1998-09-16 02:39:15 +00:00
|
|
|
/* capture.c
|
2005-03-28 18:04:09 +00:00
|
|
|
* Routines for packet capture
|
1998-09-16 02:39:15 +00:00
|
|
|
*
|
2004-07-18 00:24:25 +00:00
|
|
|
* $Id$
|
1998-09-16 03:22:19 +00:00
|
|
|
*
|
2006-05-21 05:12:17 +00:00
|
|
|
* Wireshark - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@wireshark.org>
|
1998-09-16 02:39:15 +00:00
|
|
|
* Copyright 1998 Gerald Combs
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
# include "config.h"
|
|
|
|
#endif
|
|
|
|
|
1999-07-09 04:18:36 +00:00
|
|
|
#ifdef HAVE_LIBPCAP
|
|
|
|
|
2005-04-30 17:23:33 +00:00
|
|
|
#ifdef HAVE_UNISTD_H
|
|
|
|
#include <unistd.h>
|
|
|
|
#endif
|
|
|
|
|
1998-12-17 05:42:33 +00:00
|
|
|
#include <stdlib.h>
|
1998-09-16 02:39:15 +00:00
|
|
|
#include <string.h>
|
2005-02-06 22:18:15 +00:00
|
|
|
#include <ctype.h>
|
2000-08-11 13:37:21 +00:00
|
|
|
|
|
|
|
#ifdef HAVE_FCNTL_H
|
1999-10-02 06:26:53 +00:00
|
|
|
#include <fcntl.h>
|
2000-08-11 13:37:21 +00:00
|
|
|
#endif
|
1999-08-03 20:51:41 +00:00
|
|
|
|
2007-06-11 03:58:58 +00:00
|
|
|
#ifdef HAVE_SYS_TYPES_H
|
|
|
|
#include <sys/types.h>
|
|
|
|
#endif
|
|
|
|
|
2007-06-11 18:26:09 +00:00
|
|
|
#ifdef HAVE_NETINET_IN_H
|
|
|
|
#include <netinet/in.h>
|
|
|
|
#endif
|
|
|
|
|
2007-08-02 21:45:27 +00:00
|
|
|
#ifdef HAVE_NETDB_H
|
|
|
|
#include <netdb.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifdef HAVE_ARPA_INET_H
|
|
|
|
#include <arpa/inet.h>
|
|
|
|
#endif
|
|
|
|
|
2007-06-11 18:26:09 +00:00
|
|
|
#ifdef HAVE_SYS_SOCKET_H
|
|
|
|
#include <sys/socket.h> /* needed to define AF_ values on UNIX */
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifdef HAVE_WINSOCK2_H
|
|
|
|
#include <winsock2.h> /* needed to define AF_ values on Windows */
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifdef NEED_INET_V6DEFS_H
|
|
|
|
# include "inet_v6defs.h"
|
2007-06-11 03:58:58 +00:00
|
|
|
#endif
|
|
|
|
|
1999-05-11 18:51:10 +00:00
|
|
|
#include <signal.h>
|
|
|
|
#include <errno.h>
|
1998-09-16 02:39:15 +00:00
|
|
|
|
2004-10-30 23:26:47 +00:00
|
|
|
#include <glib.h>
|
|
|
|
|
2002-01-21 07:37:49 +00:00
|
|
|
#include <epan/packet.h>
|
2003-10-11 21:49:56 +00:00
|
|
|
#include <epan/dfilter/dfilter.h>
|
1998-09-16 02:39:15 +00:00
|
|
|
#include "file.h"
|
|
|
|
#include "capture.h"
|
2004-10-30 11:44:06 +00:00
|
|
|
#include "capture_sync.h"
|
2005-12-04 02:04:18 +00:00
|
|
|
#include "capture_info.h"
|
2005-01-16 02:56:28 +00:00
|
|
|
#include "capture_ui_utils.h"
|
1998-09-16 02:39:15 +00:00
|
|
|
#include "util.h"
|
2005-12-06 00:07:13 +00:00
|
|
|
#include "capture-pcap-util.h"
|
2004-02-11 01:23:25 +00:00
|
|
|
#include "alert_box.h"
|
2000-01-03 06:59:25 +00:00
|
|
|
#include "simple_dialog.h"
|
2004-09-27 22:55:15 +00:00
|
|
|
#include <epan/prefs.h>
|
1998-09-16 02:39:15 +00:00
|
|
|
|
2002-12-31 21:12:55 +00:00
|
|
|
#ifdef _WIN32
|
2001-11-09 07:44:51 +00:00
|
|
|
#include "capture-wpcap.h"
|
|
|
|
#endif
|
2004-01-22 18:13:57 +00:00
|
|
|
#include "ui_util.h"
|
2005-11-06 22:43:25 +00:00
|
|
|
#include "file_util.h"
|
2005-05-26 17:50:27 +00:00
|
|
|
#include "log.h"
|
2001-11-09 07:44:51 +00:00
|
|
|
|
2007-08-02 21:45:27 +00:00
|
|
|
typedef struct if_stat_cache_item_s {
|
|
|
|
char *name;
|
|
|
|
struct pcap_stat ps;
|
|
|
|
} if_stat_cache_item_t;
|
2000-06-15 08:02:43 +00:00
|
|
|
|
2007-08-02 21:45:27 +00:00
|
|
|
struct if_stat_cache_s {
|
|
|
|
int stat_fd;
|
|
|
|
int fork_child;
|
|
|
|
GList *cache_list; /* List of if_stat_chache_entry_t */
|
|
|
|
};
|
2004-02-21 14:04:17 +00:00
|
|
|
|
2007-06-11 03:58:58 +00:00
|
|
|
/**
|
2005-03-28 18:04:09 +00:00
|
|
|
* Start a capture.
|
|
|
|
*
|
|
|
|
* @return TRUE if the capture starts successfully, FALSE otherwise.
|
|
|
|
*/
|
2004-12-29 09:09:35 +00:00
|
|
|
gboolean
|
2005-03-28 18:04:09 +00:00
|
|
|
capture_start(capture_options *capture_opts)
|
2004-12-29 09:09:35 +00:00
|
|
|
{
|
|
|
|
gboolean ret;
|
|
|
|
|
2005-02-27 19:59:03 +00:00
|
|
|
|
|
|
|
/* close the currently loaded capture file */
|
|
|
|
cf_close(capture_opts->cf);
|
|
|
|
|
2005-04-27 19:43:02 +00:00
|
|
|
g_assert(capture_opts->state == CAPTURE_STOPPED);
|
|
|
|
capture_opts->state = CAPTURE_PREPARING;
|
|
|
|
|
2005-05-26 17:50:27 +00:00
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Capture Start ...");
|
|
|
|
|
2005-03-28 14:39:31 +00:00
|
|
|
/* try to start the capture child process */
|
2005-04-30 15:39:40 +00:00
|
|
|
ret = sync_pipe_start(capture_opts);
|
2005-04-11 18:57:19 +00:00
|
|
|
if(!ret) {
|
2005-03-28 14:39:31 +00:00
|
|
|
if(capture_opts->save_file != NULL) {
|
|
|
|
g_free(capture_opts->save_file);
|
|
|
|
capture_opts->save_file = NULL;
|
|
|
|
}
|
2005-04-27 19:43:02 +00:00
|
|
|
|
2006-02-17 22:36:59 +00:00
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Capture Start failed!");
|
2005-04-27 19:43:02 +00:00
|
|
|
capture_opts->state = CAPTURE_STOPPED;
|
2005-05-25 23:28:59 +00:00
|
|
|
} else {
|
|
|
|
/* the capture child might not respond shortly after bringing it up */
|
|
|
|
/* (especially it will block, if no input coming from an input capture pipe (e.g. mkfifo) is coming in) */
|
|
|
|
|
|
|
|
/* to prevent problems, bring the main GUI into "capture mode" right after successfully */
|
|
|
|
/* spawn/exec the capture child, without waiting for any response from it */
|
|
|
|
cf_callback_invoke(cf_cb_live_capture_prepared, capture_opts);
|
2005-12-04 02:04:18 +00:00
|
|
|
|
|
|
|
if(capture_opts->show_info)
|
|
|
|
capture_info_open(capture_opts->iface);
|
2004-02-21 12:58:42 +00:00
|
|
|
}
|
2004-06-20 13:39:44 +00:00
|
|
|
|
|
|
|
return ret;
|
2004-02-21 12:58:42 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2005-04-11 18:57:19 +00:00
|
|
|
void
|
|
|
|
capture_stop(capture_options *capture_opts)
|
|
|
|
{
|
2005-05-26 17:50:27 +00:00
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Capture Stop ...");
|
|
|
|
|
2005-09-20 08:42:35 +00:00
|
|
|
cf_callback_invoke(cf_cb_live_capture_stopping, capture_opts);
|
|
|
|
|
2005-04-11 18:57:19 +00:00
|
|
|
/* stop the capture child gracefully */
|
|
|
|
sync_pipe_stop(capture_opts);
|
|
|
|
}
|
|
|
|
|
2005-04-12 21:44:55 +00:00
|
|
|
|
|
|
|
void
|
2005-04-16 20:08:00 +00:00
|
|
|
capture_restart(capture_options *capture_opts)
|
2005-04-12 21:44:55 +00:00
|
|
|
{
|
2005-05-26 17:50:27 +00:00
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Capture Restart");
|
|
|
|
|
2005-04-12 21:44:55 +00:00
|
|
|
capture_opts->restart = TRUE;
|
|
|
|
capture_stop(capture_opts);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2005-04-11 18:57:19 +00:00
|
|
|
void
|
|
|
|
capture_kill_child(capture_options *capture_opts)
|
|
|
|
{
|
2005-05-26 21:45:58 +00:00
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_INFO, "Capture Kill");
|
2005-05-26 17:50:27 +00:00
|
|
|
|
2005-04-11 18:57:19 +00:00
|
|
|
/* kill the capture child */
|
2007-06-11 03:58:58 +00:00
|
|
|
sync_pipe_kill(capture_opts->fork_child);
|
2005-04-11 18:57:19 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
2005-03-28 18:04:09 +00:00
|
|
|
/* We've succeeded a (non real-time) capture, try to read it into a new capture file */
|
2005-03-28 14:39:31 +00:00
|
|
|
static gboolean
|
|
|
|
capture_input_read_all(capture_options *capture_opts, gboolean is_tempfile, gboolean drops_known,
|
2005-02-28 22:46:49 +00:00
|
|
|
guint32 drops)
|
2004-02-21 12:58:42 +00:00
|
|
|
{
|
2005-04-10 08:55:56 +00:00
|
|
|
int err;
|
2004-02-21 12:58:42 +00:00
|
|
|
|
2005-02-27 19:59:03 +00:00
|
|
|
|
2005-04-10 08:55:56 +00:00
|
|
|
/* Capture succeeded; attempt to open the capture file. */
|
|
|
|
if (cf_open(capture_opts->cf, capture_opts->save_file, is_tempfile, &err) != CF_OK) {
|
|
|
|
/* We're not doing a capture any more, so we don't have a save
|
|
|
|
file. */
|
|
|
|
return FALSE;
|
|
|
|
}
|
2004-02-21 12:58:42 +00:00
|
|
|
|
2005-04-10 08:55:56 +00:00
|
|
|
/* Set the read filter to NULL. */
|
|
|
|
/* XXX - this is odd here, try to put it somewhere, where it fits better */
|
|
|
|
cf_set_rfcode(capture_opts->cf, NULL);
|
|
|
|
|
|
|
|
/* Get the packet-drop statistics.
|
|
|
|
|
|
|
|
XXX - there are currently no packet-drop statistics stored
|
|
|
|
in libpcap captures, and that's what we're reading.
|
|
|
|
|
|
|
|
At some point, we will add support in Wiretap to return
|
|
|
|
packet-drop statistics for capture file formats that store it,
|
|
|
|
and will make "cf_read()" get those statistics from Wiretap.
|
|
|
|
We clear the statistics (marking them as "not known") in
|
|
|
|
"cf_open()", and "cf_read()" will only fetch them and mark
|
|
|
|
them as known if Wiretap supplies them, so if we get the
|
|
|
|
statistics now, after calling "cf_open()" but before calling
|
|
|
|
"cf_read()", the values we store will be used by "cf_read()".
|
|
|
|
|
|
|
|
If a future libpcap capture file format stores the statistics,
|
|
|
|
we'll put them into the capture file that we write, and will
|
|
|
|
thus not have to set them here - "cf_read()" will get them from
|
|
|
|
the file and use them. */
|
|
|
|
if (drops_known) {
|
|
|
|
cf_set_drops_known(capture_opts->cf, TRUE);
|
|
|
|
|
|
|
|
/* XXX - on some systems, libpcap doesn't bother filling in
|
|
|
|
"ps_ifdrop" - it doesn't even set it to zero - so we don't
|
|
|
|
bother looking at it.
|
|
|
|
|
|
|
|
Ideally, libpcap would have an interface that gave us
|
|
|
|
several statistics - perhaps including various interface
|
|
|
|
error statistics - and would tell us which of them it
|
|
|
|
supplies, allowing us to display only the ones it does. */
|
|
|
|
cf_set_drops(capture_opts->cf, drops);
|
|
|
|
}
|
2004-02-21 12:58:42 +00:00
|
|
|
|
2005-04-10 08:55:56 +00:00
|
|
|
/* read in the packet data */
|
|
|
|
switch (cf_read(capture_opts->cf)) {
|
|
|
|
|
|
|
|
case CF_READ_OK:
|
|
|
|
case CF_READ_ERROR:
|
|
|
|
/* Just because we got an error, that doesn't mean we were unable
|
|
|
|
to read any of the file; we handle what we could get from the
|
|
|
|
file. */
|
|
|
|
break;
|
|
|
|
|
|
|
|
case CF_READ_ABORTED:
|
2007-06-11 03:58:58 +00:00
|
|
|
/* User wants to quit program. Exit by leaving the main loop,
|
2005-04-10 08:55:56 +00:00
|
|
|
so that any quit functions we registered get called. */
|
|
|
|
main_window_nested_quit();
|
|
|
|
return FALSE;
|
|
|
|
}
|
2004-02-21 12:58:42 +00:00
|
|
|
|
2005-04-10 08:55:56 +00:00
|
|
|
/* if we didn't captured even a single packet, close the file again */
|
2006-01-22 16:26:41 +00:00
|
|
|
if(cf_get_packet_count(capture_opts->cf) == 0 && !capture_opts->restart) {
|
2007-06-11 03:58:58 +00:00
|
|
|
simple_dialog(ESD_TYPE_INFO, ESD_BTN_OK,
|
2005-11-25 22:27:27 +00:00
|
|
|
"%sNo packets captured!%s\n"
|
|
|
|
"\n"
|
|
|
|
"As no data was captured, closing the %scapture file!\n"
|
|
|
|
"\n"
|
|
|
|
"\n"
|
|
|
|
"Help about capturing can be found at:\n"
|
|
|
|
"\n"
|
2006-05-28 20:28:20 +00:00
|
|
|
" http://wiki.wireshark.org/CaptureSetup"
|
2005-11-25 22:27:27 +00:00
|
|
|
#ifdef _WIN32
|
|
|
|
"\n\n"
|
|
|
|
"Wireless (Wi-Fi/WLAN):\n"
|
|
|
|
"Try to switch off promiscuous mode in the Capture Options!"
|
|
|
|
#endif
|
|
|
|
"",
|
2005-04-10 08:55:56 +00:00
|
|
|
simple_dialog_primary_start(), simple_dialog_primary_end(),
|
|
|
|
(cf_is_tempfile(capture_opts->cf)) ? "temporary " : "");
|
|
|
|
cf_close(capture_opts->cf);
|
|
|
|
}
|
2004-02-21 12:58:42 +00:00
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
Enough is enough. Requiring anybody who uses Ethereal on Linux to
update their libpcap probably isn't going to scale - the increasing
frequency with which "Ethereal hangs when I try to capture packets"
shows up on "ethereal-dev" suggests that, unless and until a libpcap
with the "select()" in it becomes ubiquitous on Linux, that'll be the
source of a constant support burden - so we'll just put the "select()"
in Ethereal if it's being built for Linux.
(Putting it in for platforms where the read timeout argument to
"pcap_open_live()" works adds an extra useless system call at best and,
at worst, could make Ethereal not work - "select()" doesn't work on
"/dev/bpf" devices on FreeBSD 3.3, at least, unless you're in "immediate
mode", and, whilst "immediate mode" would make Ethereal respond more
quickly when packets arrive, it might cause Ethereal to respond too
quickly, doing reads for every new packet rather than waiting for
multiple packets to arrive and reading them all with one "read()", which
appears to be at least part of the intent of the read timeout on
"/dev/bpf" devices in BSD.)
svn path=/trunk/; revision=1451
2000-01-12 06:56:32 +00:00
|
|
|
|
2006-03-05 03:14:16 +00:00
|
|
|
/* capture child tells us we have a new (or the first) capture file */
|
2005-03-28 14:39:31 +00:00
|
|
|
gboolean
|
|
|
|
capture_input_new_file(capture_options *capture_opts, gchar *new_file)
|
2005-02-27 19:59:03 +00:00
|
|
|
{
|
2005-03-28 14:39:31 +00:00
|
|
|
gboolean is_tempfile;
|
|
|
|
int err;
|
2005-02-27 19:59:03 +00:00
|
|
|
|
|
|
|
|
2005-05-26 17:50:27 +00:00
|
|
|
if(capture_opts->state == CAPTURE_PREPARING) {
|
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Capture started!");
|
|
|
|
}
|
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "File: \"%s\"", new_file);
|
|
|
|
|
2005-04-27 19:43:02 +00:00
|
|
|
g_assert(capture_opts->state == CAPTURE_PREPARING || capture_opts->state == CAPTURE_RUNNING);
|
2005-03-28 14:39:31 +00:00
|
|
|
|
2005-04-10 08:55:56 +00:00
|
|
|
/* free the old filename */
|
|
|
|
if(capture_opts->save_file != NULL) {
|
2005-04-11 18:57:19 +00:00
|
|
|
/* we start a new capture file, close the old one (if we had one before) */
|
2005-12-03 18:15:02 +00:00
|
|
|
/* (we can only have an open capture file in real_time_mode!) */
|
2005-04-11 18:57:19 +00:00
|
|
|
if( ((capture_file *) capture_opts->cf)->state != FILE_CLOSED) {
|
|
|
|
cf_callback_invoke(cf_cb_live_capture_update_finished, capture_opts->cf);
|
|
|
|
cf_finish_tail(capture_opts->cf, &err);
|
|
|
|
cf_close(capture_opts->cf);
|
|
|
|
}
|
2005-04-10 08:55:56 +00:00
|
|
|
g_free(capture_opts->save_file);
|
|
|
|
is_tempfile = FALSE;
|
2005-04-11 18:57:19 +00:00
|
|
|
cf_set_tempfile(capture_opts->cf, FALSE);
|
2005-04-10 08:55:56 +00:00
|
|
|
} else {
|
|
|
|
/* we didn't had a save_file before, must be a tempfile */
|
|
|
|
is_tempfile = TRUE;
|
|
|
|
cf_set_tempfile(capture_opts->cf, TRUE);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* save the new filename */
|
|
|
|
capture_opts->save_file = g_strdup(new_file);
|
2005-03-28 18:04:09 +00:00
|
|
|
|
2005-04-10 08:55:56 +00:00
|
|
|
/* if we are in real-time mode, open the new file now */
|
|
|
|
if(capture_opts->real_time_mode) {
|
|
|
|
/* Attempt to open the capture file and set up to read from it. */
|
2006-03-01 01:46:52 +00:00
|
|
|
switch(cf_start_tail(capture_opts->cf, capture_opts->save_file, is_tempfile, &err)) {
|
2005-04-10 08:55:56 +00:00
|
|
|
case CF_OK:
|
|
|
|
break;
|
|
|
|
case CF_ERROR:
|
2007-06-11 03:58:58 +00:00
|
|
|
/* Don't unlink (delete) the save file - leave it around,
|
2005-04-10 08:55:56 +00:00
|
|
|
for debugging purposes. */
|
|
|
|
g_free(capture_opts->save_file);
|
|
|
|
capture_opts->save_file = NULL;
|
|
|
|
return FALSE;
|
2005-02-27 19:59:03 +00:00
|
|
|
}
|
2006-03-01 01:46:52 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if(capture_opts->show_info) {
|
|
|
|
if (!capture_info_new_file(new_file))
|
|
|
|
return FALSE;
|
|
|
|
}
|
2005-04-10 19:36:56 +00:00
|
|
|
|
2006-03-01 01:46:52 +00:00
|
|
|
if(capture_opts->real_time_mode) {
|
2005-04-10 21:03:31 +00:00
|
|
|
cf_callback_invoke(cf_cb_live_capture_update_started, capture_opts);
|
2005-04-10 19:36:56 +00:00
|
|
|
} else {
|
2005-04-10 21:03:31 +00:00
|
|
|
cf_callback_invoke(cf_cb_live_capture_fixed_started, capture_opts);
|
2005-04-10 08:55:56 +00:00
|
|
|
}
|
2005-04-27 19:43:02 +00:00
|
|
|
capture_opts->state = CAPTURE_RUNNING;
|
2005-03-28 21:35:21 +00:00
|
|
|
|
2005-04-10 08:55:56 +00:00
|
|
|
return TRUE;
|
2005-03-28 14:39:31 +00:00
|
|
|
}
|
|
|
|
|
2007-06-11 03:58:58 +00:00
|
|
|
|
2006-03-05 03:14:16 +00:00
|
|
|
/* capture child tells us we have new packets to read */
|
2005-03-28 14:39:31 +00:00
|
|
|
void
|
|
|
|
capture_input_new_packets(capture_options *capture_opts, int to_read)
|
|
|
|
{
|
|
|
|
int err;
|
|
|
|
|
|
|
|
|
2005-04-16 20:08:00 +00:00
|
|
|
g_assert(capture_opts->save_file);
|
|
|
|
|
2005-03-28 16:14:34 +00:00
|
|
|
if(capture_opts->real_time_mode) {
|
2005-12-03 18:15:02 +00:00
|
|
|
/* Read from the capture file the number of records the child told us it added. */
|
2005-04-10 08:55:56 +00:00
|
|
|
switch (cf_continue_tail(capture_opts->cf, to_read, &err)) {
|
|
|
|
|
|
|
|
case CF_READ_OK:
|
|
|
|
case CF_READ_ERROR:
|
|
|
|
/* Just because we got an error, that doesn't mean we were unable
|
|
|
|
to read any of the file; we handle what we could get from the
|
|
|
|
file.
|
|
|
|
|
|
|
|
XXX - abort on a read error? */
|
2005-04-18 22:05:56 +00:00
|
|
|
cf_callback_invoke(cf_cb_live_capture_update_continue, capture_opts->cf);
|
2005-04-10 08:55:56 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
case CF_READ_ABORTED:
|
|
|
|
/* Kill the child capture process; the user wants to exit, and we
|
|
|
|
shouldn't just leave it running. */
|
|
|
|
capture_kill_child(capture_opts);
|
|
|
|
break;
|
|
|
|
}
|
2006-01-22 16:26:41 +00:00
|
|
|
} else {
|
|
|
|
/* increase capture file packet counter by the number or incoming packets */
|
2007-06-11 03:58:58 +00:00
|
|
|
cf_set_packet_count(capture_opts->cf,
|
2006-01-22 16:26:41 +00:00
|
|
|
cf_get_packet_count(capture_opts->cf) + to_read);
|
|
|
|
|
|
|
|
cf_callback_invoke(cf_cb_live_capture_fixed_continue, capture_opts->cf);
|
2005-03-28 14:39:31 +00:00
|
|
|
}
|
2005-12-04 02:04:18 +00:00
|
|
|
|
2006-01-22 16:26:41 +00:00
|
|
|
/* update the main window, so we get events (e.g. from the stop toolbar button) */
|
|
|
|
main_window_update();
|
|
|
|
|
2005-12-04 02:04:18 +00:00
|
|
|
if(capture_opts->show_info)
|
|
|
|
capture_info_new_packets(to_read);
|
2005-03-28 14:39:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2006-03-05 03:14:16 +00:00
|
|
|
/* Capture child told us how many dropped packets it counted.
|
2005-12-03 18:15:02 +00:00
|
|
|
*/
|
|
|
|
void
|
|
|
|
capture_input_drops(capture_options *capture_opts, int dropped)
|
|
|
|
{
|
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_INFO, "%d packet%s dropped", dropped, plurality(dropped, "", "s"));
|
|
|
|
|
|
|
|
g_assert(capture_opts->state == CAPTURE_RUNNING);
|
|
|
|
|
|
|
|
cf_set_drops_known(capture_opts->cf, TRUE);
|
|
|
|
cf_set_drops(capture_opts->cf, dropped);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2006-03-05 03:14:16 +00:00
|
|
|
/* Capture child told us that an error has occurred while starting/running
|
|
|
|
the capture.
|
|
|
|
The buffer we're handed has *two* null-terminated strings in it - a
|
|
|
|
primary message and a secondary message, one right after the other.
|
|
|
|
The secondary message might be a null string.
|
|
|
|
*/
|
2005-12-03 18:15:02 +00:00
|
|
|
void
|
2006-03-13 00:30:51 +00:00
|
|
|
capture_input_error_message(capture_options *capture_opts, char *error_msg, char *secondary_error_msg)
|
2005-12-03 18:15:02 +00:00
|
|
|
{
|
2006-03-05 03:14:16 +00:00
|
|
|
gchar *safe_error_msg;
|
|
|
|
gchar *safe_secondary_error_msg;
|
|
|
|
|
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Error message from child: \"%s\", \"%s\"",
|
|
|
|
error_msg, secondary_error_msg);
|
2005-12-03 18:15:02 +00:00
|
|
|
|
2005-12-06 19:41:45 +00:00
|
|
|
g_assert(capture_opts->state == CAPTURE_PREPARING || capture_opts->state == CAPTURE_RUNNING);
|
2005-12-03 18:15:02 +00:00
|
|
|
|
2006-03-05 03:14:16 +00:00
|
|
|
safe_error_msg = simple_dialog_format_message(error_msg);
|
|
|
|
if (*secondary_error_msg != '\0') {
|
|
|
|
/* We have both primary and secondary messages. */
|
|
|
|
safe_secondary_error_msg = simple_dialog_format_message(secondary_error_msg);
|
|
|
|
simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK, "%s%s%s\n\n%s",
|
|
|
|
simple_dialog_primary_start(), safe_error_msg,
|
|
|
|
simple_dialog_primary_end(), safe_secondary_error_msg);
|
|
|
|
g_free(safe_secondary_error_msg);
|
|
|
|
} else {
|
|
|
|
/* We have only a primary message. */
|
|
|
|
simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK, "%s%s%s",
|
|
|
|
simple_dialog_primary_start(), safe_error_msg,
|
|
|
|
simple_dialog_primary_end());
|
|
|
|
}
|
|
|
|
g_free(safe_error_msg);
|
|
|
|
|
|
|
|
/* the capture child will close the sync_pipe if required, nothing to do for now */
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* Capture child told us that an error has occurred while parsing a
|
|
|
|
capture filter when starting/running the capture.
|
|
|
|
*/
|
|
|
|
void
|
|
|
|
capture_input_cfilter_error_message(capture_options *capture_opts, char *error_message)
|
|
|
|
{
|
|
|
|
dfilter_t *rfcode = NULL;
|
|
|
|
gchar *safe_cfilter = simple_dialog_format_message(capture_opts->cfilter);
|
|
|
|
gchar *safe_cfilter_error_msg = simple_dialog_format_message(error_message);
|
|
|
|
|
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Capture filter error message from child: \"%s\"", error_message);
|
|
|
|
|
|
|
|
g_assert(capture_opts->state == CAPTURE_PREPARING || capture_opts->state == CAPTURE_RUNNING);
|
|
|
|
|
|
|
|
/* Did the user try a display filter? */
|
|
|
|
if (dfilter_compile(capture_opts->cfilter, &rfcode) && rfcode != NULL) {
|
|
|
|
simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK,
|
|
|
|
"%sInvalid capture filter: \"%s\"!%s\n"
|
|
|
|
"\n"
|
|
|
|
"That string looks like a valid display filter; however, it isn't a valid\n"
|
|
|
|
"capture filter (%s).\n"
|
|
|
|
"\n"
|
|
|
|
"Note that display filters and capture filters don't have the same syntax,\n"
|
|
|
|
"so you can't use most display filter expressions as capture filters.\n"
|
|
|
|
"\n"
|
|
|
|
"See the User's Guide for a description of the capture filter syntax.",
|
|
|
|
simple_dialog_primary_start(), safe_cfilter,
|
|
|
|
simple_dialog_primary_end(), safe_cfilter_error_msg);
|
|
|
|
dfilter_free(rfcode);
|
|
|
|
} else {
|
|
|
|
simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK,
|
|
|
|
"%sInvalid capture filter: \"%s\"!%s\n"
|
|
|
|
"\n"
|
|
|
|
"That string isn't a valid capture filter (%s).\n"
|
|
|
|
"See the User's Guide for a description of the capture filter syntax.",
|
|
|
|
simple_dialog_primary_start(), safe_cfilter,
|
|
|
|
simple_dialog_primary_end(), safe_cfilter_error_msg);
|
|
|
|
}
|
|
|
|
g_free(safe_cfilter_error_msg);
|
|
|
|
g_free(safe_cfilter);
|
2005-12-03 18:15:02 +00:00
|
|
|
|
2005-12-06 19:41:45 +00:00
|
|
|
/* the capture child will close the sync_pipe if required, nothing to do for now */
|
2005-12-03 18:15:02 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2006-03-05 03:14:16 +00:00
|
|
|
/* capture child closed its side of the pipe, do the required cleanup */
|
2005-03-28 14:39:31 +00:00
|
|
|
void
|
|
|
|
capture_input_closed(capture_options *capture_opts)
|
|
|
|
{
|
|
|
|
int err;
|
2007-05-17 01:41:47 +00:00
|
|
|
int packet_count_save;
|
2005-03-28 14:39:31 +00:00
|
|
|
|
2005-05-26 17:50:27 +00:00
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Capture stopped!");
|
2005-04-27 19:43:02 +00:00
|
|
|
g_assert(capture_opts->state == CAPTURE_PREPARING || capture_opts->state == CAPTURE_RUNNING);
|
|
|
|
|
2005-12-03 21:12:59 +00:00
|
|
|
/* if we didn't started the capture, do a fake start */
|
|
|
|
/* (happens if we got an error message - we won't get a filename then) */
|
2005-04-27 19:43:02 +00:00
|
|
|
if(capture_opts->state == CAPTURE_PREPARING) {
|
2005-04-16 20:08:00 +00:00
|
|
|
if(capture_opts->real_time_mode) {
|
|
|
|
cf_callback_invoke(cf_cb_live_capture_update_started, capture_opts);
|
|
|
|
} else {
|
|
|
|
cf_callback_invoke(cf_cb_live_capture_fixed_started, capture_opts);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2005-03-28 16:14:34 +00:00
|
|
|
if(capture_opts->real_time_mode) {
|
2007-05-17 01:41:47 +00:00
|
|
|
cf_read_status_t status;
|
2005-10-07 03:24:14 +00:00
|
|
|
|
|
|
|
/* Read what remains of the capture file. */
|
|
|
|
status = cf_finish_tail(capture_opts->cf, &err);
|
|
|
|
|
2007-05-17 01:41:47 +00:00
|
|
|
/* XXX: If -Q (quit-after-cap) then cf->count clr'd below so save it first */
|
|
|
|
packet_count_save = cf_get_packet_count(capture_opts->cf);
|
2005-10-07 03:24:14 +00:00
|
|
|
/* Tell the GUI, we are not doing a capture any more.
|
2007-06-11 03:58:58 +00:00
|
|
|
Must be done after the cf_finish_tail(), so file lengths are displayed
|
2005-10-07 03:24:14 +00:00
|
|
|
correct. */
|
2005-04-10 19:36:56 +00:00
|
|
|
cf_callback_invoke(cf_cb_live_capture_update_finished, capture_opts->cf);
|
|
|
|
|
2005-10-07 03:24:14 +00:00
|
|
|
/* Finish the capture. */
|
|
|
|
switch (status) {
|
2005-03-28 14:39:31 +00:00
|
|
|
|
|
|
|
case CF_READ_OK:
|
2007-05-17 01:41:47 +00:00
|
|
|
if ((packet_count_save == 0) && !capture_opts->restart) {
|
2007-06-11 03:58:58 +00:00
|
|
|
simple_dialog(ESD_TYPE_INFO, ESD_BTN_OK,
|
2005-11-25 22:27:27 +00:00
|
|
|
"%sNo packets captured!%s\n"
|
|
|
|
"\n"
|
|
|
|
"As no data was captured, closing the %scapture file!\n"
|
|
|
|
"\n"
|
|
|
|
"\n"
|
|
|
|
"Help about capturing can be found at:\n"
|
|
|
|
"\n"
|
2006-05-28 20:28:20 +00:00
|
|
|
" http://wiki.wireshark.org/CaptureSetup"
|
2005-11-25 22:27:27 +00:00
|
|
|
#ifdef _WIN32
|
|
|
|
"\n\n"
|
|
|
|
"Wireless (Wi-Fi/WLAN):\n"
|
|
|
|
"Try to switch off promiscuous mode in the Capture Options!"
|
|
|
|
#endif
|
|
|
|
"",
|
2005-03-28 14:39:31 +00:00
|
|
|
simple_dialog_primary_start(), simple_dialog_primary_end(),
|
|
|
|
cf_is_tempfile(capture_opts->cf) ? "temporary " : "");
|
|
|
|
cf_close(capture_opts->cf);
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case CF_READ_ERROR:
|
|
|
|
/* Just because we got an error, that doesn't mean we were unable
|
|
|
|
to read any of the file; we handle what we could get from the
|
|
|
|
file. */
|
|
|
|
break;
|
|
|
|
|
|
|
|
case CF_READ_ABORTED:
|
|
|
|
/* Exit by leaving the main loop, so that any quit functions
|
|
|
|
we registered get called. */
|
|
|
|
main_window_quit();
|
|
|
|
}
|
2005-03-28 21:05:53 +00:00
|
|
|
|
2005-03-28 14:39:31 +00:00
|
|
|
} else {
|
2005-04-10 19:36:56 +00:00
|
|
|
/* first of all, we are not doing a capture any more */
|
|
|
|
cf_callback_invoke(cf_cb_live_capture_fixed_finished, capture_opts->cf);
|
|
|
|
|
2005-04-16 19:31:06 +00:00
|
|
|
/* this is a normal mode capture and if no error happened, read in the capture file data */
|
|
|
|
if(capture_opts->save_file != NULL) {
|
2007-06-11 03:58:58 +00:00
|
|
|
capture_input_read_all(capture_opts, cf_is_tempfile(capture_opts->cf),
|
2005-04-16 19:31:06 +00:00
|
|
|
cf_get_drops_known(capture_opts->cf), cf_get_drops(capture_opts->cf));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2005-12-04 02:04:18 +00:00
|
|
|
if(capture_opts->show_info)
|
|
|
|
capture_info_close();
|
|
|
|
|
2005-04-27 19:43:02 +00:00
|
|
|
capture_opts->state = CAPTURE_STOPPED;
|
|
|
|
|
2005-04-16 19:31:06 +00:00
|
|
|
/* if we couldn't open a capture file, there's nothing more for us to do */
|
|
|
|
if(capture_opts->save_file == NULL) {
|
2005-04-16 20:08:00 +00:00
|
|
|
cf_close(capture_opts->cf);
|
2005-04-16 19:31:06 +00:00
|
|
|
return;
|
2005-04-10 17:36:36 +00:00
|
|
|
}
|
|
|
|
|
2005-04-12 21:44:55 +00:00
|
|
|
/* does the user wants to restart the current capture? */
|
|
|
|
if(capture_opts->restart) {
|
|
|
|
capture_opts->restart = FALSE;
|
|
|
|
|
2005-11-06 22:43:25 +00:00
|
|
|
eth_unlink(capture_opts->save_file);
|
2005-04-12 21:44:55 +00:00
|
|
|
|
|
|
|
/* if it was a tempfile, throw away the old filename (so it will become a tempfile again) */
|
|
|
|
if(cf_is_tempfile(capture_opts->cf)) {
|
|
|
|
g_free(capture_opts->save_file);
|
|
|
|
capture_opts->save_file = NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* ... and start the capture again */
|
|
|
|
capture_start(capture_opts);
|
|
|
|
} else {
|
|
|
|
/* We're not doing a capture any more, so we don't have a save file. */
|
2005-04-12 00:54:52 +00:00
|
|
|
g_free(capture_opts->save_file);
|
|
|
|
capture_opts->save_file = NULL;
|
|
|
|
}
|
2005-02-27 19:59:03 +00:00
|
|
|
}
|
|
|
|
|
2007-06-11 03:58:58 +00:00
|
|
|
/**
|
|
|
|
* Fetch the interface list from a child process (dumpcap).
|
|
|
|
*
|
|
|
|
* @return A GList containing if_info_t structs if successful, NULL otherwise.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/* XXX - We parse simple text output to get our interface list. Should
|
|
|
|
* we use "real" data serialization instead, e.g. via XML? */
|
|
|
|
GList *
|
|
|
|
capture_interface_list(int *err, char **err_str)
|
|
|
|
{
|
|
|
|
GList *if_list = NULL;
|
|
|
|
int i, j;
|
|
|
|
gchar *msg;
|
|
|
|
gchar **raw_list, **if_parts, **addr_parts;
|
|
|
|
gchar *name;
|
|
|
|
if_info_t *if_info;
|
|
|
|
if_addr_t *if_addr;
|
|
|
|
|
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Capture Interface List ...");
|
|
|
|
|
|
|
|
/* Try to get our interface list */
|
|
|
|
*err = sync_interface_list_open(&msg);
|
2007-06-11 06:40:56 +00:00
|
|
|
if (*err != 0) {
|
2007-06-11 03:58:58 +00:00
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Capture Interface List failed!");
|
2007-06-11 06:40:56 +00:00
|
|
|
if (err_str) {
|
|
|
|
if (*err_str)
|
|
|
|
*err_str = msg;
|
|
|
|
else
|
|
|
|
g_free(msg);
|
|
|
|
} else {
|
2007-06-11 03:58:58 +00:00
|
|
|
g_free(msg);
|
2007-06-11 06:40:56 +00:00
|
|
|
}
|
2007-06-11 03:58:58 +00:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Split our lines */
|
|
|
|
raw_list = g_strsplit(msg, "\n", 0);
|
|
|
|
g_free(msg);
|
|
|
|
|
|
|
|
for (i = 0; raw_list[i] != NULL; i++) {
|
|
|
|
if_parts = g_strsplit(raw_list[i], "\t", 4);
|
|
|
|
if (if_parts[0] == NULL || if_parts[1] == NULL || if_parts[2] == NULL ||
|
|
|
|
if_parts[3] == NULL) {
|
|
|
|
g_strfreev(if_parts);
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Number followed by the name, e.g "1. eth0" */
|
|
|
|
name = strchr(if_parts[0], ' ');
|
|
|
|
if (name) {
|
|
|
|
name++;
|
|
|
|
} else {
|
|
|
|
g_strfreev(if_parts);
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
if_info = g_malloc0(sizeof(if_info_t));
|
|
|
|
if_info->name = g_strdup(name);
|
|
|
|
if (strlen(if_parts[1]) > 0)
|
|
|
|
if_info->description = g_strdup(if_parts[1]);
|
|
|
|
addr_parts = g_strsplit(if_parts[2], ",", 0);
|
|
|
|
for (j = 0; addr_parts[j] != NULL; j++) {
|
2007-06-11 18:26:09 +00:00
|
|
|
if_addr = g_malloc0(sizeof(if_addr_t));
|
|
|
|
if (inet_pton(AF_INET, addr_parts[j], &if_addr->ip_addr.ip4_addr)) {
|
|
|
|
if_addr->type = AT_IPv4;
|
|
|
|
} else if (inet_pton(AF_INET6, addr_parts[j],
|
|
|
|
&if_addr->ip_addr.ip6_addr)) {
|
|
|
|
if_addr->type = AT_IPv6;
|
|
|
|
} else {
|
|
|
|
g_free(if_addr);
|
2007-06-11 03:58:58 +00:00
|
|
|
if_addr = NULL;
|
2007-06-11 18:26:09 +00:00
|
|
|
}
|
|
|
|
if (if_addr) {
|
|
|
|
if_info->ip_addr = g_slist_append(if_info->ip_addr, if_addr);
|
2007-06-11 03:58:58 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
if (strcmp(if_parts[3], "loopback") == 0)
|
|
|
|
if_info->loopback = TRUE;
|
|
|
|
g_strfreev(if_parts);
|
|
|
|
g_strfreev(addr_parts);
|
|
|
|
if_list = g_list_append(if_list, if_info);
|
|
|
|
}
|
|
|
|
g_strfreev(raw_list);
|
|
|
|
|
|
|
|
/* Check to see if we built a list */
|
|
|
|
if (if_list == NULL) {
|
2007-08-02 21:45:27 +00:00
|
|
|
if (err_str && *err_str)
|
2007-06-11 03:58:58 +00:00
|
|
|
*err_str = g_strdup("No interfaces found");
|
|
|
|
*err = NO_INTERFACES_FOUND;
|
|
|
|
}
|
|
|
|
return if_list;
|
|
|
|
}
|
|
|
|
|
2007-07-20 21:43:07 +00:00
|
|
|
/* XXX - We parse simple text output to get our interface list. Should
|
|
|
|
* we use "real" data serialization instead, e.g. via XML? */
|
|
|
|
GList *
|
2008-02-21 12:30:26 +00:00
|
|
|
capture_pcap_linktype_list(const gchar *ifname, char **err_str)
|
2007-07-20 21:43:07 +00:00
|
|
|
{
|
|
|
|
GList *linktype_list = NULL;
|
|
|
|
int err, i;
|
|
|
|
gchar *msg;
|
|
|
|
gchar **raw_list, **lt_parts;
|
|
|
|
data_link_info_t *data_link_info;
|
|
|
|
|
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Capture Interface List ...");
|
|
|
|
|
|
|
|
/* Try to get our interface list */
|
|
|
|
err = sync_linktype_list_open(ifname, &msg);
|
|
|
|
if (err != 0) {
|
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Capture Interface List failed!");
|
|
|
|
if (err_str) {
|
|
|
|
*err_str = msg;
|
|
|
|
} else {
|
|
|
|
g_free(msg);
|
|
|
|
}
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Split our lines */
|
|
|
|
raw_list = g_strsplit(msg, "\n", 0);
|
|
|
|
g_free(msg);
|
|
|
|
|
|
|
|
for (i = 0; raw_list[i] != NULL; i++) {
|
|
|
|
/* ...and what if the interface name has a tab in it, Mr. Clever Programmer? */
|
|
|
|
lt_parts = g_strsplit(raw_list[i], "\t", 3);
|
|
|
|
if (lt_parts[0] == NULL || lt_parts[1] == NULL || lt_parts[2] == NULL) {
|
|
|
|
g_strfreev(lt_parts);
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
data_link_info = g_malloc(sizeof (data_link_info_t));
|
|
|
|
data_link_info->dlt = (int) strtol(lt_parts[0], NULL, 10);
|
|
|
|
data_link_info->name = g_strdup(lt_parts[1]);
|
2007-08-02 21:45:27 +00:00
|
|
|
if (strcmp(lt_parts[2], "(not supported)") != 0)
|
2007-07-20 21:43:07 +00:00
|
|
|
data_link_info->description = g_strdup(lt_parts[2]);
|
|
|
|
else
|
|
|
|
data_link_info->description = NULL;
|
|
|
|
|
|
|
|
linktype_list = g_list_append(linktype_list, data_link_info);
|
|
|
|
}
|
|
|
|
g_strfreev(raw_list);
|
|
|
|
|
|
|
|
/* Check to see if we built a list */
|
|
|
|
if (linktype_list == NULL) {
|
|
|
|
if (err_str)
|
|
|
|
*err_str = NULL;
|
|
|
|
}
|
|
|
|
return linktype_list;
|
|
|
|
}
|
|
|
|
|
2007-08-02 21:45:27 +00:00
|
|
|
if_stat_cache_t *
|
|
|
|
capture_stat_start(GList *if_list) {
|
|
|
|
int stat_fd, fork_child;
|
|
|
|
gchar *msg;
|
|
|
|
if_stat_cache_t *sc = NULL;
|
|
|
|
GList *if_entry;
|
|
|
|
if_info_t *if_info;
|
|
|
|
if_stat_cache_item_t *sc_item;
|
|
|
|
|
|
|
|
/* Fire up dumpcap. */
|
|
|
|
/*
|
|
|
|
* XXX - on systems with BPF, the number of BPF devices limits the
|
|
|
|
* number of devices on which you can capture simultaneously.
|
|
|
|
*
|
|
|
|
* This means that
|
|
|
|
*
|
|
|
|
* 1) this might fail if you run out of BPF devices
|
|
|
|
*
|
|
|
|
* and
|
|
|
|
*
|
|
|
|
* 2) opening every interface could leave too few BPF devices
|
|
|
|
* for *other* programs.
|
|
|
|
*
|
|
|
|
* It also means the system could end up getting a lot of traffic
|
|
|
|
* that it has to pass through the networking stack and capture
|
|
|
|
* mechanism, so opening all the devices and presenting packet
|
|
|
|
* counts might not always be a good idea.
|
|
|
|
*/
|
|
|
|
if (sync_interface_stats_open(&stat_fd, &fork_child, &msg) == 0) {
|
|
|
|
sc = g_malloc(sizeof(if_stat_cache_t));
|
|
|
|
sc->stat_fd = stat_fd;
|
|
|
|
sc->fork_child = fork_child;
|
|
|
|
sc->cache_list = NULL;
|
|
|
|
|
|
|
|
/* Initialize the cache */
|
|
|
|
for (if_entry = if_list; if_entry != NULL; if_entry = g_list_next(if_entry)) {
|
|
|
|
if_info = if_entry->data;
|
|
|
|
sc_item = g_malloc0(sizeof(if_stat_cache_item_t));
|
|
|
|
sc_item->name = g_strdup(if_info->name);
|
|
|
|
sc->cache_list = g_list_append(sc->cache_list, sc_item);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return sc;
|
|
|
|
}
|
|
|
|
|
|
|
|
#define MAX_STAT_LINE_LEN 500
|
|
|
|
|
|
|
|
static void
|
|
|
|
capture_stat_cache_update(if_stat_cache_t *sc) {
|
|
|
|
gchar stat_line[MAX_STAT_LINE_LEN];
|
|
|
|
gchar **stat_parts;
|
|
|
|
GList *sc_entry;
|
|
|
|
if_stat_cache_item_t *sc_item;
|
|
|
|
|
|
|
|
if (!sc)
|
|
|
|
return;
|
|
|
|
|
|
|
|
while (sync_pipe_gets_nonblock(sc->stat_fd, stat_line, MAX_STAT_LINE_LEN) > 0) {
|
|
|
|
g_strstrip(stat_line);
|
|
|
|
stat_parts = g_strsplit(stat_line, "\t", 3);
|
|
|
|
if (stat_parts[0] == NULL || stat_parts[1] == NULL ||
|
|
|
|
stat_parts[2] == NULL) {
|
|
|
|
g_strfreev(stat_parts);
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
for (sc_entry = sc->cache_list; sc_entry != NULL; sc_entry = g_list_next(sc_entry)) {
|
|
|
|
sc_item = sc_entry->data;
|
|
|
|
if (strcmp(sc_item->name, stat_parts[0]) == 0) {
|
|
|
|
sc_item->ps.ps_recv = (u_int) strtoul(stat_parts[1], NULL, 10);
|
|
|
|
sc_item->ps.ps_drop = (u_int) strtoul(stat_parts[2], NULL, 10);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
g_strfreev(stat_parts);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
gboolean
|
|
|
|
capture_stats(if_stat_cache_t *sc, char *ifname, struct pcap_stat *ps) {
|
|
|
|
GList *sc_entry;
|
|
|
|
if_stat_cache_item_t *sc_item;
|
|
|
|
|
|
|
|
if (!sc || !ifname || !ps) {
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
|
|
|
capture_stat_cache_update(sc);
|
|
|
|
for (sc_entry = sc->cache_list; sc_entry != NULL; sc_entry = g_list_next(sc_entry)) {
|
|
|
|
sc_item = sc_entry->data;
|
|
|
|
if (strcmp(sc_item->name, ifname) == 0) {
|
|
|
|
memcpy(ps, &sc_item->ps, sizeof(struct pcap_stat));
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
capture_stat_stop(if_stat_cache_t *sc) {
|
|
|
|
GList *sc_entry;
|
|
|
|
if_stat_cache_item_t *sc_item;
|
|
|
|
gchar *msg;
|
|
|
|
|
|
|
|
if (!sc)
|
|
|
|
return;
|
|
|
|
|
|
|
|
sync_interface_stats_close(&sc->stat_fd, &sc->fork_child, &msg);
|
|
|
|
|
|
|
|
for (sc_entry = sc->cache_list; sc_entry != NULL; sc_entry = g_list_next(sc_entry)) {
|
|
|
|
sc_item = sc_entry->data;
|
|
|
|
g_free(sc_item->name);
|
|
|
|
g_free(sc_item);
|
|
|
|
}
|
|
|
|
g_free(sc);
|
|
|
|
}
|
2005-02-27 19:59:03 +00:00
|
|
|
|
1999-07-09 04:18:36 +00:00
|
|
|
#endif /* HAVE_LIBPCAP */
|