+
+ if (!verbose)
+ fprintf(stderr, "%s: ", program_name);
+
+ (void)fprintf(stderr, "%u packet%s captured", packets_captured,
+ PLURAL_SUFFIX(packets_captured));
+ if (!verbose)
+ fputs(", ", stderr);
+ else
+ putc('\n', stderr);
+ (void)fprintf(stderr, "%u packet%s received by filter", stat.ps_recv,
+ PLURAL_SUFFIX(stat.ps_recv));
+ if (!verbose)
+ fputs(", ", stderr);
+ else
+ putc('\n', stderr);
+ (void)fprintf(stderr, "%u packet%s dropped by kernel", stat.ps_drop,
+ PLURAL_SUFFIX(stat.ps_drop));
+ if (stat.ps_ifdrop != 0) {
+ if (!verbose)
+ fputs(", ", stderr);
+ else
+ putc('\n', stderr);
+ (void)fprintf(stderr, "%u packet%s dropped by interface\n",
+ stat.ps_ifdrop, PLURAL_SUFFIX(stat.ps_ifdrop));
+ } else
+ putc('\n', stderr);
+ infoprint = 0;
+}
+
+#if defined(HAVE_FORK) || defined(HAVE_VFORK)
+static void
+compress_savefile(const char *filename)
+{
+# ifdef HAVE_FORK
+ if (fork())
+# else
+ if (vfork())
+# endif
+ return;
+ /*
+ * Set to lowest priority so that this doesn't disturb the capture
+ */
+#ifdef NZERO
+ setpriority(PRIO_PROCESS, 0, NZERO - 1);
+#else
+ setpriority(PRIO_PROCESS, 0, 19);
+#endif
+ if (execlp(zflag, zflag, filename, (char *)NULL) == -1)
+ fprintf(stderr,
+ "compress_savefile:execlp(%s, %s): %s\n",
+ zflag,
+ filename,
+ strerror(errno));
+# ifdef HAVE_FORK
+ exit(1);
+# else
+ _exit(1);
+# endif
+}
+#else /* HAVE_FORK && HAVE_VFORK */
+static void
+compress_savefile(const char *filename)
+{
+ fprintf(stderr,
+ "compress_savefile failed. Functionality not implemented under your system\n");
+}
+#endif /* HAVE_FORK && HAVE_VFORK */
+
+static void
+dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
+{
+ struct dump_info *dump_info;
+
+ ++packets_captured;
+
+ ++infodelay;
+
+ dump_info = (struct dump_info *)user;
+
+ /*
+ * XXX - this won't force the file to rotate on the specified time
+ * boundary, but it will rotate on the first packet received after the
+ * specified Gflag number of seconds. Note: if a Gflag time boundary
+ * and a Cflag size boundary coincide, the time rotation will occur
+ * first thereby cancelling the Cflag boundary (since the file should
+ * be 0).
+ */
+ if (Gflag != 0) {
+ /* Check if it is time to rotate */
+ time_t t;
+
+ /* Get the current time */
+ if ((t = time(NULL)) == (time_t)-1) {
+ error("dump_and_trunc_packet: can't get current_time: %s",
+ pcap_strerror(errno));
+ }
+
+
+ /* If the time is greater than the specified window, rotate */
+ if (t - Gflag_time >= Gflag) {
+ /* Update the Gflag_time */
+ Gflag_time = t;
+ /* Update Gflag_count */
+ Gflag_count++;
+ /*
+ * Close the current file and open a new one.
+ */
+ pcap_dump_close(dump_info->p);
+
+ /*
+ * Compress the file we just closed, if the user asked for it
+ */
+ if (zflag != NULL)
+ compress_savefile(dump_info->CurrentFileName);
+
+ /*
+ * Check to see if we've exceeded the Wflag (when
+ * not using Cflag).
+ */
+ if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) {
+ (void)fprintf(stderr, "Maximum file limit reached: %d\n",
+ Wflag);
+ exit(0);
+ /* NOTREACHED */
+ }
+ if (dump_info->CurrentFileName != NULL)
+ free(dump_info->CurrentFileName);
+ /* Allocate space for max filename + \0. */
+ dump_info->CurrentFileName = (char *)malloc(NAME_MAX + 1);
+ if (dump_info->CurrentFileName == NULL)
+ error("dump_packet_and_trunc: malloc");
+ /*
+ * This is always the first file in the Cflag
+ * rotation: e.g. 0
+ * We also don't need numbering if Cflag is not set.
+ */
+ if (Cflag != 0)
+ MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0,
+ WflagChars);
+ else
+ MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 0);
+
+ dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
+ if (dump_info->p == NULL)
+ error("%s", pcap_geterr(pd));
+ }
+ }
+
+ /*
+ * XXX - this won't prevent capture files from getting
+ * larger than Cflag - the last packet written to the
+ * file could put it over Cflag.
+ */
+ if (Cflag != 0 && pcap_dump_ftell(dump_info->p) > Cflag) {
+ /*
+ * Close the current file and open a new one.
+ */
+ pcap_dump_close(dump_info->p);
+
+ /*
+ * Compress the file we just closed, if the user asked for it
+ */
+ if (zflag != NULL)
+ compress_savefile(dump_info->CurrentFileName);
+
+ Cflag_count++;
+ if (Wflag > 0) {
+ if (Cflag_count >= Wflag)
+ Cflag_count = 0;
+ }
+ if (dump_info->CurrentFileName != NULL)
+ free(dump_info->CurrentFileName);
+ dump_info->CurrentFileName = (char *)malloc(NAME_MAX + 1);
+ if (dump_info->CurrentFileName == NULL)
+ error("dump_packet_and_trunc: malloc");
+ MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars);
+ dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
+ if (dump_info->p == NULL)
+ error("%s", pcap_geterr(pd));
+ }
+
+ pcap_dump((u_char *)dump_info->p, h, sp);
+#ifdef HAVE_PCAP_DUMP_FLUSH
+ if (Uflag)
+ pcap_dump_flush(dump_info->p);
+#endif
+
+ --infodelay;
+ if (infoprint)
+ info(0);
+}
+
+static void
+dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
+{
+ ++packets_captured;
+
+ ++infodelay;
+
+ pcap_dump(user, h, sp);
+#ifdef HAVE_PCAP_DUMP_FLUSH
+ if (Uflag)
+ pcap_dump_flush((pcap_dumper_t *)user);
+#endif
+
+ --infodelay;
+ if (infoprint)
+ info(0);
+}
+
+static void
+print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
+{
+ struct print_info *print_info;
+ u_int hdrlen;
+
+ ++packets_captured;
+
+ ++infodelay;
+ ts_print(&h->ts);
+
+ print_info = (struct print_info *)user;
+
+ /*
+ * Some printers want to check that they're not walking off the
+ * end of the packet.
+ * Rather than pass it all the way down, we set this global.
+ */
+ snapend = sp + h->caplen;
+
+ if(print_info->ndo_type) {
+ hdrlen = (*print_info->p.ndo_printer)(print_info->ndo, h, sp);
+ } else {
+ hdrlen = (*print_info->p.printer)(h, sp);
+ }
+
+ /*
+ * Restore the original snapend, as a printer might have
+ * changed it.
+ */
+ snapend = sp + h->caplen;
+ if (Xflag) {
+ /*
+ * Print the raw packet data in hex and ASCII.
+ */
+ if (Xflag > 1) {
+ /*
+ * Include the link-layer header.
+ */
+ hex_and_ascii_print("\n\t", sp, h->caplen);
+ } else {
+ /*
+ * Don't include the link-layer header - and if
+ * we have nothing past the link-layer header,
+ * print nothing.
+ */
+ if (h->caplen > hdrlen)
+ hex_and_ascii_print("\n\t", sp + hdrlen,
+ h->caplen - hdrlen);
+ }
+ } else if (xflag) {
+ /*
+ * Print the raw packet data in hex.
+ */
+ if (xflag > 1) {
+ /*
+ * Include the link-layer header.
+ */
+ hex_print("\n\t", sp, h->caplen);
+ } else {
+ /*
+ * Don't include the link-layer header - and if
+ * we have nothing past the link-layer header,
+ * print nothing.
+ */
+ if (h->caplen > hdrlen)
+ hex_print("\n\t", sp + hdrlen,
+ h->caplen - hdrlen);
+ }
+ } else if (Aflag) {
+ /*
+ * Print the raw packet data in ASCII.
+ */
+ if (Aflag > 1) {
+ /*
+ * Include the link-layer header.
+ */
+ ascii_print(sp, h->caplen);
+ } else {
+ /*
+ * Don't include the link-layer header - and if
+ * we have nothing past the link-layer header,
+ * print nothing.
+ */
+ if (h->caplen > hdrlen)
+ ascii_print(sp + hdrlen, h->caplen - hdrlen);
+ }
projects / tcpdump / blobdiff