tcpdump  4.99.1
About: tcpdump is a tool for network monitoring and data acquisition.
  Fossies Dox: tcpdump-4.99.1.tar.gz  ("unofficial" and yet experimental doxygen-generated source code documentation)  

tcpdump.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3  * The Regents of the University of California. All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that: (1) source code distributions
7  * retain the above copyright notice and this paragraph in its entirety, (2)
8  * distributions including binary code include the above copyright notice and
9  * this paragraph in its entirety in the documentation or other materials
10  * provided with the distribution, and (3) all advertising materials mentioning
11  * features or use of this software display the following acknowledgement:
12  * ``This product includes software developed by the University of California,
13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14  * the University nor the names of its contributors may be used to endorse
15  * or promote products derived from this software without specific prior
16  * written permission.
17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20  *
21  * Support for splitting captures into multiple files with a maximum
22  * file size:
23  *
24  * Copyright (c) 2001
25  * Seth Webster <swebster@sst.ll.mit.edu>
26  */
27 
28 /*
29  * tcpdump - dump traffic on a network
30  *
31  * First written in 1987 by Van Jacobson, Lawrence Berkeley Laboratory.
32  * Mercilessly hacked and occasionally improved since then via the
33  * combined efforts of Van, Steve McCanne and Craig Leres of LBL.
34  */
35 
36 #ifdef HAVE_CONFIG_H
37 #include <config.h>
38 #endif
39 
40 /*
41  * Some older versions of Mac OS X may ship pcap.h from libpcap 0.6 with a
42  * libpcap based on 0.8. That means it has pcap_findalldevs() but the
43  * header doesn't define pcap_if_t, meaning that we can't actually *use*
44  * pcap_findalldevs().
45  */
46 #ifdef HAVE_PCAP_FINDALLDEVS
47 #ifndef HAVE_PCAP_IF_T
48 #undef HAVE_PCAP_FINDALLDEVS
49 #endif
50 #endif
51 
52 #include "netdissect-stdinc.h"
53 
54 /*
55  * This must appear after including netdissect-stdinc.h, so that _U_ is
56  * defined.
57  */
58 #ifndef lint
59 static const char copyright[] _U_ =
60  "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\
61 The Regents of the University of California. All rights reserved.\n";
62 #endif
63 
64 #include <sys/stat.h>
65 
66 #ifdef HAVE_FCNTL_H
67 #include <fcntl.h>
68 #endif
69 
70 #ifdef HAVE_LIBCRYPTO
71 #include <openssl/crypto.h>
72 #endif
73 
74 #ifdef HAVE_GETOPT_LONG
75 #include <getopt.h>
76 #else
77 #include "missing/getopt_long.h"
78 #endif
79 /* Capsicum-specific code requires macros from <net/bpf.h>, which will fail
80  * to compile if <pcap.h> has already been included; including the headers
81  * in the opposite order works fine.
82  */
83 #ifdef HAVE_CAPSICUM
84 #include <sys/capsicum.h>
85 #include <sys/ioccom.h>
86 #include <net/bpf.h>
87 #include <libgen.h>
88 #ifdef HAVE_CASPER
89 #include <libcasper.h>
90 #include <casper/cap_dns.h>
91 #include <sys/nv.h>
92 #endif /* HAVE_CASPER */
93 #endif /* HAVE_CAPSICUM */
94 #ifdef HAVE_PCAP_OPEN
95 /*
96  * We found pcap_open() in the capture library, so we'll be using
97  * the remote capture APIs; define PCAP_REMOTE before we include pcap.h,
98  * so we get those APIs declared, and the types and #defines that they
99  * use defined.
100  *
101  * WinPcap's headers require that PCAP_REMOTE be defined in order to get
102  * remote-capture APIs declared and types and #defines that they use
103  * defined.
104  *
105  * (Versions of libpcap with those APIs, and thus Npcap, which is based on
106  * those versions of libpcap, don't require it.)
107  */
108 #define HAVE_REMOTE
109 #endif
110 #include <pcap.h>
111 #include <signal.h>
112 #include <stdio.h>
113 #include <stdarg.h>
114 #include <stdlib.h>
115 #include <string.h>
116 #include <limits.h>
117 #ifdef _WIN32
118 #include <windows.h>
119 #else
120 #include <sys/time.h>
121 #include <sys/wait.h>
122 #include <sys/resource.h>
123 #include <pwd.h>
124 #include <grp.h>
125 #endif /* _WIN32 */
126 
127 /*
128  * Pathname separator.
129  * Use this in pathnames, but do *not* use it in URLs.
130  */
131 #ifdef _WIN32
132 #define PATH_SEPARATOR '\\'
133 #else
134 #define PATH_SEPARATOR '/'
135 #endif
136 
137 /* capabilities convenience library */
138 /* If a code depends on HAVE_LIBCAP_NG, it depends also on HAVE_CAP_NG_H.
139  * If HAVE_CAP_NG_H is not defined, undefine HAVE_LIBCAP_NG.
140  * Thus, the later tests are done only on HAVE_LIBCAP_NG.
141  */
142 #ifdef HAVE_LIBCAP_NG
143 #ifdef HAVE_CAP_NG_H
144 #include <cap-ng.h>
145 #else
146 #undef HAVE_LIBCAP_NG
147 #endif /* HAVE_CAP_NG_H */
148 #endif /* HAVE_LIBCAP_NG */
149 
150 #ifdef __FreeBSD__
151 #include <sys/sysctl.h>
152 #endif /* __FreeBSD__ */
153 
154 #include "netdissect-stdinc.h"
155 #include "netdissect.h"
156 #include "interface.h"
157 #include "addrtoname.h"
158 #include "machdep.h"
159 #include "pcap-missing.h"
160 #include "ascii_strcasecmp.h"
161 
162 #include "print.h"
163 
164 #include "fptype.h"
165 
166 #ifndef PATH_MAX
167 #define PATH_MAX 1024
168 #endif
169 
170 #if defined(SIGINFO)
171 #define SIGNAL_REQ_INFO SIGINFO
172 #elif defined(SIGUSR1)
173 #define SIGNAL_REQ_INFO SIGUSR1
174 #endif
175 
176 #if defined(HAVE_PCAP_DUMP_FLUSH) && defined(SIGUSR2)
177 #define SIGNAL_FLUSH_PCAP SIGUSR2
178 #endif
179 
180 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
181 static int Bflag; /* buffer size */
182 #endif
183 #ifdef HAVE_PCAP_DUMP_FTELL64
184 static int64_t Cflag; /* rotate dump files after this many bytes */
185 #else
186 static long Cflag; /* rotate dump files after this many bytes */
187 #endif
188 static int Cflag_count; /* Keep track of which file number we're writing */
189 #ifdef HAVE_PCAP_FINDALLDEVS
190 static int Dflag; /* list available devices and exit */
191 #endif
192 #ifdef HAVE_PCAP_FINDALLDEVS_EX
193 static char *remote_interfaces_source; /* list available devices from this source and exit */
194 #endif
195 
196 /*
197  * This is exported because, in some versions of libpcap, if libpcap
198  * is built with optimizer debugging code (which is *NOT* the default
199  * configuration!), the library *imports*(!) a variable named dflag,
200  * under the expectation that tcpdump is exporting it, to govern
201  * how much debugging information to print when optimizing
202  * the generated BPF code.
203  *
204  * This is a horrible hack; newer versions of libpcap don't import
205  * dflag but, instead, *if* built with optimizer debugging code,
206  * *export* a routine to set that flag.
207  */
208 extern int dflag;
209 int dflag; /* print filter code */
210 static int Gflag; /* rotate dump files after this many seconds */
211 static int Gflag_count; /* number of files created with Gflag rotation */
212 static time_t Gflag_time; /* The last time_t the dump file was rotated. */
213 static int Lflag; /* list available data link types and exit */
214 static int Iflag; /* rfmon (monitor) mode */
215 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
216 static int Jflag; /* list available time stamp types */
217 static int jflag = -1; /* packet time stamp source */
218 #endif
219 static int lflag; /* line-buffered output */
220 static int pflag; /* don't go promiscuous */
221 #ifdef HAVE_PCAP_SETDIRECTION
222 static int Qflag = -1; /* restrict captured packet by send/receive direction */
223 #endif
224 #ifdef HAVE_PCAP_DUMP_FLUSH
225 static int Uflag; /* "unbuffered" output of dump files */
226 #endif
227 static int Wflag; /* recycle output files after this number of files */
228 static int WflagChars;
229 static char *zflag = NULL; /* compress each savefile using a specified command (like gzip or bzip2) */
230 static int timeout = 1000; /* default timeout = 1000 ms = 1 s */
231 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
232 static int immediate_mode;
233 #endif
234 static int count_mode;
235 
236 static int infodelay;
237 static int infoprint;
238 
240 
241 #ifdef HAVE_CASPER
242 cap_channel_t *capdns;
243 #endif
244 
245 /* Forwards */
246 static NORETURN void error(FORMAT_STRING(const char *), ...) PRINTFLIKE(1, 2);
247 static void warning(FORMAT_STRING(const char *), ...) PRINTFLIKE(1, 2);
248 static NORETURN void exit_tcpdump(int);
249 static void (*setsignal (int sig, void (*func)(int)))(int);
250 static void cleanup(int);
251 static void child_cleanup(int);
252 static void print_version(FILE *);
253 static void print_usage(FILE *);
254 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
255 static NORETURN void show_tstamp_types_and_exit(pcap_t *, const char *device);
256 #endif
257 static NORETURN void show_dlts_and_exit(pcap_t *, const char *device);
258 #ifdef HAVE_PCAP_FINDALLDEVS
259 static NORETURN void show_devices_and_exit(void);
260 #endif
261 #ifdef HAVE_PCAP_FINDALLDEVS_EX
262 static NORETURN void show_remote_devices_and_exit(void);
263 #endif
264 
265 static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
266 static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *);
267 static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
268 static void droproot(const char *, const char *);
269 
270 #ifdef SIGNAL_REQ_INFO
271 static void requestinfo(int);
272 #endif
273 
274 #ifdef SIGNAL_FLUSH_PCAP
275 static void flushpcap(int);
276 #endif
277 
278 #ifdef _WIN32
279  static HANDLE timer_handle = INVALID_HANDLE_VALUE;
280  static void CALLBACK verbose_stats_dump(PVOID param, BOOLEAN timer_fired);
281 #else /* _WIN32 */
282  static void verbose_stats_dump(int sig);
283 #endif /* _WIN32 */
284 
285 static void info(int);
286 static u_int packets_captured;
287 
288 #ifdef HAVE_PCAP_FINDALLDEVS
289 static const struct tok status_flags[] = {
290 #ifdef PCAP_IF_UP
291  { PCAP_IF_UP, "Up" },
292 #endif
293 #ifdef PCAP_IF_RUNNING
294  { PCAP_IF_RUNNING, "Running" },
295 #endif
296  { PCAP_IF_LOOPBACK, "Loopback" },
297 #ifdef PCAP_IF_WIRELESS
298  { PCAP_IF_WIRELESS, "Wireless" },
299 #endif
300  { 0, NULL }
301 };
302 #endif
303 
304 static pcap_t *pd;
305 static pcap_dumper_t *pdd = NULL;
306 
308 
309 extern int optind;
310 extern int opterr;
311 extern char *optarg;
312 
313 struct dump_info {
314  char *WFileName;
316  pcap_t *pd;
317  pcap_dumper_t *pdd;
319 #ifdef HAVE_CAPSICUM
320  int dirfd;
321 #endif
322 };
323 
324 #if defined(HAVE_PCAP_SET_PARSER_DEBUG)
325 /*
326  * We have pcap_set_parser_debug() in libpcap; declare it (it's not declared
327  * by any libpcap header, because it's a special hack, only available if
328  * libpcap was configured to include it, and only intended for use by
329  * libpcap developers trying to debug the parser for filter expressions).
330  */
331 #ifdef _WIN32
332 __declspec(dllimport)
333 #else /* _WIN32 */
334 extern
335 #endif /* _WIN32 */
336 void pcap_set_parser_debug(int);
337 #elif defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG)
338 /*
339  * We don't have pcap_set_parser_debug() in libpcap, but we do have
340  * pcap_debug or yydebug. Make a local version of pcap_set_parser_debug()
341  * to set the flag, and define HAVE_PCAP_SET_PARSER_DEBUG.
342  */
343 static void
344 pcap_set_parser_debug(int value)
345 {
346 #ifdef HAVE_PCAP_DEBUG
347  extern int pcap_debug;
348 
349  pcap_debug = value;
350 #else /* HAVE_PCAP_DEBUG */
351  extern int yydebug;
352 
353  yydebug = value;
354 #endif /* HAVE_PCAP_DEBUG */
355 }
356 
357 #define HAVE_PCAP_SET_PARSER_DEBUG
358 #endif
359 
360 #if defined(HAVE_PCAP_SET_OPTIMIZER_DEBUG)
361 /*
362  * We have pcap_set_optimizer_debug() in libpcap; declare it (it's not declared
363  * by any libpcap header, because it's a special hack, only available if
364  * libpcap was configured to include it, and only intended for use by
365  * libpcap developers trying to debug the optimizer for filter expressions).
366  */
367 #ifdef _WIN32
368 __declspec(dllimport)
369 #else /* _WIN32 */
370 extern
371 #endif /* _WIN32 */
372 void pcap_set_optimizer_debug(int);
373 #endif
374 
375 /* VARARGS */
376 static void
377 error(const char *fmt, ...)
378 {
379  va_list ap;
380 
381  (void)fprintf(stderr, "%s: ", program_name);
382  va_start(ap, fmt);
383  (void)vfprintf(stderr, fmt, ap);
384  va_end(ap);
385  if (*fmt) {
386  fmt += strlen(fmt);
387  if (fmt[-1] != '\n')
388  (void)fputc('\n', stderr);
389  }
391  /* NOTREACHED */
392 }
393 
394 /* VARARGS */
395 static void
396 warning(const char *fmt, ...)
397 {
398  va_list ap;
399 
400  (void)fprintf(stderr, "%s: WARNING: ", program_name);
401  va_start(ap, fmt);
402  (void)vfprintf(stderr, fmt, ap);
403  va_end(ap);
404  if (*fmt) {
405  fmt += strlen(fmt);
406  if (fmt[-1] != '\n')
407  (void)fputc('\n', stderr);
408  }
409 }
410 
411 static void
412 exit_tcpdump(int status)
413 {
414  nd_cleanup();
415  exit(status);
416 }
417 
418 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
419 static void
420 show_tstamp_types_and_exit(pcap_t *pc, const char *device)
421 {
422  int n_tstamp_types;
423  int *tstamp_types = 0;
424  const char *tstamp_type_name;
425  int i;
426 
427  n_tstamp_types = pcap_list_tstamp_types(pc, &tstamp_types);
428  if (n_tstamp_types < 0)
429  error("%s", pcap_geterr(pc));
430 
431  if (n_tstamp_types == 0) {
432  fprintf(stderr, "Time stamp type cannot be set for %s\n",
433  device);
435  }
436  fprintf(stderr, "Time stamp types for %s (use option -j to set):\n",
437  device);
438  for (i = 0; i < n_tstamp_types; i++) {
439  tstamp_type_name = pcap_tstamp_type_val_to_name(tstamp_types[i]);
440  if (tstamp_type_name != NULL) {
441  (void) fprintf(stderr, " %s (%s)\n", tstamp_type_name,
442  pcap_tstamp_type_val_to_description(tstamp_types[i]));
443  } else {
444  (void) fprintf(stderr, " %d\n", tstamp_types[i]);
445  }
446  }
447  pcap_free_tstamp_types(tstamp_types);
449 }
450 #endif
451 
452 static void
453 show_dlts_and_exit(pcap_t *pc, const char *device)
454 {
455  int n_dlts, i;
456  int *dlts = 0;
457  const char *dlt_name;
458 
459  n_dlts = pcap_list_datalinks(pc, &dlts);
460  if (n_dlts < 0)
461  error("%s", pcap_geterr(pc));
462  else if (n_dlts == 0 || !dlts)
463  error("No data link types.");
464 
465  /*
466  * If the interface is known to support monitor mode, indicate
467  * whether these are the data link types available when not in
468  * monitor mode, if -I wasn't specified, or when in monitor mode,
469  * when -I was specified (the link-layer types available in
470  * monitor mode might be different from the ones available when
471  * not in monitor mode).
472  */
474  (void) fprintf(stderr, "Data link types for %s %s (use option -y to set):\n",
475  device,
476  Iflag ? "when in monitor mode" : "when not in monitor mode");
477  else
478  (void) fprintf(stderr, "Data link types for %s (use option -y to set):\n",
479  device);
480 
481  for (i = 0; i < n_dlts; i++) {
482  dlt_name = pcap_datalink_val_to_name(dlts[i]);
483  if (dlt_name != NULL) {
484  (void) fprintf(stderr, " %s (%s)", dlt_name,
486 
487  /*
488  * OK, does tcpdump handle that type?
489  */
490  if (!has_printer(dlts[i]))
491  (void) fprintf(stderr, " (printing not supported)");
492  fprintf(stderr, "\n");
493  } else {
494  (void) fprintf(stderr, " DLT %d (printing not supported)\n",
495  dlts[i]);
496  }
497  }
498 #ifdef HAVE_PCAP_FREE_DATALINKS
499  pcap_free_datalinks(dlts);
500 #endif
502 }
503 
504 #ifdef HAVE_PCAP_FINDALLDEVS
505 static void
506 show_devices_and_exit(void)
507 {
508  pcap_if_t *dev, *devlist;
509  char ebuf[PCAP_ERRBUF_SIZE];
510  int i;
511 
512  if (pcap_findalldevs(&devlist, ebuf) < 0)
513  error("%s", ebuf);
514  for (i = 0, dev = devlist; dev != NULL; i++, dev = dev->next) {
515  printf("%d.%s", i+1, dev->name);
516  if (dev->description != NULL)
517  printf(" (%s)", dev->description);
518  if (dev->flags != 0) {
519  printf(" [");
520  printf("%s", bittok2str(status_flags, "none", dev->flags));
521 #ifdef PCAP_IF_WIRELESS
522  if (dev->flags & PCAP_IF_WIRELESS) {
523  switch (dev->flags & PCAP_IF_CONNECTION_STATUS) {
524 
525  case PCAP_IF_CONNECTION_STATUS_UNKNOWN:
526  printf(", Association status unknown");
527  break;
528 
529  case PCAP_IF_CONNECTION_STATUS_CONNECTED:
530  printf(", Associated");
531  break;
532 
533  case PCAP_IF_CONNECTION_STATUS_DISCONNECTED:
534  printf(", Not associated");
535  break;
536 
537  case PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE:
538  break;
539  }
540  } else {
541  switch (dev->flags & PCAP_IF_CONNECTION_STATUS) {
542 
543  case PCAP_IF_CONNECTION_STATUS_UNKNOWN:
544  printf(", Connection status unknown");
545  break;
546 
547  case PCAP_IF_CONNECTION_STATUS_CONNECTED:
548  printf(", Connected");
549  break;
550 
551  case PCAP_IF_CONNECTION_STATUS_DISCONNECTED:
552  printf(", Disconnected");
553  break;
554 
555  case PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE:
556  break;
557  }
558  }
559 #endif
560  printf("]");
561  }
562  printf("\n");
563  }
564  pcap_freealldevs(devlist);
566 }
567 #endif /* HAVE_PCAP_FINDALLDEVS */
568 
569 #ifdef HAVE_PCAP_FINDALLDEVS_EX
570 static void
571 show_remote_devices_and_exit(void)
572 {
573  pcap_if_t *dev, *devlist;
574  char ebuf[PCAP_ERRBUF_SIZE];
575  int i;
576 
577  if (pcap_findalldevs_ex(remote_interfaces_source, NULL, &devlist,
578  ebuf) < 0)
579  error("%s", ebuf);
580  for (i = 0, dev = devlist; dev != NULL; i++, dev = dev->next) {
581  printf("%d.%s", i+1, dev->name);
582  if (dev->description != NULL)
583  printf(" (%s)", dev->description);
584  if (dev->flags != 0)
585  printf(" [%s]", bittok2str(status_flags, "none", dev->flags));
586  printf("\n");
587  }
588  pcap_freealldevs(devlist);
590 }
591 #endif /* HAVE_PCAP_FINDALLDEVS */
592 
593 /*
594  * Short options.
595  *
596  * Note that there we use all letters for short options except for g, k,
597  * o, and P, and those are used by other versions of tcpdump, and we should
598  * only use them for the same purposes that the other versions of tcpdump
599  * use them:
600  *
601  * macOS tcpdump uses -g to force non--v output for IP to be on one
602  * line, making it more "g"repable;
603  *
604  * macOS tcpdump uses -k to specify that packet comments in pcapng files
605  * should be printed;
606  *
607  * OpenBSD tcpdump uses -o to indicate that OS fingerprinting should be done
608  * for hosts sending TCP SYN packets;
609  *
610  * macOS tcpdump uses -P to indicate that -w should write pcapng rather
611  * than pcap files.
612  *
613  * macOS tcpdump also uses -Q to specify expressions that match packet
614  * metadata, including but not limited to the packet direction.
615  * The expression syntax is different from a simple "in|out|inout",
616  * and those expressions aren't accepted by macOS tcpdump, but the
617  * equivalents would be "in" = "dir=in", "out" = "dir=out", and
618  * "inout" = "dir=in or dir=out", and the parser could conceivably
619  * special-case "in", "out", and "inout" as expressions for backwards
620  * compatibility, so all is not (yet) lost.
621  */
622 
623 /*
624  * Set up flags that might or might not be supported depending on the
625  * version of libpcap we're using.
626  */
627 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
628 #define B_FLAG "B:"
629 #define B_FLAG_USAGE " [ -B size ]"
630 #else /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */
631 #define B_FLAG
632 #define B_FLAG_USAGE
633 #endif /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */
634 
635 #ifdef HAVE_PCAP_FINDALLDEVS
636 #define D_FLAG "D"
637 #else
638 #define D_FLAG
639 #endif
640 
641 #ifdef HAVE_PCAP_CREATE
642 #define I_FLAG "I"
643 #else /* HAVE_PCAP_CREATE */
644 #define I_FLAG
645 #endif /* HAVE_PCAP_CREATE */
646 
647 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
648 #define j_FLAG "j:"
649 #define j_FLAG_USAGE " [ -j tstamptype ]"
650 #define J_FLAG "J"
651 #else /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */
652 #define j_FLAG
653 #define j_FLAG_USAGE
654 #define J_FLAG
655 #endif /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */
656 
657 #ifdef USE_LIBSMI
658 #define m_FLAG_USAGE "[ -m module ] ..."
659 #endif
660 
661 #ifdef HAVE_PCAP_SETDIRECTION
662 #define Q_FLAG "Q:"
663 #define Q_FLAG_USAGE " [ -Q in|out|inout ]"
664 #else
665 #define Q_FLAG
666 #define Q_FLAG_USAGE
667 #endif
668 
669 #ifdef HAVE_PCAP_DUMP_FLUSH
670 #define U_FLAG "U"
671 #else
672 #define U_FLAG
673 #endif
674 
675 #define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:s:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#"
676 
677 /*
678  * Long options.
679  *
680  * We do not currently have long options corresponding to all short
681  * options; we should probably pick appropriate option names for them.
682  *
683  * However, the short options where the number of times the option is
684  * specified matters, such as -v and -d and -t, should probably not
685  * just map to a long option, as saying
686  *
687  * tcpdump --verbose --verbose
688  *
689  * doesn't make sense; it should be --verbosity={N} or something such
690  * as that.
691  *
692  * For long options with no corresponding short options, we define values
693  * outside the range of ASCII graphic characters, make that the last
694  * component of the entry for the long option, and have a case for that
695  * option in the switch statement.
696  */
697 #define OPTION_VERSION 128
698 #define OPTION_TSTAMP_PRECISION 129
699 #define OPTION_IMMEDIATE_MODE 130
700 #define OPTION_PRINT 131
701 #define OPTION_LIST_REMOTE_INTERFACES 132
702 #define OPTION_TSTAMP_MICRO 133
703 #define OPTION_TSTAMP_NANO 134
704 #define OPTION_FP_TYPE 135
705 #define OPTION_COUNT 136
706 
707 static const struct option longopts[] = {
708 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
709  { "buffer-size", required_argument, NULL, 'B' },
710 #endif
711  { "list-interfaces", no_argument, NULL, 'D' },
712 #ifdef HAVE_PCAP_FINDALLDEVS_EX
713  { "list-remote-interfaces", required_argument, NULL, OPTION_LIST_REMOTE_INTERFACES },
714 #endif
715  { "help", no_argument, NULL, 'h' },
716  { "interface", required_argument, NULL, 'i' },
717 #ifdef HAVE_PCAP_CREATE
718  { "monitor-mode", no_argument, NULL, 'I' },
719 #endif
720 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
721  { "time-stamp-type", required_argument, NULL, 'j' },
722  { "list-time-stamp-types", no_argument, NULL, 'J' },
723 #endif
724 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
725  { "micro", no_argument, NULL, OPTION_TSTAMP_MICRO},
726  { "nano", no_argument, NULL, OPTION_TSTAMP_NANO},
727  { "time-stamp-precision", required_argument, NULL, OPTION_TSTAMP_PRECISION},
728 #endif
729  { "dont-verify-checksums", no_argument, NULL, 'K' },
730  { "list-data-link-types", no_argument, NULL, 'L' },
731  { "no-optimize", no_argument, NULL, 'O' },
732  { "no-promiscuous-mode", no_argument, NULL, 'p' },
733 #ifdef HAVE_PCAP_SETDIRECTION
734  { "direction", required_argument, NULL, 'Q' },
735 #endif
736  { "snapshot-length", required_argument, NULL, 's' },
737  { "absolute-tcp-sequence-numbers", no_argument, NULL, 'S' },
738 #ifdef HAVE_PCAP_DUMP_FLUSH
739  { "packet-buffered", no_argument, NULL, 'U' },
740 #endif
741  { "linktype", required_argument, NULL, 'y' },
742 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
743  { "immediate-mode", no_argument, NULL, OPTION_IMMEDIATE_MODE },
744 #endif
745 #ifdef HAVE_PCAP_SET_PARSER_DEBUG
746  { "debug-filter-parser", no_argument, NULL, 'Y' },
747 #endif
748  { "relinquish-privileges", required_argument, NULL, 'Z' },
749  { "count", no_argument, NULL, OPTION_COUNT },
750  { "fp-type", no_argument, NULL, OPTION_FP_TYPE },
751  { "number", no_argument, NULL, '#' },
752  { "print", no_argument, NULL, OPTION_PRINT },
753  { "version", no_argument, NULL, OPTION_VERSION },
754  { NULL, 0, NULL, 0 }
755 };
756 
757 #ifdef HAVE_PCAP_FINDALLDEVS_EX
758 #define LIST_REMOTE_INTERFACES_USAGE "[ --list-remote-interfaces remote-source ]"
759 #else
760 #define LIST_REMOTE_INTERFACES_USAGE
761 #endif
762 
763 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
764 #define IMMEDIATE_MODE_USAGE " [ --immediate-mode ]"
765 #else
766 #define IMMEDIATE_MODE_USAGE ""
767 #endif
768 
769 #ifndef _WIN32
770 /* Drop root privileges and chroot if necessary */
771 static void
772 droproot(const char *username, const char *chroot_dir)
773 {
774  struct passwd *pw = NULL;
775 
776  if (chroot_dir && !username)
777  error("Chroot without dropping root is insecure");
778 
779  pw = getpwnam(username);
780  if (pw) {
781  if (chroot_dir) {
782  if (chroot(chroot_dir) != 0 || chdir ("/") != 0)
783  error("Couldn't chroot/chdir to '%.64s': %s",
784  chroot_dir, pcap_strerror(errno));
785  }
786 #ifdef HAVE_LIBCAP_NG
787  {
788  int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG);
789  if (ret < 0)
790  error("capng_change_id(): return %d\n", ret);
791  else
792  fprintf(stderr, "dropped privs to %s\n", username);
793  }
794 #else
795  if (initgroups(pw->pw_name, pw->pw_gid) != 0 ||
796  setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0)
797  error("Couldn't change to '%.32s' uid=%lu gid=%lu: %s",
798  username,
799  (unsigned long)pw->pw_uid,
800  (unsigned long)pw->pw_gid,
801  pcap_strerror(errno));
802  else {
803  fprintf(stderr, "dropped privs to %s\n", username);
804  }
805 #endif /* HAVE_LIBCAP_NG */
806  } else
807  error("Couldn't find user '%.32s'", username);
808 #ifdef HAVE_LIBCAP_NG
809  /* We don't need CAP_SETUID, CAP_SETGID and CAP_SYS_CHROOT any more. */
810 DIAG_OFF_CLANG(assign-enum)
811  capng_updatev(
812  CAPNG_DROP,
813  CAPNG_EFFECTIVE | CAPNG_PERMITTED,
814  CAP_SETUID,
815  CAP_SETGID,
816  CAP_SYS_CHROOT,
817  -1);
818 DIAG_ON_CLANG(assign-enum)
819  capng_apply(CAPNG_SELECT_BOTH);
820 #endif /* HAVE_LIBCAP_NG */
821 
822 }
823 #endif /* _WIN32 */
824 
825 static int
827 {
828  int c = 0;
829 
830  x -= 1;
831  while (x > 0) {
832  c += 1;
833  x /= 10;
834  }
835 
836  return c;
837 }
838 
839 
840 static void
841 MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars)
842 {
843  char *filename = malloc(PATH_MAX + 1);
844  if (filename == NULL)
845  error("%s: malloc", __func__);
846 
847  /* Process with strftime if Gflag is set. */
848  if (Gflag != 0) {
849  struct tm *local_tm;
850 
851  /* Convert Gflag_time to a usable format */
852  if ((local_tm = localtime(&Gflag_time)) == NULL) {
853  error("%s: localtime", __func__);
854  }
855 
856  /* There's no good way to detect an error in strftime since a return
857  * value of 0 isn't necessarily failure.
858  */
859  strftime(filename, PATH_MAX, orig_name, local_tm);
860  } else {
861  strncpy(filename, orig_name, PATH_MAX);
862  }
863 
864  if (cnt == 0 && max_chars == 0)
865  strncpy(buffer, filename, PATH_MAX + 1);
866  else
867  if (snprintf(buffer, PATH_MAX + 1, "%s%0*d", filename, max_chars, cnt) > PATH_MAX)
868  /* Report an error if the filename is too large */
869  error("too many output files or filename is too long (> %d)", PATH_MAX);
870  free(filename);
871 }
872 
873 static char *
874 get_next_file(FILE *VFile, char *ptr)
875 {
876  char *ret;
877  size_t len;
878 
879  ret = fgets(ptr, PATH_MAX, VFile);
880  if (!ret)
881  return NULL;
882 
883  len = strlen (ptr);
884  if (len > 0 && ptr[len - 1] == '\n')
885  ptr[len - 1] = '\0';
886 
887  return ret;
888 }
889 
890 #ifdef HAVE_CASPER
891 static cap_channel_t *
892 capdns_setup(void)
893 {
894  cap_channel_t *capcas, *capdnsloc;
895  const char *types[1];
896  int families[2];
897 
898  capcas = cap_init();
899  if (capcas == NULL)
900  error("unable to create casper process");
901  capdnsloc = cap_service_open(capcas, "system.dns");
902  /* Casper capability no longer needed. */
903  cap_close(capcas);
904  if (capdnsloc == NULL)
905  error("unable to open system.dns service");
906  /* Limit system.dns to reverse DNS lookups. */
907  types[0] = "ADDR";
908  if (cap_dns_type_limit(capdnsloc, types, 1) < 0)
909  error("unable to limit access to system.dns service");
910  families[0] = AF_INET;
911  families[1] = AF_INET6;
912  if (cap_dns_family_limit(capdnsloc, families, 2) < 0)
913  error("unable to limit access to system.dns service");
914 
915  return (capdnsloc);
916 }
917 #endif /* HAVE_CASPER */
918 
919 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
920 static int
921 tstamp_precision_from_string(const char *precision)
922 {
923  if (strncmp(precision, "nano", strlen("nano")) == 0)
924  return PCAP_TSTAMP_PRECISION_NANO;
925 
926  if (strncmp(precision, "micro", strlen("micro")) == 0)
927  return PCAP_TSTAMP_PRECISION_MICRO;
928 
929  return -EINVAL;
930 }
931 
932 static const char *
933 tstamp_precision_to_string(int precision)
934 {
935  switch (precision) {
936 
937  case PCAP_TSTAMP_PRECISION_MICRO:
938  return "micro";
939 
940  case PCAP_TSTAMP_PRECISION_NANO:
941  return "nano";
942 
943  default:
944  return "unknown";
945  }
946 }
947 #endif
948 
949 #ifdef HAVE_CAPSICUM
950 /*
951  * Ensure that, on a dump file's descriptor, we have all the rights
952  * necessary to make the standard I/O library work with an fdopen()ed
953  * FILE * from that descriptor.
954  *
955  * A long time ago in a galaxy far, far away, AT&T decided that, instead
956  * of providing separate APIs for getting and setting the FD_ flags on a
957  * descriptor, getting and setting the O_ flags on a descriptor, and
958  * locking files, they'd throw them all into a kitchen-sink fcntl() call
959  * along the lines of ioctl(), the fact that ioctl() operations are
960  * largely specific to particular character devices but fcntl() operations
961  * are either generic to all descriptors or generic to all descriptors for
962  * regular files nonwithstanding.
963  *
964  * The Capsicum people decided that fine-grained control of descriptor
965  * operations was required, so that you need to grant permission for
966  * reading, writing, seeking, and fcntl-ing. The latter, courtesy of
967  * AT&T's decision, means that "fcntl-ing" isn't a thing, but a motley
968  * collection of things, so there are *individual* fcntls for which
969  * permission needs to be granted.
970  *
971  * The FreeBSD standard I/O people implemented some optimizations that
972  * requires that the standard I/O routines be able to determine whether
973  * the descriptor for the FILE * is open append-only or not; as that
974  * descriptor could have come from an open() rather than an fopen(),
975  * that requires that it be able to do an F_GETFL fcntl() to read
976  * the O_ flags.
977  *
978  * Tcpdump uses ftell() to determine how much data has been written
979  * to a file in order to, when used with -C, determine when it's time
980  * to rotate capture files. ftell() therefore needs to do an lseek()
981  * to find out the file offset and must, thanks to the aforementioned
982  * optimization, also know whether the descriptor is open append-only
983  * or not.
984  *
985  * The net result of all the above is that we need to grant CAP_SEEK,
986  * CAP_WRITE, and CAP_FCNTL with the CAP_FCNTL_GETFL subcapability.
987  *
988  * Perhaps this is the universe's way of saying that either
989  *
990  * 1) there needs to be an fopenat() call and a pcap_dump_openat() call
991  * using it, so that Capsicum-capable tcpdump wouldn't need to do
992  * an fdopen()
993  *
994  * or
995  *
996  * 2) there needs to be a cap_fdopen() call in the FreeBSD standard
997  * I/O library that knows what rights are needed by the standard
998  * I/O library, based on the open mode, and assigns them, perhaps
999  * with an additional argument indicating, for example, whether
1000  * seeking should be allowed, so that tcpdump doesn't need to know
1001  * what the standard I/O library happens to require this week.
1002  */
1003 static void
1004 set_dumper_capsicum_rights(pcap_dumper_t *p)
1005 {
1006  int fd = fileno(pcap_dump_file(p));
1007  cap_rights_t rights;
1008 
1009  cap_rights_init(&rights, CAP_SEEK, CAP_WRITE, CAP_FCNTL);
1010  if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS) {
1011  error("unable to limit dump descriptor");
1012  }
1013  if (cap_fcntls_limit(fd, CAP_FCNTL_GETFL) < 0 && errno != ENOSYS) {
1014  error("unable to limit dump descriptor fcntls");
1015  }
1016 }
1017 #endif
1018 
1019 /*
1020  * Copy arg vector into a new buffer, concatenating arguments with spaces.
1021  */
1022 static char *
1023 copy_argv(char **argv)
1024 {
1025  char **p;
1026  size_t len = 0;
1027  char *buf;
1028  char *src, *dst;
1029 
1030  p = argv;
1031  if (*p == NULL)
1032  return 0;
1033 
1034  while (*p)
1035  len += strlen(*p++) + 1;
1036 
1037  buf = (char *)malloc(len);
1038  if (buf == NULL)
1039  error("%s: malloc", __func__);
1040 
1041  p = argv;
1042  dst = buf;
1043  while ((src = *p++) != NULL) {
1044  while ((*dst++ = *src++) != '\0')
1045  ;
1046  dst[-1] = ' ';
1047  }
1048  dst[-1] = '\0';
1049 
1050  return buf;
1051 }
1052 
1053 /*
1054  * On Windows, we need to open the file in binary mode, so that
1055  * we get all the bytes specified by the size we get from "fstat()".
1056  * On UNIX, that's not necessary. O_BINARY is defined on Windows;
1057  * we define it as 0 if it's not defined, so it does nothing.
1058  */
1059 #ifndef O_BINARY
1060 #define O_BINARY 0
1061 #endif
1062 
1063 static char *
1064 read_infile(char *fname)
1065 {
1066  int i, fd;
1067  ssize_t cc;
1068  char *cp;
1069  our_statb buf;
1070 
1071  fd = open(fname, O_RDONLY|O_BINARY);
1072  if (fd < 0)
1073  error("can't open %s: %s", fname, pcap_strerror(errno));
1074 
1075  if (our_fstat(fd, &buf) < 0)
1076  error("can't stat %s: %s", fname, pcap_strerror(errno));
1077 
1078  /*
1079  * Reject files whose size doesn't fit into an int; a filter
1080  * *that* large will probably be too big.
1081  */
1082  if (buf.st_size > INT_MAX)
1083  error("%s is too large", fname);
1084 
1085  cp = malloc((u_int)buf.st_size + 1);
1086  if (cp == NULL)
1087  error("malloc(%d) for %s: %s", (u_int)buf.st_size + 1,
1088  fname, pcap_strerror(errno));
1089  cc = read(fd, cp, (u_int)buf.st_size);
1090  if (cc < 0)
1091  error("read %s: %s", fname, pcap_strerror(errno));
1092  if (cc != buf.st_size)
1093  error("short read %s (%d != %d)", fname, (int) cc,
1094  (int)buf.st_size);
1095 
1096  close(fd);
1097  /* replace "# comment" with spaces */
1098  for (i = 0; i < cc; i++) {
1099  if (cp[i] == '#')
1100  while (i < cc && cp[i] != '\n')
1101  cp[i++] = ' ';
1102  }
1103  cp[cc] = '\0';
1104  return (cp);
1105 }
1106 
1107 #ifdef HAVE_PCAP_FINDALLDEVS
1108 static long
1109 parse_interface_number(const char *device)
1110 {
1111  const char *p;
1112  long devnum;
1113  char *end;
1114 
1115  /*
1116  * Search for a colon, terminating any scheme at the beginning
1117  * of the device.
1118  */
1119  p = strchr(device, ':');
1120  if (p != NULL) {
1121  /*
1122  * We found it. Is it followed by "//"?
1123  */
1124  p++; /* skip the : */
1125  if (strncmp(p, "//", 2) == 0) {
1126  /*
1127  * Yes. Search for the next /, at the end of the
1128  * authority part of the URL.
1129  */
1130  p += 2; /* skip the // */
1131  p = strchr(p, '/');
1132  if (p != NULL) {
1133  /*
1134  * OK, past the / is the path.
1135  */
1136  device = p + 1;
1137  }
1138  }
1139  }
1140  devnum = strtol(device, &end, 10);
1141  if (device != end && *end == '\0') {
1142  /*
1143  * It's all-numeric, but is it a valid number?
1144  */
1145  if (devnum <= 0) {
1146  /*
1147  * No, it's not an ordinal.
1148  */
1149  error("Invalid adapter index");
1150  }
1151  return (devnum);
1152  } else {
1153  /*
1154  * It's not all-numeric; return -1, so our caller
1155  * knows that.
1156  */
1157  return (-1);
1158  }
1159 }
1160 
1161 static char *
1162 find_interface_by_number(const char *url
1163 #ifndef HAVE_PCAP_FINDALLDEVS_EX
1164 _U_
1165 #endif
1166 , long devnum)
1167 {
1168  pcap_if_t *dev, *devlist;
1169  long i;
1170  char ebuf[PCAP_ERRBUF_SIZE];
1171  char *device;
1172 #ifdef HAVE_PCAP_FINDALLDEVS_EX
1173  const char *endp;
1174  char *host_url;
1175 #endif
1176  int status;
1177 
1178 #ifdef HAVE_PCAP_FINDALLDEVS_EX
1179  /*
1180  * Search for a colon, terminating any scheme at the beginning
1181  * of the URL.
1182  */
1183  endp = strchr(url, ':');
1184  if (endp != NULL) {
1185  /*
1186  * We found it. Is it followed by "//"?
1187  */
1188  endp++; /* skip the : */
1189  if (strncmp(endp, "//", 2) == 0) {
1190  /*
1191  * Yes. Search for the next /, at the end of the
1192  * authority part of the URL.
1193  */
1194  endp += 2; /* skip the // */
1195  endp = strchr(endp, '/');
1196  } else
1197  endp = NULL;
1198  }
1199  if (endp != NULL) {
1200  /*
1201  * OK, everything from device to endp is a URL to hand
1202  * to pcap_findalldevs_ex().
1203  */
1204  endp++; /* Include the trailing / in the URL; pcap_findalldevs_ex() requires it */
1205  host_url = malloc(endp - url + 1);
1206  if (host_url == NULL && (endp - url + 1) > 0)
1207  error("Invalid allocation for host");
1208 
1209  memcpy(host_url, url, endp - url);
1210  host_url[endp - url] = '\0';
1211  status = pcap_findalldevs_ex(host_url, NULL, &devlist, ebuf);
1212  free(host_url);
1213  } else
1214 #endif
1215  status = pcap_findalldevs(&devlist, ebuf);
1216  if (status < 0)
1217  error("%s", ebuf);
1218  /*
1219  * Look for the devnum-th entry in the list of devices (1-based).
1220  */
1221  for (i = 0, dev = devlist; i < devnum-1 && dev != NULL;
1222  i++, dev = dev->next)
1223  ;
1224  if (dev == NULL)
1225  error("Invalid adapter index");
1226  device = strdup(dev->name);
1227  pcap_freealldevs(devlist);
1228  return (device);
1229 }
1230 #endif
1231 
1232 #ifdef HAVE_PCAP_OPEN
1233 /*
1234  * Prefixes for rpcap URLs.
1235  */
1236 static char rpcap_prefix[] = "rpcap://";
1237 static char rpcap_ssl_prefix[] = "rpcaps://";
1238 #endif
1239 
1240 static pcap_t *
1241 open_interface(const char *device, netdissect_options *ndo, char *ebuf)
1242 {
1243  pcap_t *pc;
1244 #ifdef HAVE_PCAP_CREATE
1245  int status;
1246  char *cp;
1247 #endif
1248 
1249 #ifdef HAVE_PCAP_OPEN
1250  /*
1251  * Is this an rpcap URL?
1252  */
1253  if (strncmp(device, rpcap_prefix, sizeof(rpcap_prefix) - 1) == 0 ||
1254  strncmp(device, rpcap_ssl_prefix, sizeof(rpcap_ssl_prefix) - 1) == 0) {
1255  /*
1256  * Yes. Open it with pcap_open().
1257  */
1258  *ebuf = '\0';
1259  pc = pcap_open(device, ndo->ndo_snaplen,
1260  pflag ? 0 : PCAP_OPENFLAG_PROMISCUOUS, timeout, NULL,
1261  ebuf);
1262  if (pc == NULL) {
1263  /*
1264  * If this failed with "No such device" or "The system
1265  * cannot find the device specified", that means
1266  * the interface doesn't exist; return NULL, so that
1267  * the caller can see whether the device name is
1268  * actually an interface index.
1269  */
1270  if (strstr(ebuf, "No such device") != NULL ||
1271  strstr(ebuf, "The system cannot find the device specified") != NULL)
1272  return (NULL);
1273  error("%s", ebuf);
1274  }
1275  if (*ebuf)
1276  warning("%s", ebuf);
1277  return (pc);
1278  }
1279 #endif /* HAVE_PCAP_OPEN */
1280 
1281 #ifdef HAVE_PCAP_CREATE
1282  pc = pcap_create(device, ebuf);
1283  if (pc == NULL) {
1284  /*
1285  * If this failed with "No such device", that means
1286  * the interface doesn't exist; return NULL, so that
1287  * the caller can see whether the device name is
1288  * actually an interface index.
1289  */
1290  if (strstr(ebuf, "No such device") != NULL)
1291  return (NULL);
1292  error("%s", ebuf);
1293  }
1294 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1295  if (Jflag)
1296  show_tstamp_types_and_exit(pc, device);
1297 #endif
1298 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
1299  status = pcap_set_tstamp_precision(pc, ndo->ndo_tstamp_precision);
1300  if (status != 0)
1301  error("%s: Can't set %ssecond time stamp precision: %s",
1302  device,
1303  tstamp_precision_to_string(ndo->ndo_tstamp_precision),
1304  pcap_statustostr(status));
1305 #endif
1306 
1307 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
1308  if (immediate_mode) {
1309  status = pcap_set_immediate_mode(pc, 1);
1310  if (status != 0)
1311  error("%s: Can't set immediate mode: %s",
1312  device, pcap_statustostr(status));
1313  }
1314 #endif
1315  /*
1316  * Is this an interface that supports monitor mode?
1317  */
1318  if (pcap_can_set_rfmon(pc) == 1)
1320  else
1322  if (ndo->ndo_snaplen != 0) {
1323  /*
1324  * A snapshot length was explicitly specified;
1325  * use it.
1326  */
1327  status = pcap_set_snaplen(pc, ndo->ndo_snaplen);
1328  if (status != 0)
1329  error("%s: Can't set snapshot length: %s",
1330  device, pcap_statustostr(status));
1331  }
1332  status = pcap_set_promisc(pc, !pflag);
1333  if (status != 0)
1334  error("%s: Can't set promiscuous mode: %s",
1335  device, pcap_statustostr(status));
1336  if (Iflag) {
1337  status = pcap_set_rfmon(pc, 1);
1338  if (status != 0)
1339  error("%s: Can't set monitor mode: %s",
1340  device, pcap_statustostr(status));
1341  }
1342  status = pcap_set_timeout(pc, timeout);
1343  if (status != 0)
1344  error("%s: pcap_set_timeout failed: %s",
1345  device, pcap_statustostr(status));
1346  if (Bflag != 0) {
1347  status = pcap_set_buffer_size(pc, Bflag);
1348  if (status != 0)
1349  error("%s: Can't set buffer size: %s",
1350  device, pcap_statustostr(status));
1351  }
1352 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1353  if (jflag != -1) {
1354  status = pcap_set_tstamp_type(pc, jflag);
1355  if (status < 0)
1356  error("%s: Can't set time stamp type: %s",
1357  device, pcap_statustostr(status));
1358  else if (status > 0)
1359  warning("When trying to set timestamp type '%s' on %s: %s",
1360  pcap_tstamp_type_val_to_name(jflag), device,
1361  pcap_statustostr(status));
1362  }
1363 #endif
1364  status = pcap_activate(pc);
1365  if (status < 0) {
1366  /*
1367  * pcap_activate() failed.
1368  */
1369  cp = pcap_geterr(pc);
1370  if (status == PCAP_ERROR)
1371  error("%s", cp);
1372  else if (status == PCAP_ERROR_NO_SUCH_DEVICE) {
1373  /*
1374  * Return an error for our caller to handle.
1375  */
1376  snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s\n(%s)",
1377  device, pcap_statustostr(status), cp);
1378  } else if (status == PCAP_ERROR_PERM_DENIED && *cp != '\0')
1379  error("%s: %s\n(%s)", device,
1380  pcap_statustostr(status), cp);
1381 #ifdef __FreeBSD__
1382  else if (status == PCAP_ERROR_RFMON_NOTSUP &&
1383  strncmp(device, "wlan", 4) == 0) {
1384  char parent[8], newdev[8];
1385  char sysctl[32];
1386  size_t s = sizeof(parent);
1387 
1388  snprintf(sysctl, sizeof(sysctl),
1389  "net.wlan.%d.%%parent", atoi(device + 4));
1390  sysctlbyname(sysctl, parent, &s, NULL, 0);
1391  strlcpy(newdev, device, sizeof(newdev));
1392  /* Suggest a new wlan device. */
1393  /* FIXME: incrementing the index this way is not going to work well
1394  * when the index is 9 or greater but the only consequence in this
1395  * specific case would be an error message that looks a bit odd.
1396  */
1397  newdev[strlen(newdev)-1]++;
1398  error("%s is not a monitor mode VAP\n"
1399  "To create a new monitor mode VAP use:\n"
1400  " ifconfig %s create wlandev %s wlanmode monitor\n"
1401  "and use %s as the tcpdump interface",
1402  device, newdev, parent, newdev);
1403  }
1404 #endif
1405  else
1406  error("%s: %s", device,
1407  pcap_statustostr(status));
1408  pcap_close(pc);
1409  return (NULL);
1410  } else if (status > 0) {
1411  /*
1412  * pcap_activate() succeeded, but it's warning us
1413  * of a problem it had.
1414  */
1415  cp = pcap_geterr(pc);
1416  if (status == PCAP_WARNING)
1417  warning("%s", cp);
1418  else if (status == PCAP_WARNING_PROMISC_NOTSUP &&
1419  *cp != '\0')
1420  warning("%s: %s\n(%s)", device,
1421  pcap_statustostr(status), cp);
1422  else
1423  warning("%s: %s", device,
1424  pcap_statustostr(status));
1425  }
1426 #ifdef HAVE_PCAP_SETDIRECTION
1427  if (Qflag != -1) {
1428  status = pcap_setdirection(pc, Qflag);
1429  if (status != 0)
1430  error("%s: pcap_setdirection() failed: %s",
1431  device, pcap_geterr(pc));
1432  }
1433 #endif /* HAVE_PCAP_SETDIRECTION */
1434 #else /* HAVE_PCAP_CREATE */
1435  *ebuf = '\0';
1436  /*
1437  * If no snapshot length was specified, or a length of 0 was
1438  * specified, default to 256KB.
1439  */
1440  if (ndo->ndo_snaplen == 0)
1442  pc = pcap_open_live(device, ndo->ndo_snaplen, !pflag, timeout, ebuf);
1443  if (pc == NULL) {
1444  /*
1445  * If this failed with "No such device", that means
1446  * the interface doesn't exist; return NULL, so that
1447  * the caller can see whether the device name is
1448  * actually an interface index.
1449  */
1450  if (strstr(ebuf, "No such device") != NULL)
1451  return (NULL);
1452  error("%s", ebuf);
1453  }
1454  if (*ebuf)
1455  warning("%s", ebuf);
1456 #endif /* HAVE_PCAP_CREATE */
1457 
1458  return (pc);
1459 }
1460 
1461 int
1462 main(int argc, char **argv)
1463 {
1464  int cnt, op, i;
1465  bpf_u_int32 localnet = 0, netmask = 0;
1466  char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName;
1467  char *endp;
1468  pcap_handler callback;
1469  int dlt;
1470  const char *dlt_name;
1471  struct bpf_program fcode;
1472 #ifndef _WIN32
1473  void (*oldhandler)(int);
1474 #endif
1475  struct dump_info dumpinfo;
1476  u_char *pcap_userdata;
1477  char ebuf[PCAP_ERRBUF_SIZE];
1478  char VFileLine[PATH_MAX + 1];
1479  const char *username = NULL;
1480 #ifndef _WIN32
1481  const char *chroot_dir = NULL;
1482 #endif
1483  char *ret = NULL;
1484  char *end;
1485 #ifdef HAVE_PCAP_FINDALLDEVS
1486  pcap_if_t *devlist;
1487  long devnum;
1488 #endif
1489  int status;
1490  FILE *VFile;
1491 #ifdef HAVE_CAPSICUM
1492  cap_rights_t rights;
1493  int cansandbox;
1494 #endif /* HAVE_CAPSICUM */
1495  int Oflag = 1; /* run filter code optimizer */
1496  int yflag_dlt = -1;
1497  const char *yflag_dlt_name = NULL;
1498  int print = 0;
1499 
1500  netdissect_options Ndo;
1501  netdissect_options *ndo = &Ndo;
1502 
1503  /*
1504  * Initialize the netdissect code.
1505  */
1506  if (nd_init(ebuf, sizeof(ebuf)) == -1)
1507  error("%s", ebuf);
1508 
1509  memset(ndo, 0, sizeof(*ndo));
1511 
1512  cnt = -1;
1513  device = NULL;
1514  infile = NULL;
1515  RFileName = NULL;
1516  VFileName = NULL;
1517  VFile = NULL;
1518  WFileName = NULL;
1519  dlt = -1;
1520  if ((cp = strrchr(argv[0], PATH_SEPARATOR)) != NULL)
1521  ndo->program_name = program_name = cp + 1;
1522  else
1523  ndo->program_name = program_name = argv[0];
1524 
1525 #if defined(HAVE_PCAP_WSOCKINIT)
1526  if (pcap_wsockinit() != 0)
1527  error("Attempting to initialize Winsock failed");
1528 #elif defined(HAVE_WSOCKINIT)
1529  if (wsockinit() != 0)
1530  error("Attempting to initialize Winsock failed");
1531 #endif
1532 
1533  /*
1534  * On platforms where the CPU doesn't support unaligned loads,
1535  * force unaligned accesses to abort with SIGBUS, rather than
1536  * being fixed up (slowly) by the OS kernel; on those platforms,
1537  * misaligned accesses are bugs, and we want tcpdump to crash so
1538  * that the bugs are reported.
1539  */
1540  if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0)
1541  error("%s", ebuf);
1542 
1543  while (
1544  (op = getopt_long(argc, argv, SHORTOPTS, longopts, NULL)) != -1)
1545  switch (op) {
1546 
1547  case 'a':
1548  /* compatibility for old -a */
1549  break;
1550 
1551  case 'A':
1552  ++ndo->ndo_Aflag;
1553  break;
1554 
1555  case 'b':
1556  ++ndo->ndo_bflag;
1557  break;
1558 
1559 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
1560  case 'B':
1561  Bflag = atoi(optarg)*1024;
1562  if (Bflag <= 0)
1563  error("invalid packet buffer size %s", optarg);
1564  break;
1565 #endif /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */
1566 
1567  case 'c':
1568  cnt = atoi(optarg);
1569  if (cnt <= 0)
1570  error("invalid packet count %s", optarg);
1571  break;
1572 
1573  case 'C':
1574  errno = 0;
1575 #ifdef HAVE_PCAP_DUMP_FTELL64
1576  Cflag = strtoint64_t(optarg, &endp, 10);
1577 #else
1578  Cflag = strtol(optarg, &endp, 10);
1579 #endif
1580  if (endp == optarg || *endp != '\0' || errno != 0
1581  || Cflag <= 0)
1582  error("invalid file size %s", optarg);
1583  /*
1584  * Will multiplying it by 1000000 overflow?
1585  */
1586 #ifdef HAVE_PCAP_DUMP_FTELL64
1587  if (Cflag > INT64_T_CONSTANT(0x7fffffffffffffff) / 1000000)
1588 #else
1589  if (Cflag > LONG_MAX / 1000000)
1590 #endif
1591  error("file size %s is too large", optarg);
1592  Cflag *= 1000000;
1593  break;
1594 
1595  case 'd':
1596  ++dflag;
1597  break;
1598 
1599 #ifdef HAVE_PCAP_FINDALLDEVS
1600  case 'D':
1601  Dflag++;
1602  break;
1603 #endif
1604 
1605 #ifdef HAVE_PCAP_FINDALLDEVS_EX
1607  remote_interfaces_source = optarg;
1608  break;
1609 #endif
1610 
1611  case 'L':
1612  Lflag++;
1613  break;
1614 
1615  case 'e':
1616  ++ndo->ndo_eflag;
1617  break;
1618 
1619  case 'E':
1620 #ifndef HAVE_LIBCRYPTO
1621  warning("crypto code not compiled in");
1622 #endif
1624  break;
1625 
1626  case 'f':
1627  ++ndo->ndo_fflag;
1628  break;
1629 
1630  case 'F':
1631  infile = optarg;
1632  break;
1633 
1634  case 'G':
1635  Gflag = atoi(optarg);
1636  if (Gflag < 0)
1637  error("invalid number of seconds %s", optarg);
1638 
1639  /* We will create one file initially. */
1640  Gflag_count = 0;
1641 
1642  /* Grab the current time for rotation use. */
1643  if ((Gflag_time = time(NULL)) == (time_t)-1) {
1644  error("%s: can't get current time: %s",
1645  __func__, pcap_strerror(errno));
1646  }
1647  break;
1648 
1649  case 'h':
1650  print_usage(stdout);
1652  break;
1653 
1654  case 'H':
1655  ++ndo->ndo_Hflag;
1656  break;
1657 
1658  case 'i':
1659  device = optarg;
1660  break;
1661 
1662 #ifdef HAVE_PCAP_CREATE
1663  case 'I':
1664  ++Iflag;
1665  break;
1666 #endif /* HAVE_PCAP_CREATE */
1667 
1668 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1669  case 'j':
1670  jflag = pcap_tstamp_type_name_to_val(optarg);
1671  if (jflag < 0)
1672  error("invalid time stamp type %s", optarg);
1673  break;
1674 
1675  case 'J':
1676  Jflag++;
1677  break;
1678 #endif
1679 
1680  case 'l':
1681 #ifdef _WIN32
1682  /*
1683  * _IOLBF is the same as _IOFBF in Microsoft's C
1684  * libraries; the only alternative they offer
1685  * is _IONBF.
1686  *
1687  * XXX - this should really be checking for MSVC++,
1688  * not _WIN32, if, for example, MinGW has its own
1689  * C library that is more UNIX-compatible.
1690  */
1691  setvbuf(stdout, NULL, _IONBF, 0);
1692 #else /* _WIN32 */
1693 #ifdef HAVE_SETLINEBUF
1694  setlinebuf(stdout);
1695 #else
1696  setvbuf(stdout, NULL, _IOLBF, 0);
1697 #endif
1698 #endif /* _WIN32 */
1699  lflag = 1;
1700  break;
1701 
1702  case 'K':
1703  ++ndo->ndo_Kflag;
1704  break;
1705 
1706  case 'm':
1707  if (nd_have_smi_support()) {
1708  if (nd_load_smi_module(optarg, ebuf, sizeof(ebuf)) == -1)
1709  error("%s", ebuf);
1710  } else {
1711  (void)fprintf(stderr, "%s: ignoring option `-m %s' ",
1712  program_name, optarg);
1713  (void)fprintf(stderr, "(no libsmi support)\n");
1714  }
1715  break;
1716 
1717  case 'M':
1718  /* TCP-MD5 shared secret */
1719 #ifndef HAVE_LIBCRYPTO
1720  warning("crypto code not compiled in");
1721 #endif
1723  break;
1724 
1725  case 'n':
1726  ++ndo->ndo_nflag;
1727  break;
1728 
1729  case 'N':
1730  ++ndo->ndo_Nflag;
1731  break;
1732 
1733  case 'O':
1734  Oflag = 0;
1735  break;
1736 
1737  case 'p':
1738  ++pflag;
1739  break;
1740 
1741  case 'q':
1742  ++ndo->ndo_qflag;
1744  break;
1745 
1746 #ifdef HAVE_PCAP_SETDIRECTION
1747  case 'Q':
1748  if (ascii_strcasecmp(optarg, "in") == 0)
1749  Qflag = PCAP_D_IN;
1750  else if (ascii_strcasecmp(optarg, "out") == 0)
1751  Qflag = PCAP_D_OUT;
1752  else if (ascii_strcasecmp(optarg, "inout") == 0)
1753  Qflag = PCAP_D_INOUT;
1754  else
1755  error("unknown capture direction `%s'", optarg);
1756  break;
1757 #endif /* HAVE_PCAP_SETDIRECTION */
1758 
1759  case 'r':
1760  RFileName = optarg;
1761  break;
1762 
1763  case 's':
1764  ndo->ndo_snaplen = (int)strtol(optarg, &end, 0);
1765  if (optarg == end || *end != '\0'
1767  error("invalid snaplen %s (must be >= 0 and <= %d)",
1769  break;
1770 
1771  case 'S':
1772  ++ndo->ndo_Sflag;
1773  break;
1774 
1775  case 't':
1776  ++ndo->ndo_tflag;
1777  break;
1778 
1779  case 'T':
1780  if (ascii_strcasecmp(optarg, "vat") == 0)
1782  else if (ascii_strcasecmp(optarg, "wb") == 0)
1784  else if (ascii_strcasecmp(optarg, "rpc") == 0)
1786  else if (ascii_strcasecmp(optarg, "rtp") == 0)
1788  else if (ascii_strcasecmp(optarg, "rtcp") == 0)
1790  else if (ascii_strcasecmp(optarg, "snmp") == 0)
1792  else if (ascii_strcasecmp(optarg, "cnfp") == 0)
1794  else if (ascii_strcasecmp(optarg, "tftp") == 0)
1796  else if (ascii_strcasecmp(optarg, "aodv") == 0)
1798  else if (ascii_strcasecmp(optarg, "carp") == 0)
1800  else if (ascii_strcasecmp(optarg, "radius") == 0)
1802  else if (ascii_strcasecmp(optarg, "zmtp1") == 0)
1804  else if (ascii_strcasecmp(optarg, "vxlan") == 0)
1806  else if (ascii_strcasecmp(optarg, "pgm") == 0)
1808  else if (ascii_strcasecmp(optarg, "pgm_zmtp1") == 0)
1810  else if (ascii_strcasecmp(optarg, "lmp") == 0)
1812  else if (ascii_strcasecmp(optarg, "resp") == 0)
1814  else if (ascii_strcasecmp(optarg, "ptp") == 0)
1816  else if (ascii_strcasecmp(optarg, "someip") == 0)
1818  else if (ascii_strcasecmp(optarg, "domain") == 0)
1820  else
1821  error("unknown packet type `%s'", optarg);
1822  break;
1823 
1824  case 'u':
1825  ++ndo->ndo_uflag;
1826  break;
1827 
1828 #ifdef HAVE_PCAP_DUMP_FLUSH
1829  case 'U':
1830  ++Uflag;
1831  break;
1832 #endif
1833 
1834  case 'v':
1835  ++ndo->ndo_vflag;
1836  break;
1837 
1838  case 'V':
1839  VFileName = optarg;
1840  break;
1841 
1842  case 'w':
1843  WFileName = optarg;
1844  break;
1845 
1846  case 'W':
1847  Wflag = atoi(optarg);
1848  if (Wflag <= 0)
1849  error("invalid number of output files %s", optarg);
1851  break;
1852 
1853  case 'x':
1854  ++ndo->ndo_xflag;
1856  break;
1857 
1858  case 'X':
1859  ++ndo->ndo_Xflag;
1861  break;
1862 
1863  case 'y':
1864  yflag_dlt_name = optarg;
1865  yflag_dlt =
1866  pcap_datalink_name_to_val(yflag_dlt_name);
1867  if (yflag_dlt < 0)
1868  error("invalid data link type %s", yflag_dlt_name);
1869  break;
1870 
1871 #ifdef HAVE_PCAP_SET_PARSER_DEBUG
1872  case 'Y':
1873  {
1874  /* Undocumented flag */
1875  pcap_set_parser_debug(1);
1876  }
1877  break;
1878 #endif
1879  case 'z':
1880  zflag = optarg;
1881  break;
1882 
1883  case 'Z':
1884  username = optarg;
1885  break;
1886 
1887  case '#':
1888  ndo->ndo_packet_number = 1;
1889  break;
1890 
1891  case OPTION_VERSION:
1892  print_version(stdout);
1894  break;
1895 
1896 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
1898  ndo->ndo_tstamp_precision = tstamp_precision_from_string(optarg);
1899  if (ndo->ndo_tstamp_precision < 0)
1900  error("unsupported time stamp precision");
1901  break;
1902 #endif
1903 
1904 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
1905  case OPTION_IMMEDIATE_MODE:
1906  immediate_mode = 1;
1907  break;
1908 #endif
1909 
1910  case OPTION_PRINT:
1911  print = 1;
1912  break;
1913 
1914 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
1915  case OPTION_TSTAMP_MICRO:
1916  ndo->ndo_tstamp_precision = PCAP_TSTAMP_PRECISION_MICRO;
1917  break;
1918 
1919  case OPTION_TSTAMP_NANO:
1920  ndo->ndo_tstamp_precision = PCAP_TSTAMP_PRECISION_NANO;
1921  break;
1922 #endif
1923 
1924  case OPTION_FP_TYPE:
1925  /*
1926  * Print out the type of floating-point arithmetic
1927  * we're doing; it's probably IEEE, unless somebody
1928  * tries to run this on a VAX, but the precision
1929  * may differ (e.g., it might be 32-bit, 64-bit,
1930  * or 80-bit).
1931  */
1932  float_type_check(0x4e93312d);
1933  return 0;
1934 
1935  case OPTION_COUNT:
1936  count_mode = 1;
1937  break;
1938 
1939  default:
1940  print_usage(stderr);
1942  /* NOTREACHED */
1943  }
1944 
1945 #ifdef HAVE_PCAP_FINDALLDEVS
1946  if (Dflag)
1947  show_devices_and_exit();
1948 #endif
1949 #ifdef HAVE_PCAP_FINDALLDEVS_EX
1950  if (remote_interfaces_source != NULL)
1951  show_remote_devices_and_exit();
1952 #endif
1953 
1954 #if defined(DLT_LINUX_SLL2) && defined(HAVE_PCAP_SET_DATALINK)
1955 /* Set default linktype DLT_LINUX_SLL2 when capturing on the "any" device */
1956  if (device != NULL &&
1957  strncmp (device, "any", strlen("any")) == 0
1958  && yflag_dlt == -1)
1959  yflag_dlt = DLT_LINUX_SLL2;
1960 #endif
1961 
1962  switch (ndo->ndo_tflag) {
1963 
1964  case 0: /* Default */
1965  case 1: /* No time stamp */
1966  case 2: /* Unix timeval style */
1967  case 3: /* Microseconds/nanoseconds since previous packet */
1968  case 4: /* Date + Default */
1969  case 5: /* Microseconds/nanoseconds since first packet */
1970  break;
1971 
1972  default: /* Not supported */
1973  error("only -t, -tt, -ttt, -tttt and -ttttt are supported");
1974  break;
1975  }
1976 
1977  if (ndo->ndo_fflag != 0 && (VFileName != NULL || RFileName != NULL))
1978  error("-f can not be used with -V or -r");
1979 
1980  if (VFileName != NULL && RFileName != NULL)
1981  error("-V and -r are mutually exclusive.");
1982 
1983  /*
1984  * If we're printing dissected packets to the standard output,
1985  * and either the standard output is a terminal or we're doing
1986  * "line" buffering, set the capture timeout to .1 second rather
1987  * than 1 second, as the user's probably expecting to see packets
1988  * pop up immediately shortly after they arrive.
1989  *
1990  * XXX - would there be some value appropriate for all cases,
1991  * based on, say, the buffer size and packet input rate?
1992  */
1993  if ((WFileName == NULL || print) && (isatty(1) || lflag))
1994  timeout = 100;
1995 
1996 #ifdef WITH_CHROOT
1997  /* if run as root, prepare for chrooting */
1998  if (getuid() == 0 || geteuid() == 0) {
1999  /* future extensibility for cmd-line arguments */
2000  if (!chroot_dir)
2001  chroot_dir = WITH_CHROOT;
2002  }
2003 #endif
2004 
2005 #ifdef WITH_USER
2006  /* if run as root, prepare for dropping root privileges */
2007  if (getuid() == 0 || geteuid() == 0) {
2008  /* Run with '-Z root' to restore old behaviour */
2009  if (!username)
2010  username = WITH_USER;
2011  }
2012 #endif
2013 
2014  if (RFileName != NULL || VFileName != NULL) {
2015  /*
2016  * If RFileName is non-null, it's the pathname of a
2017  * savefile to read. If VFileName is non-null, it's
2018  * the pathname of a file containing a list of pathnames
2019  * (one per line) of savefiles to read.
2020  *
2021  * In either case, we're reading a savefile, not doing
2022  * a live capture.
2023  */
2024 #ifndef _WIN32
2025  /*
2026  * We don't need network access, so relinquish any set-UID
2027  * or set-GID privileges we have (if any).
2028  *
2029  * We do *not* want set-UID privileges when opening a
2030  * trace file, as that might let the user read other
2031  * people's trace files (especially if we're set-UID
2032  * root).
2033  */
2034  if (setgid(getgid()) != 0 || setuid(getuid()) != 0 )
2035  fprintf(stderr, "Warning: setgid/setuid failed !\n");
2036 #endif /* _WIN32 */
2037  if (VFileName != NULL) {
2038  if (VFileName[0] == '-' && VFileName[1] == '\0')
2039  VFile = stdin;
2040  else
2041  VFile = fopen(VFileName, "r");
2042 
2043  if (VFile == NULL)
2044  error("Unable to open file: %s\n", pcap_strerror(errno));
2045 
2046  ret = get_next_file(VFile, VFileLine);
2047  if (!ret)
2048  error("Nothing in %s\n", VFileName);
2049  RFileName = VFileLine;
2050  }
2051 
2052 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
2053  pd = pcap_open_offline_with_tstamp_precision(RFileName,
2054  ndo->ndo_tstamp_precision, ebuf);
2055 #else
2056  pd = pcap_open_offline(RFileName, ebuf);
2057 #endif
2058 
2059  if (pd == NULL)
2060  error("%s", ebuf);
2061 #ifdef HAVE_CAPSICUM
2062  cap_rights_init(&rights, CAP_READ);
2063  if (cap_rights_limit(fileno(pcap_file(pd)), &rights) < 0 &&
2064  errno != ENOSYS) {
2065  error("unable to limit pcap descriptor");
2066  }
2067 #endif
2068  dlt = pcap_datalink(pd);
2069  dlt_name = pcap_datalink_val_to_name(dlt);
2070  fprintf(stderr, "reading from file %s", RFileName);
2071  if (dlt_name == NULL) {
2072  fprintf(stderr, ", link-type %u", dlt);
2073  } else {
2074  fprintf(stderr, ", link-type %s (%s)", dlt_name,
2076  }
2077  fprintf(stderr, ", snapshot length %d\n", pcap_snapshot(pd));
2078 #ifdef DLT_LINUX_SLL2
2079  if (dlt == DLT_LINUX_SLL2)
2080  fprintf(stderr, "Warning: interface names might be incorrect\n");
2081 #endif
2082  } else if (dflag && !device) {
2083  int dump_dlt = DLT_EN10MB;
2084  /*
2085  * We're dumping the compiled code without an explicit
2086  * device specification. (If a device is specified, we
2087  * definitely want to open it to use the DLT of that device.)
2088  * Either default to DLT_EN10MB with a warning, or use
2089  * the user-specified value if supplied.
2090  */
2091  /*
2092  * If no snapshot length was specified, or a length of 0 was
2093  * specified, default to 256KB.
2094  */
2095  if (ndo->ndo_snaplen == 0)
2097  /*
2098  * If a DLT was specified with the -y flag, use that instead.
2099  */
2100  if (yflag_dlt != -1)
2101  dump_dlt = yflag_dlt;
2102  else
2103  fprintf(stderr, "Warning: assuming Ethernet\n");
2104  pd = pcap_open_dead(dump_dlt, ndo->ndo_snaplen);
2105  } else {
2106  /*
2107  * We're doing a live capture.
2108  */
2109  if (device == NULL) {
2110  /*
2111  * No interface was specified. Pick one.
2112  */
2113 #ifdef HAVE_PCAP_FINDALLDEVS
2114  /*
2115  * Find the list of interfaces, and pick
2116  * the first interface.
2117  */
2118  if (pcap_findalldevs(&devlist, ebuf) == -1)
2119  error("%s", ebuf);
2120  if (devlist == NULL)
2121  error("no interfaces available for capture");
2122  device = strdup(devlist->name);
2123  pcap_freealldevs(devlist);
2124 #else /* HAVE_PCAP_FINDALLDEVS */
2125  /*
2126  * Use whatever interface pcap_lookupdev()
2127  * chooses.
2128  */
2129  device = pcap_lookupdev(ebuf);
2130  if (device == NULL)
2131  error("%s", ebuf);
2132 #endif
2133  }
2134 
2135  /*
2136  * Try to open the interface with the specified name.
2137  */
2138  pd = open_interface(device, ndo, ebuf);
2139  if (pd == NULL) {
2140  /*
2141  * That failed. If we can get a list of
2142  * interfaces, and the interface name
2143  * is purely numeric, try to use it as
2144  * a 1-based index in the list of
2145  * interfaces.
2146  */
2147 #ifdef HAVE_PCAP_FINDALLDEVS
2148  devnum = parse_interface_number(device);
2149  if (devnum == -1) {
2150  /*
2151  * It's not a number; just report
2152  * the open error and fail.
2153  */
2154  error("%s", ebuf);
2155  }
2156 
2157  /*
2158  * OK, it's a number; try to find the
2159  * interface with that index, and try
2160  * to open it.
2161  *
2162  * find_interface_by_number() exits if it
2163  * couldn't be found.
2164  */
2165  device = find_interface_by_number(device, devnum);
2166  pd = open_interface(device, ndo, ebuf);
2167  if (pd == NULL)
2168  error("%s", ebuf);
2169 #else /* HAVE_PCAP_FINDALLDEVS */
2170  /*
2171  * We can't get a list of interfaces; just
2172  * fail.
2173  */
2174  error("%s", ebuf);
2175 #endif /* HAVE_PCAP_FINDALLDEVS */
2176  }
2177 
2178  /*
2179  * Let user own process after capture device has
2180  * been opened.
2181  */
2182 #ifndef _WIN32
2183  if (setgid(getgid()) != 0 || setuid(getuid()) != 0)
2184  fprintf(stderr, "Warning: setgid/setuid failed !\n");
2185 #endif /* _WIN32 */
2186 #if !defined(HAVE_PCAP_CREATE) && defined(_WIN32)
2187  if(Bflag != 0)
2188  if(pcap_setbuff(pd, Bflag)==-1){
2189  error("%s", pcap_geterr(pd));
2190  }
2191 #endif /* !defined(HAVE_PCAP_CREATE) && defined(_WIN32) */
2192  if (Lflag)
2193  show_dlts_and_exit(pd, device);
2194  if (yflag_dlt >= 0) {
2195 #ifdef HAVE_PCAP_SET_DATALINK
2196  if (pcap_set_datalink(pd, yflag_dlt) < 0)
2197  error("%s", pcap_geterr(pd));
2198 #else
2199  /*
2200  * We don't actually support changing the
2201  * data link type, so we only let them
2202  * set it to what it already is.
2203  */
2204  if (yflag_dlt != pcap_datalink(pd)) {
2205  error("%s is not one of the DLTs supported by this device\n",
2206  yflag_dlt_name);
2207  }
2208 #endif
2209  (void)fprintf(stderr, "%s: data link type %s\n",
2210  program_name,
2211  pcap_datalink_val_to_name(yflag_dlt));
2212  (void)fflush(stderr);
2213  }
2214  i = pcap_snapshot(pd);
2215  if (ndo->ndo_snaplen < i) {
2216  if (ndo->ndo_snaplen != 0)
2217  warning("snaplen raised from %d to %d", ndo->ndo_snaplen, i);
2218  ndo->ndo_snaplen = i;
2219  } else if (ndo->ndo_snaplen > i) {
2220  warning("snaplen lowered from %d to %d", ndo->ndo_snaplen, i);
2221  ndo->ndo_snaplen = i;
2222  }
2223  if(ndo->ndo_fflag != 0) {
2224  if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) {
2225  warning("foreign (-f) flag used but: %s", ebuf);
2226  }
2227  }
2228 
2229  }
2230  if (infile)
2231  cmdbuf = read_infile(infile);
2232  else
2233  cmdbuf = copy_argv(&argv[optind]);
2234 
2235 #ifdef HAVE_PCAP_SET_OPTIMIZER_DEBUG
2236  pcap_set_optimizer_debug(dflag);
2237 #endif
2238  if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
2239  error("%s", pcap_geterr(pd));
2240  if (dflag) {
2241  bpf_dump(&fcode, dflag);
2242  pcap_close(pd);
2243  free(cmdbuf);
2244  pcap_freecode(&fcode);
2246  }
2247 
2248 #ifdef HAVE_CASPER
2249  if (!ndo->ndo_nflag)
2250  capdns = capdns_setup();
2251 #endif /* HAVE_CASPER */
2252 
2253  init_print(ndo, localnet, netmask);
2254 
2255 #ifndef _WIN32
2256  (void)setsignal(SIGPIPE, cleanup);
2257  (void)setsignal(SIGTERM, cleanup);
2258 #endif /* _WIN32 */
2259  (void)setsignal(SIGINT, cleanup);
2260 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
2261  (void)setsignal(SIGCHLD, child_cleanup);
2262 #endif
2263  /* Cooperate with nohup(1) */
2264 #ifndef _WIN32
2265  if ((oldhandler = setsignal(SIGHUP, cleanup)) != SIG_DFL)
2266  (void)setsignal(SIGHUP, oldhandler);
2267 #endif /* _WIN32 */
2268 
2269 #ifndef _WIN32
2270  /*
2271  * If a user name was specified with "-Z", attempt to switch to
2272  * that user's UID. This would probably be used with sudo,
2273  * to allow tcpdump to be run in a special restricted
2274  * account (if you just want to allow users to open capture
2275  * devices, and can't just give users that permission,
2276  * you'd make tcpdump set-UID or set-GID).
2277  *
2278  * Tcpdump doesn't necessarily write only to one savefile;
2279  * the general only way to allow a -Z instance to write to
2280  * savefiles as the user under whose UID it's run, rather
2281  * than as the user specified with -Z, would thus be to switch
2282  * to the original user ID before opening a capture file and
2283  * then switch back to the -Z user ID after opening the savefile.
2284  * Switching to the -Z user ID only after opening the first
2285  * savefile doesn't handle the general case.
2286  */
2287 
2288  if (getuid() == 0 || geteuid() == 0) {
2289 #ifdef HAVE_LIBCAP_NG
2290  /* Initialize capng */
2291  capng_clear(CAPNG_SELECT_BOTH);
2292  if (username) {
2293 DIAG_OFF_CLANG(assign-enum)
2294  capng_updatev(
2295  CAPNG_ADD,
2296  CAPNG_PERMITTED | CAPNG_EFFECTIVE,
2297  CAP_SETUID,
2298  CAP_SETGID,
2299  -1);
2300 DIAG_ON_CLANG(assign-enum)
2301  }
2302  if (chroot_dir) {
2303 DIAG_OFF_CLANG(assign-enum)
2304  capng_update(
2305  CAPNG_ADD,
2306  CAPNG_PERMITTED | CAPNG_EFFECTIVE,
2307  CAP_SYS_CHROOT
2308  );
2309 DIAG_ON_CLANG(assign-enum)
2310  }
2311 
2312  if (WFileName) {
2313 DIAG_OFF_CLANG(assign-enum)
2314  capng_update(
2315  CAPNG_ADD,
2316  CAPNG_PERMITTED | CAPNG_EFFECTIVE,
2317  CAP_DAC_OVERRIDE
2318  );
2319 DIAG_ON_CLANG(assign-enum)
2320  }
2321  capng_apply(CAPNG_SELECT_BOTH);
2322 #endif /* HAVE_LIBCAP_NG */
2323  if (username || chroot_dir)
2324  droproot(username, chroot_dir);
2325 
2326  }
2327 #endif /* _WIN32 */
2328 
2329  if (pcap_setfilter(pd, &fcode) < 0)
2330  error("%s", pcap_geterr(pd));
2331 #ifdef HAVE_CAPSICUM
2332  if (RFileName == NULL && VFileName == NULL && pcap_fileno(pd) != -1) {
2333  static const unsigned long cmds[] = { BIOCGSTATS, BIOCROTZBUF };
2334 
2335  /*
2336  * The various libpcap devices use a combination of
2337  * read (bpf), ioctl (bpf, netmap), poll (netmap)
2338  * so we add the relevant access rights.
2339  */
2340  cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_EVENT);
2341  if (cap_rights_limit(pcap_fileno(pd), &rights) < 0 &&
2342  errno != ENOSYS) {
2343  error("unable to limit pcap descriptor");
2344  }
2345  if (cap_ioctls_limit(pcap_fileno(pd), cmds,
2346  sizeof(cmds) / sizeof(cmds[0])) < 0 && errno != ENOSYS) {
2347  error("unable to limit ioctls on pcap descriptor");
2348  }
2349  }
2350 #endif
2351  if (WFileName) {
2352  /* Do not exceed the default PATH_MAX for files. */
2353  dumpinfo.CurrentFileName = (char *)malloc(PATH_MAX + 1);
2354 
2355  if (dumpinfo.CurrentFileName == NULL)
2356  error("malloc of dumpinfo.CurrentFileName");
2357 
2358  /* We do not need numbering for dumpfiles if Cflag isn't set. */
2359  if (Cflag != 0)
2361  else
2362  MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0);
2363 
2364  pdd = pcap_dump_open(pd, dumpinfo.CurrentFileName);
2365 #ifdef HAVE_LIBCAP_NG
2366  /* Give up CAP_DAC_OVERRIDE capability.
2367  * Only allow it to be restored if the -C or -G flag have been
2368  * set since we may need to create more files later on.
2369  */
2370  capng_update(
2371  CAPNG_DROP,
2372  (Cflag || Gflag ? 0 : CAPNG_PERMITTED)
2373  | CAPNG_EFFECTIVE,
2374  CAP_DAC_OVERRIDE
2375  );
2376  capng_apply(CAPNG_SELECT_BOTH);
2377 #endif /* HAVE_LIBCAP_NG */
2378  if (pdd == NULL)
2379  error("%s", pcap_geterr(pd));
2380 #ifdef HAVE_CAPSICUM
2381  set_dumper_capsicum_rights(pdd);
2382 #endif
2383  if (Cflag != 0 || Gflag != 0) {
2384 #ifdef HAVE_CAPSICUM
2385  dumpinfo.WFileName = strdup(basename(WFileName));
2386  if (dumpinfo.WFileName == NULL) {
2387  error("Unable to allocate memory for file %s",
2388  WFileName);
2389  }
2390  dumpinfo.dirfd = open(dirname(WFileName),
2391  O_DIRECTORY | O_RDONLY);
2392  if (dumpinfo.dirfd < 0) {
2393  error("unable to open directory %s",
2394  dirname(WFileName));
2395  }
2396  cap_rights_init(&rights, CAP_CREATE, CAP_FCNTL,
2397  CAP_FTRUNCATE, CAP_LOOKUP, CAP_SEEK, CAP_WRITE);
2398  if (cap_rights_limit(dumpinfo.dirfd, &rights) < 0 &&
2399  errno != ENOSYS) {
2400  error("unable to limit directory rights");
2401  }
2402  if (cap_fcntls_limit(dumpinfo.dirfd, CAP_FCNTL_GETFL) < 0 &&
2403  errno != ENOSYS) {
2404  error("unable to limit dump descriptor fcntls");
2405  }
2406 #else /* !HAVE_CAPSICUM */
2407  dumpinfo.WFileName = WFileName;
2408 #endif
2409  callback = dump_packet_and_trunc;
2410  dumpinfo.pd = pd;
2411  dumpinfo.pdd = pdd;
2412  pcap_userdata = (u_char *)&dumpinfo;
2413  } else {
2414  callback = dump_packet;
2415  dumpinfo.WFileName = WFileName;
2416  dumpinfo.pd = pd;
2417  dumpinfo.pdd = pdd;
2418  pcap_userdata = (u_char *)&dumpinfo;
2419  }
2420  if (print) {
2421  dlt = pcap_datalink(pd);
2423  dumpinfo.ndo = ndo;
2424  } else
2425  dumpinfo.ndo = NULL;
2426 
2427 #ifdef HAVE_PCAP_DUMP_FLUSH
2428  if (Uflag)
2429  pcap_dump_flush(pdd);
2430 #endif
2431  } else {
2432  dlt = pcap_datalink(pd);
2434  callback = print_packet;
2435  pcap_userdata = (u_char *)ndo;
2436  }
2437 
2438 #ifdef SIGNAL_REQ_INFO
2439  /*
2440  * We can't get statistics when reading from a file rather
2441  * than capturing from a device.
2442  */
2443  if (RFileName == NULL)
2444  (void)setsignal(SIGNAL_REQ_INFO, requestinfo);
2445 #endif
2446 #ifdef SIGNAL_FLUSH_PCAP
2447  (void)setsignal(SIGNAL_FLUSH_PCAP, flushpcap);
2448 #endif
2449 
2450  if (ndo->ndo_vflag > 0 && WFileName && RFileName == NULL && !print) {
2451  /*
2452  * When capturing to a file, if "--print" wasn't specified,
2453  *"-v" means tcpdump should, once per second,
2454  * "v"erbosely report the number of packets captured.
2455  * Except when reading from a file, because -r, -w and -v
2456  * together used to make a corner case, in which pcap_loop()
2457  * errored due to EINTR (see GH #155 for details).
2458  */
2459 #ifdef _WIN32
2460  /*
2461  * https://blogs.msdn.microsoft.com/oldnewthing/20151230-00/?p=92741
2462  *
2463  * suggests that this dates back to W2K.
2464  *
2465  * I don't know what a "long wait" is, but we'll assume
2466  * that printing the stats could be a "long wait".
2467  */
2468  CreateTimerQueueTimer(&timer_handle, NULL,
2469  verbose_stats_dump, NULL, 1000, 1000,
2470  WT_EXECUTEDEFAULT|WT_EXECUTELONGFUNCTION);
2471  setvbuf(stderr, NULL, _IONBF, 0);
2472 #else /* _WIN32 */
2473  /*
2474  * Assume this is UN*X, and that it has setitimer(); that
2475  * dates back to UNIX 95.
2476  */
2477  struct itimerval timer;
2478  (void)setsignal(SIGALRM, verbose_stats_dump);
2479  timer.it_interval.tv_sec = 1;
2480  timer.it_interval.tv_usec = 0;
2481  timer.it_value.tv_sec = 1;
2482  timer.it_value.tv_usec = 1;
2483  setitimer(ITIMER_REAL, &timer, NULL);
2484 #endif /* _WIN32 */
2485  }
2486 
2487  if (RFileName == NULL) {
2488  /*
2489  * Live capture (if -V was specified, we set RFileName
2490  * to a file from the -V file). Print a message to
2491  * the standard error on UN*X.
2492  */
2493  if (!ndo->ndo_vflag && !WFileName) {
2494  (void)fprintf(stderr,
2495  "%s: verbose output suppressed, use -v[v]... for full protocol decode\n",
2496  program_name);
2497  } else
2498  (void)fprintf(stderr, "%s: ", program_name);
2499  dlt = pcap_datalink(pd);
2500  dlt_name = pcap_datalink_val_to_name(dlt);
2501  (void)fprintf(stderr, "listening on %s", device);
2502  if (dlt_name == NULL) {
2503  (void)fprintf(stderr, ", link-type %u", dlt);
2504  } else {
2505  (void)fprintf(stderr, ", link-type %s (%s)", dlt_name,
2507  }
2508  (void)fprintf(stderr, ", snapshot length %d bytes\n", ndo->ndo_snaplen);
2509  (void)fflush(stderr);
2510  }
2511 
2512 #ifdef HAVE_CAPSICUM
2513  cansandbox = (VFileName == NULL && zflag == NULL);
2514 #ifdef HAVE_CASPER
2515  cansandbox = (cansandbox && (ndo->ndo_nflag || capdns != NULL));
2516 #else
2517  cansandbox = (cansandbox && ndo->ndo_nflag);
2518 #endif /* HAVE_CASPER */
2519  if (cansandbox && cap_enter() < 0 && errno != ENOSYS)
2520  error("unable to enter the capability mode");
2521 #endif /* HAVE_CAPSICUM */
2522 
2523  do {
2524  status = pcap_loop(pd, cnt, callback, pcap_userdata);
2525  if (WFileName == NULL) {
2526  /*
2527  * We're printing packets. Flush the printed output,
2528  * so it doesn't get intermingled with error output.
2529  */
2530  if (status == -2) {
2531  /*
2532  * We got interrupted, so perhaps we didn't
2533  * manage to finish a line we were printing.
2534  * Print an extra newline, just in case.
2535  */
2536  putchar('\n');
2537  }
2538  (void)fflush(stdout);
2539  }
2540  if (status == -2) {
2541  /*
2542  * We got interrupted. If we are reading multiple
2543  * files (via -V) set these so that we stop.
2544  */
2545  VFileName = NULL;
2546  ret = NULL;
2547  }
2548  if (status == -1) {
2549  /*
2550  * Error. Report it.
2551  */
2552  (void)fprintf(stderr, "%s: pcap_loop: %s\n",
2553  program_name, pcap_geterr(pd));
2554  }
2555  if (RFileName == NULL) {
2556  /*
2557  * We're doing a live capture. Report the capture
2558  * statistics.
2559  */
2560  info(1);
2561  }
2562  pcap_close(pd);
2563  if (VFileName != NULL) {
2564  ret = get_next_file(VFile, VFileLine);
2565  if (ret) {
2566  int new_dlt;
2567 
2568  RFileName = VFileLine;
2569  pd = pcap_open_offline(RFileName, ebuf);
2570  if (pd == NULL)
2571  error("%s", ebuf);
2572 #ifdef HAVE_CAPSICUM
2573  cap_rights_init(&rights, CAP_READ);
2574  if (cap_rights_limit(fileno(pcap_file(pd)),
2575  &rights) < 0 && errno != ENOSYS) {
2576  error("unable to limit pcap descriptor");
2577  }
2578 #endif
2579  new_dlt = pcap_datalink(pd);
2580  if (new_dlt != dlt) {
2581  /*
2582  * The new file has a different
2583  * link-layer header type from the
2584  * previous one.
2585  */
2586  if (WFileName != NULL) {
2587  /*
2588  * We're writing raw packets
2589  * that match the filter to
2590  * a pcap file. pcap files
2591  * don't support multiple
2592  * different link-layer
2593  * header types, so we fail
2594  * here.
2595  */
2596  error("%s: new dlt does not match original", RFileName);
2597  }
2598 
2599  /*
2600  * We're printing the decoded packets;
2601  * switch to the new DLT.
2602  *
2603  * To do that, we need to change
2604  * the printer, change the DLT name,
2605  * and recompile the filter with
2606  * the new DLT.
2607  */
2608  dlt = new_dlt;
2609  ndo->ndo_if_printer = get_if_printer(dlt);
2610  if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
2611  error("%s", pcap_geterr(pd));
2612  }
2613 
2614  /*
2615  * Set the filter on the new file.
2616  */
2617  if (pcap_setfilter(pd, &fcode) < 0)
2618  error("%s", pcap_geterr(pd));
2619 
2620  /*
2621  * Report the new file.
2622  */
2623  dlt_name = pcap_datalink_val_to_name(dlt);
2624  fprintf(stderr, "reading from file %s", RFileName);
2625  if (dlt_name == NULL) {
2626  fprintf(stderr, ", link-type %u", dlt);
2627  } else {
2628  fprintf(stderr, ", link-type %s (%s)",
2629  dlt_name,
2631  }
2632  fprintf(stderr, ", snapshot length %d\n", pcap_snapshot(pd));
2633  }
2634  }
2635  }
2636  while (ret != NULL);
2637 
2638  if (count_mode && RFileName != NULL)
2639  fprintf(stdout, "%u packet%s\n", packets_captured,
2641 
2642  free(cmdbuf);
2643  pcap_freecode(&fcode);
2644  exit_tcpdump(status == -1 ? 1 : 0);
2645 }
2646 
2647 /*
2648  * Catch a signal.
2649  */
2650 static void
2651 (*setsignal (int sig, void (*func)(int)))(int)
2652 {
2653 #ifdef _WIN32
2654  return (signal(sig, func));
2655 #else
2656  struct sigaction old, new;
2657 
2658  memset(&new, 0, sizeof(new));
2659  new.sa_handler = func;
2660  if (sig == SIGCHLD)
2661  new.sa_flags = SA_RESTART;
2662  if (sigaction(sig, &new, &old) < 0)
2663  return (SIG_ERR);
2664  return (old.sa_handler);
2665 #endif
2666 }
2667 
2668 /* make a clean exit on interrupts */
2669 static void
2670 cleanup(int signo _U_)
2671 {
2672 #ifdef _WIN32
2673  if (timer_handle != INVALID_HANDLE_VALUE) {
2674  DeleteTimerQueueTimer(NULL, timer_handle, NULL);
2675  CloseHandle(timer_handle);
2676  timer_handle = INVALID_HANDLE_VALUE;
2677  }
2678 #else /* _WIN32 */
2679  struct itimerval timer;
2680 
2681  timer.it_interval.tv_sec = 0;
2682  timer.it_interval.tv_usec = 0;
2683  timer.it_value.tv_sec = 0;
2684  timer.it_value.tv_usec = 0;
2685  setitimer(ITIMER_REAL, &timer, NULL);
2686 #endif /* _WIN32 */
2687 
2688 #ifdef HAVE_PCAP_BREAKLOOP
2689  /*
2690  * We have "pcap_breakloop()"; use it, so that we do as little
2691  * as possible in the signal handler (it's probably not safe
2692  * to do anything with standard I/O streams in a signal handler -
2693  * the ANSI C standard doesn't say it is).
2694  */
2695  pcap_breakloop(pd);
2696 #else
2697  /*
2698  * We don't have "pcap_breakloop()"; this isn't safe, but
2699  * it's the best we can do. Print the summary if we're
2700  * not reading from a savefile - i.e., if we're doing a
2701  * live capture - and exit.
2702  */
2703  if (pd != NULL && pcap_file(pd) == NULL) {
2704  /*
2705  * We got interrupted, so perhaps we didn't
2706  * manage to finish a line we were printing.
2707  * Print an extra newline, just in case.
2708  */
2709  putchar('\n');
2710  (void)fflush(stdout);
2711  info(1);
2712  }
2714 #endif
2715 }
2716 
2717 /*
2718  On windows, we do not use a fork, so we do not care less about
2719  waiting a child processes to die
2720  */
2721 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
2722 static void
2723 child_cleanup(int signo _U_)
2724 {
2725  wait(NULL);
2726 }
2727 #endif /* HAVE_FORK && HAVE_VFORK */
2728 
2729 static void
2730 info(int verbose)
2731 {
2732  struct pcap_stat stats;
2733 
2734  /*
2735  * Older versions of libpcap didn't set ps_ifdrop on some
2736  * platforms; initialize it to 0 to handle that.
2737  */
2738  stats.ps_ifdrop = 0;
2739  if (pcap_stats(pd, &stats) < 0) {
2740  (void)fprintf(stderr, "pcap_stats: %s\n", pcap_geterr(pd));
2741  infoprint = 0;
2742  return;
2743  }
2744 
2745  if (!verbose)
2746  fprintf(stderr, "%s: ", program_name);
2747 
2748  (void)fprintf(stderr, "%u packet%s captured", packets_captured,
2750  if (!verbose)
2751  fputs(", ", stderr);
2752  else
2753  putc('\n', stderr);
2754  (void)fprintf(stderr, "%u packet%s received by filter", stats.ps_recv,
2755  PLURAL_SUFFIX(stats.ps_recv));
2756  if (!verbose)
2757  fputs(", ", stderr);
2758  else
2759  putc('\n', stderr);
2760  (void)fprintf(stderr, "%u packet%s dropped by kernel", stats.ps_drop,
2761  PLURAL_SUFFIX(stats.ps_drop));
2762  if (stats.ps_ifdrop != 0) {
2763  if (!verbose)
2764  fputs(", ", stderr);
2765  else
2766  putc('\n', stderr);
2767  (void)fprintf(stderr, "%u packet%s dropped by interface\n",
2768  stats.ps_ifdrop, PLURAL_SUFFIX(stats.ps_ifdrop));
2769  } else
2770  putc('\n', stderr);
2771  infoprint = 0;
2772 }
2773 
2774 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
2775 #ifdef HAVE_FORK
2776 #define fork_subprocess() fork()
2777 #else
2778 #define fork_subprocess() vfork()
2779 #endif
2780 static void
2781 compress_savefile(const char *filename)
2782 {
2783  pid_t child;
2784 
2785  child = fork_subprocess();
2786  if (child == -1) {
2787  fprintf(stderr,
2788  "compress_savefile: fork failed: %s\n",
2789  pcap_strerror(errno));
2790  return;
2791  }
2792  if (child != 0) {
2793  /* Parent process. */
2794  return;
2795  }
2796 
2797  /*
2798  * Child process.
2799  * Set to lowest priority so that this doesn't disturb the capture.
2800  */
2801 #ifdef NZERO
2802  setpriority(PRIO_PROCESS, 0, NZERO - 1);
2803 #else
2804  setpriority(PRIO_PROCESS, 0, 19);
2805 #endif
2806  if (execlp(zflag, zflag, filename, (char *)NULL) == -1)
2807  fprintf(stderr,
2808  "compress_savefile: execlp(%s, %s) failed: %s\n",
2809  zflag,
2810  filename,
2811  pcap_strerror(errno));
2812 #ifdef HAVE_FORK
2813  exit(S_ERR_HOST_PROGRAM);
2814 #else
2815  _exit(S_ERR_HOST_PROGRAM);
2816 #endif
2817 }
2818 #else /* HAVE_FORK && HAVE_VFORK */
2819 static void
2820 compress_savefile(const char *filename)
2821 {
2822  fprintf(stderr,
2823  "compress_savefile failed. Functionality not implemented under your system\n");
2824 }
2825 #endif /* HAVE_FORK && HAVE_VFORK */
2826 
2827 static void
2828 dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
2829 {
2830  struct dump_info *dump_info;
2831 
2832  ++packets_captured;
2833 
2834  ++infodelay;
2835 
2836  dump_info = (struct dump_info *)user;
2837 
2838  /*
2839  * XXX - this won't force the file to rotate on the specified time
2840  * boundary, but it will rotate on the first packet received after the
2841  * specified Gflag number of seconds. Note: if a Gflag time boundary
2842  * and a Cflag size boundary coincide, the time rotation will occur
2843  * first thereby cancelling the Cflag boundary (since the file should
2844  * be 0).
2845  */
2846  if (Gflag != 0) {
2847  /* Check if it is time to rotate */
2848  time_t t;
2849 
2850  /* Get the current time */
2851  if ((t = time(NULL)) == (time_t)-1) {
2852  error("%s: can't get current_time: %s",
2853  __func__, pcap_strerror(errno));
2854  }
2855 
2856 
2857  /* If the time is greater than the specified window, rotate */
2858  if (t - Gflag_time >= Gflag) {
2859 #ifdef HAVE_CAPSICUM
2860  FILE *fp;
2861  int fd;
2862 #endif
2863 
2864  /* Update the Gflag_time */
2865  Gflag_time = t;
2866  /* Update Gflag_count */
2867  Gflag_count++;
2868  /*
2869  * Close the current file and open a new one.
2870  */
2871  pcap_dump_close(dump_info->pdd);
2872 
2873  /*
2874  * Compress the file we just closed, if the user asked for it
2875  */
2876  if (zflag != NULL)
2878 
2879  /*
2880  * Check to see if we've exceeded the Wflag (when
2881  * not using Cflag).
2882  */
2883  if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) {
2884  (void)fprintf(stderr, "Maximum file limit reached: %d\n",
2885  Wflag);
2886  info(1);
2888  /* NOTREACHED */
2889  }
2890  if (dump_info->CurrentFileName != NULL)
2891  free(dump_info->CurrentFileName);
2892  /* Allocate space for max filename + \0. */
2893  dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1);
2894  if (dump_info->CurrentFileName == NULL)
2895  error("dump_packet_and_trunc: malloc");
2896  /*
2897  * Gflag was set otherwise we wouldn't be here. Reset the count
2898  * so multiple files would end with 1,2,3 in the filename.
2899  * The counting is handled with the -C flow after this.
2900  */
2901  Cflag_count = 0;
2902 
2903  /*
2904  * This is always the first file in the Cflag
2905  * rotation: e.g. 0
2906  * We also don't need numbering if Cflag is not set.
2907  */
2908  if (Cflag != 0)
2910  WflagChars);
2911  else
2913 
2914 #ifdef HAVE_LIBCAP_NG
2915  capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
2916  capng_apply(CAPNG_SELECT_BOTH);
2917 #endif /* HAVE_LIBCAP_NG */
2918 #ifdef HAVE_CAPSICUM
2919  fd = openat(dump_info->dirfd,
2921  O_CREAT | O_WRONLY | O_TRUNC, 0644);
2922  if (fd < 0) {
2923  error("unable to open file %s",
2925  }
2926  fp = fdopen(fd, "w");
2927  if (fp == NULL) {
2928  error("unable to fdopen file %s",
2930  }
2931  dump_info->pdd = pcap_dump_fopen(dump_info->pd, fp);
2932 #else /* !HAVE_CAPSICUM */
2933  dump_info->pdd = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
2934 #endif
2935 #ifdef HAVE_LIBCAP_NG
2936  capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
2937  capng_apply(CAPNG_SELECT_BOTH);
2938 #endif /* HAVE_LIBCAP_NG */
2939  if (dump_info->pdd == NULL)
2940  error("%s", pcap_geterr(pd));
2941 #ifdef HAVE_CAPSICUM
2942  set_dumper_capsicum_rights(dump_info->pdd);
2943 #endif
2944  }
2945  }
2946 
2947  /*
2948  * XXX - this won't prevent capture files from getting
2949  * larger than Cflag - the last packet written to the
2950  * file could put it over Cflag.
2951  */
2952  if (Cflag != 0) {
2953 #ifdef HAVE_PCAP_DUMP_FTELL64
2954  int64_t size = pcap_dump_ftell64(dump_info->pdd);
2955 #else
2956  /*
2957  * XXX - this only handles a Cflag value > 2^31-1 on
2958  * LP64 platforms; to handle ILP32 (32-bit UN*X and
2959  * Windows) or LLP64 (64-bit Windows) would require
2960  * a version of libpcap with pcap_dump_ftell64().
2961  */
2962  long size = pcap_dump_ftell(dump_info->pdd);
2963 #endif
2964 
2965  if (size == -1)
2966  error("ftell fails on output file");
2967  if (size > Cflag) {
2968 #ifdef HAVE_CAPSICUM
2969  FILE *fp;
2970  int fd;
2971 #endif
2972 
2973  /*
2974  * Close the current file and open a new one.
2975  */
2976  pcap_dump_close(dump_info->pdd);
2977 
2978  /*
2979  * Compress the file we just closed, if the user
2980  * asked for it.
2981  */
2982  if (zflag != NULL)
2984 
2985  Cflag_count++;
2986  if (Wflag > 0) {
2987  if (Cflag_count >= Wflag)
2988  Cflag_count = 0;
2989  }
2990  if (dump_info->CurrentFileName != NULL)
2991  free(dump_info->CurrentFileName);
2992  dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1);
2993  if (dump_info->CurrentFileName == NULL)
2994  error("%s: malloc", __func__);
2996 #ifdef HAVE_LIBCAP_NG
2997  capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
2998  capng_apply(CAPNG_SELECT_BOTH);
2999 #endif /* HAVE_LIBCAP_NG */
3000 #ifdef HAVE_CAPSICUM
3001  fd = openat(dump_info->dirfd, dump_info->CurrentFileName,
3002  O_CREAT | O_WRONLY | O_TRUNC, 0644);
3003  if (fd < 0) {
3004  error("unable to open file %s",
3006  }
3007  fp = fdopen(fd, "w");
3008  if (fp == NULL) {
3009  error("unable to fdopen file %s",
3011  }
3012  dump_info->pdd = pcap_dump_fopen(dump_info->pd, fp);
3013 #else /* !HAVE_CAPSICUM */
3014  dump_info->pdd = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
3015 #endif
3016 #ifdef HAVE_LIBCAP_NG
3017  capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
3018  capng_apply(CAPNG_SELECT_BOTH);
3019 #endif /* HAVE_LIBCAP_NG */
3020  if (dump_info->pdd == NULL)
3021  error("%s", pcap_geterr(pd));
3022 #ifdef HAVE_CAPSICUM
3023  set_dumper_capsicum_rights(dump_info->pdd);
3024 #endif
3025  }
3026  }
3027 
3028  pcap_dump((u_char *)dump_info->pdd, h, sp);
3029 #ifdef HAVE_PCAP_DUMP_FLUSH
3030  if (Uflag)
3031  pcap_dump_flush(dump_info->pdd);
3032 #endif
3033 
3034  if (dump_info->ndo != NULL)
3036 
3037  --infodelay;
3038  if (infoprint)
3039  info(0);
3040 }
3041 
3042 static void
3043 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
3044 {
3045  struct dump_info *dump_info;
3046 
3047  ++packets_captured;
3048 
3049  ++infodelay;
3050 
3051  dump_info = (struct dump_info *)user;
3052 
3053  pcap_dump((u_char *)dump_info->pdd, h, sp);
3054 #ifdef HAVE_PCAP_DUMP_FLUSH
3055  if (Uflag)
3056  pcap_dump_flush(dump_info->pdd);
3057 #endif
3058 
3059  if (dump_info->ndo != NULL)
3061 
3062  --infodelay;
3063  if (infoprint)
3064  info(0);
3065 }
3066 
3067 static void
3068 print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
3069 {
3070  ++packets_captured;
3071 
3072  ++infodelay;
3073 
3074  if (!count_mode)
3076 
3077  --infodelay;
3078  if (infoprint)
3079  info(0);
3080 }
3081 
3082 #ifdef SIGNAL_REQ_INFO
3083 static void
3084 requestinfo(int signo _U_)
3085 {
3086  if (infodelay)
3087  ++infoprint;
3088  else
3089  info(0);
3090 }
3091 #endif
3092 
3093 #ifdef SIGNAL_FLUSH_PCAP
3094 static void
3095 flushpcap(int signo _U_)
3096 {
3097  if (pdd != NULL)
3098  pcap_dump_flush(pdd);
3099 }
3100 #endif
3101 
3102 static void
3104 {
3105  static u_int prev_packets_captured, first = 1;
3106 
3107  if (infodelay == 0 && (first || packets_captured != prev_packets_captured)) {
3108  fprintf(stderr, "Got %u\r", packets_captured);
3109  first = 0;
3110  prev_packets_captured = packets_captured;
3111  }
3112 }
3113 
3114 /*
3115  * Called once each second in verbose mode while dumping to file
3116  */
3117 #ifdef _WIN32
3118 static void CALLBACK verbose_stats_dump(PVOID param _U_,
3119  BOOLEAN timer_fired _U_)
3120 {
3122 }
3123 #else /* _WIN32 */
3124 static void verbose_stats_dump(int sig _U_)
3125 {
3127 }
3128 #endif /* _WIN32 */
3129 
3131 static void
3133 {
3134 #ifndef HAVE_PCAP_LIB_VERSION
3135  #ifdef HAVE_PCAP_VERSION
3136  extern char pcap_version[];
3137  #else /* HAVE_PCAP_VERSION */
3138  static char pcap_version[] = "unknown";
3139  #endif /* HAVE_PCAP_VERSION */
3140 #endif /* HAVE_PCAP_LIB_VERSION */
3141  const char *smi_version_string;
3142 
3143  (void)fprintf(f, "%s version " PACKAGE_VERSION "\n", program_name);
3144 #ifdef HAVE_PCAP_LIB_VERSION
3145  (void)fprintf(f, "%s\n", pcap_lib_version());
3146 #else /* HAVE_PCAP_LIB_VERSION */
3147  (void)fprintf(f, "libpcap version %s\n", pcap_version);
3148 #endif /* HAVE_PCAP_LIB_VERSION */
3149 
3150 #if defined(HAVE_LIBCRYPTO) && defined(SSLEAY_VERSION)
3151  (void)fprintf (f, "%s\n", SSLeay_version(SSLEAY_VERSION));
3152 #endif
3153 
3154  smi_version_string = nd_smi_version_string();
3155  if (smi_version_string != NULL)
3156  (void)fprintf (f, "SMI-library: %s\n", smi_version_string);
3157 
3158 #if defined(__SANITIZE_ADDRESS__)
3159  (void)fprintf (f, "Compiled with AddressSanitizer/GCC.\n");
3160 #elif defined(__has_feature)
3161 # if __has_feature(address_sanitizer)
3162  (void)fprintf (f, "Compiled with AddressSanitizer/Clang.\n");
3163 # elif __has_feature(memory_sanitizer)
3164  (void)fprintf (f, "Compiled with MemorySanitizer/Clang.\n");
3165 # endif
3166 #endif /* __SANITIZE_ADDRESS__ or __has_feature */
3167 }
3169 
3170 static void
3171 print_usage(FILE *f)
3172 {
3173  print_version(f);
3174  (void)fprintf(f,
3175 "Usage: %s [-Abd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ] [--count]\n", program_name);
3176  (void)fprintf(f,
3177 "\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n");
3178  (void)fprintf(f,
3179 "\t\t[ -i interface ]" IMMEDIATE_MODE_USAGE j_FLAG_USAGE "\n");
3180 #ifdef HAVE_PCAP_FINDALLDEVS_EX
3181  (void)fprintf(f,
3182 "\t\t" LIST_REMOTE_INTERFACES_USAGE "\n");
3183 #endif
3184 #ifdef USE_LIBSMI
3185  (void)fprintf(f,
3186 "\t\t" m_FLAG_USAGE "\n");
3187 #endif
3188  (void)fprintf(f,
3189 "\t\t[ -M secret ] [ --number ] [ --print ]" Q_FLAG_USAGE "\n");
3190  (void)fprintf(f,
3191 "\t\t[ -r file ] [ -s snaplen ] [ -T type ] [ --version ]\n");
3192  (void)fprintf(f,
3193 "\t\t[ -V file ] [ -w file ] [ -W filecount ] [ -y datalinktype ]\n");
3194 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
3195  (void)fprintf(f,
3196 "\t\t[ --time-stamp-precision precision ] [ --micro ] [ --nano ]\n");
3197 #endif
3198  (void)fprintf(f,
3199 "\t\t[ -z postrotate-command ] [ -Z user ] [ expression ]\n");
3200 }
int ascii_strcasecmp(const char *s1, const char *s2)
void bpf_dump(const struct bpf_program *p, int option)
Definition: bpf_dump.c:34
const char * pcap_datalink_val_to_description(int dlt)
Definition: dlnames.c:159
int pcap_datalink_name_to_val(const char *name)
Definition: dlnames.c:133
const char * pcap_datalink_val_to_name(int dlt)
Definition: dlnames.c:146
void float_type_check(uint32_t in)
Definition: fptype.c:41
#define FORMAT_STRING(p)
Definition: funcattrs.h:145
#define PRINTFLIKE(x, y)
Definition: funcattrs.h:134
#define NORETURN
Definition: funcattrs.h:103
int getopt_long(int nargc, char *const *nargv, const char *options, const struct option *long_options, int *idx)
Definition: getopt_long.c:593
#define no_argument
Definition: getopt_long.h:40
#define required_argument
Definition: getopt_long.h:41
char * strdup(const char *)
size_t strlcpy(char *, const char *, size_t)
Definition: strlcpy.c:47
int abort_on_misalignment(char *ebuf, size_t ebufsiz)
Definition: machdep.c:47
#define USES_APPLE_DEPRECATED_API
#define INT64_T_CONSTANT(constant)
#define our_fstat
#define our_statb
#define DIAG_ON_CLANG(x)
#define AF_INET6
#define strtoint64_t
#define DIAG_OFF_CLANG(x)
#define USES_APPLE_RST
int nd_load_smi_module(const char *module, char *errbuf, size_t errbuf_size)
Definition: netdissect.c:122
const char * nd_smi_version_string(void)
Definition: netdissect.c:140
void nd_cleanup(void)
Definition: netdissect.c:87
int nd_have_smi_support(void)
Definition: netdissect.c:106
int nd_init(char *errbuf, size_t errbuf_size)
Definition: netdissect.c:48
#define PT_CARP
Definition: netdissect.h:282
#define MAXIMUM_SNAPLEN
Definition: netdissect.h:327
#define PT_PTP
Definition: netdissect.h:290
#define PT_RADIUS
Definition: netdissect.h:283
#define PT_VXLAN
Definition: netdissect.h:285
#define PT_SNMP
Definition: netdissect.h:278
#define PT_PGM
Definition: netdissect.h:286
#define PT_DOMAIN
Definition: netdissect.h:292
#define PLURAL_SUFFIX(n)
Definition: netdissect.h:447
#define PT_WB
Definition: netdissect.h:274
char * bittok2str(const struct tok *, const char *, u_int)
Definition: util-print.c:558
#define PT_TFTP
Definition: netdissect.h:280
#define PT_RTCP
Definition: netdissect.h:277
#define PT_SOMEIP
Definition: netdissect.h:291
#define PT_RESP
Definition: netdissect.h:289
#define PT_RTP
Definition: netdissect.h:276
#define PT_PGM_ZMTP1
Definition: netdissect.h:287
#define PT_RPC
Definition: netdissect.h:275
#define PT_ZMTP1
Definition: netdissect.h:284
#define PT_CNFP
Definition: netdissect.h:279
#define PT_AODV
Definition: netdissect.h:281
#define PT_VAT
Definition: netdissect.h:273
#define PT_LMP
Definition: netdissect.h:288
int snprintf(char *, size_t, const char *,...)
long strtol(const char *, char **, int)
int initgroups(const char *, int)
int read(int, char *, u_int)
void(*)(int) signal(int, void(*)(int))
Definition: os-sunos4.h:153
int strftime(char *, int, char *, struct tm *)
int setpriority(int, int, int)
time_t time(time_t *)
int isatty(int)
int wait(int *)
int chroot(const char *)
int printf(const char *,...)
int close(int)
int setlinebuf(FILE *)
long pcap_dump_ftell(pcap_dumper_t *p)
int(* print)(netdissect_options *, const u_char *, u_int, u_char)
Definition: print-mptcp.c:453
static const char * cmds[]
Definition: print-telnet.c:342
int has_printer(int type)
Definition: print.c:310
if_printer get_if_printer(int type)
Definition: print.c:316
void ndo_set_function_pointers(netdissect_options *ndo)
Definition: print.c:566
void init_print(netdissect_options *ndo, uint32_t localnet, uint32_t mask)
Definition: print.c:265
void pretty_print_packet(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *sp, u_int packets_captured)
Definition: print.c:327
@ S_SUCCESS
@ S_ERR_HOST_PROGRAM
netdissect_options * ndo
Definition: tcpdump.c:318
pcap_t * pd
Definition: tcpdump.c:316
char * CurrentFileName
Definition: tcpdump.c:315
pcap_dumper_t * pdd
Definition: tcpdump.c:317
char * WFileName
Definition: tcpdump.c:314
int ndo_suppress_default_print
Definition: netdissect.h:222
const char * program_name
Definition: netdissect.h:224
if_printer ndo_if_printer
Definition: netdissect.h:245
#define j_FLAG_USAGE
Definition: tcpdump.c:653
static void warning(const char *,...)
Definition: tcpdump.c:396
static int supports_monitor_mode
Definition: tcpdump.c:307
int dflag
Definition: tcpdump.c:209
static void error(const char *,...)
Definition: tcpdump.c:377
static void print_usage(FILE *)
Definition: tcpdump.c:3171
static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *)
Definition: tcpdump.c:2828
static long Cflag
Definition: tcpdump.c:186
static pcap_t * pd
Definition: tcpdump.c:304
#define I_FLAG
Definition: tcpdump.c:644
#define PATH_SEPARATOR
Definition: tcpdump.c:134
#define OPTION_TSTAMP_PRECISION
Definition: tcpdump.c:698
#define J_FLAG
Definition: tcpdump.c:654
char * program_name
Definition: tcpdump.c:239
#define U_FLAG
Definition: tcpdump.c:672
static void droproot(const char *, const char *)
Definition: tcpdump.c:772
static const char copyright[]
Definition: tcpdump.c:59
static void cleanup(int)
Definition: tcpdump.c:2670
#define O_BINARY
Definition: tcpdump.c:1060
static void child_cleanup(int)
static int pflag
Definition: tcpdump.c:220
int main(int argc, char **argv)
Definition: tcpdump.c:1462
static pcap_t * open_interface(const char *device, netdissect_options *ndo, char *ebuf)
Definition: tcpdump.c:1241
#define LIST_REMOTE_INTERFACES_USAGE
Definition: tcpdump.c:760
static int timeout
Definition: tcpdump.c:230
static int lflag
Definition: tcpdump.c:219
static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *)
Definition: tcpdump.c:3068
static void compress_savefile(const char *filename)
Definition: tcpdump.c:2820
static u_int packets_captured
Definition: tcpdump.c:286
#define D_FLAG
Definition: tcpdump.c:638
#define OPTION_FP_TYPE
Definition: tcpdump.c:704
static void MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars)
Definition: tcpdump.c:841
static int infoprint
Definition: tcpdump.c:237
static int Gflag_count
Definition: tcpdump.c:211
static const struct option longopts[]
Definition: tcpdump.c:707
static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *)
Definition: tcpdump.c:3043
static int Lflag
Definition: tcpdump.c:213
static int count_mode
Definition: tcpdump.c:234
static int infodelay
Definition: tcpdump.c:236
static void exit_tcpdump(int)
Definition: tcpdump.c:412
#define Q_FLAG_USAGE
Definition: tcpdump.c:666
#define OPTION_TSTAMP_MICRO
Definition: tcpdump.c:702
static int WflagChars
Definition: tcpdump.c:228
#define SHORTOPTS
Definition: tcpdump.c:675
#define OPTION_IMMEDIATE_MODE
Definition: tcpdump.c:699
#define OPTION_LIST_REMOTE_INTERFACES
Definition: tcpdump.c:701
static int Iflag
Definition: tcpdump.c:214
static char * zflag
Definition: tcpdump.c:229
#define OPTION_PRINT
Definition: tcpdump.c:700
#define IMMEDIATE_MODE_USAGE
Definition: tcpdump.c:766
static void show_dlts_and_exit(pcap_t *, const char *device)
Definition: tcpdump.c:453
static void print_packets_captured(void)
Definition: tcpdump.c:3103
static char * copy_argv(char **argv)
Definition: tcpdump.c:1023
static int getWflagChars(int x)
Definition: tcpdump.c:826
#define OPTION_VERSION
Definition: tcpdump.c:697
#define B_FLAG_USAGE
Definition: tcpdump.c:632
static void info(int)
Definition: tcpdump.c:2730
static int Gflag
Definition: tcpdump.c:210
#define OPTION_TSTAMP_NANO
Definition: tcpdump.c:703
int optind
Definition: getopt_long.c:83
static void print_version(FILE *)
Definition: tcpdump.c:3132
char * optarg
Definition: getopt_long.c:82
static time_t Gflag_time
Definition: tcpdump.c:212
static char * read_infile(char *fname)
Definition: tcpdump.c:1064
static void(*)(int) setsignal(int sig, void(*func)(int))
Definition: tcpdump.c:249
static int Wflag
Definition: tcpdump.c:227
static void verbose_stats_dump(int sig)
Definition: tcpdump.c:3124
int opterr
Definition: getopt_long.c:83
#define PATH_MAX
Definition: tcpdump.c:167
#define OPTION_COUNT
Definition: tcpdump.c:705
static pcap_dumper_t * pdd
Definition: tcpdump.c:305
static char * get_next_file(FILE *VFile, char *ptr)
Definition: tcpdump.c:874
static int Cflag_count
Definition: tcpdump.c:188
#define _U_
Definition: varattrs.h:56