1998-09-16 02:39:15 +00:00
|
|
|
/* capture.c
|
|
|
|
* Routines for packet capture windows
|
|
|
|
*
|
2004-07-18 00:24:25 +00:00
|
|
|
* $Id$
|
1998-09-16 03:22:19 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* Ethereal - Network traffic analyzer
|
2001-10-25 06:41:48 +00:00
|
|
|
* By Gerald Combs <gerald@ethereal.com>
|
1998-09-16 02:39:15 +00:00
|
|
|
* Copyright 1998 Gerald Combs
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
|
|
*/
|
|
|
|
|
2004-05-09 10:03:41 +00:00
|
|
|
/* With MSVC and a libethereal.dll this file needs to import some variables
|
|
|
|
in a special way. Therefore _NEED_VAR_IMPORT_ is defined. */
|
|
|
|
#define _NEED_VAR_IMPORT_
|
|
|
|
|
1998-09-16 02:39:15 +00:00
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
# include "config.h"
|
|
|
|
#endif
|
|
|
|
|
1999-07-09 04:18:36 +00:00
|
|
|
#ifdef HAVE_LIBPCAP
|
|
|
|
|
1999-07-31 23:06:13 +00:00
|
|
|
#ifdef HAVE_SYS_STAT_H
|
|
|
|
# include <sys/stat.h>
|
|
|
|
#endif
|
|
|
|
|
1999-11-29 01:54:01 +00:00
|
|
|
#ifdef HAVE_SYS_WAIT_H
|
|
|
|
# include <sys/wait.h>
|
|
|
|
#endif
|
2000-12-27 22:35:48 +00:00
|
|
|
|
|
|
|
#ifndef _WIN32
|
|
|
|
/*
|
|
|
|
* Define various POSIX macros (and, in the case of WCOREDUMP, non-POSIX
|
|
|
|
* macros) on UNIX systems that don't have them.
|
|
|
|
*/
|
|
|
|
#ifndef WIFEXITED
|
|
|
|
# define WIFEXITED(status) (((status) & 0177) == 0)
|
|
|
|
#endif
|
|
|
|
#ifndef WIFSTOPPED
|
|
|
|
# define WIFSTOPPED(status) (((status) & 0177) == 0177)
|
|
|
|
#endif
|
|
|
|
#ifndef WIFSIGNALED
|
|
|
|
# define WIFSIGNALED(status) (!WIFSTOPPED(status) && !WIFEXITED(status))
|
|
|
|
#endif
|
|
|
|
#ifndef WEXITSTATUS
|
|
|
|
# define WEXITSTATUS(status) ((status) >> 8)
|
|
|
|
#endif
|
|
|
|
#ifndef WTERMSIG
|
|
|
|
# define WTERMSIG(status) ((status) & 0177)
|
|
|
|
#endif
|
|
|
|
#ifndef WCOREDUMP
|
|
|
|
# define WCOREDUMP(status) ((status) & 0200)
|
|
|
|
#endif
|
|
|
|
#ifndef WSTOPSIG
|
|
|
|
# define WSTOPSIG(status) ((status) >> 8)
|
|
|
|
#endif
|
|
|
|
#endif /* _WIN32 */
|
|
|
|
|
2000-02-09 19:18:42 +00:00
|
|
|
#ifdef HAVE_IO_H
|
2000-12-27 22:35:48 +00:00
|
|
|
# include <io.h>
|
2000-02-09 19:18:42 +00:00
|
|
|
#endif
|
1999-11-29 01:54:01 +00:00
|
|
|
|
2003-12-21 12:19:39 +00:00
|
|
|
#include <pcap.h>
|
|
|
|
|
2004-01-22 18:13:57 +00:00
|
|
|
#include <glib.h>
|
1998-12-17 05:42:33 +00:00
|
|
|
#include <stdlib.h>
|
1999-04-06 16:24:50 +00:00
|
|
|
#include <stdio.h>
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
#include <ctype.h>
|
1998-09-16 02:39:15 +00:00
|
|
|
#include <string.h>
|
2000-08-11 13:37:21 +00:00
|
|
|
|
|
|
|
#ifdef HAVE_FCNTL_H
|
1999-10-02 06:26:53 +00:00
|
|
|
#include <fcntl.h>
|
2000-08-11 13:37:21 +00:00
|
|
|
#endif
|
1999-08-03 20:51:41 +00:00
|
|
|
|
|
|
|
#ifdef HAVE_UNISTD_H
|
1998-10-13 07:03:37 +00:00
|
|
|
#include <unistd.h>
|
1999-08-03 20:51:41 +00:00
|
|
|
#endif
|
|
|
|
|
1998-12-29 04:05:38 +00:00
|
|
|
#include <time.h>
|
1999-08-03 20:51:41 +00:00
|
|
|
|
|
|
|
#ifdef HAVE_SYS_SOCKET_H
|
1998-09-16 02:39:15 +00:00
|
|
|
#include <sys/socket.h>
|
1999-08-03 20:51:41 +00:00
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifdef HAVE_SYS_IOCTL_H
|
1998-09-16 02:39:15 +00:00
|
|
|
#include <sys/ioctl.h>
|
1999-08-03 20:51:41 +00:00
|
|
|
#endif
|
|
|
|
|
1999-05-11 18:51:10 +00:00
|
|
|
#include <signal.h>
|
|
|
|
#include <errno.h>
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1998-10-10 03:32:20 +00:00
|
|
|
#ifdef NEED_SNPRINTF_H
|
|
|
|
# include "snprintf.h"
|
|
|
|
#endif
|
|
|
|
|
2001-01-09 00:53:26 +00:00
|
|
|
/*
|
|
|
|
* We don't want to do a "select()" on the pcap_t's file descriptor on
|
|
|
|
* BSD (because "select()" doesn't work correctly on BPF devices on at
|
|
|
|
* least some releases of some flavors of BSD), and we don't want to do
|
|
|
|
* it on Windows (because "select()" is something for sockets, not for
|
2003-11-14 21:18:06 +00:00
|
|
|
* arbitrary handles). (Note that "Windows" here includes Cygwin;
|
|
|
|
* even in its pretend-it's-UNIX environment, we're using WinPcap, not
|
|
|
|
* a UNIX libpcap.)
|
2001-01-09 00:53:26 +00:00
|
|
|
*
|
|
|
|
* We *do* want to do it on other platforms, as, on other platforms (with
|
|
|
|
* the possible exception of Ultrix and Digital UNIX), the read timeout
|
|
|
|
* doesn't expire if no packets have arrived, so a "pcap_dispatch()" call
|
|
|
|
* will block until packets arrive, causing the UI to hang.
|
2003-11-14 21:18:06 +00:00
|
|
|
*
|
|
|
|
* XXX - the various BSDs appear to define BSD in <sys/param.h>; we don't
|
|
|
|
* want to include it if it's not present on this platform, however.
|
2001-01-09 00:53:26 +00:00
|
|
|
*/
|
2003-11-17 19:40:09 +00:00
|
|
|
#if !defined(__FreeBSD__) && !defined(__NetBSD__) && !defined(__OpenBSD__) && \
|
2003-11-14 21:18:06 +00:00
|
|
|
!defined(__bsdi__) && !defined(__APPLE__) && !defined(_WIN32) && \
|
|
|
|
!defined(__CYGWIN__)
|
2001-01-09 00:53:26 +00:00
|
|
|
# define MUST_DO_SELECT
|
|
|
|
#endif
|
|
|
|
|
2002-01-21 07:37:49 +00:00
|
|
|
#include <epan/packet.h>
|
2003-10-11 21:49:56 +00:00
|
|
|
#include <epan/dfilter/dfilter.h>
|
1998-09-16 02:39:15 +00:00
|
|
|
#include "file.h"
|
|
|
|
#include "capture.h"
|
2004-10-30 11:44:06 +00:00
|
|
|
#include "capture_sync.h"
|
1998-09-16 02:39:15 +00:00
|
|
|
#include "util.h"
|
2001-11-09 07:44:51 +00:00
|
|
|
#include "pcap-util.h"
|
2004-02-11 01:23:25 +00:00
|
|
|
#include "alert_box.h"
|
2000-01-03 06:59:25 +00:00
|
|
|
#include "simple_dialog.h"
|
2004-09-27 22:55:15 +00:00
|
|
|
#include <epan/prefs.h>
|
1999-09-09 03:32:03 +00:00
|
|
|
#include "globals.h"
|
2001-12-04 07:32:05 +00:00
|
|
|
#include "conditions.h"
|
|
|
|
#include "capture_stop_conditions.h"
|
2001-12-04 08:26:00 +00:00
|
|
|
#include "ringbuffer.h"
|
1998-09-16 02:39:15 +00:00
|
|
|
|
2000-07-30 16:54:12 +00:00
|
|
|
#include "wiretap/libpcap.h"
|
2000-09-14 11:49:40 +00:00
|
|
|
#include "wiretap/wtap.h"
|
2002-06-07 21:11:24 +00:00
|
|
|
#include "wiretap/wtap-capture.h"
|
2000-07-30 16:54:12 +00:00
|
|
|
|
2004-07-18 18:06:47 +00:00
|
|
|
#include <epan/dissectors/packet-ap1394.h>
|
|
|
|
#include <epan/dissectors/packet-atalk.h>
|
|
|
|
#include <epan/dissectors/packet-atm.h>
|
|
|
|
#include <epan/dissectors/packet-clip.h>
|
|
|
|
#include <epan/dissectors/packet-eth.h>
|
|
|
|
#include <epan/dissectors/packet-fddi.h>
|
|
|
|
#include <epan/dissectors/packet-null.h>
|
|
|
|
#include <epan/dissectors/packet-ppp.h>
|
|
|
|
#include <epan/dissectors/packet-raw.h>
|
|
|
|
#include <epan/dissectors/packet-sll.h>
|
|
|
|
#include <epan/dissectors/packet-tr.h>
|
|
|
|
#include <epan/dissectors/packet-ieee80211.h>
|
|
|
|
#include <epan/dissectors/packet-chdlc.h>
|
|
|
|
#include <epan/dissectors/packet-prism.h>
|
|
|
|
#include <epan/dissectors/packet-ipfc.h>
|
|
|
|
#include <epan/dissectors/packet-arcnet.h>
|
2000-02-15 21:06:58 +00:00
|
|
|
|
2002-12-31 21:12:55 +00:00
|
|
|
#ifdef _WIN32
|
2001-11-09 07:44:51 +00:00
|
|
|
#include "capture-wpcap.h"
|
|
|
|
#endif
|
2004-01-22 18:13:57 +00:00
|
|
|
#include "ui_util.h"
|
2001-11-09 07:44:51 +00:00
|
|
|
|
"autostop_filesize" and "autostop_duration" don't need to be in the
"capture_file" structure - they're a property of an in-progress capture,
not a property of an open capture file. Make them just variables.
The maximum number of packets to be captured should be a variable
separate from the "count" field in the "capture_file" structure - the
latter is a count of the packets in the capture file in question.
Have Boolean variables indicating whether a maximum packet count,
maximum capture file size, and maximum capture duration were specified.
If an option isn't set, and we're doing an "update list of packets in
real time" capture, don't pass the option to the child process with a
command-line argument.
Don't create "stop when the capture file reaches this size" or "stop
when the capture's run for this long" conditions if a maximum capture
file size or a maximum capture duration, respectively, haven't been
specified. Don't test or free a condition if it wasn't created.
Don't allow a 0 argument to the "-c" flag - the absence of a "-c" flag
is the way you specify "no limit on the number of packets".
Initialize the check boxes and spin buttons for the "maximum packets to
capture", "maximum capture size", and "maximum capture duration" options
to the values they had in the last capture. If an option wasn't
specified, don't read its value from the dialog box and set the
variable.
svn path=/trunk/; revision=4795
2002-02-24 03:33:05 +00:00
|
|
|
/*
|
|
|
|
* Capture options.
|
|
|
|
*/
|
2002-02-24 09:25:36 +00:00
|
|
|
capture_options capture_opts;
|
2004-02-21 13:40:06 +00:00
|
|
|
gboolean quit_after_cap = FALSE;/* Makes a "capture only mode". Implies -k */
|
|
|
|
gboolean capture_child; /* if this is the child for "-S" */
|
"autostop_filesize" and "autostop_duration" don't need to be in the
"capture_file" structure - they're a property of an in-progress capture,
not a property of an open capture file. Make them just variables.
The maximum number of packets to be captured should be a variable
separate from the "count" field in the "capture_file" structure - the
latter is a count of the packets in the capture file in question.
Have Boolean variables indicating whether a maximum packet count,
maximum capture file size, and maximum capture duration were specified.
If an option isn't set, and we're doing an "update list of packets in
real time" capture, don't pass the option to the child process with a
command-line argument.
Don't create "stop when the capture file reaches this size" or "stop
when the capture's run for this long" conditions if a maximum capture
file size or a maximum capture duration, respectively, haven't been
specified. Don't test or free a condition if it wasn't created.
Don't allow a 0 argument to the "-c" flag - the absence of a "-c" flag
is the way you specify "no limit on the number of packets".
Initialize the check boxes and spin buttons for the "maximum packets to
capture", "maximum capture size", and "maximum capture duration" options
to the values they had in the last capture. If an option wasn't
specified, don't read its value from the dialog box and set the
variable.
svn path=/trunk/; revision=4795
2002-02-24 03:33:05 +00:00
|
|
|
|
2000-06-15 08:02:43 +00:00
|
|
|
|
1999-08-15 22:31:22 +00:00
|
|
|
typedef struct _loop_data {
|
Make the "go" member of the "loop_data" structure in Ethereal a
"gboolean", as it's a Boolean value, and move it to the beginning of the
structure in Tethereal, as it is in Ethereal.
From Graeme Hewson:
Check for "pcap_dispatch()" returning -1, meaning an error
occurred; if it does, stop capturing, and report the error.
If we get a signal in tethereal, stop the capture with a
"longjmp()", rather than by clearning the "go" flag;
"pcap_dispatch()", on many platforms, keeps reading rather than
returning a captured packet count of 0 if the system call to
read packets returns -1 with an errno of EINTR, so the
"pcap_dispatch()" won't be broken out of if the signal handler
returns.
Fix a typo in an error message.
svn path=/trunk/; revision=4471
2002-01-03 22:03:24 +00:00
|
|
|
gboolean go; /* TRUE as long as we're supposed to keep capturing */
|
2001-02-10 09:08:14 +00:00
|
|
|
gint max; /* Number of packets we're supposed to capture - 0 means infinite */
|
|
|
|
int err; /* if non-zero, error seen while capturing */
|
1999-08-15 22:31:22 +00:00
|
|
|
gint linktype;
|
|
|
|
gint sync_packets;
|
Make the "go" member of the "loop_data" structure in Ethereal a
"gboolean", as it's a Boolean value, and move it to the beginning of the
structure in Tethereal, as it is in Ethereal.
From Graeme Hewson:
Check for "pcap_dispatch()" returning -1, meaning an error
occurred; if it does, stop capturing, and report the error.
If we get a signal in tethereal, stop the capture with a
"longjmp()", rather than by clearning the "go" flag;
"pcap_dispatch()", on many platforms, keeps reading rather than
returning a captured packet count of 0 if the system call to
read packets returns -1 with an errno of EINTR, so the
"pcap_dispatch()" won't be broken out of if the signal handler
returns.
Fix a typo in an error message.
svn path=/trunk/; revision=4471
2002-01-03 22:03:24 +00:00
|
|
|
gboolean pcap_err; /* TRUE if error from pcap */
|
2004-02-21 12:58:42 +00:00
|
|
|
gboolean from_cap_pipe;/* TRUE if we are capturing data from a pipe */
|
1999-08-15 22:31:22 +00:00
|
|
|
packet_counts counts;
|
Add to Wiretap the ability to write capture files; for now, it can only
write them in "libpcap" format, but the mechanism can have other formats
added.
When creating the temporary file for a capture, use "create_tempfile()",
to close a security hole opened by the fact that "tempnam()" creates a
temporary file, but doesn't open it, and we open the file with the name
it gives us - somebody could remove the file and plant a link to some
file, and, if as may well be the case when Ethereal is capturing
packets, it's running as "root", that means we write a capture on top of
that file.... (The aforementioned changes to Wiretap let you open a
capture file for writing given an file descriptor, "fdopen()"-style,
which this change requires.)
svn path=/trunk/; revision=509
1999-08-18 04:17:38 +00:00
|
|
|
wtap_dumper *pdh;
|
2002-06-13 21:23:02 +00:00
|
|
|
#ifndef _WIN32
|
|
|
|
gboolean modified; /* TRUE if data in the pipe uses modified pcap headers */
|
|
|
|
gboolean byte_swapped; /* TRUE if data in the pipe is byte swapped */
|
2004-02-21 12:58:42 +00:00
|
|
|
unsigned int bytes_to_read, bytes_read; /* Used by cap_pipe_dispatch */
|
2002-06-13 21:23:02 +00:00
|
|
|
enum {
|
|
|
|
STATE_EXPECT_REC_HDR, STATE_READ_REC_HDR,
|
|
|
|
STATE_EXPECT_DATA, STATE_READ_DATA
|
2004-02-21 12:58:42 +00:00
|
|
|
} cap_pipe_state;
|
2002-06-13 21:23:02 +00:00
|
|
|
|
2004-02-21 12:58:42 +00:00
|
|
|
enum { PIPOK, PIPEOF, PIPERR, PIPNEXIST } cap_pipe_err;
|
2002-06-13 21:23:02 +00:00
|
|
|
#endif
|
1999-08-15 22:31:22 +00:00
|
|
|
} loop_data;
|
|
|
|
|
2004-06-30 06:58:59 +00:00
|
|
|
/* Win32 needs the O_BINARY flag for open() */
|
|
|
|
#ifndef O_BINARY
|
|
|
|
#define O_BINARY 0
|
|
|
|
#endif
|
2000-09-15 05:32:49 +00:00
|
|
|
|
2004-02-21 14:04:17 +00:00
|
|
|
static gboolean normal_do_capture(gboolean is_tempfile);
|
|
|
|
static void capture_pcap_cb(guchar *, const struct pcap_pkthdr *,
|
|
|
|
const guchar *);
|
|
|
|
static void get_capture_file_io_error(char *, int, const char *, int, gboolean);
|
|
|
|
static void popup_errmsg(const char *);
|
|
|
|
static void stop_capture_signal_handler(int signo);
|
|
|
|
|
|
|
|
#ifndef _WIN32
|
|
|
|
static void cap_pipe_adjust_header(loop_data *, struct pcap_hdr *, struct pcaprec_hdr *);
|
|
|
|
static int cap_pipe_open_live(char *, struct pcap_hdr *, loop_data *, char *, int);
|
|
|
|
static int cap_pipe_dispatch(int, loop_data *, struct pcap_hdr *, \
|
|
|
|
struct pcaprec_modified_hdr *, guchar *, char *, int);
|
|
|
|
#endif
|
|
|
|
|
2000-09-15 05:32:49 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
1999-10-02 06:26:53 +00:00
|
|
|
/* Open a specified file, or create a temporary file, and start a capture
|
2003-09-15 23:15:32 +00:00
|
|
|
to the file in question. Returns TRUE if the capture starts
|
|
|
|
successfully, FALSE otherwise. */
|
|
|
|
gboolean
|
2002-09-09 20:39:01 +00:00
|
|
|
do_capture(const char *save_file)
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
{
|
|
|
|
char tmpname[128+1];
|
Allow the user to save either all of the current capture, or only the
packets that are currently being displayed from that capture.
Centralize the code to control whether "File:Save" and "File:Save As"
are enabled (and *always* have "File:Save As" enabled if you have a
capture; "File:Save" is enabled only if you have a live capture you've
not yet saved, although it does the same thing as "File:Save As").
Have the "save_file" member of a "capture_file" structure represent
*only* the file currently being *written* to by a capture, and, if there
is no capture currently in progress, have it be NULL; the name of the
file currently being *displayed" is in the "filename" member, and an
"is_tempfile" member indicates whether it's a temporary file for a live
capture or not.
Have "close_cap_file()" delete the current capture file if it's a
temporary capture file that hasn't been saved (in its entirety - saving
selected frames doesn't count). Do the same (if there *is* a current
capture file) when exiting.
The "Ready to load or capture" message is the only statusbar message in
the "main" context; "close_cap_file()" should never pop it, it should
only pop whatever message exists in the "file" context, and thus has no
need to take, as an argument, the context for the message it should pop.
Update the man page to reflect the new behavior of "File:Save" and
"File:Save As", and to reflect recent changes to "Display:Match Selected".
svn path=/trunk/; revision=1170
1999-11-30 20:50:15 +00:00
|
|
|
gboolean is_tempfile;
|
2002-09-09 20:39:01 +00:00
|
|
|
gchar *capfile_name;
|
2004-06-20 13:39:44 +00:00
|
|
|
gboolean ret;
|
2002-09-09 20:39:01 +00:00
|
|
|
|
|
|
|
if (save_file != NULL) {
|
|
|
|
/* If the Sync option is set, we return to the caller while the capture
|
|
|
|
* is in progress. Therefore we need to take a copy of save_file in
|
|
|
|
* case the caller destroys it after we return.
|
|
|
|
*/
|
|
|
|
capfile_name = g_strdup(save_file);
|
2004-03-02 22:07:23 +00:00
|
|
|
if (capture_opts.multi_files_on) {
|
2001-12-04 08:26:00 +00:00
|
|
|
/* ringbuffer is enabled */
|
2002-02-24 09:25:36 +00:00
|
|
|
cfile.save_file_fd = ringbuf_init(capfile_name,
|
2004-03-04 19:31:21 +00:00
|
|
|
(capture_opts.has_ring_num_files) ? capture_opts.ring_num_files : 0);
|
2001-12-04 08:26:00 +00:00
|
|
|
} else {
|
|
|
|
/* Try to open/create the specified file for use as a capture buffer. */
|
2002-02-24 09:25:36 +00:00
|
|
|
cfile.save_file_fd = open(capfile_name, O_RDWR|O_BINARY|O_TRUNC|O_CREAT,
|
|
|
|
0600);
|
2001-12-04 08:26:00 +00:00
|
|
|
}
|
Allow the user to save either all of the current capture, or only the
packets that are currently being displayed from that capture.
Centralize the code to control whether "File:Save" and "File:Save As"
are enabled (and *always* have "File:Save As" enabled if you have a
capture; "File:Save" is enabled only if you have a live capture you've
not yet saved, although it does the same thing as "File:Save As").
Have the "save_file" member of a "capture_file" structure represent
*only* the file currently being *written* to by a capture, and, if there
is no capture currently in progress, have it be NULL; the name of the
file currently being *displayed" is in the "filename" member, and an
"is_tempfile" member indicates whether it's a temporary file for a live
capture or not.
Have "close_cap_file()" delete the current capture file if it's a
temporary capture file that hasn't been saved (in its entirety - saving
selected frames doesn't count). Do the same (if there *is* a current
capture file) when exiting.
The "Ready to load or capture" message is the only statusbar message in
the "main" context; "close_cap_file()" should never pop it, it should
only pop whatever message exists in the "file" context, and thus has no
need to take, as an argument, the context for the message it should pop.
Update the man page to reflect the new behavior of "File:Save" and
"File:Save As", and to reflect recent changes to "Display:Match Selected".
svn path=/trunk/; revision=1170
1999-11-30 20:50:15 +00:00
|
|
|
is_tempfile = FALSE;
|
1999-10-02 06:26:53 +00:00
|
|
|
} else {
|
|
|
|
/* Choose a random name for the capture buffer */
|
2000-06-27 04:36:03 +00:00
|
|
|
cfile.save_file_fd = create_tempfile(tmpname, sizeof tmpname, "ether");
|
1999-10-02 06:26:53 +00:00
|
|
|
capfile_name = g_strdup(tmpname);
|
Allow the user to save either all of the current capture, or only the
packets that are currently being displayed from that capture.
Centralize the code to control whether "File:Save" and "File:Save As"
are enabled (and *always* have "File:Save As" enabled if you have a
capture; "File:Save" is enabled only if you have a live capture you've
not yet saved, although it does the same thing as "File:Save As").
Have the "save_file" member of a "capture_file" structure represent
*only* the file currently being *written* to by a capture, and, if there
is no capture currently in progress, have it be NULL; the name of the
file currently being *displayed" is in the "filename" member, and an
"is_tempfile" member indicates whether it's a temporary file for a live
capture or not.
Have "close_cap_file()" delete the current capture file if it's a
temporary capture file that hasn't been saved (in its entirety - saving
selected frames doesn't count). Do the same (if there *is* a current
capture file) when exiting.
The "Ready to load or capture" message is the only statusbar message in
the "main" context; "close_cap_file()" should never pop it, it should
only pop whatever message exists in the "file" context, and thus has no
need to take, as an argument, the context for the message it should pop.
Update the man page to reflect the new behavior of "File:Save" and
"File:Save As", and to reflect recent changes to "Display:Match Selected".
svn path=/trunk/; revision=1170
1999-11-30 20:50:15 +00:00
|
|
|
is_tempfile = TRUE;
|
1999-10-02 06:26:53 +00:00
|
|
|
}
|
2000-06-27 04:36:03 +00:00
|
|
|
if (cfile.save_file_fd == -1) {
|
2000-07-20 05:10:02 +00:00
|
|
|
if (is_tempfile) {
|
2004-01-31 03:22:42 +00:00
|
|
|
simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK,
|
2000-07-20 05:10:02 +00:00
|
|
|
"The temporary file to which the capture would be saved (\"%s\")"
|
1999-11-28 09:44:53 +00:00
|
|
|
"could not be opened: %s.", capfile_name, strerror(errno));
|
2000-07-20 05:10:02 +00:00
|
|
|
} else {
|
2004-03-02 22:07:23 +00:00
|
|
|
if (capture_opts.multi_files_on) {
|
2001-12-04 08:26:00 +00:00
|
|
|
ringbuf_error_cleanup();
|
|
|
|
}
|
2004-02-11 01:23:25 +00:00
|
|
|
open_failure_alert_box(capfile_name, errno, TRUE);
|
2000-07-20 05:10:02 +00:00
|
|
|
}
|
2002-09-09 20:39:01 +00:00
|
|
|
g_free(capfile_name);
|
2003-09-15 23:15:32 +00:00
|
|
|
return FALSE;
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
}
|
2003-09-15 22:48:42 +00:00
|
|
|
cf_close(&cfile);
|
2000-06-27 04:36:03 +00:00
|
|
|
g_assert(cfile.save_file == NULL);
|
|
|
|
cfile.save_file = capfile_name;
|
2002-09-09 20:39:01 +00:00
|
|
|
/* cfile.save_file is "g_free"ed below, which is equivalent to
|
|
|
|
"g_free(capfile_name)". */
|
Add a new global flag "capture_child", which is TRUE if we're a child
process for a sync mode or fork mode capture.
Have that flag control whether we do things that *only* the parent or
*only* the child should do, rather than basing it solely on the setting
of "sync_mode" or "fork_mode" (or, in the case of stuff done in the
child process either in sync mode or fork mode, rather than basing it on
the setting of those flags at all).
Split "do_capture()" into a "run_capture()" routine that starts a
capture (possibly by forking off and execing a child process, if we're
supposed to do sync mode or fork mode captures), and that assumes the
file to which the capture is to write has already been opened and that
"cf.save_file_fd" is the file descriptor for that file, and a
"do_capture()" routine that creates a temporary file, getting an FD for
it, and calls "run_capture()".
Use "run_capture()", rather than "capture()", for "-k" captures, so that
it'll do the capture in a child process if "-S" or "-F" was specified
("do_capture()" won't do because "-k" captures should write to the file
specified by the "-w" flag, not some random temporary file).
For child process captures, however, just use "capture()" - the child
process shouldn't itself fork off a child if we're in sync or fork mode,
and should just write to the file whose file descriptor was specified by
the "-W" flag on the command line.
All this allows you to do "ethereal -S -w <file> -i <interface> -k" to
start a sync mode capture from the command line.
svn path=/trunk/; revision=740
1999-09-30 06:50:01 +00:00
|
|
|
|
2004-02-21 12:58:42 +00:00
|
|
|
if (capture_opts.sync_mode) {
|
|
|
|
/* sync mode: do the capture in a child process */
|
2004-06-20 13:39:44 +00:00
|
|
|
ret = sync_pipe_do_capture(is_tempfile);
|
2004-02-21 12:58:42 +00:00
|
|
|
/* capture is still running */
|
2004-06-20 13:39:44 +00:00
|
|
|
set_main_window_name("(Live Capture in Progress) - Ethereal");
|
2004-02-21 12:58:42 +00:00
|
|
|
} else {
|
|
|
|
/* normal mode: do the capture synchronously */
|
2004-06-20 13:39:44 +00:00
|
|
|
set_main_window_name("(Live Capture in Progress) - Ethereal");
|
|
|
|
ret = normal_do_capture(is_tempfile);
|
2004-02-21 12:58:42 +00:00
|
|
|
/* capture is finished here */
|
|
|
|
}
|
2004-06-20 13:39:44 +00:00
|
|
|
|
|
|
|
return ret;
|
2004-02-21 12:58:42 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2004-10-30 11:44:06 +00:00
|
|
|
/* start a normal capture session */
|
2004-02-21 12:58:42 +00:00
|
|
|
static gboolean
|
|
|
|
normal_do_capture(gboolean is_tempfile)
|
|
|
|
{
|
|
|
|
int capture_succeeded;
|
|
|
|
gboolean stats_known;
|
|
|
|
struct pcap_stat stats;
|
|
|
|
int err;
|
|
|
|
|
|
|
|
/* Not sync mode. */
|
|
|
|
capture_succeeded = capture(&stats_known, &stats);
|
|
|
|
if (quit_after_cap) {
|
|
|
|
/* DON'T unlink the save file. Presumably someone wants it. */
|
|
|
|
main_window_exit();
|
|
|
|
}
|
|
|
|
if (!capture_succeeded) {
|
|
|
|
/* We didn't succeed in doing the capture, so we don't have a save
|
|
|
|
file. */
|
2004-03-02 22:07:23 +00:00
|
|
|
if (capture_opts.multi_files_on) {
|
2004-02-21 12:58:42 +00:00
|
|
|
ringbuf_free();
|
|
|
|
} else {
|
|
|
|
g_free(cfile.save_file);
|
|
|
|
}
|
|
|
|
cfile.save_file = NULL;
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
/* Capture succeeded; attempt to read in the capture file. */
|
|
|
|
if ((err = cf_open(cfile.save_file, is_tempfile, &cfile)) != 0) {
|
|
|
|
/* We're not doing a capture any more, so we don't have a save
|
|
|
|
file. */
|
2004-03-02 22:07:23 +00:00
|
|
|
if (capture_opts.multi_files_on) {
|
2004-02-21 12:58:42 +00:00
|
|
|
ringbuf_free();
|
|
|
|
} else {
|
|
|
|
g_free(cfile.save_file);
|
|
|
|
}
|
|
|
|
cfile.save_file = NULL;
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Set the read filter to NULL. */
|
|
|
|
cfile.rfcode = NULL;
|
|
|
|
|
|
|
|
/* Get the packet-drop statistics.
|
|
|
|
|
|
|
|
XXX - there are currently no packet-drop statistics stored
|
|
|
|
in libpcap captures, and that's what we're reading.
|
|
|
|
|
|
|
|
At some point, we will add support in Wiretap to return
|
|
|
|
packet-drop statistics for capture file formats that store it,
|
|
|
|
and will make "cf_read()" get those statistics from Wiretap.
|
|
|
|
We clear the statistics (marking them as "not known") in
|
|
|
|
"cf_open()", and "cf_read()" will only fetch them and mark
|
|
|
|
them as known if Wiretap supplies them, so if we get the
|
|
|
|
statistics now, after calling "cf_open()" but before calling
|
|
|
|
"cf_read()", the values we store will be used by "cf_read()".
|
|
|
|
|
|
|
|
If a future libpcap capture file format stores the statistics,
|
|
|
|
we'll put them into the capture file that we write, and will
|
|
|
|
thus not have to set them here - "cf_read()" will get them from
|
|
|
|
the file and use them. */
|
|
|
|
if (stats_known) {
|
|
|
|
cfile.drops_known = TRUE;
|
|
|
|
|
|
|
|
/* XXX - on some systems, libpcap doesn't bother filling in
|
|
|
|
"ps_ifdrop" - it doesn't even set it to zero - so we don't
|
|
|
|
bother looking at it.
|
|
|
|
|
|
|
|
Ideally, libpcap would have an interface that gave us
|
|
|
|
several statistics - perhaps including various interface
|
|
|
|
error statistics - and would tell us which of them it
|
|
|
|
supplies, allowing us to display only the ones it does. */
|
|
|
|
cfile.drops = stats.ps_drop;
|
|
|
|
}
|
|
|
|
switch (cf_read(&cfile)) {
|
|
|
|
|
|
|
|
case READ_SUCCESS:
|
|
|
|
case READ_ERROR:
|
|
|
|
/* Just because we got an error, that doesn't mean we were unable
|
|
|
|
to read any of the file; we handle what we could get from the
|
|
|
|
file. */
|
|
|
|
break;
|
|
|
|
|
|
|
|
case READ_ABORTED:
|
|
|
|
/* Exit by leaving the main loop, so that any quit functions
|
|
|
|
we registered get called. */
|
|
|
|
main_window_nested_quit();
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* We're not doing a capture any more, so we don't have a save
|
|
|
|
file. */
|
2004-03-02 22:07:23 +00:00
|
|
|
if (capture_opts.multi_files_on) {
|
2004-02-21 12:58:42 +00:00
|
|
|
ringbuf_free();
|
|
|
|
} else {
|
|
|
|
g_free(cfile.save_file);
|
|
|
|
}
|
|
|
|
cfile.save_file = NULL;
|
|
|
|
|
|
|
|
/* if we didn't captured even a single packet, close the file again */
|
|
|
|
if(cfile.count == 0) {
|
|
|
|
simple_dialog(ESD_TYPE_INFO, ESD_BTN_OK,
|
|
|
|
"%sNo packets captured!%s\n\n"
|
|
|
|
"As no data was captured, closing the %scapture file!",
|
|
|
|
simple_dialog_primary_start(), simple_dialog_primary_end(),
|
|
|
|
(cfile.is_tempfile) ? "temporary " : "");
|
|
|
|
cf_close(&cfile);
|
|
|
|
}
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
Enough is enough. Requiring anybody who uses Ethereal on Linux to
update their libpcap probably isn't going to scale - the increasing
frequency with which "Ethereal hangs when I try to capture packets"
shows up on "ethereal-dev" suggests that, unless and until a libpcap
with the "select()" in it becomes ubiquitous on Linux, that'll be the
source of a constant support burden - so we'll just put the "select()"
in Ethereal if it's being built for Linux.
(Putting it in for platforms where the read timeout argument to
"pcap_open_live()" works adds an extra useless system call at best and,
at worst, could make Ethereal not work - "select()" doesn't work on
"/dev/bpf" devices on FreeBSD 3.3, at least, unless you're in "immediate
mode", and, whilst "immediate mode" would make Ethereal respond more
quickly when packets arrive, it might cause Ethereal to respond too
quickly, doing reads for every new packet rather than waiting for
multiple packets to arrive and reading them all with one "read()", which
appears to be at least part of the intent of the read timeout on
"/dev/bpf" devices in BSD.)
svn path=/trunk/; revision=1451
2000-01-12 06:56:32 +00:00
|
|
|
/*
|
|
|
|
* Timeout, in milliseconds, for reads from the stream of captured packets.
|
|
|
|
*/
|
|
|
|
#define CAP_READ_TIMEOUT 250
|
|
|
|
|
2000-07-30 16:54:12 +00:00
|
|
|
#ifndef _WIN32
|
2002-12-29 01:25:01 +00:00
|
|
|
/* Take care of byte order in the libpcap headers read from pipes.
|
2000-07-30 16:54:12 +00:00
|
|
|
* (function taken from wiretap/libpcap.c) */
|
|
|
|
static void
|
2004-02-21 12:58:42 +00:00
|
|
|
cap_pipe_adjust_header(loop_data *ld, struct pcap_hdr *hdr, struct pcaprec_hdr *rechdr)
|
2000-07-30 16:54:12 +00:00
|
|
|
{
|
|
|
|
if (ld->byte_swapped) {
|
|
|
|
/* Byte-swap the record header fields. */
|
|
|
|
rechdr->ts_sec = BSWAP32(rechdr->ts_sec);
|
|
|
|
rechdr->ts_usec = BSWAP32(rechdr->ts_usec);
|
|
|
|
rechdr->incl_len = BSWAP32(rechdr->incl_len);
|
|
|
|
rechdr->orig_len = BSWAP32(rechdr->orig_len);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* In file format version 2.3, the "incl_len" and "orig_len" fields were
|
|
|
|
swapped, in order to match the BPF header layout.
|
|
|
|
|
|
|
|
Unfortunately, some files were, according to a comment in the "libpcap"
|
|
|
|
source, written with version 2.3 in their headers but without the
|
|
|
|
interchanged fields, so if "incl_len" is greater than "orig_len" - which
|
|
|
|
would make no sense - we assume that we need to swap them. */
|
|
|
|
if (hdr->version_major == 2 &&
|
|
|
|
(hdr->version_minor < 3 ||
|
|
|
|
(hdr->version_minor == 3 && rechdr->incl_len > rechdr->orig_len))) {
|
|
|
|
guint32 temp;
|
|
|
|
|
|
|
|
temp = rechdr->orig_len;
|
|
|
|
rechdr->orig_len = rechdr->incl_len;
|
|
|
|
rechdr->incl_len = temp;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2002-08-28 21:04:11 +00:00
|
|
|
/* Mimic pcap_open_live() for pipe captures
|
2000-07-30 16:54:12 +00:00
|
|
|
* We check if "pipename" is "-" (stdin) or a FIFO, open it, and read the
|
|
|
|
* header.
|
|
|
|
* N.B. : we can't read the libpcap formats used in RedHat 6.1 or SuSE 6.3
|
|
|
|
* because we can't seek on pipes (see wiretap/libpcap.c for details) */
|
|
|
|
static int
|
2004-02-21 12:58:42 +00:00
|
|
|
cap_pipe_open_live(char *pipename, struct pcap_hdr *hdr, loop_data *ld,
|
2002-06-13 21:23:02 +00:00
|
|
|
char *errmsg, int errmsgl)
|
2000-07-30 16:54:12 +00:00
|
|
|
{
|
|
|
|
struct stat pipe_stat;
|
|
|
|
int fd;
|
|
|
|
guint32 magic;
|
2002-06-13 21:23:02 +00:00
|
|
|
int b, sel_ret;
|
|
|
|
unsigned int bytes_read;
|
|
|
|
fd_set rfds;
|
|
|
|
struct timeval timeout;
|
2000-07-30 16:54:12 +00:00
|
|
|
|
2002-06-22 10:21:00 +00:00
|
|
|
/*
|
|
|
|
* XXX Ethereal blocks until we return
|
|
|
|
*/
|
2002-06-13 21:23:02 +00:00
|
|
|
if (strcmp(pipename, "-") == 0)
|
|
|
|
fd = 0; /* read from stdin */
|
|
|
|
else {
|
|
|
|
if (stat(pipename, &pipe_stat) < 0) {
|
|
|
|
if (errno == ENOENT || errno == ENOTDIR)
|
2004-02-21 12:58:42 +00:00
|
|
|
ld->cap_pipe_err = PIPNEXIST;
|
2002-06-13 21:23:02 +00:00
|
|
|
else {
|
|
|
|
snprintf(errmsg, errmsgl,
|
|
|
|
"The capture session could not be initiated "
|
|
|
|
"due to error on pipe: %s", strerror(errno));
|
2004-02-21 12:58:42 +00:00
|
|
|
ld->cap_pipe_err = PIPERR;
|
2002-06-13 21:23:02 +00:00
|
|
|
}
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
if (! S_ISFIFO(pipe_stat.st_mode)) {
|
|
|
|
if (S_ISCHR(pipe_stat.st_mode)) {
|
|
|
|
/*
|
|
|
|
* Assume the user specified an interface on a system where
|
|
|
|
* interfaces are in /dev. Pretend we haven't seen it.
|
|
|
|
*/
|
2004-02-21 12:58:42 +00:00
|
|
|
ld->cap_pipe_err = PIPNEXIST;
|
2002-06-13 21:23:02 +00:00
|
|
|
} else {
|
|
|
|
snprintf(errmsg, errmsgl,
|
|
|
|
"The capture session could not be initiated because\n"
|
|
|
|
"\"%s\" is neither an interface nor a pipe", pipename);
|
2004-02-21 12:58:42 +00:00
|
|
|
ld->cap_pipe_err = PIPERR;
|
2002-06-13 21:23:02 +00:00
|
|
|
}
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
fd = open(pipename, O_RDONLY | O_NONBLOCK);
|
|
|
|
if (fd == -1) {
|
|
|
|
snprintf(errmsg, errmsgl,
|
|
|
|
"The capture session could not be initiated "
|
|
|
|
"due to error on pipe open: %s", strerror(errno));
|
2004-02-21 12:58:42 +00:00
|
|
|
ld->cap_pipe_err = PIPERR;
|
2002-06-13 21:23:02 +00:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
2000-07-30 16:54:12 +00:00
|
|
|
|
2004-02-21 12:58:42 +00:00
|
|
|
ld->from_cap_pipe = TRUE;
|
2002-06-13 21:23:02 +00:00
|
|
|
|
2000-07-30 16:54:12 +00:00
|
|
|
/* read the pcap header */
|
2002-06-13 21:23:02 +00:00
|
|
|
FD_ZERO(&rfds);
|
|
|
|
bytes_read = 0;
|
|
|
|
while (bytes_read < sizeof magic) {
|
|
|
|
FD_SET(fd, &rfds);
|
|
|
|
timeout.tv_sec = 0;
|
|
|
|
timeout.tv_usec = CAP_READ_TIMEOUT*1000;
|
|
|
|
sel_ret = select(fd+1, &rfds, NULL, NULL, &timeout);
|
|
|
|
if (sel_ret < 0) {
|
|
|
|
snprintf(errmsg, errmsgl,
|
|
|
|
"Unexpected error from select: %s", strerror(errno));
|
|
|
|
goto error;
|
|
|
|
} else if (sel_ret > 0) {
|
2002-12-29 01:19:08 +00:00
|
|
|
b = read(fd, ((char *)&magic)+bytes_read, sizeof magic-bytes_read);
|
2002-06-13 21:23:02 +00:00
|
|
|
if (b <= 0) {
|
|
|
|
if (b == 0)
|
|
|
|
snprintf(errmsg, errmsgl, "End of file on pipe during open");
|
|
|
|
else
|
|
|
|
snprintf(errmsg, errmsgl, "Error on pipe during open: %s",
|
|
|
|
strerror(errno));
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
bytes_read += b;
|
|
|
|
}
|
2000-07-30 16:54:12 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
switch (magic) {
|
|
|
|
case PCAP_MAGIC:
|
|
|
|
/* Host that wrote it has our byte order, and was running
|
|
|
|
a program using either standard or ss990417 libpcap. */
|
|
|
|
ld->byte_swapped = FALSE;
|
|
|
|
ld->modified = FALSE;
|
|
|
|
break;
|
|
|
|
case PCAP_MODIFIED_MAGIC:
|
|
|
|
/* Host that wrote it has our byte order, but was running
|
|
|
|
a program using either ss990915 or ss991029 libpcap. */
|
|
|
|
ld->byte_swapped = FALSE;
|
|
|
|
ld->modified = TRUE;
|
|
|
|
break;
|
|
|
|
case PCAP_SWAPPED_MAGIC:
|
|
|
|
/* Host that wrote it has a byte order opposite to ours,
|
|
|
|
and was running a program using either standard or
|
|
|
|
ss990417 libpcap. */
|
|
|
|
ld->byte_swapped = TRUE;
|
|
|
|
ld->modified = FALSE;
|
|
|
|
break;
|
|
|
|
case PCAP_SWAPPED_MODIFIED_MAGIC:
|
|
|
|
/* Host that wrote it out has a byte order opposite to
|
|
|
|
ours, and was running a program using either ss990915
|
|
|
|
or ss991029 libpcap. */
|
|
|
|
ld->byte_swapped = TRUE;
|
|
|
|
ld->modified = TRUE;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
/* Not a "libpcap" type we know about. */
|
2002-06-13 21:23:02 +00:00
|
|
|
snprintf(errmsg, errmsgl, "Unrecognized libpcap format");
|
|
|
|
goto error;
|
2000-07-30 16:54:12 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Read the rest of the header */
|
2002-06-13 21:23:02 +00:00
|
|
|
bytes_read = 0;
|
|
|
|
while (bytes_read < sizeof(struct pcap_hdr)) {
|
|
|
|
FD_SET(fd, &rfds);
|
|
|
|
timeout.tv_sec = 0;
|
|
|
|
timeout.tv_usec = CAP_READ_TIMEOUT*1000;
|
|
|
|
sel_ret = select(fd+1, &rfds, NULL, NULL, &timeout);
|
|
|
|
if (sel_ret < 0) {
|
|
|
|
snprintf(errmsg, errmsgl,
|
|
|
|
"Unexpected error from select: %s", strerror(errno));
|
|
|
|
goto error;
|
|
|
|
} else if (sel_ret > 0) {
|
|
|
|
b = read(fd, ((char *)hdr)+bytes_read,
|
|
|
|
sizeof(struct pcap_hdr) - bytes_read);
|
|
|
|
if (b <= 0) {
|
|
|
|
if (b == 0)
|
|
|
|
snprintf(errmsg, errmsgl, "End of file on pipe during open");
|
|
|
|
else
|
|
|
|
snprintf(errmsg, errmsgl, "Error on pipe during open: %s",
|
|
|
|
strerror(errno));
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
bytes_read += b;
|
2000-07-30 16:54:12 +00:00
|
|
|
}
|
|
|
|
}
|
2002-06-13 21:23:02 +00:00
|
|
|
|
2000-07-30 16:54:12 +00:00
|
|
|
if (ld->byte_swapped) {
|
|
|
|
/* Byte-swap the header fields about which we care. */
|
|
|
|
hdr->version_major = BSWAP16(hdr->version_major);
|
|
|
|
hdr->version_minor = BSWAP16(hdr->version_minor);
|
|
|
|
hdr->snaplen = BSWAP32(hdr->snaplen);
|
|
|
|
hdr->network = BSWAP32(hdr->network);
|
|
|
|
}
|
2002-06-13 21:23:02 +00:00
|
|
|
|
2000-07-30 16:54:12 +00:00
|
|
|
if (hdr->version_major < 2) {
|
2002-06-13 21:23:02 +00:00
|
|
|
snprintf(errmsg, errmsgl, "Unable to read old libpcap format");
|
|
|
|
goto error;
|
2000-07-30 16:54:12 +00:00
|
|
|
}
|
|
|
|
|
2004-02-21 12:58:42 +00:00
|
|
|
ld->cap_pipe_state = STATE_EXPECT_REC_HDR;
|
|
|
|
ld->cap_pipe_err = PIPOK;
|
2000-07-30 16:54:12 +00:00
|
|
|
return fd;
|
2002-06-13 21:23:02 +00:00
|
|
|
|
|
|
|
error:
|
2004-02-21 12:58:42 +00:00
|
|
|
ld->cap_pipe_err = PIPERR;
|
2002-06-13 21:23:02 +00:00
|
|
|
close(fd);
|
|
|
|
return -1;
|
|
|
|
|
2000-07-30 16:54:12 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* We read one record from the pipe, take care of byte order in the record
|
|
|
|
* header, write the record in the capture file, and update capture statistics. */
|
2002-06-13 21:23:02 +00:00
|
|
|
|
2000-07-30 16:54:12 +00:00
|
|
|
static int
|
2004-02-21 12:58:42 +00:00
|
|
|
cap_pipe_dispatch(int fd, loop_data *ld, struct pcap_hdr *hdr,
|
2002-08-02 23:36:07 +00:00
|
|
|
struct pcaprec_modified_hdr *rechdr, guchar *data,
|
2002-06-13 21:23:02 +00:00
|
|
|
char *errmsg, int errmsgl)
|
2000-07-30 16:54:12 +00:00
|
|
|
{
|
2002-06-07 11:12:43 +00:00
|
|
|
struct pcap_pkthdr phdr;
|
2002-06-13 21:23:02 +00:00
|
|
|
int b;
|
|
|
|
enum { PD_REC_HDR_READ, PD_DATA_READ, PD_PIPE_EOF, PD_PIPE_ERR,
|
|
|
|
PD_ERR } result;
|
|
|
|
|
2004-02-21 12:58:42 +00:00
|
|
|
switch (ld->cap_pipe_state) {
|
2002-06-13 21:23:02 +00:00
|
|
|
|
|
|
|
case STATE_EXPECT_REC_HDR:
|
|
|
|
ld->bytes_to_read = ld->modified ?
|
|
|
|
sizeof(struct pcaprec_modified_hdr) : sizeof(struct pcaprec_hdr);
|
|
|
|
ld->bytes_read = 0;
|
2004-02-21 12:58:42 +00:00
|
|
|
ld->cap_pipe_state = STATE_READ_REC_HDR;
|
2002-06-13 21:23:02 +00:00
|
|
|
/* Fall through */
|
|
|
|
|
|
|
|
case STATE_READ_REC_HDR:
|
|
|
|
b = read(fd, ((char *)rechdr)+ld->bytes_read,
|
|
|
|
ld->bytes_to_read - ld->bytes_read);
|
2000-07-30 16:54:12 +00:00
|
|
|
if (b <= 0) {
|
2002-06-13 21:23:02 +00:00
|
|
|
if (b == 0)
|
|
|
|
result = PD_PIPE_EOF;
|
|
|
|
else
|
|
|
|
result = PD_PIPE_ERR;
|
|
|
|
break;
|
2000-07-30 16:54:12 +00:00
|
|
|
}
|
2002-06-13 21:23:02 +00:00
|
|
|
if ((ld->bytes_read += b) < ld->bytes_to_read)
|
|
|
|
return 0;
|
|
|
|
result = PD_REC_HDR_READ;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case STATE_EXPECT_DATA:
|
|
|
|
ld->bytes_read = 0;
|
2004-02-21 12:58:42 +00:00
|
|
|
ld->cap_pipe_state = STATE_READ_DATA;
|
2002-06-13 21:23:02 +00:00
|
|
|
/* Fall through */
|
|
|
|
|
|
|
|
case STATE_READ_DATA:
|
|
|
|
b = read(fd, data+ld->bytes_read, rechdr->hdr.incl_len - ld->bytes_read);
|
2000-07-30 16:54:12 +00:00
|
|
|
if (b <= 0) {
|
2002-06-13 21:23:02 +00:00
|
|
|
if (b == 0)
|
|
|
|
result = PD_PIPE_EOF;
|
|
|
|
else
|
|
|
|
result = PD_PIPE_ERR;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if ((ld->bytes_read += b) < rechdr->hdr.incl_len)
|
2000-07-30 16:54:12 +00:00
|
|
|
return 0;
|
2002-06-13 21:23:02 +00:00
|
|
|
result = PD_DATA_READ;
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
2004-02-21 12:58:42 +00:00
|
|
|
snprintf(errmsg, errmsgl, "cap_pipe_dispatch: invalid state");
|
2002-06-13 21:23:02 +00:00
|
|
|
result = PD_ERR;
|
|
|
|
|
2004-02-21 12:58:42 +00:00
|
|
|
} /* switch (ld->cap_pipe_state) */
|
2002-06-13 21:23:02 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* We've now read as much data as we were expecting, so process it.
|
|
|
|
*/
|
|
|
|
switch (result) {
|
|
|
|
|
|
|
|
case PD_REC_HDR_READ:
|
|
|
|
/* We've read the header. Take care of byte order. */
|
2004-02-21 12:58:42 +00:00
|
|
|
cap_pipe_adjust_header(ld, hdr, &rechdr->hdr);
|
2002-06-13 21:23:02 +00:00
|
|
|
if (rechdr->hdr.incl_len > WTAP_MAX_PACKET_SIZE) {
|
|
|
|
snprintf(errmsg, errmsgl, "Frame %u too long (%d bytes)",
|
|
|
|
ld->counts.total+1, rechdr->hdr.incl_len);
|
|
|
|
break;
|
2000-07-30 16:54:12 +00:00
|
|
|
}
|
2004-02-21 12:58:42 +00:00
|
|
|
ld->cap_pipe_state = STATE_EXPECT_DATA;
|
2002-06-13 21:23:02 +00:00
|
|
|
return 0;
|
2000-07-30 16:54:12 +00:00
|
|
|
|
2002-06-13 21:23:02 +00:00
|
|
|
case PD_DATA_READ:
|
|
|
|
/* Fill in a "struct pcap_pkthdr", and process the packet. */
|
|
|
|
phdr.ts.tv_sec = rechdr->hdr.ts_sec;
|
|
|
|
phdr.ts.tv_usec = rechdr->hdr.ts_usec;
|
|
|
|
phdr.caplen = rechdr->hdr.incl_len;
|
|
|
|
phdr.len = rechdr->hdr.orig_len;
|
2002-08-28 21:04:11 +00:00
|
|
|
|
2002-08-02 23:36:07 +00:00
|
|
|
capture_pcap_cb((guchar *)ld, &phdr, data);
|
2002-08-28 21:04:11 +00:00
|
|
|
|
2004-02-21 12:58:42 +00:00
|
|
|
ld->cap_pipe_state = STATE_EXPECT_REC_HDR;
|
2002-06-13 21:23:02 +00:00
|
|
|
return 1;
|
|
|
|
|
|
|
|
case PD_PIPE_EOF:
|
2004-02-21 12:58:42 +00:00
|
|
|
ld->cap_pipe_err = PIPEOF;
|
2002-06-13 21:23:02 +00:00
|
|
|
return -1;
|
|
|
|
|
|
|
|
case PD_PIPE_ERR:
|
|
|
|
snprintf(errmsg, errmsgl, "Error reading from pipe: %s",
|
|
|
|
strerror(errno));
|
2002-08-13 18:12:11 +00:00
|
|
|
/* Fall through */
|
2002-06-13 21:23:02 +00:00
|
|
|
case PD_ERR:
|
2002-08-13 18:12:11 +00:00
|
|
|
break;
|
2002-06-13 21:23:02 +00:00
|
|
|
}
|
2000-07-30 16:54:12 +00:00
|
|
|
|
2004-02-21 12:58:42 +00:00
|
|
|
ld->cap_pipe_err = PIPERR;
|
2002-06-13 21:23:02 +00:00
|
|
|
/* Return here rather than inside the switch to prevent GCC warning */
|
|
|
|
return -1;
|
2000-07-30 16:54:12 +00:00
|
|
|
}
|
2004-02-21 12:58:42 +00:00
|
|
|
#endif /* not _WIN32 */
|
2000-07-30 16:54:12 +00:00
|
|
|
|
2000-10-11 06:01:16 +00:00
|
|
|
/*
|
|
|
|
* This needs to be static, so that the SIGUSR1 handler can clear the "go"
|
|
|
|
* flag.
|
|
|
|
*/
|
|
|
|
static loop_data ld;
|
|
|
|
|
1999-10-02 06:00:07 +00:00
|
|
|
/* Do the low-level work of a capture.
|
|
|
|
Returns TRUE if it succeeds, FALSE otherwise. */
|
|
|
|
int
|
2001-02-11 09:28:17 +00:00
|
|
|
capture(gboolean *stats_known, struct pcap_stat *stats)
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
{
|
1998-09-16 02:39:15 +00:00
|
|
|
pcap_t *pch;
|
2000-07-31 04:03:31 +00:00
|
|
|
int pcap_encap;
|
Have Wiretap set the snapshot length to 0 if it can't be derived from
reading the capture file. Have callers of "wtap_snapshot_length()"
treat a value of 0 as "unknown", and default to WTAP_MAX_PACKET_SIZE (so
that, when writing a capture file in a format that *does* store the
snapshot length, we can at least put *something* in the file).
If we don't know the snapshot length of the current capture file, don't
display a value in the summary window.
Don't use "cfile.snap" as the snapshot length option when capturing -
doing so causes Ethereal to default, when capturing, to the snapshot
length of the last capture file that you read in, rather than to the
snapshot length of the last capture you did (or the initial default of
"no snapshot length").
Redo the "Capture Options" dialog box to group options into sections
with frames around them, and add units to the snapshot length, maximum
file size, and capture duration options, as per a suggestion by Ulf
Lamping. Also add units to the capture count option.
Make the snapshot length, capture count, maximum file size, and capture
duration options into a combination of a check box and a spin button.
If the check box is not checked, the limit in question is inactive
(snapshot length of 65535, no max packet count, no max file size, no max
capture duration); if it's checked, the spinbox specifies the limit.
Default all of the check boxes to "not checked" and all of the spin
boxes to small values.
Use "gtk_toggle_button_get_active()" rather than directly fetching the
state of a check box.
svn path=/trunk/; revision=4709
2002-02-08 10:07:41 +00:00
|
|
|
int file_snaplen;
|
2001-10-25 06:41:48 +00:00
|
|
|
gchar open_err_str[PCAP_ERRBUF_SIZE];
|
|
|
|
gchar lookup_net_err_str[PCAP_ERRBUF_SIZE];
|
1998-09-16 02:39:15 +00:00
|
|
|
bpf_u_int32 netnum, netmask;
|
2001-01-28 23:56:29 +00:00
|
|
|
struct bpf_program fcode;
|
2003-11-01 02:30:18 +00:00
|
|
|
const char *set_linktype_err_str;
|
1998-09-16 02:39:15 +00:00
|
|
|
time_t upd_time, cur_time;
|
2002-10-16 23:34:52 +00:00
|
|
|
time_t start_time;
|
2001-06-18 01:49:17 +00:00
|
|
|
int err, inpkts;
|
2004-03-04 19:31:21 +00:00
|
|
|
condition *cnd_file_duration = NULL;
|
|
|
|
condition *cnd_autostop_files = NULL;
|
|
|
|
condition *cnd_autostop_size = NULL;
|
|
|
|
condition *cnd_autostop_duration = NULL;
|
|
|
|
guint32 autostop_files = 0;
|
On Win32, if the attempt to open the capture device fails, don't talk
about checking permissions, as the capture devices are probably
available to all users, and talking about permissions will only confuse
the user. Do, however, warn that Ethereal can't capture on Token Ring
or PPP/WAN interfaces.
On UNIX, if the attempt to open the capture device fails, and the error
message starts with "can't find PPA for ", they are probably running on
HP-UX with a version of libpcap not patched to properly look up PPAs for
network interfaces given the interface name; give them a detailed
warning about this, telling them that they'll have to fix libpcap and
build Ethereal from source, and pointing them at the "README.hpux" file.
svn path=/trunk/; revision=2265
2000-08-13 08:17:03 +00:00
|
|
|
char errmsg[4096+1];
|
2002-09-22 16:17:41 +00:00
|
|
|
gboolean write_ok;
|
|
|
|
gboolean close_ok;
|
2003-11-15 08:48:14 +00:00
|
|
|
capture_info capture_ui;
|
2000-03-21 06:52:13 +00:00
|
|
|
|
2002-08-28 21:04:11 +00:00
|
|
|
#ifdef _WIN32
|
2003-07-23 05:01:15 +00:00
|
|
|
WORD wVersionRequested;
|
|
|
|
WSADATA wsaData;
|
2002-06-13 21:23:02 +00:00
|
|
|
#else
|
2004-01-05 19:31:44 +00:00
|
|
|
fd_set set1;
|
|
|
|
struct timeval timeout;
|
2002-06-13 21:23:02 +00:00
|
|
|
static const char ppamsg[] = "can't find PPA for ";
|
|
|
|
char *libpcap_warn;
|
|
|
|
int sel_ret;
|
|
|
|
int pipe_fd = -1;
|
|
|
|
struct pcap_hdr hdr;
|
|
|
|
struct pcaprec_modified_hdr rechdr;
|
2002-08-02 23:36:07 +00:00
|
|
|
guchar pcap_data[WTAP_MAX_PACKET_SIZE];
|
2002-06-13 21:23:02 +00:00
|
|
|
#endif
|
|
|
|
#ifdef MUST_DO_SELECT
|
|
|
|
int pcap_fd = 0;
|
|
|
|
#endif
|
2004-06-20 13:39:44 +00:00
|
|
|
gboolean show_info = capture_opts.show_info || !capture_opts.sync_mode;
|
2002-06-13 21:23:02 +00:00
|
|
|
|
2002-08-28 21:04:11 +00:00
|
|
|
/* Initialize Windows Socket if we are in a WIN32 OS
|
2000-03-21 06:52:13 +00:00
|
|
|
This needs to be done before querying the interface for network/netmask */
|
2002-08-28 21:04:11 +00:00
|
|
|
#ifdef _WIN32
|
2003-07-23 05:01:15 +00:00
|
|
|
/* XXX - do we really require 1.1 or earlier?
|
|
|
|
Are there any versions that support only 2.0 or higher? */
|
|
|
|
wVersionRequested = MAKEWORD(1, 1);
|
|
|
|
err = WSAStartup(wVersionRequested, &wsaData);
|
|
|
|
if (err != 0) {
|
|
|
|
switch (err) {
|
|
|
|
|
|
|
|
case WSASYSNOTREADY:
|
|
|
|
snprintf(errmsg, sizeof errmsg,
|
|
|
|
"Couldn't initialize Windows Sockets: Network system not ready for network communication");
|
|
|
|
break;
|
|
|
|
|
|
|
|
case WSAVERNOTSUPPORTED:
|
|
|
|
snprintf(errmsg, sizeof errmsg,
|
|
|
|
"Couldn't initialize Windows Sockets: Windows Sockets version %u.%u not supported",
|
|
|
|
LOBYTE(wVersionRequested), HIBYTE(wVersionRequested));
|
|
|
|
break;
|
|
|
|
|
|
|
|
case WSAEINPROGRESS:
|
|
|
|
snprintf(errmsg, sizeof errmsg,
|
|
|
|
"Couldn't initialize Windows Sockets: Blocking operation is in progress");
|
|
|
|
break;
|
|
|
|
|
|
|
|
case WSAEPROCLIM:
|
|
|
|
snprintf(errmsg, sizeof errmsg,
|
|
|
|
"Couldn't initialize Windows Sockets: Limit on the number of tasks supported by this WinSock implementation has been reached");
|
|
|
|
break;
|
|
|
|
|
|
|
|
case WSAEFAULT:
|
|
|
|
snprintf(errmsg, sizeof errmsg,
|
|
|
|
"Couldn't initialize Windows Sockets: Bad pointer passed to WSAStartup");
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
snprintf(errmsg, sizeof errmsg,
|
|
|
|
"Couldn't initialize Windows Sockets: error %d", err);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
pch = NULL;
|
2002-08-28 21:04:11 +00:00
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
#endif
|
1999-08-15 22:16:59 +00:00
|
|
|
|
1999-08-10 20:06:39 +00:00
|
|
|
ld.go = TRUE;
|
|
|
|
ld.counts.total = 0;
|
2004-03-04 19:31:21 +00:00
|
|
|
if (capture_opts.has_autostop_packets)
|
|
|
|
ld.max = capture_opts.autostop_packets;
|
"autostop_filesize" and "autostop_duration" don't need to be in the
"capture_file" structure - they're a property of an in-progress capture,
not a property of an open capture file. Make them just variables.
The maximum number of packets to be captured should be a variable
separate from the "count" field in the "capture_file" structure - the
latter is a count of the packets in the capture file in question.
Have Boolean variables indicating whether a maximum packet count,
maximum capture file size, and maximum capture duration were specified.
If an option isn't set, and we're doing an "update list of packets in
real time" capture, don't pass the option to the child process with a
command-line argument.
Don't create "stop when the capture file reaches this size" or "stop
when the capture's run for this long" conditions if a maximum capture
file size or a maximum capture duration, respectively, haven't been
specified. Don't test or free a condition if it wasn't created.
Don't allow a 0 argument to the "-c" flag - the absence of a "-c" flag
is the way you specify "no limit on the number of packets".
Initialize the check boxes and spin buttons for the "maximum packets to
capture", "maximum capture size", and "maximum capture duration" options
to the values they had in the last capture. If an option wasn't
specified, don't read its value from the dialog box and set the
variable.
svn path=/trunk/; revision=4795
2002-02-24 03:33:05 +00:00
|
|
|
else
|
|
|
|
ld.max = 0; /* no limit */
|
2001-02-10 09:08:14 +00:00
|
|
|
ld.err = 0; /* no error seen yet */
|
DLT_NULL, from "libpcap", means different things on different platforms
and in different capture files; throw in some heuristics to try to
figure out whether the 4-byte header is:
1) PPP-over-HDLC (some version of ISDN4BSD?);
2) big-endian AF_ value (BSD on big-endian platforms);
3) little-endian AF_ value (BSD on little-endian platforms);
4) two octets of 0 followed by an Ethernet type (Linux, at least
on little-endian platforms, as mutated by "libpcap").
Make a separate Wiretap encapsulation type, WTAP_ENCAP_NULL,
corresponding to DLT_NULL.
Have the PPP code dissect the frame if it's PPP-over-HDLC, and have
"ethertype()" dissect the Ethernet type and the rest of the packet if
it's a Linux-style header; dissect it ourselves only if it's an AF_
value.
Have Wiretap impose a maximum packet size of 65535 bytes, so that it
fails more gracefully when handed a corrupt "libpcap" capture file
(other capture file formats with more than a 16-bit capture length
field, if any, will have that check added later), and put that size in
"wtap.h" and have Ethereal use it as its notion of a maximum packet
size.
Have Ethereal put up a "this file appears to be damaged or corrupt"
message box if Wiretap returns a WTAP_ERR_BAD_RECORD error when opening
or reading a capture file.
Include loopback interfaces in the list of interfaces offered by the
"Capture" dialog box, but put them at the end of the list so that it
doesn't default to a loopback interface unless there are no other
interfaces. Also, don't require that an interface in the list have an
IP address associated with it, and only put one entry in the list for a
given interface (SIOCGIFCONF returns one entry per interface *address*,
not per *interface* - and even if you were to use only IP addresses, an
interface could conceivably have more than one IP address).
Exclusively use Wiretap encapsulation types internally, even when
capturing; don't use DLT_ types.
svn path=/trunk/; revision=540
1999-08-22 00:47:56 +00:00
|
|
|
ld.linktype = WTAP_ENCAP_UNKNOWN;
|
Make the "go" member of the "loop_data" structure in Ethereal a
"gboolean", as it's a Boolean value, and move it to the beginning of the
structure in Tethereal, as it is in Ethereal.
From Graeme Hewson:
Check for "pcap_dispatch()" returning -1, meaning an error
occurred; if it does, stop capturing, and report the error.
If we get a signal in tethereal, stop the capture with a
"longjmp()", rather than by clearning the "go" flag;
"pcap_dispatch()", on many platforms, keeps reading rather than
returning a captured packet count of 0 if the system call to
read packets returns -1 with an errno of EINTR, so the
"pcap_dispatch()" won't be broken out of if the signal handler
returns.
Fix a typo in an error message.
svn path=/trunk/; revision=4471
2002-01-03 22:03:24 +00:00
|
|
|
ld.pcap_err = FALSE;
|
2004-02-21 12:58:42 +00:00
|
|
|
ld.from_cap_pipe = FALSE;
|
1999-08-10 20:06:39 +00:00
|
|
|
ld.sync_packets = 0;
|
2000-05-26 22:08:16 +00:00
|
|
|
ld.counts.sctp = 0;
|
1999-08-10 20:06:39 +00:00
|
|
|
ld.counts.tcp = 0;
|
|
|
|
ld.counts.udp = 0;
|
1999-08-14 23:47:20 +00:00
|
|
|
ld.counts.icmp = 0;
|
1999-08-10 20:06:39 +00:00
|
|
|
ld.counts.ospf = 0;
|
|
|
|
ld.counts.gre = 0;
|
1999-11-30 23:56:37 +00:00
|
|
|
ld.counts.ipx = 0;
|
1999-08-10 20:06:39 +00:00
|
|
|
ld.counts.netbios = 0;
|
2000-01-20 21:34:16 +00:00
|
|
|
ld.counts.vines = 0;
|
1999-08-10 20:06:39 +00:00
|
|
|
ld.counts.other = 0;
|
2002-10-14 17:33:50 +00:00
|
|
|
ld.counts.arp = 0;
|
1999-08-10 20:06:39 +00:00
|
|
|
ld.pdh = NULL;
|
1998-09-16 02:39:15 +00:00
|
|
|
|
2001-02-11 09:28:17 +00:00
|
|
|
/* We haven't yet gotten the capture statistics. */
|
|
|
|
*stats_known = FALSE;
|
|
|
|
|
2001-10-25 06:41:48 +00:00
|
|
|
/* Open the network interface to capture from it.
|
|
|
|
Some versions of libpcap may put warnings into the error buffer
|
|
|
|
if they succeed; to tell if that's happened, we have to clear
|
|
|
|
the error buffer, and check if it's still a null string. */
|
|
|
|
open_err_str[0] = '\0';
|
Have Wiretap set the snapshot length to 0 if it can't be derived from
reading the capture file. Have callers of "wtap_snapshot_length()"
treat a value of 0 as "unknown", and default to WTAP_MAX_PACKET_SIZE (so
that, when writing a capture file in a format that *does* store the
snapshot length, we can at least put *something* in the file).
If we don't know the snapshot length of the current capture file, don't
display a value in the summary window.
Don't use "cfile.snap" as the snapshot length option when capturing -
doing so causes Ethereal to default, when capturing, to the snapshot
length of the last capture file that you read in, rather than to the
snapshot length of the last capture you did (or the initial default of
"no snapshot length").
Redo the "Capture Options" dialog box to group options into sections
with frames around them, and add units to the snapshot length, maximum
file size, and capture duration options, as per a suggestion by Ulf
Lamping. Also add units to the capture count option.
Make the snapshot length, capture count, maximum file size, and capture
duration options into a combination of a check box and a spin button.
If the check box is not checked, the limit in question is inactive
(snapshot length of 65535, no max packet count, no max file size, no max
capture duration); if it's checked, the spinbox specifies the limit.
Default all of the check boxes to "not checked" and all of the spin
boxes to small values.
Use "gtk_toggle_button_get_active()" rather than directly fetching the
state of a check box.
svn path=/trunk/; revision=4709
2002-02-08 10:07:41 +00:00
|
|
|
pch = pcap_open_live(cfile.iface,
|
2002-02-24 09:25:36 +00:00
|
|
|
capture_opts.has_snaplen ? capture_opts.snaplen :
|
|
|
|
WTAP_MAX_PACKET_SIZE,
|
|
|
|
capture_opts.promisc_mode, CAP_READ_TIMEOUT,
|
|
|
|
open_err_str);
|
1998-09-16 02:39:15 +00:00
|
|
|
|
2003-11-01 02:30:18 +00:00
|
|
|
if (pch != NULL) {
|
2004-03-13 22:49:30 +00:00
|
|
|
#ifdef _WIN32
|
|
|
|
/* try to set the capture buffer size */
|
|
|
|
if (pcap_setbuff(pch, capture_opts.buffer_size * 1024 * 1024) != 0) {
|
|
|
|
simple_dialog(ESD_TYPE_INFO, ESD_BTN_OK,
|
|
|
|
"%sCouldn't set the capture buffer size!%s\n"
|
|
|
|
"\n"
|
|
|
|
"The capture buffer size of %luMB seems to be too high for your machine,\n"
|
|
|
|
"the default of 1MB will be used.\n"
|
|
|
|
"\n"
|
|
|
|
"Nonetheless, the capture is started.\n",
|
|
|
|
simple_dialog_primary_start(), simple_dialog_primary_end(), capture_opts.buffer_size);
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2003-11-01 02:30:18 +00:00
|
|
|
/* setting the data link type only works on real interfaces */
|
|
|
|
if (capture_opts.linktype != -1) {
|
|
|
|
set_linktype_err_str = set_pcap_linktype(pch, cfile.iface,
|
|
|
|
capture_opts.linktype);
|
|
|
|
if (set_linktype_err_str != NULL) {
|
|
|
|
snprintf(errmsg, sizeof errmsg, "Unable to set data link type (%s).",
|
|
|
|
set_linktype_err_str);
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
} else {
|
2002-12-31 21:06:48 +00:00
|
|
|
/* We couldn't open "cfile.iface" as a network device. */
|
On Win32, if the attempt to open the capture device fails, don't talk
about checking permissions, as the capture devices are probably
available to all users, and talking about permissions will only confuse
the user. Do, however, warn that Ethereal can't capture on Token Ring
or PPP/WAN interfaces.
On UNIX, if the attempt to open the capture device fails, and the error
message starts with "can't find PPA for ", they are probably running on
HP-UX with a version of libpcap not patched to properly look up PPAs for
network interfaces given the interface name; give them a detailed
warning about this, telling them that they'll have to fix libpcap and
build Ethereal from source, and pointing them at the "README.hpux" file.
svn path=/trunk/; revision=2265
2000-08-13 08:17:03 +00:00
|
|
|
#ifdef _WIN32
|
2002-12-31 21:06:48 +00:00
|
|
|
/* On Windows, we don't support capturing on pipes, so we give up.
|
On Win32, if the attempt to open the capture device fails, don't talk
about checking permissions, as the capture devices are probably
available to all users, and talking about permissions will only confuse
the user. Do, however, warn that Ethereal can't capture on Token Ring
or PPP/WAN interfaces.
On UNIX, if the attempt to open the capture device fails, and the error
message starts with "can't find PPA for ", they are probably running on
HP-UX with a version of libpcap not patched to properly look up PPAs for
network interfaces given the interface name; give them a detailed
warning about this, telling them that they'll have to fix libpcap and
build Ethereal from source, and pointing them at the "README.hpux" file.
svn path=/trunk/; revision=2265
2000-08-13 08:17:03 +00:00
|
|
|
If this is a child process that does the capturing in sync
|
|
|
|
mode or fork mode, it shouldn't do any UI stuff until we pop up the
|
|
|
|
capture-progress window, and, since we couldn't start the
|
|
|
|
capture, we haven't popped it up. */
|
|
|
|
if (!capture_child) {
|
2004-01-22 18:13:57 +00:00
|
|
|
main_window_update();
|
On Win32, if the attempt to open the capture device fails, don't talk
about checking permissions, as the capture devices are probably
available to all users, and talking about permissions will only confuse
the user. Do, however, warn that Ethereal can't capture on Token Ring
or PPP/WAN interfaces.
On UNIX, if the attempt to open the capture device fails, and the error
message starts with "can't find PPA for ", they are probably running on
HP-UX with a version of libpcap not patched to properly look up PPAs for
network interfaces given the interface name; give them a detailed
warning about this, telling them that they'll have to fix libpcap and
build Ethereal from source, and pointing them at the "README.hpux" file.
svn path=/trunk/; revision=2265
2000-08-13 08:17:03 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* On Win32 OSes, the capture devices are probably available to all
|
|
|
|
users; don't warn about permissions problems.
|
|
|
|
|
2001-04-04 23:40:23 +00:00
|
|
|
Do, however, warn that WAN devices aren't supported. */
|
On Win32, if the attempt to open the capture device fails, don't talk
about checking permissions, as the capture devices are probably
available to all users, and talking about permissions will only confuse
the user. Do, however, warn that Ethereal can't capture on Token Ring
or PPP/WAN interfaces.
On UNIX, if the attempt to open the capture device fails, and the error
message starts with "can't find PPA for ", they are probably running on
HP-UX with a version of libpcap not patched to properly look up PPAs for
network interfaces given the interface name; give them a detailed
warning about this, telling them that they'll have to fix libpcap and
build Ethereal from source, and pointing them at the "README.hpux" file.
svn path=/trunk/; revision=2265
2000-08-13 08:17:03 +00:00
|
|
|
snprintf(errmsg, sizeof errmsg,
|
|
|
|
"The capture session could not be initiated (%s).\n"
|
|
|
|
"Please check that you have the proper interface specified.\n"
|
|
|
|
"\n"
|
2004-01-18 04:13:44 +00:00
|
|
|
"Note that the WinPcap 2.x version of the driver Ethereal uses for packet\n"
|
|
|
|
"capture on Windows doesn't support capturing on PPP/WAN interfaces in\n"
|
|
|
|
"Windows NT/2000/XP/2003 Server, and that the WinPcap 3.0 and later versions\n"
|
|
|
|
"don't support capturing on PPP/WAN interfaces at all.",
|
2001-10-25 06:41:48 +00:00
|
|
|
open_err_str);
|
On Win32, if the attempt to open the capture device fails, don't talk
about checking permissions, as the capture devices are probably
available to all users, and talking about permissions will only confuse
the user. Do, however, warn that Ethereal can't capture on Token Ring
or PPP/WAN interfaces.
On UNIX, if the attempt to open the capture device fails, and the error
message starts with "can't find PPA for ", they are probably running on
HP-UX with a version of libpcap not patched to properly look up PPAs for
network interfaces given the interface name; give them a detailed
warning about this, telling them that they'll have to fix libpcap and
build Ethereal from source, and pointing them at the "README.hpux" file.
svn path=/trunk/; revision=2265
2000-08-13 08:17:03 +00:00
|
|
|
goto error;
|
|
|
|
#else
|
2000-07-30 16:54:12 +00:00
|
|
|
/* try to open cfile.iface as a pipe */
|
2004-02-21 12:58:42 +00:00
|
|
|
pipe_fd = cap_pipe_open_live(cfile.iface, &hdr, &ld, errmsg, sizeof errmsg);
|
2000-07-30 16:54:12 +00:00
|
|
|
|
|
|
|
if (pipe_fd == -1) {
|
2002-05-04 09:11:28 +00:00
|
|
|
|
2002-06-13 21:23:02 +00:00
|
|
|
/* If this is a child process that does the capturing in sync
|
|
|
|
* mode or fork mode, it shouldn't do any UI stuff until we pop up the
|
|
|
|
* capture-progress window, and, since we couldn't start the
|
|
|
|
* capture, we haven't popped it up.
|
|
|
|
*/
|
2000-07-30 16:54:12 +00:00
|
|
|
if (!capture_child) {
|
2004-01-22 18:13:57 +00:00
|
|
|
main_window_update();
|
2000-07-30 16:54:12 +00:00
|
|
|
}
|
On Win32, if the attempt to open the capture device fails, don't talk
about checking permissions, as the capture devices are probably
available to all users, and talking about permissions will only confuse
the user. Do, however, warn that Ethereal can't capture on Token Ring
or PPP/WAN interfaces.
On UNIX, if the attempt to open the capture device fails, and the error
message starts with "can't find PPA for ", they are probably running on
HP-UX with a version of libpcap not patched to properly look up PPAs for
network interfaces given the interface name; give them a detailed
warning about this, telling them that they'll have to fix libpcap and
build Ethereal from source, and pointing them at the "README.hpux" file.
svn path=/trunk/; revision=2265
2000-08-13 08:17:03 +00:00
|
|
|
|
2004-02-21 12:58:42 +00:00
|
|
|
if (ld.cap_pipe_err == PIPNEXIST) {
|
2002-07-15 23:25:59 +00:00
|
|
|
/* Pipe doesn't exist, so output message for interface */
|
|
|
|
|
|
|
|
/* If we got a "can't find PPA for XXX" message, warn the user (who
|
|
|
|
is running Ethereal on HP-UX) that they don't have a version
|
|
|
|
of libpcap that properly handles HP-UX (libpcap 0.6.x and later
|
|
|
|
versions, which properly handle HP-UX, say "can't find /dev/dlpi
|
|
|
|
PPA for XXX" rather than "can't find PPA for XXX"). */
|
|
|
|
if (strncmp(open_err_str, ppamsg, sizeof ppamsg - 1) == 0)
|
|
|
|
libpcap_warn =
|
|
|
|
"\n\n"
|
|
|
|
"You are running Ethereal with a version of the libpcap library\n"
|
|
|
|
"that doesn't handle HP-UX network devices well; this means that\n"
|
|
|
|
"Ethereal may not be able to capture packets.\n"
|
|
|
|
"\n"
|
|
|
|
"To fix this, you should install libpcap 0.6.2, or a later version\n"
|
|
|
|
"of libpcap, rather than libpcap 0.4 or 0.5.x. It is available in\n"
|
|
|
|
"packaged binary form from the Software Porting And Archive Centre\n"
|
|
|
|
"for HP-UX; the Centre is at http://hpux.connect.org.uk/ - the page\n"
|
|
|
|
"at the URL lists a number of mirror sites.";
|
|
|
|
else
|
|
|
|
libpcap_warn = "";
|
|
|
|
snprintf(errmsg, sizeof errmsg,
|
2000-07-30 16:54:12 +00:00
|
|
|
"The capture session could not be initiated (%s).\n"
|
|
|
|
"Please check to make sure you have sufficient permissions, and that\n"
|
2001-10-25 06:41:48 +00:00
|
|
|
"you have the proper interface or pipe specified.%s", open_err_str,
|
On Win32, if the attempt to open the capture device fails, don't talk
about checking permissions, as the capture devices are probably
available to all users, and talking about permissions will only confuse
the user. Do, however, warn that Ethereal can't capture on Token Ring
or PPP/WAN interfaces.
On UNIX, if the attempt to open the capture device fails, and the error
message starts with "can't find PPA for ", they are probably running on
HP-UX with a version of libpcap not patched to properly look up PPAs for
network interfaces given the interface name; give them a detailed
warning about this, telling them that they'll have to fix libpcap and
build Ethereal from source, and pointing them at the "README.hpux" file.
svn path=/trunk/; revision=2265
2000-08-13 08:17:03 +00:00
|
|
|
libpcap_warn);
|
2002-06-13 21:23:02 +00:00
|
|
|
}
|
|
|
|
/*
|
2004-02-21 12:58:42 +00:00
|
|
|
* Else pipe (or file) does exist and cap_pipe_open_live() has
|
2002-06-13 21:23:02 +00:00
|
|
|
* filled in errmsg
|
|
|
|
*/
|
2000-07-30 16:54:12 +00:00
|
|
|
goto error;
|
2002-06-04 11:19:59 +00:00
|
|
|
} else
|
2004-02-21 12:58:42 +00:00
|
|
|
/* cap_pipe_open_live() succeeded; don't want
|
2002-06-04 11:19:59 +00:00
|
|
|
error message from pcap_open_live() */
|
|
|
|
open_err_str[0] = '\0';
|
2000-07-30 16:54:12 +00:00
|
|
|
#endif
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
}
|
|
|
|
|
2003-12-18 21:18:34 +00:00
|
|
|
/* capture filters only work on real interfaces */
|
2004-02-21 12:58:42 +00:00
|
|
|
if (cfile.cfilter && !ld.from_cap_pipe) {
|
1999-09-23 07:04:23 +00:00
|
|
|
/* A capture filter was specified; set it up. */
|
2001-10-25 06:41:48 +00:00
|
|
|
if (pcap_lookupnet(cfile.iface, &netnum, &netmask, lookup_net_err_str) < 0) {
|
2000-11-01 07:38:54 +00:00
|
|
|
/*
|
|
|
|
* Well, we can't get the netmask for this interface; it's used
|
|
|
|
* only for filters that check for broadcast IP addresses, so
|
|
|
|
* we just punt and use 0. It might be nice to warn the user,
|
|
|
|
* but that's a pain in a GUI application, as it'd involve popping
|
|
|
|
* up a message box, and it's not clear how often this would make
|
|
|
|
* a difference (only filters that check for IP broadcast addresses
|
|
|
|
* use the netmask).
|
|
|
|
*/
|
|
|
|
netmask = 0;
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
}
|
2001-01-28 23:56:29 +00:00
|
|
|
if (pcap_compile(pch, &fcode, cfile.cfilter, 1, netmask) < 0) {
|
2003-10-11 21:49:56 +00:00
|
|
|
dfilter_t *rfcode = NULL;
|
2004-02-03 17:59:01 +00:00
|
|
|
/* filter string invalid, did the user tried a display filter? */
|
2004-01-31 01:32:51 +00:00
|
|
|
if (dfilter_compile(cfile.cfilter, &rfcode) && rfcode != NULL) {
|
2003-10-11 21:49:56 +00:00
|
|
|
snprintf(errmsg, sizeof errmsg,
|
2004-02-03 19:54:08 +00:00
|
|
|
"%sInvalid capture filter: \"%s\"!%s\n"
|
2004-01-31 02:29:19 +00:00
|
|
|
"\n"
|
2004-02-03 20:48:50 +00:00
|
|
|
"That string looks like a valid display filter; however, it is not a valid\n"
|
|
|
|
"capture filter (%s).\n"
|
2004-02-03 17:59:01 +00:00
|
|
|
"\n"
|
|
|
|
"Note that display filters and capture filters don't have the same syntax,\n"
|
|
|
|
"so you can't use most display filter expressions as capture filters.\n"
|
|
|
|
"\n"
|
2004-02-03 20:48:50 +00:00
|
|
|
"See the help for a description of the capture filter syntax.",
|
2004-02-03 17:59:01 +00:00
|
|
|
simple_dialog_primary_start(), cfile.cfilter, simple_dialog_primary_end(),
|
2003-10-11 21:49:56 +00:00
|
|
|
pcap_geterr(pch));
|
|
|
|
dfilter_free(rfcode);
|
|
|
|
} else {
|
|
|
|
snprintf(errmsg, sizeof errmsg,
|
2004-02-03 17:59:01 +00:00
|
|
|
"%sInvalid capture filter: \"%s\"!%s\n"
|
|
|
|
"\n"
|
2004-02-03 20:48:50 +00:00
|
|
|
"That string is not a valid capture filter (%s).\n"
|
|
|
|
"See the help for a description of the capture filter syntax.",
|
2004-02-03 17:59:01 +00:00
|
|
|
simple_dialog_primary_start(), cfile.cfilter, simple_dialog_primary_end(),
|
2003-10-11 21:49:56 +00:00
|
|
|
pcap_geterr(pch));
|
|
|
|
}
|
1999-09-23 07:04:23 +00:00
|
|
|
goto error;
|
1999-08-18 17:08:47 +00:00
|
|
|
}
|
2001-01-28 23:56:29 +00:00
|
|
|
if (pcap_setfilter(pch, &fcode) < 0) {
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
snprintf(errmsg, sizeof errmsg, "Can't install filter (%s).",
|
|
|
|
pcap_geterr(pch));
|
1999-09-23 07:04:23 +00:00
|
|
|
goto error;
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
1999-09-23 07:04:23 +00:00
|
|
|
/* Set up to write to the capture file. */
|
2000-07-31 04:03:31 +00:00
|
|
|
#ifndef _WIN32
|
2004-02-21 12:58:42 +00:00
|
|
|
if (ld.from_cap_pipe) {
|
2000-07-31 04:03:31 +00:00
|
|
|
pcap_encap = hdr.network;
|
Have Wiretap set the snapshot length to 0 if it can't be derived from
reading the capture file. Have callers of "wtap_snapshot_length()"
treat a value of 0 as "unknown", and default to WTAP_MAX_PACKET_SIZE (so
that, when writing a capture file in a format that *does* store the
snapshot length, we can at least put *something* in the file).
If we don't know the snapshot length of the current capture file, don't
display a value in the summary window.
Don't use "cfile.snap" as the snapshot length option when capturing -
doing so causes Ethereal to default, when capturing, to the snapshot
length of the last capture file that you read in, rather than to the
snapshot length of the last capture you did (or the initial default of
"no snapshot length").
Redo the "Capture Options" dialog box to group options into sections
with frames around them, and add units to the snapshot length, maximum
file size, and capture duration options, as per a suggestion by Ulf
Lamping. Also add units to the capture count option.
Make the snapshot length, capture count, maximum file size, and capture
duration options into a combination of a check box and a spin button.
If the check box is not checked, the limit in question is inactive
(snapshot length of 65535, no max packet count, no max file size, no max
capture duration); if it's checked, the spinbox specifies the limit.
Default all of the check boxes to "not checked" and all of the spin
boxes to small values.
Use "gtk_toggle_button_get_active()" rather than directly fetching the
state of a check box.
svn path=/trunk/; revision=4709
2002-02-08 10:07:41 +00:00
|
|
|
file_snaplen = hdr.snaplen;
|
2000-07-31 04:03:31 +00:00
|
|
|
} else
|
|
|
|
#endif
|
|
|
|
{
|
2001-11-09 07:44:51 +00:00
|
|
|
pcap_encap = get_pcap_linktype(pch, cfile.iface);
|
Have Wiretap set the snapshot length to 0 if it can't be derived from
reading the capture file. Have callers of "wtap_snapshot_length()"
treat a value of 0 as "unknown", and default to WTAP_MAX_PACKET_SIZE (so
that, when writing a capture file in a format that *does* store the
snapshot length, we can at least put *something* in the file).
If we don't know the snapshot length of the current capture file, don't
display a value in the summary window.
Don't use "cfile.snap" as the snapshot length option when capturing -
doing so causes Ethereal to default, when capturing, to the snapshot
length of the last capture file that you read in, rather than to the
snapshot length of the last capture you did (or the initial default of
"no snapshot length").
Redo the "Capture Options" dialog box to group options into sections
with frames around them, and add units to the snapshot length, maximum
file size, and capture duration options, as per a suggestion by Ulf
Lamping. Also add units to the capture count option.
Make the snapshot length, capture count, maximum file size, and capture
duration options into a combination of a check box and a spin button.
If the check box is not checked, the limit in question is inactive
(snapshot length of 65535, no max packet count, no max file size, no max
capture duration); if it's checked, the spinbox specifies the limit.
Default all of the check boxes to "not checked" and all of the spin
boxes to small values.
Use "gtk_toggle_button_get_active()" rather than directly fetching the
state of a check box.
svn path=/trunk/; revision=4709
2002-02-08 10:07:41 +00:00
|
|
|
file_snaplen = pcap_snapshot(pch);
|
2000-07-31 04:03:31 +00:00
|
|
|
}
|
|
|
|
ld.linktype = wtap_pcap_encap_to_wtap_encap(pcap_encap);
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
if (ld.linktype == WTAP_ENCAP_UNKNOWN) {
|
2000-08-22 06:04:40 +00:00
|
|
|
snprintf(errmsg, sizeof errmsg,
|
|
|
|
"The network you're capturing from is of a type"
|
|
|
|
" that Ethereal doesn't support (data link type %d).", pcap_encap);
|
1999-09-23 07:04:23 +00:00
|
|
|
goto error;
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
}
|
2004-03-02 22:07:23 +00:00
|
|
|
if (capture_opts.multi_files_on) {
|
2002-08-28 21:04:11 +00:00
|
|
|
ld.pdh = ringbuf_init_wtap_dump_fdopen(WTAP_FILE_PCAP, ld.linktype,
|
Have Wiretap set the snapshot length to 0 if it can't be derived from
reading the capture file. Have callers of "wtap_snapshot_length()"
treat a value of 0 as "unknown", and default to WTAP_MAX_PACKET_SIZE (so
that, when writing a capture file in a format that *does* store the
snapshot length, we can at least put *something* in the file).
If we don't know the snapshot length of the current capture file, don't
display a value in the summary window.
Don't use "cfile.snap" as the snapshot length option when capturing -
doing so causes Ethereal to default, when capturing, to the snapshot
length of the last capture file that you read in, rather than to the
snapshot length of the last capture you did (or the initial default of
"no snapshot length").
Redo the "Capture Options" dialog box to group options into sections
with frames around them, and add units to the snapshot length, maximum
file size, and capture duration options, as per a suggestion by Ulf
Lamping. Also add units to the capture count option.
Make the snapshot length, capture count, maximum file size, and capture
duration options into a combination of a check box and a spin button.
If the check box is not checked, the limit in question is inactive
(snapshot length of 65535, no max packet count, no max file size, no max
capture duration); if it's checked, the spinbox specifies the limit.
Default all of the check boxes to "not checked" and all of the spin
boxes to small values.
Use "gtk_toggle_button_get_active()" rather than directly fetching the
state of a check box.
svn path=/trunk/; revision=4709
2002-02-08 10:07:41 +00:00
|
|
|
file_snaplen, &err);
|
2001-12-04 08:26:00 +00:00
|
|
|
} else {
|
|
|
|
ld.pdh = wtap_dump_fdopen(cfile.save_file_fd, WTAP_FILE_PCAP,
|
Have Wiretap set the snapshot length to 0 if it can't be derived from
reading the capture file. Have callers of "wtap_snapshot_length()"
treat a value of 0 as "unknown", and default to WTAP_MAX_PACKET_SIZE (so
that, when writing a capture file in a format that *does* store the
snapshot length, we can at least put *something* in the file).
If we don't know the snapshot length of the current capture file, don't
display a value in the summary window.
Don't use "cfile.snap" as the snapshot length option when capturing -
doing so causes Ethereal to default, when capturing, to the snapshot
length of the last capture file that you read in, rather than to the
snapshot length of the last capture you did (or the initial default of
"no snapshot length").
Redo the "Capture Options" dialog box to group options into sections
with frames around them, and add units to the snapshot length, maximum
file size, and capture duration options, as per a suggestion by Ulf
Lamping. Also add units to the capture count option.
Make the snapshot length, capture count, maximum file size, and capture
duration options into a combination of a check box and a spin button.
If the check box is not checked, the limit in question is inactive
(snapshot length of 65535, no max packet count, no max file size, no max
capture duration); if it's checked, the spinbox specifies the limit.
Default all of the check boxes to "not checked" and all of the spin
boxes to small values.
Use "gtk_toggle_button_get_active()" rather than directly fetching the
state of a check box.
svn path=/trunk/; revision=4709
2002-02-08 10:07:41 +00:00
|
|
|
ld.linktype, file_snaplen, &err);
|
2001-12-04 08:26:00 +00:00
|
|
|
}
|
1999-08-02 06:08:58 +00:00
|
|
|
|
1999-09-23 07:04:23 +00:00
|
|
|
if (ld.pdh == NULL) {
|
|
|
|
/* We couldn't set up to write to the capture file. */
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
switch (err) {
|
|
|
|
|
|
|
|
case WTAP_ERR_CANT_OPEN:
|
|
|
|
strcpy(errmsg, "The file to which the capture would be saved"
|
|
|
|
" couldn't be created for some unknown reason.");
|
|
|
|
break;
|
|
|
|
|
|
|
|
case WTAP_ERR_SHORT_WRITE:
|
|
|
|
strcpy(errmsg, "A full header couldn't be written to the file"
|
|
|
|
" to which the capture would be saved.");
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
if (err < 0) {
|
2000-08-19 18:20:59 +00:00
|
|
|
snprintf(errmsg, sizeof(errmsg),
|
|
|
|
"The file to which the capture would be"
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
" saved (\"%s\") could not be opened: Error %d.",
|
2000-06-27 04:36:03 +00:00
|
|
|
cfile.save_file, err);
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
} else {
|
2000-08-19 18:20:59 +00:00
|
|
|
snprintf(errmsg, sizeof(errmsg),
|
|
|
|
"The file to which the capture would be"
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
" saved (\"%s\") could not be opened: %s.",
|
2000-06-27 04:36:03 +00:00
|
|
|
cfile.save_file, strerror(err));
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
}
|
|
|
|
break;
|
|
|
|
}
|
1999-09-23 07:04:23 +00:00
|
|
|
goto error;
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
}
|
|
|
|
|
2001-10-25 06:41:48 +00:00
|
|
|
/* Does "open_err_str" contain a non-empty string? If so, "pcap_open_live()"
|
|
|
|
returned a warning; print it, but keep capturing. */
|
|
|
|
if (open_err_str[0] != '\0')
|
2001-10-25 08:06:15 +00:00
|
|
|
g_warning("%s.", open_err_str);
|
2001-10-25 06:41:48 +00:00
|
|
|
|
Add routines to Wiretap to allow a client of Wiretap to get:
a pointer to the "wtap_pkthdr" structure for an open capture
file;
a pointer to the "wtap_pseudo_header" union for an open capture
file;
a pointer to the packet buffer for an open capture file;
so that a program using "wtap_read()" in a loop can get at those items.
Keep, in a "capture_file" structure, an indicator of whether:
no file is open;
a file is open, and being read;
a file is open, and is being read, but the user tried to quit
out of reading the file (e.g., by doing "File/Quit");
a file is open, and has been completely read.
Abort if we try to close a capture that's being read if the user hasn't
tried to quit out of the read.
Have "File/Quit" check if a file is being read; if so, just set the
state indicator to "user tried to quit out of it", so that the code
reading the file can do what's appropriate to clean up, rather than
closing the file out from under that code and causing crashes.
Have "read_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
close the capture and return an indication that the read was aborted by
the user. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "continue_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
return an indication that the read was aborted by the user if that
happened. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "finish_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
close the capture and return an indication that the read was aborted by
the user if that happened. Otherwise, return an indication of whether
the read completely succeeded or failed in the middle (and, if it
failed, return the error code through a pointer).
Have their callers check whether the read was aborted or not and, if it
was, bail out in the appropriate fashion (exit if it's reading a file
specified by "-r" on the command line; exit the main loop if it's
reading a file specified with File->Open; kill the capture child if it's
"continue_tail_cap_file()"; exit the main loop if it's
"finish_tail_cap_file()".
svn path=/trunk/; revision=2095
2000-06-27 07:13:42 +00:00
|
|
|
/* XXX - capture SIGTERM and close the capture, in case we're on a
|
|
|
|
Linux 2.0[.x] system and you have to explicitly close the capture
|
|
|
|
stream in order to turn promiscuous mode off? We need to do that
|
|
|
|
in other places as well - and I don't think that works all the
|
|
|
|
time in any case, due to libpcap bugs. */
|
|
|
|
|
1999-10-02 20:00:46 +00:00
|
|
|
if (capture_child) {
|
1999-09-23 07:04:23 +00:00
|
|
|
/* Well, we should be able to start capturing.
|
|
|
|
|
Add a new global flag "capture_child", which is TRUE if we're a child
process for a sync mode or fork mode capture.
Have that flag control whether we do things that *only* the parent or
*only* the child should do, rather than basing it solely on the setting
of "sync_mode" or "fork_mode" (or, in the case of stuff done in the
child process either in sync mode or fork mode, rather than basing it on
the setting of those flags at all).
Split "do_capture()" into a "run_capture()" routine that starts a
capture (possibly by forking off and execing a child process, if we're
supposed to do sync mode or fork mode captures), and that assumes the
file to which the capture is to write has already been opened and that
"cf.save_file_fd" is the file descriptor for that file, and a
"do_capture()" routine that creates a temporary file, getting an FD for
it, and calls "run_capture()".
Use "run_capture()", rather than "capture()", for "-k" captures, so that
it'll do the capture in a child process if "-S" or "-F" was specified
("do_capture()" won't do because "-k" captures should write to the file
specified by the "-w" flag, not some random temporary file).
For child process captures, however, just use "capture()" - the child
process shouldn't itself fork off a child if we're in sync or fork mode,
and should just write to the file whose file descriptor was specified by
the "-W" flag on the command line.
All this allows you to do "ethereal -S -w <file> -i <interface> -k" to
start a sync mode capture from the command line.
svn path=/trunk/; revision=740
1999-09-30 06:50:01 +00:00
|
|
|
This is the child process for a sync mode capture, so sync out
|
|
|
|
the capture file, so the header makes it to the file system,
|
|
|
|
and send a "capture started successfully and capture file created"
|
|
|
|
message to our parent so that they'll open the capture file and
|
|
|
|
update its windows to indicate that we have a live capture in
|
|
|
|
progress. */
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
fflush(wtap_dump_file(ld.pdh));
|
2004-02-21 12:58:42 +00:00
|
|
|
sync_pipe_capstart_to_parent();
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
}
|
|
|
|
|
2003-11-15 08:48:14 +00:00
|
|
|
/* start capture info dialog */
|
2004-06-20 13:39:44 +00:00
|
|
|
if(show_info) {
|
|
|
|
capture_ui.callback_data = &ld;
|
|
|
|
capture_ui.counts = &ld.counts;
|
|
|
|
capture_info_create(&capture_ui, cfile.iface);
|
|
|
|
}
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
2002-10-16 23:34:52 +00:00
|
|
|
start_time = time(NULL);
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
upd_time = time(NULL);
|
2001-01-09 00:53:26 +00:00
|
|
|
#ifdef MUST_DO_SELECT
|
2004-02-21 12:58:42 +00:00
|
|
|
if (!ld.from_cap_pipe) pcap_fd = pcap_fileno(pch);
|
Enough is enough. Requiring anybody who uses Ethereal on Linux to
update their libpcap probably isn't going to scale - the increasing
frequency with which "Ethereal hangs when I try to capture packets"
shows up on "ethereal-dev" suggests that, unless and until a libpcap
with the "select()" in it becomes ubiquitous on Linux, that'll be the
source of a constant support burden - so we'll just put the "select()"
in Ethereal if it's being built for Linux.
(Putting it in for platforms where the read timeout argument to
"pcap_open_live()" works adds an extra useless system call at best and,
at worst, could make Ethereal not work - "select()" doesn't work on
"/dev/bpf" devices on FreeBSD 3.3, at least, unless you're in "immediate
mode", and, whilst "immediate mode" would make Ethereal respond more
quickly when packets arrive, it might cause Ethereal to respond too
quickly, doing reads for every new packet rather than waiting for
multiple packets to arrive and reading them all with one "read()", which
appears to be at least part of the intent of the read timeout on
"/dev/bpf" devices in BSD.)
svn path=/trunk/; revision=1451
2000-01-12 06:56:32 +00:00
|
|
|
#endif
|
2000-10-11 06:01:16 +00:00
|
|
|
|
|
|
|
#ifndef _WIN32
|
|
|
|
/*
|
|
|
|
* Catch SIGUSR1, so that we exit cleanly if the parent process
|
|
|
|
* kills us with it due to the user selecting "Capture->Stop".
|
|
|
|
*/
|
2002-06-13 21:23:02 +00:00
|
|
|
if (capture_child)
|
2004-02-21 12:58:42 +00:00
|
|
|
signal(SIGUSR1, stop_capture_signal_handler);
|
2000-10-11 06:01:16 +00:00
|
|
|
#endif
|
2004-03-04 19:31:21 +00:00
|
|
|
|
2002-08-28 21:04:11 +00:00
|
|
|
/* initialize capture stop conditions */
|
2001-12-04 07:32:05 +00:00
|
|
|
init_capture_stop_conditions();
|
|
|
|
/* create stop conditions */
|
2002-02-24 09:25:36 +00:00
|
|
|
if (capture_opts.has_autostop_filesize)
|
2004-03-04 19:31:21 +00:00
|
|
|
cnd_autostop_size =
|
2004-03-04 21:27:55 +00:00
|
|
|
cnd_new(CND_CLASS_CAPTURESIZE,(long)capture_opts.autostop_filesize);
|
2002-02-24 09:25:36 +00:00
|
|
|
if (capture_opts.has_autostop_duration)
|
2004-03-04 19:31:21 +00:00
|
|
|
cnd_autostop_duration =
|
2002-02-24 09:25:36 +00:00
|
|
|
cnd_new(CND_CLASS_TIMEOUT,(gint32)capture_opts.autostop_duration);
|
2001-12-04 07:32:05 +00:00
|
|
|
|
2004-03-04 19:31:21 +00:00
|
|
|
if (capture_opts.multi_files_on) {
|
|
|
|
if (capture_opts.has_file_duration)
|
|
|
|
cnd_file_duration =
|
|
|
|
cnd_new(CND_CLASS_TIMEOUT, capture_opts.file_duration);
|
2003-05-15 13:40:20 +00:00
|
|
|
|
2004-03-04 19:31:21 +00:00
|
|
|
if (capture_opts.has_autostop_files)
|
|
|
|
cnd_autostop_files =
|
|
|
|
cnd_new(CND_CLASS_CAPTURESIZE, capture_opts.autostop_files);
|
|
|
|
}
|
2003-11-15 08:48:14 +00:00
|
|
|
|
|
|
|
/* WOW, everything is prepared! */
|
|
|
|
/* please fasten your seat belts, we will enter now the actual capture loop */
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
while (ld.go) {
|
2004-01-22 18:13:57 +00:00
|
|
|
main_window_update();
|
2000-07-30 16:54:12 +00:00
|
|
|
|
2000-07-31 04:03:31 +00:00
|
|
|
#ifndef _WIN32
|
2004-02-21 12:58:42 +00:00
|
|
|
if (ld.from_cap_pipe) {
|
2000-07-30 16:54:12 +00:00
|
|
|
FD_ZERO(&set1);
|
|
|
|
FD_SET(pipe_fd, &set1);
|
|
|
|
timeout.tv_sec = 0;
|
|
|
|
timeout.tv_usec = CAP_READ_TIMEOUT*1000;
|
2002-06-04 11:19:59 +00:00
|
|
|
sel_ret = select(pipe_fd+1, &set1, NULL, NULL, &timeout);
|
2002-06-13 21:23:02 +00:00
|
|
|
if (sel_ret <= 0) {
|
2000-07-30 16:54:12 +00:00
|
|
|
inpkts = 0;
|
2002-06-04 11:19:59 +00:00
|
|
|
if (sel_ret < 0 && errno != EINTR) {
|
|
|
|
snprintf(errmsg, sizeof(errmsg),
|
|
|
|
"Unexpected error from select: %s", strerror(errno));
|
|
|
|
popup_errmsg(errmsg);
|
|
|
|
ld.go = FALSE;
|
|
|
|
}
|
2002-06-13 21:23:02 +00:00
|
|
|
} else {
|
|
|
|
/*
|
|
|
|
* "select()" says we can read from the pipe without blocking
|
|
|
|
*/
|
2004-02-21 12:58:42 +00:00
|
|
|
inpkts = cap_pipe_dispatch(pipe_fd, &ld, &hdr, &rechdr, pcap_data,
|
2002-06-13 21:23:02 +00:00
|
|
|
errmsg, sizeof errmsg);
|
|
|
|
if (inpkts < 0) {
|
|
|
|
ld.go = FALSE;
|
|
|
|
}
|
2002-06-04 11:19:59 +00:00
|
|
|
}
|
2000-07-30 16:54:12 +00:00
|
|
|
}
|
2000-07-31 04:03:31 +00:00
|
|
|
else
|
2004-06-20 13:39:44 +00:00
|
|
|
#endif /* _WIN32 */
|
2000-07-31 04:03:31 +00:00
|
|
|
{
|
2001-01-09 00:53:26 +00:00
|
|
|
#ifdef MUST_DO_SELECT
|
Enough is enough. Requiring anybody who uses Ethereal on Linux to
update their libpcap probably isn't going to scale - the increasing
frequency with which "Ethereal hangs when I try to capture packets"
shows up on "ethereal-dev" suggests that, unless and until a libpcap
with the "select()" in it becomes ubiquitous on Linux, that'll be the
source of a constant support burden - so we'll just put the "select()"
in Ethereal if it's being built for Linux.
(Putting it in for platforms where the read timeout argument to
"pcap_open_live()" works adds an extra useless system call at best and,
at worst, could make Ethereal not work - "select()" doesn't work on
"/dev/bpf" devices on FreeBSD 3.3, at least, unless you're in "immediate
mode", and, whilst "immediate mode" would make Ethereal respond more
quickly when packets arrive, it might cause Ethereal to respond too
quickly, doing reads for every new packet rather than waiting for
multiple packets to arrive and reading them all with one "read()", which
appears to be at least part of the intent of the read timeout on
"/dev/bpf" devices in BSD.)
svn path=/trunk/; revision=1451
2000-01-12 06:56:32 +00:00
|
|
|
/*
|
2000-07-30 16:54:12 +00:00
|
|
|
* Sigh. The semantics of the read timeout argument to
|
|
|
|
* "pcap_open_live()" aren't particularly well specified by
|
|
|
|
* the "pcap" man page - at least with the BSD BPF code, the
|
|
|
|
* intent appears to be, at least in part, a way of cutting
|
|
|
|
* down the number of reads done on a capture, by blocking
|
|
|
|
* until the buffer fills or a timer expires - and the Linux
|
|
|
|
* libpcap doesn't actually support it, so we can't use it
|
|
|
|
* to break out of the "pcap_dispatch()" every 1/4 of a second
|
It turns out that the read timeout in Solaris's "bufmod" STREAMS module
doesn't work like the read timeout in BPF - the timer doesn't start
until at least one packet has arrived.
I think that's the way read timeouts should work on *all* packet capture
mechanisms, but it does mean that Solaris will, on a quiet net, exhibit
the same symptoms that Linux used to exhibit before we put in a
"select()" call to wait until either packets arrive or a timer expires -
the "pcap_dispatch()" call blocks until a packet arrives, so the display
doesn't get updated and Ethereal doesn't respond to user input until a
packet arrives.
Furthermore, Linux isn't the only OS that lacks any read timeout
on its packet capture mechanism; the others will also have that problem.
We therefore do the "select()" on *all* platforms other than the BSDs
(where the timer starts when the read is done, and can be used for
polling); I don't know whether it's necessary on Digital UNIX, but I
suspect it's necessary on SunOS 4.x (as the 5.x "bufmod" is probably
derived from the 4.x one, and the 5.x one, as per the above, starts the
timer when a packet arrives), and it may even be necessary on 3.x, those
(BSD, SunOS including 5.x, and Digital UNIX) apparently being the only
UNIXes that appear to have such a read timeout.
svn path=/trunk/; revision=2790
2000-12-28 01:44:19 +00:00
|
|
|
* or so. Linux's libpcap is not the only libpcap that doesn't
|
|
|
|
* support the read timeout.
|
|
|
|
*
|
|
|
|
* Furthermore, at least on Solaris, the bufmod STREAMS module's
|
|
|
|
* read timeout won't go off if no data has arrived, i.e. it cannot
|
|
|
|
* be used to guarantee that a read from a DLPI stream will return
|
|
|
|
* within a specified amount of time regardless of whether any
|
|
|
|
* data arrives or not.
|
|
|
|
*
|
|
|
|
* Thus, on all platforms other than BSD, we do a "select()" on the
|
|
|
|
* file descriptor for the capture, with a timeout of CAP_READ_TIMEOUT
|
|
|
|
* milliseconds, or CAP_READ_TIMEOUT*1000 microseconds.
|
2000-07-30 16:54:12 +00:00
|
|
|
*
|
It turns out that the read timeout in Solaris's "bufmod" STREAMS module
doesn't work like the read timeout in BPF - the timer doesn't start
until at least one packet has arrived.
I think that's the way read timeouts should work on *all* packet capture
mechanisms, but it does mean that Solaris will, on a quiet net, exhibit
the same symptoms that Linux used to exhibit before we put in a
"select()" call to wait until either packets arrive or a timer expires -
the "pcap_dispatch()" call blocks until a packet arrives, so the display
doesn't get updated and Ethereal doesn't respond to user input until a
packet arrives.
Furthermore, Linux isn't the only OS that lacks any read timeout
on its packet capture mechanism; the others will also have that problem.
We therefore do the "select()" on *all* platforms other than the BSDs
(where the timer starts when the read is done, and can be used for
polling); I don't know whether it's necessary on Digital UNIX, but I
suspect it's necessary on SunOS 4.x (as the 5.x "bufmod" is probably
derived from the 4.x one, and the 5.x one, as per the above, starts the
timer when a packet arrives), and it may even be necessary on 3.x, those
(BSD, SunOS including 5.x, and Digital UNIX) apparently being the only
UNIXes that appear to have such a read timeout.
svn path=/trunk/; revision=2790
2000-12-28 01:44:19 +00:00
|
|
|
* "select()", on BPF devices, doesn't work as you might expect;
|
|
|
|
* at least on some versions of some flavors of BSD, the timer
|
|
|
|
* doesn't start until a read is done, so it won't expire if
|
|
|
|
* only a "select()" or "poll()" is posted.
|
Enough is enough. Requiring anybody who uses Ethereal on Linux to
update their libpcap probably isn't going to scale - the increasing
frequency with which "Ethereal hangs when I try to capture packets"
shows up on "ethereal-dev" suggests that, unless and until a libpcap
with the "select()" in it becomes ubiquitous on Linux, that'll be the
source of a constant support burden - so we'll just put the "select()"
in Ethereal if it's being built for Linux.
(Putting it in for platforms where the read timeout argument to
"pcap_open_live()" works adds an extra useless system call at best and,
at worst, could make Ethereal not work - "select()" doesn't work on
"/dev/bpf" devices on FreeBSD 3.3, at least, unless you're in "immediate
mode", and, whilst "immediate mode" would make Ethereal respond more
quickly when packets arrive, it might cause Ethereal to respond too
quickly, doing reads for every new packet rather than waiting for
multiple packets to arrive and reading them all with one "read()", which
appears to be at least part of the intent of the read timeout on
"/dev/bpf" devices in BSD.)
svn path=/trunk/; revision=1451
2000-01-12 06:56:32 +00:00
|
|
|
*/
|
2000-07-30 16:54:12 +00:00
|
|
|
FD_ZERO(&set1);
|
|
|
|
FD_SET(pcap_fd, &set1);
|
|
|
|
timeout.tv_sec = 0;
|
|
|
|
timeout.tv_usec = CAP_READ_TIMEOUT*1000;
|
2002-06-04 11:19:59 +00:00
|
|
|
sel_ret = select(pcap_fd+1, &set1, NULL, NULL, &timeout);
|
|
|
|
if (sel_ret > 0) {
|
2000-07-30 16:54:12 +00:00
|
|
|
/*
|
|
|
|
* "select()" says we can read from it without blocking; go for
|
|
|
|
* it.
|
|
|
|
*/
|
2002-08-02 23:36:07 +00:00
|
|
|
inpkts = pcap_dispatch(pch, 1, capture_pcap_cb, (guchar *) &ld);
|
Make the "go" member of the "loop_data" structure in Ethereal a
"gboolean", as it's a Boolean value, and move it to the beginning of the
structure in Tethereal, as it is in Ethereal.
From Graeme Hewson:
Check for "pcap_dispatch()" returning -1, meaning an error
occurred; if it does, stop capturing, and report the error.
If we get a signal in tethereal, stop the capture with a
"longjmp()", rather than by clearning the "go" flag;
"pcap_dispatch()", on many platforms, keeps reading rather than
returning a captured packet count of 0 if the system call to
read packets returns -1 with an errno of EINTR, so the
"pcap_dispatch()" won't be broken out of if the signal handler
returns.
Fix a typo in an error message.
svn path=/trunk/; revision=4471
2002-01-03 22:03:24 +00:00
|
|
|
if (inpkts < 0) {
|
|
|
|
ld.pcap_err = TRUE;
|
|
|
|
ld.go = FALSE;
|
|
|
|
}
|
2002-06-04 11:19:59 +00:00
|
|
|
} else {
|
|
|
|
inpkts = 0;
|
|
|
|
if (sel_ret < 0 && errno != EINTR) {
|
|
|
|
snprintf(errmsg, sizeof(errmsg),
|
|
|
|
"Unexpected error from select: %s", strerror(errno));
|
|
|
|
popup_errmsg(errmsg);
|
|
|
|
ld.go = FALSE;
|
|
|
|
}
|
|
|
|
}
|
Enough is enough. Requiring anybody who uses Ethereal on Linux to
update their libpcap probably isn't going to scale - the increasing
frequency with which "Ethereal hangs when I try to capture packets"
shows up on "ethereal-dev" suggests that, unless and until a libpcap
with the "select()" in it becomes ubiquitous on Linux, that'll be the
source of a constant support burden - so we'll just put the "select()"
in Ethereal if it's being built for Linux.
(Putting it in for platforms where the read timeout argument to
"pcap_open_live()" works adds an extra useless system call at best and,
at worst, could make Ethereal not work - "select()" doesn't work on
"/dev/bpf" devices on FreeBSD 3.3, at least, unless you're in "immediate
mode", and, whilst "immediate mode" would make Ethereal respond more
quickly when packets arrive, it might cause Ethereal to respond too
quickly, doing reads for every new packet rather than waiting for
multiple packets to arrive and reading them all with one "read()", which
appears to be at least part of the intent of the read timeout on
"/dev/bpf" devices in BSD.)
svn path=/trunk/; revision=1451
2000-01-12 06:56:32 +00:00
|
|
|
#else
|
2002-08-02 23:36:07 +00:00
|
|
|
inpkts = pcap_dispatch(pch, 1, capture_pcap_cb, (guchar *) &ld);
|
Make the "go" member of the "loop_data" structure in Ethereal a
"gboolean", as it's a Boolean value, and move it to the beginning of the
structure in Tethereal, as it is in Ethereal.
From Graeme Hewson:
Check for "pcap_dispatch()" returning -1, meaning an error
occurred; if it does, stop capturing, and report the error.
If we get a signal in tethereal, stop the capture with a
"longjmp()", rather than by clearning the "go" flag;
"pcap_dispatch()", on many platforms, keeps reading rather than
returning a captured packet count of 0 if the system call to
read packets returns -1 with an errno of EINTR, so the
"pcap_dispatch()" won't be broken out of if the signal handler
returns.
Fix a typo in an error message.
svn path=/trunk/; revision=4471
2002-01-03 22:03:24 +00:00
|
|
|
if (inpkts < 0) {
|
|
|
|
ld.pcap_err = TRUE;
|
|
|
|
ld.go = FALSE;
|
|
|
|
}
|
2004-06-20 13:39:44 +00:00
|
|
|
#endif /* MUST_DO_SELECT */
|
2000-07-30 16:54:12 +00:00
|
|
|
}
|
2002-06-13 21:23:02 +00:00
|
|
|
|
|
|
|
if (inpkts > 0) {
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
ld.sync_packets += inpkts;
|
2004-03-04 19:31:21 +00:00
|
|
|
|
|
|
|
/* check capture size condition */
|
|
|
|
if (cnd_autostop_size != NULL && cnd_eval(cnd_autostop_size,
|
2002-06-13 21:23:02 +00:00
|
|
|
(guint32)wtap_get_bytes_dumped(ld.pdh))){
|
2004-03-04 19:31:21 +00:00
|
|
|
/* Capture size limit reached, do we have another file? */
|
|
|
|
if (capture_opts.multi_files_on) {
|
|
|
|
if (cnd_autostop_files != NULL && cnd_eval(cnd_autostop_files, ++autostop_files)) {
|
|
|
|
/* no files left: stop here */
|
|
|
|
ld.go = FALSE;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
2002-06-13 21:23:02 +00:00
|
|
|
/* Switch to the next ringbuffer file */
|
|
|
|
if (ringbuf_switch_file(&cfile, &ld.pdh, &ld.err)) {
|
2004-03-04 19:31:21 +00:00
|
|
|
/* File switch succeeded: reset the conditions */
|
|
|
|
cnd_reset(cnd_autostop_size);
|
|
|
|
if (cnd_file_duration) {
|
|
|
|
cnd_reset(cnd_file_duration);
|
2004-02-28 16:21:11 +00:00
|
|
|
}
|
2002-06-13 21:23:02 +00:00
|
|
|
} else {
|
|
|
|
/* File switch failed: stop here */
|
|
|
|
ld.go = FALSE;
|
|
|
|
continue;
|
|
|
|
}
|
2001-12-04 08:26:00 +00:00
|
|
|
} else {
|
2004-03-04 19:31:21 +00:00
|
|
|
/* single file, stop now */
|
|
|
|
ld.go = FALSE;
|
|
|
|
continue;
|
2001-12-04 08:26:00 +00:00
|
|
|
}
|
2004-03-04 19:31:21 +00:00
|
|
|
} /* cnd_autostop_size */
|
2001-12-04 07:32:05 +00:00
|
|
|
}
|
2002-06-13 21:23:02 +00:00
|
|
|
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
/* Only update once a second so as not to overload slow displays */
|
|
|
|
cur_time = time(NULL);
|
|
|
|
if (cur_time > upd_time) {
|
|
|
|
upd_time = cur_time;
|
|
|
|
|
2003-11-15 08:48:14 +00:00
|
|
|
/*if (pcap_stats(pch, stats) >= 0) {
|
|
|
|
*stats_known = TRUE;
|
|
|
|
}*/
|
|
|
|
|
|
|
|
/* Let the parent process know. */
|
2002-10-16 23:34:52 +00:00
|
|
|
/* calculate and display running time */
|
2004-06-20 13:39:44 +00:00
|
|
|
if(show_info) {
|
|
|
|
cur_time -= start_time;
|
|
|
|
capture_ui.running_time = cur_time;
|
|
|
|
capture_ui.new_packets = ld.sync_packets;
|
|
|
|
capture_info_update(&capture_ui);
|
|
|
|
}
|
2002-10-16 23:34:52 +00:00
|
|
|
|
2002-06-13 21:23:02 +00:00
|
|
|
if (ld.sync_packets) {
|
2003-11-15 08:48:14 +00:00
|
|
|
/* do sync here */
|
2002-06-13 21:23:02 +00:00
|
|
|
fflush(wtap_dump_file(ld.pdh));
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
2002-06-13 21:23:02 +00:00
|
|
|
if (capture_child) {
|
|
|
|
/* This is the child process for a sync mode capture, so send
|
|
|
|
our parent a message saying we've written out "ld.sync_packets"
|
|
|
|
packets to the capture file. */
|
2004-02-21 12:58:42 +00:00
|
|
|
sync_pipe_packet_count_to_parent(ld.sync_packets);
|
2002-06-13 21:23:02 +00:00
|
|
|
}
|
|
|
|
|
2004-02-28 16:21:11 +00:00
|
|
|
ld.sync_packets = 0;
|
2000-10-21 04:20:07 +00:00
|
|
|
}
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
2004-03-04 19:31:21 +00:00
|
|
|
/* check capture duration condition */
|
|
|
|
if (cnd_autostop_duration != NULL && cnd_eval(cnd_autostop_duration)) {
|
|
|
|
/* The maximum capture time has elapsed; stop the capture. */
|
2002-06-13 21:23:02 +00:00
|
|
|
ld.go = FALSE;
|
2004-03-04 19:31:21 +00:00
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* check capture file duration condition */
|
|
|
|
if (cnd_file_duration != NULL && cnd_eval(cnd_file_duration)) {
|
|
|
|
/* duration limit reached, do we have another file? */
|
|
|
|
if (capture_opts.multi_files_on) {
|
|
|
|
if (cnd_autostop_files != NULL && cnd_eval(cnd_autostop_files, ++autostop_files)) {
|
|
|
|
/* no files left: stop here */
|
|
|
|
ld.go = FALSE;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Switch to the next ringbuffer file */
|
2004-02-28 16:21:11 +00:00
|
|
|
if (ringbuf_switch_file(&cfile, &ld.pdh, &ld.err)) {
|
2004-03-04 19:31:21 +00:00
|
|
|
/* file switch succeeded: reset the conditions */
|
|
|
|
cnd_reset(cnd_file_duration);
|
|
|
|
if(cnd_autostop_size)
|
|
|
|
cnd_reset(cnd_autostop_size);
|
2004-02-28 16:21:11 +00:00
|
|
|
} else {
|
|
|
|
/* File switch failed: stop here */
|
|
|
|
ld.go = FALSE;
|
2004-03-04 19:31:21 +00:00
|
|
|
continue;
|
2004-02-28 16:21:11 +00:00
|
|
|
}
|
|
|
|
} else {
|
2004-03-04 19:31:21 +00:00
|
|
|
/* single file, stop now */
|
|
|
|
ld.go = FALSE;
|
|
|
|
continue;
|
2004-02-28 16:21:11 +00:00
|
|
|
}
|
2004-03-04 19:31:21 +00:00
|
|
|
} /* cnd_file_duration */
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
}
|
2003-05-15 13:40:20 +00:00
|
|
|
|
2002-06-13 21:23:02 +00:00
|
|
|
} /* while (ld.go) */
|
2002-08-28 21:04:11 +00:00
|
|
|
|
2001-12-04 07:32:05 +00:00
|
|
|
/* delete stop conditions */
|
2004-03-04 19:31:21 +00:00
|
|
|
if (cnd_file_duration != NULL)
|
|
|
|
cnd_delete(cnd_file_duration);
|
|
|
|
if (cnd_autostop_files != NULL)
|
|
|
|
cnd_delete(cnd_autostop_files);
|
|
|
|
if (cnd_autostop_size != NULL)
|
|
|
|
cnd_delete(cnd_autostop_size);
|
|
|
|
if (cnd_autostop_duration != NULL)
|
|
|
|
cnd_delete(cnd_autostop_duration);
|
2001-12-04 07:32:05 +00:00
|
|
|
|
Make the "go" member of the "loop_data" structure in Ethereal a
"gboolean", as it's a Boolean value, and move it to the beginning of the
structure in Tethereal, as it is in Ethereal.
From Graeme Hewson:
Check for "pcap_dispatch()" returning -1, meaning an error
occurred; if it does, stop capturing, and report the error.
If we get a signal in tethereal, stop the capture with a
"longjmp()", rather than by clearning the "go" flag;
"pcap_dispatch()", on many platforms, keeps reading rather than
returning a captured packet count of 0 if the system call to
read packets returns -1 with an errno of EINTR, so the
"pcap_dispatch()" won't be broken out of if the signal handler
returns.
Fix a typo in an error message.
svn path=/trunk/; revision=4471
2002-01-03 22:03:24 +00:00
|
|
|
if (ld.pcap_err) {
|
|
|
|
snprintf(errmsg, sizeof(errmsg), "Error while capturing packets: %s",
|
|
|
|
pcap_geterr(pch));
|
2002-06-04 11:19:59 +00:00
|
|
|
popup_errmsg(errmsg);
|
2002-06-13 21:23:02 +00:00
|
|
|
#ifdef _WIN32
|
Make the "go" member of the "loop_data" structure in Ethereal a
"gboolean", as it's a Boolean value, and move it to the beginning of the
structure in Tethereal, as it is in Ethereal.
From Graeme Hewson:
Check for "pcap_dispatch()" returning -1, meaning an error
occurred; if it does, stop capturing, and report the error.
If we get a signal in tethereal, stop the capture with a
"longjmp()", rather than by clearning the "go" flag;
"pcap_dispatch()", on many platforms, keeps reading rather than
returning a captured packet count of 0 if the system call to
read packets returns -1 with an errno of EINTR, so the
"pcap_dispatch()" won't be broken out of if the signal handler
returns.
Fix a typo in an error message.
svn path=/trunk/; revision=4471
2002-01-03 22:03:24 +00:00
|
|
|
}
|
2002-06-13 21:23:02 +00:00
|
|
|
#else
|
2004-02-21 12:58:42 +00:00
|
|
|
} else if (ld.from_cap_pipe && ld.cap_pipe_err == PIPERR)
|
2002-06-13 21:23:02 +00:00
|
|
|
popup_errmsg(errmsg);
|
|
|
|
#endif
|
Make the "go" member of the "loop_data" structure in Ethereal a
"gboolean", as it's a Boolean value, and move it to the beginning of the
structure in Tethereal, as it is in Ethereal.
From Graeme Hewson:
Check for "pcap_dispatch()" returning -1, meaning an error
occurred; if it does, stop capturing, and report the error.
If we get a signal in tethereal, stop the capture with a
"longjmp()", rather than by clearning the "go" flag;
"pcap_dispatch()", on many platforms, keeps reading rather than
returning a captured packet count of 0 if the system call to
read packets returns -1 with an errno of EINTR, so the
"pcap_dispatch()" won't be broken out of if the signal handler
returns.
Fix a typo in an error message.
svn path=/trunk/; revision=4471
2002-01-03 22:03:24 +00:00
|
|
|
|
2002-09-22 16:17:41 +00:00
|
|
|
if (ld.err == 0)
|
|
|
|
write_ok = TRUE;
|
|
|
|
else {
|
2001-02-11 22:36:57 +00:00
|
|
|
get_capture_file_io_error(errmsg, sizeof(errmsg), cfile.save_file, ld.err,
|
|
|
|
FALSE);
|
2002-06-04 11:19:59 +00:00
|
|
|
popup_errmsg(errmsg);
|
2002-09-22 16:17:41 +00:00
|
|
|
write_ok = FALSE;
|
|
|
|
}
|
1999-09-23 07:04:23 +00:00
|
|
|
|
2004-03-02 22:07:23 +00:00
|
|
|
if (capture_opts.multi_files_on) {
|
2002-09-22 16:17:41 +00:00
|
|
|
close_ok = ringbuf_wtap_dump_close(&cfile, &err);
|
|
|
|
} else {
|
|
|
|
close_ok = wtap_dump_close(ld.pdh, &err);
|
|
|
|
}
|
|
|
|
/* If we've displayed a message about a write error, there's no point
|
|
|
|
in displaying another message about an error on close. */
|
|
|
|
if (!close_ok && write_ok) {
|
|
|
|
get_capture_file_io_error(errmsg, sizeof(errmsg), cfile.save_file, err,
|
|
|
|
TRUE);
|
|
|
|
popup_errmsg(errmsg);
|
1998-09-16 02:39:15 +00:00
|
|
|
}
|
2002-09-22 16:17:41 +00:00
|
|
|
/* Set write_ok to mean the write and the close were successful. */
|
|
|
|
write_ok = (write_ok && close_ok);
|
2002-06-13 21:23:02 +00:00
|
|
|
|
2002-06-22 10:21:00 +00:00
|
|
|
#ifndef _WIN32
|
|
|
|
/*
|
|
|
|
* XXX We exhibit different behaviour between normal mode and sync mode
|
|
|
|
* when the pipe is stdin and not already at EOF. If we're a child, the
|
|
|
|
* parent's stdin isn't closed, so if the user starts another capture,
|
2004-02-21 12:58:42 +00:00
|
|
|
* cap_pipe_open_live() will very likely not see the expected magic bytes and
|
2002-06-22 10:21:00 +00:00
|
|
|
* will say "Unrecognized libpcap format". On the other hand, in normal
|
2004-02-21 12:58:42 +00:00
|
|
|
* mode, cap_pipe_open_live() will say "End of file on pipe during open".
|
2002-06-22 10:21:00 +00:00
|
|
|
*/
|
2004-02-21 12:58:42 +00:00
|
|
|
if (ld.from_cap_pipe && pipe_fd >= 0)
|
2000-07-30 16:54:12 +00:00
|
|
|
close(pipe_fd);
|
|
|
|
else
|
2000-07-31 04:03:31 +00:00
|
|
|
#endif
|
2001-02-11 09:28:17 +00:00
|
|
|
{
|
|
|
|
/* Get the capture statistics, so we know how many packets were
|
|
|
|
dropped. */
|
2001-02-11 22:46:27 +00:00
|
|
|
if (pcap_stats(pch, stats) >= 0) {
|
2001-02-11 09:28:17 +00:00
|
|
|
*stats_known = TRUE;
|
2001-02-11 22:46:27 +00:00
|
|
|
if (capture_child) {
|
|
|
|
/* Let the parent process know. */
|
2004-02-21 12:58:42 +00:00
|
|
|
sync_pipe_drops_to_parent(stats->ps_drop);
|
2001-02-11 22:46:27 +00:00
|
|
|
}
|
|
|
|
} else {
|
|
|
|
snprintf(errmsg, sizeof(errmsg),
|
2001-02-11 21:29:03 +00:00
|
|
|
"Can't get packet-drop statistics: %s",
|
|
|
|
pcap_geterr(pch));
|
2002-06-04 11:19:59 +00:00
|
|
|
popup_errmsg(errmsg);
|
2001-02-11 21:29:03 +00:00
|
|
|
}
|
2000-07-30 16:54:12 +00:00
|
|
|
pcap_close(pch);
|
2001-02-11 09:28:17 +00:00
|
|
|
}
|
1998-09-16 02:39:15 +00:00
|
|
|
|
2002-12-31 21:12:55 +00:00
|
|
|
#ifdef _WIN32
|
2000-09-14 22:59:08 +00:00
|
|
|
/* Shut down windows sockets */
|
|
|
|
WSACleanup();
|
|
|
|
#endif
|
|
|
|
|
2004-06-20 13:39:44 +00:00
|
|
|
if(show_info) {
|
|
|
|
capture_info_destroy(&capture_ui);
|
|
|
|
}
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
2002-09-22 16:17:41 +00:00
|
|
|
return write_ok;
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
1999-09-23 07:04:23 +00:00
|
|
|
error:
|
2004-03-02 22:07:23 +00:00
|
|
|
if (capture_opts.multi_files_on) {
|
2001-12-04 08:26:00 +00:00
|
|
|
/* cleanup ringbuffer */
|
|
|
|
ringbuf_error_cleanup();
|
|
|
|
} else {
|
|
|
|
/* We can't use the save file, and we have no wtap_dump stream
|
|
|
|
to close in order to close it, so close the FD directly. */
|
|
|
|
close(cfile.save_file_fd);
|
|
|
|
|
|
|
|
/* We couldn't even start the capture, so get rid of the capture
|
|
|
|
file. */
|
|
|
|
unlink(cfile.save_file); /* silently ignore error */
|
|
|
|
g_free(cfile.save_file);
|
|
|
|
}
|
2000-06-27 04:36:03 +00:00
|
|
|
cfile.save_file = NULL;
|
2002-06-04 11:19:59 +00:00
|
|
|
popup_errmsg(errmsg);
|
2002-06-13 21:23:02 +00:00
|
|
|
|
2002-12-31 21:12:55 +00:00
|
|
|
#ifndef _WIN32
|
2004-02-21 12:58:42 +00:00
|
|
|
if (ld.from_cap_pipe) {
|
2002-06-13 21:23:02 +00:00
|
|
|
if (pipe_fd >= 0)
|
|
|
|
close(pipe_fd);
|
2002-06-22 10:21:00 +00:00
|
|
|
} else
|
|
|
|
#endif
|
|
|
|
{
|
|
|
|
if (pch != NULL)
|
|
|
|
pcap_close(pch);
|
|
|
|
}
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
1999-10-02 06:00:07 +00:00
|
|
|
return FALSE;
|
1998-09-16 02:39:15 +00:00
|
|
|
}
|
|
|
|
|
2001-02-10 09:08:14 +00:00
|
|
|
static void
|
2001-02-11 22:36:57 +00:00
|
|
|
get_capture_file_io_error(char *errmsg, int errmsglen, const char *fname,
|
|
|
|
int err, gboolean is_close)
|
2001-02-10 09:08:14 +00:00
|
|
|
{
|
|
|
|
switch (err) {
|
|
|
|
|
|
|
|
case ENOSPC:
|
2001-02-11 22:36:57 +00:00
|
|
|
snprintf(errmsg, errmsglen,
|
2001-02-10 09:08:14 +00:00
|
|
|
"Not all the packets could be written to the file"
|
|
|
|
" to which the capture was being saved\n"
|
|
|
|
"(\"%s\") because there is no space left on the file system\n"
|
|
|
|
"on which that file resides.",
|
|
|
|
fname);
|
|
|
|
break;
|
|
|
|
|
|
|
|
#ifdef EDQUOT
|
|
|
|
case EDQUOT:
|
2001-02-11 22:36:57 +00:00
|
|
|
snprintf(errmsg, errmsglen,
|
2001-02-10 09:08:14 +00:00
|
|
|
"Not all the packets could be written to the file"
|
|
|
|
" to which the capture was being saved\n"
|
|
|
|
"(\"%s\") because you are too close to, or over,"
|
|
|
|
" your disk quota\n"
|
|
|
|
"on the file system on which that file resides.",
|
|
|
|
fname);
|
|
|
|
break;
|
|
|
|
#endif
|
|
|
|
|
|
|
|
case WTAP_ERR_CANT_CLOSE:
|
2001-02-11 22:36:57 +00:00
|
|
|
snprintf(errmsg, errmsglen,
|
2001-02-10 09:08:14 +00:00
|
|
|
"The file to which the capture was being saved"
|
|
|
|
" couldn't be closed for some unknown reason.");
|
|
|
|
break;
|
|
|
|
|
|
|
|
case WTAP_ERR_SHORT_WRITE:
|
2001-02-11 22:36:57 +00:00
|
|
|
snprintf(errmsg, errmsglen,
|
2001-02-10 09:08:14 +00:00
|
|
|
"Not all the packets could be written to the file"
|
|
|
|
" to which the capture was being saved\n"
|
|
|
|
"(\"%s\").",
|
|
|
|
fname);
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
if (is_close) {
|
2001-02-11 22:36:57 +00:00
|
|
|
snprintf(errmsg, errmsglen,
|
2001-02-10 09:08:14 +00:00
|
|
|
"The file to which the capture was being saved\n"
|
|
|
|
"(\"%s\") could not be closed: %s.",
|
|
|
|
fname, wtap_strerror(err));
|
|
|
|
} else {
|
2001-02-11 22:36:57 +00:00
|
|
|
snprintf(errmsg, errmsglen,
|
2001-02-10 09:08:14 +00:00
|
|
|
"An error occurred while writing to the file"
|
|
|
|
" to which the capture was being saved\n"
|
|
|
|
"(\"%s\"): %s.",
|
|
|
|
fname, wtap_strerror(err));
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2002-06-04 11:19:59 +00:00
|
|
|
static void
|
|
|
|
popup_errmsg(const char *errmsg)
|
|
|
|
{
|
|
|
|
if (capture_child) {
|
|
|
|
/* This is the child process for a sync mode capture.
|
|
|
|
Send the error message to our parent, so they can display a
|
|
|
|
dialog box containing it. */
|
2004-02-21 12:58:42 +00:00
|
|
|
sync_pipe_errmsg_to_parent(errmsg);
|
2002-06-04 11:19:59 +00:00
|
|
|
} else {
|
|
|
|
/* Display the dialog box ourselves; there's no parent. */
|
2004-01-31 03:22:42 +00:00
|
|
|
simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK, "%s", errmsg);
|
2002-06-04 11:19:59 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2000-05-06 05:08:39 +00:00
|
|
|
static void
|
2004-02-21 12:58:42 +00:00
|
|
|
stop_capture_signal_handler(int signo _U_)
|
2000-10-11 06:01:16 +00:00
|
|
|
{
|
|
|
|
ld.go = FALSE;
|
|
|
|
}
|
|
|
|
|
2003-11-15 08:48:14 +00:00
|
|
|
|
2000-10-11 06:01:16 +00:00
|
|
|
void
|
|
|
|
capture_stop(void)
|
|
|
|
{
|
2004-10-30 11:44:06 +00:00
|
|
|
|
|
|
|
if (capture_opts.sync_mode) {
|
|
|
|
sync_pipe_stop();
|
2004-02-21 12:58:42 +00:00
|
|
|
} else {
|
|
|
|
ld.go = FALSE;
|
2004-02-03 17:59:01 +00:00
|
|
|
}
|
2000-10-11 06:01:16 +00:00
|
|
|
}
|
|
|
|
|
Add a routine to kill a capture child if it exists, so that if we exit
(by deleting the main window or selecting File->Quit or typing ^Q) while
an "Update list of packets in real time" capture is in progress, we can
abort the capture.
Arrange that "fork_child" is -1 when there is no capture child, so said
routine knows when it can kill the child.
When we exit, kill off any capture child, using that routine, and, if
we're exiting due to a request to delete the main window and, if a read
is in progress (from an "Update list of packets in real time" capture),
don't delete the main window - just set the "Read aborted" flag, so that
the code doing the read will see that flag (it will be called because
the pipe to the capture child is closed due to the child exiting) will
see that and clean up and exit itself.
svn path=/trunk/; revision=4498
2002-01-08 09:32:15 +00:00
|
|
|
void
|
|
|
|
kill_capture_child(void)
|
|
|
|
{
|
2004-10-30 11:44:06 +00:00
|
|
|
if (capture_opts.sync_mode) {
|
|
|
|
sync_pipe_kill();
|
|
|
|
}
|
Add a routine to kill a capture child if it exists, so that if we exit
(by deleting the main window or selecting File->Quit or typing ^Q) while
an "Update list of packets in real time" capture is in progress, we can
abort the capture.
Arrange that "fork_child" is -1 when there is no capture child, so said
routine knows when it can kill the child.
When we exit, kill off any capture child, using that routine, and, if
we're exiting due to a request to delete the main window and, if a read
is in progress (from an "Update list of packets in real time" capture),
don't delete the main window - just set the "Read aborted" flag, so that
the code doing the read will see that flag (it will be called because
the pipe to the capture child is closed due to the child exiting) will
see that and clean up and exit itself.
svn path=/trunk/; revision=4498
2002-01-08 09:32:15 +00:00
|
|
|
}
|
|
|
|
|
2004-02-21 12:58:42 +00:00
|
|
|
/* one packet was captured, process it */
|
1999-06-19 01:14:51 +00:00
|
|
|
static void
|
2002-08-02 23:36:07 +00:00
|
|
|
capture_pcap_cb(guchar *user, const struct pcap_pkthdr *phdr,
|
|
|
|
const guchar *pd)
|
2002-06-07 11:12:43 +00:00
|
|
|
{
|
Add to Wiretap the ability to write capture files; for now, it can only
write them in "libpcap" format, but the mechanism can have other formats
added.
When creating the temporary file for a capture, use "create_tempfile()",
to close a security hole opened by the fact that "tempnam()" creates a
temporary file, but doesn't open it, and we open the file with the name
it gives us - somebody could remove the file and plant a link to some
file, and, if as may well be the case when Ethereal is capturing
packets, it's running as "root", that means we write a capture on top of
that file.... (The aforementioned changes to Wiretap let you open a
capture file for writing given an file descriptor, "fdopen()"-style,
which this change requires.)
svn path=/trunk/; revision=509
1999-08-18 04:17:38 +00:00
|
|
|
struct wtap_pkthdr whdr;
|
2002-06-07 21:11:24 +00:00
|
|
|
union wtap_pseudo_header pseudo_header;
|
1998-09-16 02:39:15 +00:00
|
|
|
loop_data *ld = (loop_data *) user;
|
1999-08-18 04:41:20 +00:00
|
|
|
int err;
|
Add to Wiretap the ability to write capture files; for now, it can only
write them in "libpcap" format, but the mechanism can have other formats
added.
When creating the temporary file for a capture, use "create_tempfile()",
to close a security hole opened by the fact that "tempnam()" creates a
temporary file, but doesn't open it, and we open the file with the name
it gives us - somebody could remove the file and plant a link to some
file, and, if as may well be the case when Ethereal is capturing
packets, it's running as "root", that means we write a capture on top of
that file.... (The aforementioned changes to Wiretap let you open a
capture file for writing given an file descriptor, "fdopen()"-style,
which this change requires.)
svn path=/trunk/; revision=509
1999-08-18 04:17:38 +00:00
|
|
|
|
2004-02-21 12:58:42 +00:00
|
|
|
/* user told us to stop after x packets, do we have enough? */
|
2002-08-28 21:04:11 +00:00
|
|
|
if ((++ld->counts.total >= ld->max) && (ld->max > 0))
|
1998-09-29 21:39:29 +00:00
|
|
|
{
|
|
|
|
ld->go = FALSE;
|
|
|
|
}
|
2002-06-07 11:12:43 +00:00
|
|
|
|
2002-06-07 21:11:24 +00:00
|
|
|
/* Convert from libpcap to Wiretap format.
|
|
|
|
If that fails, set "ld->go" to FALSE, to stop the capture, and set
|
|
|
|
"ld->err" to the error. */
|
|
|
|
pd = wtap_process_pcap_packet(ld->linktype, phdr, pd, &pseudo_header,
|
|
|
|
&whdr, &err);
|
|
|
|
if (pd == NULL) {
|
|
|
|
ld->go = FALSE;
|
|
|
|
ld->err = err;
|
|
|
|
return;
|
|
|
|
}
|
2002-06-07 11:12:43 +00:00
|
|
|
|
Add to Wiretap the ability to write capture files; for now, it can only
write them in "libpcap" format, but the mechanism can have other formats
added.
When creating the temporary file for a capture, use "create_tempfile()",
to close a security hole opened by the fact that "tempnam()" creates a
temporary file, but doesn't open it, and we open the file with the name
it gives us - somebody could remove the file and plant a link to some
file, and, if as may well be the case when Ethereal is capturing
packets, it's running as "root", that means we write a capture on top of
that file.... (The aforementioned changes to Wiretap let you open a
capture file for writing given an file descriptor, "fdopen()"-style,
which this change requires.)
svn path=/trunk/; revision=509
1999-08-18 04:17:38 +00:00
|
|
|
if (ld->pdh) {
|
2002-06-07 11:12:43 +00:00
|
|
|
/* We're supposed to write the packet to a file; do so.
|
|
|
|
If this fails, set "ld->go" to FALSE, to stop the capture, and set
|
2002-06-07 10:54:03 +00:00
|
|
|
"ld->err" to the error. */
|
2002-06-07 21:11:24 +00:00
|
|
|
if (!wtap_dump(ld->pdh, &whdr, &pseudo_header, pd, &err)) {
|
2002-06-07 10:54:03 +00:00
|
|
|
ld->go = FALSE;
|
|
|
|
ld->err = err;
|
|
|
|
}
|
Add to Wiretap the ability to write capture files; for now, it can only
write them in "libpcap" format, but the mechanism can have other formats
added.
When creating the temporary file for a capture, use "create_tempfile()",
to close a security hole opened by the fact that "tempnam()" creates a
temporary file, but doesn't open it, and we open the file with the name
it gives us - somebody could remove the file and plant a link to some
file, and, if as may well be the case when Ethereal is capturing
packets, it's running as "root", that means we write a capture on top of
that file.... (The aforementioned changes to Wiretap let you open a
capture file for writing given an file descriptor, "fdopen()"-style,
which this change requires.)
svn path=/trunk/; revision=509
1999-08-18 04:17:38 +00:00
|
|
|
}
|
2000-01-23 08:55:37 +00:00
|
|
|
|
1999-02-09 00:35:38 +00:00
|
|
|
switch (ld->linktype) {
|
DLT_NULL, from "libpcap", means different things on different platforms
and in different capture files; throw in some heuristics to try to
figure out whether the 4-byte header is:
1) PPP-over-HDLC (some version of ISDN4BSD?);
2) big-endian AF_ value (BSD on big-endian platforms);
3) little-endian AF_ value (BSD on little-endian platforms);
4) two octets of 0 followed by an Ethernet type (Linux, at least
on little-endian platforms, as mutated by "libpcap").
Make a separate Wiretap encapsulation type, WTAP_ENCAP_NULL,
corresponding to DLT_NULL.
Have the PPP code dissect the frame if it's PPP-over-HDLC, and have
"ethertype()" dissect the Ethernet type and the rest of the packet if
it's a Linux-style header; dissect it ourselves only if it's an AF_
value.
Have Wiretap impose a maximum packet size of 65535 bytes, so that it
fails more gracefully when handed a corrupt "libpcap" capture file
(other capture file formats with more than a 16-bit capture length
field, if any, will have that check added later), and put that size in
"wtap.h" and have Ethereal use it as its notion of a maximum packet
size.
Have Ethereal put up a "this file appears to be damaged or corrupt"
message box if Wiretap returns a WTAP_ERR_BAD_RECORD error when opening
or reading a capture file.
Include loopback interfaces in the list of interfaces offered by the
"Capture" dialog box, but put them at the end of the list so that it
doesn't default to a loopback interface unless there are no other
interfaces. Also, don't require that an interface in the list have an
IP address associated with it, and only put one entry in the list for a
given interface (SIOCGIFCONF returns one entry per interface *address*,
not per *interface* - and even if you were to use only IP addresses, an
interface could conceivably have more than one IP address).
Exclusively use Wiretap encapsulation types internally, even when
capturing; don't use DLT_ types.
svn path=/trunk/; revision=540
1999-08-22 00:47:56 +00:00
|
|
|
case WTAP_ENCAP_ETHERNET:
|
2002-06-07 11:12:43 +00:00
|
|
|
capture_eth(pd, 0, whdr.caplen, &ld->counts);
|
1999-02-09 00:35:38 +00:00
|
|
|
break;
|
DLT_NULL, from "libpcap", means different things on different platforms
and in different capture files; throw in some heuristics to try to
figure out whether the 4-byte header is:
1) PPP-over-HDLC (some version of ISDN4BSD?);
2) big-endian AF_ value (BSD on big-endian platforms);
3) little-endian AF_ value (BSD on little-endian platforms);
4) two octets of 0 followed by an Ethernet type (Linux, at least
on little-endian platforms, as mutated by "libpcap").
Make a separate Wiretap encapsulation type, WTAP_ENCAP_NULL,
corresponding to DLT_NULL.
Have the PPP code dissect the frame if it's PPP-over-HDLC, and have
"ethertype()" dissect the Ethernet type and the rest of the packet if
it's a Linux-style header; dissect it ourselves only if it's an AF_
value.
Have Wiretap impose a maximum packet size of 65535 bytes, so that it
fails more gracefully when handed a corrupt "libpcap" capture file
(other capture file formats with more than a 16-bit capture length
field, if any, will have that check added later), and put that size in
"wtap.h" and have Ethereal use it as its notion of a maximum packet
size.
Have Ethereal put up a "this file appears to be damaged or corrupt"
message box if Wiretap returns a WTAP_ERR_BAD_RECORD error when opening
or reading a capture file.
Include loopback interfaces in the list of interfaces offered by the
"Capture" dialog box, but put them at the end of the list so that it
doesn't default to a loopback interface unless there are no other
interfaces. Also, don't require that an interface in the list have an
IP address associated with it, and only put one entry in the list for a
given interface (SIOCGIFCONF returns one entry per interface *address*,
not per *interface* - and even if you were to use only IP addresses, an
interface could conceivably have more than one IP address).
Exclusively use Wiretap encapsulation types internally, even when
capturing; don't use DLT_ types.
svn path=/trunk/; revision=540
1999-08-22 00:47:56 +00:00
|
|
|
case WTAP_ENCAP_FDDI:
|
Add a new Wiretap encapsulation type WTAP_ENCAP_FDDI_BITSWAPPED, meaning
"FDDI with the MAC addresses bit-swapped"; whether the MAC addresses are
bit-swapped is a property of the machine on which the capture was taken,
not of the machine on which the capture is being read - right now, none
of the capture file formats we read indicate whether FDDI MAC addresses
are bit-swapped, but this does let us treat non-"libpcap" captures as
being bit-swapped or not bit-swapped independent of the machine on which
they're being read (and of the machine on which they were captured, but
I have the impression they're bit-swapped on most platforms), and allows
us to, if, as, and when we implement packet capture in Wiretap, mark
packets in a capture file written in Wiretap-native format based on the
machine on which they are captured (assuming the rule "Ultrix, Alpha,
and BSD/OS are the only platforms that don't bit-swap", or some other
compile-time rule, gets the right answer, or that some platform has
drivers that can tell us whether the addresses are bit-swapped).
(NOTE: if, for any of the capture file formats used only on one
platform, FDDI MAC addresses aren't bit-swapped, the code to read that
capture file format should be fixed to flag them as not bit-swapped.)
Use the encapsulation type to decide whether to bit-swap addresses in
"dissect_fddi()".
svn path=/trunk/; revision=557
1999-08-24 03:19:34 +00:00
|
|
|
case WTAP_ENCAP_FDDI_BITSWAPPED:
|
2002-06-07 11:12:43 +00:00
|
|
|
capture_fddi(pd, whdr.caplen, &ld->counts);
|
1999-02-09 00:35:38 +00:00
|
|
|
break;
|
2001-11-30 07:14:22 +00:00
|
|
|
case WTAP_ENCAP_PRISM_HEADER:
|
2002-06-07 11:12:43 +00:00
|
|
|
capture_prism(pd, 0, whdr.caplen, &ld->counts);
|
2001-11-30 07:14:22 +00:00
|
|
|
break;
|
2000-09-21 04:41:37 +00:00
|
|
|
case WTAP_ENCAP_TOKEN_RING:
|
2002-06-07 11:12:43 +00:00
|
|
|
capture_tr(pd, 0, whdr.caplen, &ld->counts);
|
1999-02-09 00:35:38 +00:00
|
|
|
break;
|
DLT_NULL, from "libpcap", means different things on different platforms
and in different capture files; throw in some heuristics to try to
figure out whether the 4-byte header is:
1) PPP-over-HDLC (some version of ISDN4BSD?);
2) big-endian AF_ value (BSD on big-endian platforms);
3) little-endian AF_ value (BSD on little-endian platforms);
4) two octets of 0 followed by an Ethernet type (Linux, at least
on little-endian platforms, as mutated by "libpcap").
Make a separate Wiretap encapsulation type, WTAP_ENCAP_NULL,
corresponding to DLT_NULL.
Have the PPP code dissect the frame if it's PPP-over-HDLC, and have
"ethertype()" dissect the Ethernet type and the rest of the packet if
it's a Linux-style header; dissect it ourselves only if it's an AF_
value.
Have Wiretap impose a maximum packet size of 65535 bytes, so that it
fails more gracefully when handed a corrupt "libpcap" capture file
(other capture file formats with more than a 16-bit capture length
field, if any, will have that check added later), and put that size in
"wtap.h" and have Ethereal use it as its notion of a maximum packet
size.
Have Ethereal put up a "this file appears to be damaged or corrupt"
message box if Wiretap returns a WTAP_ERR_BAD_RECORD error when opening
or reading a capture file.
Include loopback interfaces in the list of interfaces offered by the
"Capture" dialog box, but put them at the end of the list so that it
doesn't default to a loopback interface unless there are no other
interfaces. Also, don't require that an interface in the list have an
IP address associated with it, and only put one entry in the list for a
given interface (SIOCGIFCONF returns one entry per interface *address*,
not per *interface* - and even if you were to use only IP addresses, an
interface could conceivably have more than one IP address).
Exclusively use Wiretap encapsulation types internally, even when
capturing; don't use DLT_ types.
svn path=/trunk/; revision=540
1999-08-22 00:47:56 +00:00
|
|
|
case WTAP_ENCAP_NULL:
|
2002-06-07 11:12:43 +00:00
|
|
|
capture_null(pd, whdr.caplen, &ld->counts);
|
1999-02-09 00:35:38 +00:00
|
|
|
break;
|
DLT_NULL, from "libpcap", means different things on different platforms
and in different capture files; throw in some heuristics to try to
figure out whether the 4-byte header is:
1) PPP-over-HDLC (some version of ISDN4BSD?);
2) big-endian AF_ value (BSD on big-endian platforms);
3) little-endian AF_ value (BSD on little-endian platforms);
4) two octets of 0 followed by an Ethernet type (Linux, at least
on little-endian platforms, as mutated by "libpcap").
Make a separate Wiretap encapsulation type, WTAP_ENCAP_NULL,
corresponding to DLT_NULL.
Have the PPP code dissect the frame if it's PPP-over-HDLC, and have
"ethertype()" dissect the Ethernet type and the rest of the packet if
it's a Linux-style header; dissect it ourselves only if it's an AF_
value.
Have Wiretap impose a maximum packet size of 65535 bytes, so that it
fails more gracefully when handed a corrupt "libpcap" capture file
(other capture file formats with more than a 16-bit capture length
field, if any, will have that check added later), and put that size in
"wtap.h" and have Ethereal use it as its notion of a maximum packet
size.
Have Ethereal put up a "this file appears to be damaged or corrupt"
message box if Wiretap returns a WTAP_ERR_BAD_RECORD error when opening
or reading a capture file.
Include loopback interfaces in the list of interfaces offered by the
"Capture" dialog box, but put them at the end of the list so that it
doesn't default to a loopback interface unless there are no other
interfaces. Also, don't require that an interface in the list have an
IP address associated with it, and only put one entry in the list for a
given interface (SIOCGIFCONF returns one entry per interface *address*,
not per *interface* - and even if you were to use only IP addresses, an
interface could conceivably have more than one IP address).
Exclusively use Wiretap encapsulation types internally, even when
capturing; don't use DLT_ types.
svn path=/trunk/; revision=540
1999-08-22 00:47:56 +00:00
|
|
|
case WTAP_ENCAP_PPP:
|
2002-06-07 11:12:43 +00:00
|
|
|
capture_ppp_hdlc(pd, 0, whdr.caplen, &ld->counts);
|
1999-02-09 00:35:38 +00:00
|
|
|
break;
|
DLT_NULL, from "libpcap", means different things on different platforms
and in different capture files; throw in some heuristics to try to
figure out whether the 4-byte header is:
1) PPP-over-HDLC (some version of ISDN4BSD?);
2) big-endian AF_ value (BSD on big-endian platforms);
3) little-endian AF_ value (BSD on little-endian platforms);
4) two octets of 0 followed by an Ethernet type (Linux, at least
on little-endian platforms, as mutated by "libpcap").
Make a separate Wiretap encapsulation type, WTAP_ENCAP_NULL,
corresponding to DLT_NULL.
Have the PPP code dissect the frame if it's PPP-over-HDLC, and have
"ethertype()" dissect the Ethernet type and the rest of the packet if
it's a Linux-style header; dissect it ourselves only if it's an AF_
value.
Have Wiretap impose a maximum packet size of 65535 bytes, so that it
fails more gracefully when handed a corrupt "libpcap" capture file
(other capture file formats with more than a 16-bit capture length
field, if any, will have that check added later), and put that size in
"wtap.h" and have Ethereal use it as its notion of a maximum packet
size.
Have Ethereal put up a "this file appears to be damaged or corrupt"
message box if Wiretap returns a WTAP_ERR_BAD_RECORD error when opening
or reading a capture file.
Include loopback interfaces in the list of interfaces offered by the
"Capture" dialog box, but put them at the end of the list so that it
doesn't default to a loopback interface unless there are no other
interfaces. Also, don't require that an interface in the list have an
IP address associated with it, and only put one entry in the list for a
given interface (SIOCGIFCONF returns one entry per interface *address*,
not per *interface* - and even if you were to use only IP addresses, an
interface could conceivably have more than one IP address).
Exclusively use Wiretap encapsulation types internally, even when
capturing; don't use DLT_ types.
svn path=/trunk/; revision=540
1999-08-22 00:47:56 +00:00
|
|
|
case WTAP_ENCAP_RAW_IP:
|
2002-06-07 11:12:43 +00:00
|
|
|
capture_raw(pd, whdr.caplen, &ld->counts);
|
1999-02-09 00:35:38 +00:00
|
|
|
break;
|
2001-01-13 03:17:15 +00:00
|
|
|
case WTAP_ENCAP_SLL:
|
2002-06-07 11:12:43 +00:00
|
|
|
capture_sll(pd, whdr.caplen, &ld->counts);
|
2001-01-13 03:17:15 +00:00
|
|
|
break;
|
2000-06-15 04:23:06 +00:00
|
|
|
case WTAP_ENCAP_LINUX_ATM_CLIP:
|
2002-06-07 11:12:43 +00:00
|
|
|
capture_clip(pd, whdr.caplen, &ld->counts);
|
2002-06-07 10:36:57 +00:00
|
|
|
break;
|
|
|
|
case WTAP_ENCAP_IEEE_802_11:
|
|
|
|
case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
|
2002-06-07 11:12:43 +00:00
|
|
|
capture_ieee80211(pd, 0, whdr.caplen, &ld->counts);
|
2002-06-07 10:36:57 +00:00
|
|
|
break;
|
|
|
|
case WTAP_ENCAP_CHDLC:
|
2002-06-07 11:12:43 +00:00
|
|
|
capture_chdlc(pd, 0, whdr.caplen, &ld->counts);
|
2000-06-15 04:23:06 +00:00
|
|
|
break;
|
2001-11-30 07:14:22 +00:00
|
|
|
case WTAP_ENCAP_LOCALTALK:
|
2002-04-24 06:03:34 +00:00
|
|
|
capture_llap(&ld->counts);
|
2001-11-30 07:14:22 +00:00
|
|
|
break;
|
Rename WTAP_ENCAP_ATM_SNIFFER to WTAP_ENCAP_ATM_PDUS, as it's not just
used for the DOS-based ATM Sniffer. (That's not a great name, but I
couldn't think of a better one.)
Add a new WTAP_ENCAP_ATM_PDUS_UNTRUNCATED encapsulation type for capture
files where reassembled frames don't have trailers, such as the AAL5
trailer, chopped off. That's what at least some versions of the
Windows-based ATM Sniffer appear to have.
Map the ATM capture file type for NetXRay captures to
WTAP_ENCAP_ATM_PDUS_UNTRUNCATED, and put in stuff to fill in what we've
reverse-engineered, so far, for the pseudo-header; there's more that
needs to be done on it, e.g. getting the channel, AAL type, and traffic
type (or inferring them if they're not in the packet header).
svn path=/trunk/; revision=6840
2003-01-03 06:45:45 +00:00
|
|
|
case WTAP_ENCAP_ATM_PDUS:
|
2002-06-07 21:11:24 +00:00
|
|
|
capture_atm(&pseudo_header, pd, whdr.caplen, &ld->counts);
|
|
|
|
break;
|
2002-12-08 22:35:30 +00:00
|
|
|
case WTAP_ENCAP_IP_OVER_FC:
|
|
|
|
capture_ipfc(pd, whdr.caplen, &ld->counts);
|
|
|
|
break;
|
2003-01-23 06:57:37 +00:00
|
|
|
case WTAP_ENCAP_ARCNET:
|
2003-01-23 09:04:54 +00:00
|
|
|
capture_arcnet(pd, whdr.caplen, &ld->counts, FALSE, TRUE);
|
2003-01-23 06:57:37 +00:00
|
|
|
break;
|
|
|
|
case WTAP_ENCAP_ARCNET_LINUX:
|
2003-01-23 09:04:54 +00:00
|
|
|
capture_arcnet(pd, whdr.caplen, &ld->counts, TRUE, FALSE);
|
2003-01-23 06:57:37 +00:00
|
|
|
break;
|
2004-03-23 01:02:41 +00:00
|
|
|
case WTAP_ENCAP_APPLE_IP_OVER_IEEE1394:
|
|
|
|
capture_ap1394(pd, 0, whdr.caplen, &ld->counts);
|
|
|
|
break;
|
2002-06-07 11:12:43 +00:00
|
|
|
/* XXX - some ATM drivers on FreeBSD might prepend a 4-byte ATM
|
|
|
|
pseudo-header to DLT_ATM_RFC1483, with LLC header following;
|
|
|
|
we might have to implement that at some point. */
|
1998-09-16 02:39:15 +00:00
|
|
|
}
|
|
|
|
}
|
1999-07-09 04:18:36 +00:00
|
|
|
|
|
|
|
#endif /* HAVE_LIBPCAP */
|