aboutsummaryrefslogtreecommitdiffstats
path: root/tshark.c
AgeCommit message (Collapse)AuthorFilesLines
2011-02-19Sort capture file types listed by "-F" like editcap does.Chris Maynard1-8/+38
svn path=/trunk/; revision=36008
2011-02-03From Huzaifa Sidhpurwala of the Red Hat Security Response Team: Don'tGerald Combs1-1/+1
free uninitialized memory. See also: bug 5652. svn path=/trunk/; revision=35791
2011-01-06On Windows, convert all of our command-line arguments from UTF-16 toGerald Combs1-0/+13
UTF-8 where we don't already do so. In Wireshark use g_utf16_to_utf8 instead of utf_16to8. This should fix bug 5520. svn path=/trunk/; revision=35411
2010-12-22Avoid the need for cf_mark_frame stubs.Jaap Keuter1-6/+0
svn path=/trunk/; revision=35248
2010-12-20Rename the routines that handle dissector tables with unsigned integerGuy Harris1-1/+1
keys to have _uint in their names, to match the routines that handle dissector tables with string keys. (Using _port can confuse people into thinking they're intended solely for use with TCP/UDP/etc. ports when, in fact, they work better for things such as Ethernet types, where the binding of particular values to particular protocols are a lot stronger.) svn path=/trunk/; revision=35224
2010-11-05Bug fix: Running tshark with the following command will leave a temp file on ↵Anders Broman1-1/+4
the file system. \tshark -f "port 53" -a duration:1 -z proto,col info,dns.qry.type,dns.qry.type svn path=/trunk/; revision=34791
2010-10-21Fixed "Compiled with" information in the About box.Stig Bjørlykke1-1/+1
svn path=/trunk/; revision=34601
2010-10-12Rename g_resolv_flags --> gbl_resolv_flags; Also: cleanup some whitespace & ↵Bill Meier1-142/+142
indentation. svn path=/trunk/; revision=34487
2010-09-16Turn on ASLR via /DYNAMICBASE and DEP via SetProcessDEPPolicy().Gerald Combs1-1/+1
svn path=/trunk/; revision=34137
2010-07-16Make sure we call wtap_cleareof() before each read.Gerald Combs1-1/+1
svn path=/trunk/; revision=33555
2010-07-15Move the code to get version information for libraries used byGuy Harris1-1/+1
libwireshark into libwireshark, and call it only in programs linked with libwireshark. That way, programs that don't link with libwireshark don't have to link with libgcrypt or libgnutls solely so that they can say that they're linked with a particular version of libgcrypt or libgnutls. Don't link dumpcap with libgcrypt or libgnutls any more. svn path=/trunk/; revision=33531
2010-07-14Add an option to print the first, the last or all occurrences of each fieldSake Blok1-0/+1
(when using tshark -T fields) svn path=/trunk/; revision=33529
2010-07-14Make 'tshark -T fields' print all values for fields with multiple occurences.Sake Blok1-0/+1
svn path=/trunk/; revision=33527
2010-07-14Get rid of no-longer-used variable.Guy Harris1-6/+0
svn path=/trunk/; revision=33511
2010-07-01From Petr Lautrbach: when capturing, return the exit status of dumpcap,Guy Harris1-0/+2
so we give a non-zero exit status for invalid interfaces or capture filters. From me: don't exit immediately if dumpcap failed, print out information from taps and the like. svn path=/trunk/; revision=33393
2010-06-25r32715 fixed bug 4708 (zlib-1.2.5 cause wireshark to stop live capture)Gerald Combs1-0/+1
for Wireshark but not TShark. Apply the fix to TShark as well. Fixes bug 4916. svn path=/trunk/; revision=33327
2010-06-18From Jim Young:Anders Broman1-1/+35
The attached patch simply documents a long supported but hidden tshark -G option. Tshark's print_usage() has been augmented as well as the tshark man page. svn path=/trunk/; revision=33253
2010-06-07Alas, the stuff to see whether the standard output and error are theGuy Harris1-1/+5
same works only on UN*X; note that, and don't bother compiling it on Windows. svn path=/trunk/; revision=33125
2010-06-07If we get an error reading the capture file, don't give up - run theGuy Harris1-4/+25
taps, etc., so we at least print the statistics for the packets we *could* read. Also, if we're printing packet data, and the standard output and standard error are going to the same place, before printing the error message for that error, flush the standard output and print a newline to the standard error, so the error appears after all the packet data, and has a newline separating it from the packet data. This fixes bug 4845. svn path=/trunk/; revision=33124
2010-06-05Clarify an error message (and the corresponding comment).Guy Harris1-2/+5
Fix the no-libpcap build. svn path=/trunk/; revision=33103
2010-06-05Catch some cases that don't currently work.Guy Harris1-0/+19
svn path=/trunk/; revision=33100
2010-06-01capture() can, in some cases, return FALSE when the capture succeeds;Guy Harris1-3/+10
back out the change to check its return value until we fix that. Also back out the test suite changes to look for an error exit for invalid capture filters and interfaces. svn path=/trunk/; revision=33029
2010-05-28Move some code (including the optional objects) into libwsutilJeff Morriss1-2/+2
svn path=/trunk/; revision=33012
2010-05-28Use return rather than exit in main().Guy Harris1-53/+52
Return 2 for a capture error - we mainly use 1 for command-line syntax errors (rather than, say, filter syntax errors or an invalid interface). Now that TShark exits with an error status when given an invalid capture filter or invalid interface, check for "error" rather than "success" as an exit status. svn path=/trunk/; revision=33006
2010-05-27Fix bug #4735: tshark returns 0 on non-valid filter and interface.Bill Meier1-3/+5
See: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4735 svn path=/trunk/; revision=33004
2010-05-27Make -q not a capture option again - it's used by tshark even when notGuy Harris1-4/+7
capturing, and thus even when we build without pcap. svn path=/trunk/; revision=32988
2010-05-27Clean up the error reporting. An EOF from the sync pipe when capturingGuy Harris1-8/+20
is just an indication that the capture child exited; don't treat it as an error, unless the child process exits with an abnormal status. As tshark sends a "stop capture" indication to the child when it's ^C'ed, the child will exit and we'll get an EOF from the capture pipe; don't make SIGINT etc. interrupt system calls, so they don't cause reads from the capture pipe to get EINTR errors. svn path=/trunk/; revision=32986
2010-05-26Don't send ^T output to the standard error if we're a capture child.Guy Harris1-1/+1
Make SIGINFO a restart-the-system-call signal, so reads etc. don't return an error. svn path=/trunk/; revision=32968
2010-05-26If dumpcap exits abnormally, report the error.Guy Harris1-2/+8
svn path=/trunk/; revision=32964
2010-05-26Fix build without pcap.Guy Harris1-1/+1
svn path=/trunk/; revision=32959
2010-05-26Add a -q flag to dumpcap, to squelch its reporting of the packet count,Guy Harris1-9/+6
and add support for SIGINFO, so, if your OS supports SIGINFO, you can get the packet count by typing ^T. svn path=/trunk/; revision=32958
2010-05-19Fix indentation.Guy Harris1-17/+17
svn path=/trunk/; revision=32886
2010-05-17When dumpcap is run to get an interface list, interface capabilities, orGuy Harris1-3/+1
interface statistics, have its error messages come out as sync-pipe errors, have it send a sync-pipe "success" message on success, and have the callers get that message and display it. svn path=/trunk/; revision=32843
2010-05-14Um, no, the problem with the Leopard x86 build is that we first do aGuy Harris1-1/+1
build without libpcap, to make sure that works, and then do a build with libpcap, to put into a binary release. It's the former that's failing; I'll back out the previous change and then work on that. svn path=/trunk/; revision=32801
2010-05-14See whether the Leopard x86 buildbot is upset because of the nameGuy Harris1-1/+1
if_capabilities_t - it doesn't fail on Snow Leopard, even if I undefine HAVE_PCAP_CREATE, and doesn't fail on the Leopard PPC buildbot, either. svn path=/trunk/; revision=32799
2010-05-13Fetch an indication of whether the interface supports capturing inGuy Harris1-14/+17
monitor mode at the same time that we fetch its list of link-layer types. Support fetching that list in monitor mode, as the list may be different in regular and monitor mode. If the interface supports monitor mode, when printing the list of link-layer types, indicate whether they're fetched in monitor mode or not, as tcpdump 4.1.x does. svn path=/trunk/; revision=32789
2010-05-10Fix a gcc -Wshadow warning.Bill Meier1-5/+5
svn path=/trunk/; revision=32737
2010-05-08The default capture buffer size is, in fact, *nominally* 1MB; however,Guy Harris1-1/+1
libpcap/WinPcap and the capture mechanism atop which they run might either silently limit the buffer size to a smaller value or raise it to a higher value - that's the part that's platform-dependent. svn path=/trunk/; revision=32718
2010-05-07As with the list of data link types, so with the list of interfaces; moveGuy Harris1-2/+19
the code to print the machine-readable format into dumpcap, and have the code in capture_opts.c just print the human-readable format. svn path=/trunk/; revision=32714
2010-05-07Add routines vfprintf_stderr() and fprintf_stderr() to print to theGuy Harris1-0/+21
standard error and, in Wireshark on Windows, create a console if necessary. Have the cmdarg_err routines use them. Use *fprintf_stderr() to print the output of -L, rather than using cmdarg_err_cont(), so that we don't get extra newlines in the output (it should look similar to the output of tcpdump). svn path=/trunk/; revision=32711
2010-05-07For TShark and Wireshark, get the list of link-layer types for anGuy Harris1-2/+19
interface by running dumpcap, so that if you need privileges to open an interface, and dumpcap has those privileges, neither TShark nor Wireshark need them. svn path=/trunk/; revision=32710
2010-05-07Add monitor mode support to TShark.Guy Harris1-6/+19
svn path=/trunk/; revision=32704
2010-05-07Instead, say that the default is platform-dependent.Guy Harris1-1/+1
svn path=/trunk/; revision=32701
2010-05-07Now that we support -B on various UN*X platforms as well as Windows, weGuy Harris1-1/+1
can no longer state what the default is (it's platform-dependent). svn path=/trunk/; revision=32700
2010-05-06Set the timestamp seconds type to TS_SECONDS_DEFAULT at startup so weGerald Combs1-0/+1
don't abort. svn path=/trunk/; revision=32697
2010-05-06Just check for pcap_create(); it first appeared in libpcap 1.0.0, andGuy Harris1-5/+5
pcap_set_buffer_size() did as well, so there aren't any libpcap releases with pcap_create() but not pcap_set_buffer_size(). Only do one check for pcap_create. svn path=/trunk/; revision=32695
2010-05-06Checking in Stigs changes fromAnders Broman1-9/+9
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=475 BUT not activating the check for pcap_create() pcap_set_buffer_size() This should make it possible to build with support for setting the buffersize if not capturing 802.11 traffic. The code for handling the 'B' option should be OK in any case. svn path=/trunk/; revision=32688
2010-05-06Moved command line option for seconds type to -u.Stig Bjørlykke1-1/+13
Added this option to tshark. svn path=/trunk/; revision=32685
2010-04-16Fix https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2742 :Jeff Morriss1-3/+11
If the user specifies -V or -x, turn on print_packet_info (-S) so they actually get some output in case we're also writing to a file. svn path=/trunk/; revision=32486
2010-03-04"capture-pcap-util.h" include <pcap.h>, and <pcap.h>, for better orGuy Harris1-1/+0
worse, has no include-once guards; include it only once. svn path=/trunk/; revision=32110
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-03 09:28:35 +0000