![Gerald Combs](/assets/img/avatar_default.png)
be used to adjust version preferences. It understands two configuration directives: "enable", which can be 0 or 1, and "format", which can be any strftime()-compatible string, e.g. "V12-powered on %A %Y-%m-%d %H:%M:%S". If no configuration file is present, the configuration defaults to enable: 1 format: CVS %Y%m%d%H%M%S svn path=/trunk/; revision=10139
528 lines
13 KiB
C
528 lines
13 KiB
C
/* Combine two dump files, either by appending or by merging by timestamp
|
|
*
|
|
* $Id: mergecap.c,v 1.18 2004/02/20 20:36:13 gerald Exp $
|
|
*
|
|
* Written by Scott Renfro <scott@renfro.org> based on
|
|
* editcap by Richard Sharpe and Guy Harris
|
|
*
|
|
*/
|
|
|
|
#ifdef HAVE_CONFIG_H
|
|
#include "config.h"
|
|
#endif
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <glib.h>
|
|
|
|
#ifdef HAVE_UNISTD_H
|
|
#include <unistd.h>
|
|
#endif
|
|
|
|
#ifdef HAVE_SYS_TIME_H
|
|
#include <sys/time.h>
|
|
#endif
|
|
|
|
#include <string.h>
|
|
#include "wtap.h"
|
|
|
|
#ifdef NEED_GETOPT_H
|
|
#include "getopt.h"
|
|
#endif
|
|
|
|
#include "cvsversion.h"
|
|
|
|
/*
|
|
* Global variables
|
|
*/
|
|
static int verbose = 0; /* Not so verbose */
|
|
|
|
/*
|
|
* Structures to manage our files
|
|
*/
|
|
typedef struct in_file_t {
|
|
const char *filename;
|
|
wtap *wth;
|
|
int err;
|
|
gchar *err_info;
|
|
long data_offset;
|
|
gboolean ok;
|
|
} in_file_t;
|
|
|
|
typedef struct out_file_t {
|
|
const char *filename;
|
|
wtap_dumper *pdh;
|
|
int file_type;
|
|
int frame_type;
|
|
unsigned int snaplen;
|
|
int count;
|
|
} out_file_t;
|
|
static out_file_t out_file;
|
|
|
|
/*
|
|
* Routine to write frame to output file
|
|
*/
|
|
static void
|
|
write_frame(guchar *user, const struct wtap_pkthdr *phdr, long offset _U_,
|
|
union wtap_pseudo_header *pseudo_header, const guchar *buf)
|
|
{
|
|
wtap_dumper *pdh = (wtap_dumper*)user;
|
|
int err;
|
|
struct wtap_pkthdr snap_phdr;
|
|
|
|
if (verbose)
|
|
printf("Record: %u\n", out_file.count++);
|
|
|
|
/* We simply write it, perhaps after truncating it; we could do other
|
|
* things, like modify it. */
|
|
if (out_file.snaplen != 0 && phdr->caplen > out_file.snaplen) {
|
|
snap_phdr = *phdr;
|
|
snap_phdr.caplen = out_file.snaplen;
|
|
phdr = &snap_phdr;
|
|
}
|
|
|
|
if (!wtap_dump(pdh, phdr, pseudo_header, buf, &err)) {
|
|
fprintf(stderr, "mergecap: Error writing to %s: %s\n",
|
|
out_file.filename, wtap_strerror(err));
|
|
exit(1);
|
|
}
|
|
}
|
|
|
|
|
|
/*
|
|
* routine to concatenate files
|
|
*/
|
|
static void
|
|
append(int count, in_file_t in_files[], out_file_t *out_file)
|
|
{
|
|
int i;
|
|
int err;
|
|
gchar *err_info;
|
|
|
|
for (i = 0; i < count; i++) {
|
|
if (!wtap_loop(in_files[i].wth, 0, write_frame,
|
|
(guchar*)out_file->pdh, &err, &err_info)) {
|
|
fprintf(stderr, "mergecap: Error reading %s to append to %s: %s\n",
|
|
in_files[i].filename, out_file->filename, wtap_strerror(err));
|
|
switch (err) {
|
|
|
|
case WTAP_ERR_UNSUPPORTED:
|
|
case WTAP_ERR_UNSUPPORTED_ENCAP:
|
|
case WTAP_ERR_BAD_RECORD:
|
|
fprintf(stderr, "(%s)\n", err_info);
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
/*
|
|
* returns TRUE if first argument is earlier than second
|
|
*/
|
|
static gboolean
|
|
is_earlier(struct timeval *l, struct timeval *r) {
|
|
if (l->tv_sec > r->tv_sec) { /* left is later */
|
|
return FALSE;
|
|
} else if (l->tv_sec < r->tv_sec) { /* left is earlier */
|
|
return TRUE;
|
|
} else if (l->tv_usec > r->tv_usec) { /* tv_sec equal, l.usec later */
|
|
return FALSE;
|
|
}
|
|
/* either one < two or one == two
|
|
* either way, return one
|
|
*/
|
|
return TRUE;
|
|
}
|
|
|
|
|
|
/*
|
|
* returns index of earliest timestamp in set of input files
|
|
* or -1 if no valid files remain
|
|
*/
|
|
static int
|
|
earliest(int count, in_file_t in_files[]) {
|
|
int i;
|
|
int ei = -1;
|
|
struct timeval tv = {LONG_MAX, LONG_MAX};
|
|
|
|
for (i = 0; i < count; i++) {
|
|
struct wtap_pkthdr *phdr = wtap_phdr(in_files[i].wth);
|
|
|
|
if (in_files[i].ok && is_earlier(&(phdr->ts), &tv)) {
|
|
tv = phdr->ts;
|
|
ei = i;
|
|
}
|
|
}
|
|
return ei;
|
|
}
|
|
|
|
/*
|
|
* actually merge the files
|
|
*/
|
|
static void
|
|
merge(int count, in_file_t in_files[], out_file_t *out_file)
|
|
{
|
|
int i;
|
|
|
|
/* prime the pump (read in first frame from each file) */
|
|
for (i = 0; i < count; i++) {
|
|
in_files[i].ok = wtap_read(in_files[i].wth, &(in_files[i].err),
|
|
&(in_files[i].err_info),
|
|
&(in_files[i].data_offset));
|
|
}
|
|
|
|
/* now keep writing the earliest frame until we're out of frames */
|
|
while ( -1 != (i = earliest(count, in_files))) {
|
|
|
|
/* write out earliest frame, and fetch another from its
|
|
* input file
|
|
*/
|
|
write_frame((guchar*)out_file->pdh,
|
|
wtap_phdr(in_files[i].wth),
|
|
in_files[i].data_offset,
|
|
wtap_pseudoheader(in_files[i].wth),
|
|
wtap_buf_ptr(in_files[i].wth));
|
|
in_files[i].ok = wtap_read(in_files[i].wth, &(in_files[i].err),
|
|
&(in_files[i].err_info),
|
|
&(in_files[i].data_offset));
|
|
}
|
|
}
|
|
|
|
|
|
/*
|
|
* Select an output frame type based on the input files
|
|
* From Guy: If all files have the same frame type, then use that.
|
|
* Otherwise select WTAP_ENCAP_PER_PACKET. If the selected
|
|
* output file type doesn't support per packet frame types,
|
|
* then the wtap_dump_open call will fail with a reasonable
|
|
* error condition.
|
|
*/
|
|
static int
|
|
select_frame_type(int count, in_file_t files[])
|
|
{
|
|
int i;
|
|
int selected_frame_type;
|
|
|
|
selected_frame_type = wtap_file_encap(files[0].wth);
|
|
|
|
for (i = 1; i < count; i++) {
|
|
int this_frame_type = wtap_file_encap(files[i].wth);
|
|
if (selected_frame_type != this_frame_type) {
|
|
selected_frame_type = WTAP_ENCAP_PER_PACKET;
|
|
if (verbose) {
|
|
fprintf(stderr, "mergecap: multiple frame encapsulation types detected\n");
|
|
fprintf(stderr, " defaulting to WTAP_ENCAP_PER_PACKET\n");
|
|
fprintf(stderr, " %s had type %s (%s)\n",
|
|
files[0].filename,
|
|
wtap_encap_string(selected_frame_type),
|
|
wtap_encap_short_string(selected_frame_type));
|
|
fprintf(stderr, " %s had type %s (%s)\n",
|
|
files[i].filename,
|
|
wtap_encap_string(this_frame_type),
|
|
wtap_encap_short_string(this_frame_type));
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (verbose) {
|
|
fprintf(stderr, "mergecap: selected frame_type %s (%s)\n",
|
|
wtap_encap_string(selected_frame_type),
|
|
wtap_encap_short_string(selected_frame_type));
|
|
}
|
|
|
|
return selected_frame_type;
|
|
}
|
|
|
|
|
|
/*
|
|
* Close the output file
|
|
*/
|
|
static void
|
|
close_outfile(out_file_t *out_file)
|
|
{
|
|
int err;
|
|
if (!wtap_dump_close(out_file->pdh, &err)) {
|
|
fprintf(stderr, "mergecap: Error closing file %s: %s\n",
|
|
out_file->filename, wtap_strerror(err));
|
|
exit(1);
|
|
}
|
|
}
|
|
|
|
|
|
/*
|
|
* Open the output file
|
|
*
|
|
* Return FALSE if file cannot be opened (so caller can clean up)
|
|
*/
|
|
static gboolean
|
|
open_outfile(out_file_t *out_file, int snapshot_len)
|
|
{
|
|
int err;
|
|
if (!out_file) {
|
|
fprintf(stderr, "mergecap: internal error (null out_file)\n");
|
|
exit(1);
|
|
}
|
|
|
|
out_file->pdh = wtap_dump_open(out_file->filename, out_file->file_type,
|
|
out_file->frame_type, snapshot_len, &err);
|
|
if (!out_file->pdh) {
|
|
fprintf(stderr, "mergecap: Can't open/create %s:\n", out_file->filename);
|
|
fprintf(stderr, " %s\n", wtap_strerror(err));
|
|
return FALSE;
|
|
}
|
|
return TRUE;
|
|
}
|
|
|
|
|
|
/*
|
|
* Scan through input files and find maximum snapshot length
|
|
*/
|
|
static int
|
|
max_snapshot_length(int count, in_file_t in_files[])
|
|
{
|
|
int i;
|
|
int max_snapshot = 0;
|
|
int snapshot_length;
|
|
|
|
for (i = 0; i < count; i++) {
|
|
snapshot_length = wtap_snapshot_length(in_files[i].wth);
|
|
if (snapshot_length == 0) {
|
|
/* Snapshot length of input file not known. */
|
|
snapshot_length = WTAP_MAX_PACKET_SIZE;
|
|
}
|
|
if (snapshot_length > max_snapshot)
|
|
max_snapshot = snapshot_length;
|
|
}
|
|
return max_snapshot;
|
|
}
|
|
|
|
|
|
/*
|
|
* Scan through and close each input file
|
|
*/
|
|
static void
|
|
close_in_files(int count, in_file_t in_files[])
|
|
{
|
|
int i;
|
|
for (i = 0; i < count; i++) {
|
|
wtap_close(in_files[i].wth);
|
|
}
|
|
}
|
|
|
|
|
|
/*
|
|
* Scan through the arguments and open the input files
|
|
*/
|
|
static int
|
|
open_in_files(int argc, char *argv[], in_file_t *in_files[])
|
|
{
|
|
int i;
|
|
int count = 0;
|
|
int err;
|
|
gchar *err_info;
|
|
in_file_t *files;
|
|
int files_size = argc * sizeof(in_file_t);
|
|
|
|
|
|
files = malloc(files_size);
|
|
if (!files) {
|
|
fprintf(stderr, "mergecap: error allocating %d bytes of memory\n",
|
|
files_size);
|
|
exit(1);
|
|
}
|
|
*in_files = files;
|
|
|
|
for (i = 0; i < argc; i++) {
|
|
files[count].filename = argv[i];
|
|
files[count].wth = wtap_open_offline(argv[i], &err, &err_info, FALSE);
|
|
files[count].err = 0;
|
|
files[count].data_offset = 0;
|
|
files[count].ok = TRUE;
|
|
if (!files[count].wth) {
|
|
fprintf(stderr, "mergecap: skipping %s: %s\n", argv[i],
|
|
wtap_strerror(err));
|
|
switch (err) {
|
|
|
|
case WTAP_ERR_UNSUPPORTED:
|
|
case WTAP_ERR_UNSUPPORTED_ENCAP:
|
|
case WTAP_ERR_BAD_RECORD:
|
|
fprintf(stderr, "(%s)\n", err_info);
|
|
g_free(err_info);
|
|
break;
|
|
}
|
|
} else {
|
|
if (verbose) {
|
|
fprintf(stderr, "mergecap: %s is type %s.\n", argv[i],
|
|
wtap_file_type_string(wtap_file_type(files[count].wth)));
|
|
}
|
|
count++;
|
|
}
|
|
}
|
|
if (verbose)
|
|
fprintf(stderr, "mergecap: opened %d of %d input files\n", count,
|
|
argc);
|
|
|
|
return count;
|
|
}
|
|
|
|
|
|
/*
|
|
* Show the usage
|
|
*/
|
|
static void
|
|
usage(void)
|
|
{
|
|
int i;
|
|
const char *string;
|
|
|
|
printf("Usage: mergecap [-hva] [-s <snaplen>] [-T <encap type>]\n");
|
|
printf(" [-F <capture type>] -w <outfile> <infile> [...]\n\n");
|
|
printf(" where\t-h produces this help listing.\n");
|
|
printf(" \t-v verbose operation, default is silent\n");
|
|
printf(" \t-a files should be concatenated, not merged\n");
|
|
printf(" \t Default merges based on frame timestamps\n");
|
|
printf(" \t-s <snaplen>: truncate packets to <snaplen> bytes of data\n");
|
|
printf(" \t-w <outfile>: sets output filename to <outfile>\n");
|
|
printf(" \t-T <encap type> encapsulation type to use:\n");
|
|
for (i = 0; i < WTAP_NUM_ENCAP_TYPES; i++) {
|
|
string = wtap_encap_short_string(i);
|
|
if (string != NULL)
|
|
printf(" \t %s - %s\n",
|
|
string, wtap_encap_string(i));
|
|
}
|
|
printf(" \t default is the same as the first input file\n");
|
|
printf(" \t-F <capture type> capture file type to write:\n");
|
|
for (i = 0; i < WTAP_NUM_FILE_TYPES; i++) {
|
|
if (wtap_dump_can_open(i))
|
|
printf(" \t %s - %s\n",
|
|
wtap_file_type_short_string(i), wtap_file_type_string(i));
|
|
}
|
|
printf(" \t default is libpcap\n");
|
|
}
|
|
|
|
|
|
|
|
int
|
|
main(int argc, char *argv[])
|
|
{
|
|
extern char *optarg;
|
|
extern int optind;
|
|
int opt;
|
|
char *p;
|
|
gboolean do_append = FALSE;
|
|
int in_file_count = 0;
|
|
in_file_t *in_files = NULL;
|
|
|
|
/* initialize out_file */
|
|
out_file.filename = NULL;
|
|
out_file.pdh = NULL; /* wiretap dumpfile */
|
|
out_file.file_type = WTAP_FILE_PCAP; /* default to "libpcap" */
|
|
out_file.frame_type = -2; /* leave type alone */
|
|
out_file.snaplen = 0; /* no limit */
|
|
out_file.count = 1; /* frames output */
|
|
|
|
/* Process the options first */
|
|
while ((opt = getopt(argc, argv, "hvas:T:F:w:")) != -1) {
|
|
|
|
switch (opt) {
|
|
case 'w':
|
|
out_file.filename = optarg;
|
|
break;
|
|
|
|
case 'a':
|
|
do_append = !do_append;
|
|
break;
|
|
|
|
case 'T':
|
|
out_file.frame_type = wtap_short_string_to_encap(optarg);
|
|
if (out_file.frame_type < 0) {
|
|
fprintf(stderr, "mergecap: \"%s\" is not a valid encapsulation type\n",
|
|
optarg);
|
|
exit(1);
|
|
}
|
|
break;
|
|
|
|
case 'F':
|
|
out_file.file_type = wtap_short_string_to_file_type(optarg);
|
|
if (out_file.file_type < 0) {
|
|
fprintf(stderr, "mergecap: \"%s\" is not a valid capture file type\n",
|
|
optarg);
|
|
exit(1);
|
|
}
|
|
break;
|
|
|
|
case 'v':
|
|
verbose = !verbose; /* Just invert */
|
|
break;
|
|
|
|
case 's':
|
|
out_file.snaplen = strtol(optarg, &p, 10);
|
|
if (p == optarg || *p != '\0') {
|
|
fprintf(stderr, "mergecap: \"%s\" is not a valid snapshot length\n",
|
|
optarg);
|
|
exit(1);
|
|
}
|
|
break;
|
|
|
|
case 'h':
|
|
printf("mergecap version %s"
|
|
#ifdef CVSVERSION
|
|
" (" CVSVERSION ")"
|
|
#endif
|
|
"\n", VERSION);
|
|
usage();
|
|
exit(0);
|
|
break;
|
|
|
|
case '?': /* Bad options if GNU getopt */
|
|
usage();
|
|
exit(1);
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
/* check for proper args; at a minimum, must have an output
|
|
* filename and one input file
|
|
*/
|
|
in_file_count = argc - optind;
|
|
if (!out_file.filename) {
|
|
fprintf(stderr, "mergecap: an output filename must be set with -w\n");
|
|
fprintf(stderr, " run with -h for help\n");
|
|
exit(1);
|
|
}
|
|
|
|
/* open the input files */
|
|
in_file_count = open_in_files(in_file_count, &argv[optind], &in_files);
|
|
if (in_file_count < 1) {
|
|
fprintf(stderr, "mergecap: No valid input files\n");
|
|
exit(1);
|
|
}
|
|
|
|
/* set the outfile frame type */
|
|
if (out_file.frame_type == -2)
|
|
out_file.frame_type = select_frame_type(in_file_count, in_files);
|
|
|
|
/* open the outfile */
|
|
if (!open_outfile(&out_file, max_snapshot_length(in_file_count, in_files))) {
|
|
close_in_files(in_file_count, in_files);
|
|
exit(1);
|
|
}
|
|
|
|
/* do the merge (or append) */
|
|
if (do_append)
|
|
append(in_file_count, in_files, &out_file);
|
|
else
|
|
merge(in_file_count, in_files, &out_file);
|
|
|
|
close_in_files(in_file_count, in_files);
|
|
close_outfile(&out_file);
|
|
|
|
free(in_files);
|
|
|
|
return 0;
|
|
}
|