
1165 #endif
1166 }
1167
1168 static void
1169 info(register int verbose)
1170 {
1171         struct pcap_stat stat;
1172
1173         if (pcap_stats(pd, &stat) < 0) {
1174                 (void)fprintf(stderr, "pcap_stats: %s\n", pcap_geterr(pd));
1175                 return;
1176         }
1177
1178         if (!verbose)
1179                 fprintf(stderr, "%s: ", program_name);
1180
1181         (void)fprintf(stderr, "%u packets captured", packets_captured);
1182         if (!verbose)
1183                 fputs(", ", stderr);
1184         else
1185                 putc('\n', stderr);
1186         (void)fprintf(stderr, "%d packets received by filter", stat.ps_recv);
1187         if (!verbose)
1188                 fputs(", ", stderr);
1189         else
1190                 putc('\n', stderr);
1191         (void)fprintf(stderr, "%d packets dropped by kernel\n", stat.ps_drop);
1192         infoprint = 0;
1193 }
1194
1195 static void
1196 dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
1197 {
1198         struct dump_info *dump_info;
1199         char *name;
1200
1201         ++packets_captured;
1202
1203         ++infodelay;
1204
1205         dump_info = (struct dump_info *)user;
1206
1207         /*
1208          * XXX - this won't force the file to rotate on the specified time
1209          * boundary, but it will rotate on the first packet received after the
1210          * specified Gflag number of seconds. Note: if a Gflag time boundary
1211          * and a Cflag size boundary coincide, the time rotation will occur
1212          * first thereby cancelling the Cflag boundary (since the file should
1213          * be 0).
1214          */
1215         if (Gflag != 0) {
1216                 /* Check if it is time to rotate */
1217                 time_t t;
1218
1219                 /* Get the current time */
1220                 if ((t = time(NULL)) == (time_t)-1) {
1221                         error("dump_and_trunc_packet: can't get current_time: %s",
1222                             pcap_strerror(errno));
1223                 }
1224
1225
1226                 /* If the time is greater than the specified window, rotate */
1227                 if (t - Gflag_time >= Gflag) {
1228                         /* Update the Gflag_time */
1229                         Gflag_time = t;
1230                         /* Update Gflag_count */
1231                         Gflag_count++;
1232                         /*
1233                          * Close the current file and open a new one.
1234                          */
1235                         pcap_dump_close(dump_info->p);
1236
1237                         /*
1238                          * Check to see if we've exceeded the Wflag (when
1239                          * not using Cflag).
1240                          */
1241                         if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) {
1242                                 (void)fprintf(stderr, "Maximum file limit reached: %d\n",
1243                                     Wflag);
1244                                 exit(0);
1245                                 /* NOTREACHED */
1246                         }
1247                         /* Allocate space for max filename + \0. */
1248                         name = (char *)malloc(NAME_MAX + 1);
1249                         if (name == NULL)
1250                                 error("dump_packet_and_trunc: malloc");
1251                         /*
1252                          * This is always the first file in the Cflag
1253                          * rotation: e.g. 0
1254                          * We also don't need numbering if Cflag is not set.
1255                          */
1256                         if (Cflag != 0)
1257                                 MakeFilename(name, dump_info->WFileName, 0,
1258                                     WflagChars);
1259                         else
1260                                 MakeFilename(name, dump_info->WFileName, 0, 0);
1261
1262                         dump_info->p = pcap_dump_open(dump_info->pd, name);
1263                         free(name);
1264                         if (dump_info->p == NULL)
1265                                 error("%s", pcap_geterr(pd));
1266                 }
1267         }
1268
1269         /*
1270          * XXX - this won't prevent capture files from getting
1271          * larger than Cflag - the last packet written to the
1272          * file could put it over Cflag.
1273          */
1274         if (Cflag != 0 && pcap_dump_ftell(dump_info->p) > Cflag) {
1275                 /*
1276                  * Close the current file and open a new one.
1277                  */
1278                 pcap_dump_close(dump_info->p);
1279                 Cflag_count++;
1280                 if (Wflag > 0) {
1281                         if (Cflag_count >= Wflag)
1282                                 Cflag_count = 0;
1283                 }
1284                 name = (char *)malloc(NAME_MAX + 1);
1285                 if (name == NULL)
1286                         error("dump_packet_and_trunc: malloc");
1287                 MakeFilename(name, dump_info->WFileName, Cflag_count, WflagChars);
1288                 dump_info->p = pcap_dump_open(dump_info->pd, name);
1289                 free(name);
1290                 if (dump_info->p == NULL)
1291                         error("%s", pcap_geterr(pd));
1292         }
1293
1294         pcap_dump((u_char *)dump_info->p, h, sp);
1295 #ifdef HAVE_PCAP_DUMP_FLUSH
1296         if (Uflag)
1297                 pcap_dump_flush(dump_info->p);
1298 #endif
1299
1300         --infodelay;
1301         if (infoprint)
1302                 info(0);
1303 }
1304
1305 static void
1306 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
1307 {
1308         ++packets_captured;
1309
1310         ++infodelay;
1311
1312         pcap_dump(user, h, sp);
1313 #ifdef HAVE_PCAP_DUMP_FLUSH
1314         if (Uflag)
1315                 pcap_dump_flush((pcap_dumper_t *)user);
1316 #endif
1317
1318         --infodelay;
1319         if (infoprint)
1320                 info(0);
1321 }
1322
1323 static void
1324 print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
1325 {
1326         struct print_info *print_info;
1327         u_int hdrlen;
1328
1329         ++packets_captured;
1330
1331         ++infodelay;
1332         ts_print(&h->ts);
1333
1334         print_info = (struct print_info *)user;
1335
1336         /*
1337          * Some printers want to check that they're not walking off the
1338          * end of the packet.
1339          * Rather than pass it all the way down, we set this global.
1340          */
1341         snapend = sp + h->caplen;
1342
1343         hdrlen = (*print_info->printer)(h, sp);
1344         if (Xflag) {
1345                 /*
1346                  * Print the raw packet data in hex and ASCII.
1347                  */
1348                 if (Xflag > 1) {
1349                         /*
1350                          * Include the link-layer header.
1351                          */
1352                         hex_and_ascii_print("\n\t", sp, h->caplen);
1353                 } else {
1354                         /*
1355                          * Don't include the link-layer header - and if
1356                          * we have nothing past the link-layer header,
1357                          * print nothing.
1358                          */
1359                         if (h->caplen > hdrlen)
1360                                 hex_and_ascii_print("\n\t", sp + hdrlen,
1361                                     h->caplen - hdrlen);
1362                 }
1363         } else if (xflag) {
1364                 /*
1365                  * Print the raw packet data in hex.
1366                  */
1367                 if (xflag > 1) {
1368                         /*
1369                          * Include the link-layer header.
1370                          */
1371                         hex_print("\n\t", sp, h->caplen);
1372                 } else {
1373                         /*
1374                          * Don't include the link-layer header - and if
1375                          * we have nothing past the link-layer header,
1376                          * print nothing.
1377                          */
1378                         if (h->caplen > hdrlen)
1379                                 hex_print("\n\t", sp + hdrlen,
1380                                     h->caplen - hdrlen);
1381                 }
1382         } else if (Aflag) {
1383                 /*
1384                  * Print the raw packet data in ASCII.
1385                  */
1386                 if (Aflag > 1) {
1387                         /*
1388                          * Include the link-layer header.
1389                          */
1390                         ascii_print(sp, h->caplen);
1391                 } else {
1392                         /*
1393                          * Don't include the link-layer header - and if
1394                          * we have nothing past the link-layer header,
1395                          * print nothing.
1396                          */
1397                         if (h->caplen > hdrlen)
1398                                 ascii_print(sp + hdrlen, h->caplen - hdrlen);
1399                 }
1400         }
1401
1402         putchar('\n');
1403
1404         --infodelay;
1405         if (infoprint)
1406                 info(0);
1407 }
1408
1409 #ifdef WIN32
1410         /*
1411          * XXX - there should really be libpcap calls to get the version
1412          * number as a string (the string would be generated from #defines
1413          * at run time, so that it's not generated from string constants
1414          * in the library, as, on many UNIX systems, those constants would
1415          * be statically linked into the application executable image, and
1416          * would thus reflect the version of libpcap on the system on
1417          * which the application was *linked*, not the system on which it's
1418          * *running*.
1419          *
1420          * That routine should be documented, unlike the "version[]"
1421          * string, so that UNIX vendors providing their own libpcaps
1422          * don't omit it (as a couple of vendors have...).
1423          *
1424          * Packet.dll should perhaps also export a routine to return the
1425          * version number of the Packet.dll code, to supply the
1426          * "Wpcap_version" information on Windows.
1427          */
1428         char WDversion[]="current-cvs.tcpdump.org";
1429 #if !defined(HAVE_GENERATED_VERSION)
1430         char version[]="current-cvs.tcpdump.org";
1431 #endif
1432         char pcap_version[]="current-cvs.tcpdump.org";
1433         char Wpcap_version[]="3.1";
1434 #endif
1435
1436 /*
1437  * By default, print the specified data out in hex and ASCII.
1438  */
1439 static void
1440 ndo_default_print(netdissect_options *ndo _U_, const u_char *bp, u_int length)
1441 {
1442         hex_and_ascii_print("\n\t", bp, length); /* pass on lf and identation string */
1443 }
1444
1445 void
1446 default_print(const u_char *bp, u_int length)
1447 {
1448         ndo_default_print(gndo, bp, length);
1449 }
1450
1451 #ifdef SIGINFO
1452 RETSIGTYPE requestinfo(int signo _U_)
1453 {
1454         if (infodelay)
1455                 ++infoprint;
1456         else
1457                 info(0);
1458 }
1459 #endif
1460
1461 /*
1462  * Called once each second in verbose mode while dumping to file
1463  */
1464 #ifdef USE_WIN32_MM_TIMER
1465 void CALLBACK verbose_stats_dump (UINT timer_id _U_, UINT msg _U_, DWORD_PTR arg _U_,
1466                                   DWORD_PTR dw1 _U_, DWORD_PTR dw2 _U_)
1467 {
1468         struct pcap_stat stat;
1469
1470         if (infodelay == 0 && pcap_stats(pd, &stat) >= 0)
1471                 fprintf(stderr, "Got %u\r", packets_captured);
1472 }
1473 #elif defined(HAVE_ALARM)
1474 static void verbose_stats_dump(int sig _U_)
1475 {
1476         struct pcap_stat stat;
1477
1478         if (infodelay == 0 && pcap_stats(pd, &stat) >= 0)
1479                 fprintf(stderr, "Got %u\r", packets_captured);
1480         alarm(1);
1481 }
1482 #endif
1483
1484 static void
1485 usage(void)
1486 {
1487         extern char version[];
1488 #ifndef HAVE_PCAP_LIB_VERSION
1489 #if defined(WIN32) || defined(HAVE_PCAP_VERSION)
1490         extern char pcap_version[];
1491 #else /* defined(WIN32) || defined(HAVE_PCAP_VERSION) */
1492         static char pcap_version[] = "unknown";
1493 #endif /* defined(WIN32) || defined(HAVE_PCAP_VERSION) */
1494 #endif /* HAVE_PCAP_LIB_VERSION */
1495
1496 #ifdef HAVE_PCAP_LIB_VERSION
1497 #ifdef WIN32
1498         (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version);
1499 #else /* WIN32 */
1500         (void)fprintf(stderr, "%s version %s\n", program_name, version);
1501 #endif /* WIN32 */
1502         (void)fprintf(stderr, "%s\n",pcap_lib_version());
1503 #else /* HAVE_PCAP_LIB_VERSION */
1504 #ifdef WIN32
1505         (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version);
1506         (void)fprintf(stderr, "WinPcap version %s, based on libpcap version %s\n",Wpcap_version, pcap_version);
1507 #else /* WIN32 */
1508         (void)fprintf(stderr, "%s version %s\n", program_name, version);
1509         (void)fprintf(stderr, "libpcap version %s\n", pcap_version);
1510 #endif /* WIN32 */
1511 #endif /* HAVE_PCAP_LIB_VERSION */
1512         (void)fprintf(stderr,
1513 "Usage: %s [-aAd" D_FLAG "eflLnNOpqRStu" U_FLAG "vxX]" B_FLAG_USAGE " [-c count] [ -C file_size ]\n", program_name);
1514         (void)fprintf(stderr,
1515 "\t\t[ -E algo:secret ] [ -F file ] [ -G seconds ] [ -i interface ]\n");
1516         (void)fprintf(stderr,
1517 "\t\t[ -M secret ] [ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]\n");
1518         (void)fprintf(stderr,
1519 "\t\t[ -W filecount ] [ -y datalinktype ] [ -Z user ]\n");
1520         (void)fprintf(stderr,
1521 "\t\t[ expression ]\n");
1522         exit(1);
1523 }
1524
1525
1526
1527 /* VARARGS */
1528 static void
1529 ndo_error(netdissect_options *ndo _U_, const char *fmt, ...)
1530 {
1531         va_list ap;
1532
1533         (void)fprintf(stderr, "%s: ", program_name);
1534         va_start(ap, fmt);
1535         (void)vfprintf(stderr, fmt, ap);
1536         va_end(ap);
1537         if (*fmt) {
1538                 fmt += strlen(fmt);
1539                 if (fmt[-1] != '\n')
1540                         (void)fputc('\n', stderr);
1541         }
1542         exit(1);
1543         /* NOTREACHED */
1544 }
1545
1546 /* VARARGS */
1547 static void
1548 ndo_warning(netdissect_options *ndo _U_, const char *fmt, ...)
1549 {
1550         va_list ap;
1551
1552         (void)fprintf(stderr, "%s: WARNING: ", program_name);
1553         va_start(ap, fmt);
1554         (void)vfprintf(stderr, fmt, ap);
1555         va_end(ap);
1556         if (*fmt) {
1557                 fmt += strlen(fmt);
1558                 if (fmt[-1] != '\n')
1559                         (void)fputc('\n', stderr);
1560         }
1561 }
1562