1998-09-16 02:39:15 +00:00
|
|
|
/* capture.c
|
2005-03-28 18:04:09 +00:00
|
|
|
* Routines for packet capture
|
1998-09-16 02:39:15 +00:00
|
|
|
*
|
2006-05-21 05:12:17 +00:00
|
|
|
* Wireshark - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@wireshark.org>
|
1998-09-16 02:39:15 +00:00
|
|
|
* Copyright 1998 Gerald Combs
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
2012-06-28 22:56:06 +00:00
|
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
1998-09-16 02:39:15 +00:00
|
|
|
*/
|
|
|
|
|
2012-09-20 01:29:52 +00:00
|
|
|
#include "config.h"
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1999-07-09 04:18:36 +00:00
|
|
|
#ifdef HAVE_LIBPCAP
|
|
|
|
|
2009-08-26 19:27:49 +00:00
|
|
|
#include <stdio.h>
|
2013-12-03 22:16:49 +00:00
|
|
|
#include <stdlib.h>
|
1998-09-16 02:39:15 +00:00
|
|
|
#include <string.h>
|
|
|
|
|
2004-10-30 23:26:47 +00:00
|
|
|
#include <glib.h>
|
|
|
|
|
2002-01-21 07:37:49 +00:00
|
|
|
#include <epan/packet.h>
|
2003-10-11 21:49:56 +00:00
|
|
|
#include <epan/dfilter/dfilter.h>
|
1998-09-16 02:39:15 +00:00
|
|
|
#include "file.h"
|
2014-06-30 05:38:29 +00:00
|
|
|
#include "ui/capture.h"
|
2014-07-04 07:24:02 +00:00
|
|
|
#include "caputils/capture_ifinfo.h"
|
2014-06-24 00:27:28 +00:00
|
|
|
#include <capchild/capture_sync.h>
|
2005-12-04 02:04:18 +00:00
|
|
|
#include "capture_info.h"
|
2014-06-30 01:36:22 +00:00
|
|
|
#include "ui/capture_ui_utils.h"
|
2012-02-17 12:30:27 +00:00
|
|
|
#include "ui/util.h"
|
2014-07-04 07:24:02 +00:00
|
|
|
#include "caputils/capture-pcap-util.h"
|
2004-09-27 22:55:15 +00:00
|
|
|
#include <epan/prefs.h>
|
1998-09-16 02:39:15 +00:00
|
|
|
|
2002-12-31 21:12:55 +00:00
|
|
|
#ifdef _WIN32
|
2014-07-04 07:24:02 +00:00
|
|
|
#include "caputils/capture-wpcap.h"
|
2001-11-09 07:44:51 +00:00
|
|
|
#endif
|
2012-01-16 01:07:52 +00:00
|
|
|
|
|
|
|
#include "ui/simple_dialog.h"
|
|
|
|
#include "ui/ui_util.h"
|
|
|
|
|
2008-05-22 15:46:27 +00:00
|
|
|
#include "wsutil/file_util.h"
|
2015-11-04 08:45:54 +00:00
|
|
|
#include "wsutil/str_util.h"
|
2005-05-26 17:50:27 +00:00
|
|
|
#include "log.h"
|
2001-11-09 07:44:51 +00:00
|
|
|
|
2007-08-02 21:45:27 +00:00
|
|
|
typedef struct if_stat_cache_item_s {
|
|
|
|
char *name;
|
|
|
|
struct pcap_stat ps;
|
|
|
|
} if_stat_cache_item_t;
|
2000-06-15 08:02:43 +00:00
|
|
|
|
2007-08-02 21:45:27 +00:00
|
|
|
struct if_stat_cache_s {
|
|
|
|
int stat_fd;
|
2015-06-10 00:30:15 +00:00
|
|
|
ws_process_id fork_child;
|
2007-08-02 21:45:27 +00:00
|
|
|
GList *cache_list; /* List of if_stat_chache_entry_t */
|
|
|
|
};
|
2004-02-21 14:04:17 +00:00
|
|
|
|
2008-06-24 08:05:45 +00:00
|
|
|
/* this callback mechanism should possibly be replaced by the g_signal_...() stuff (if I only would know how :-) */
|
|
|
|
typedef struct {
|
|
|
|
capture_callback_t cb_fct;
|
|
|
|
gpointer user_data;
|
|
|
|
} capture_callback_data_t;
|
|
|
|
|
|
|
|
static GList *capture_callbacks = NULL;
|
|
|
|
|
|
|
|
static void
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_callback_invoke(int event, capture_session *cap_session)
|
2008-06-24 08:05:45 +00:00
|
|
|
{
|
2012-01-25 13:04:32 +00:00
|
|
|
capture_callback_data_t *cb;
|
|
|
|
GList *cb_item = capture_callbacks;
|
2008-06-24 08:05:45 +00:00
|
|
|
|
2012-01-25 13:04:32 +00:00
|
|
|
/* there should be at least one interested */
|
|
|
|
g_assert(cb_item != NULL);
|
2008-06-24 08:05:45 +00:00
|
|
|
|
2012-01-25 13:04:32 +00:00
|
|
|
while(cb_item != NULL) {
|
2013-03-07 18:25:25 +00:00
|
|
|
cb = (capture_callback_data_t *)cb_item->data;
|
2013-05-22 07:44:28 +00:00
|
|
|
cb->cb_fct(event, cap_session, cb->user_data);
|
2012-01-25 13:04:32 +00:00
|
|
|
cb_item = g_list_next(cb_item);
|
|
|
|
}
|
2008-06-24 08:05:45 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void
|
|
|
|
capture_callback_add(capture_callback_t func, gpointer user_data)
|
|
|
|
{
|
2012-01-25 13:04:32 +00:00
|
|
|
capture_callback_data_t *cb;
|
2008-06-24 08:05:45 +00:00
|
|
|
|
2013-03-07 18:25:25 +00:00
|
|
|
cb = (capture_callback_data_t *)g_malloc(sizeof(capture_callback_data_t));
|
2012-01-25 13:04:32 +00:00
|
|
|
cb->cb_fct = func;
|
|
|
|
cb->user_data = user_data;
|
2008-06-24 08:05:45 +00:00
|
|
|
|
2012-01-25 13:04:32 +00:00
|
|
|
capture_callbacks = g_list_append(capture_callbacks, cb);
|
2008-06-24 08:05:45 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2014-09-09 20:42:58 +00:00
|
|
|
capture_callback_remove(capture_callback_t func, gpointer user_data)
|
2008-06-24 08:05:45 +00:00
|
|
|
{
|
2012-01-25 13:04:32 +00:00
|
|
|
capture_callback_data_t *cb;
|
|
|
|
GList *cb_item = capture_callbacks;
|
|
|
|
|
|
|
|
while(cb_item != NULL) {
|
2013-03-07 18:25:25 +00:00
|
|
|
cb = (capture_callback_data_t *)cb_item->data;
|
2014-09-09 20:42:58 +00:00
|
|
|
if(cb->cb_fct == func && cb->user_data == user_data) {
|
2012-01-25 13:04:32 +00:00
|
|
|
capture_callbacks = g_list_remove(capture_callbacks, cb);
|
|
|
|
g_free(cb);
|
|
|
|
return;
|
2008-06-24 08:05:45 +00:00
|
|
|
}
|
2012-01-25 13:04:32 +00:00
|
|
|
cb_item = g_list_next(cb_item);
|
|
|
|
}
|
2008-06-24 08:05:45 +00:00
|
|
|
|
2012-01-25 13:04:32 +00:00
|
|
|
g_assert_not_reached();
|
2008-06-24 08:05:45 +00:00
|
|
|
}
|
|
|
|
|
2007-06-11 03:58:58 +00:00
|
|
|
/**
|
2005-03-28 18:04:09 +00:00
|
|
|
* Start a capture.
|
|
|
|
*
|
|
|
|
* @return TRUE if the capture starts successfully, FALSE otherwise.
|
|
|
|
*/
|
2004-12-29 09:09:35 +00:00
|
|
|
gboolean
|
2013-06-27 17:10:50 +00:00
|
|
|
capture_start(capture_options *capture_opts, capture_session *cap_session, void(*update_cb)(void))
|
2004-12-29 09:09:35 +00:00
|
|
|
{
|
|
|
|
gboolean ret;
|
2015-04-05 23:42:35 +00:00
|
|
|
GString *source;
|
2005-02-27 19:59:03 +00:00
|
|
|
|
2013-05-22 07:44:28 +00:00
|
|
|
cap_session->state = CAPTURE_PREPARING;
|
2015-04-06 21:06:17 +00:00
|
|
|
cap_session->count = 0;
|
2005-05-26 17:50:27 +00:00
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Capture Start ...");
|
2015-04-05 23:42:35 +00:00
|
|
|
source = get_iface_list_string(capture_opts, IFLIST_SHOW_FILTER);
|
2013-05-22 07:44:28 +00:00
|
|
|
cf_set_tempfile_source((capture_file *)cap_session->cf, source->str);
|
2010-04-01 21:55:01 +00:00
|
|
|
g_string_free(source, TRUE);
|
2005-03-28 14:39:31 +00:00
|
|
|
/* try to start the capture child process */
|
2013-06-27 17:10:50 +00:00
|
|
|
ret = sync_pipe_start(capture_opts, cap_session, update_cb);
|
2005-04-11 18:57:19 +00:00
|
|
|
if(!ret) {
|
2005-03-28 14:39:31 +00:00
|
|
|
if(capture_opts->save_file != NULL) {
|
|
|
|
g_free(capture_opts->save_file);
|
|
|
|
capture_opts->save_file = NULL;
|
|
|
|
}
|
2005-04-27 19:43:02 +00:00
|
|
|
|
2014-09-24 21:06:23 +00:00
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Capture Start failed.");
|
2013-05-22 07:44:28 +00:00
|
|
|
cap_session->state = CAPTURE_STOPPED;
|
2005-05-25 23:28:59 +00:00
|
|
|
} else {
|
|
|
|
/* the capture child might not respond shortly after bringing it up */
|
2009-01-04 14:21:54 +00:00
|
|
|
/* (for example: it will block if no input arrives from an input capture pipe (e.g. mkfifo)) */
|
2005-05-25 23:28:59 +00:00
|
|
|
|
2009-01-04 14:21:54 +00:00
|
|
|
/* to prevent problems, bring the main GUI into "capture mode" right after a successful */
|
|
|
|
/* spawn/exec of the capture child, without waiting for any response from it */
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_callback_invoke(capture_cb_capture_prepared, cap_session);
|
2005-12-04 02:04:18 +00:00
|
|
|
|
|
|
|
if(capture_opts->show_info)
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_info_open(cap_session);
|
2004-02-21 12:58:42 +00:00
|
|
|
}
|
2004-06-20 13:39:44 +00:00
|
|
|
|
|
|
|
return ret;
|
2004-02-21 12:58:42 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2005-04-11 18:57:19 +00:00
|
|
|
void
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_stop(capture_session *cap_session)
|
2005-04-11 18:57:19 +00:00
|
|
|
{
|
2005-05-26 17:50:27 +00:00
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Capture Stop ...");
|
|
|
|
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_callback_invoke(capture_cb_capture_stopping, cap_session);
|
2005-09-20 08:42:35 +00:00
|
|
|
|
2005-04-11 18:57:19 +00:00
|
|
|
/* stop the capture child gracefully */
|
2013-05-22 07:44:28 +00:00
|
|
|
sync_pipe_stop(cap_session);
|
2005-04-11 18:57:19 +00:00
|
|
|
}
|
|
|
|
|
2005-04-12 21:44:55 +00:00
|
|
|
|
|
|
|
void
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_restart(capture_session *cap_session)
|
2005-04-12 21:44:55 +00:00
|
|
|
{
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_options *capture_opts = cap_session->capture_opts;
|
|
|
|
|
2005-05-26 17:50:27 +00:00
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Capture Restart");
|
|
|
|
|
2005-04-12 21:44:55 +00:00
|
|
|
capture_opts->restart = TRUE;
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_stop(cap_session);
|
2005-04-12 21:44:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2005-04-11 18:57:19 +00:00
|
|
|
void
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_kill_child(capture_session *cap_session)
|
2005-04-11 18:57:19 +00:00
|
|
|
{
|
2005-05-26 21:45:58 +00:00
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_INFO, "Capture Kill");
|
2005-05-26 17:50:27 +00:00
|
|
|
|
2005-04-11 18:57:19 +00:00
|
|
|
/* kill the capture child */
|
2013-05-22 07:44:28 +00:00
|
|
|
sync_pipe_kill(cap_session->fork_child);
|
2005-04-11 18:57:19 +00:00
|
|
|
}
|
|
|
|
|
2009-01-04 14:21:54 +00:00
|
|
|
/* We've succeeded in doing a (non real-time) capture; try to read it into a new capture file */
|
2005-03-28 14:39:31 +00:00
|
|
|
static gboolean
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_input_read_all(capture_session *cap_session, gboolean is_tempfile,
|
|
|
|
gboolean drops_known, guint32 drops)
|
2004-02-21 12:58:42 +00:00
|
|
|
{
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_options *capture_opts = cap_session->capture_opts;
|
2005-04-10 08:55:56 +00:00
|
|
|
int err;
|
2004-02-21 12:58:42 +00:00
|
|
|
|
2005-04-10 08:55:56 +00:00
|
|
|
/* Capture succeeded; attempt to open the capture file. */
|
2014-01-18 14:20:02 +00:00
|
|
|
if (cf_open((capture_file *)cap_session->cf, capture_opts->save_file, WTAP_TYPE_AUTO, is_tempfile, &err) != CF_OK) {
|
2009-01-04 14:21:54 +00:00
|
|
|
/* We're not doing a capture any more, so we don't have a save file. */
|
2005-04-10 08:55:56 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
2012-05-16 16:29:12 +00:00
|
|
|
|
2005-04-10 08:55:56 +00:00
|
|
|
/* Set the read filter to NULL. */
|
2009-01-04 14:21:54 +00:00
|
|
|
/* XXX - this is odd here; try to put it somewhere where it fits better */
|
2013-05-22 07:44:28 +00:00
|
|
|
cf_set_rfcode((capture_file *)cap_session->cf, NULL);
|
2005-04-10 08:55:56 +00:00
|
|
|
|
|
|
|
/* Get the packet-drop statistics.
|
|
|
|
|
|
|
|
XXX - there are currently no packet-drop statistics stored
|
|
|
|
in libpcap captures, and that's what we're reading.
|
|
|
|
|
|
|
|
At some point, we will add support in Wiretap to return
|
|
|
|
packet-drop statistics for capture file formats that store it,
|
|
|
|
and will make "cf_read()" get those statistics from Wiretap.
|
|
|
|
We clear the statistics (marking them as "not known") in
|
|
|
|
"cf_open()", and "cf_read()" will only fetch them and mark
|
|
|
|
them as known if Wiretap supplies them, so if we get the
|
|
|
|
statistics now, after calling "cf_open()" but before calling
|
|
|
|
"cf_read()", the values we store will be used by "cf_read()".
|
|
|
|
|
|
|
|
If a future libpcap capture file format stores the statistics,
|
|
|
|
we'll put them into the capture file that we write, and will
|
|
|
|
thus not have to set them here - "cf_read()" will get them from
|
|
|
|
the file and use them. */
|
|
|
|
if (drops_known) {
|
2013-05-22 07:44:28 +00:00
|
|
|
cf_set_drops_known((capture_file *)cap_session->cf, TRUE);
|
2005-04-10 08:55:56 +00:00
|
|
|
|
|
|
|
/* XXX - on some systems, libpcap doesn't bother filling in
|
|
|
|
"ps_ifdrop" - it doesn't even set it to zero - so we don't
|
|
|
|
bother looking at it.
|
|
|
|
|
|
|
|
Ideally, libpcap would have an interface that gave us
|
|
|
|
several statistics - perhaps including various interface
|
|
|
|
error statistics - and would tell us which of them it
|
|
|
|
supplies, allowing us to display only the ones it does. */
|
2013-05-22 07:44:28 +00:00
|
|
|
cf_set_drops((capture_file *)cap_session->cf, drops);
|
2005-04-10 08:55:56 +00:00
|
|
|
}
|
2004-02-21 12:58:42 +00:00
|
|
|
|
2005-04-10 08:55:56 +00:00
|
|
|
/* read in the packet data */
|
2013-05-22 07:44:28 +00:00
|
|
|
switch (cf_read((capture_file *)cap_session->cf, FALSE)) {
|
2005-04-10 08:55:56 +00:00
|
|
|
|
|
|
|
case CF_READ_OK:
|
|
|
|
case CF_READ_ERROR:
|
|
|
|
/* Just because we got an error, that doesn't mean we were unable
|
|
|
|
to read any of the file; we handle what we could get from the
|
|
|
|
file. */
|
|
|
|
break;
|
|
|
|
|
|
|
|
case CF_READ_ABORTED:
|
2007-06-11 03:58:58 +00:00
|
|
|
/* User wants to quit program. Exit by leaving the main loop,
|
2005-04-10 08:55:56 +00:00
|
|
|
so that any quit functions we registered get called. */
|
|
|
|
main_window_nested_quit();
|
|
|
|
return FALSE;
|
|
|
|
}
|
2004-02-21 12:58:42 +00:00
|
|
|
|
2009-01-04 14:21:54 +00:00
|
|
|
/* if we didn't capture even a single packet, close the file again */
|
2015-04-06 19:14:25 +00:00
|
|
|
if(cap_session->count == 0 && !capture_opts->restart) {
|
2007-06-11 03:58:58 +00:00
|
|
|
simple_dialog(ESD_TYPE_INFO, ESD_BTN_OK,
|
2014-09-24 21:06:23 +00:00
|
|
|
"%sNo packets captured.%s\n"
|
2005-11-25 22:27:27 +00:00
|
|
|
"\n"
|
2014-09-24 21:06:23 +00:00
|
|
|
"As no data was captured, closing the %scapture file.\n"
|
2005-11-25 22:27:27 +00:00
|
|
|
"\n"
|
|
|
|
"\n"
|
2014-09-24 21:06:23 +00:00
|
|
|
"Help about capturing can be found at\n"
|
2005-11-25 22:27:27 +00:00
|
|
|
"\n"
|
2015-03-10 17:46:50 +00:00
|
|
|
" https://wiki.wireshark.org/CaptureSetup"
|
2005-11-25 22:27:27 +00:00
|
|
|
#ifdef _WIN32
|
|
|
|
"\n\n"
|
|
|
|
"Wireless (Wi-Fi/WLAN):\n"
|
2014-09-24 21:06:23 +00:00
|
|
|
"Try to switch off promiscuous mode in the Capture Options"
|
2005-11-25 22:27:27 +00:00
|
|
|
#endif
|
|
|
|
"",
|
2005-04-10 08:55:56 +00:00
|
|
|
simple_dialog_primary_start(), simple_dialog_primary_end(),
|
2013-05-22 07:44:28 +00:00
|
|
|
(cf_is_tempfile((capture_file *)cap_session->cf)) ? "temporary " : "");
|
|
|
|
cf_close((capture_file *)cap_session->cf);
|
2005-04-10 08:55:56 +00:00
|
|
|
}
|
2004-02-21 12:58:42 +00:00
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
Enough is enough. Requiring anybody who uses Ethereal on Linux to
update their libpcap probably isn't going to scale - the increasing
frequency with which "Ethereal hangs when I try to capture packets"
shows up on "ethereal-dev" suggests that, unless and until a libpcap
with the "select()" in it becomes ubiquitous on Linux, that'll be the
source of a constant support burden - so we'll just put the "select()"
in Ethereal if it's being built for Linux.
(Putting it in for platforms where the read timeout argument to
"pcap_open_live()" works adds an extra useless system call at best and,
at worst, could make Ethereal not work - "select()" doesn't work on
"/dev/bpf" devices on FreeBSD 3.3, at least, unless you're in "immediate
mode", and, whilst "immediate mode" would make Ethereal respond more
quickly when packets arrive, it might cause Ethereal to respond too
quickly, doing reads for every new packet rather than waiting for
multiple packets to arrive and reading them all with one "read()", which
appears to be at least part of the intent of the read timeout on
"/dev/bpf" devices in BSD.)
svn path=/trunk/; revision=1451
2000-01-12 06:56:32 +00:00
|
|
|
|
2006-03-05 03:14:16 +00:00
|
|
|
/* capture child tells us we have a new (or the first) capture file */
|
2005-03-28 14:39:31 +00:00
|
|
|
gboolean
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_input_new_file(capture_session *cap_session, gchar *new_file)
|
2005-02-27 19:59:03 +00:00
|
|
|
{
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_options *capture_opts = cap_session->capture_opts;
|
2005-03-28 14:39:31 +00:00
|
|
|
gboolean is_tempfile;
|
|
|
|
int err;
|
2005-02-27 19:59:03 +00:00
|
|
|
|
2013-05-22 07:44:28 +00:00
|
|
|
if(cap_session->state == CAPTURE_PREPARING) {
|
2014-09-24 21:06:23 +00:00
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Capture started");
|
2005-05-26 17:50:27 +00:00
|
|
|
}
|
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "File: \"%s\"", new_file);
|
|
|
|
|
2013-05-22 07:44:28 +00:00
|
|
|
g_assert(cap_session->state == CAPTURE_PREPARING || cap_session->state == CAPTURE_RUNNING);
|
2005-03-28 14:39:31 +00:00
|
|
|
|
2005-04-10 08:55:56 +00:00
|
|
|
/* free the old filename */
|
|
|
|
if(capture_opts->save_file != NULL) {
|
2009-01-04 14:21:54 +00:00
|
|
|
/* we start a new capture file, close the old one (if we had one before). */
|
2005-12-03 18:15:02 +00:00
|
|
|
/* (we can only have an open capture file in real_time_mode!) */
|
2013-05-22 07:44:28 +00:00
|
|
|
if( ((capture_file *) cap_session->cf)->state != FILE_CLOSED) {
|
2012-07-28 11:13:24 +00:00
|
|
|
if(capture_opts->real_time_mode) {
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_callback_invoke(capture_cb_capture_update_finished, cap_session);
|
|
|
|
cf_finish_tail((capture_file *)cap_session->cf, &err);
|
|
|
|
cf_close((capture_file *)cap_session->cf);
|
2012-07-28 11:13:24 +00:00
|
|
|
} else {
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_callback_invoke(capture_cb_capture_fixed_finished, cap_session);
|
2012-07-28 11:13:24 +00:00
|
|
|
}
|
2005-04-11 18:57:19 +00:00
|
|
|
}
|
2005-04-10 08:55:56 +00:00
|
|
|
g_free(capture_opts->save_file);
|
|
|
|
is_tempfile = FALSE;
|
2013-05-22 07:44:28 +00:00
|
|
|
cf_set_tempfile((capture_file *)cap_session->cf, FALSE);
|
2005-04-10 08:55:56 +00:00
|
|
|
} else {
|
2009-01-04 14:21:54 +00:00
|
|
|
/* we didn't have a save_file before; must be a tempfile */
|
2005-04-10 08:55:56 +00:00
|
|
|
is_tempfile = TRUE;
|
2013-05-22 07:44:28 +00:00
|
|
|
cf_set_tempfile((capture_file *)cap_session->cf, TRUE);
|
2005-04-10 08:55:56 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* save the new filename */
|
|
|
|
capture_opts->save_file = g_strdup(new_file);
|
2005-03-28 18:04:09 +00:00
|
|
|
|
2005-04-10 08:55:56 +00:00
|
|
|
/* if we are in real-time mode, open the new file now */
|
|
|
|
if(capture_opts->real_time_mode) {
|
|
|
|
/* Attempt to open the capture file and set up to read from it. */
|
2014-01-18 14:20:02 +00:00
|
|
|
switch(cf_open((capture_file *)cap_session->cf, capture_opts->save_file, WTAP_TYPE_AUTO, is_tempfile, &err)) {
|
2005-04-10 08:55:56 +00:00
|
|
|
case CF_OK:
|
|
|
|
break;
|
|
|
|
case CF_ERROR:
|
2007-06-11 03:58:58 +00:00
|
|
|
/* Don't unlink (delete) the save file - leave it around,
|
2005-04-10 08:55:56 +00:00
|
|
|
for debugging purposes. */
|
|
|
|
g_free(capture_opts->save_file);
|
|
|
|
capture_opts->save_file = NULL;
|
|
|
|
return FALSE;
|
2005-02-27 19:59:03 +00:00
|
|
|
}
|
2012-07-28 11:13:24 +00:00
|
|
|
} else {
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_callback_invoke(capture_cb_capture_prepared, cap_session);
|
2006-03-01 01:46:52 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if(capture_opts->show_info) {
|
|
|
|
if (!capture_info_new_file(new_file))
|
|
|
|
return FALSE;
|
|
|
|
}
|
2005-04-10 19:36:56 +00:00
|
|
|
|
2006-03-01 01:46:52 +00:00
|
|
|
if(capture_opts->real_time_mode) {
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_callback_invoke(capture_cb_capture_update_started, cap_session);
|
2005-04-10 19:36:56 +00:00
|
|
|
} else {
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_callback_invoke(capture_cb_capture_fixed_started, cap_session);
|
2005-04-10 08:55:56 +00:00
|
|
|
}
|
2013-05-22 07:44:28 +00:00
|
|
|
cap_session->state = CAPTURE_RUNNING;
|
2005-03-28 21:35:21 +00:00
|
|
|
|
2005-04-10 08:55:56 +00:00
|
|
|
return TRUE;
|
2005-03-28 14:39:31 +00:00
|
|
|
}
|
|
|
|
|
2007-06-11 03:58:58 +00:00
|
|
|
|
2014-05-23 10:50:02 +00:00
|
|
|
/* capture child tells us we have new packets to read */
|
2005-03-28 14:39:31 +00:00
|
|
|
void
|
2014-05-23 10:50:02 +00:00
|
|
|
capture_input_new_packets(capture_session *cap_session, int to_read)
|
2005-03-28 14:39:31 +00:00
|
|
|
{
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_options *capture_opts = cap_session->capture_opts;
|
2005-03-28 14:39:31 +00:00
|
|
|
int err;
|
|
|
|
|
2005-04-16 20:08:00 +00:00
|
|
|
g_assert(capture_opts->save_file);
|
|
|
|
|
2005-03-28 16:14:34 +00:00
|
|
|
if(capture_opts->real_time_mode) {
|
2005-12-03 18:15:02 +00:00
|
|
|
/* Read from the capture file the number of records the child told us it added. */
|
2013-05-22 07:44:28 +00:00
|
|
|
switch (cf_continue_tail((capture_file *)cap_session->cf, to_read, &err)) {
|
2005-04-10 08:55:56 +00:00
|
|
|
|
|
|
|
case CF_READ_OK:
|
|
|
|
case CF_READ_ERROR:
|
|
|
|
/* Just because we got an error, that doesn't mean we were unable
|
|
|
|
to read any of the file; we handle what we could get from the
|
|
|
|
file.
|
|
|
|
|
|
|
|
XXX - abort on a read error? */
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_callback_invoke(capture_cb_capture_update_continue, cap_session);
|
2005-04-10 08:55:56 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
case CF_READ_ABORTED:
|
|
|
|
/* Kill the child capture process; the user wants to exit, and we
|
|
|
|
shouldn't just leave it running. */
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_kill_child(cap_session);
|
2005-04-10 08:55:56 +00:00
|
|
|
break;
|
|
|
|
}
|
2006-01-22 16:26:41 +00:00
|
|
|
} else {
|
2013-05-22 07:44:28 +00:00
|
|
|
cf_fake_continue_tail((capture_file *)cap_session->cf);
|
2006-01-22 16:26:41 +00:00
|
|
|
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_callback_invoke(capture_cb_capture_fixed_continue, cap_session);
|
2005-03-28 14:39:31 +00:00
|
|
|
}
|
2005-12-04 02:04:18 +00:00
|
|
|
|
2009-01-04 14:21:54 +00:00
|
|
|
/* update the main window so we get events (e.g. from the stop toolbar button) */
|
2012-08-06 18:24:21 +00:00
|
|
|
/* This causes a hang on Windows (see bug 7305). Do we need this on any platform? */
|
|
|
|
#ifndef _WIN32
|
2006-01-22 16:26:41 +00:00
|
|
|
main_window_update();
|
2012-08-06 18:24:21 +00:00
|
|
|
#endif
|
2006-01-22 16:26:41 +00:00
|
|
|
|
2005-12-04 02:04:18 +00:00
|
|
|
if(capture_opts->show_info)
|
2014-05-23 10:50:02 +00:00
|
|
|
capture_info_new_packets(to_read);
|
2005-03-28 14:39:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2006-03-05 03:14:16 +00:00
|
|
|
/* Capture child told us how many dropped packets it counted.
|
2005-12-03 18:15:02 +00:00
|
|
|
*/
|
|
|
|
void
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_input_drops(capture_session *cap_session, guint32 dropped)
|
2005-12-03 18:15:02 +00:00
|
|
|
{
|
2008-08-19 05:10:16 +00:00
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_INFO, "%u packet%s dropped", dropped, plurality(dropped, "", "s"));
|
2005-12-03 18:15:02 +00:00
|
|
|
|
2013-05-22 07:44:28 +00:00
|
|
|
g_assert(cap_session->state == CAPTURE_RUNNING);
|
2005-12-03 18:15:02 +00:00
|
|
|
|
2013-05-22 07:44:28 +00:00
|
|
|
cf_set_drops_known((capture_file *)cap_session->cf, TRUE);
|
|
|
|
cf_set_drops((capture_file *)cap_session->cf, dropped);
|
2005-12-03 18:15:02 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2006-03-05 03:14:16 +00:00
|
|
|
/* Capture child told us that an error has occurred while starting/running
|
|
|
|
the capture.
|
|
|
|
The buffer we're handed has *two* null-terminated strings in it - a
|
|
|
|
primary message and a secondary message, one right after the other.
|
|
|
|
The secondary message might be a null string.
|
|
|
|
*/
|
2005-12-03 18:15:02 +00:00
|
|
|
void
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_input_error_message(capture_session *cap_session, char *error_msg,
|
|
|
|
char *secondary_error_msg)
|
2005-12-03 18:15:02 +00:00
|
|
|
{
|
2006-03-05 03:14:16 +00:00
|
|
|
gchar *safe_error_msg;
|
|
|
|
gchar *safe_secondary_error_msg;
|
|
|
|
|
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Error message from child: \"%s\", \"%s\"",
|
|
|
|
error_msg, secondary_error_msg);
|
2005-12-03 18:15:02 +00:00
|
|
|
|
2013-05-22 07:44:28 +00:00
|
|
|
g_assert(cap_session->state == CAPTURE_PREPARING || cap_session->state == CAPTURE_RUNNING);
|
2005-12-03 18:15:02 +00:00
|
|
|
|
2006-03-05 03:14:16 +00:00
|
|
|
safe_error_msg = simple_dialog_format_message(error_msg);
|
|
|
|
if (*secondary_error_msg != '\0') {
|
|
|
|
/* We have both primary and secondary messages. */
|
|
|
|
safe_secondary_error_msg = simple_dialog_format_message(secondary_error_msg);
|
|
|
|
simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK, "%s%s%s\n\n%s",
|
|
|
|
simple_dialog_primary_start(), safe_error_msg,
|
|
|
|
simple_dialog_primary_end(), safe_secondary_error_msg);
|
|
|
|
g_free(safe_secondary_error_msg);
|
|
|
|
} else {
|
|
|
|
/* We have only a primary message. */
|
|
|
|
simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK, "%s%s%s",
|
|
|
|
simple_dialog_primary_start(), safe_error_msg,
|
|
|
|
simple_dialog_primary_end());
|
|
|
|
}
|
|
|
|
g_free(safe_error_msg);
|
|
|
|
|
|
|
|
/* the capture child will close the sync_pipe if required, nothing to do for now */
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Capture child told us that an error has occurred while parsing a
|
|
|
|
capture filter when starting/running the capture.
|
|
|
|
*/
|
|
|
|
void
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_input_cfilter_error_message(capture_session *cap_session, guint i,
|
|
|
|
char *error_message)
|
2006-03-05 03:14:16 +00:00
|
|
|
{
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_options *capture_opts = cap_session->capture_opts;
|
2011-06-27 00:09:03 +00:00
|
|
|
dfilter_t *rfcode = NULL;
|
|
|
|
gchar *safe_cfilter;
|
2011-06-27 11:30:39 +00:00
|
|
|
gchar *safe_descr;
|
2011-06-27 00:09:03 +00:00
|
|
|
gchar *safe_cfilter_error_msg;
|
|
|
|
interface_options interface_opts;
|
2006-03-05 03:14:16 +00:00
|
|
|
|
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Capture filter error message from child: \"%s\"", error_message);
|
|
|
|
|
2013-05-22 07:44:28 +00:00
|
|
|
g_assert(cap_session->state == CAPTURE_PREPARING || cap_session->state == CAPTURE_RUNNING);
|
2011-06-27 00:09:03 +00:00
|
|
|
g_assert(i < capture_opts->ifaces->len);
|
2006-03-05 03:14:16 +00:00
|
|
|
|
2011-06-27 00:09:03 +00:00
|
|
|
interface_opts = g_array_index(capture_opts->ifaces, interface_options, i);
|
|
|
|
safe_cfilter = simple_dialog_format_message(interface_opts.cfilter);
|
2011-06-27 11:30:39 +00:00
|
|
|
safe_descr = simple_dialog_format_message(interface_opts.descr);
|
2011-06-27 00:09:03 +00:00
|
|
|
safe_cfilter_error_msg = simple_dialog_format_message(error_message);
|
2006-03-05 03:14:16 +00:00
|
|
|
/* Did the user try a display filter? */
|
2015-01-18 10:22:19 +00:00
|
|
|
if (dfilter_compile(interface_opts.cfilter, &rfcode, NULL) && rfcode != NULL) {
|
2006-03-05 03:14:16 +00:00
|
|
|
simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK,
|
2014-09-24 21:06:23 +00:00
|
|
|
"%sInvalid capture filter \"%s\" for interface %s.%s\n"
|
2006-03-05 03:14:16 +00:00
|
|
|
"\n"
|
|
|
|
"That string looks like a valid display filter; however, it isn't a valid\n"
|
|
|
|
"capture filter (%s).\n"
|
|
|
|
"\n"
|
|
|
|
"Note that display filters and capture filters don't have the same syntax,\n"
|
|
|
|
"so you can't use most display filter expressions as capture filters.\n"
|
|
|
|
"\n"
|
|
|
|
"See the User's Guide for a description of the capture filter syntax.",
|
2011-06-27 11:30:39 +00:00
|
|
|
simple_dialog_primary_start(), safe_cfilter, safe_descr,
|
2006-03-05 03:14:16 +00:00
|
|
|
simple_dialog_primary_end(), safe_cfilter_error_msg);
|
|
|
|
dfilter_free(rfcode);
|
|
|
|
} else {
|
|
|
|
simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK,
|
2014-09-24 21:06:23 +00:00
|
|
|
"%sInvalid capture filter \"%s\" for interface %s.%s\n"
|
2006-03-05 03:14:16 +00:00
|
|
|
"\n"
|
|
|
|
"That string isn't a valid capture filter (%s).\n"
|
|
|
|
"See the User's Guide for a description of the capture filter syntax.",
|
2011-06-27 11:30:39 +00:00
|
|
|
simple_dialog_primary_start(), safe_cfilter, safe_descr,
|
2006-03-05 03:14:16 +00:00
|
|
|
simple_dialog_primary_end(), safe_cfilter_error_msg);
|
|
|
|
}
|
|
|
|
g_free(safe_cfilter_error_msg);
|
2011-06-27 11:30:39 +00:00
|
|
|
g_free(safe_descr);
|
2006-03-05 03:14:16 +00:00
|
|
|
g_free(safe_cfilter);
|
2005-12-03 18:15:02 +00:00
|
|
|
|
2005-12-06 19:41:45 +00:00
|
|
|
/* the capture child will close the sync_pipe if required, nothing to do for now */
|
2005-12-03 18:15:02 +00:00
|
|
|
}
|
|
|
|
|
2006-03-05 03:14:16 +00:00
|
|
|
/* capture child closed its side of the pipe, do the required cleanup */
|
2005-03-28 14:39:31 +00:00
|
|
|
void
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_input_closed(capture_session *cap_session, gchar *msg)
|
2005-03-28 14:39:31 +00:00
|
|
|
{
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_options *capture_opts = cap_session->capture_opts;
|
2012-01-25 13:04:32 +00:00
|
|
|
int err;
|
|
|
|
|
2014-09-24 21:06:23 +00:00
|
|
|
g_log(LOG_DOMAIN_CAPTURE, G_LOG_LEVEL_MESSAGE, "Capture stopped.");
|
2013-05-22 07:44:28 +00:00
|
|
|
g_assert(cap_session->state == CAPTURE_PREPARING || cap_session->state == CAPTURE_RUNNING);
|
2005-10-07 03:24:14 +00:00
|
|
|
|
2012-01-25 13:04:32 +00:00
|
|
|
if (msg != NULL)
|
|
|
|
simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK, "%s", msg);
|
|
|
|
|
2013-05-22 07:44:28 +00:00
|
|
|
if(cap_session->state == CAPTURE_PREPARING) {
|
2012-03-13 08:36:25 +00:00
|
|
|
/* We didn't start a capture; note that the attempt to start it
|
|
|
|
failed. */
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_callback_invoke(capture_cb_capture_failed, cap_session);
|
2012-03-13 08:36:25 +00:00
|
|
|
} else {
|
|
|
|
/* We started a capture; process what's left of the capture file if
|
|
|
|
we were in "update list of packets in real time" mode, or process
|
|
|
|
all of it if we weren't. */
|
2012-01-24 17:12:56 +00:00
|
|
|
if(capture_opts->real_time_mode) {
|
2012-03-13 08:36:25 +00:00
|
|
|
cf_read_status_t status;
|
|
|
|
|
|
|
|
/* Read what remains of the capture file. */
|
2013-05-22 07:44:28 +00:00
|
|
|
status = cf_finish_tail((capture_file *)cap_session->cf, &err);
|
2012-03-13 08:36:25 +00:00
|
|
|
|
|
|
|
/* Tell the GUI we are not doing a capture any more.
|
2012-05-16 16:29:12 +00:00
|
|
|
Must be done after the cf_finish_tail(), so file lengths are
|
2012-03-13 08:36:25 +00:00
|
|
|
correctly displayed */
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_callback_invoke(capture_cb_capture_update_finished, cap_session);
|
2012-03-13 08:36:25 +00:00
|
|
|
|
|
|
|
/* Finish the capture. */
|
|
|
|
switch (status) {
|
|
|
|
|
|
|
|
case CF_READ_OK:
|
2015-04-06 19:14:25 +00:00
|
|
|
if (cap_session->count == 0 && !capture_opts->restart) {
|
2012-03-13 08:36:25 +00:00
|
|
|
simple_dialog(ESD_TYPE_INFO, ESD_BTN_OK,
|
2014-09-24 21:06:23 +00:00
|
|
|
"%sNo packets captured.%s\n"
|
2012-03-13 08:36:25 +00:00
|
|
|
"\n"
|
2014-09-24 21:06:23 +00:00
|
|
|
"As no data was captured, closing the %scapture file.\n"
|
2012-03-13 08:36:25 +00:00
|
|
|
"\n"
|
|
|
|
"\n"
|
2014-09-24 21:06:23 +00:00
|
|
|
"Help about capturing can be found at\n"
|
2012-03-13 08:36:25 +00:00
|
|
|
"\n"
|
2015-03-10 17:46:50 +00:00
|
|
|
" https://wiki.wireshark.org/CaptureSetup"
|
2005-11-25 22:27:27 +00:00
|
|
|
#ifdef _WIN32
|
2012-03-13 08:36:25 +00:00
|
|
|
"\n\n"
|
|
|
|
"Wireless (Wi-Fi/WLAN):\n"
|
2014-09-24 21:06:23 +00:00
|
|
|
"Try to switch off promiscuous mode in the Capture Options."
|
2005-11-25 22:27:27 +00:00
|
|
|
#endif
|
2012-03-13 08:36:25 +00:00
|
|
|
"",
|
|
|
|
simple_dialog_primary_start(), simple_dialog_primary_end(),
|
2013-05-22 07:44:28 +00:00
|
|
|
cf_is_tempfile((capture_file *)cap_session->cf) ? "temporary " : "");
|
|
|
|
cf_close((capture_file *)cap_session->cf);
|
2012-03-13 08:36:25 +00:00
|
|
|
}
|
|
|
|
break;
|
|
|
|
case CF_READ_ERROR:
|
|
|
|
/* Just because we got an error, that doesn't mean we were unable
|
|
|
|
to read any of the file; we handle what we could get from the
|
|
|
|
file. */
|
|
|
|
break;
|
|
|
|
|
|
|
|
case CF_READ_ABORTED:
|
|
|
|
/* Exit by leaving the main loop, so that any quit functions
|
|
|
|
we registered get called. */
|
|
|
|
main_window_quit();
|
|
|
|
break;
|
2012-01-25 13:04:32 +00:00
|
|
|
}
|
2012-03-13 08:36:25 +00:00
|
|
|
} else {
|
|
|
|
/* first of all, we are not doing a capture any more */
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_callback_invoke(capture_cb_capture_fixed_finished, cap_session);
|
2005-04-12 21:44:55 +00:00
|
|
|
|
2012-03-13 08:36:25 +00:00
|
|
|
/* this is a normal mode capture and if no error happened, read in the capture file data */
|
|
|
|
if(capture_opts->save_file != NULL) {
|
2013-05-22 07:44:28 +00:00
|
|
|
capture_input_read_all(cap_session, cf_is_tempfile((capture_file *)cap_session->cf),
|
|
|
|
cf_get_drops_known((capture_file *)cap_session->cf), cf_get_drops((capture_file *)cap_session->cf));
|
2012-03-13 08:36:25 +00:00
|
|
|
}
|
2012-01-24 17:12:56 +00:00
|
|
|
}
|
2012-01-25 13:04:32 +00:00
|
|
|
}
|
2005-04-12 21:44:55 +00:00
|
|
|
|
2012-01-25 13:04:32 +00:00
|
|
|
if(capture_opts->show_info)
|
|
|
|
capture_info_close();
|
2012-01-24 16:05:26 +00:00
|
|
|
|
2013-05-22 07:44:28 +00:00
|
|
|
cap_session->state = CAPTURE_STOPPED;
|
2012-01-24 16:05:26 +00:00
|
|
|
|
2012-01-25 13:04:32 +00:00
|
|
|
/* if we couldn't open a capture file, there's nothing more for us to do */
|
|
|
|
if(capture_opts->save_file == NULL) {
|
2013-05-22 07:44:28 +00:00
|
|
|
cf_close((capture_file *)cap_session->cf);
|
2012-01-25 13:04:32 +00:00
|
|
|
return;
|
|
|
|
}
|
2012-01-24 16:05:26 +00:00
|
|
|
|
2012-01-25 13:04:32 +00:00
|
|
|
/* does the user wants to restart the current capture? */
|
|
|
|
if(capture_opts->restart) {
|
|
|
|
capture_opts->restart = FALSE;
|
|
|
|
|
|
|
|
ws_unlink(capture_opts->save_file);
|
|
|
|
|
2013-10-23 15:31:48 +00:00
|
|
|
/* If we have a ring buffer, the original save file has been overwritten
|
|
|
|
with the "ring filename". Restore it before starting again */
|
|
|
|
if ((capture_opts->multi_files_on) && (capture_opts->orig_save_file != NULL)) {
|
|
|
|
g_free(capture_opts->save_file);
|
|
|
|
capture_opts->save_file = g_strdup(capture_opts->orig_save_file);
|
|
|
|
}
|
|
|
|
|
2012-01-25 13:04:32 +00:00
|
|
|
/* if it was a tempfile, throw away the old filename (so it will become a tempfile again) */
|
2013-05-22 07:44:28 +00:00
|
|
|
if(cf_is_tempfile((capture_file *)cap_session->cf)) {
|
2012-01-25 13:04:32 +00:00
|
|
|
g_free(capture_opts->save_file);
|
|
|
|
capture_opts->save_file = NULL;
|
2012-01-24 16:05:26 +00:00
|
|
|
}
|
2012-01-25 13:04:32 +00:00
|
|
|
|
|
|
|
/* ... and start the capture again */
|
|
|
|
if (capture_opts->ifaces->len == 0) {
|
|
|
|
collect_ifaces(capture_opts);
|
|
|
|
}
|
2012-03-11 20:08:54 +00:00
|
|
|
|
|
|
|
/* close the currently loaded capture file */
|
2013-05-22 07:44:28 +00:00
|
|
|
cf_close((capture_file *)cap_session->cf);
|
2012-03-11 20:08:54 +00:00
|
|
|
|
2013-06-27 17:10:50 +00:00
|
|
|
capture_start(capture_opts, cap_session,NULL); /*XXX is this NULL ok or we need an update_cb???*/
|
2012-01-25 13:04:32 +00:00
|
|
|
} else {
|
|
|
|
/* We're not doing a capture any more, so we don't have a save file. */
|
|
|
|
g_free(capture_opts->save_file);
|
|
|
|
capture_opts->save_file = NULL;
|
|
|
|
}
|
2005-02-27 19:59:03 +00:00
|
|
|
}
|
|
|
|
|
2007-08-02 21:45:27 +00:00
|
|
|
if_stat_cache_t *
|
2012-01-25 13:04:32 +00:00
|
|
|
capture_stat_start(capture_options *capture_opts) {
|
2015-06-09 08:13:29 +00:00
|
|
|
int stat_fd;
|
2015-06-10 00:30:15 +00:00
|
|
|
ws_process_id fork_child;
|
2012-01-25 13:04:32 +00:00
|
|
|
gchar *msg;
|
|
|
|
if_stat_cache_t *sc = NULL;
|
|
|
|
if_stat_cache_item_t *sc_item;
|
|
|
|
guint i;
|
|
|
|
interface_t device;
|
|
|
|
|
|
|
|
/* Fire up dumpcap. */
|
|
|
|
/*
|
|
|
|
* XXX - on systems with BPF, the number of BPF devices limits the
|
|
|
|
* number of devices on which you can capture simultaneously.
|
|
|
|
*
|
|
|
|
* This means that
|
|
|
|
*
|
|
|
|
* 1) this might fail if you run out of BPF devices
|
|
|
|
*
|
|
|
|
* and
|
|
|
|
*
|
|
|
|
* 2) opening every interface could leave too few BPF devices
|
|
|
|
* for *other* programs.
|
|
|
|
*
|
|
|
|
* It also means the system could end up getting a lot of traffic
|
|
|
|
* that it has to pass through the networking stack and capture
|
|
|
|
* mechanism, so opening all the devices and presenting packet
|
|
|
|
* counts might not always be a good idea.
|
|
|
|
*/
|
2013-06-27 17:10:50 +00:00
|
|
|
if (sync_interface_stats_open(&stat_fd, &fork_child, &msg, NULL) == 0) {
|
2013-03-07 18:25:25 +00:00
|
|
|
sc = (if_stat_cache_t *)g_malloc(sizeof(if_stat_cache_t));
|
2012-01-25 13:04:32 +00:00
|
|
|
sc->stat_fd = stat_fd;
|
|
|
|
sc->fork_child = fork_child;
|
|
|
|
sc->cache_list = NULL;
|
|
|
|
|
|
|
|
/* Initialize the cache */
|
|
|
|
for (i = 0; i < capture_opts->all_ifaces->len; i++) {
|
|
|
|
device = g_array_index(capture_opts->all_ifaces, interface_t, i);
|
2014-06-12 18:28:58 +00:00
|
|
|
if (device.type != IF_PIPE) {
|
2013-03-07 18:25:25 +00:00
|
|
|
sc_item = (if_stat_cache_item_t *)g_malloc0(sizeof(if_stat_cache_item_t));
|
2012-01-25 13:04:32 +00:00
|
|
|
sc_item->name = g_strdup(device.if_info.name);
|
|
|
|
sc->cache_list = g_list_append(sc->cache_list, sc_item);
|
|
|
|
}
|
2007-08-02 21:45:27 +00:00
|
|
|
}
|
2015-06-26 21:24:28 +00:00
|
|
|
} else {
|
|
|
|
g_free(msg); /* XXX: should we display this to the user ? */
|
2012-01-25 13:04:32 +00:00
|
|
|
}
|
|
|
|
return sc;
|
2007-08-02 21:45:27 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
#define MAX_STAT_LINE_LEN 500
|
|
|
|
|
|
|
|
static void
|
|
|
|
capture_stat_cache_update(if_stat_cache_t *sc) {
|
2012-05-16 16:29:12 +00:00
|
|
|
gchar stat_line[MAX_STAT_LINE_LEN] = "";
|
2012-01-25 13:04:32 +00:00
|
|
|
gchar **stat_parts;
|
|
|
|
GList *sc_entry;
|
|
|
|
if_stat_cache_item_t *sc_item;
|
|
|
|
|
|
|
|
if (!sc)
|
|
|
|
return;
|
|
|
|
|
|
|
|
while (sync_pipe_gets_nonblock(sc->stat_fd, stat_line, MAX_STAT_LINE_LEN) > 0) {
|
|
|
|
g_strstrip(stat_line);
|
|
|
|
stat_parts = g_strsplit(stat_line, "\t", 3);
|
|
|
|
if (stat_parts[0] == NULL || stat_parts[1] == NULL ||
|
|
|
|
stat_parts[2] == NULL) {
|
|
|
|
g_strfreev(stat_parts);
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
for (sc_entry = sc->cache_list; sc_entry != NULL; sc_entry = g_list_next(sc_entry)) {
|
2013-03-07 18:25:25 +00:00
|
|
|
sc_item = (if_stat_cache_item_t *)sc_entry->data;
|
2012-01-25 13:04:32 +00:00
|
|
|
if (strcmp(sc_item->name, stat_parts[0]) == 0) {
|
|
|
|
sc_item->ps.ps_recv = (u_int) strtoul(stat_parts[1], NULL, 10);
|
|
|
|
sc_item->ps.ps_drop = (u_int) strtoul(stat_parts[2], NULL, 10);
|
|
|
|
}
|
2007-08-02 21:45:27 +00:00
|
|
|
}
|
2012-01-25 13:04:32 +00:00
|
|
|
g_strfreev(stat_parts);
|
|
|
|
}
|
2007-08-02 21:45:27 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
gboolean
|
|
|
|
capture_stats(if_stat_cache_t *sc, char *ifname, struct pcap_stat *ps) {
|
2012-01-25 13:04:32 +00:00
|
|
|
GList *sc_entry;
|
|
|
|
if_stat_cache_item_t *sc_item;
|
2007-08-02 21:45:27 +00:00
|
|
|
|
2012-01-25 13:04:32 +00:00
|
|
|
if (!sc || !ifname || !ps) {
|
|
|
|
return FALSE;
|
|
|
|
}
|
2007-08-02 21:45:27 +00:00
|
|
|
|
2012-01-25 13:04:32 +00:00
|
|
|
capture_stat_cache_update(sc);
|
|
|
|
for (sc_entry = sc->cache_list; sc_entry != NULL; sc_entry = g_list_next(sc_entry)) {
|
2013-03-07 18:25:25 +00:00
|
|
|
sc_item = (if_stat_cache_item_t *)sc_entry->data;
|
2012-01-25 13:04:32 +00:00
|
|
|
if (strcmp(sc_item->name, ifname) == 0) {
|
|
|
|
memcpy(ps, &sc_item->ps, sizeof(struct pcap_stat));
|
|
|
|
return TRUE;
|
2007-08-02 21:45:27 +00:00
|
|
|
}
|
2012-01-25 13:04:32 +00:00
|
|
|
}
|
|
|
|
return FALSE;
|
2007-08-02 21:45:27 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
capture_stat_stop(if_stat_cache_t *sc) {
|
2012-01-25 13:04:32 +00:00
|
|
|
GList *sc_entry;
|
|
|
|
if_stat_cache_item_t *sc_item;
|
|
|
|
int ret;
|
|
|
|
gchar *msg;
|
|
|
|
|
|
|
|
if (!sc)
|
|
|
|
return;
|
|
|
|
|
|
|
|
ret = sync_interface_stats_close(&sc->stat_fd, &sc->fork_child, &msg);
|
|
|
|
if (ret == -1) {
|
|
|
|
/* XXX - report failure? */
|
|
|
|
g_free(msg);
|
|
|
|
}
|
2007-08-02 21:45:27 +00:00
|
|
|
|
2012-01-25 13:04:32 +00:00
|
|
|
for (sc_entry = sc->cache_list; sc_entry != NULL; sc_entry = g_list_next(sc_entry)) {
|
2013-03-07 18:25:25 +00:00
|
|
|
sc_item = (if_stat_cache_item_t *)sc_entry->data;
|
2012-01-25 13:04:32 +00:00
|
|
|
g_free(sc_item->name);
|
|
|
|
g_free(sc_item);
|
|
|
|
}
|
2015-10-04 09:31:19 +00:00
|
|
|
g_list_free(sc->cache_list);
|
2012-01-25 13:04:32 +00:00
|
|
|
g_free(sc);
|
2007-08-02 21:45:27 +00:00
|
|
|
}
|
2005-02-27 19:59:03 +00:00
|
|
|
|
1999-07-09 04:18:36 +00:00
|
|
|
#endif /* HAVE_LIBPCAP */
|
2014-10-12 18:56:12 +00:00
|
|
|
|
|
|
|
/*
|
2015-03-10 17:46:50 +00:00
|
|
|
* Editor modelines - https://www.wireshark.org/tools/modelines.html
|
2014-10-12 18:56:12 +00:00
|
|
|
*
|
|
|
|
* Local Variables:
|
|
|
|
* c-basic-offset: 2
|
|
|
|
* tab-width: 8
|
|
|
|
* indent-tabs-mode: nil
|
|
|
|
* End:
|
|
|
|
*
|
|
|
|
* ex: set shiftwidth=2 tabstop=8 expandtab:
|
|
|
|
* :indentSize=2:tabSize=8:noTabs=true:
|
|
|
|
*/
|