1998-09-16 02:39:15 +00:00
|
|
|
/* capture.c
|
|
|
|
* Routines for packet capture windows
|
|
|
|
*
|
2000-11-15 05:42:35 +00:00
|
|
|
* $Id: capture.c,v 1.132 2000/11/15 05:41:41 guy Exp $
|
1998-09-16 03:22:19 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* Ethereal - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@zing.org>
|
|
|
|
* Copyright 1998 Gerald Combs
|
|
|
|
*
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
|
|
*/
|
|
|
|
|
1998-10-10 03:32:20 +00:00
|
|
|
|
1998-09-16 02:39:15 +00:00
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
# include "config.h"
|
|
|
|
#endif
|
|
|
|
|
1999-07-09 04:18:36 +00:00
|
|
|
#ifdef HAVE_LIBPCAP
|
|
|
|
|
1998-10-10 03:32:20 +00:00
|
|
|
#ifdef HAVE_SYS_TYPES_H
|
|
|
|
# include <sys/types.h>
|
|
|
|
#endif
|
|
|
|
|
1999-07-31 23:06:13 +00:00
|
|
|
#ifdef HAVE_SYS_STAT_H
|
|
|
|
# include <sys/stat.h>
|
|
|
|
#endif
|
|
|
|
|
1999-11-29 01:54:01 +00:00
|
|
|
#ifdef HAVE_SYS_WAIT_H
|
|
|
|
# include <sys/wait.h>
|
|
|
|
#endif
|
2000-02-09 19:18:42 +00:00
|
|
|
#ifdef HAVE_IO_H
|
|
|
|
#include <io.h>
|
|
|
|
#endif
|
1999-11-29 01:54:01 +00:00
|
|
|
|
1998-09-16 02:39:15 +00:00
|
|
|
#include <gtk/gtk.h>
|
1998-12-17 05:42:33 +00:00
|
|
|
#include <stdlib.h>
|
1999-04-06 16:24:50 +00:00
|
|
|
#include <stdio.h>
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
#include <ctype.h>
|
1998-09-16 02:39:15 +00:00
|
|
|
#include <string.h>
|
2000-08-11 13:37:21 +00:00
|
|
|
|
|
|
|
#ifdef HAVE_FCNTL_H
|
1999-10-02 06:26:53 +00:00
|
|
|
#include <fcntl.h>
|
2000-08-11 13:37:21 +00:00
|
|
|
#endif
|
1999-08-03 20:51:41 +00:00
|
|
|
|
|
|
|
#ifdef HAVE_UNISTD_H
|
1998-10-13 07:03:37 +00:00
|
|
|
#include <unistd.h>
|
1999-08-03 20:51:41 +00:00
|
|
|
#endif
|
|
|
|
|
1998-12-29 04:05:38 +00:00
|
|
|
#include <time.h>
|
1999-08-03 20:51:41 +00:00
|
|
|
|
|
|
|
#ifdef HAVE_SYS_SOCKET_H
|
1998-09-16 02:39:15 +00:00
|
|
|
#include <sys/socket.h>
|
1999-08-03 20:51:41 +00:00
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifdef HAVE_SYS_IOCTL_H
|
1998-09-16 02:39:15 +00:00
|
|
|
#include <sys/ioctl.h>
|
1999-08-03 20:51:41 +00:00
|
|
|
#endif
|
|
|
|
|
1999-05-11 18:51:10 +00:00
|
|
|
#include <signal.h>
|
|
|
|
#include <errno.h>
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1998-10-10 03:32:20 +00:00
|
|
|
#ifdef NEED_SNPRINTF_H
|
|
|
|
# include "snprintf.h"
|
|
|
|
#endif
|
|
|
|
|
1999-10-02 19:24:27 +00:00
|
|
|
#ifndef lib_pcap_h
|
|
|
|
#include <pcap.h>
|
|
|
|
#endif
|
|
|
|
|
2000-06-15 08:02:43 +00:00
|
|
|
#ifdef _WIN32
|
|
|
|
#include <process.h> /* For spawning child process */
|
|
|
|
#endif
|
|
|
|
|
1999-09-09 02:42:40 +00:00
|
|
|
#include "gtk/main.h"
|
1999-10-20 22:36:05 +00:00
|
|
|
#include "gtk/gtkglobals.h"
|
1998-09-16 02:39:15 +00:00
|
|
|
#include "packet.h"
|
|
|
|
#include "file.h"
|
|
|
|
#include "capture.h"
|
|
|
|
#include "util.h"
|
2000-01-03 06:59:25 +00:00
|
|
|
#include "simple_dialog.h"
|
1998-10-12 01:40:57 +00:00
|
|
|
#include "prefs.h"
|
1999-09-09 03:32:03 +00:00
|
|
|
#include "globals.h"
|
1998-09-16 02:39:15 +00:00
|
|
|
|
2000-07-30 16:54:12 +00:00
|
|
|
#include "wiretap/libpcap.h"
|
2000-09-14 11:49:40 +00:00
|
|
|
#include "wiretap/wtap.h"
|
2000-07-30 16:54:12 +00:00
|
|
|
|
2000-06-15 04:23:06 +00:00
|
|
|
#include "packet-clip.h"
|
2000-02-15 21:06:58 +00:00
|
|
|
#include "packet-eth.h"
|
|
|
|
#include "packet-fddi.h"
|
|
|
|
#include "packet-null.h"
|
|
|
|
#include "packet-ppp.h"
|
|
|
|
#include "packet-raw.h"
|
|
|
|
#include "packet-tr.h"
|
2000-11-15 05:42:35 +00:00
|
|
|
#include "packet-ieee80211.h"
|
2000-02-15 21:06:58 +00:00
|
|
|
|
2000-09-15 05:32:49 +00:00
|
|
|
int promisc_mode = TRUE; /* capture in promiscuous mode */
|
1999-10-01 21:52:03 +00:00
|
|
|
int sync_mode; /* fork a child to do the capture, and sync between them */
|
1999-11-29 01:54:01 +00:00
|
|
|
static int sync_pipe[2]; /* used to sync father */
|
2000-06-15 08:02:43 +00:00
|
|
|
enum PIPES { READ, WRITE }; /* Constants 0 and 1 for READ and WRITE */
|
1999-10-01 21:52:03 +00:00
|
|
|
int quit_after_cap; /* Makes a "capture only mode". Implies -k */
|
1999-10-02 20:00:46 +00:00
|
|
|
gboolean capture_child; /* if this is the child for "-S" */
|
Add routines to Wiretap to allow a client of Wiretap to get:
a pointer to the "wtap_pkthdr" structure for an open capture
file;
a pointer to the "wtap_pseudo_header" union for an open capture
file;
a pointer to the packet buffer for an open capture file;
so that a program using "wtap_read()" in a loop can get at those items.
Keep, in a "capture_file" structure, an indicator of whether:
no file is open;
a file is open, and being read;
a file is open, and is being read, but the user tried to quit
out of reading the file (e.g., by doing "File/Quit");
a file is open, and has been completely read.
Abort if we try to close a capture that's being read if the user hasn't
tried to quit out of the read.
Have "File/Quit" check if a file is being read; if so, just set the
state indicator to "user tried to quit out of it", so that the code
reading the file can do what's appropriate to clean up, rather than
closing the file out from under that code and causing crashes.
Have "read_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
close the capture and return an indication that the read was aborted by
the user. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "continue_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
return an indication that the read was aborted by the user if that
happened. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "finish_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
close the capture and return an indication that the read was aborted by
the user if that happened. Otherwise, return an indication of whether
the read completely succeeded or failed in the middle (and, if it
failed, return the error code through a pointer).
Have their callers check whether the read was aborted or not and, if it
was, bail out in the appropriate fashion (exit if it's reading a file
specified by "-r" on the command line; exit the main loop if it's
reading a file specified with File->Open; kill the capture child if it's
"continue_tail_cap_file()"; exit the main loop if it's
"finish_tail_cap_file()".
svn path=/trunk/; revision=2095
2000-06-27 07:13:42 +00:00
|
|
|
static int fork_child; /* In parent, process ID of child */
|
1999-11-29 01:54:01 +00:00
|
|
|
static guint cap_input_id;
|
1999-10-01 21:52:03 +00:00
|
|
|
|
2000-06-15 08:02:43 +00:00
|
|
|
#ifdef _WIN32
|
|
|
|
static guint cap_timer_id;
|
|
|
|
static int cap_timer_cb(gpointer); /* Win32 kludge to check for pipe input */
|
|
|
|
#endif
|
|
|
|
|
1999-11-29 01:54:01 +00:00
|
|
|
static void cap_file_input_cb(gpointer, gint, GdkInputCondition);
|
2000-01-30 17:10:29 +00:00
|
|
|
static void capture_delete_cb(GtkWidget *, GdkEvent *, gpointer);
|
1999-06-19 01:14:51 +00:00
|
|
|
static void capture_stop_cb(GtkWidget *, gpointer);
|
|
|
|
static void capture_pcap_cb(u_char *, const struct pcap_pkthdr *,
|
|
|
|
const u_char *);
|
2000-05-06 05:08:39 +00:00
|
|
|
static void send_errmsg_to_parent(const char *);
|
1999-09-09 03:32:03 +00:00
|
|
|
static float pct(gint, gint);
|
2000-10-11 06:01:16 +00:00
|
|
|
static void stop_capture(int signo);
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1999-08-15 22:31:22 +00:00
|
|
|
typedef struct _loop_data {
|
|
|
|
gint go;
|
|
|
|
gint max;
|
|
|
|
gint linktype;
|
|
|
|
gint sync_packets;
|
2000-07-30 16:54:12 +00:00
|
|
|
gboolean from_pipe; /* TRUE if we are capturing data from a pipe */
|
|
|
|
gboolean modified; /* TRUE if data in the pipe uses modified pcap headers */
|
|
|
|
gboolean byte_swapped; /* TRUE if data in the pipe is byte swapped */
|
1999-08-15 22:31:22 +00:00
|
|
|
packet_counts counts;
|
Add to Wiretap the ability to write capture files; for now, it can only
write them in "libpcap" format, but the mechanism can have other formats
added.
When creating the temporary file for a capture, use "create_tempfile()",
to close a security hole opened by the fact that "tempnam()" creates a
temporary file, but doesn't open it, and we open the file with the name
it gives us - somebody could remove the file and plant a link to some
file, and, if as may well be the case when Ethereal is capturing
packets, it's running as "root", that means we write a capture on top of
that file.... (The aforementioned changes to Wiretap let you open a
capture file for writing given an file descriptor, "fdopen()"-style,
which this change requires.)
svn path=/trunk/; revision=509
1999-08-18 04:17:38 +00:00
|
|
|
wtap_dumper *pdh;
|
1999-08-15 22:31:22 +00:00
|
|
|
} loop_data;
|
|
|
|
|
2000-07-30 16:59:07 +00:00
|
|
|
#ifndef _WIN32
|
|
|
|
static void adjust_header(loop_data *, struct pcap_hdr *, struct pcaprec_hdr *);
|
|
|
|
static int pipe_open_live(char *, struct pcap_hdr *, loop_data *, char *);
|
|
|
|
static int pipe_dispatch(int, loop_data *, struct pcap_hdr *);
|
|
|
|
#endif
|
|
|
|
|
2000-02-09 19:18:42 +00:00
|
|
|
/* Win32 needs the O_BINARY flag for open() */
|
|
|
|
#ifndef O_BINARY
|
|
|
|
#define O_BINARY 0
|
|
|
|
#endif
|
|
|
|
|
2000-06-15 08:02:43 +00:00
|
|
|
#ifdef _WIN32
|
|
|
|
/* Win32 needs a handle to the child capture process */
|
|
|
|
int child_process;
|
|
|
|
#endif
|
|
|
|
|
2000-09-15 05:32:49 +00:00
|
|
|
/* Add a string pointer to a NULL-terminated array of string pointers. */
|
|
|
|
static char **
|
|
|
|
add_arg(char **args, int *argc, char *arg)
|
|
|
|
{
|
|
|
|
/* Grow the array; "*argc" currently contains the number of string
|
|
|
|
pointers, *not* counting the NULL pointer at the end, so we have
|
|
|
|
to add 2 in order to get the new size of the array, including the
|
|
|
|
new pointer and the terminating NULL pointer. */
|
|
|
|
args = g_realloc(args, (*argc + 2) * sizeof (char *));
|
|
|
|
|
|
|
|
/* Stuff the pointer into the penultimate element of the array, which
|
|
|
|
is the one at the index specified by "*argc". */
|
|
|
|
args[*argc] = arg;
|
|
|
|
|
|
|
|
/* Now bump the count. */
|
|
|
|
(*argc)++;
|
|
|
|
|
|
|
|
/* We overwrite the NULL pointer; put it back right after the
|
|
|
|
element we added. */
|
|
|
|
args[*argc] = NULL;
|
|
|
|
|
|
|
|
return args;
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef _WIN32
|
|
|
|
/* Given a string, return a pointer to a quote-encapsulated version of
|
|
|
|
the string, so we can pass it as an argument with "spawnvp" even
|
|
|
|
if it contains blanks. */
|
|
|
|
char *
|
|
|
|
quote_encapsulate(const char *string)
|
|
|
|
{
|
|
|
|
char *encapsulated_string;
|
|
|
|
|
|
|
|
encapsulated_string = g_new(char, strlen(string) + 3);
|
|
|
|
sprintf(encapsulated_string, "\"%s\"", string);
|
|
|
|
return encapsulated_string;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
1999-10-02 06:26:53 +00:00
|
|
|
/* Open a specified file, or create a temporary file, and start a capture
|
|
|
|
to the file in question. */
|
1998-09-16 02:39:15 +00:00
|
|
|
void
|
1999-10-02 06:26:53 +00:00
|
|
|
do_capture(char *capfile_name)
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
{
|
|
|
|
char tmpname[128+1];
|
Allow the user to save either all of the current capture, or only the
packets that are currently being displayed from that capture.
Centralize the code to control whether "File:Save" and "File:Save As"
are enabled (and *always* have "File:Save As" enabled if you have a
capture; "File:Save" is enabled only if you have a live capture you've
not yet saved, although it does the same thing as "File:Save As").
Have the "save_file" member of a "capture_file" structure represent
*only* the file currently being *written* to by a capture, and, if there
is no capture currently in progress, have it be NULL; the name of the
file currently being *displayed" is in the "filename" member, and an
"is_tempfile" member indicates whether it's a temporary file for a live
capture or not.
Have "close_cap_file()" delete the current capture file if it's a
temporary capture file that hasn't been saved (in its entirety - saving
selected frames doesn't count). Do the same (if there *is* a current
capture file) when exiting.
The "Ready to load or capture" message is the only statusbar message in
the "main" context; "close_cap_file()" should never pop it, it should
only pop whatever message exists in the "file" context, and thus has no
need to take, as an argument, the context for the message it should pop.
Update the man page to reflect the new behavior of "File:Save" and
"File:Save As", and to reflect recent changes to "Display:Match Selected".
svn path=/trunk/; revision=1170
1999-11-30 20:50:15 +00:00
|
|
|
gboolean is_tempfile;
|
1999-10-02 06:26:53 +00:00
|
|
|
u_char c;
|
|
|
|
int i;
|
|
|
|
guint byte_count;
|
|
|
|
char *msg;
|
|
|
|
int err;
|
|
|
|
int capture_succeeded;
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
1999-10-02 06:26:53 +00:00
|
|
|
if (capfile_name != NULL) {
|
|
|
|
/* Try to open/create the specified file for use as a capture buffer. */
|
2000-06-27 04:36:03 +00:00
|
|
|
cfile.save_file_fd = open(capfile_name, O_RDWR|O_BINARY|O_TRUNC|O_CREAT, 0600);
|
Allow the user to save either all of the current capture, or only the
packets that are currently being displayed from that capture.
Centralize the code to control whether "File:Save" and "File:Save As"
are enabled (and *always* have "File:Save As" enabled if you have a
capture; "File:Save" is enabled only if you have a live capture you've
not yet saved, although it does the same thing as "File:Save As").
Have the "save_file" member of a "capture_file" structure represent
*only* the file currently being *written* to by a capture, and, if there
is no capture currently in progress, have it be NULL; the name of the
file currently being *displayed" is in the "filename" member, and an
"is_tempfile" member indicates whether it's a temporary file for a live
capture or not.
Have "close_cap_file()" delete the current capture file if it's a
temporary capture file that hasn't been saved (in its entirety - saving
selected frames doesn't count). Do the same (if there *is* a current
capture file) when exiting.
The "Ready to load or capture" message is the only statusbar message in
the "main" context; "close_cap_file()" should never pop it, it should
only pop whatever message exists in the "file" context, and thus has no
need to take, as an argument, the context for the message it should pop.
Update the man page to reflect the new behavior of "File:Save" and
"File:Save As", and to reflect recent changes to "Display:Match Selected".
svn path=/trunk/; revision=1170
1999-11-30 20:50:15 +00:00
|
|
|
is_tempfile = FALSE;
|
1999-10-02 06:26:53 +00:00
|
|
|
} else {
|
|
|
|
/* Choose a random name for the capture buffer */
|
2000-06-27 04:36:03 +00:00
|
|
|
cfile.save_file_fd = create_tempfile(tmpname, sizeof tmpname, "ether");
|
1999-10-02 06:26:53 +00:00
|
|
|
capfile_name = g_strdup(tmpname);
|
Allow the user to save either all of the current capture, or only the
packets that are currently being displayed from that capture.
Centralize the code to control whether "File:Save" and "File:Save As"
are enabled (and *always* have "File:Save As" enabled if you have a
capture; "File:Save" is enabled only if you have a live capture you've
not yet saved, although it does the same thing as "File:Save As").
Have the "save_file" member of a "capture_file" structure represent
*only* the file currently being *written* to by a capture, and, if there
is no capture currently in progress, have it be NULL; the name of the
file currently being *displayed" is in the "filename" member, and an
"is_tempfile" member indicates whether it's a temporary file for a live
capture or not.
Have "close_cap_file()" delete the current capture file if it's a
temporary capture file that hasn't been saved (in its entirety - saving
selected frames doesn't count). Do the same (if there *is* a current
capture file) when exiting.
The "Ready to load or capture" message is the only statusbar message in
the "main" context; "close_cap_file()" should never pop it, it should
only pop whatever message exists in the "file" context, and thus has no
need to take, as an argument, the context for the message it should pop.
Update the man page to reflect the new behavior of "File:Save" and
"File:Save As", and to reflect recent changes to "Display:Match Selected".
svn path=/trunk/; revision=1170
1999-11-30 20:50:15 +00:00
|
|
|
is_tempfile = TRUE;
|
1999-10-02 06:26:53 +00:00
|
|
|
}
|
2000-06-27 04:36:03 +00:00
|
|
|
if (cfile.save_file_fd == -1) {
|
2000-07-20 05:10:02 +00:00
|
|
|
if (is_tempfile) {
|
|
|
|
simple_dialog(ESD_TYPE_CRIT, NULL,
|
|
|
|
"The temporary file to which the capture would be saved (\"%s\")"
|
1999-11-28 09:44:53 +00:00
|
|
|
"could not be opened: %s.", capfile_name, strerror(errno));
|
2000-07-20 05:10:02 +00:00
|
|
|
} else {
|
|
|
|
simple_dialog(ESD_TYPE_CRIT, NULL,
|
|
|
|
file_open_error_message(errno, TRUE), capfile_name);
|
|
|
|
}
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
return;
|
|
|
|
}
|
2000-06-27 04:36:03 +00:00
|
|
|
close_cap_file(&cfile, info_bar);
|
|
|
|
g_assert(cfile.save_file == NULL);
|
|
|
|
cfile.save_file = capfile_name;
|
Add a new global flag "capture_child", which is TRUE if we're a child
process for a sync mode or fork mode capture.
Have that flag control whether we do things that *only* the parent or
*only* the child should do, rather than basing it solely on the setting
of "sync_mode" or "fork_mode" (or, in the case of stuff done in the
child process either in sync mode or fork mode, rather than basing it on
the setting of those flags at all).
Split "do_capture()" into a "run_capture()" routine that starts a
capture (possibly by forking off and execing a child process, if we're
supposed to do sync mode or fork mode captures), and that assumes the
file to which the capture is to write has already been opened and that
"cf.save_file_fd" is the file descriptor for that file, and a
"do_capture()" routine that creates a temporary file, getting an FD for
it, and calls "run_capture()".
Use "run_capture()", rather than "capture()", for "-k" captures, so that
it'll do the capture in a child process if "-S" or "-F" was specified
("do_capture()" won't do because "-k" captures should write to the file
specified by the "-w" flag, not some random temporary file).
For child process captures, however, just use "capture()" - the child
process shouldn't itself fork off a child if we're in sync or fork mode,
and should just write to the file whose file descriptor was specified by
the "-W" flag on the command line.
All this allows you to do "ethereal -S -w <file> -i <interface> -k" to
start a sync mode capture from the command line.
svn path=/trunk/; revision=740
1999-09-30 06:50:01 +00:00
|
|
|
|
2000-05-06 05:08:39 +00:00
|
|
|
if (sync_mode) { /* do the capture in a child process */
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
char ssnap[24];
|
|
|
|
char scount[24]; /* need a constant for len of numbers */
|
|
|
|
char save_file_fd[24];
|
2000-05-06 05:08:39 +00:00
|
|
|
char errmsg[1024+1];
|
|
|
|
int error;
|
2000-09-15 05:32:49 +00:00
|
|
|
int argc;
|
|
|
|
char **argv;
|
2000-06-15 08:02:43 +00:00
|
|
|
#ifdef _WIN32
|
|
|
|
char sync_pipe_fd[24];
|
2000-09-15 05:32:49 +00:00
|
|
|
char *fontstring;
|
2000-06-15 08:02:43 +00:00
|
|
|
char *filterstring;
|
|
|
|
#endif
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
2000-09-15 05:32:49 +00:00
|
|
|
/* Allocate the string pointer array with enough space for the
|
|
|
|
terminating NULL pointer. */
|
|
|
|
argc = 0;
|
|
|
|
argv = g_malloc(sizeof (char *));
|
|
|
|
*argv = NULL;
|
|
|
|
|
|
|
|
/* Now add those arguments used on all platforms. */
|
|
|
|
argv = add_arg(argv, &argc, CHILD_NAME);
|
|
|
|
|
|
|
|
argv = add_arg(argv, &argc, "-i");
|
|
|
|
argv = add_arg(argv, &argc, cfile.iface);
|
|
|
|
|
|
|
|
argv = add_arg(argv, &argc, "-w");
|
|
|
|
argv = add_arg(argv, &argc, cfile.save_file);
|
|
|
|
|
|
|
|
argv = add_arg(argv, &argc, "-W");
|
|
|
|
sprintf(save_file_fd,"%d",cfile.save_file_fd); /* in lieu of itoa */
|
|
|
|
argv = add_arg(argv, &argc, save_file_fd);
|
|
|
|
|
|
|
|
argv = add_arg(argv, &argc, "-c");
|
2000-06-27 04:36:03 +00:00
|
|
|
sprintf(scount,"%d",cfile.count);
|
2000-09-15 05:32:49 +00:00
|
|
|
argv = add_arg(argv, &argc, scount);
|
|
|
|
|
|
|
|
argv = add_arg(argv, &argc, "-s");
|
|
|
|
sprintf(ssnap,"%d",cfile.snap);
|
|
|
|
argv = add_arg(argv, &argc, ssnap);
|
|
|
|
|
|
|
|
if (!promisc_mode)
|
|
|
|
argv = add_arg(argv, &argc, "-p");
|
2000-06-15 08:02:43 +00:00
|
|
|
|
|
|
|
#ifdef _WIN32
|
|
|
|
/* Create a pipe for the child process */
|
|
|
|
|
|
|
|
if(_pipe(sync_pipe, 512, O_BINARY) < 0) {
|
|
|
|
/* Couldn't create the pipe between parent and child. */
|
|
|
|
error = errno;
|
2000-06-27 04:36:03 +00:00
|
|
|
unlink(cfile.save_file);
|
|
|
|
g_free(cfile.save_file);
|
|
|
|
cfile.save_file = NULL;
|
2000-07-20 05:10:02 +00:00
|
|
|
simple_dialog(ESD_TYPE_CRIT, NULL, "Couldn't create sync pipe: %s",
|
2000-06-15 08:02:43 +00:00
|
|
|
strerror(error));
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2000-09-15 05:32:49 +00:00
|
|
|
/* Convert font name to a quote-encapsulated string and pass to child */
|
|
|
|
argv = add_arg(argv, &argc, "-m");
|
|
|
|
fontstring = quote_encapsulate(prefs.gui_font_name);
|
|
|
|
argv = add_arg(argv, &argc, fontstring);
|
|
|
|
|
2000-06-15 08:02:43 +00:00
|
|
|
/* Convert pipe write handle to a string and pass to child */
|
2000-09-15 05:32:49 +00:00
|
|
|
argv = add_arg(argv, &argc, "-Z");
|
2000-06-15 08:02:43 +00:00
|
|
|
itoa(sync_pipe[WRITE], sync_pipe_fd, 10);
|
2000-09-15 05:32:49 +00:00
|
|
|
argv = add_arg(argv, &argc, sync_pipe_fd);
|
|
|
|
|
|
|
|
/* Convert filter string to a quote delimited string and pass to child */
|
|
|
|
if (cfile.cfilter != NULL && strlen(cfile.cfilter) != 0) {
|
|
|
|
argv = add_arg(argv, &argc, "-f");
|
|
|
|
filterstring = quote_encapsulate(cfile.cfilter);
|
|
|
|
argv = add_arg(argv, &argc, filterstring);
|
|
|
|
}
|
|
|
|
|
2000-06-15 08:02:43 +00:00
|
|
|
/* Spawn process */
|
2000-09-15 05:32:49 +00:00
|
|
|
fork_child = spawnvp(_P_NOWAIT, ethereal_path, argv);
|
|
|
|
g_free(fontstring);
|
2000-06-15 08:02:43 +00:00
|
|
|
g_free(filterstring);
|
|
|
|
/* Keep a copy for later evaluation by _cwait() */
|
|
|
|
child_process = fork_child;
|
|
|
|
#else
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
signal(SIGCHLD, SIG_IGN);
|
2000-05-06 07:07:27 +00:00
|
|
|
if (pipe(sync_pipe) < 0) {
|
|
|
|
/* Couldn't create the pipe between parent and child. */
|
|
|
|
error = errno;
|
2000-06-27 04:36:03 +00:00
|
|
|
unlink(cfile.save_file);
|
|
|
|
g_free(cfile.save_file);
|
|
|
|
cfile.save_file = NULL;
|
2000-07-20 05:10:02 +00:00
|
|
|
simple_dialog(ESD_TYPE_CRIT, NULL, "Couldn't create sync pipe: %s",
|
2000-05-06 07:07:27 +00:00
|
|
|
strerror(error));
|
|
|
|
return;
|
|
|
|
}
|
2000-09-15 05:32:49 +00:00
|
|
|
|
|
|
|
argv = add_arg(argv, &argc, "-m");
|
|
|
|
argv = add_arg(argv, &argc, prefs.gui_font_name);
|
|
|
|
|
|
|
|
if (cfile.cfilter != NULL && strlen(cfile.cfilter) != 0) {
|
|
|
|
argv = add_arg(argv, &argc, "-f");
|
|
|
|
argv = add_arg(argv, &argc, cfile.cfilter);
|
|
|
|
}
|
|
|
|
|
1999-09-23 07:04:23 +00:00
|
|
|
if ((fork_child = fork()) == 0) {
|
1999-11-29 01:54:01 +00:00
|
|
|
/*
|
|
|
|
* Child process - run Ethereal with the right arguments to make
|
|
|
|
* it just pop up the live capture dialog box and capture with
|
|
|
|
* the specified capture parameters, writing to the specified file.
|
|
|
|
*
|
|
|
|
* args: -i interface specification
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
* -w file to write
|
|
|
|
* -W file descriptor to write
|
|
|
|
* -c count to capture
|
|
|
|
* -s snaplen
|
|
|
|
* -m / -b fonts
|
|
|
|
* -f "filter expression"
|
|
|
|
*/
|
1999-10-02 20:00:46 +00:00
|
|
|
close(1);
|
2000-06-15 08:02:43 +00:00
|
|
|
dup(sync_pipe[WRITE]);
|
|
|
|
close(sync_pipe[READ]);
|
2000-09-15 05:32:49 +00:00
|
|
|
execvp(ethereal_path, argv);
|
2000-05-06 05:08:39 +00:00
|
|
|
snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s",
|
|
|
|
ethereal_path, strerror(errno));
|
|
|
|
send_errmsg_to_parent(errmsg);
|
|
|
|
|
|
|
|
/* Exit with "_exit()", so that we don't close the connection
|
|
|
|
to the X server (and cause stuff buffered up by our parent but
|
|
|
|
not yet sent to be sent, as that stuff should only be sent by
|
|
|
|
our parent). */
|
|
|
|
_exit(2);
|
|
|
|
}
|
2000-06-15 08:02:43 +00:00
|
|
|
#endif
|
2000-05-06 05:08:39 +00:00
|
|
|
|
2000-05-19 22:37:57 +00:00
|
|
|
/* Parent process - read messages from the child process over the
|
|
|
|
sync pipe. */
|
2000-09-15 05:32:49 +00:00
|
|
|
g_free(argv); /* free up arg array */
|
2000-05-19 22:37:57 +00:00
|
|
|
|
|
|
|
/* Close the write side of the pipe, so that only the child has it
|
|
|
|
open, and thus it completely closes, and thus returns to us
|
|
|
|
an EOF indication, if the child closes it (either deliberately
|
|
|
|
or by exiting abnormally). */
|
2000-06-15 08:02:43 +00:00
|
|
|
close(sync_pipe[WRITE]);
|
2000-05-19 22:37:57 +00:00
|
|
|
|
|
|
|
/* Close the save file FD, as we won't be using it - we'll be opening
|
|
|
|
it and reading the save file through Wiretap. */
|
2000-06-27 04:36:03 +00:00
|
|
|
close(cfile.save_file_fd);
|
2000-05-19 22:37:57 +00:00
|
|
|
|
2000-05-06 05:08:39 +00:00
|
|
|
if (fork_child == -1) {
|
|
|
|
/* We couldn't even create the child process. */
|
|
|
|
error = errno;
|
2000-06-15 08:02:43 +00:00
|
|
|
close(sync_pipe[READ]);
|
2000-06-27 04:36:03 +00:00
|
|
|
unlink(cfile.save_file);
|
|
|
|
g_free(cfile.save_file);
|
|
|
|
cfile.save_file = NULL;
|
2000-07-20 05:10:02 +00:00
|
|
|
simple_dialog(ESD_TYPE_CRIT, NULL, "Couldn't create child process: %s",
|
2000-05-06 05:08:39 +00:00
|
|
|
strerror(error));
|
|
|
|
return;
|
|
|
|
}
|
1999-10-02 20:00:46 +00:00
|
|
|
|
2000-06-15 08:02:43 +00:00
|
|
|
/* Read a byte count from "sync_pipe[READ]", terminated with a
|
2000-05-06 05:08:39 +00:00
|
|
|
colon; if the count is 0, the child process created the
|
|
|
|
capture file and we should start reading from it, otherwise
|
|
|
|
the capture couldn't start and the count is a count of bytes
|
|
|
|
of error message, and we should display the message. */
|
|
|
|
byte_count = 0;
|
|
|
|
for (;;) {
|
2000-06-15 08:02:43 +00:00
|
|
|
i = read(sync_pipe[READ], &c, 1);
|
2000-05-06 05:08:39 +00:00
|
|
|
if (i == 0) {
|
|
|
|
/* EOF - the child process died.
|
|
|
|
Close the read side of the sync pipe, remove the capture file,
|
|
|
|
and report the failure.
|
|
|
|
XXX - reap the child process and report the status in detail. */
|
2000-06-15 08:02:43 +00:00
|
|
|
close(sync_pipe[READ]);
|
2000-06-27 04:36:03 +00:00
|
|
|
unlink(cfile.save_file);
|
|
|
|
g_free(cfile.save_file);
|
|
|
|
cfile.save_file = NULL;
|
2000-05-06 05:08:39 +00:00
|
|
|
simple_dialog(ESD_TYPE_WARN, NULL, "Capture child process died");
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
if (c == ';')
|
|
|
|
break;
|
|
|
|
if (!isdigit(c)) {
|
|
|
|
/* Child process handed us crap.
|
|
|
|
Close the read side of the sync pipe, remove the capture file,
|
|
|
|
and report the failure. */
|
2000-06-15 08:02:43 +00:00
|
|
|
close(sync_pipe[READ]);
|
2000-06-27 04:36:03 +00:00
|
|
|
unlink(cfile.save_file);
|
|
|
|
g_free(cfile.save_file);
|
|
|
|
cfile.save_file = NULL;
|
2000-05-06 05:08:39 +00:00
|
|
|
simple_dialog(ESD_TYPE_WARN, NULL,
|
|
|
|
"Capture child process sent us a bad message");
|
|
|
|
return;
|
1999-10-02 20:00:46 +00:00
|
|
|
}
|
2000-05-06 05:08:39 +00:00
|
|
|
byte_count = byte_count*10 + c - '0';
|
|
|
|
}
|
|
|
|
if (byte_count == 0) {
|
|
|
|
/* Success. Open the capture file, and set up to read it. */
|
2000-06-27 04:36:03 +00:00
|
|
|
err = start_tail_cap_file(cfile.save_file, is_tempfile, &cfile);
|
2000-05-06 05:08:39 +00:00
|
|
|
if (err == 0) {
|
|
|
|
/* We were able to open and set up to read the capture file;
|
|
|
|
arrange that our callback be called whenever it's possible
|
|
|
|
to read from the sync pipe, so that it's called when
|
|
|
|
the child process wants to tell us something. */
|
2000-06-15 08:02:43 +00:00
|
|
|
#ifdef _WIN32
|
|
|
|
/* Tricky to use pipes in win9x, as no concept of wait. NT can
|
|
|
|
do this but that doesn't cover all win32 platforms. GTK can do
|
|
|
|
this but doesn't seem to work over processes. Attempt to do
|
|
|
|
something similar here, start a timer and check for data on every
|
|
|
|
timeout. */
|
|
|
|
cap_timer_id = gtk_timeout_add(1000, cap_timer_cb, NULL);
|
|
|
|
#else
|
|
|
|
cap_input_id = gtk_input_add_full(sync_pipe[READ],
|
2000-02-02 18:38:52 +00:00
|
|
|
GDK_INPUT_READ|GDK_INPUT_EXCEPTION,
|
1999-11-29 01:54:01 +00:00
|
|
|
cap_file_input_cb,
|
|
|
|
NULL,
|
2000-06-27 04:36:03 +00:00
|
|
|
(gpointer) &cfile,
|
1999-11-29 01:54:01 +00:00
|
|
|
NULL);
|
2000-06-15 08:02:43 +00:00
|
|
|
#endif
|
2000-05-06 05:08:39 +00:00
|
|
|
} else {
|
|
|
|
/* We weren't able to open the capture file; complain, and
|
|
|
|
close the sync pipe. */
|
2000-07-20 05:10:02 +00:00
|
|
|
simple_dialog(ESD_TYPE_CRIT, NULL,
|
2000-06-27 04:36:03 +00:00
|
|
|
file_open_error_message(err, FALSE), cfile.save_file);
|
1999-11-29 01:54:01 +00:00
|
|
|
|
2000-05-06 05:08:39 +00:00
|
|
|
/* Close the sync pipe. */
|
2000-06-15 08:02:43 +00:00
|
|
|
close(sync_pipe[READ]);
|
1999-11-29 01:54:01 +00:00
|
|
|
|
2000-05-06 05:08:39 +00:00
|
|
|
/* Don't unlink the save file - leave it around, for debugging
|
|
|
|
purposes. */
|
2000-06-27 04:36:03 +00:00
|
|
|
g_free(cfile.save_file);
|
|
|
|
cfile.save_file = NULL;
|
2000-05-06 05:08:39 +00:00
|
|
|
}
|
|
|
|
} else {
|
|
|
|
/* Failure - the child process sent us a message indicating
|
|
|
|
what the problem was. */
|
|
|
|
msg = g_malloc(byte_count + 1);
|
|
|
|
if (msg == NULL) {
|
|
|
|
simple_dialog(ESD_TYPE_WARN, NULL,
|
|
|
|
"Capture child process failed, but its error message was too big.");
|
1999-10-02 20:00:46 +00:00
|
|
|
} else {
|
2000-06-15 08:02:43 +00:00
|
|
|
i = read(sync_pipe[READ], msg, byte_count);
|
2000-05-06 05:08:39 +00:00
|
|
|
if (i < 0) {
|
1999-10-02 20:00:46 +00:00
|
|
|
simple_dialog(ESD_TYPE_WARN, NULL,
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
"Capture child process failed: Error %s reading its error message.",
|
|
|
|
strerror(errno));
|
2000-05-06 05:08:39 +00:00
|
|
|
} else if (i == 0) {
|
|
|
|
simple_dialog(ESD_TYPE_WARN, NULL,
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
"Capture child process failed: EOF reading its error message.");
|
2000-05-06 05:08:39 +00:00
|
|
|
} else
|
2000-05-06 07:07:27 +00:00
|
|
|
simple_dialog(ESD_TYPE_WARN, NULL, msg);
|
2000-05-06 05:08:39 +00:00
|
|
|
g_free(msg);
|
1999-11-29 01:54:01 +00:00
|
|
|
|
2000-05-06 05:08:39 +00:00
|
|
|
/* Close the sync pipe. */
|
2000-06-15 08:02:43 +00:00
|
|
|
close(sync_pipe[READ]);
|
1999-11-29 01:54:01 +00:00
|
|
|
|
2000-05-06 05:08:39 +00:00
|
|
|
/* Get rid of the save file - the capture never started. */
|
2000-06-27 04:36:03 +00:00
|
|
|
unlink(cfile.save_file);
|
|
|
|
g_free(cfile.save_file);
|
|
|
|
cfile.save_file = NULL;
|
1999-10-02 20:00:46 +00:00
|
|
|
}
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
}
|
1999-11-29 01:54:01 +00:00
|
|
|
} else {
|
|
|
|
/* Not sync mode. */
|
1999-10-02 06:00:07 +00:00
|
|
|
capture_succeeded = capture();
|
|
|
|
if (quit_after_cap) {
|
|
|
|
/* DON'T unlink the save file. Presumably someone wants it. */
|
|
|
|
gtk_exit(0);
|
|
|
|
}
|
|
|
|
if (capture_succeeded) {
|
|
|
|
/* Capture succeeded; read in the capture file. */
|
2000-06-27 04:36:03 +00:00
|
|
|
if ((err = open_cap_file(cfile.save_file, is_tempfile, &cfile)) == 0) {
|
1999-10-02 06:00:07 +00:00
|
|
|
/* Set the read filter to NULL. */
|
2000-06-27 04:36:03 +00:00
|
|
|
cfile.rfcode = NULL;
|
Add routines to Wiretap to allow a client of Wiretap to get:
a pointer to the "wtap_pkthdr" structure for an open capture
file;
a pointer to the "wtap_pseudo_header" union for an open capture
file;
a pointer to the packet buffer for an open capture file;
so that a program using "wtap_read()" in a loop can get at those items.
Keep, in a "capture_file" structure, an indicator of whether:
no file is open;
a file is open, and being read;
a file is open, and is being read, but the user tried to quit
out of reading the file (e.g., by doing "File/Quit");
a file is open, and has been completely read.
Abort if we try to close a capture that's being read if the user hasn't
tried to quit out of the read.
Have "File/Quit" check if a file is being read; if so, just set the
state indicator to "user tried to quit out of it", so that the code
reading the file can do what's appropriate to clean up, rather than
closing the file out from under that code and causing crashes.
Have "read_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
close the capture and return an indication that the read was aborted by
the user. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "continue_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
return an indication that the read was aborted by the user if that
happened. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "finish_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
close the capture and return an indication that the read was aborted by
the user if that happened. Otherwise, return an indication of whether
the read completely succeeded or failed in the middle (and, if it
failed, return the error code through a pointer).
Have their callers check whether the read was aborted or not and, if it
was, bail out in the appropriate fashion (exit if it's reading a file
specified by "-r" on the command line; exit the main loop if it's
reading a file specified with File->Open; kill the capture child if it's
"continue_tail_cap_file()"; exit the main loop if it's
"finish_tail_cap_file()".
svn path=/trunk/; revision=2095
2000-06-27 07:13:42 +00:00
|
|
|
switch (read_cap_file(&cfile, &err)) {
|
|
|
|
|
|
|
|
case READ_SUCCESS:
|
|
|
|
case READ_ERROR:
|
|
|
|
/* Just because we got an error, that doesn't mean we were unable
|
|
|
|
to read any of the file; we handle what we could get from the
|
|
|
|
file. */
|
|
|
|
break;
|
|
|
|
|
|
|
|
case READ_ABORTED:
|
|
|
|
/* Exit by leaving the main loop, so that any quit functions
|
|
|
|
we registered get called. */
|
|
|
|
gtk_main_quit();
|
|
|
|
return;
|
|
|
|
}
|
1999-10-02 06:00:07 +00:00
|
|
|
}
|
|
|
|
}
|
Allow the user to save either all of the current capture, or only the
packets that are currently being displayed from that capture.
Centralize the code to control whether "File:Save" and "File:Save As"
are enabled (and *always* have "File:Save As" enabled if you have a
capture; "File:Save" is enabled only if you have a live capture you've
not yet saved, although it does the same thing as "File:Save As").
Have the "save_file" member of a "capture_file" structure represent
*only* the file currently being *written* to by a capture, and, if there
is no capture currently in progress, have it be NULL; the name of the
file currently being *displayed" is in the "filename" member, and an
"is_tempfile" member indicates whether it's a temporary file for a live
capture or not.
Have "close_cap_file()" delete the current capture file if it's a
temporary capture file that hasn't been saved (in its entirety - saving
selected frames doesn't count). Do the same (if there *is* a current
capture file) when exiting.
The "Ready to load or capture" message is the only statusbar message in
the "main" context; "close_cap_file()" should never pop it, it should
only pop whatever message exists in the "file" context, and thus has no
need to take, as an argument, the context for the message it should pop.
Update the man page to reflect the new behavior of "File:Save" and
"File:Save As", and to reflect recent changes to "Display:Match Selected".
svn path=/trunk/; revision=1170
1999-11-30 20:50:15 +00:00
|
|
|
/* We're not doing a capture any more, so we don't have a save
|
|
|
|
file. */
|
2000-06-27 04:36:03 +00:00
|
|
|
g_free(cfile.save_file);
|
|
|
|
cfile.save_file = NULL;
|
1999-10-02 06:00:07 +00:00
|
|
|
}
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
}
|
|
|
|
|
2000-06-15 08:02:43 +00:00
|
|
|
#ifdef _WIN32
|
|
|
|
/* The timer has expired, see if there's stuff to read from the pipe,
|
|
|
|
if so call the cap_file_input_cb */
|
|
|
|
static gint
|
|
|
|
cap_timer_cb(gpointer data)
|
|
|
|
{
|
|
|
|
HANDLE handle;
|
|
|
|
DWORD avail = 0;
|
|
|
|
gboolean result, result1;
|
|
|
|
DWORD childstatus;
|
|
|
|
|
|
|
|
/* Oddly enough although Named pipes don't work on win9x,
|
|
|
|
PeekNamedPipe does !!! */
|
|
|
|
handle = (HANDLE) _get_osfhandle (sync_pipe[READ]);
|
|
|
|
result = PeekNamedPipe(handle, NULL, 0, NULL, &avail, NULL);
|
|
|
|
|
|
|
|
/* Get the child process exit status */
|
|
|
|
result1 = GetExitCodeProcess((HANDLE)child_process, &childstatus);
|
|
|
|
|
|
|
|
/* If the Peek returned an error, or there are bytes to be read
|
|
|
|
or the childwatcher thread has terminated then call the normal
|
|
|
|
callback */
|
|
|
|
if (!result || avail > 0 || childstatus != STILL_ACTIVE) {
|
|
|
|
|
|
|
|
/* avoid reentrancy problems and stack overflow */
|
|
|
|
gtk_timeout_remove(cap_timer_id);
|
|
|
|
|
|
|
|
/* And call the real handler */
|
2000-06-27 04:36:03 +00:00
|
|
|
cap_file_input_cb((gpointer) &cfile, 0, 0);
|
2000-06-15 08:02:43 +00:00
|
|
|
|
|
|
|
/* Return false so that the timer is not run again */
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
/* No data so let timer run again */
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
1999-11-29 01:54:01 +00:00
|
|
|
/* There's stuff to read from the sync pipe, meaning the child has sent
|
|
|
|
us a message, or the sync pipe has closed, meaning the child has
|
|
|
|
closed it (perhaps because it exited). */
|
|
|
|
static void
|
|
|
|
cap_file_input_cb(gpointer data, gint source, GdkInputCondition condition)
|
|
|
|
{
|
|
|
|
capture_file *cf = (capture_file *)data;
|
|
|
|
char buffer[256+1], *p = buffer, *q = buffer;
|
|
|
|
int nread;
|
|
|
|
int to_read = 0;
|
|
|
|
gboolean exit_loop = FALSE;
|
|
|
|
int err;
|
|
|
|
int wstatus;
|
|
|
|
int wsignal;
|
|
|
|
char *msg;
|
|
|
|
char *sigmsg;
|
|
|
|
char sigmsg_buf[6+1+3+1];
|
|
|
|
char *coredumped;
|
|
|
|
|
2000-06-15 08:02:43 +00:00
|
|
|
#ifndef _WIN32
|
1999-11-29 01:54:01 +00:00
|
|
|
/* avoid reentrancy problems and stack overflow */
|
|
|
|
gtk_input_remove(cap_input_id);
|
2000-06-15 08:02:43 +00:00
|
|
|
#endif
|
1999-11-29 01:54:01 +00:00
|
|
|
|
2000-06-15 08:02:43 +00:00
|
|
|
if ((nread = read(sync_pipe[READ], buffer, 256)) <= 0) {
|
1999-11-29 01:54:01 +00:00
|
|
|
/* The child has closed the sync pipe, meaning it's not going to be
|
|
|
|
capturing any more packets. Pick up its exit status, and
|
|
|
|
complain if it died of a signal. */
|
2000-06-15 08:02:43 +00:00
|
|
|
#ifdef _WIN32
|
|
|
|
/* XXX - analyze the wait stuatus and display more information
|
|
|
|
in the dialog box? */
|
|
|
|
if (_cwait(&wstatus, child_process, _WAIT_CHILD) == -1) {
|
|
|
|
simple_dialog(ESD_TYPE_WARN, NULL, "Child capture process stopped unexpectedly");
|
|
|
|
}
|
|
|
|
#else
|
1999-11-29 01:54:01 +00:00
|
|
|
if (wait(&wstatus) != -1) {
|
|
|
|
/* XXX - are there any platforms on which we can run that *don't*
|
|
|
|
support POSIX.1's <sys/wait.h> and macros therein? */
|
|
|
|
wsignal = wstatus & 0177;
|
|
|
|
coredumped = "";
|
|
|
|
if (wstatus == 0177) {
|
|
|
|
/* It stopped, rather than exiting. "Should not happen." */
|
|
|
|
msg = "stopped";
|
|
|
|
wsignal = (wstatus >> 8) & 0xFF;
|
|
|
|
} else {
|
|
|
|
msg = "terminated";
|
|
|
|
if (wstatus & 0200)
|
|
|
|
coredumped = " - core dumped";
|
|
|
|
}
|
|
|
|
if (wsignal != 0) {
|
|
|
|
switch (wsignal) {
|
|
|
|
|
|
|
|
case SIGHUP:
|
|
|
|
sigmsg = "Hangup";
|
|
|
|
break;
|
|
|
|
|
|
|
|
case SIGINT:
|
|
|
|
sigmsg = "Interrupted";
|
|
|
|
break;
|
|
|
|
|
|
|
|
case SIGQUIT:
|
|
|
|
sigmsg = "Quit";
|
|
|
|
break;
|
|
|
|
|
|
|
|
case SIGILL:
|
|
|
|
sigmsg = "Illegal instruction";
|
|
|
|
break;
|
|
|
|
|
|
|
|
case SIGTRAP:
|
|
|
|
sigmsg = "Trace trap";
|
|
|
|
break;
|
|
|
|
|
|
|
|
case SIGABRT:
|
|
|
|
sigmsg = "Abort";
|
|
|
|
break;
|
|
|
|
|
|
|
|
case SIGFPE:
|
|
|
|
sigmsg = "Arithmetic exception";
|
|
|
|
break;
|
|
|
|
|
|
|
|
case SIGKILL:
|
|
|
|
sigmsg = "Killed";
|
|
|
|
break;
|
|
|
|
|
|
|
|
case SIGBUS:
|
|
|
|
sigmsg = "Bus error";
|
|
|
|
break;
|
|
|
|
|
|
|
|
case SIGSEGV:
|
|
|
|
sigmsg = "Segmentation violation";
|
|
|
|
break;
|
|
|
|
|
|
|
|
/* http://metalab.unc.edu/pub/Linux/docs/HOWTO/GCC-HOWTO
|
|
|
|
Linux is POSIX compliant. These are not POSIX-defined signals ---
|
|
|
|
ISO/IEC 9945-1:1990 (IEEE Std 1003.1-1990), paragraph B.3.3.1.1 sez:
|
|
|
|
|
|
|
|
``The signals SIGBUS, SIGEMT, SIGIOT, SIGTRAP, and SIGSYS
|
|
|
|
were omitted from POSIX.1 because their behavior is
|
|
|
|
implementation dependent and could not be adequately catego-
|
|
|
|
rized. Conforming implementations may deliver these sig-
|
|
|
|
nals, but must document the circumstances under which they
|
|
|
|
are delivered and note any restrictions concerning their
|
|
|
|
delivery.''
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifdef SIGSYS
|
|
|
|
case SIGSYS:
|
|
|
|
sigmsg = "Bad system call";
|
|
|
|
break;
|
|
|
|
#endif
|
|
|
|
|
|
|
|
case SIGPIPE:
|
|
|
|
sigmsg = "Broken pipe";
|
|
|
|
break;
|
|
|
|
|
|
|
|
case SIGALRM:
|
|
|
|
sigmsg = "Alarm clock";
|
|
|
|
break;
|
|
|
|
|
|
|
|
case SIGTERM:
|
|
|
|
sigmsg = "Terminated";
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
sprintf(sigmsg_buf, "Signal %d", wsignal);
|
|
|
|
sigmsg = sigmsg_buf;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
simple_dialog(ESD_TYPE_WARN, NULL,
|
|
|
|
"Child capture process %s: %s%s", msg, sigmsg, coredumped);
|
|
|
|
}
|
|
|
|
}
|
2000-06-15 08:02:43 +00:00
|
|
|
#endif
|
1999-11-29 01:54:01 +00:00
|
|
|
|
|
|
|
/* Read what remains of the capture file, and finish the capture.
|
|
|
|
XXX - do something if this fails? */
|
Add routines to Wiretap to allow a client of Wiretap to get:
a pointer to the "wtap_pkthdr" structure for an open capture
file;
a pointer to the "wtap_pseudo_header" union for an open capture
file;
a pointer to the packet buffer for an open capture file;
so that a program using "wtap_read()" in a loop can get at those items.
Keep, in a "capture_file" structure, an indicator of whether:
no file is open;
a file is open, and being read;
a file is open, and is being read, but the user tried to quit
out of reading the file (e.g., by doing "File/Quit");
a file is open, and has been completely read.
Abort if we try to close a capture that's being read if the user hasn't
tried to quit out of the read.
Have "File/Quit" check if a file is being read; if so, just set the
state indicator to "user tried to quit out of it", so that the code
reading the file can do what's appropriate to clean up, rather than
closing the file out from under that code and causing crashes.
Have "read_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
close the capture and return an indication that the read was aborted by
the user. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "continue_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
return an indication that the read was aborted by the user if that
happened. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "finish_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
close the capture and return an indication that the read was aborted by
the user if that happened. Otherwise, return an indication of whether
the read completely succeeded or failed in the middle (and, if it
failed, return the error code through a pointer).
Have their callers check whether the read was aborted or not and, if it
was, bail out in the appropriate fashion (exit if it's reading a file
specified by "-r" on the command line; exit the main loop if it's
reading a file specified with File->Open; kill the capture child if it's
"continue_tail_cap_file()"; exit the main loop if it's
"finish_tail_cap_file()".
svn path=/trunk/; revision=2095
2000-06-27 07:13:42 +00:00
|
|
|
switch (finish_tail_cap_file(cf, &err)) {
|
|
|
|
|
|
|
|
case READ_SUCCESS:
|
|
|
|
case READ_ERROR:
|
|
|
|
/* Just because we got an error, that doesn't mean we were unable
|
|
|
|
to read any of the file; we handle what we could get from the
|
|
|
|
file. */
|
|
|
|
break;
|
|
|
|
|
|
|
|
case READ_ABORTED:
|
|
|
|
/* Exit by leaving the main loop, so that any quit functions
|
|
|
|
we registered get called. */
|
|
|
|
gtk_main_quit();
|
|
|
|
return;
|
|
|
|
}
|
Allow the user to save either all of the current capture, or only the
packets that are currently being displayed from that capture.
Centralize the code to control whether "File:Save" and "File:Save As"
are enabled (and *always* have "File:Save As" enabled if you have a
capture; "File:Save" is enabled only if you have a live capture you've
not yet saved, although it does the same thing as "File:Save As").
Have the "save_file" member of a "capture_file" structure represent
*only* the file currently being *written* to by a capture, and, if there
is no capture currently in progress, have it be NULL; the name of the
file currently being *displayed" is in the "filename" member, and an
"is_tempfile" member indicates whether it's a temporary file for a live
capture or not.
Have "close_cap_file()" delete the current capture file if it's a
temporary capture file that hasn't been saved (in its entirety - saving
selected frames doesn't count). Do the same (if there *is* a current
capture file) when exiting.
The "Ready to load or capture" message is the only statusbar message in
the "main" context; "close_cap_file()" should never pop it, it should
only pop whatever message exists in the "file" context, and thus has no
need to take, as an argument, the context for the message it should pop.
Update the man page to reflect the new behavior of "File:Save" and
"File:Save As", and to reflect recent changes to "Display:Match Selected".
svn path=/trunk/; revision=1170
1999-11-30 20:50:15 +00:00
|
|
|
|
|
|
|
/* We're not doing a capture any more, so we don't have a save
|
|
|
|
file. */
|
|
|
|
g_free(cf->save_file);
|
|
|
|
cf->save_file = NULL;
|
|
|
|
|
1999-11-29 01:54:01 +00:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
buffer[nread] = '\0';
|
|
|
|
|
|
|
|
while(!exit_loop) {
|
|
|
|
/* look for (possibly multiple) '*' */
|
|
|
|
switch (*q) {
|
|
|
|
case '*' :
|
|
|
|
to_read += atoi(p);
|
|
|
|
p = q + 1;
|
|
|
|
q++;
|
|
|
|
break;
|
|
|
|
case '\0' :
|
|
|
|
/* XXX should handle the case of a pipe full (i.e. no star found) */
|
|
|
|
exit_loop = TRUE;
|
|
|
|
break;
|
|
|
|
default :
|
|
|
|
q++;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Read from the capture file the number of records the child told us
|
|
|
|
it added.
|
|
|
|
XXX - do something if this fails? */
|
Add routines to Wiretap to allow a client of Wiretap to get:
a pointer to the "wtap_pkthdr" structure for an open capture
file;
a pointer to the "wtap_pseudo_header" union for an open capture
file;
a pointer to the packet buffer for an open capture file;
so that a program using "wtap_read()" in a loop can get at those items.
Keep, in a "capture_file" structure, an indicator of whether:
no file is open;
a file is open, and being read;
a file is open, and is being read, but the user tried to quit
out of reading the file (e.g., by doing "File/Quit");
a file is open, and has been completely read.
Abort if we try to close a capture that's being read if the user hasn't
tried to quit out of the read.
Have "File/Quit" check if a file is being read; if so, just set the
state indicator to "user tried to quit out of it", so that the code
reading the file can do what's appropriate to clean up, rather than
closing the file out from under that code and causing crashes.
Have "read_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
close the capture and return an indication that the read was aborted by
the user. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "continue_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
return an indication that the read was aborted by the user if that
happened. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "finish_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
close the capture and return an indication that the read was aborted by
the user if that happened. Otherwise, return an indication of whether
the read completely succeeded or failed in the middle (and, if it
failed, return the error code through a pointer).
Have their callers check whether the read was aborted or not and, if it
was, bail out in the appropriate fashion (exit if it's reading a file
specified by "-r" on the command line; exit the main loop if it's
reading a file specified with File->Open; kill the capture child if it's
"continue_tail_cap_file()"; exit the main loop if it's
"finish_tail_cap_file()".
svn path=/trunk/; revision=2095
2000-06-27 07:13:42 +00:00
|
|
|
switch (continue_tail_cap_file(cf, to_read, &err)) {
|
|
|
|
|
|
|
|
case READ_SUCCESS:
|
|
|
|
case READ_ERROR:
|
|
|
|
/* Just because we got an error, that doesn't mean we were unable
|
|
|
|
to read any of the file; we handle what we could get from the
|
|
|
|
file.
|
|
|
|
|
|
|
|
XXX - abort on a read error? */
|
|
|
|
break;
|
|
|
|
|
|
|
|
case READ_ABORTED:
|
|
|
|
/* Kill the child capture process; the user wants to exit, and we
|
|
|
|
shouldn't just leave it running. */
|
|
|
|
#ifdef _WIN32
|
|
|
|
/* XXX - kill it. */
|
|
|
|
#else
|
|
|
|
kill(fork_child, SIGTERM); /* SIGTERM so it can clean up if necessary */
|
|
|
|
#endif
|
|
|
|
break;
|
|
|
|
}
|
1999-11-29 01:54:01 +00:00
|
|
|
|
|
|
|
/* restore pipe handler */
|
2000-06-15 08:02:43 +00:00
|
|
|
#ifdef _WIN32
|
|
|
|
cap_timer_id = gtk_timeout_add(1000, cap_timer_cb, NULL);
|
|
|
|
#else
|
|
|
|
cap_input_id = gtk_input_add_full (sync_pipe[READ],
|
2000-02-02 18:38:52 +00:00
|
|
|
GDK_INPUT_READ|GDK_INPUT_EXCEPTION,
|
1999-11-29 01:54:01 +00:00
|
|
|
cap_file_input_cb,
|
|
|
|
NULL,
|
|
|
|
(gpointer) cf,
|
|
|
|
NULL);
|
2000-06-15 08:02:43 +00:00
|
|
|
#endif
|
1999-11-29 01:54:01 +00:00
|
|
|
}
|
|
|
|
|
Enough is enough. Requiring anybody who uses Ethereal on Linux to
update their libpcap probably isn't going to scale - the increasing
frequency with which "Ethereal hangs when I try to capture packets"
shows up on "ethereal-dev" suggests that, unless and until a libpcap
with the "select()" in it becomes ubiquitous on Linux, that'll be the
source of a constant support burden - so we'll just put the "select()"
in Ethereal if it's being built for Linux.
(Putting it in for platforms where the read timeout argument to
"pcap_open_live()" works adds an extra useless system call at best and,
at worst, could make Ethereal not work - "select()" doesn't work on
"/dev/bpf" devices on FreeBSD 3.3, at least, unless you're in "immediate
mode", and, whilst "immediate mode" would make Ethereal respond more
quickly when packets arrive, it might cause Ethereal to respond too
quickly, doing reads for every new packet rather than waiting for
multiple packets to arrive and reading them all with one "read()", which
appears to be at least part of the intent of the read timeout on
"/dev/bpf" devices in BSD.)
svn path=/trunk/; revision=1451
2000-01-12 06:56:32 +00:00
|
|
|
/*
|
|
|
|
* Timeout, in milliseconds, for reads from the stream of captured packets.
|
|
|
|
*/
|
|
|
|
#define CAP_READ_TIMEOUT 250
|
|
|
|
|
2000-07-30 16:54:12 +00:00
|
|
|
#ifndef _WIN32
|
|
|
|
/* Take carre of byte order in the libpcap headers read from pipes.
|
|
|
|
* (function taken from wiretap/libpcap.c) */
|
|
|
|
static void
|
|
|
|
adjust_header(loop_data *ld, struct pcap_hdr *hdr, struct pcaprec_hdr *rechdr)
|
|
|
|
{
|
|
|
|
if (ld->byte_swapped) {
|
|
|
|
/* Byte-swap the record header fields. */
|
|
|
|
rechdr->ts_sec = BSWAP32(rechdr->ts_sec);
|
|
|
|
rechdr->ts_usec = BSWAP32(rechdr->ts_usec);
|
|
|
|
rechdr->incl_len = BSWAP32(rechdr->incl_len);
|
|
|
|
rechdr->orig_len = BSWAP32(rechdr->orig_len);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* In file format version 2.3, the "incl_len" and "orig_len" fields were
|
|
|
|
swapped, in order to match the BPF header layout.
|
|
|
|
|
|
|
|
Unfortunately, some files were, according to a comment in the "libpcap"
|
|
|
|
source, written with version 2.3 in their headers but without the
|
|
|
|
interchanged fields, so if "incl_len" is greater than "orig_len" - which
|
|
|
|
would make no sense - we assume that we need to swap them. */
|
|
|
|
if (hdr->version_major == 2 &&
|
|
|
|
(hdr->version_minor < 3 ||
|
|
|
|
(hdr->version_minor == 3 && rechdr->incl_len > rechdr->orig_len))) {
|
|
|
|
guint32 temp;
|
|
|
|
|
|
|
|
temp = rechdr->orig_len;
|
|
|
|
rechdr->orig_len = rechdr->incl_len;
|
|
|
|
rechdr->incl_len = temp;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Mimic pcap_open_live() for pipe captures
|
|
|
|
* We check if "pipename" is "-" (stdin) or a FIFO, open it, and read the
|
|
|
|
* header.
|
|
|
|
* N.B. : we can't read the libpcap formats used in RedHat 6.1 or SuSE 6.3
|
|
|
|
* because we can't seek on pipes (see wiretap/libpcap.c for details) */
|
|
|
|
static int
|
|
|
|
pipe_open_live(char *pipename, struct pcap_hdr *hdr, loop_data *ld, char *ebuf)
|
|
|
|
{
|
|
|
|
struct stat pipe_stat;
|
|
|
|
int fd;
|
|
|
|
guint32 magic;
|
|
|
|
int bytes_read, b;
|
|
|
|
|
|
|
|
if (strcmp(pipename, "-") == 0) fd = 0; /* read from stdin */
|
|
|
|
else if (stat(pipename, &pipe_stat) == 0 && S_ISFIFO(pipe_stat.st_mode)) {
|
|
|
|
if ((fd = open(pipename, O_RDONLY)) == -1) return -1;
|
|
|
|
} else return -1;
|
|
|
|
|
|
|
|
ld->from_pipe = TRUE;
|
|
|
|
/* read the pcap header */
|
|
|
|
if (read(fd, &magic, sizeof magic) != sizeof magic) {
|
|
|
|
close(fd);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
switch (magic) {
|
|
|
|
case PCAP_MAGIC:
|
|
|
|
/* Host that wrote it has our byte order, and was running
|
|
|
|
a program using either standard or ss990417 libpcap. */
|
|
|
|
ld->byte_swapped = FALSE;
|
|
|
|
ld->modified = FALSE;
|
|
|
|
break;
|
|
|
|
case PCAP_MODIFIED_MAGIC:
|
|
|
|
/* Host that wrote it has our byte order, but was running
|
|
|
|
a program using either ss990915 or ss991029 libpcap. */
|
|
|
|
ld->byte_swapped = FALSE;
|
|
|
|
ld->modified = TRUE;
|
|
|
|
break;
|
|
|
|
case PCAP_SWAPPED_MAGIC:
|
|
|
|
/* Host that wrote it has a byte order opposite to ours,
|
|
|
|
and was running a program using either standard or
|
|
|
|
ss990417 libpcap. */
|
|
|
|
ld->byte_swapped = TRUE;
|
|
|
|
ld->modified = FALSE;
|
|
|
|
break;
|
|
|
|
case PCAP_SWAPPED_MODIFIED_MAGIC:
|
|
|
|
/* Host that wrote it out has a byte order opposite to
|
|
|
|
ours, and was running a program using either ss990915
|
|
|
|
or ss991029 libpcap. */
|
|
|
|
ld->byte_swapped = TRUE;
|
|
|
|
ld->modified = TRUE;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
/* Not a "libpcap" type we know about. */
|
|
|
|
close(fd);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Read the rest of the header */
|
|
|
|
bytes_read = read(fd, hdr, sizeof(struct pcap_hdr));
|
|
|
|
if (bytes_read <= 0) {
|
|
|
|
close(fd);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
while (bytes_read < sizeof(struct pcap_hdr))
|
|
|
|
{
|
|
|
|
b = read(fd, ((char *)&hdr)+bytes_read, sizeof(struct pcap_hdr) - bytes_read);
|
|
|
|
if (b <= 0) {
|
|
|
|
close(fd);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
bytes_read += b;
|
|
|
|
}
|
|
|
|
if (ld->byte_swapped) {
|
|
|
|
/* Byte-swap the header fields about which we care. */
|
|
|
|
hdr->version_major = BSWAP16(hdr->version_major);
|
|
|
|
hdr->version_minor = BSWAP16(hdr->version_minor);
|
|
|
|
hdr->snaplen = BSWAP32(hdr->snaplen);
|
|
|
|
hdr->network = BSWAP32(hdr->network);
|
|
|
|
}
|
|
|
|
if (hdr->version_major < 2) {
|
|
|
|
close(fd);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
return fd;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* We read one record from the pipe, take care of byte order in the record
|
|
|
|
* header, write the record in the capture file, and update capture statistics. */
|
|
|
|
static int
|
|
|
|
pipe_dispatch(int fd, loop_data *ld, struct pcap_hdr *hdr)
|
|
|
|
{
|
|
|
|
struct wtap_pkthdr whdr;
|
|
|
|
struct pcaprec_modified_hdr rechdr;
|
|
|
|
int bytes_to_read, bytes_read, b;
|
|
|
|
u_char pd[WTAP_MAX_PACKET_SIZE];
|
|
|
|
int err;
|
|
|
|
|
|
|
|
/* read the record header */
|
|
|
|
bytes_to_read = ld->modified ? sizeof rechdr : sizeof rechdr.hdr;
|
|
|
|
bytes_read = read(fd, &rechdr, bytes_to_read);
|
|
|
|
if (bytes_read <= 0) {
|
|
|
|
close(fd);
|
|
|
|
ld->go = FALSE;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
while (bytes_read < bytes_to_read)
|
|
|
|
{
|
|
|
|
b = read(fd, ((char *)&rechdr)+bytes_read, bytes_to_read - bytes_read);
|
|
|
|
if (b <= 0) {
|
|
|
|
close(fd);
|
|
|
|
ld->go = FALSE;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
bytes_read += b;
|
|
|
|
}
|
|
|
|
/* take care of byte order */
|
|
|
|
adjust_header(ld, hdr, &rechdr.hdr);
|
|
|
|
if (rechdr.hdr.incl_len > WTAP_MAX_PACKET_SIZE) {
|
|
|
|
close(fd);
|
|
|
|
ld->go = FALSE;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
/* read the packet data */
|
|
|
|
bytes_read = read(fd, pd, rechdr.hdr.incl_len);
|
|
|
|
if (bytes_read <= 0) {
|
|
|
|
close(fd);
|
|
|
|
ld->go = FALSE;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
while (bytes_read < rechdr.hdr.incl_len)
|
|
|
|
{
|
|
|
|
b = read(fd, pd+bytes_read, rechdr.hdr.incl_len - bytes_read);
|
|
|
|
if (b <= 0) {
|
|
|
|
close(fd);
|
|
|
|
ld->go = FALSE;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
bytes_read += b;
|
|
|
|
}
|
|
|
|
/* dump the packet data to the capture file */
|
|
|
|
whdr.ts.tv_sec = rechdr.hdr.ts_sec;
|
|
|
|
whdr.ts.tv_usec = rechdr.hdr.ts_usec;
|
|
|
|
whdr.caplen = rechdr.hdr.incl_len;
|
|
|
|
whdr.len = rechdr.hdr.orig_len;
|
|
|
|
whdr.pkt_encap = ld->linktype;
|
|
|
|
wtap_dump(ld->pdh, &whdr, NULL, pd, &err);
|
|
|
|
|
|
|
|
/* Set the initial payload to the packet length, and the initial
|
|
|
|
captured payload to the capture length (other protocols may
|
|
|
|
reduce them if their headers say they're less). */
|
|
|
|
pi.len = whdr.len;
|
|
|
|
pi.captured_len = whdr.caplen;
|
|
|
|
|
|
|
|
/* update capture statistics */
|
|
|
|
switch (ld->linktype) {
|
|
|
|
case WTAP_ENCAP_ETHERNET:
|
|
|
|
capture_eth(pd, 0, &ld->counts);
|
|
|
|
break;
|
|
|
|
case WTAP_ENCAP_FDDI:
|
|
|
|
case WTAP_ENCAP_FDDI_BITSWAPPED:
|
|
|
|
capture_fddi(pd, &ld->counts);
|
|
|
|
break;
|
2000-09-21 04:41:37 +00:00
|
|
|
case WTAP_ENCAP_TOKEN_RING:
|
2000-07-30 16:54:12 +00:00
|
|
|
capture_tr(pd, 0, &ld->counts);
|
|
|
|
break;
|
|
|
|
case WTAP_ENCAP_NULL:
|
|
|
|
capture_null(pd, &ld->counts);
|
|
|
|
break;
|
|
|
|
case WTAP_ENCAP_PPP:
|
|
|
|
capture_ppp(pd, 0, &ld->counts);
|
|
|
|
break;
|
|
|
|
case WTAP_ENCAP_RAW_IP:
|
|
|
|
capture_raw(pd, &ld->counts);
|
|
|
|
break;
|
|
|
|
case WTAP_ENCAP_LINUX_ATM_CLIP:
|
|
|
|
capture_clip(pd, &ld->counts);
|
|
|
|
break;
|
2000-11-15 05:42:35 +00:00
|
|
|
case WTAP_ENCAP_IEEE_802_11:
|
|
|
|
capture_ieee80211(pd,0,&ld->counts);
|
|
|
|
break;
|
2000-07-30 16:54:12 +00:00
|
|
|
/* XXX - FreeBSD may append 4-byte ATM pseudo-header to DLT_ATM_RFC1483,
|
|
|
|
with LLC header following; we should implement it at some
|
|
|
|
point. */
|
|
|
|
}
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2000-10-11 06:01:16 +00:00
|
|
|
/*
|
|
|
|
* This needs to be static, so that the SIGUSR1 handler can clear the "go"
|
|
|
|
* flag.
|
|
|
|
*/
|
|
|
|
static loop_data ld;
|
|
|
|
|
1999-10-02 06:00:07 +00:00
|
|
|
/* Do the low-level work of a capture.
|
|
|
|
Returns TRUE if it succeeds, FALSE otherwise. */
|
|
|
|
int
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
capture(void)
|
|
|
|
{
|
2000-10-21 04:20:07 +00:00
|
|
|
GtkWidget *cap_w, *main_vb, *stop_bt, *counts_tb;
|
1998-09-16 02:39:15 +00:00
|
|
|
pcap_t *pch;
|
2000-07-31 04:03:31 +00:00
|
|
|
int pcap_encap;
|
|
|
|
int snaplen;
|
2000-08-19 18:20:59 +00:00
|
|
|
gchar err_str[PCAP_ERRBUF_SIZE], label_str[64];
|
1998-09-16 02:39:15 +00:00
|
|
|
bpf_u_int32 netnum, netmask;
|
|
|
|
time_t upd_time, cur_time;
|
2000-10-21 04:20:07 +00:00
|
|
|
int err, inpkts, i;
|
On Win32, if the attempt to open the capture device fails, don't talk
about checking permissions, as the capture devices are probably
available to all users, and talking about permissions will only confuse
the user. Do, however, warn that Ethereal can't capture on Token Ring
or PPP/WAN interfaces.
On UNIX, if the attempt to open the capture device fails, and the error
message starts with "can't find PPA for ", they are probably running on
HP-UX with a version of libpcap not patched to properly look up PPAs for
network interfaces given the interface name; give them a detailed
warning about this, telling them that they'll have to fix libpcap and
build Ethereal from source, and pointing them at the "README.hpux" file.
svn path=/trunk/; revision=2265
2000-08-13 08:17:03 +00:00
|
|
|
char errmsg[4096+1];
|
|
|
|
#ifndef _WIN32
|
|
|
|
static const char ppamsg[] = "can't find PPA for ";
|
|
|
|
char *libpcap_warn;
|
|
|
|
#endif
|
Enough is enough. Requiring anybody who uses Ethereal on Linux to
update their libpcap probably isn't going to scale - the increasing
frequency with which "Ethereal hangs when I try to capture packets"
shows up on "ethereal-dev" suggests that, unless and until a libpcap
with the "select()" in it becomes ubiquitous on Linux, that'll be the
source of a constant support burden - so we'll just put the "select()"
in Ethereal if it's being built for Linux.
(Putting it in for platforms where the read timeout argument to
"pcap_open_live()" works adds an extra useless system call at best and,
at worst, could make Ethereal not work - "select()" doesn't work on
"/dev/bpf" devices on FreeBSD 3.3, at least, unless you're in "immediate
mode", and, whilst "immediate mode" would make Ethereal respond more
quickly when packets arrive, it might cause Ethereal to respond too
quickly, doing reads for every new packet rather than waiting for
multiple packets to arrive and reading them all with one "read()", which
appears to be at least part of the intent of the read timeout on
"/dev/bpf" devices in BSD.)
svn path=/trunk/; revision=1451
2000-01-12 06:56:32 +00:00
|
|
|
fd_set set1;
|
|
|
|
struct timeval timeout;
|
2000-07-31 04:03:31 +00:00
|
|
|
#ifdef linux
|
2000-07-30 16:54:12 +00:00
|
|
|
int pcap_fd = 0;
|
Enough is enough. Requiring anybody who uses Ethereal on Linux to
update their libpcap probably isn't going to scale - the increasing
frequency with which "Ethereal hangs when I try to capture packets"
shows up on "ethereal-dev" suggests that, unless and until a libpcap
with the "select()" in it becomes ubiquitous on Linux, that'll be the
source of a constant support burden - so we'll just put the "select()"
in Ethereal if it's being built for Linux.
(Putting it in for platforms where the read timeout argument to
"pcap_open_live()" works adds an extra useless system call at best and,
at worst, could make Ethereal not work - "select()" doesn't work on
"/dev/bpf" devices on FreeBSD 3.3, at least, unless you're in "immediate
mode", and, whilst "immediate mode" would make Ethereal respond more
quickly when packets arrive, it might cause Ethereal to respond too
quickly, doing reads for every new packet rather than waiting for
multiple packets to arrive and reading them all with one "read()", which
appears to be at least part of the intent of the read timeout on
"/dev/bpf" devices in BSD.)
svn path=/trunk/; revision=1451
2000-01-12 06:56:32 +00:00
|
|
|
#endif
|
2000-03-21 06:52:13 +00:00
|
|
|
#ifdef _WIN32
|
|
|
|
WORD wVersionRequested;
|
|
|
|
WSADATA wsaData;
|
|
|
|
#endif
|
2000-07-30 16:54:12 +00:00
|
|
|
#ifndef _WIN32
|
|
|
|
int pipe_fd = -1;
|
|
|
|
struct pcap_hdr hdr;
|
|
|
|
#endif
|
2000-10-21 04:20:07 +00:00
|
|
|
struct {
|
|
|
|
const gchar *title;
|
|
|
|
gint *value_ptr;
|
|
|
|
GtkWidget *label, *value, *percent;
|
|
|
|
} stats[] = {
|
|
|
|
{ "Total", &ld.counts.total },
|
|
|
|
{ "SCTP", &ld.counts.sctp },
|
|
|
|
{ "TCP", &ld.counts.tcp },
|
|
|
|
{ "UDP", &ld.counts.udp },
|
|
|
|
{ "ICMP", &ld.counts.icmp },
|
|
|
|
{ "OSPF", &ld.counts.ospf },
|
|
|
|
{ "GRE", &ld.counts.gre },
|
|
|
|
{ "NetBIOS", &ld.counts.netbios },
|
|
|
|
{ "IPX", &ld.counts.ipx },
|
|
|
|
{ "VINES", &ld.counts.vines },
|
|
|
|
{ "Other", &ld.counts.other }
|
|
|
|
};
|
|
|
|
|
|
|
|
#define N_STATS (sizeof stats / sizeof stats[0])
|
2000-03-21 06:52:13 +00:00
|
|
|
|
|
|
|
/* Initialize Windows Socket if we are in a WIN32 OS
|
|
|
|
This needs to be done before querying the interface for network/netmask */
|
|
|
|
#ifdef _WIN32
|
|
|
|
wVersionRequested = MAKEWORD( 1, 1 );
|
|
|
|
err = WSAStartup( wVersionRequested, &wsaData );
|
|
|
|
if (err!=0) {
|
|
|
|
snprintf(errmsg, sizeof errmsg,
|
|
|
|
"Couldn't initialize Windows Sockets.");
|
|
|
|
pch=NULL;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
#endif
|
1999-08-15 22:16:59 +00:00
|
|
|
|
1999-08-10 20:06:39 +00:00
|
|
|
ld.go = TRUE;
|
|
|
|
ld.counts.total = 0;
|
2000-06-27 04:36:03 +00:00
|
|
|
ld.max = cfile.count;
|
DLT_NULL, from "libpcap", means different things on different platforms
and in different capture files; throw in some heuristics to try to
figure out whether the 4-byte header is:
1) PPP-over-HDLC (some version of ISDN4BSD?);
2) big-endian AF_ value (BSD on big-endian platforms);
3) little-endian AF_ value (BSD on little-endian platforms);
4) two octets of 0 followed by an Ethernet type (Linux, at least
on little-endian platforms, as mutated by "libpcap").
Make a separate Wiretap encapsulation type, WTAP_ENCAP_NULL,
corresponding to DLT_NULL.
Have the PPP code dissect the frame if it's PPP-over-HDLC, and have
"ethertype()" dissect the Ethernet type and the rest of the packet if
it's a Linux-style header; dissect it ourselves only if it's an AF_
value.
Have Wiretap impose a maximum packet size of 65535 bytes, so that it
fails more gracefully when handed a corrupt "libpcap" capture file
(other capture file formats with more than a 16-bit capture length
field, if any, will have that check added later), and put that size in
"wtap.h" and have Ethereal use it as its notion of a maximum packet
size.
Have Ethereal put up a "this file appears to be damaged or corrupt"
message box if Wiretap returns a WTAP_ERR_BAD_RECORD error when opening
or reading a capture file.
Include loopback interfaces in the list of interfaces offered by the
"Capture" dialog box, but put them at the end of the list so that it
doesn't default to a loopback interface unless there are no other
interfaces. Also, don't require that an interface in the list have an
IP address associated with it, and only put one entry in the list for a
given interface (SIOCGIFCONF returns one entry per interface *address*,
not per *interface* - and even if you were to use only IP addresses, an
interface could conceivably have more than one IP address).
Exclusively use Wiretap encapsulation types internally, even when
capturing; don't use DLT_ types.
svn path=/trunk/; revision=540
1999-08-22 00:47:56 +00:00
|
|
|
ld.linktype = WTAP_ENCAP_UNKNOWN;
|
2000-07-30 16:54:12 +00:00
|
|
|
ld.from_pipe = FALSE;
|
1999-08-10 20:06:39 +00:00
|
|
|
ld.sync_packets = 0;
|
2000-05-26 22:08:16 +00:00
|
|
|
ld.counts.sctp = 0;
|
1999-08-10 20:06:39 +00:00
|
|
|
ld.counts.tcp = 0;
|
|
|
|
ld.counts.udp = 0;
|
1999-08-14 23:47:20 +00:00
|
|
|
ld.counts.icmp = 0;
|
1999-08-10 20:06:39 +00:00
|
|
|
ld.counts.ospf = 0;
|
|
|
|
ld.counts.gre = 0;
|
1999-11-30 23:56:37 +00:00
|
|
|
ld.counts.ipx = 0;
|
1999-08-10 20:06:39 +00:00
|
|
|
ld.counts.netbios = 0;
|
2000-01-20 21:34:16 +00:00
|
|
|
ld.counts.vines = 0;
|
1999-08-10 20:06:39 +00:00
|
|
|
ld.counts.other = 0;
|
|
|
|
ld.pdh = NULL;
|
1998-09-16 02:39:15 +00:00
|
|
|
|
1999-09-23 07:04:23 +00:00
|
|
|
/* Open the network interface to capture from it. */
|
2000-09-15 05:32:49 +00:00
|
|
|
pch = pcap_open_live(cfile.iface, cfile.snap, promisc_mode,
|
|
|
|
CAP_READ_TIMEOUT, err_str);
|
1998-09-16 02:39:15 +00:00
|
|
|
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
if (pch == NULL) {
|
On Win32, if the attempt to open the capture device fails, don't talk
about checking permissions, as the capture devices are probably
available to all users, and talking about permissions will only confuse
the user. Do, however, warn that Ethereal can't capture on Token Ring
or PPP/WAN interfaces.
On UNIX, if the attempt to open the capture device fails, and the error
message starts with "can't find PPA for ", they are probably running on
HP-UX with a version of libpcap not patched to properly look up PPAs for
network interfaces given the interface name; give them a detailed
warning about this, telling them that they'll have to fix libpcap and
build Ethereal from source, and pointing them at the "README.hpux" file.
svn path=/trunk/; revision=2265
2000-08-13 08:17:03 +00:00
|
|
|
#ifdef _WIN32
|
|
|
|
/* Well, we couldn't start the capture.
|
|
|
|
If this is a child process that does the capturing in sync
|
|
|
|
mode or fork mode, it shouldn't do any UI stuff until we pop up the
|
|
|
|
capture-progress window, and, since we couldn't start the
|
|
|
|
capture, we haven't popped it up. */
|
|
|
|
if (!capture_child) {
|
|
|
|
while (gtk_events_pending()) gtk_main_iteration();
|
|
|
|
}
|
|
|
|
|
|
|
|
/* On Win32 OSes, the capture devices are probably available to all
|
|
|
|
users; don't warn about permissions problems.
|
|
|
|
|
|
|
|
Do, however, warn that Token Ring and PPP devices aren't supported. */
|
|
|
|
snprintf(errmsg, sizeof errmsg,
|
|
|
|
"The capture session could not be initiated (%s).\n"
|
|
|
|
"Please check that you have the proper interface specified.\n"
|
|
|
|
"\n"
|
|
|
|
"Note that the driver Ethereal uses for packet capture on Windows\n"
|
2000-08-14 08:36:41 +00:00
|
|
|
"doesn't support capturing on Token Ring interfaces, and doesn't\n"
|
|
|
|
"support capturing on PPP/WAN interfaces in Windows NT/2000.\n",
|
On Win32, if the attempt to open the capture device fails, don't talk
about checking permissions, as the capture devices are probably
available to all users, and talking about permissions will only confuse
the user. Do, however, warn that Ethereal can't capture on Token Ring
or PPP/WAN interfaces.
On UNIX, if the attempt to open the capture device fails, and the error
message starts with "can't find PPA for ", they are probably running on
HP-UX with a version of libpcap not patched to properly look up PPAs for
network interfaces given the interface name; give them a detailed
warning about this, telling them that they'll have to fix libpcap and
build Ethereal from source, and pointing them at the "README.hpux" file.
svn path=/trunk/; revision=2265
2000-08-13 08:17:03 +00:00
|
|
|
err_str);
|
|
|
|
goto error;
|
|
|
|
#else
|
2000-07-30 16:54:12 +00:00
|
|
|
/* try to open cfile.iface as a pipe */
|
|
|
|
pipe_fd = pipe_open_live(cfile.iface, &hdr, &ld, err_str);
|
|
|
|
|
|
|
|
if (pipe_fd == -1) {
|
|
|
|
/* Well, we couldn't start the capture.
|
|
|
|
If this is a child process that does the capturing in sync
|
|
|
|
mode or fork mode, it shouldn't do any UI stuff until we pop up the
|
|
|
|
capture-progress window, and, since we couldn't start the
|
|
|
|
capture, we haven't popped it up. */
|
|
|
|
if (!capture_child) {
|
|
|
|
while (gtk_events_pending()) gtk_main_iteration();
|
|
|
|
}
|
On Win32, if the attempt to open the capture device fails, don't talk
about checking permissions, as the capture devices are probably
available to all users, and talking about permissions will only confuse
the user. Do, however, warn that Ethereal can't capture on Token Ring
or PPP/WAN interfaces.
On UNIX, if the attempt to open the capture device fails, and the error
message starts with "can't find PPA for ", they are probably running on
HP-UX with a version of libpcap not patched to properly look up PPAs for
network interfaces given the interface name; give them a detailed
warning about this, telling them that they'll have to fix libpcap and
build Ethereal from source, and pointing them at the "README.hpux" file.
svn path=/trunk/; revision=2265
2000-08-13 08:17:03 +00:00
|
|
|
|
|
|
|
/* If we got a "can't find PPA for XXX" message, warn the user (who
|
|
|
|
is running Ethereal on HP-UX) that they don't have a version
|
|
|
|
of libpcap patched to properly handle HP-UX (the patched version
|
|
|
|
says "can't find /dev/dlpi PPA for XXX" rather than "can't find
|
|
|
|
PPA for XXX"). */
|
|
|
|
if (strncmp(err_str, ppamsg, sizeof ppamsg - 1) == 0)
|
|
|
|
libpcap_warn =
|
|
|
|
"\n\n"
|
|
|
|
"You are running Ethereal with a version of the libpcap library\n"
|
|
|
|
"that doesn't handle HP-UX network devices well; this means that\n"
|
|
|
|
"Ethereal may not be able to capture packets.\n"
|
|
|
|
"\n"
|
|
|
|
"To fix this, you will need to download the source to Ethereal\n"
|
2000-10-08 17:16:29 +00:00
|
|
|
"from www.ethereal.com if you have not already done so, read\n"
|
On Win32, if the attempt to open the capture device fails, don't talk
about checking permissions, as the capture devices are probably
available to all users, and talking about permissions will only confuse
the user. Do, however, warn that Ethereal can't capture on Token Ring
or PPP/WAN interfaces.
On UNIX, if the attempt to open the capture device fails, and the error
message starts with "can't find PPA for ", they are probably running on
HP-UX with a version of libpcap not patched to properly look up PPAs for
network interfaces given the interface name; give them a detailed
warning about this, telling them that they'll have to fix libpcap and
build Ethereal from source, and pointing them at the "README.hpux" file.
svn path=/trunk/; revision=2265
2000-08-13 08:17:03 +00:00
|
|
|
"the instructions in the \"README.hpux\" file in the source\n"
|
|
|
|
"distribution, download the source to libpcap if you have not\n"
|
|
|
|
"already done so, patch libpcap as per the instructions, rebuild\n"
|
|
|
|
"and install libpcap, and then build Ethereal (if you have already\n"
|
|
|
|
"built Ethereal from source, do a \"make distclean\" and re-run\n"
|
|
|
|
"configure before building).";
|
|
|
|
else
|
|
|
|
libpcap_warn = "";
|
2000-07-30 16:54:12 +00:00
|
|
|
snprintf(errmsg, sizeof errmsg,
|
|
|
|
"The capture session could not be initiated (%s).\n"
|
|
|
|
"Please check to make sure you have sufficient permissions, and that\n"
|
On Win32, if the attempt to open the capture device fails, don't talk
about checking permissions, as the capture devices are probably
available to all users, and talking about permissions will only confuse
the user. Do, however, warn that Ethereal can't capture on Token Ring
or PPP/WAN interfaces.
On UNIX, if the attempt to open the capture device fails, and the error
message starts with "can't find PPA for ", they are probably running on
HP-UX with a version of libpcap not patched to properly look up PPAs for
network interfaces given the interface name; give them a detailed
warning about this, telling them that they'll have to fix libpcap and
build Ethereal from source, and pointing them at the "README.hpux" file.
svn path=/trunk/; revision=2265
2000-08-13 08:17:03 +00:00
|
|
|
"you have the proper interface or pipe specified.%s", err_str,
|
|
|
|
libpcap_warn);
|
2000-07-30 16:54:12 +00:00
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
#endif
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
}
|
|
|
|
|
2000-07-30 16:54:12 +00:00
|
|
|
/* capture filters only work on real interfaces */
|
|
|
|
if (cfile.cfilter && !ld.from_pipe) {
|
1999-09-23 07:04:23 +00:00
|
|
|
/* A capture filter was specified; set it up. */
|
2000-06-27 04:36:03 +00:00
|
|
|
if (pcap_lookupnet (cfile.iface, &netnum, &netmask, err_str) < 0) {
|
2000-11-01 07:38:54 +00:00
|
|
|
/*
|
|
|
|
* Well, we can't get the netmask for this interface; it's used
|
|
|
|
* only for filters that check for broadcast IP addresses, so
|
|
|
|
* we just punt and use 0. It might be nice to warn the user,
|
|
|
|
* but that's a pain in a GUI application, as it'd involve popping
|
|
|
|
* up a message box, and it's not clear how often this would make
|
|
|
|
* a difference (only filters that check for IP broadcast addresses
|
|
|
|
* use the netmask).
|
|
|
|
*/
|
|
|
|
netmask = 0;
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
}
|
2000-06-27 04:36:03 +00:00
|
|
|
if (pcap_compile(pch, &cfile.fcode, cfile.cfilter, 1, netmask) < 0) {
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
snprintf(errmsg, sizeof errmsg, "Unable to parse filter string (%s).",
|
|
|
|
pcap_geterr(pch));
|
1999-09-23 07:04:23 +00:00
|
|
|
goto error;
|
1999-08-18 17:08:47 +00:00
|
|
|
}
|
2000-06-27 04:36:03 +00:00
|
|
|
if (pcap_setfilter(pch, &cfile.fcode) < 0) {
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
snprintf(errmsg, sizeof errmsg, "Can't install filter (%s).",
|
|
|
|
pcap_geterr(pch));
|
1999-09-23 07:04:23 +00:00
|
|
|
goto error;
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
1999-09-23 07:04:23 +00:00
|
|
|
/* Set up to write to the capture file. */
|
2000-07-31 04:03:31 +00:00
|
|
|
#ifndef _WIN32
|
|
|
|
if (ld.from_pipe) {
|
|
|
|
pcap_encap = hdr.network;
|
|
|
|
snaplen = hdr.snaplen;
|
|
|
|
} else
|
|
|
|
#endif
|
|
|
|
{
|
|
|
|
pcap_encap = pcap_datalink(pch);
|
|
|
|
snaplen = pcap_snapshot(pch);
|
|
|
|
}
|
|
|
|
ld.linktype = wtap_pcap_encap_to_wtap_encap(pcap_encap);
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
if (ld.linktype == WTAP_ENCAP_UNKNOWN) {
|
2000-08-22 06:04:40 +00:00
|
|
|
snprintf(errmsg, sizeof errmsg,
|
|
|
|
"The network you're capturing from is of a type"
|
|
|
|
" that Ethereal doesn't support (data link type %d).", pcap_encap);
|
1999-09-23 07:04:23 +00:00
|
|
|
goto error;
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
}
|
2000-06-27 04:36:03 +00:00
|
|
|
ld.pdh = wtap_dump_fdopen(cfile.save_file_fd, WTAP_FILE_PCAP,
|
2000-07-31 04:03:31 +00:00
|
|
|
ld.linktype, snaplen, &err);
|
1999-08-02 06:08:58 +00:00
|
|
|
|
1999-09-23 07:04:23 +00:00
|
|
|
if (ld.pdh == NULL) {
|
|
|
|
/* We couldn't set up to write to the capture file. */
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
switch (err) {
|
|
|
|
|
|
|
|
case WTAP_ERR_CANT_OPEN:
|
|
|
|
strcpy(errmsg, "The file to which the capture would be saved"
|
|
|
|
" couldn't be created for some unknown reason.");
|
|
|
|
break;
|
|
|
|
|
|
|
|
case WTAP_ERR_SHORT_WRITE:
|
|
|
|
strcpy(errmsg, "A full header couldn't be written to the file"
|
|
|
|
" to which the capture would be saved.");
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
if (err < 0) {
|
2000-08-19 18:20:59 +00:00
|
|
|
snprintf(errmsg, sizeof(errmsg),
|
|
|
|
"The file to which the capture would be"
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
" saved (\"%s\") could not be opened: Error %d.",
|
2000-06-27 04:36:03 +00:00
|
|
|
cfile.save_file, err);
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
} else {
|
2000-08-19 18:20:59 +00:00
|
|
|
snprintf(errmsg, sizeof(errmsg),
|
|
|
|
"The file to which the capture would be"
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
" saved (\"%s\") could not be opened: %s.",
|
2000-06-27 04:36:03 +00:00
|
|
|
cfile.save_file, strerror(err));
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
}
|
|
|
|
break;
|
|
|
|
}
|
1999-09-23 07:04:23 +00:00
|
|
|
goto error;
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
}
|
|
|
|
|
Add routines to Wiretap to allow a client of Wiretap to get:
a pointer to the "wtap_pkthdr" structure for an open capture
file;
a pointer to the "wtap_pseudo_header" union for an open capture
file;
a pointer to the packet buffer for an open capture file;
so that a program using "wtap_read()" in a loop can get at those items.
Keep, in a "capture_file" structure, an indicator of whether:
no file is open;
a file is open, and being read;
a file is open, and is being read, but the user tried to quit
out of reading the file (e.g., by doing "File/Quit");
a file is open, and has been completely read.
Abort if we try to close a capture that's being read if the user hasn't
tried to quit out of the read.
Have "File/Quit" check if a file is being read; if so, just set the
state indicator to "user tried to quit out of it", so that the code
reading the file can do what's appropriate to clean up, rather than
closing the file out from under that code and causing crashes.
Have "read_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
close the capture and return an indication that the read was aborted by
the user. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "continue_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
return an indication that the read was aborted by the user if that
happened. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "finish_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
close the capture and return an indication that the read was aborted by
the user if that happened. Otherwise, return an indication of whether
the read completely succeeded or failed in the middle (and, if it
failed, return the error code through a pointer).
Have their callers check whether the read was aborted or not and, if it
was, bail out in the appropriate fashion (exit if it's reading a file
specified by "-r" on the command line; exit the main loop if it's
reading a file specified with File->Open; kill the capture child if it's
"continue_tail_cap_file()"; exit the main loop if it's
"finish_tail_cap_file()".
svn path=/trunk/; revision=2095
2000-06-27 07:13:42 +00:00
|
|
|
/* XXX - capture SIGTERM and close the capture, in case we're on a
|
|
|
|
Linux 2.0[.x] system and you have to explicitly close the capture
|
|
|
|
stream in order to turn promiscuous mode off? We need to do that
|
|
|
|
in other places as well - and I don't think that works all the
|
|
|
|
time in any case, due to libpcap bugs. */
|
|
|
|
|
1999-10-02 20:00:46 +00:00
|
|
|
if (capture_child) {
|
1999-09-23 07:04:23 +00:00
|
|
|
/* Well, we should be able to start capturing.
|
|
|
|
|
Add a new global flag "capture_child", which is TRUE if we're a child
process for a sync mode or fork mode capture.
Have that flag control whether we do things that *only* the parent or
*only* the child should do, rather than basing it solely on the setting
of "sync_mode" or "fork_mode" (or, in the case of stuff done in the
child process either in sync mode or fork mode, rather than basing it on
the setting of those flags at all).
Split "do_capture()" into a "run_capture()" routine that starts a
capture (possibly by forking off and execing a child process, if we're
supposed to do sync mode or fork mode captures), and that assumes the
file to which the capture is to write has already been opened and that
"cf.save_file_fd" is the file descriptor for that file, and a
"do_capture()" routine that creates a temporary file, getting an FD for
it, and calls "run_capture()".
Use "run_capture()", rather than "capture()", for "-k" captures, so that
it'll do the capture in a child process if "-S" or "-F" was specified
("do_capture()" won't do because "-k" captures should write to the file
specified by the "-w" flag, not some random temporary file).
For child process captures, however, just use "capture()" - the child
process shouldn't itself fork off a child if we're in sync or fork mode,
and should just write to the file whose file descriptor was specified by
the "-W" flag on the command line.
All this allows you to do "ethereal -S -w <file> -i <interface> -k" to
start a sync mode capture from the command line.
svn path=/trunk/; revision=740
1999-09-30 06:50:01 +00:00
|
|
|
This is the child process for a sync mode capture, so sync out
|
|
|
|
the capture file, so the header makes it to the file system,
|
|
|
|
and send a "capture started successfully and capture file created"
|
|
|
|
message to our parent so that they'll open the capture file and
|
|
|
|
update its windows to indicate that we have a live capture in
|
|
|
|
progress. */
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
fflush(wtap_dump_file(ld.pdh));
|
|
|
|
write(1, "0;", 2);
|
|
|
|
}
|
|
|
|
|
|
|
|
cap_w = gtk_window_new(GTK_WINDOW_TOPLEVEL);
|
2000-07-21 15:56:15 +00:00
|
|
|
gtk_window_set_title(GTK_WINDOW(cap_w), "Ethereal: Capture");
|
2000-07-05 02:52:39 +00:00
|
|
|
gtk_window_set_modal(GTK_WINDOW(cap_w), TRUE);
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
|
|
|
/* Container for capture display widgets */
|
|
|
|
main_vb = gtk_vbox_new(FALSE, 1);
|
|
|
|
gtk_container_border_width(GTK_CONTAINER(main_vb), 5);
|
|
|
|
gtk_container_add(GTK_CONTAINER(cap_w), main_vb);
|
|
|
|
gtk_widget_show(main_vb);
|
|
|
|
|
2000-10-21 04:20:07 +00:00
|
|
|
/* Individual statistic elements */
|
|
|
|
counts_tb = gtk_table_new(N_STATS, 3, TRUE);
|
|
|
|
gtk_box_pack_start(GTK_BOX(main_vb), counts_tb, TRUE, TRUE, 3);
|
|
|
|
gtk_widget_show(counts_tb);
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
2000-10-21 04:20:07 +00:00
|
|
|
for (i = 0; i < N_STATS; i++) {
|
|
|
|
stats[i].label = gtk_label_new(stats[i].title);
|
|
|
|
gtk_misc_set_alignment(GTK_MISC(stats[i].label), 0.0f, 0.0f);
|
2000-05-26 22:08:16 +00:00
|
|
|
|
2000-10-21 04:20:07 +00:00
|
|
|
stats[i].value = gtk_label_new("0");
|
|
|
|
gtk_misc_set_alignment(GTK_MISC(stats[i].value), 0.0f, 0.0f);
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
2000-10-21 04:20:07 +00:00
|
|
|
stats[i].percent = gtk_label_new("0.0%");
|
|
|
|
gtk_misc_set_alignment(GTK_MISC(stats[i].percent), 0.0f, 0.0f);
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
2000-10-21 04:20:07 +00:00
|
|
|
gtk_table_attach_defaults(GTK_TABLE(counts_tb),
|
|
|
|
stats[i].label, 0, 1, i, i + 1);
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
2000-10-21 04:20:07 +00:00
|
|
|
gtk_table_attach(GTK_TABLE(counts_tb),
|
|
|
|
stats[i].value,
|
|
|
|
1, 2, i, i + 1, 0, 0, 5, 0);
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
2000-10-21 04:20:07 +00:00
|
|
|
gtk_table_attach_defaults(GTK_TABLE(counts_tb),
|
|
|
|
stats[i].percent, 2, 3, i, i + 1);
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
2000-10-21 04:20:07 +00:00
|
|
|
gtk_widget_show(stats[i].label);
|
|
|
|
gtk_widget_show(stats[i].value);
|
|
|
|
gtk_widget_show(stats[i].percent);
|
|
|
|
}
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
2000-01-30 17:10:29 +00:00
|
|
|
/* allow user to either click a stop button, or the close button on
|
|
|
|
the window to stop a capture in progress. */
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
stop_bt = gtk_button_new_with_label ("Stop");
|
|
|
|
gtk_signal_connect(GTK_OBJECT(stop_bt), "clicked",
|
|
|
|
GTK_SIGNAL_FUNC(capture_stop_cb), (gpointer) &ld);
|
2000-01-30 17:10:29 +00:00
|
|
|
gtk_signal_connect(GTK_OBJECT(cap_w), "delete_event",
|
|
|
|
GTK_SIGNAL_FUNC(capture_delete_cb), (gpointer) &ld);
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
gtk_box_pack_end(GTK_BOX(main_vb), stop_bt, FALSE, FALSE, 3);
|
|
|
|
GTK_WIDGET_SET_FLAGS(stop_bt, GTK_CAN_DEFAULT);
|
|
|
|
gtk_widget_grab_default(stop_bt);
|
|
|
|
GTK_WIDGET_SET_FLAGS(stop_bt, GTK_CAN_DEFAULT);
|
|
|
|
gtk_widget_grab_default(stop_bt);
|
|
|
|
gtk_widget_show(stop_bt);
|
|
|
|
|
|
|
|
gtk_widget_show(cap_w);
|
|
|
|
|
|
|
|
upd_time = time(NULL);
|
Enough is enough. Requiring anybody who uses Ethereal on Linux to
update their libpcap probably isn't going to scale - the increasing
frequency with which "Ethereal hangs when I try to capture packets"
shows up on "ethereal-dev" suggests that, unless and until a libpcap
with the "select()" in it becomes ubiquitous on Linux, that'll be the
source of a constant support burden - so we'll just put the "select()"
in Ethereal if it's being built for Linux.
(Putting it in for platforms where the read timeout argument to
"pcap_open_live()" works adds an extra useless system call at best and,
at worst, could make Ethereal not work - "select()" doesn't work on
"/dev/bpf" devices on FreeBSD 3.3, at least, unless you're in "immediate
mode", and, whilst "immediate mode" would make Ethereal respond more
quickly when packets arrive, it might cause Ethereal to respond too
quickly, doing reads for every new packet rather than waiting for
multiple packets to arrive and reading them all with one "read()", which
appears to be at least part of the intent of the read timeout on
"/dev/bpf" devices in BSD.)
svn path=/trunk/; revision=1451
2000-01-12 06:56:32 +00:00
|
|
|
#ifdef linux
|
2000-07-30 16:54:12 +00:00
|
|
|
if (!ld.from_pipe) pcap_fd = pcap_fileno(pch);
|
Enough is enough. Requiring anybody who uses Ethereal on Linux to
update their libpcap probably isn't going to scale - the increasing
frequency with which "Ethereal hangs when I try to capture packets"
shows up on "ethereal-dev" suggests that, unless and until a libpcap
with the "select()" in it becomes ubiquitous on Linux, that'll be the
source of a constant support burden - so we'll just put the "select()"
in Ethereal if it's being built for Linux.
(Putting it in for platforms where the read timeout argument to
"pcap_open_live()" works adds an extra useless system call at best and,
at worst, could make Ethereal not work - "select()" doesn't work on
"/dev/bpf" devices on FreeBSD 3.3, at least, unless you're in "immediate
mode", and, whilst "immediate mode" would make Ethereal respond more
quickly when packets arrive, it might cause Ethereal to respond too
quickly, doing reads for every new packet rather than waiting for
multiple packets to arrive and reading them all with one "read()", which
appears to be at least part of the intent of the read timeout on
"/dev/bpf" devices in BSD.)
svn path=/trunk/; revision=1451
2000-01-12 06:56:32 +00:00
|
|
|
#endif
|
2000-10-11 06:01:16 +00:00
|
|
|
|
|
|
|
#ifndef _WIN32
|
|
|
|
/*
|
|
|
|
* Catch SIGUSR1, so that we exit cleanly if the parent process
|
|
|
|
* kills us with it due to the user selecting "Capture->Stop".
|
|
|
|
*/
|
|
|
|
signal(SIGUSR1, stop_capture);
|
|
|
|
#endif
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
while (ld.go) {
|
|
|
|
while (gtk_events_pending()) gtk_main_iteration();
|
2000-07-30 16:54:12 +00:00
|
|
|
|
2000-07-31 04:03:31 +00:00
|
|
|
#ifndef _WIN32
|
2000-07-30 16:54:12 +00:00
|
|
|
if (ld.from_pipe) {
|
|
|
|
FD_ZERO(&set1);
|
|
|
|
FD_SET(pipe_fd, &set1);
|
|
|
|
timeout.tv_sec = 0;
|
|
|
|
timeout.tv_usec = CAP_READ_TIMEOUT*1000;
|
|
|
|
if (select(pipe_fd+1, &set1, NULL, NULL, &timeout) != 0) {
|
|
|
|
/*
|
|
|
|
* "select()" says we can read from the pipe without blocking; go for
|
|
|
|
* it. We are not sure we can read a whole record, but at least the
|
|
|
|
* begninning of one. pipe_dispatch() will block reading the whole
|
|
|
|
* record.
|
|
|
|
*/
|
|
|
|
inpkts = pipe_dispatch(pipe_fd, &ld, &hdr);
|
|
|
|
} else
|
|
|
|
inpkts = 0;
|
|
|
|
}
|
2000-07-31 04:03:31 +00:00
|
|
|
else
|
|
|
|
#endif
|
|
|
|
{
|
Enough is enough. Requiring anybody who uses Ethereal on Linux to
update their libpcap probably isn't going to scale - the increasing
frequency with which "Ethereal hangs when I try to capture packets"
shows up on "ethereal-dev" suggests that, unless and until a libpcap
with the "select()" in it becomes ubiquitous on Linux, that'll be the
source of a constant support burden - so we'll just put the "select()"
in Ethereal if it's being built for Linux.
(Putting it in for platforms where the read timeout argument to
"pcap_open_live()" works adds an extra useless system call at best and,
at worst, could make Ethereal not work - "select()" doesn't work on
"/dev/bpf" devices on FreeBSD 3.3, at least, unless you're in "immediate
mode", and, whilst "immediate mode" would make Ethereal respond more
quickly when packets arrive, it might cause Ethereal to respond too
quickly, doing reads for every new packet rather than waiting for
multiple packets to arrive and reading them all with one "read()", which
appears to be at least part of the intent of the read timeout on
"/dev/bpf" devices in BSD.)
svn path=/trunk/; revision=1451
2000-01-12 06:56:32 +00:00
|
|
|
#ifdef linux
|
|
|
|
/*
|
2000-07-30 16:54:12 +00:00
|
|
|
* Sigh. The semantics of the read timeout argument to
|
|
|
|
* "pcap_open_live()" aren't particularly well specified by
|
|
|
|
* the "pcap" man page - at least with the BSD BPF code, the
|
|
|
|
* intent appears to be, at least in part, a way of cutting
|
|
|
|
* down the number of reads done on a capture, by blocking
|
|
|
|
* until the buffer fills or a timer expires - and the Linux
|
|
|
|
* libpcap doesn't actually support it, so we can't use it
|
|
|
|
* to break out of the "pcap_dispatch()" every 1/4 of a second
|
|
|
|
* or so.
|
|
|
|
*
|
|
|
|
* Thus, on Linux, we do a "select()" on the file descriptor for the
|
|
|
|
* capture, with a timeout of CAP_READ_TIMEOUT milliseconds, or
|
|
|
|
* CAP_READ_TIMEOUT*1000 microseconds.
|
Enough is enough. Requiring anybody who uses Ethereal on Linux to
update their libpcap probably isn't going to scale - the increasing
frequency with which "Ethereal hangs when I try to capture packets"
shows up on "ethereal-dev" suggests that, unless and until a libpcap
with the "select()" in it becomes ubiquitous on Linux, that'll be the
source of a constant support burden - so we'll just put the "select()"
in Ethereal if it's being built for Linux.
(Putting it in for platforms where the read timeout argument to
"pcap_open_live()" works adds an extra useless system call at best and,
at worst, could make Ethereal not work - "select()" doesn't work on
"/dev/bpf" devices on FreeBSD 3.3, at least, unless you're in "immediate
mode", and, whilst "immediate mode" would make Ethereal respond more
quickly when packets arrive, it might cause Ethereal to respond too
quickly, doing reads for every new packet rather than waiting for
multiple packets to arrive and reading them all with one "read()", which
appears to be at least part of the intent of the read timeout on
"/dev/bpf" devices in BSD.)
svn path=/trunk/; revision=1451
2000-01-12 06:56:32 +00:00
|
|
|
*/
|
2000-07-30 16:54:12 +00:00
|
|
|
FD_ZERO(&set1);
|
|
|
|
FD_SET(pcap_fd, &set1);
|
|
|
|
timeout.tv_sec = 0;
|
|
|
|
timeout.tv_usec = CAP_READ_TIMEOUT*1000;
|
|
|
|
if (select(pcap_fd+1, &set1, NULL, NULL, &timeout) != 0) {
|
|
|
|
/*
|
|
|
|
* "select()" says we can read from it without blocking; go for
|
|
|
|
* it.
|
|
|
|
*/
|
|
|
|
inpkts = pcap_dispatch(pch, 1, capture_pcap_cb, (u_char *) &ld);
|
|
|
|
} else
|
|
|
|
inpkts = 0;
|
Enough is enough. Requiring anybody who uses Ethereal on Linux to
update their libpcap probably isn't going to scale - the increasing
frequency with which "Ethereal hangs when I try to capture packets"
shows up on "ethereal-dev" suggests that, unless and until a libpcap
with the "select()" in it becomes ubiquitous on Linux, that'll be the
source of a constant support burden - so we'll just put the "select()"
in Ethereal if it's being built for Linux.
(Putting it in for platforms where the read timeout argument to
"pcap_open_live()" works adds an extra useless system call at best and,
at worst, could make Ethereal not work - "select()" doesn't work on
"/dev/bpf" devices on FreeBSD 3.3, at least, unless you're in "immediate
mode", and, whilst "immediate mode" would make Ethereal respond more
quickly when packets arrive, it might cause Ethereal to respond too
quickly, doing reads for every new packet rather than waiting for
multiple packets to arrive and reading them all with one "read()", which
appears to be at least part of the intent of the read timeout on
"/dev/bpf" devices in BSD.)
svn path=/trunk/; revision=1451
2000-01-12 06:56:32 +00:00
|
|
|
#else
|
2000-07-30 16:54:12 +00:00
|
|
|
inpkts = pcap_dispatch(pch, 1, capture_pcap_cb, (u_char *) &ld);
|
Enough is enough. Requiring anybody who uses Ethereal on Linux to
update their libpcap probably isn't going to scale - the increasing
frequency with which "Ethereal hangs when I try to capture packets"
shows up on "ethereal-dev" suggests that, unless and until a libpcap
with the "select()" in it becomes ubiquitous on Linux, that'll be the
source of a constant support burden - so we'll just put the "select()"
in Ethereal if it's being built for Linux.
(Putting it in for platforms where the read timeout argument to
"pcap_open_live()" works adds an extra useless system call at best and,
at worst, could make Ethereal not work - "select()" doesn't work on
"/dev/bpf" devices on FreeBSD 3.3, at least, unless you're in "immediate
mode", and, whilst "immediate mode" would make Ethereal respond more
quickly when packets arrive, it might cause Ethereal to respond too
quickly, doing reads for every new packet rather than waiting for
multiple packets to arrive and reading them all with one "read()", which
appears to be at least part of the intent of the read timeout on
"/dev/bpf" devices in BSD.)
svn path=/trunk/; revision=1451
2000-01-12 06:56:32 +00:00
|
|
|
#endif
|
2000-07-30 16:54:12 +00:00
|
|
|
}
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
if (inpkts > 0)
|
|
|
|
ld.sync_packets += inpkts;
|
|
|
|
/* Only update once a second so as not to overload slow displays */
|
|
|
|
cur_time = time(NULL);
|
|
|
|
if (cur_time > upd_time) {
|
|
|
|
upd_time = cur_time;
|
|
|
|
|
2000-10-21 04:20:07 +00:00
|
|
|
for (i = 0; i < N_STATS; i++) {
|
|
|
|
snprintf(label_str, sizeof(label_str), "%d",
|
|
|
|
*stats[i].value_ptr);
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
2000-10-21 04:20:07 +00:00
|
|
|
gtk_label_set(GTK_LABEL(stats[i].value), label_str);
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
2000-10-21 04:20:07 +00:00
|
|
|
snprintf(label_str, sizeof(label_str), "(%.1f%%)",
|
|
|
|
pct(*stats[i].value_ptr, ld.counts.total));
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
2000-10-21 04:20:07 +00:00
|
|
|
gtk_label_set(GTK_LABEL(stats[i].percent), label_str);
|
|
|
|
}
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
|
|
|
/* do sync here, too */
|
|
|
|
fflush(wtap_dump_file(ld.pdh));
|
1999-10-02 20:00:46 +00:00
|
|
|
if (capture_child && ld.sync_packets) {
|
Add a new global flag "capture_child", which is TRUE if we're a child
process for a sync mode or fork mode capture.
Have that flag control whether we do things that *only* the parent or
*only* the child should do, rather than basing it solely on the setting
of "sync_mode" or "fork_mode" (or, in the case of stuff done in the
child process either in sync mode or fork mode, rather than basing it on
the setting of those flags at all).
Split "do_capture()" into a "run_capture()" routine that starts a
capture (possibly by forking off and execing a child process, if we're
supposed to do sync mode or fork mode captures), and that assumes the
file to which the capture is to write has already been opened and that
"cf.save_file_fd" is the file descriptor for that file, and a
"do_capture()" routine that creates a temporary file, getting an FD for
it, and calls "run_capture()".
Use "run_capture()", rather than "capture()", for "-k" captures, so that
it'll do the capture in a child process if "-S" or "-F" was specified
("do_capture()" won't do because "-k" captures should write to the file
specified by the "-w" flag, not some random temporary file).
For child process captures, however, just use "capture()" - the child
process shouldn't itself fork off a child if we're in sync or fork mode,
and should just write to the file whose file descriptor was specified by
the "-W" flag on the command line.
All this allows you to do "ethereal -S -w <file> -i <interface> -k" to
start a sync mode capture from the command line.
svn path=/trunk/; revision=740
1999-09-30 06:50:01 +00:00
|
|
|
/* This is the child process for a sync mode capture, so send
|
|
|
|
our parent a message saying we've written out "ld.sync_packets"
|
|
|
|
packets to the capture file. */
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
char tmp[20];
|
|
|
|
sprintf(tmp, "%d*", ld.sync_packets);
|
|
|
|
write(1, tmp, strlen(tmp));
|
|
|
|
ld.sync_packets = 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
1999-09-23 07:04:23 +00:00
|
|
|
if (!wtap_dump_close(ld.pdh, &err)) {
|
|
|
|
/* XXX - in fork mode, this may not pop up, or, if it does,
|
|
|
|
it may disappear as soon as we exit.
|
|
|
|
|
|
|
|
We should have the parent process, while it's reading
|
|
|
|
the packet count update messages, catch error messages
|
|
|
|
and pop up a message box if it sees one. */
|
|
|
|
switch (err) {
|
|
|
|
|
|
|
|
case WTAP_ERR_CANT_CLOSE:
|
|
|
|
simple_dialog(ESD_TYPE_WARN, NULL,
|
|
|
|
"The file to which the capture was being saved"
|
|
|
|
" couldn't be closed for some unknown reason.");
|
|
|
|
break;
|
|
|
|
|
|
|
|
case WTAP_ERR_SHORT_WRITE:
|
|
|
|
simple_dialog(ESD_TYPE_WARN, NULL,
|
|
|
|
"Not all the data could be written to the file"
|
|
|
|
" to which the capture was being saved.");
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
1999-11-25 22:37:53 +00:00
|
|
|
simple_dialog(ESD_TYPE_WARN, NULL,
|
1999-09-23 07:04:23 +00:00
|
|
|
"The file to which the capture was being"
|
|
|
|
" saved (\"%s\") could not be closed: %s.",
|
2000-06-27 04:36:03 +00:00
|
|
|
cfile.save_file, wtap_strerror(err));
|
1999-09-23 07:04:23 +00:00
|
|
|
break;
|
1999-08-18 04:41:20 +00:00
|
|
|
}
|
1998-09-16 02:39:15 +00:00
|
|
|
}
|
2000-07-31 04:03:31 +00:00
|
|
|
#ifndef _WIN32
|
2000-07-30 16:54:12 +00:00
|
|
|
if (ld.from_pipe)
|
|
|
|
close(pipe_fd);
|
|
|
|
else
|
2000-07-31 04:03:31 +00:00
|
|
|
#endif
|
2000-07-30 16:54:12 +00:00
|
|
|
pcap_close(pch);
|
1998-09-16 02:39:15 +00:00
|
|
|
|
2000-09-14 22:59:08 +00:00
|
|
|
#ifdef WIN32
|
|
|
|
/* Shut down windows sockets */
|
|
|
|
WSACleanup();
|
|
|
|
#endif
|
|
|
|
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
gtk_grab_remove(GTK_WIDGET(cap_w));
|
|
|
|
gtk_widget_destroy(GTK_WIDGET(cap_w));
|
|
|
|
|
1999-10-02 06:00:07 +00:00
|
|
|
return TRUE;
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
|
1999-09-23 07:04:23 +00:00
|
|
|
error:
|
2000-05-19 22:37:57 +00:00
|
|
|
/* We can't use the save file, and we have no wtap_dump stream
|
|
|
|
to close in order to close it, so close the FD directly. */
|
2000-06-27 04:36:03 +00:00
|
|
|
close(cfile.save_file_fd);
|
2000-05-19 22:37:57 +00:00
|
|
|
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
/* We couldn't even start the capture, so get rid of the capture
|
|
|
|
file. */
|
2000-06-27 04:36:03 +00:00
|
|
|
unlink(cfile.save_file); /* silently ignore error */
|
|
|
|
g_free(cfile.save_file);
|
|
|
|
cfile.save_file = NULL;
|
1999-10-02 20:00:46 +00:00
|
|
|
if (capture_child) {
|
Add a new global flag "capture_child", which is TRUE if we're a child
process for a sync mode or fork mode capture.
Have that flag control whether we do things that *only* the parent or
*only* the child should do, rather than basing it solely on the setting
of "sync_mode" or "fork_mode" (or, in the case of stuff done in the
child process either in sync mode or fork mode, rather than basing it on
the setting of those flags at all).
Split "do_capture()" into a "run_capture()" routine that starts a
capture (possibly by forking off and execing a child process, if we're
supposed to do sync mode or fork mode captures), and that assumes the
file to which the capture is to write has already been opened and that
"cf.save_file_fd" is the file descriptor for that file, and a
"do_capture()" routine that creates a temporary file, getting an FD for
it, and calls "run_capture()".
Use "run_capture()", rather than "capture()", for "-k" captures, so that
it'll do the capture in a child process if "-S" or "-F" was specified
("do_capture()" won't do because "-k" captures should write to the file
specified by the "-w" flag, not some random temporary file).
For child process captures, however, just use "capture()" - the child
process shouldn't itself fork off a child if we're in sync or fork mode,
and should just write to the file whose file descriptor was specified by
the "-W" flag on the command line.
All this allows you to do "ethereal -S -w <file> -i <interface> -k" to
start a sync mode capture from the command line.
svn path=/trunk/; revision=740
1999-09-30 06:50:01 +00:00
|
|
|
/* This is the child process for a sync mode capture.
|
|
|
|
Send the error message to our parent, so they can display a
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
dialog box containing it. */
|
2000-05-06 05:08:39 +00:00
|
|
|
send_errmsg_to_parent(errmsg);
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
} else {
|
|
|
|
/* Display the dialog box ourselves; there's no parent. */
|
2000-07-20 05:10:02 +00:00
|
|
|
simple_dialog(ESD_TYPE_CRIT, NULL, errmsg);
|
Improve the alert boxes put up for file open/read/write errors. (Some
influence came from
http://developer.apple.com/techpubs/mac/HIGuidelines/HIGuidelines-232.html
which has a section on dialog box and alert box messages. However,
we're largely dealing with technoids, not with The Rest Of Us, so I
didn't go as far as one perhaps should.)
Unfortunately, it looks like it's a bit more work to arrange that, if
you give a bad file name to the "-r" flag, the dialog box pop up only
*after* the main window pops up - it has the annoying habit of popping
up *before* the main window pops up, and sometimes getting *obscured* by
it, when I do that. The removal of the dialog box stuff from
"load_cap_file()" was intended to facilitate that work. (It might also
be nice if, when an open from the "File/Open" menu item fails, we keep
the file selection box open, and give the user a chance to correct
typos, choose another file name, etc.)
svn path=/trunk/; revision=310
1999-06-12 09:10:20 +00:00
|
|
|
}
|
2000-07-30 16:54:12 +00:00
|
|
|
if (pch != NULL && !ld.from_pipe)
|
Move the toolkit-independent code to create a temporary capture file,
and to fork off and run a separate copy of "ethereal" for "-S" and "-F"
captures or just call "capture()" otherwise, out of "gtk/capture_dlg.c"
and into a routine in "capture.c".
If the attempt to create said temporary capture file fails, pop up a
dialog box and don't do the capture.
Have the child capture process send a message upstream after it either
successfully starts the capture and syncs out the header of the capture
file, or fails to start the capture; the message indicates whether it
succeeded or failed, and, if it failed, includes a failure message.
This:
avoids the use of a signal, and thus means we don't have to
worry about whether to capture the signal, or whether to start
or stop capturing depending on whether this particular capture
is in sync mode or not;
lets us pop up the message box for the error in the parent
process if we're in sync mode, rather than doing it in the
child, which didn't work well.
Add a check button to the Capture/Start dialog box, so that we can
control, for each capture, whether it's to be done in sync mode or not.
svn path=/trunk/; revision=708
1999-09-23 06:27:27 +00:00
|
|
|
pcap_close(pch);
|
|
|
|
|
1999-10-02 06:00:07 +00:00
|
|
|
return FALSE;
|
1998-09-16 02:39:15 +00:00
|
|
|
}
|
|
|
|
|
2000-05-06 05:08:39 +00:00
|
|
|
static void
|
|
|
|
send_errmsg_to_parent(const char *errmsg)
|
|
|
|
{
|
|
|
|
int msglen = strlen(errmsg);
|
|
|
|
char lenbuf[10+1+1];
|
|
|
|
|
|
|
|
sprintf(lenbuf, "%u;", msglen);
|
|
|
|
write(1, lenbuf, strlen(lenbuf));
|
|
|
|
write(1, errmsg, msglen);
|
|
|
|
}
|
|
|
|
|
1999-06-19 01:14:51 +00:00
|
|
|
static float
|
1998-09-16 02:39:15 +00:00
|
|
|
pct(gint num, gint denom) {
|
|
|
|
if (denom) {
|
|
|
|
return (float) num * 100.0 / (float) denom;
|
|
|
|
} else {
|
|
|
|
return 0.0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2000-10-11 06:01:16 +00:00
|
|
|
static void
|
|
|
|
stop_capture(int signo)
|
|
|
|
{
|
|
|
|
ld.go = FALSE;
|
|
|
|
}
|
|
|
|
|
2000-01-30 17:10:29 +00:00
|
|
|
static void
|
|
|
|
capture_delete_cb(GtkWidget *w, GdkEvent *event, gpointer data) {
|
|
|
|
capture_stop_cb(NULL, data);
|
|
|
|
}
|
|
|
|
|
1999-06-19 01:14:51 +00:00
|
|
|
static void
|
1998-09-16 02:39:15 +00:00
|
|
|
capture_stop_cb(GtkWidget *w, gpointer data) {
|
|
|
|
loop_data *ld = (loop_data *) data;
|
|
|
|
|
|
|
|
ld->go = FALSE;
|
|
|
|
}
|
|
|
|
|
2000-10-11 06:01:16 +00:00
|
|
|
void
|
|
|
|
capture_stop(void)
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* XXX - find some way of signaling the child in Win32.
|
|
|
|
*/
|
|
|
|
#ifndef _WIN32
|
|
|
|
if (fork_child != -1)
|
|
|
|
kill(fork_child, SIGUSR1);
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
1999-06-19 01:14:51 +00:00
|
|
|
static void
|
1998-09-16 02:39:15 +00:00
|
|
|
capture_pcap_cb(u_char *user, const struct pcap_pkthdr *phdr,
|
|
|
|
const u_char *pd) {
|
Add to Wiretap the ability to write capture files; for now, it can only
write them in "libpcap" format, but the mechanism can have other formats
added.
When creating the temporary file for a capture, use "create_tempfile()",
to close a security hole opened by the fact that "tempnam()" creates a
temporary file, but doesn't open it, and we open the file with the name
it gives us - somebody could remove the file and plant a link to some
file, and, if as may well be the case when Ethereal is capturing
packets, it's running as "root", that means we write a capture on top of
that file.... (The aforementioned changes to Wiretap let you open a
capture file for writing given an file descriptor, "fdopen()"-style,
which this change requires.)
svn path=/trunk/; revision=509
1999-08-18 04:17:38 +00:00
|
|
|
struct wtap_pkthdr whdr;
|
1998-09-16 02:39:15 +00:00
|
|
|
loop_data *ld = (loop_data *) user;
|
1999-08-18 04:41:20 +00:00
|
|
|
int err;
|
Add to Wiretap the ability to write capture files; for now, it can only
write them in "libpcap" format, but the mechanism can have other formats
added.
When creating the temporary file for a capture, use "create_tempfile()",
to close a security hole opened by the fact that "tempnam()" creates a
temporary file, but doesn't open it, and we open the file with the name
it gives us - somebody could remove the file and plant a link to some
file, and, if as may well be the case when Ethereal is capturing
packets, it's running as "root", that means we write a capture on top of
that file.... (The aforementioned changes to Wiretap let you open a
capture file for writing given an file descriptor, "fdopen()"-style,
which this change requires.)
svn path=/trunk/; revision=509
1999-08-18 04:17:38 +00:00
|
|
|
|
1999-02-09 00:35:38 +00:00
|
|
|
if ((++ld->counts.total >= ld->max) && (ld->max > 0))
|
1998-09-29 21:39:29 +00:00
|
|
|
{
|
|
|
|
ld->go = FALSE;
|
|
|
|
}
|
Add to Wiretap the ability to write capture files; for now, it can only
write them in "libpcap" format, but the mechanism can have other formats
added.
When creating the temporary file for a capture, use "create_tempfile()",
to close a security hole opened by the fact that "tempnam()" creates a
temporary file, but doesn't open it, and we open the file with the name
it gives us - somebody could remove the file and plant a link to some
file, and, if as may well be the case when Ethereal is capturing
packets, it's running as "root", that means we write a capture on top of
that file.... (The aforementioned changes to Wiretap let you open a
capture file for writing given an file descriptor, "fdopen()"-style,
which this change requires.)
svn path=/trunk/; revision=509
1999-08-18 04:17:38 +00:00
|
|
|
if (ld->pdh) {
|
2000-01-26 23:09:21 +00:00
|
|
|
/* "phdr->ts" may not necessarily be a "struct timeval" - it may
|
|
|
|
be a "struct bpf_timeval", with member sizes wired to 32
|
|
|
|
bits - and we may go that way ourselves in the future, so
|
|
|
|
copy the members individually. */
|
|
|
|
whdr.ts.tv_sec = phdr->ts.tv_sec;
|
|
|
|
whdr.ts.tv_usec = phdr->ts.tv_usec;
|
Add to Wiretap the ability to write capture files; for now, it can only
write them in "libpcap" format, but the mechanism can have other formats
added.
When creating the temporary file for a capture, use "create_tempfile()",
to close a security hole opened by the fact that "tempnam()" creates a
temporary file, but doesn't open it, and we open the file with the name
it gives us - somebody could remove the file and plant a link to some
file, and, if as may well be the case when Ethereal is capturing
packets, it's running as "root", that means we write a capture on top of
that file.... (The aforementioned changes to Wiretap let you open a
capture file for writing given an file descriptor, "fdopen()"-style,
which this change requires.)
svn path=/trunk/; revision=509
1999-08-18 04:17:38 +00:00
|
|
|
whdr.caplen = phdr->caplen;
|
|
|
|
whdr.len = phdr->len;
|
DLT_NULL, from "libpcap", means different things on different platforms
and in different capture files; throw in some heuristics to try to
figure out whether the 4-byte header is:
1) PPP-over-HDLC (some version of ISDN4BSD?);
2) big-endian AF_ value (BSD on big-endian platforms);
3) little-endian AF_ value (BSD on little-endian platforms);
4) two octets of 0 followed by an Ethernet type (Linux, at least
on little-endian platforms, as mutated by "libpcap").
Make a separate Wiretap encapsulation type, WTAP_ENCAP_NULL,
corresponding to DLT_NULL.
Have the PPP code dissect the frame if it's PPP-over-HDLC, and have
"ethertype()" dissect the Ethernet type and the rest of the packet if
it's a Linux-style header; dissect it ourselves only if it's an AF_
value.
Have Wiretap impose a maximum packet size of 65535 bytes, so that it
fails more gracefully when handed a corrupt "libpcap" capture file
(other capture file formats with more than a 16-bit capture length
field, if any, will have that check added later), and put that size in
"wtap.h" and have Ethereal use it as its notion of a maximum packet
size.
Have Ethereal put up a "this file appears to be damaged or corrupt"
message box if Wiretap returns a WTAP_ERR_BAD_RECORD error when opening
or reading a capture file.
Include loopback interfaces in the list of interfaces offered by the
"Capture" dialog box, but put them at the end of the list so that it
doesn't default to a loopback interface unless there are no other
interfaces. Also, don't require that an interface in the list have an
IP address associated with it, and only put one entry in the list for a
given interface (SIOCGIFCONF returns one entry per interface *address*,
not per *interface* - and even if you were to use only IP addresses, an
interface could conceivably have more than one IP address).
Exclusively use Wiretap encapsulation types internally, even when
capturing; don't use DLT_ types.
svn path=/trunk/; revision=540
1999-08-22 00:47:56 +00:00
|
|
|
whdr.pkt_encap = ld->linktype;
|
Add to Wiretap the ability to write capture files; for now, it can only
write them in "libpcap" format, but the mechanism can have other formats
added.
When creating the temporary file for a capture, use "create_tempfile()",
to close a security hole opened by the fact that "tempnam()" creates a
temporary file, but doesn't open it, and we open the file with the name
it gives us - somebody could remove the file and plant a link to some
file, and, if as may well be the case when Ethereal is capturing
packets, it's running as "root", that means we write a capture on top of
that file.... (The aforementioned changes to Wiretap let you open a
capture file for writing given an file descriptor, "fdopen()"-style,
which this change requires.)
svn path=/trunk/; revision=509
1999-08-18 04:17:38 +00:00
|
|
|
|
1999-08-18 04:41:20 +00:00
|
|
|
/* XXX - do something if this fails */
|
2000-05-18 09:09:50 +00:00
|
|
|
wtap_dump(ld->pdh, &whdr, NULL, pd, &err);
|
Add to Wiretap the ability to write capture files; for now, it can only
write them in "libpcap" format, but the mechanism can have other formats
added.
When creating the temporary file for a capture, use "create_tempfile()",
to close a security hole opened by the fact that "tempnam()" creates a
temporary file, but doesn't open it, and we open the file with the name
it gives us - somebody could remove the file and plant a link to some
file, and, if as may well be the case when Ethereal is capturing
packets, it's running as "root", that means we write a capture on top of
that file.... (The aforementioned changes to Wiretap let you open a
capture file for writing given an file descriptor, "fdopen()"-style,
which this change requires.)
svn path=/trunk/; revision=509
1999-08-18 04:17:38 +00:00
|
|
|
}
|
2000-01-23 08:55:37 +00:00
|
|
|
|
|
|
|
/* Set the initial payload to the packet length, and the initial
|
|
|
|
captured payload to the capture length (other protocols may
|
|
|
|
reduce them if their headers say they're less). */
|
|
|
|
pi.len = phdr->len;
|
|
|
|
pi.captured_len = phdr->caplen;
|
1999-08-10 11:08:38 +00:00
|
|
|
|
1999-02-09 00:35:38 +00:00
|
|
|
switch (ld->linktype) {
|
DLT_NULL, from "libpcap", means different things on different platforms
and in different capture files; throw in some heuristics to try to
figure out whether the 4-byte header is:
1) PPP-over-HDLC (some version of ISDN4BSD?);
2) big-endian AF_ value (BSD on big-endian platforms);
3) little-endian AF_ value (BSD on little-endian platforms);
4) two octets of 0 followed by an Ethernet type (Linux, at least
on little-endian platforms, as mutated by "libpcap").
Make a separate Wiretap encapsulation type, WTAP_ENCAP_NULL,
corresponding to DLT_NULL.
Have the PPP code dissect the frame if it's PPP-over-HDLC, and have
"ethertype()" dissect the Ethernet type and the rest of the packet if
it's a Linux-style header; dissect it ourselves only if it's an AF_
value.
Have Wiretap impose a maximum packet size of 65535 bytes, so that it
fails more gracefully when handed a corrupt "libpcap" capture file
(other capture file formats with more than a 16-bit capture length
field, if any, will have that check added later), and put that size in
"wtap.h" and have Ethereal use it as its notion of a maximum packet
size.
Have Ethereal put up a "this file appears to be damaged or corrupt"
message box if Wiretap returns a WTAP_ERR_BAD_RECORD error when opening
or reading a capture file.
Include loopback interfaces in the list of interfaces offered by the
"Capture" dialog box, but put them at the end of the list so that it
doesn't default to a loopback interface unless there are no other
interfaces. Also, don't require that an interface in the list have an
IP address associated with it, and only put one entry in the list for a
given interface (SIOCGIFCONF returns one entry per interface *address*,
not per *interface* - and even if you were to use only IP addresses, an
interface could conceivably have more than one IP address).
Exclusively use Wiretap encapsulation types internally, even when
capturing; don't use DLT_ types.
svn path=/trunk/; revision=540
1999-08-22 00:47:56 +00:00
|
|
|
case WTAP_ENCAP_ETHERNET:
|
2000-01-23 08:55:37 +00:00
|
|
|
capture_eth(pd, 0, &ld->counts);
|
1999-02-09 00:35:38 +00:00
|
|
|
break;
|
DLT_NULL, from "libpcap", means different things on different platforms
and in different capture files; throw in some heuristics to try to
figure out whether the 4-byte header is:
1) PPP-over-HDLC (some version of ISDN4BSD?);
2) big-endian AF_ value (BSD on big-endian platforms);
3) little-endian AF_ value (BSD on little-endian platforms);
4) two octets of 0 followed by an Ethernet type (Linux, at least
on little-endian platforms, as mutated by "libpcap").
Make a separate Wiretap encapsulation type, WTAP_ENCAP_NULL,
corresponding to DLT_NULL.
Have the PPP code dissect the frame if it's PPP-over-HDLC, and have
"ethertype()" dissect the Ethernet type and the rest of the packet if
it's a Linux-style header; dissect it ourselves only if it's an AF_
value.
Have Wiretap impose a maximum packet size of 65535 bytes, so that it
fails more gracefully when handed a corrupt "libpcap" capture file
(other capture file formats with more than a 16-bit capture length
field, if any, will have that check added later), and put that size in
"wtap.h" and have Ethereal use it as its notion of a maximum packet
size.
Have Ethereal put up a "this file appears to be damaged or corrupt"
message box if Wiretap returns a WTAP_ERR_BAD_RECORD error when opening
or reading a capture file.
Include loopback interfaces in the list of interfaces offered by the
"Capture" dialog box, but put them at the end of the list so that it
doesn't default to a loopback interface unless there are no other
interfaces. Also, don't require that an interface in the list have an
IP address associated with it, and only put one entry in the list for a
given interface (SIOCGIFCONF returns one entry per interface *address*,
not per *interface* - and even if you were to use only IP addresses, an
interface could conceivably have more than one IP address).
Exclusively use Wiretap encapsulation types internally, even when
capturing; don't use DLT_ types.
svn path=/trunk/; revision=540
1999-08-22 00:47:56 +00:00
|
|
|
case WTAP_ENCAP_FDDI:
|
Add a new Wiretap encapsulation type WTAP_ENCAP_FDDI_BITSWAPPED, meaning
"FDDI with the MAC addresses bit-swapped"; whether the MAC addresses are
bit-swapped is a property of the machine on which the capture was taken,
not of the machine on which the capture is being read - right now, none
of the capture file formats we read indicate whether FDDI MAC addresses
are bit-swapped, but this does let us treat non-"libpcap" captures as
being bit-swapped or not bit-swapped independent of the machine on which
they're being read (and of the machine on which they were captured, but
I have the impression they're bit-swapped on most platforms), and allows
us to, if, as, and when we implement packet capture in Wiretap, mark
packets in a capture file written in Wiretap-native format based on the
machine on which they are captured (assuming the rule "Ultrix, Alpha,
and BSD/OS are the only platforms that don't bit-swap", or some other
compile-time rule, gets the right answer, or that some platform has
drivers that can tell us whether the addresses are bit-swapped).
(NOTE: if, for any of the capture file formats used only on one
platform, FDDI MAC addresses aren't bit-swapped, the code to read that
capture file format should be fixed to flag them as not bit-swapped.)
Use the encapsulation type to decide whether to bit-swap addresses in
"dissect_fddi()".
svn path=/trunk/; revision=557
1999-08-24 03:19:34 +00:00
|
|
|
case WTAP_ENCAP_FDDI_BITSWAPPED:
|
2000-01-23 08:55:37 +00:00
|
|
|
capture_fddi(pd, &ld->counts);
|
1999-02-09 00:35:38 +00:00
|
|
|
break;
|
2000-09-21 04:41:37 +00:00
|
|
|
case WTAP_ENCAP_TOKEN_RING:
|
2000-01-23 08:55:37 +00:00
|
|
|
capture_tr(pd, 0, &ld->counts);
|
1999-02-09 00:35:38 +00:00
|
|
|
break;
|
DLT_NULL, from "libpcap", means different things on different platforms
and in different capture files; throw in some heuristics to try to
figure out whether the 4-byte header is:
1) PPP-over-HDLC (some version of ISDN4BSD?);
2) big-endian AF_ value (BSD on big-endian platforms);
3) little-endian AF_ value (BSD on little-endian platforms);
4) two octets of 0 followed by an Ethernet type (Linux, at least
on little-endian platforms, as mutated by "libpcap").
Make a separate Wiretap encapsulation type, WTAP_ENCAP_NULL,
corresponding to DLT_NULL.
Have the PPP code dissect the frame if it's PPP-over-HDLC, and have
"ethertype()" dissect the Ethernet type and the rest of the packet if
it's a Linux-style header; dissect it ourselves only if it's an AF_
value.
Have Wiretap impose a maximum packet size of 65535 bytes, so that it
fails more gracefully when handed a corrupt "libpcap" capture file
(other capture file formats with more than a 16-bit capture length
field, if any, will have that check added later), and put that size in
"wtap.h" and have Ethereal use it as its notion of a maximum packet
size.
Have Ethereal put up a "this file appears to be damaged or corrupt"
message box if Wiretap returns a WTAP_ERR_BAD_RECORD error when opening
or reading a capture file.
Include loopback interfaces in the list of interfaces offered by the
"Capture" dialog box, but put them at the end of the list so that it
doesn't default to a loopback interface unless there are no other
interfaces. Also, don't require that an interface in the list have an
IP address associated with it, and only put one entry in the list for a
given interface (SIOCGIFCONF returns one entry per interface *address*,
not per *interface* - and even if you were to use only IP addresses, an
interface could conceivably have more than one IP address).
Exclusively use Wiretap encapsulation types internally, even when
capturing; don't use DLT_ types.
svn path=/trunk/; revision=540
1999-08-22 00:47:56 +00:00
|
|
|
case WTAP_ENCAP_NULL:
|
2000-01-23 08:55:37 +00:00
|
|
|
capture_null(pd, &ld->counts);
|
1999-02-09 00:35:38 +00:00
|
|
|
break;
|
DLT_NULL, from "libpcap", means different things on different platforms
and in different capture files; throw in some heuristics to try to
figure out whether the 4-byte header is:
1) PPP-over-HDLC (some version of ISDN4BSD?);
2) big-endian AF_ value (BSD on big-endian platforms);
3) little-endian AF_ value (BSD on little-endian platforms);
4) two octets of 0 followed by an Ethernet type (Linux, at least
on little-endian platforms, as mutated by "libpcap").
Make a separate Wiretap encapsulation type, WTAP_ENCAP_NULL,
corresponding to DLT_NULL.
Have the PPP code dissect the frame if it's PPP-over-HDLC, and have
"ethertype()" dissect the Ethernet type and the rest of the packet if
it's a Linux-style header; dissect it ourselves only if it's an AF_
value.
Have Wiretap impose a maximum packet size of 65535 bytes, so that it
fails more gracefully when handed a corrupt "libpcap" capture file
(other capture file formats with more than a 16-bit capture length
field, if any, will have that check added later), and put that size in
"wtap.h" and have Ethereal use it as its notion of a maximum packet
size.
Have Ethereal put up a "this file appears to be damaged or corrupt"
message box if Wiretap returns a WTAP_ERR_BAD_RECORD error when opening
or reading a capture file.
Include loopback interfaces in the list of interfaces offered by the
"Capture" dialog box, but put them at the end of the list so that it
doesn't default to a loopback interface unless there are no other
interfaces. Also, don't require that an interface in the list have an
IP address associated with it, and only put one entry in the list for a
given interface (SIOCGIFCONF returns one entry per interface *address*,
not per *interface* - and even if you were to use only IP addresses, an
interface could conceivably have more than one IP address).
Exclusively use Wiretap encapsulation types internally, even when
capturing; don't use DLT_ types.
svn path=/trunk/; revision=540
1999-08-22 00:47:56 +00:00
|
|
|
case WTAP_ENCAP_PPP:
|
2000-05-25 07:42:26 +00:00
|
|
|
capture_ppp(pd, 0, &ld->counts);
|
1999-02-09 00:35:38 +00:00
|
|
|
break;
|
DLT_NULL, from "libpcap", means different things on different platforms
and in different capture files; throw in some heuristics to try to
figure out whether the 4-byte header is:
1) PPP-over-HDLC (some version of ISDN4BSD?);
2) big-endian AF_ value (BSD on big-endian platforms);
3) little-endian AF_ value (BSD on little-endian platforms);
4) two octets of 0 followed by an Ethernet type (Linux, at least
on little-endian platforms, as mutated by "libpcap").
Make a separate Wiretap encapsulation type, WTAP_ENCAP_NULL,
corresponding to DLT_NULL.
Have the PPP code dissect the frame if it's PPP-over-HDLC, and have
"ethertype()" dissect the Ethernet type and the rest of the packet if
it's a Linux-style header; dissect it ourselves only if it's an AF_
value.
Have Wiretap impose a maximum packet size of 65535 bytes, so that it
fails more gracefully when handed a corrupt "libpcap" capture file
(other capture file formats with more than a 16-bit capture length
field, if any, will have that check added later), and put that size in
"wtap.h" and have Ethereal use it as its notion of a maximum packet
size.
Have Ethereal put up a "this file appears to be damaged or corrupt"
message box if Wiretap returns a WTAP_ERR_BAD_RECORD error when opening
or reading a capture file.
Include loopback interfaces in the list of interfaces offered by the
"Capture" dialog box, but put them at the end of the list so that it
doesn't default to a loopback interface unless there are no other
interfaces. Also, don't require that an interface in the list have an
IP address associated with it, and only put one entry in the list for a
given interface (SIOCGIFCONF returns one entry per interface *address*,
not per *interface* - and even if you were to use only IP addresses, an
interface could conceivably have more than one IP address).
Exclusively use Wiretap encapsulation types internally, even when
capturing; don't use DLT_ types.
svn path=/trunk/; revision=540
1999-08-22 00:47:56 +00:00
|
|
|
case WTAP_ENCAP_RAW_IP:
|
2000-01-23 08:55:37 +00:00
|
|
|
capture_raw(pd, &ld->counts);
|
1999-02-09 00:35:38 +00:00
|
|
|
break;
|
2000-06-15 04:23:06 +00:00
|
|
|
case WTAP_ENCAP_LINUX_ATM_CLIP:
|
|
|
|
capture_clip(pd, &ld->counts);
|
|
|
|
break;
|
1999-08-22 02:29:40 +00:00
|
|
|
/* XXX - FreeBSD may append 4-byte ATM pseudo-header to DLT_ATM_RFC1483,
|
|
|
|
with LLC header following; we should implement it at some
|
|
|
|
point. */
|
1998-09-16 02:39:15 +00:00
|
|
|
}
|
|
|
|
}
|
1999-07-09 04:18:36 +00:00
|
|
|
|
|
|
|
#endif /* HAVE_LIBPCAP */
|