With no -s, or with -s 0, don't specify the snapshot length with newer versions of...

That leaves it up to libpcap to choose an appropriate snapshot length,
which it'll do.  With upcoming versions, it'll choose, when capturing on
a D-Bus interface, a very large snapshot length, to handle the maximum
D-Bus message size of 128MB.

(For older versions, we still use 262144, as those versions won't pick a
default value.)

diff --git a/netdissect.h b/netdissect.h
index ac916c2a2e117160bb01fd5c23578dcdca075b72..91fc2fba99cf6a36a4320f1ea20474ec4bff8e11 100644 (file)
--- a/netdissect.h
+++ b/netdissect.h
@@ -264,15 +264,14 @@ struct netdissect_options {
  *       savefile header to control the size of the buffer they allocate,
  *       so a size of, say, 2^31-1 might not work well.
  *
- * XXX - does it need to be bigger still?
+ * XXX - does it need to be bigger still?  Note that, for versions of
+ * libpcap with pcap_create()/pcap_activate(), if no -s flag is specified
+ * or -s 0 is specified, we won't set the snapshot length at all, and will
+ * let libpcap choose a snapshot length; newer versions may choose a bigger
+ * value than 262144 for D-Bus, for example.
  */
 #define MAXIMUM_SNAPLEN        262144
 
-/*
- * The default snapshot length is the maximum.
- */
-#define DEFAULT_SNAPLEN        MAXIMUM_SNAPLEN
-
 #define ESRC(ep) ((ep)->ether_shost)
 #define EDST(ep) ((ep)->ether_dhost)
 

diff --git a/tcpdump.c b/tcpdump.c
index 2ac7757f7a06fd6271447318c4780df9661adb87..01bd7522c05f591bd250a75bf42447c6945d7381 100644 (file)
--- a/tcpdump.c
+++ b/tcpdump.c
@@ -1045,10 +1045,16 @@ open_interface(const char *device, netdissect_options *ndo, char *ebuf)
                supports_monitor_mode = 1;
        else
                supports_monitor_mode = 0;
-       status = pcap_set_snaplen(pc, ndo->ndo_snaplen);
-       if (status != 0)
-               error("%s: Can't set snapshot length: %s",
-                   device, pcap_statustostr(status));
+       if (ndo->ndo_snaplen != 0) {
+               /*
+                * A snapshot length was explicitly specified;
+                * use it.
+                */
+               status = pcap_set_snaplen(pc, ndo->ndo_snaplen);
+               if (status != 0)
+                       error("%s: Can't set snapshot length: %s",
+                           device, pcap_statustostr(status));
+       }
        status = pcap_set_promisc(pc, !pflag);
        if (status != 0)
                error("%s: Can't set promiscuous mode: %s",
@@ -1149,6 +1155,12 @@ open_interface(const char *device, netdissect_options *ndo, char *ebuf)
 #endif /* HAVE_PCAP_SETDIRECTION */
 #else /* HAVE_PCAP_CREATE */
        *ebuf = '\0';
+       /*
+        * If no snapshot length was specified, or a length of 0 was
+        * specified, default to 256KB.
+        */
+       if (ndo->ndo_snaplen == 0)
+               ndo->ndo_snaplen = 262144;
        pc = pcap_open_live(device, ndo->ndo_snaplen, !pflag, 1000, ebuf);
        if (pc == NULL) {
                /*
@@ -1215,7 +1227,6 @@ main(int argc, char **argv)
 
        memset(ndo, 0, sizeof(*ndo));
        ndo_set_function_pointers(ndo);
-       ndo->ndo_snaplen = DEFAULT_SNAPLEN;
 
        cnt = -1;
        device = NULL;
@@ -1445,8 +1456,6 @@ main(int argc, char **argv)
                        if (optarg == end || *end != '\0'
                            || ndo->ndo_snaplen < 0 || ndo->ndo_snaplen > MAXIMUM_SNAPLEN)
                                error("invalid snaplen %s", optarg);
-                       else if (ndo->ndo_snaplen == 0)
-                               ndo->ndo_snaplen = MAXIMUM_SNAPLEN;
                        break;
 
                case 'S':
@@ -1784,7 +1793,8 @@ main(int argc, char **argv)
                }
 
                /*
-                * Let user own process after socket has been opened.
+                * Let user own process after capture device has
+                * been opened.
                 */
 #ifndef _WIN32
                if (setgid(getgid()) != 0 || setuid(getuid()) != 0)
@@ -1819,7 +1829,11 @@ main(int argc, char **argv)
                }
                i = pcap_snapshot(pd);
                if (ndo->ndo_snaplen < i) {
-                       warning("snaplen raised from %d to %d", ndo->ndo_snaplen, i);
+                       if (ndo->ndo_snaplen != 0)
+                               warning("snaplen raised from %d to %d", ndo->ndo_snaplen, i);
+                       ndo->ndo_snaplen = i;
+               } else if (ndo->ndo_snaplen > i) {
+                       warning("snaplen lowered from %d to %d", ndo->ndo_snaplen, i);
                        ndo->ndo_snaplen = i;
                }
                 if(ndo->ndo_fflag != 0) {