aboutsummaryrefslogtreecommitdiffstats
path: root/capture.c
AgeCommit message (Collapse)AuthorFilesLines
2002-06-13From Graeme Hewson: fix capture-from-pipe not to block when reading fromGuy Harris1-157/+333
the pipe, and clean up various other things. svn path=/trunk/; revision=5670
2002-06-07Add a Wiretap routine to process packets captured via libpcap, possiblyGuy Harris1-11/+18
extracting a pseudo-header, for the use of SunATM captures. Add support for SunATM capture. svn path=/trunk/; revision=5652
2002-06-07Just have "pcap_dispatch()" cons up a "strut pcap_pkthdr" and callGuy Harris1-46/+38
"capture_pcap_cb()", so it duplicates even less of the latter routine. svn path=/trunk/; revision=5648
2002-06-07Have a common routine for doing the packet counter stuff, rather thanGuy Harris1-68/+37
having two different versions, both broken in different ways. Bump the count of total packets in the capture-from-pipe routine. svn path=/trunk/; revision=5647
2002-06-07Pass the captured length, not the full length, to the "capture_"Guy Harris1-10/+17
routines. Call the 802.11 and Cisco HDLC capture routines for those packet types. svn path=/trunk/; revision=5646
2002-06-06From Michael Tuexen: remove the old workaround for "select()"s notGuy Harris1-14/+1
working on MacOS X. It appears that the underlying problem with the timeout was that we weren't treating MacOS X as a BSD, and the "select()" we were doing presumably wasn't working as it doesn't work on BPF devices on many BSDs; the workaround no longer appears to be necessary, with Michael's fix to treat MacOS X as BSD. (Presumably a select timeout with "tv_usec" set to 1000*1000 microseconds was treated as an error, or otherwise treated in such a way that it didn't block waiting for the BPF device to say it could be read.) svn path=/trunk/; revision=5637
2002-06-04From Michael Tuexen: treat Darwin/MacOS X like the other BSDs, as itsGuy Harris1-3/+3
BPF, in at least some OS versions, acts like the other BPFs in some versions of other BSDs, and doesn't work with "select()". svn path=/trunk/; revision=5620
2002-06-04From Graeme Hewson:Guy Harris1-53/+48
This fixes some bugs: 1. With the -S option under Linux, Capture/Stop or ^E was ignored until the next packet was read. This is because capture.c wasn't checking for EINTR from select(), which is returned when the child receives SIGUSR1 from the parent. 2. When reading from a pipe, a spurious error message from pcap_open_live() was written to stderr. 3. Error messages from the child in Sync mode were displayed in a Warning alert box. Also, there's a new subroutine, popup_errmsg(), to replace several instances of duplicate code. svn path=/trunk/; revision=5616
2002-05-04From Joerg Mayer: get rid of some unused arguments, and mark others asGuy Harris1-9/+16
unused. Put in a comment to note that if we fail to open the interface either as a device or as a pipe, we report the error from the failed "pcap_open_live()" (which explains why "pipe_open_live()" doesn't return an error string). svn path=/trunk/; revision=5381
2002-04-24From Joerg Mayer: get rid of extra arguments to capture routines.Guy Harris1-3/+3
svn path=/trunk/; revision=5233
2002-04-08Add an encapsulation type for "802.11 with radio information"; that typeGuy Harris1-1/+2
returns radio information such as signal strength, channel, and data rate in a pseudo-header. Add that pseudo-header. Use the "802.11 with radio information" encapsulation type for Wireless Sniffer files; extract the radio information from where it appears to be in the header. Add dissector code for that encapsulation type. Fix an error in the code to put radio information into the AiroPeek tree. Make the "wrapped" flag for NetXRay/Windows Sniffer captures a "gboolean". svn path=/trunk/; revision=5122
2002-02-24Put all the capture options into a structure.Guy Harris1-39/+36
Move the ringbuffer capture options from the "capture_file" structure to the structure for capture options, as they're a property of an in-progress capture, not a property of a particular capture file. svn path=/trunk/; revision=4799
2002-02-24"autostop_filesize" and "autostop_duration" don't need to be in theGuy Harris1-22/+43
"capture_file" structure - they're a property of an in-progress capture, not a property of an open capture file. Make them just variables. The maximum number of packets to be captured should be a variable separate from the "count" field in the "capture_file" structure - the latter is a count of the packets in the capture file in question. Have Boolean variables indicating whether a maximum packet count, maximum capture file size, and maximum capture duration were specified. If an option isn't set, and we're doing an "update list of packets in real time" capture, don't pass the option to the child process with a command-line argument. Don't create "stop when the capture file reaches this size" or "stop when the capture's run for this long" conditions if a maximum capture file size or a maximum capture duration, respectively, haven't been specified. Don't test or free a condition if it wasn't created. Don't allow a 0 argument to the "-c" flag - the absence of a "-c" flag is the way you specify "no limit on the number of packets". Initialize the check boxes and spin buttons for the "maximum packets to capture", "maximum capture size", and "maximum capture duration" options to the values they had in the last capture. If an option wasn't specified, don't read its value from the dialog box and set the variable. svn path=/trunk/; revision=4795
2002-02-08Have Wiretap set the snapshot length to 0 if it can't be derived fromGuy Harris1-11/+16
reading the capture file. Have callers of "wtap_snapshot_length()" treat a value of 0 as "unknown", and default to WTAP_MAX_PACKET_SIZE (so that, when writing a capture file in a format that *does* store the snapshot length, we can at least put *something* in the file). If we don't know the snapshot length of the current capture file, don't display a value in the summary window. Don't use "cfile.snap" as the snapshot length option when capturing - doing so causes Ethereal to default, when capturing, to the snapshot length of the last capture file that you read in, rather than to the snapshot length of the last capture you did (or the initial default of "no snapshot length"). Redo the "Capture Options" dialog box to group options into sections with frames around them, and add units to the snapshot length, maximum file size, and capture duration options, as per a suggestion by Ulf Lamping. Also add units to the capture count option. Make the snapshot length, capture count, maximum file size, and capture duration options into a combination of a check box and a spin button. If the check box is not checked, the limit in question is inactive (snapshot length of 65535, no max packet count, no max file size, no max capture duration); if it's checked, the spinbox specifies the limit. Default all of the check boxes to "not checked" and all of the spin boxes to small values. Use "gtk_toggle_button_get_active()" rather than directly fetching the state of a check box. svn path=/trunk/; revision=4709
2002-01-21Include files from the "epan" directory and subdirectories thereof withGuy Harris1-2/+2
"epan/..." pathnames, so as to avoid collisions with header files in any of the directories in which we look (e.g., "proto.h", as some other package has its own "proto.h" file which it installs in the top-level include directory). Don't add "-I" flags to search "epan", as that's no longer necessary (and we want includes of "epan" headers to fail if the "epan/" is left out, so that we don't re-introduce includes lacking "epan/"). svn path=/trunk/; revision=4586
2002-01-10Separate the promiscuous mode, "Update list of packets in real time",Guy Harris1-4/+6
and "Automatic scrolling in live capture" options from the preference settings for them, so that the preference settings affect the initial values of those options, but changing those values in a capture don't affect the preferences, and don't automatically get saved when you save the preferences. If we're building without libpcap, don't have an "Automatic scrolling in live capture" option anywhere. svn path=/trunk/; revision=4514
2002-01-08Add a routine to kill a capture child if it exists, so that if we exitGuy Harris1-2/+17
(by deleting the main window or selecting File->Quit or typing ^Q) while an "Update list of packets in real time" capture is in progress, we can abort the capture. Arrange that "fork_child" is -1 when there is no capture child, so said routine knows when it can kill the child. When we exit, kill off any capture child, using that routine, and, if we're exiting due to a request to delete the main window and, if a read is in progress (from an "Update list of packets in real time" capture), don't delete the main window - just set the "Read aborted" flag, so that the code doing the read will see that flag (it will be called because the pipe to the capture child is closed due to the child exiting) will see that and clean up and exit itself. svn path=/trunk/; revision=4498
2002-01-04As per Michael Tuexen's suggestion, set the libpcap open timeout to 1Guy Harris1-1/+14
second rather than 1/4 second on MacOS X, to workaround what appears to be a MacOS BPF bug. svn path=/trunk/; revision=4473
2002-01-03Make the "go" member of the "loop_data" structure in Ethereal aGuy Harris1-2/+26
"gboolean", as it's a Boolean value, and move it to the beginning of the structure in Tethereal, as it is in Ethereal. From Graeme Hewson: Check for "pcap_dispatch()" returning -1, meaning an error occurred; if it does, stop capturing, and report the error. If we get a signal in tethereal, stop the capture with a "longjmp()", rather than by clearning the "go" flag; "pcap_dispatch()", on many platforms, keeps reading rather than returning a captured packet count of 0 if the system call to read packets returns -1 with an errno of EINTR, so the "pcap_dispatch()" won't be broken out of if the signal handler returns. Fix a typo in an error message. svn path=/trunk/; revision=4471
2001-12-04Make the bytes-written information from Wiretap a long, as we allowGuy Harris1-19/+67
files to get that big. From Thomas Wittwer and Matthias Nyffenegger: Support for "ring buffer mode", wherein there's a ring buffer of N capture files; as each capture file reaches its maximum size (the ring buffer works only with a maximum capture file size specified), Ethereal rolls over to the next capture file in the ring buffer, replacing whatever packets might be in it with new packets. svn path=/trunk/; revision=4323
2001-12-04Support for stopping capture at specified capture file size or captureGuy Harris1-2/+35
duration, from Thomas Wittwer and Matthias Nyffenegger. svn path=/trunk/; revision=4322
2001-11-30Add support for LocalTalk Link Access Protocol.Guy Harris1-2/+12
Rename WTAP_ENCAP_PRISM to WTAP_ENCAP_PRISM_HEADER, to match DLT_PRISM_HEADER. Add in missing capture support for WTAP_ENCAP_PRISM_HEADER when capturing with "pcap_open_live()" rather than reading the capture from a pipe. svn path=/trunk/; revision=4299
2001-11-28Support for 802.11+Prism II monitor-mode link-layer headers, fromGuy Harris1-1/+5
Tim Newsham. Add in missing item for WTAP_ENCAP_CISCO_IOS in the Wiretap encapsulation type table. svn path=/trunk/; revision=4290
2001-11-20Get rid of the "len" and "captured_len" members of the "packet_info"Guy Harris1-13/+1
structure; they're no longer used. svn path=/trunk/; revision=4236
2001-11-20Make the capture routines take an additional argument giving the amountGuy Harris1-18/+18
of packet data captured. Make the "BYTES_ARE_IN_FRAME()" macro take a "captured length of the packet" argument. Add some length checks to capture routines. svn path=/trunk/; revision=4235
2001-11-09Wrap calls to "pcap_datalink()" in a routine that attempts to compensateGuy Harris1-2/+7
for AIX 5.x's non-standard libpcap, where "pcap_datalink()" doesn't return DLT_ values, it returns RFC 1573 ifType values. Put that wrapper, and the routine to get the interface list, in a separate file, for packet-capture utility routines, so not everybody who includes "util.h" needs to include <pcap.h>. Fix up the Wiretap hack for dealing with said incompatibility to use the correct ifType value for Token Ring. svn path=/trunk/; revision=4184
2001-10-26Fix the rest of the signed/unsigned comparison warnings.Gilbert Ramirez1-3/+3
svn path=/trunk/; revision=4088
2001-10-25Use "g_warning" to print warning messages from "pcap_open_live()", asGuy Harris1-2/+2
that should cause it to show up in a console window if run from Ethereal on Windows. svn path=/trunk/; revision=4075
2001-10-25Handle "pcap_open_live()" succeeding but returning a warning; print theGuy Harris1-14/+24
warning before the capture starts. svn path=/trunk/; revision=4074
2001-06-18Various signed vs. unsigned fixes, from Joerg Mayer.Guy Harris1-2/+3
svn path=/trunk/; revision=3560
2001-06-15If the capture child process sends the parent an error message with aGuy Harris1-15/+18
byte count of zero, don't bother allocating a buffer for that message, as we wouldn't do anything with that buffer. Null-terminate the error message once we read it, before using it as a string. svn path=/trunk/; revision=3551
2001-06-05Enable "Match Selected" only if there's a field selected *and* we can doGuy Harris1-2/+2
a "Match Selected" on it - we can't do a "Match Selected" if the field has no value (e.g., FT_NULL) and has a length of 0. If we unselect the current packet, we don't have a protocol tree, so we don't have a currently selected field - clear the "Match Selected" menu item and the display in the status line of information about the currently selected field. Move the low-level statusbar manipulation into "gtk/main.c", in routines whose API doesn't expose anything GTK+-ish. "close_cap_file()" calls one of those routines to clear out the status bar, so it doesn't need to take a pointer to the statusbar widget as an argument. "clear_tree_and_hex_views()" is purely a display-manipulating routine; move it to "gtk/proto_draw.c". Extract from "tree_view_unselect_row_cb()" an "unselect_field()" routine to do all the work that needs to be done if the currently selected protocol tree row is unselected, and call it if the currently selected packet list row is unselected (if it's unselected, there *is* no protocol tree, so no row can be selected), as well as from "tree_view_unselect_row_cb()". Before pushing a new field-description message onto the statusbar, pop the old one off. Get rid of an unused variable (set, but not used). svn path=/trunk/; revision=3513
2001-06-02Changes to structure initializations not to initialize some but not allGuy Harris1-12/+12
members, from Joerg Mayer. svn path=/trunk/; revision=3501
2001-05-01"prefs.capture_real_time", not "prefs.capture_auto_scroll", shouldGuy Harris1-2/+2
control whether we have a child process do the capturing; a user might want the packet list to be updated as packets arrive but *not* want it to scroll so that the most recently arrived packets are shown. "prefs.capture_auto_scroll", not "auto_scroll_live", should control whether we scroll a real-time-update capture's packet list; "auto_scroll_live" isn't set by the capture dialog box, "prefs_capture_auto_scroll" is. svn path=/trunk/; revision=3388
2001-04-13Added the ethereal capture preferences to the preference file.Jeff Foster1-6/+4
svn path=/trunk/; revision=3298
2001-04-11The Software Porting And Archive Centre for HP-UX now has libpcap 0.6.2Guy Harris1-12/+9
binaries, so users only need to make sure they have that version installed in order to have Ethereal (and tcpdump, and snort, and so on) accept "lanN"-style names (i.e., names of the sort reported by lanscan and handled by ifconfig), rather than "dlpiN". Get rid of the patches to update libpcap, get rid of the discussion in "README.hpux" of patching libpcap and just say "get 0.6.2", and make the notes on HP-UX kernel patches to fix problems with capturing outgoing packets a separate item in the list of items in "README.hpux". Also update the error messages Ethereal and Tethereal display if they can't open a device and the error is "can't find PPA for XXX" to say "get 0.6.2" rather than "patch libpcap and recompile. svn path=/trunk/; revision=3288
2001-04-04WinPcap 2.1 allows you to capture on Token Ring, so remove the noteGuy Harris1-4/+3
about Token Ring in the "sorry, we couldn't open the capture device" dialog box on Windows. svn path=/trunk/; revision=3257
2001-03-30Call the capture routine for PPP-in-HDLC-like-framing (RFC 1662) theGuy Harris1-3/+3
"ppp_hdlc" capture routine. svn path=/trunk/; revision=3209
2001-03-15Add a new Wiretap encapsulation type for Cisco HDLC. Map the NetBSDGuy Harris1-2/+6
DLT_HDLC to it. Make a separate dissector for Cisco HDLC, and add a dissector for Cisco SLARP. Have the PPP dissector call the Cisco HDLC dissector if the address field is the Cisco HDLC unicast or multicast address. Use the Cisco HDLC dissector for the Cisco HDLC Wiretap encapsulation type. Add a new dissector table "chdlctype", for Cisco HDLC packet types (they're *almost* the same as Ethernet types, but 0x8035 is SLARP, not Reverse ARP, and 0x2000 is the Cisco Discovery protocol, for example), replacing "fr.chdlc". Have a "chdlctype()" routine, similar to "ethertype()", used both by the Cisco HDLC and Frame Relay dissectors. Have a "chdlc_vals[]" "value_string" table for Cisco HDLC types and protocol names. Split the packet type field in the Frame Relay dissector into separate SNAP and Cisco HDLC fields, and give them the Ethernet type and Cisco HDLC type "value_string" tables, respectively. svn path=/trunk/; revision=3133
2001-02-14Rename "SP_ERROR" to "SP_ERROR_MSG" to avoid a #define collision withGuy Harris1-5/+5
yet another Windows #define. svn path=/trunk/; revision=3034
2001-02-11In an "Update list of packets in real time" capture, pass the number ofGuy Harris1-4/+27
dropped packets from the child to the parent. svn path=/trunk/; revision=3019
2001-02-11Change the protocol between the parent and child processes in an "UpdateGuy Harris1-40/+89
list of packets in real time" capture so that "!" always indicates an error, with the "!" preceded by a count of characters in the error message and followed by the text of the error, and so that those error messages can be sent after the capture has started. Use that to report capture errors, and errors writing to the capture file, while the capture is under way. Use #defines for the message type characters in that protocol. svn path=/trunk/; revision=3018
2001-02-11Report failures of "pcap_stats()", as tcpdump does.Guy Harris1-1/+6
Print the "Capturing on <interface>" message, the running count of packets captured, and error messages to the standard error in Tethereal, so that you can pipe the output of a live capture that's printing packets to a program or script without that script having to worry about parsing stuff other than dissected packet summaries or details (tcpdump does the same). svn path=/trunk/; revision=3017
2001-02-11In Ethereal, attempt to get the packet statistics from libpcap whenGuy Harris1-24/+68
capturing; if we succeed, display the packet drops count as the "Drops" value in the status line and as the "Dropped packets" statistics in the summary dialog box, otherwise don't display it at all. In Tethereal, attempt to get the packet statistics from libpcap when capturing; if we succeed, and if there were any dropped packets, print out the count of dropped packets when the capture finishes. svn path=/trunk/; revision=3016
2001-02-10Check for errors when writing a capture file.Guy Harris1-25/+84
Report errors when writing or closing a capture file. Clean up some I/O error messages. svn path=/trunk/; revision=3011
2001-01-28There's no need for a member of a "capture_file" structure holding aGuy Harris1-7/+6
compiled capture filter program, so remove it, and remove the include of <pcap.h> from "file.h"; instead, have local "struct bpf_program" structures where needed, and have those files that need stuff from <pcap.h> include it. This cleans stuff up a bit, and should eliminate a pile of compile warnings with Visual C++ due to <pcap.h> and some GTK+/GLib header file (or files they include) both defining "inline". svn path=/trunk/; revision=2954
2001-01-13Actually call capture_sll() from the capture loop.Gilbert Ramirez1-1/+5
svn path=/trunk/; revision=2889
2001-01-09Don't do the "select()" in the capture codepath on Win32; it's notGuy Harris1-4/+20
necessary, and won't necessarily work. svn path=/trunk/; revision=2846
2000-12-28It turns out that the read timeout in Solaris's "bufmod" STREAMS moduleGuy Harris1-9/+30
doesn't work like the read timeout in BPF - the timer doesn't start until at least one packet has arrived. I think that's the way read timeouts should work on *all* packet capture mechanisms, but it does mean that Solaris will, on a quiet net, exhibit the same symptoms that Linux used to exhibit before we put in a "select()" call to wait until either packets arrive or a timer expires - the "pcap_dispatch()" call blocks until a packet arrives, so the display doesn't get updated and Ethereal doesn't respond to user input until a packet arrives. Furthermore, Linux isn't the only OS that lacks any read timeout on its packet capture mechanism; the others will also have that problem. We therefore do the "select()" on *all* platforms other than the BSDs (where the timer starts when the read is done, and can be used for polling); I don't know whether it's necessary on Digital UNIX, but I suspect it's necessary on SunOS 4.x (as the 5.x "bufmod" is probably derived from the 4.x one, and the 5.x one, as per the above, starts the timer when a packet arrives), and it may even be necessary on 3.x, those (BSD, SunOS including 5.x, and Digital UNIX) apparently being the only UNIXes that appear to have such a read timeout. svn path=/trunk/; revision=2790
2000-12-27If the capture child process exits unexpectedly, give more informationGuy Harris1-117/+176
on it, such as the exit status if it exited "normally" but unexpectedly. On UNIX systems, #define the various POSIX <sys/wait.h> macros (and the non-POSIX WCOREDUMP()" macro) if they're not defined by <sys/wait.h> (or if we don't have <sys/wait.h>), and use them to dissect the exit status. svn path=/trunk/; revision=2788
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-20 08:50:55 +0000