Commit Graph

142 Commits

Author SHA1 Message Date
Guy Harris 7ecae442c5 capture() can, in some cases, return FALSE when the capture succeeds;
back out the change to check its return value until we fix that.

Also back out the test suite changes to look for an error exit for
invalid capture filters and interfaces.

svn path=/trunk/; revision=33029
2010-06-01 03:37:51 +00:00
Jeff Morriss 47e2d75820 Move some code (including the optional objects) into libwsutil
svn path=/trunk/; revision=33012
2010-05-28 20:19:55 +00:00
Guy Harris 8d949600af Use return rather than exit in main().
Return 2 for a capture error - we mainly use 1 for command-line syntax
errors (rather than, say, filter syntax errors or an invalid interface).

Now that TShark exits with an error status when given an invalid capture
filter or invalid interface, check for "error" rather than "success" as
an exit status.

svn path=/trunk/; revision=33006
2010-05-28 01:09:28 +00:00
Bill Meier ece0ada557 Fix bug #4735: tshark returns 0 on non-valid filter and interface.
See: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4735

svn path=/trunk/; revision=33004
2010-05-27 23:46:01 +00:00
Guy Harris 80fda10f18 Make -q not a capture option again - it's used by tshark even when not
capturing, and thus even when we build without pcap.

svn path=/trunk/; revision=32988
2010-05-27 01:13:49 +00:00
Guy Harris 391b5127d6 Clean up the error reporting. An EOF from the sync pipe when capturing
is just an indication that the capture child exited; don't treat it as
an error, unless the child process exits with an abnormal status.
 
As tshark sends a "stop capture" indication to the child when it's
^C'ed, the child will exit and we'll get an EOF from the capture pipe;
don't make SIGINT etc. interrupt system calls, so they don't cause reads
from the capture pipe to get EINTR errors.

svn path=/trunk/; revision=32986
2010-05-27 00:48:08 +00:00
Guy Harris b0bfae2a85 Don't send ^T output to the standard error if we're a capture child.
Make SIGINFO a restart-the-system-call signal, so reads etc. don't
return an error.

svn path=/trunk/; revision=32968
2010-05-26 04:29:36 +00:00
Guy Harris d0ac88186d If dumpcap exits abnormally, report the error.
svn path=/trunk/; revision=32964
2010-05-26 02:32:19 +00:00
Guy Harris d3f8320039 Fix build without pcap.
svn path=/trunk/; revision=32959
2010-05-26 01:32:00 +00:00
Guy Harris 7a630c61a1 Add a -q flag to dumpcap, to squelch its reporting of the packet count,
and add support for SIGINFO, so, if your OS supports SIGINFO, you can
get the packet count by typing ^T.

svn path=/trunk/; revision=32958
2010-05-26 00:19:27 +00:00
Guy Harris b4f61dfe67 Fix indentation.
svn path=/trunk/; revision=32886
2010-05-19 03:50:09 +00:00
Guy Harris 991c5e9898 When dumpcap is run to get an interface list, interface capabilities, or
interface statistics, have its error messages come out as sync-pipe
errors, have it send a sync-pipe "success" message on success, and have
the callers get that message and display it.

svn path=/trunk/; revision=32843
2010-05-17 18:40:23 +00:00
Guy Harris 9307251bb8 Um, no, the problem with the Leopard x86 build is that we first do a
build without libpcap, to make sure that works, and then do a build with
libpcap, to put into a binary release.  It's the former that's failing;
I'll back out the previous change and then work on that.

svn path=/trunk/; revision=32801
2010-05-14 00:49:28 +00:00
Guy Harris 0e54136213 See whether the Leopard x86 buildbot is upset because of the name
if_capabilities_t - it doesn't fail on Snow Leopard, even if I undefine
HAVE_PCAP_CREATE, and doesn't fail on the Leopard PPC buildbot, either.

svn path=/trunk/; revision=32799
2010-05-14 00:10:15 +00:00
Guy Harris 1c18115bd3 Fetch an indication of whether the interface supports capturing in
monitor mode at the same time that we fetch its list of link-layer
types.  Support fetching that list in monitor mode, as the list may be
different in regular and monitor mode.  If the interface supports
monitor mode, when printing the list of link-layer types, indicate
whether they're fetched in monitor mode or not, as tcpdump 4.1.x does.

svn path=/trunk/; revision=32789
2010-05-13 17:37:39 +00:00
Bill Meier 4a1b069d3f Fix a gcc -Wshadow warning.
svn path=/trunk/; revision=32737
2010-05-10 16:51:09 +00:00
Guy Harris 547b9e48a2 The default capture buffer size is, in fact, *nominally* 1MB; however,
libpcap/WinPcap and the capture mechanism atop which they run might
either silently limit the buffer size to a smaller value or raise it to
a higher value - that's the part that's platform-dependent.

svn path=/trunk/; revision=32718
2010-05-08 00:39:07 +00:00
Guy Harris 077ff72ac1 As with the list of data link types, so with the list of interfaces; move
the code to print the machine-readable format into dumpcap, and have the
code in capture_opts.c just print the human-readable format.

svn path=/trunk/; revision=32714
2010-05-07 19:24:32 +00:00
Guy Harris 13bf4a0c55 Add routines vfprintf_stderr() and fprintf_stderr() to print to the
standard error and, in Wireshark on Windows, create a console if
necessary.  Have the cmdarg_err routines use them.

Use *fprintf_stderr() to print the output of -L, rather than using
cmdarg_err_cont(), so that we don't get extra newlines in the output (it
should look similar to the output of tcpdump).

svn path=/trunk/; revision=32711
2010-05-07 08:40:02 +00:00
Guy Harris cc05b9250d For TShark and Wireshark, get the list of link-layer types for an
interface by running dumpcap, so that if you need privileges to open an
interface, and dumpcap has those privileges, neither TShark nor
Wireshark need them.

svn path=/trunk/; revision=32710
2010-05-07 08:06:25 +00:00
Guy Harris 6ace737ae4 Add monitor mode support to TShark.
svn path=/trunk/; revision=32704
2010-05-07 01:46:38 +00:00
Guy Harris 4c5b8c5277 Instead, say that the default is platform-dependent.
svn path=/trunk/; revision=32701
2010-05-07 00:28:42 +00:00
Guy Harris 96f67d9517 Now that we support -B on various UN*X platforms as well as Windows, we
can no longer state what the default is (it's platform-dependent).

svn path=/trunk/; revision=32700
2010-05-07 00:16:52 +00:00
Gerald Combs 570a693a09 Set the timestamp seconds type to TS_SECONDS_DEFAULT at startup so we
don't abort.

svn path=/trunk/; revision=32697
2010-05-06 23:51:37 +00:00
Guy Harris 7dbbb8c572 Just check for pcap_create(); it first appeared in libpcap 1.0.0, and
pcap_set_buffer_size() did as well, so there aren't any libpcap releases
with pcap_create() but not pcap_set_buffer_size().

Only do one check for pcap_create.

svn path=/trunk/; revision=32695
2010-05-06 23:33:41 +00:00
Anders Broman f9981411f1 Checking in Stigs changes from
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=475
BUT not activating the check for 
pcap_create()
pcap_set_buffer_size()
This should make it possible to build with support for setting the buffersize if not capturing 802.11 traffic.

The code for handling the 'B' option should be OK in any case.

svn path=/trunk/; revision=32688
2010-05-06 18:34:30 +00:00
Stig Bjørlykke 54101a8630 Moved command line option for seconds type to -u.
Added this option to tshark.

svn path=/trunk/; revision=32685
2010-05-06 12:31:24 +00:00
Jeff Morriss a61489c3a5 Fix https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2742 :
If the user specifies -V or -x, turn on print_packet_info (-S) so they actually
get some output in case we're also writing to a file.

svn path=/trunk/; revision=32486
2010-04-16 00:54:00 +00:00
Guy Harris 25d49313cc "capture-pcap-util.h" include <pcap.h>, and <pcap.h>, for better or
worse, has no include-once guards; include it only once.

svn path=/trunk/; revision=32110
2010-03-04 07:19:43 +00:00
Bill Meier e4d6610bd5 Fix various gcc -Wshadow warnings.
svn path=/trunk/; revision=31729
2010-01-29 16:09:25 +00:00
Stig Bjørlykke 98024a007f Invert check for getopt: NEED_GETOPT_H -> HAVE_GETOPT_H
Rename getopt.[ch] -> wsgetopt.[ch] to avoid name collision.

svn path=/trunk/; revision=30370
2009-10-06 16:01:18 +00:00
Kovarththanan Rajaratnam 29c7430fb6 Free capture filename on shutdown
svn path=/trunk/; revision=30165
2009-09-26 06:41:20 +00:00
Kovarththanan Rajaratnam 4c3ad6faa9 (Cosmetic) Reorder so that the failure message output handler appear in succession
svn path=/trunk/; revision=30162
2009-09-26 04:52:34 +00:00
Kovarththanan Rajaratnam cf8e2654b4 Remove unused 'offset' parameter
svn path=/trunk/; revision=30078
2009-09-22 20:02:51 +00:00
Kovarththanan Rajaratnam 760eb47fc1 Add initial support for "two pass analysis" in tshark. This allows tshark to arrive at the same protocol tree as the Wireshark GUI. Before this change tshark only supported a single scan over the file. This effectively means that packets cannot use data that are gathered from frames that appear after the current frame. By scanning twice we give the dissector the opportunity to make forward references.
svn path=/trunk/; revision=30076
2009-09-22 19:28:00 +00:00
Kovarththanan Rajaratnam 0ee2b7754d Rename init_cap_file() to cap_file_init()
svn path=/trunk/; revision=30073
2009-09-22 16:53:11 +00:00
Kovarththanan Rajaratnam e44cb94beb Always initialise fdata even when we don't dissect (we access some of fdatas variables)
svn path=/trunk/; revision=30070
2009-09-22 15:22:53 +00:00
Kovarththanan Rajaratnam a9a1866acf Simply some logic inside process_packet()
svn path=/trunk/; revision=30069
2009-09-22 15:06:52 +00:00
Kovarththanan Rajaratnam 1e8d9b4937 Make frame_data_set_after_dissect() callers do the necessary checks instead
svn path=/trunk/; revision=30068
2009-09-22 14:50:43 +00:00
Kovarththanan Rajaratnam 14d2f617c2 Refactor frame_data_init() into frame_data_set_before_dissect() and frame_data_set_after_dissect().
svn path=/trunk/; revision=30066
2009-09-22 14:23:20 +00:00
Kovarththanan Rajaratnam 46b7430557 Move frame_data_init() declaration to frame_data.h
svn path=/trunk/; revision=30033
2009-09-21 11:26:23 +00:00
Kovarththanan Rajaratnam 8791df65e1 Fix return type for frame_data_init()
svn path=/trunk/; revision=30024
2009-09-20 19:01:23 +00:00
Kovarththanan Rajaratnam 2e282e7567 Introduce frame_data_cleanup() and start using it
svn path=/trunk/; revision=30023
2009-09-20 18:18:29 +00:00
Kovarththanan Rajaratnam e56f27dc99 Introduce frame_data_init() and get rid of fill_in_fdata() in tshark.c
svn path=/trunk/; revision=30021
2009-09-20 17:51:16 +00:00
Kovarththanan Rajaratnam a896743c6f Make cf_mark_frame() an empty stub in tshark.c. We only need it to satisfy a linker dependency. Add a comment in tap-rtp-common.c indicating that is is wrong to refer to cf_mark_frame() which is only applicable for the GTK UI backend.
svn path=/trunk/; revision=30019
2009-09-20 16:48:52 +00:00
Kovarththanan Rajaratnam 66f528e9e4 Remove unused cf_unmark_frame() function
svn path=/trunk/; revision=30018
2009-09-20 16:30:12 +00:00
Kovarththanan Rajaratnam a7081629f0 Move verbose banner output to show_version() and tighten scope of some variables
svn path=/trunk/; revision=30017
2009-09-20 16:16:15 +00:00
Kovarththanan Rajaratnam de23d92163 Add an option to col_fill_in() to allow us to disable column expression processing. This is rarely needed. It's only needed when the user right clicks on the packet list view to generate a display filter.
svn path=/trunk/; revision=29806
2009-09-08 19:00:54 +00:00
Kovarththanan Rajaratnam b90a11bee3 Make tshark and rawshark use build_column_format_array() instead of duplicating the code
svn path=/trunk/; revision=29803
2009-09-08 17:29:57 +00:00
Kovarththanan Rajaratnam a65d590002 Store the packet encapsulation type as gint8. Saves 3 bytes per packet
svn path=/trunk/; revision=29767
2009-09-07 13:54:46 +00:00