aboutsummaryrefslogtreecommitdiffstats
path: root/capture.c
AgeCommit message (Collapse)AuthorFilesLines
2002-10-19Suppress compiler warnings on platforms where "time_t" is a "long",Guy Harris1-3/+4
without introducing warnings where it's an "int". svn path=/trunk/; revision=6459
2002-10-16From Ulf Lamping: show total running time of capture in capture progressGuy Harris1-5/+35
dialog box. svn path=/trunk/; revision=6440
2002-10-14From Ulf Lamping: count ARP packets in capture progress dialog box.Guy Harris1-1/+3
svn path=/trunk/; revision=6416
2002-10-09From Ulf Lamping: keep "Update list of packets in real time" fromGuy Harris1-2/+5
crashing on Windows. svn path=/trunk/; revision=6387
2002-09-22From Graeme Hewson:Gerald Combs1-23/+22
It can sometimes happen that capturing is stopped just after Ethereal has switched to a new ring buffer. The result is that no frames are displayed. The patch to ringbuffer.c displays the previous ring buffer if the current buffer is empty on close. The patch to capture.c fixes a bug where an error return from ringbuf_wtap_dump_close was ignored, and tidies up the code around the call. svn path=/trunk/; revision=6315
2002-09-09From Graeme Hewson:Guy Harris1-5/+15
Currently Ethereal sets and uses a default directory for reading and writing, but only in some places. This set of patches extends the setting of the default directory to the -w option as well as the -r option, and causes all file dialogs to use and set the default consistently. (I haven't changed the Preferences/Printing/File dialog, though, as that's a special case.) There's also a fix for a bug where Ethereal was issuing the message "Ring buffer requested, but capture isn't being saved to a permanent file" even though a file was specified with -w. There also appear to be some other cleanups in his patch. svn path=/trunk/; revision=6238
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-35/+35
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-13Not all compilers allow labels that don't have a statement followingGuy Harris1-3/+3
them. Put a "break;" statement after a case label that didn't have it. svn path=/trunk/; revision=5990
2002-08-02Replace the types from sys/types.h and netinet/in.h by their glib.hJörg Mayer1-16/+12
equivalents for the toplevel directory. The removal of winsock2.h will hopefully not cause any problems under MSVC++, as those files using struct timeval still include wtap.h, which still includes winsock2.h. svn path=/trunk/; revision=5932
2002-07-16From Graeme Hewson:Guy Harris1-2/+2
Allow "-" as the output file name in Wiretap, referring to the standard error. Optimize the capture loop. Fix some of the error-message printing code in Ethereal and Tethereal. Have Wiretap check whether it can seek on a file descriptor, and pass the results of that test to the file-type-specific "open for output" routine. Have the "open for output" routines for files where we need to seek when writing the file return an error if seeks don't work. svn path=/trunk/; revision=5884
2002-07-16From Graeme Hewson:Guy Harris1-6/+3
In sync mode, if the capture file written by the child can't be opened by the parent, ethereal will write two identical popup error messages. This patch fixes the problem. svn path=/trunk/; revision=5883
2002-07-15Update the "NT sucks for PPP capture" note to include NT 5.1 (XP andGuy Harris1-25/+24
.NET Server). Fix indentation. svn path=/trunk/; revision=5882
2002-06-22On Windows, there's no "pipe_fd", so don't refer to it.Guy Harris1-17/+20
svn path=/trunk/; revision=5734
2002-06-13From Graeme Hewson: fix capture-from-pipe not to block when reading fromGuy Harris1-157/+333
the pipe, and clean up various other things. svn path=/trunk/; revision=5670
2002-06-07Add a Wiretap routine to process packets captured via libpcap, possiblyGuy Harris1-11/+18
extracting a pseudo-header, for the use of SunATM captures. Add support for SunATM capture. svn path=/trunk/; revision=5652
2002-06-07Just have "pcap_dispatch()" cons up a "strut pcap_pkthdr" and callGuy Harris1-46/+38
"capture_pcap_cb()", so it duplicates even less of the latter routine. svn path=/trunk/; revision=5648
2002-06-07Have a common routine for doing the packet counter stuff, rather thanGuy Harris1-68/+37
having two different versions, both broken in different ways. Bump the count of total packets in the capture-from-pipe routine. svn path=/trunk/; revision=5647
2002-06-07Pass the captured length, not the full length, to the "capture_"Guy Harris1-10/+17
routines. Call the 802.11 and Cisco HDLC capture routines for those packet types. svn path=/trunk/; revision=5646
2002-06-06From Michael Tuexen: remove the old workaround for "select()"s notGuy Harris1-14/+1
working on MacOS X. It appears that the underlying problem with the timeout was that we weren't treating MacOS X as a BSD, and the "select()" we were doing presumably wasn't working as it doesn't work on BPF devices on many BSDs; the workaround no longer appears to be necessary, with Michael's fix to treat MacOS X as BSD. (Presumably a select timeout with "tv_usec" set to 1000*1000 microseconds was treated as an error, or otherwise treated in such a way that it didn't block waiting for the BPF device to say it could be read.) svn path=/trunk/; revision=5637
2002-06-04From Michael Tuexen: treat Darwin/MacOS X like the other BSDs, as itsGuy Harris1-3/+3
BPF, in at least some OS versions, acts like the other BPFs in some versions of other BSDs, and doesn't work with "select()". svn path=/trunk/; revision=5620
2002-06-04From Graeme Hewson:Guy Harris1-53/+48
This fixes some bugs: 1. With the -S option under Linux, Capture/Stop or ^E was ignored until the next packet was read. This is because capture.c wasn't checking for EINTR from select(), which is returned when the child receives SIGUSR1 from the parent. 2. When reading from a pipe, a spurious error message from pcap_open_live() was written to stderr. 3. Error messages from the child in Sync mode were displayed in a Warning alert box. Also, there's a new subroutine, popup_errmsg(), to replace several instances of duplicate code. svn path=/trunk/; revision=5616
2002-05-04From Joerg Mayer: get rid of some unused arguments, and mark others asGuy Harris1-9/+16
unused. Put in a comment to note that if we fail to open the interface either as a device or as a pipe, we report the error from the failed "pcap_open_live()" (which explains why "pipe_open_live()" doesn't return an error string). svn path=/trunk/; revision=5381
2002-04-24From Joerg Mayer: get rid of extra arguments to capture routines.Guy Harris1-3/+3
svn path=/trunk/; revision=5233
2002-04-08Add an encapsulation type for "802.11 with radio information"; that typeGuy Harris1-1/+2
returns radio information such as signal strength, channel, and data rate in a pseudo-header. Add that pseudo-header. Use the "802.11 with radio information" encapsulation type for Wireless Sniffer files; extract the radio information from where it appears to be in the header. Add dissector code for that encapsulation type. Fix an error in the code to put radio information into the AiroPeek tree. Make the "wrapped" flag for NetXRay/Windows Sniffer captures a "gboolean". svn path=/trunk/; revision=5122
2002-02-24Put all the capture options into a structure.Guy Harris1-39/+36
Move the ringbuffer capture options from the "capture_file" structure to the structure for capture options, as they're a property of an in-progress capture, not a property of a particular capture file. svn path=/trunk/; revision=4799
2002-02-24"autostop_filesize" and "autostop_duration" don't need to be in theGuy Harris1-22/+43
"capture_file" structure - they're a property of an in-progress capture, not a property of an open capture file. Make them just variables. The maximum number of packets to be captured should be a variable separate from the "count" field in the "capture_file" structure - the latter is a count of the packets in the capture file in question. Have Boolean variables indicating whether a maximum packet count, maximum capture file size, and maximum capture duration were specified. If an option isn't set, and we're doing an "update list of packets in real time" capture, don't pass the option to the child process with a command-line argument. Don't create "stop when the capture file reaches this size" or "stop when the capture's run for this long" conditions if a maximum capture file size or a maximum capture duration, respectively, haven't been specified. Don't test or free a condition if it wasn't created. Don't allow a 0 argument to the "-c" flag - the absence of a "-c" flag is the way you specify "no limit on the number of packets". Initialize the check boxes and spin buttons for the "maximum packets to capture", "maximum capture size", and "maximum capture duration" options to the values they had in the last capture. If an option wasn't specified, don't read its value from the dialog box and set the variable. svn path=/trunk/; revision=4795
2002-02-08Have Wiretap set the snapshot length to 0 if it can't be derived fromGuy Harris1-11/+16
reading the capture file. Have callers of "wtap_snapshot_length()" treat a value of 0 as "unknown", and default to WTAP_MAX_PACKET_SIZE (so that, when writing a capture file in a format that *does* store the snapshot length, we can at least put *something* in the file). If we don't know the snapshot length of the current capture file, don't display a value in the summary window. Don't use "cfile.snap" as the snapshot length option when capturing - doing so causes Ethereal to default, when capturing, to the snapshot length of the last capture file that you read in, rather than to the snapshot length of the last capture you did (or the initial default of "no snapshot length"). Redo the "Capture Options" dialog box to group options into sections with frames around them, and add units to the snapshot length, maximum file size, and capture duration options, as per a suggestion by Ulf Lamping. Also add units to the capture count option. Make the snapshot length, capture count, maximum file size, and capture duration options into a combination of a check box and a spin button. If the check box is not checked, the limit in question is inactive (snapshot length of 65535, no max packet count, no max file size, no max capture duration); if it's checked, the spinbox specifies the limit. Default all of the check boxes to "not checked" and all of the spin boxes to small values. Use "gtk_toggle_button_get_active()" rather than directly fetching the state of a check box. svn path=/trunk/; revision=4709
2002-01-21Include files from the "epan" directory and subdirectories thereof withGuy Harris1-2/+2
"epan/..." pathnames, so as to avoid collisions with header files in any of the directories in which we look (e.g., "proto.h", as some other package has its own "proto.h" file which it installs in the top-level include directory). Don't add "-I" flags to search "epan", as that's no longer necessary (and we want includes of "epan" headers to fail if the "epan/" is left out, so that we don't re-introduce includes lacking "epan/"). svn path=/trunk/; revision=4586
2002-01-10Separate the promiscuous mode, "Update list of packets in real time",Guy Harris1-4/+6
and "Automatic scrolling in live capture" options from the preference settings for them, so that the preference settings affect the initial values of those options, but changing those values in a capture don't affect the preferences, and don't automatically get saved when you save the preferences. If we're building without libpcap, don't have an "Automatic scrolling in live capture" option anywhere. svn path=/trunk/; revision=4514
2002-01-08Add a routine to kill a capture child if it exists, so that if we exitGuy Harris1-2/+17
(by deleting the main window or selecting File->Quit or typing ^Q) while an "Update list of packets in real time" capture is in progress, we can abort the capture. Arrange that "fork_child" is -1 when there is no capture child, so said routine knows when it can kill the child. When we exit, kill off any capture child, using that routine, and, if we're exiting due to a request to delete the main window and, if a read is in progress (from an "Update list of packets in real time" capture), don't delete the main window - just set the "Read aborted" flag, so that the code doing the read will see that flag (it will be called because the pipe to the capture child is closed due to the child exiting) will see that and clean up and exit itself. svn path=/trunk/; revision=4498
2002-01-04As per Michael Tuexen's suggestion, set the libpcap open timeout to 1Guy Harris1-1/+14
second rather than 1/4 second on MacOS X, to workaround what appears to be a MacOS BPF bug. svn path=/trunk/; revision=4473
2002-01-03Make the "go" member of the "loop_data" structure in Ethereal aGuy Harris1-2/+26
"gboolean", as it's a Boolean value, and move it to the beginning of the structure in Tethereal, as it is in Ethereal. From Graeme Hewson: Check for "pcap_dispatch()" returning -1, meaning an error occurred; if it does, stop capturing, and report the error. If we get a signal in tethereal, stop the capture with a "longjmp()", rather than by clearning the "go" flag; "pcap_dispatch()", on many platforms, keeps reading rather than returning a captured packet count of 0 if the system call to read packets returns -1 with an errno of EINTR, so the "pcap_dispatch()" won't be broken out of if the signal handler returns. Fix a typo in an error message. svn path=/trunk/; revision=4471
2001-12-04Make the bytes-written information from Wiretap a long, as we allowGuy Harris1-19/+67
files to get that big. From Thomas Wittwer and Matthias Nyffenegger: Support for "ring buffer mode", wherein there's a ring buffer of N capture files; as each capture file reaches its maximum size (the ring buffer works only with a maximum capture file size specified), Ethereal rolls over to the next capture file in the ring buffer, replacing whatever packets might be in it with new packets. svn path=/trunk/; revision=4323
2001-12-04Support for stopping capture at specified capture file size or captureGuy Harris1-2/+35
duration, from Thomas Wittwer and Matthias Nyffenegger. svn path=/trunk/; revision=4322
2001-11-30Add support for LocalTalk Link Access Protocol.Guy Harris1-2/+12
Rename WTAP_ENCAP_PRISM to WTAP_ENCAP_PRISM_HEADER, to match DLT_PRISM_HEADER. Add in missing capture support for WTAP_ENCAP_PRISM_HEADER when capturing with "pcap_open_live()" rather than reading the capture from a pipe. svn path=/trunk/; revision=4299
2001-11-28Support for 802.11+Prism II monitor-mode link-layer headers, fromGuy Harris1-1/+5
Tim Newsham. Add in missing item for WTAP_ENCAP_CISCO_IOS in the Wiretap encapsulation type table. svn path=/trunk/; revision=4290
2001-11-20Get rid of the "len" and "captured_len" members of the "packet_info"Guy Harris1-13/+1
structure; they're no longer used. svn path=/trunk/; revision=4236
2001-11-20Make the capture routines take an additional argument giving the amountGuy Harris1-18/+18
of packet data captured. Make the "BYTES_ARE_IN_FRAME()" macro take a "captured length of the packet" argument. Add some length checks to capture routines. svn path=/trunk/; revision=4235
2001-11-09Wrap calls to "pcap_datalink()" in a routine that attempts to compensateGuy Harris1-2/+7
for AIX 5.x's non-standard libpcap, where "pcap_datalink()" doesn't return DLT_ values, it returns RFC 1573 ifType values. Put that wrapper, and the routine to get the interface list, in a separate file, for packet-capture utility routines, so not everybody who includes "util.h" needs to include <pcap.h>. Fix up the Wiretap hack for dealing with said incompatibility to use the correct ifType value for Token Ring. svn path=/trunk/; revision=4184
2001-10-26Fix the rest of the signed/unsigned comparison warnings.Gilbert Ramirez1-3/+3
svn path=/trunk/; revision=4088
2001-10-25Use "g_warning" to print warning messages from "pcap_open_live()", asGuy Harris1-2/+2
that should cause it to show up in a console window if run from Ethereal on Windows. svn path=/trunk/; revision=4075
2001-10-25Handle "pcap_open_live()" succeeding but returning a warning; print theGuy Harris1-14/+24
warning before the capture starts. svn path=/trunk/; revision=4074
2001-06-18Various signed vs. unsigned fixes, from Joerg Mayer.Guy Harris1-2/+3
svn path=/trunk/; revision=3560
2001-06-15If the capture child process sends the parent an error message with aGuy Harris1-15/+18
byte count of zero, don't bother allocating a buffer for that message, as we wouldn't do anything with that buffer. Null-terminate the error message once we read it, before using it as a string. svn path=/trunk/; revision=3551
2001-06-05Enable "Match Selected" only if there's a field selected *and* we can doGuy Harris1-2/+2
a "Match Selected" on it - we can't do a "Match Selected" if the field has no value (e.g., FT_NULL) and has a length of 0. If we unselect the current packet, we don't have a protocol tree, so we don't have a currently selected field - clear the "Match Selected" menu item and the display in the status line of information about the currently selected field. Move the low-level statusbar manipulation into "gtk/main.c", in routines whose API doesn't expose anything GTK+-ish. "close_cap_file()" calls one of those routines to clear out the status bar, so it doesn't need to take a pointer to the statusbar widget as an argument. "clear_tree_and_hex_views()" is purely a display-manipulating routine; move it to "gtk/proto_draw.c". Extract from "tree_view_unselect_row_cb()" an "unselect_field()" routine to do all the work that needs to be done if the currently selected protocol tree row is unselected, and call it if the currently selected packet list row is unselected (if it's unselected, there *is* no protocol tree, so no row can be selected), as well as from "tree_view_unselect_row_cb()". Before pushing a new field-description message onto the statusbar, pop the old one off. Get rid of an unused variable (set, but not used). svn path=/trunk/; revision=3513
2001-06-02Changes to structure initializations not to initialize some but not allGuy Harris1-12/+12
members, from Joerg Mayer. svn path=/trunk/; revision=3501
2001-05-01"prefs.capture_real_time", not "prefs.capture_auto_scroll", shouldGuy Harris1-2/+2
control whether we have a child process do the capturing; a user might want the packet list to be updated as packets arrive but *not* want it to scroll so that the most recently arrived packets are shown. "prefs.capture_auto_scroll", not "auto_scroll_live", should control whether we scroll a real-time-update capture's packet list; "auto_scroll_live" isn't set by the capture dialog box, "prefs_capture_auto_scroll" is. svn path=/trunk/; revision=3388
2001-04-13Added the ethereal capture preferences to the preference file.Jeff Foster1-6/+4
svn path=/trunk/; revision=3298
2001-04-11The Software Porting And Archive Centre for HP-UX now has libpcap 0.6.2Guy Harris1-12/+9
binaries, so users only need to make sure they have that version installed in order to have Ethereal (and tcpdump, and snort, and so on) accept "lanN"-style names (i.e., names of the sort reported by lanscan and handled by ifconfig), rather than "dlpiN". Get rid of the patches to update libpcap, get rid of the discussion in "README.hpux" of patching libpcap and just say "get 0.6.2", and make the notes on HP-UX kernel patches to fix problems with capturing outgoing packets a separate item in the list of items in "README.hpux". Also update the error messages Ethereal and Tethereal display if they can't open a device and the error is "can't find PPA for XXX" to say "get 0.6.2" rather than "patch libpcap and recompile. svn path=/trunk/; revision=3288
2001-04-04WinPcap 2.1 allows you to capture on Token Ring, so remove the noteGuy Harris1-4/+3
about Token Ring in the "sorry, we couldn't open the capture device" dialog box on Windows. svn path=/trunk/; revision=3257
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-28 13:37:18 +0000