Commit Graph

160 Commits

Author SHA1 Message Date
Sake Blok f17c5ac01f As mentioned on the users-mailinglist[1], it could be useful to have groups read access to the ringbuffer that dumpcap creates. That way, a group of people can access the capture files without having to use root access.
[1]  http://www.wireshark.org/lists/wireshark-users/201008/msg00235.html

svn path=/trunk/; revision=33978
2010-08-28 11:05:51 +00:00
Sake Blok 42a0f16cef We change the owner and group of the first file, so we also want to change owner and group of the rest of the files in the ringbuffer.
svn path=/trunk/; revision=33977
2010-08-28 09:44:18 +00:00
Gerald Combs 5aae07254f Forward-port r33953.
Move the SetDllDirectory calls to ws_init_dll_search_path. If
SetDllDirectory fails, pass the Wireshark program path to
SetCurrentDirectory.

svn path=/trunk/; revision=33958
2010-08-27 19:24:44 +00:00
Gerald Combs b73454e8bd Fix !Windows compilation.
svn path=/trunk/; revision=33917
2010-08-25 00:20:50 +00:00
Gerald Combs ad4ffa5d49 Partial fix for bug 5133. On Windows, call SetDllDirectory at startup if
it's present in Wireshark and dumpcap. This takes care of the airpcap.dll
PoC but we need to load wpcap.dll from a full path. We might want to
call SetDllDirectory from our other executables as well.

svn path=/trunk/; revision=33916
2010-08-24 23:39:29 +00:00
Jörg Mayer 3a8eea122f Add #ifdef HAVE_BPF_IMAGE
around
show_filter_code(capture_options *capture_opts)

To fix a warning about an unused function.


svn path=/trunk/; revision=33519
2010-07-14 13:22:34 +00:00
Guy Harris 6582e265a8 Fix warnings.
svn path=/trunk/; revision=33517
2010-07-14 08:56:35 +00:00
Guy Harris 61ffcf2618 Fix build errors.
svn path=/trunk/; revision=33515
2010-07-14 08:27:26 +00:00
Guy Harris 6a8c39c59f Define print_caps() before we use it.
svn path=/trunk/; revision=33514
2010-07-14 04:31:52 +00:00
Guy Harris b277e17e7b Ensure, at compile time, that the error-message-buffer argument to
open_captur_device() is an array of PCAP_ERRBUF_SIZE chars.  That means
we don't need to pass the size.

Unfortunately, pcap_compile() didn't always take a "const char *" as the
filter string argument, even though it didn't modify the argument; don't
pass it a "const char *".

Don't print the secondary error message if it's empty.

svn path=/trunk/; revision=33513
2010-07-14 04:30:37 +00:00
Guy Harris 31c8eaf95e Define relinquish_all_capabilities() before we use it.
If we get an "XXX is not one of the DLTs supported by this device" error
when we try to set the link-layer header type, don't tell the user to
report it to the Wireshark developers, as that's probably just the
result of them giving a link-layer header type that the device doesn't
support.

svn path=/trunk/; revision=33512
2010-07-14 02:14:54 +00:00
Guy Harris c85fa2cd46 We must also set the link-layer header type before compiling the capture
filter, as that affects the generated code.

svn path=/trunk/; revision=33510
2010-07-14 00:50:25 +00:00
Guy Harris 4d6cb744df Add a "-d" flag to dumpcap, to print out the generated code for the
capture filter in human-readable form.  (Well, readable by humans who
know BPF machine language, at least. :-))

svn path=/trunk/; revision=33509
2010-07-13 23:26:07 +00:00
Jeff Morriss 47e2d75820 Move some code (including the optional objects) into libwsutil
svn path=/trunk/; revision=33012
2010-05-28 20:19:55 +00:00
Guy Harris 80fda10f18 Make -q not a capture option again - it's used by tshark even when not
capturing, and thus even when we build without pcap.

svn path=/trunk/; revision=32988
2010-05-27 01:13:49 +00:00
Guy Harris b0bfae2a85 Don't send ^T output to the standard error if we're a capture child.
Make SIGINFO a restart-the-system-call signal, so reads etc. don't
return an error.

svn path=/trunk/; revision=32968
2010-05-26 04:29:36 +00:00
Guy Harris 7a630c61a1 Add a -q flag to dumpcap, to squelch its reporting of the packet count,
and add support for SIGINFO, so, if your OS supports SIGINFO, you can
get the packet count by typing ^T.

svn path=/trunk/; revision=32958
2010-05-26 00:19:27 +00:00
Guy Harris 71de391514 Pull the big pile of code that handles the
capture-stopping/file-switching operation into a routine.  Move a few
variables into the loop_data structure so that routine can get at them.

svn path=/trunk/; revision=32949
2010-05-25 20:14:22 +00:00
Guy Harris 72ed0558f2 Don't have -M affect -v yet; if we end up, for example, having dumpcap
being the only program that needs to be linked with *pcap, that's when
we'd want to fetch that information, but there might be other libraries
(e.g., the POSIX capabilities library) that it might be linked with but
that programs that use it aren't linked with.

Don't commit to the output formats of -M, as they are, as noted, subject
to change from release to release.

svn path=/trunk/; revision=32904
2010-05-19 23:27:35 +00:00
Guy Harris c1e651802e -S doesn't require an interface, either.
svn path=/trunk/; revision=32883
2010-05-19 02:55:05 +00:00
Guy Harris ccac912244 Regularize indentation a bit.
Let pcap_statustostr()'s result suffice for most PCAP_ERROR_ errors. 
Don't mention the capture device name multiple times in the error
message.  Treat positive returns from pcap_can_set_rfmon() other than 0
or 1 as weird returns, not error returns.

svn path=/trunk/; revision=32882
2010-05-19 02:47:16 +00:00
Guy Harris ece9788353 Squelch an unused-variable warning.
svn path=/trunk/; revision=32856
2010-05-18 03:35:20 +00:00
Guy Harris 0910d319cd Move some routines around, fix and shuffle comments.
svn path=/trunk/; revision=32854
2010-05-18 02:48:51 +00:00
Guy Harris 1bf60839c9 Move get_pcap_linktype() into dumpcap - it's not used elsewhere.
svn path=/trunk/; revision=32853
2010-05-18 02:36:02 +00:00
Guy Harris c58680fd40 Only negative return values from pcap_activate() are errors; positive
return values are success-with-a-warning.

Report those errors with a string.

svn path=/trunk/; revision=32852
2010-05-18 01:48:46 +00:00
Guy Harris e3038273ca Don't write the SP_SUCCESS messages unless -Z was specified.
Add support for a machine-readable "-v" output, which prints only the
pcap version string.

Give a little more information about the machine-readable format, but
note that it's primarily intended for consumption by Wireshark and
TShark and is subject to change.

Properly hyphenate "pcap-ng".

svn path=/trunk/; revision=32851
2010-05-18 00:20:30 +00:00
Guy Harris 14c40a21aa Make -Z always generate machine-readable output, and don't bother
supplying -M along with -Z.  (We keep -M around for debugging use; it's
documented, unlike -Z.)

svn path=/trunk/; revision=32850
2010-05-17 23:56:00 +00:00
Guy Harris 859c6e4d3e If dumpcap is run with -D, don't select a default interface; it's not
necessary.

If it's run with -D and -M, and we found no interfaces, don't treat that
as an error; let the code that reads our output just indicate it as "no
interfaces available", so *its* caller can decide whether to report an
error or not (in some cases in Wireshark, it's obvious that there are no
interfaces, e.g. there aren't any listed on the welcome screen, so
popping up a dialog is pointless).

svn path=/trunk/; revision=32849
2010-05-17 23:13:24 +00:00
Guy Harris 991c5e9898 When dumpcap is run to get an interface list, interface capabilities, or
interface statistics, have its error messages come out as sync-pipe
errors, have it send a sync-pipe "success" message on success, and have
the callers get that message and display it.

svn path=/trunk/; revision=32843
2010-05-17 18:40:23 +00:00
Guy Harris 9307251bb8 Um, no, the problem with the Leopard x86 build is that we first do a
build without libpcap, to make sure that works, and then do a build with
libpcap, to put into a binary release.  It's the former that's failing;
I'll back out the previous change and then work on that.

svn path=/trunk/; revision=32801
2010-05-14 00:49:28 +00:00
Guy Harris 0e54136213 See whether the Leopard x86 buildbot is upset because of the name
if_capabilities_t - it doesn't fail on Snow Leopard, even if I undefine
HAVE_PCAP_CREATE, and doesn't fail on the Leopard PPC buildbot, either.

svn path=/trunk/; revision=32799
2010-05-14 00:10:15 +00:00
Guy Harris 1c18115bd3 Fetch an indication of whether the interface supports capturing in
monitor mode at the same time that we fetch its list of link-layer
types.  Support fetching that list in monitor mode, as the list may be
different in regular and monitor mode.  If the interface supports
monitor mode, when printing the list of link-layer types, indicate
whether they're fetched in monitor mode or not, as tcpdump 4.1.x does.

svn path=/trunk/; revision=32789
2010-05-13 17:37:39 +00:00
Guy Harris 5be9fa156f If we have pcap_open(), and we're *not* opening an rpcap URL, open the
device, don't just execute whatever comes after the open code as an else
clause.

svn path=/trunk/; revision=32761
2010-05-11 20:19:35 +00:00
Guy Harris 55dc4be5ba Include inet_v6defs.h after include the Windows socket headers, so it
knows whether AF_INET6 is needed.

svn path=/trunk/; revision=32722
2010-05-08 01:37:36 +00:00
Guy Harris 3debd13524 Include inet_v6defs.h if needed to declare inet_ntop().
svn path=/trunk/; revision=32720
2010-05-08 01:15:56 +00:00
Guy Harris 547b9e48a2 The default capture buffer size is, in fact, *nominally* 1MB; however,
libpcap/WinPcap and the capture mechanism atop which they run might
either silently limit the buffer size to a smaller value or raise it to
a higher value - that's the part that's platform-dependent.

svn path=/trunk/; revision=32718
2010-05-08 00:39:07 +00:00
Guy Harris 077ff72ac1 As with the list of data link types, so with the list of interfaces; move
the code to print the machine-readable format into dumpcap, and have the
code in capture_opts.c just print the human-readable format.

svn path=/trunk/; revision=32714
2010-05-07 19:24:32 +00:00
Guy Harris 13bf4a0c55 Add routines vfprintf_stderr() and fprintf_stderr() to print to the
standard error and, in Wireshark on Windows, create a console if
necessary.  Have the cmdarg_err routines use them.

Use *fprintf_stderr() to print the output of -L, rather than using
cmdarg_err_cont(), so that we don't get extra newlines in the output (it
should look similar to the output of tcpdump).

svn path=/trunk/; revision=32711
2010-05-07 08:40:02 +00:00
Guy Harris cc05b9250d For TShark and Wireshark, get the list of link-layer types for an
interface by running dumpcap, so that if you need privileges to open an
interface, and dumpcap has those privileges, neither TShark nor
Wireshark need them.

svn path=/trunk/; revision=32710
2010-05-07 08:06:25 +00:00
Guy Harris 4cd5e44340 Oops, -B disappeared from the list of dumpcap options in the change to
support multiple, err, optional options.

svn path=/trunk/; revision=32705
2010-05-07 01:50:22 +00:00
Guy Harris 20cbf81d39 Beginnings of monitor mode support with libpcap 1.x.
svn path=/trunk/; revision=32702
2010-05-07 01:22:33 +00:00
Guy Harris 4c5b8c5277 Instead, say that the default is platform-dependent.
svn path=/trunk/; revision=32701
2010-05-07 00:28:42 +00:00
Guy Harris 96f67d9517 Now that we support -B on various UN*X platforms as well as Windows, we
can no longer state what the default is (it's platform-dependent).

svn path=/trunk/; revision=32700
2010-05-07 00:16:52 +00:00
Guy Harris 7dbbb8c572 Just check for pcap_create(); it first appeared in libpcap 1.0.0, and
pcap_set_buffer_size() did as well, so there aren't any libpcap releases
with pcap_create() but not pcap_set_buffer_size().

Only do one check for pcap_create.

svn path=/trunk/; revision=32695
2010-05-06 23:33:41 +00:00
Gerald Combs 6ee96dc4a4 Fix compilation.
svn path=/trunk/; revision=32694
2010-05-06 23:29:55 +00:00
Anders Broman f9981411f1 Checking in Stigs changes from
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=475
BUT not activating the check for 
pcap_create()
pcap_set_buffer_size()
This should make it possible to build with support for setting the buffersize if not capturing 802.11 traffic.

The code for handling the 'B' option should be OK in any case.

svn path=/trunk/; revision=32688
2010-05-06 18:34:30 +00:00
Gerald Combs f2a66480df Revert r31529. Timing out while waiting for the pcap file header causes
more problems than it solves.

svn path=/trunk/; revision=32544
2010-04-23 17:22:51 +00:00
Guy Harris 7b41a72801 Expand the comment explaining the workaround for the Snow Leopard
timeout bug.

Make the code for the workaround assume any 10.6.x release other than
10.6.2 requires it; that way we don't have to update the code until
either

	1) Apple fixes the bug in a later 10.6.x update

or

	2) Apple comes out with a major release that still has, or
	   reintroduces, the bug.

svn path=/trunk/; revision=32349
2010-04-01 00:27:25 +00:00
Michael Tüxen d87005b114 Enable pcap timeout workaround for Mac OS X 10.6.3, since the bug seems to be
back.

svn path=/trunk/; revision=32348
2010-03-31 23:37:42 +00:00
Guy Harris 2b321eaf56 From Hilko Bengen: support capturing from UNIX-domain sockets.
Update a comment.

svn path=/trunk/; revision=32177
2010-03-13 00:29:30 +00:00