wireshark/capinfos.c

/* capinfos.c
 * Reports capture file information including # of packets, duration, others
 *
 * Copyright 2004 Ian Schorr
 *
 * Wireshark - Network traffic analyzer
 * By Gerald Combs <gerald@wireshark.org>
 * Copyright 1998 Gerald Combs
 *
 * SPDX-License-Identifier: GPL-2.0-or-later
 */

/*
 * 2009-09-19: jyoung
 *
 * New capinfos features
 *
 * Continue processing additional files after
 * a wiretap open failure.  The new -C option
 * reverts to capinfos' original behavior which
 * is to cancel any further file processing at
 * first file open failure.
 *
 * Change the behavior of how the default display
 * of all infos is initiated.  This gets rid of a
 * special post getopt() argument count test.
 *
 * Add new table output format (with related options)
 * This feature allows outputting the various infos
 * into a tab delimited text file, or to a comma
 * separated variables file (*.csv) instead of the
 * original "long" format.
 *
 * 2011-04-05: wmeier
 * behaviour changed: Upon exit capinfos will return
 *  an error status if an error occurred at any
 *  point during "continuous" file processing.
 *  (Previously a success status was always
 *   returned if the -C option was not used).
 *
 */


#include <config.h>
#define WS_LOG_DOMAIN  LOG_DOMAIN_MAIN

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdarg.h>
#include <locale.h>
#include <errno.h>

#include <ws_exit_codes.h>
#include <wsutil/ws_getopt.h>

#include <glib.h>

#include <wiretap/wtap.h>

#include <wsutil/cmdarg_err.h>
#include <wsutil/filesystem.h>
#include <wsutil/privileges.h>
#include <cli_main.h>
#include <wsutil/version_info.h>
#include <wiretap/wtap_opttypes.h>

#ifdef HAVE_PLUGINS
#include <wsutil/plugins.h>
#endif

#include <wsutil/report_message.h>
#include <wsutil/str_util.h>
#include <wsutil/file_util.h>
#include <wsutil/ws_assert.h>
#include <wsutil/wslog.h>

#include <gcrypt.h>

#include "ui/failure_message.h"

/*
 * By default capinfos now continues processing
 * the next filename if and when wiretap detects
 * a problem opening or reading a file.
 * Use the '-C' option to revert back to original
 * capinfos behavior which is to abort any
 * additional file processing at the first file
 * open or read failure.
 */

static gboolean stop_after_failure = FALSE;

/*
 * table report variables
 */

static gboolean long_report        = TRUE;  /* By default generate long report       */
static gchar table_report_header   = TRUE;  /* Generate column header by default     */
static gchar field_separator       = '\t';  /* Use TAB as field separator by default */
static gchar quote_char            = '\0';  /* Do NOT quote fields by default        */
static gboolean machine_readable   = FALSE; /* Display machine-readable numbers      */

/*
 * capinfos has the ability to report on a number of
 * various characteristics ("infos") for each input file.
 *
 * By default reporting of all info fields is enabled.
 *
 * Optionally the reporting of any specific info field
 * or combination of info fields can be enabled with
 * individual options.
 */

static gboolean report_all_infos   = TRUE;  /* Report all infos           */

static gboolean cap_file_type      = TRUE;  /* Report capture type        */
static gboolean cap_file_encap     = TRUE;  /* Report encapsulation       */
static gboolean cap_snaplen        = TRUE;  /* Packet size limit (snaplen)*/
static gboolean cap_packet_count   = TRUE;  /* Report packet count        */
static gboolean cap_file_size      = TRUE;  /* Report file size           */
static gboolean cap_comment        = TRUE;  /* Display the capture comment */
static gboolean cap_file_more_info = TRUE;  /* Report more file info      */
static gboolean cap_file_idb       = TRUE;  /* Report Interface info      */
static gboolean cap_file_nrb       = TRUE;  /* Report Name Resolution Block info      */
static gboolean cap_file_dsb       = TRUE;  /* Report Decryption Secrets Block info      */

static gboolean cap_data_size      = TRUE;  /* Report packet byte size    */
static gboolean cap_duration       = TRUE;  /* Report capture duration    */
static gboolean cap_start_time     = TRUE;  /* Report capture start time  */
static gboolean cap_end_time       = TRUE;  /* Report capture end time    */
static gboolean time_as_secs       = FALSE; /* Report time values as raw seconds */

static gboolean cap_data_rate_byte = TRUE;  /* Report data rate bytes/sec */
static gboolean cap_data_rate_bit  = TRUE;  /* Report data rate bites/sec */
static gboolean cap_packet_size    = TRUE;  /* Report average packet size */
static gboolean cap_packet_rate    = TRUE;  /* Report average packet rate */
static gboolean cap_order          = TRUE;  /* Report if packets are in chronological order (True/False) */

static gboolean cap_file_hashes    = TRUE;  /* Calculate file hashes */

// Strongest to weakest
#define HASH_SIZE_SHA256 32
#define HASH_SIZE_SHA1   20

#define HASH_STR_SIZE (65) /* Max hash size * 2 + '\0' */
#define HASH_BUF_SIZE (1024 * 1024)


static gchar file_sha256[HASH_STR_SIZE];
static gchar file_rmd160[HASH_STR_SIZE];
static gchar file_sha1[HASH_STR_SIZE];

static char  *hash_buf = NULL;
static gcry_md_hd_t hd = NULL;

static guint num_ipv4_addresses;
static guint num_ipv6_addresses;
static guint num_decryption_secrets;

/*
 * If we have at least two packets with time stamps, and they're not in
 * order - i.e., the later packet has a time stamp older than the earlier
 * packet - the time stamps are known not to be in order.
 *
 * If every packet has a time stamp, and they're all in order, the time
 * stamp is known to be in order.
 *
 * Otherwise, we have no idea.
 */
typedef enum {
    IN_ORDER,
    NOT_IN_ORDER,
    ORDER_UNKNOWN
} order_t;

typedef struct _capture_info {
    const char           *filename;
    guint16               file_type;
    wtap_compression_type compression_type;
    int                   file_encap;
    int                   file_tsprec;
    wtap                 *wth;
    gint64                filesize;
    guint64               packet_bytes;
    gboolean              times_known;
    nstime_t              start_time;
    int                   start_time_tsprec;
    nstime_t              stop_time;
    int                   stop_time_tsprec;
    guint32               packet_count;
    gboolean              snap_set;                 /* If set in capture file header      */
    guint32               snaplen;                  /* value from the capture file header */
    guint32               snaplen_min_inferred;     /* If caplen < len for 1 or more rcds */
    guint32               snaplen_max_inferred;     /*  ...                               */
    gboolean              drops_known;
    guint32               drop_count;

    nstime_t              duration;
    int                   duration_tsprec;
    double                packet_rate;
    double                packet_size;
    double                data_rate;                /* in bytes/s */
    gboolean              know_order;
    order_t               order;

    int                  *encap_counts;             /* array of per_packet encap counts; array has one entry per wtap_encap type */

    guint                 num_interfaces;           /* number of IDBs, and thus size of interface_packet_counts array */
    GArray               *interface_packet_counts;  /* array of per_packet interface_id counts; one entry per file IDB */
    guint32               pkt_interface_id_unknown; /* counts if packet interface_id didn't match a known one */
    GArray               *idb_info_strings;         /* array of IDB info strings */
} capture_info;

static char *decimal_point;

static void
enable_all_infos(void)
{
    report_all_infos   = TRUE;

    cap_file_type      = TRUE;
    cap_file_encap     = TRUE;
    cap_snaplen        = TRUE;
    cap_packet_count   = TRUE;
    cap_file_size      = TRUE;
    cap_comment        = TRUE;
    cap_file_more_info = TRUE;
    cap_file_idb       = TRUE;
    cap_file_nrb       = TRUE;
    cap_file_dsb       = TRUE;

    cap_data_size      = TRUE;
    cap_duration       = TRUE;
    cap_start_time     = TRUE;
    cap_end_time       = TRUE;
    cap_order          = TRUE;

    cap_data_rate_byte = TRUE;
    cap_data_rate_bit  = TRUE;
    cap_packet_size    = TRUE;
    cap_packet_rate    = TRUE;

    cap_file_hashes    = TRUE;
}

static void
disable_all_infos(void)
{
    report_all_infos   = FALSE;

    cap_file_type      = FALSE;
    cap_file_encap     = FALSE;
    cap_snaplen        = FALSE;
    cap_packet_count   = FALSE;
    cap_file_size      = FALSE;
    cap_comment        = FALSE;
    cap_file_more_info = FALSE;
    cap_file_idb       = FALSE;
    cap_file_nrb       = FALSE;
    cap_file_dsb       = FALSE;

    cap_data_size      = FALSE;
    cap_duration       = FALSE;
    cap_start_time     = FALSE;
    cap_end_time       = FALSE;
    cap_order          = FALSE;

    cap_data_rate_byte = FALSE;
    cap_data_rate_bit  = FALSE;
    cap_packet_size    = FALSE;
    cap_packet_rate    = FALSE;

    cap_file_hashes    = FALSE;
}

static const gchar *
order_string(order_t order)
{
    switch (order) {

        case IN_ORDER:
            return "True";

        case NOT_IN_ORDER:
            return "False";

        case ORDER_UNKNOWN:
            return "Unknown";

        default:
            return "???";  /* "cannot happen" (the next step is "Profit!") */
    }
}

static gchar *
absolute_time_string(nstime_t *timer, int tsprecision, capture_info *cf_info)
{
    /*
     *    https://web.archive.org/web/20120513133703/http://www.idrbt.ac.in/publications/workingpapers/Working%20Paper%20No.%209.pdf
     *
     * says:
     *
     *    A 64-bit Unix time would be safe for the indefinite future, as
     *    this variable would not overflow until 2**63 or
     *    9,223,372,036,854,775,808 (over nine quintillion) seconds
     *    after the beginning of the Unix epoch - corresponding to
     *    GMT 15:30:08, Sunday, 4th December, 292,277,026,596.
     *
     * So, if we're displaying the time as YYYY-MM-DD HH:MM:SS.SSSSSSSSS,
     * we'll have the buffer be large enouth for a date of the format
     * 292277026596-MM-DD HH:MM:SS.SSSSSSSSS, which is the biggest value
     * you'll get with a 64-bit time_t and a nanosecond-resolution
     * fraction-of-a-second.
     *
     * That's 12+1+2+1+2+1+2+1+2+2+2+1+9+1, including the terminating
     * \0, or 39.
     *
     * If we're displaying the time as epoch time, and the time is
     * unsigned, 2^64-1 is 18446744073709551615, so the buffer has
     * to be big enough for 18446744073709551615.999999999.  That's
     * 20+1+9+1, including the terminating '\0', or 31.  If it's
     * signed, 2^63 is 9223372036854775808, so the buffer has to
     * be big enough for -9223372036854775808.999999999, which is
     * again 20+1+9+1, or 31.
     *
     * So we go with 39.
     */
    static gchar time_string_buf[39];
    struct tm *ti_tm;

    if (cf_info->times_known && cf_info->packet_count > 0) {
        if (time_as_secs) {
            switch (tsprecision) {

                case WTAP_TSPREC_SEC:
                    snprintf(time_string_buf, sizeof time_string_buf,
                            "%"PRId64,
                            (gint64)timer->secs);
                    break;

                case WTAP_TSPREC_DSEC:
                    snprintf(time_string_buf, sizeof time_string_buf,
                            "%"PRId64"%s%01d",
                            (gint64)timer->secs,
                            decimal_point,
                            timer->nsecs / 100000000);
                    break;

                case WTAP_TSPREC_CSEC:
                    snprintf(time_string_buf, sizeof time_string_buf,
                            "%"PRId64"%s%02d",
                            (gint64)timer->secs,
                            decimal_point,
                            timer->nsecs / 10000000);
                    break;

                case WTAP_TSPREC_MSEC:
                    snprintf(time_string_buf, sizeof time_string_buf,
                            "%"PRId64"%s%03d",
                            (gint64)timer->secs,
                            decimal_point,
                            timer->nsecs / 1000000);
                    break;

                case WTAP_TSPREC_USEC:
                    snprintf(time_string_buf, sizeof time_string_buf,
                            "%"PRId64"%s%06d",
                            (gint64)timer->secs,
                            decimal_point,
                            timer->nsecs / 1000);
                    break;

                case WTAP_TSPREC_NSEC:
                    snprintf(time_string_buf, sizeof time_string_buf,
                            "%"PRId64"%s%09d",
                            (gint64)timer->secs,
                            decimal_point,
                            timer->nsecs);
                    break;

                default:
                    snprintf(time_string_buf, sizeof time_string_buf,
                            "Unknown precision %d",
                            tsprecision);
                    break;
            }
            return time_string_buf;
        } else {
            ti_tm = localtime(&timer->secs);
            if (ti_tm == NULL) {
                snprintf(time_string_buf, sizeof time_string_buf, "Not representable");
                return time_string_buf;
            }
            switch (tsprecision) {

                case WTAP_TSPREC_SEC:
                    snprintf(time_string_buf, sizeof time_string_buf,
                            "%04d-%02d-%02d %02d:%02d:%02d",
                            ti_tm->tm_year + 1900,
                            ti_tm->tm_mon + 1,
                            ti_tm->tm_mday,
                            ti_tm->tm_hour,
                            ti_tm->tm_min,
                            ti_tm->tm_sec);
                    break;

                case WTAP_TSPREC_DSEC:
                    snprintf(time_string_buf, sizeof time_string_buf,
                            "%04d-%02d-%02d %02d:%02d:%02d%s%01d",
                            ti_tm->tm_year + 1900,
                            ti_tm->tm_mon + 1,
                            ti_tm->tm_mday,
                            ti_tm->tm_hour,
                            ti_tm->tm_min,
                            ti_tm->tm_sec,
                            decimal_point,
                            timer->nsecs / 100000000);
                    break;

                case WTAP_TSPREC_CSEC:
                    snprintf(time_string_buf, sizeof time_string_buf,
                            "%04d-%02d-%02d %02d:%02d:%02d%s%02d",
                            ti_tm->tm_year + 1900,
                            ti_tm->tm_mon + 1,
                            ti_tm->tm_mday,
                            ti_tm->tm_hour,
                            ti_tm->tm_min,
                            ti_tm->tm_sec,
                            decimal_point,
                            timer->nsecs / 10000000);
                    break;

                case WTAP_TSPREC_MSEC:
                    snprintf(time_string_buf, sizeof time_string_buf,
                            "%04d-%02d-%02d %02d:%02d:%02d%s%03d",
                            ti_tm->tm_year + 1900,
                            ti_tm->tm_mon + 1,
                            ti_tm->tm_mday,
                            ti_tm->tm_hour,
                            ti_tm->tm_min,
                            ti_tm->tm_sec,
                            decimal_point,
                            timer->nsecs / 1000000);
                    break;

                case WTAP_TSPREC_USEC:
                    snprintf(time_string_buf, sizeof time_string_buf,
                            "%04d-%02d-%02d %02d:%02d:%02d%s%06d",
                            ti_tm->tm_year + 1900,
                            ti_tm->tm_mon + 1,
                            ti_tm->tm_mday,
                            ti_tm->tm_hour,
                            ti_tm->tm_min,
                            ti_tm->tm_sec,
                            decimal_point,
                            timer->nsecs / 1000);
                    break;

                case WTAP_TSPREC_NSEC:
                    snprintf(time_string_buf, sizeof time_string_buf,
                            "%04d-%02d-%02d %02d:%02d:%02d%s%09d",
                            ti_tm->tm_year + 1900,
                            ti_tm->tm_mon + 1,
                            ti_tm->tm_mday,
                            ti_tm->tm_hour,
                            ti_tm->tm_min,
                            ti_tm->tm_sec,
                            decimal_point,
                            timer->nsecs);
                    break;

                default:
                    snprintf(time_string_buf, sizeof time_string_buf,
                            "Unknown precision %d",
                            tsprecision);
                    break;
            }
            return time_string_buf;
        }
    }

    snprintf(time_string_buf, sizeof time_string_buf, "n/a");
    return time_string_buf;
}

static gchar *
relative_time_string(nstime_t *timer, int tsprecision, capture_info *cf_info, gboolean want_seconds)
{
    const gchar  *second = want_seconds ? " second" : "";
    const gchar  *plural = want_seconds ? "s" : "";
    /*
     * If we're displaying the time as epoch time, and the time is
     * unsigned, 2^64-1 is 18446744073709551615, so the buffer has
     * to be big enough for "18446744073709551615.999999999 seconds".
     * That's 20+1+9+1+7+1, including the terminating '\0', or 39.
     * If it'ssigned, 2^63 is 9223372036854775808, so the buffer has to
     * be big enough for "-9223372036854775808.999999999 seconds",
     * which is again 20+1+9+1+7+1, or 39.
     */
    static gchar  time_string_buf[39];

    if (cf_info->times_known && cf_info->packet_count > 0) {
        switch (tsprecision) {

            case WTAP_TSPREC_SEC:
                snprintf(time_string_buf, sizeof time_string_buf,
                        "%"PRId64"%s%s",
                        (gint64)timer->secs,
                        second,
                        timer->secs == 1 ? "" : plural);
                break;

            case WTAP_TSPREC_DSEC:
                snprintf(time_string_buf, sizeof time_string_buf,
                        "%"PRId64"%s%01d%s%s",
                        (gint64)timer->secs,
                        decimal_point,
                        timer->nsecs / 100000000,
                        second,
                        (timer->secs == 1 && timer->nsecs == 0) ? "" : plural);
                break;

            case WTAP_TSPREC_CSEC:
                snprintf(time_string_buf, sizeof time_string_buf,
                        "%"PRId64"%s%02d%s%s",
                        (gint64)timer->secs,
                        decimal_point,
                        timer->nsecs / 10000000,
                        second,
                        (timer->secs == 1 && timer->nsecs == 0) ? "" : plural);
                break;

            case WTAP_TSPREC_MSEC:
                snprintf(time_string_buf, sizeof time_string_buf,
                        "%"PRId64"%s%03d%s%s",
                        (gint64)timer->secs,
                        decimal_point,
                        timer->nsecs / 1000000,
                        second,
                        (timer->secs == 1 && timer->nsecs == 0) ? "" : plural);
                break;

            case WTAP_TSPREC_USEC:
                snprintf(time_string_buf, sizeof time_string_buf,
                        "%"PRId64"%s%06d%s%s",
                        (gint64)timer->secs,
                        decimal_point,
                        timer->nsecs / 1000,
                        second,
                        (timer->secs == 1 && timer->nsecs == 0) ? "" : plural);
                break;

            case WTAP_TSPREC_NSEC:
                snprintf(time_string_buf, sizeof time_string_buf,
                        "%"PRId64"%s%09d%s%s",
                        (gint64)timer->secs,
                        decimal_point,
                        timer->nsecs,
                        second,
                        (timer->secs == 1 && timer->nsecs == 0) ? "" : plural);
                break;

            default:
                snprintf(time_string_buf, sizeof time_string_buf,
                        "Unknown precision %d",
                        tsprecision);
                break;
        }
        return time_string_buf;
    }

    snprintf(time_string_buf, sizeof time_string_buf, "n/a");
    return time_string_buf;
}

static void print_value(const gchar *text_p1, gint width, const gchar *text_p2, double value)
{
    if (value > 0.0)
        printf("%s%.*f%s\n", text_p1, width, value, text_p2);
    else
        printf("%sn/a\n", text_p1);
}

/* multi-line comments would conflict with the formatting that capinfos uses
   we replace linefeeds with spaces */
static void
string_replace_newlines(gchar *str)
{
    gchar *p;

    if (str) {
        p = str;
        while (*p != '\0') {
            if (*p == '\n')
                *p = ' ';
            if (*p == '\r')
                *p = ' ';
            p++;
        }
    }
}

static void
show_option_string(const char *prefix, const char *option_str)
{
    char *str;

    if (option_str != NULL && option_str[0] != '\0') {
        str = g_strdup(option_str);
        string_replace_newlines(str);
        printf("%s%s\n", prefix, str);
        g_free(str);
    }
}

static void
print_stats(const gchar *filename, capture_info *cf_info)
{
    const gchar           *file_type_string, *file_encap_string;
    gchar                 *size_string;

    /* Build printable strings for various stats */
    if (machine_readable) {
        file_type_string = wtap_file_type_subtype_name(cf_info->file_type);
        file_encap_string = wtap_encap_name(cf_info->file_encap);
    }
    else {
        file_type_string = wtap_file_type_subtype_description(cf_info->file_type);
        file_encap_string = wtap_encap_description(cf_info->file_encap);
    }

    if (filename)           printf     ("File name:           %s\n", filename);
    if (cap_file_type) {
        const char *compression_type_description;
        compression_type_description = wtap_compression_type_description(cf_info->compression_type);
        if (compression_type_description == NULL)
            printf     ("File type:           %s\n",
                    file_type_string);
        else
            printf     ("File type:           %s (%s)\n",
                    file_type_string, compression_type_description);
    }
    if (cap_file_encap) {
        printf      ("File encapsulation:  %s\n", file_encap_string);
        if (cf_info->file_encap == WTAP_ENCAP_PER_PACKET) {
            int i;
            printf    ("Encapsulation in use by packets (# of pkts):\n");
            for (i=0; i<WTAP_NUM_ENCAP_TYPES; i++) {
                if (cf_info->encap_counts[i] > 0)
                    printf("                     %s (%d)\n",
                            wtap_encap_description(i), cf_info->encap_counts[i]);
            }
        }
    }
    if (cap_file_more_info) {
        printf      ("File timestamp precision:  %s (%d)\n",
                wtap_tsprec_string(cf_info->file_tsprec), cf_info->file_tsprec);
    }

    if (cap_snaplen && cf_info->snap_set)
        printf     ("Packet size limit:   file hdr: %u bytes\n", cf_info->snaplen);
    else if (cap_snaplen && !cf_info->snap_set)
        printf     ("Packet size limit:   file hdr: (not set)\n");
    if (cf_info->snaplen_max_inferred > 0) {
        if (cf_info->snaplen_min_inferred == cf_info->snaplen_max_inferred)
            printf     ("Packet size limit:   inferred: %u bytes\n", cf_info->snaplen_min_inferred);
        else
            printf     ("Packet size limit:   inferred: %u bytes - %u bytes (range)\n",
                    cf_info->snaplen_min_inferred, cf_info->snaplen_max_inferred);
    }
    if (cap_packet_count) {
        printf     ("Number of packets:   ");
        if (machine_readable) {
            printf ("%u\n", cf_info->packet_count);
        } else {
            size_string = format_size(cf_info->packet_count, FORMAT_SIZE_UNIT_NONE, 0);
            printf ("%s\n", size_string);
            g_free(size_string);
        }
    }
    if (cap_file_size) {
        printf     ("File size:           ");
        if (machine_readable) {
            printf     ("%" PRId64 " bytes\n", cf_info->filesize);
        } else {
            size_string = format_size(cf_info->filesize, FORMAT_SIZE_UNIT_BYTES, 0);
            printf ("%s\n", size_string);
            g_free(size_string);
        }
    }
    if (cap_data_size) {
        printf     ("Data size:           ");
        if (machine_readable) {
            printf     ("%" PRIu64 " bytes\n", cf_info->packet_bytes);
        } else {
            size_string = format_size(cf_info->packet_bytes, FORMAT_SIZE_UNIT_BYTES, 0);
            printf ("%s\n", size_string);
            g_free(size_string);
        }
    }
    if (cf_info->times_known) {
        if (cap_duration) /* XXX - shorten to hh:mm:ss */
            printf("Capture duration:    %s\n", relative_time_string(&cf_info->duration, cf_info->duration_tsprec, cf_info, TRUE));
        if (cap_start_time)
            printf("First packet time:   %s\n", absolute_time_string(&cf_info->start_time, cf_info->start_time_tsprec, cf_info));
        if (cap_end_time)
            printf("Last packet time:    %s\n", absolute_time_string(&cf_info->stop_time, cf_info->stop_time_tsprec, cf_info));
        if (cap_data_rate_byte) {
            printf("Data byte rate:      ");
            if (machine_readable) {
                print_value("", 2, " bytes/sec",   cf_info->data_rate);
            } else {
                size_string = format_size((int64_t)cf_info->data_rate, FORMAT_SIZE_UNIT_BYTES_S, 0);
                printf ("%s\n", size_string);
                g_free(size_string);
            }
        }
        if (cap_data_rate_bit) {
            printf("Data bit rate:       ");
            if (machine_readable) {
                print_value("", 2, " bits/sec",    cf_info->data_rate*8);
            } else {
                size_string = format_size((int64_t)(cf_info->data_rate*8), FORMAT_SIZE_UNIT_BITS_S, 0);
                printf ("%s\n", size_string);
                g_free(size_string);
            }
        }
    }
    if (cap_packet_size)    printf("Average packet size: %.2f bytes\n",        cf_info->packet_size);
    if (cf_info->times_known) {
        if (cap_packet_rate) {
            printf("Average packet rate: ");
            if (machine_readable) {
                print_value("", 2, " packets/sec", cf_info->packet_rate);
            } else {
                size_string = format_size((int64_t)cf_info->packet_rate, FORMAT_SIZE_UNIT_PACKETS_S, 0);
                printf ("%s\n", size_string);
                g_free(size_string);
            }
        }
    }
    if (cap_file_hashes) {
        printf     ("SHA256:              %s\n", file_sha256);
        printf     ("SHA1:                %s\n", file_sha1);
    }
    if (cap_order)          printf     ("Strict time order:   %s\n", order_string(cf_info->order));

    gboolean has_multiple_sections = (wtap_file_get_num_shbs(cf_info->wth) > 1);

    for (guint section_number = 0;
            section_number < wtap_file_get_num_shbs(cf_info->wth);
            section_number++) {
        wtap_block_t shb;

        // If we have more than one section, add headers for each section.
        if (has_multiple_sections)
            printf("Section %u:\n\n", section_number);

        shb = wtap_file_get_shb(cf_info->wth, section_number);
        if (shb != NULL) {
            if (cap_file_more_info) {
                char *str;

                if (wtap_block_get_string_option_value(shb, OPT_SHB_HARDWARE, &str) == WTAP_OPTTYPE_SUCCESS)
                    show_option_string("Capture hardware:    ", str);
                if (wtap_block_get_string_option_value(shb, OPT_SHB_OS, &str) == WTAP_OPTTYPE_SUCCESS)
                    show_option_string("Capture oper-sys:    ", str);
                if (wtap_block_get_string_option_value(shb, OPT_SHB_USERAPPL, &str) == WTAP_OPTTYPE_SUCCESS)
                    show_option_string("Capture application: ", str);
            }
            if (cap_comment) {
                unsigned int i;
                char *str;

                for (i = 0; wtap_block_get_nth_string_option_value(shb, OPT_COMMENT, i, &str) == WTAP_OPTTYPE_SUCCESS; i++) {
                    show_option_string("Capture comment:     ", str);
                }
            }

            if (cap_file_idb && cf_info->num_interfaces != 0) {
                guint i;
                ws_assert(cf_info->num_interfaces == cf_info->idb_info_strings->len);
                printf     ("Number of interfaces in file: %u\n", cf_info->num_interfaces);
                for (i = 0; i < cf_info->idb_info_strings->len; i++) {
                    gchar *s = g_array_index(cf_info->idb_info_strings, gchar*, i);
                    guint32 packet_count = 0;
                    if (i < cf_info->interface_packet_counts->len)
                        packet_count = g_array_index(cf_info->interface_packet_counts, guint32, i);
                    printf   ("Interface #%u info:\n", i);
                    printf   ("%s", s);
                    printf   ("                     Number of packets = %u\n", packet_count);
                }
            }
        }

        if (cap_file_nrb) {
            if (num_ipv4_addresses != 0)
                printf   ("Number of resolved IPv4 addresses in file: %u\n", num_ipv4_addresses);
            if (num_ipv6_addresses != 0)
                printf   ("Number of resolved IPv6 addresses in file: %u\n", num_ipv6_addresses);
        }
        if (cap_file_dsb) {
            if (num_decryption_secrets != 0)
                printf   ("Number of decryption secrets in file: %u\n", num_decryption_secrets);
        }
    }
}

static void
putsep(void)
{
    if (field_separator) putchar(field_separator);
}

static void
putquote(void)
{
    if (quote_char) putchar(quote_char);
}

static void
print_stats_table_header_label(const gchar *label)
{
    putsep();
    putquote();
    printf("%s", label);