3 * a simple triggered libpcap-based capture agent
5 * (c) 2007, Luis E. Garcia Ontanon <luis@ontanon.org>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * as published by the Free Software Foundation; either version 2
10 * of the License, or (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
31 #include <wsutil/wspcap.h>
34 static volatile int keep_going;
35 static pcap_t* listener;
36 static struct bpf_program stop_filter;
37 static int captured = 0;
38 static int debug_level = 0;
40 static void panic(int err, const char* fmt, ...) {
43 vfprintf(stderr,fmt,ap);
48 static void dprintf(int lev, const char* fmt, ...) {
51 if (lev <= debug_level) {
53 vfprintf(stderr,fmt,ap);
60 static void usage(int err) {
61 const char* usage_str = "usage:\n"
62 "trigcap -w outfile -b begin -e end [-f capture] [-i iface] [-s snaplen] [-p] [-q] [-d [-d [-d [-d]]]]\n"
64 " -b filter to start capturing\n"
65 " -e filter to stop capturing\n"
66 " -f capture filter\n"
67 " -p promiscuous mode\n"
68 " -s snapshot length\n"
70 " -d increase debug level\n"
71 " -h prints this message\n"
77 static void listener_handler(u_char* u, const struct pcap_pkthdr * ph, const u_char* buf) {
78 char errbuf[PCAP_ERRBUF_SIZE];
80 dprintf(2,"listener handler invoked dumping=%d\n",dumping);
83 dprintf(2,"last round\n");
86 if (pcap_setfilter(listener, &stop_filter) < 0) {
87 panic(23,"could not apply stop filter to listener: %s\n",pcap_geterr(listener));
90 dprintf(2,"apply stop filter to listener\n");
92 if (pcap_setnonblock(listener, 1, errbuf) < 0) {
93 panic(24,"could not set listener in non blocking mode: %s\n",errbuf);
96 dprintf(2,"listener -> non_blocking\n");
101 static void capture_handler(u_char* dumper, const struct pcap_pkthdr * ph, const u_char* buf) {
102 dprintf(4,"capture handler invoked dumping=%d\n",dumping);
105 pcap_dump(dumper, ph, buf);
109 static void sig_int(int sig) {
113 int main(int argc, char** argv) {
114 char errbuf[PCAP_ERRBUF_SIZE];
115 char* interface = NULL;
116 char* outfile = NULL;
117 guint snaplen = 65536;
118 char* start_filter_str = NULL;
119 char* stop_filter_str = NULL;
120 char* capture_filter_str = NULL;
123 struct bpf_program start_filter;
124 struct bpf_program capture_filter;
125 pcap_t* capturer = NULL;
126 pcap_dumper_t* dumper = NULL;
129 while ((opt = getopt(argc, argv, "i:w:s:b:e:f:phdq")) != -1) {
132 if (interface) panic(1,"interface already given");
133 interface = g_strdup(optarg);
136 if (outfile) panic(3,"output file already given");
137 outfile = g_strdup(optarg);
140 snaplen = strtoul(optarg,NULL,10);
142 panic(4,"invalid snaplen");
145 if (start_filter_str) panic(5,"start filter already given");
146 start_filter_str = g_strdup(optarg);
149 if (stop_filter_str) panic(6,"stop filter already given");
150 stop_filter_str = g_strdup(optarg);
153 if (capture_filter_str) panic(7,"capture filter already given");
154 capture_filter_str = g_strdup(optarg);
172 dprintf(1,"starting with:\n interface: %s\n snaplen: %d\n promisc: %d"
173 "\n outfile: %s\n capture filter: %s\n start: %s\n stop: %s\n debug level: %d\n",
174 interface ? interface : "to be chosen",
177 outfile ? outfile : "** missing **",
178 capture_filter_str ? capture_filter_str : "** none given **",
179 start_filter_str ? start_filter_str : "** missing **",
180 stop_filter_str ? stop_filter_str : "** missing **",
183 if (! ( start_filter_str && stop_filter_str && outfile ) ) {
188 interface = pcap_lookupdev(errbuf);
190 panic(11, "could not obtain an interface: %s\n",errbuf);
194 #ifdef HAVE_PCAP_OPEN
195 if ( ! ( capturer = pcap_open(interface, snaplen, promisc, 1, NULL, errbuf) )) {
197 if ( ! ( capturer = pcap_open_live(interface, snaplen, promisc, 1, errbuf) )) {
199 panic(12,"could not open interface '%s' for listener: %s\n",interface,errbuf);
202 dprintf(1,"opened listener (%s,%d,%d)\n",interface,snaplen, promisc);
204 if (pcap_compile(listener, &start_filter, start_filter_str, 1, 0) < 0) {
205 panic(13,"could not compile start filter: %s\n",pcap_geterr(listener));
208 dprintf(2,"compiled start filter %s\n",start_filter_str);
210 if (pcap_compile(listener, &stop_filter, stop_filter_str, 1, 0) < 0) {
211 panic(14,"could not compile stop filter: %s\n",pcap_geterr(listener));
214 dprintf(2,"compiled stop filter %s\n",stop_filter_str);
216 #ifdef HAVE_PCAP_OPEN
217 if ( ! ( capturer = pcap_open(interface, snaplen, promisc, 1, NULL, errbuf) )) {
219 if ( ! ( capturer = pcap_open_live(interface, snaplen, promisc, 1, errbuf) )) {
221 panic(15,"could not open interface '%s' for capturer: %s\n",interface, errbuf);
224 dprintf(1,"opened capturer (%s,%d,%d)\n",interface,snaplen, promisc);
226 if (capture_filter_str) {
227 if (pcap_compile(capturer, &capture_filter, capture_filter_str, 1, 0) < 0) {
228 panic(16,"could not compile capture filter: %s\n",pcap_geterr(capturer));
230 if (pcap_setfilter(capturer, &capture_filter) < 0) {
231 panic(17,"could not apply start filter to capturer: %s\n",pcap_geterr(capturer));
234 dprintf(2,"compiled and set capture filter (%s)\n",capture_filter_str);
237 if (pcap_setfilter(listener, &start_filter) < 0) {
238 panic(18,"could not apply start filter to listener: %s\n",pcap_geterr(listener));
240 dprintf(2,"set start filter on listener\n");
243 if (pcap_setnonblock(listener, 0, errbuf) < 0) {
244 panic(19,"could not set listener in blocking mode: %s\n",errbuf);
246 dprintf(2,"listener -> blocking\n");
248 if (pcap_setnonblock(capturer, 1, errbuf) < 0) {
249 panic(20,"could not set capturer in non blocking mode: %s\n",errbuf);
251 dprintf(2,"capturer -> non_blocking\n");
253 if (! (dumper = pcap_dump_open(listener,outfile)) ) {
254 panic(21,"open dumper file '%s': %s\n",outfile,pcap_geterr(listener));
256 dprintf(2,"opened dumper file '%s'\n",outfile);
258 signal(SIGINT, sig_int);
260 signal(SIGQUIT, sig_int);
263 signal(SIGTERM, sig_int);
266 signal(SIGSTOP, sig_int);
273 if (pcap_dispatch(listener, -1, listener_handler, NULL) < 0 ) {
274 panic(22,"pcap_dispatch(listener) failed: %s\n",pcap_geterr(listener));
277 if (pcap_dispatch(capturer, -1, capture_handler, (void*)dumper) < 0 ) {
278 panic(23,"pcap_dispatch(capturer) failed: %s\n",pcap_geterr(capturer));
283 printf("%d packets captured\n",captured);
286 dprintf(1,"done!\n");
288 pcap_dump_close(dumper);
289 pcap_close(listener);
290 pcap_close(capturer);
296 * Editor modelines - http://www.wireshark.org/tools/modelines.html
301 * indent-tabs-mode: t
304 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
305 * :indentSize=8:tabSize=8:noTabs=false: