trigcap.c

   1 /*
   2  * trigcap
   3  * a simple triggered libpcap-based capture agent
   4  *
   5  * (c) 2007, Luis E. Garcia Ontanon <luis@ontanon.org>
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License
   9  * as published by the Free Software Foundation; either version 2
  10  * of the License, or (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  20  *
  21  */
  22
  23 #include <stdio.h>
  24 #include <stdlib.h>
  25 #include <stdarg.h>
  26 #include <string.h>
  27 #include <signal.h>
  28 #include <errno.h>
  29 #include <getopt.h>
  30 #include <pcap.h>
  31
  32 static int dumping;
  33 static volatile int keep_going;
  34 static pcap_t* listener;
  35 static struct bpf_program stop_filter;
  36 static int captured = 0;
  37 static int debug_level = 0;
  38
  39 static void panic(int err, const char* fmt, ...) {
  40         va_list ap;
  41         va_start(ap,fmt);
  42         vfprintf(stderr,fmt,ap);
  43         va_end(ap);
  44         exit(err);
  45 }
  46
  47 static void dprintf(int lev, const char* fmt, ...) {
  48         va_list ap;
  49
  50         if (lev <= debug_level) {
  51                 va_start(ap,fmt);
  52                 vfprintf(stderr,fmt,ap);
  53                 va_end(ap);
  54                 fflush(stderr);
  55         }
  56 }
  57
  58
  59 static void usage(int err) {
  60         const char* usage_str = "usage:\n"
  61         "trigcap -w outfile -b begin -e end [-f capture] [-i iface] [-s snaplen] [-p] [-q] [-d [-d [-d [-d]]]]\n"
  62         "   -w output file\n"
  63         "   -b filter to start capturing\n"
  64         "   -e filter to stop capturing\n"
  65         "   -f capture filter\n"
  66         "   -p promiscuous mode\n"
  67         "   -s snapshot length\n"
  68         "   -q quiet\n"
  69         "   -d increase debug level\n"
  70         "   -h prints this message\n"
  71         ;
  72
  73         panic(err,usage_str);
  74 }
  75
  76 static void listener_handler(u_char* u, const struct pcap_pkthdr * ph, const u_char* buf) {
  77         char errbuf[PCAP_ERRBUF_SIZE];
  78
  79         dprintf(2,"listener handler invoked dumping=%d\n",dumping);
  80
  81         if (dumping) {
  82                 dprintf(2,"last round\n");
  83                 keep_going = 0;
  84         } else {
  85                 if (pcap_setfilter(listener, &stop_filter) < 0) {
  86                         panic(23,"could not apply stop filter to listener: %s\n",pcap_geterr(listener));
  87                 }
  88
  89                 dprintf(2,"apply stop filter to listener\n");
  90
  91                 if (pcap_setnonblock(listener, 1, errbuf) < 0) {
  92                         panic(24,"could not set listener in non blocking mode: %s\n",errbuf);
  93                 }
  94
  95                 dprintf(2,"listener -> non_blocking\n");
  96                 dumping = 1;
  97         }
  98 }
  99
 100 static void capture_handler(u_char* dumper, const struct pcap_pkthdr * ph, const u_char* buf) {
 101         dprintf(4,"capture handler invoked dumping=%d\n",dumping);
 102         if (dumping) {
 103                 captured++;
 104                 pcap_dump(dumper, ph, buf);
 105         }
 106 }
 107
 108 static void sig_int(int sig) {
 109         keep_going = 0;
 110 }
 111
 112 int main(int argc, char** argv) {
 113         char errbuf[PCAP_ERRBUF_SIZE];
 114         char* interface = NULL;
 115         char* outfile = NULL;
 116         guint snaplen = 65536;
 117         char* start_filter_str = NULL;
 118         char* stop_filter_str = NULL;
 119         char* capture_filter_str = NULL;
 120         int promisc = 0;
 121         int quiet = 0;
 122         struct bpf_program start_filter;
 123         struct bpf_program capture_filter;
 124         pcap_t* capturer = NULL;
 125         pcap_dumper_t* dumper = NULL;
 126         int opt;
 127
 128         while ((opt = getopt(argc, argv, "i:w:s:b:e:f:phdq")) != -1) {
 129                 switch (opt) {
 130                         case 'i':
 131                                 if (interface) panic(1,"interface already given");
 132                                 interface = g_strdup(optarg);
 133                                 break;
 134                         case 'w':
 135                                 if (outfile) panic(3,"output file already given");
 136                                 outfile = g_strdup(optarg);
 137                                 break;
 138                         case 's':
 139                                 snaplen = strtoul(optarg,NULL,10);
 140                                 if ( snaplen == 0 )
 141                                         panic(4,"invalid snaplen");
 142                                 break;
 143                         case 'b':
 144                                 if (start_filter_str) panic(5,"start filter already given");
 145                                 start_filter_str = g_strdup(optarg);
 146                                 break;
 147                         case 'e':
 148                                 if (stop_filter_str) panic(6,"stop filter already given");
 149                                 stop_filter_str = g_strdup(optarg);
 150                                 break;
 151                         case 'f':
 152                                 if (capture_filter_str) panic(7,"capture filter already given");
 153                                 capture_filter_str = g_strdup(optarg);
 154                                 break;
 155                         case 'p':
 156                                 promisc = 1;
 157                                 break;
 158                         case 'q':
 159                                 quiet = 1;
 160                                 break;
 161                         case 'd':
 162                                 debug_level++;
 163                                 break;
 164                         case 'h':
 165                         default:
 166                                 usage(0);
 167                                 break;
 168                         }
 169                 }
 170
 171         dprintf(1,"starting with:\n interface: %s\n snaplen: %d\n promisc: %d"
 172                         "\n outfile: %s\n capture filter: %s\n start: %s\n stop: %s\n debug level: %d\n",
 173                         interface ? interface : "to be chosen",
 174                         snaplen,
 175                         promisc,
 176                         outfile ? outfile : "** missing **",
 177                         capture_filter_str ? capture_filter_str : "** none given **",
 178                         start_filter_str ? start_filter_str : "** missing **",
 179                         stop_filter_str ? stop_filter_str : "** missing **",
 180                         debug_level);
 181
 182         if (! ( start_filter_str && stop_filter_str && outfile ) ) {
 183                 usage(10);
 184         }
 185
 186         if (! interface) {
 187                 interface = pcap_lookupdev(errbuf);
 188                 if (!interface) {
 189                         panic(11, "could not obtain an interface: %s\n",errbuf);
 190                 }
 191         }
 192
 193 #ifdef HAVE_PCAP_OPEN
 194         if ( ! ( capturer = pcap_open(interface, snaplen, promisc, 1, NULL, errbuf) )) {
 195 #else
 196         if ( ! ( capturer = pcap_open_live(interface, snaplen, promisc, 1, errbuf) )) {
 197 #endif
 198                 panic(12,"could not open interface '%s' for listener: %s\n",interface,errbuf);
 199         }
 200
 201         dprintf(1,"opened listener (%s,%d,%d)\n",interface,snaplen, promisc);
 202
 203         if (pcap_compile(listener, &start_filter, start_filter_str, 1, 0) < 0) {
 204                 panic(13,"could not compile start filter: %s\n",pcap_geterr(listener));
 205         }
 206
 207         dprintf(2,"compiled start filter %s\n",start_filter_str);
 208
 209         if (pcap_compile(listener, &stop_filter, stop_filter_str, 1, 0) < 0) {
 210                 panic(14,"could not compile stop filter: %s\n",pcap_geterr(listener));
 211         }
 212
 213         dprintf(2,"compiled stop filter %s\n",stop_filter_str);
 214
 215 #ifdef HAVE_PCAP_OPEN
 216         if ( ! ( capturer = pcap_open(interface, snaplen, promisc, 1, NULL, errbuf) )) {
 217 #else
 218         if ( ! ( capturer = pcap_open_live(interface, snaplen, promisc, 1, errbuf) )) {
 219 #endif
 220                 panic(15,"could not open interface '%s' for capturer: %s\n",interface, errbuf);
 221         }
 222
 223         dprintf(1,"opened capturer (%s,%d,%d)\n",interface,snaplen, promisc);
 224
 225         if (capture_filter_str) {
 226                 if (pcap_compile(capturer, &capture_filter, capture_filter_str, 1, 0) < 0) {
 227                         panic(16,"could not compile capture filter: %s\n",pcap_geterr(capturer));
 228                 }
 229                 if (pcap_setfilter(capturer, &capture_filter) < 0) {
 230                         panic(17,"could not apply start filter to capturer: %s\n",pcap_geterr(capturer));
 231                 }
 232
 233                 dprintf(2,"compiled and set capture filter (%s)\n",capture_filter_str);
 234         }
 235
 236         if (pcap_setfilter(listener, &start_filter) < 0) {
 237                 panic(18,"could not apply start filter to listener: %s\n",pcap_geterr(listener));
 238         }
 239         dprintf(2,"set start filter on listener\n");
 240
 241
 242         if (pcap_setnonblock(listener, 0, errbuf) < 0) {
 243                 panic(19,"could not set listener in blocking mode: %s\n",errbuf);
 244         }
 245         dprintf(2,"listener -> blocking\n");
 246
 247         if (pcap_setnonblock(capturer, 1, errbuf) < 0) {
 248                 panic(20,"could not set capturer in non blocking mode: %s\n",errbuf);
 249         }
 250         dprintf(2,"capturer -> non_blocking\n");
 251
 252         if (! (dumper = pcap_dump_open(listener,outfile)) ) {
 253                 panic(21,"open dumper file '%s': %s\n",outfile,pcap_geterr(listener));
 254         }
 255         dprintf(2,"opened dumper file '%s'\n",outfile);
 256
 257         signal(SIGINT, sig_int);
 258 #ifdef SIGQUIT
 259         signal(SIGQUIT, sig_int);
 260 #endif
 261 #ifdef SIGTERM
 262         signal(SIGTERM, sig_int);
 263 #endif
 264 #ifdef SIGSTOP
 265         signal(SIGSTOP, sig_int);
 266 #endif
 267
 268         keep_going = 1;
 269         dumping = 0;
 270
 271         do {
 272                 if (pcap_dispatch(listener, -1, listener_handler, NULL) < 0 ) {
 273                         panic(22,"pcap_dispatch(listener) failed: %s\n",pcap_geterr(listener));
 274                 }
 275
 276                 if (pcap_dispatch(capturer, -1, capture_handler, (void*)dumper) < 0 ) {
 277                         panic(23,"pcap_dispatch(capturer) failed: %s\n",pcap_geterr(capturer));
 278                 }
 279         } while(keep_going);
 280
 281         if (!quiet) {
 282                 printf("%d packets captured\n",captured);
 283         }
 284
 285         dprintf(1,"done!\n");
 286
 287         pcap_dump_close(dumper);
 288         pcap_close(listener);
 289         pcap_close(capturer);
 290
 291         return 0;
 292 }
 293
 294 /*
 295  * Editor modelines  -  http://www.wireshark.org/tools/modelines.html
 296  *
 297  * Local variables:
 298  * c-basic-offset: 8
 299  * tab-width: 8
 300  * indent-tabs-mode: t
 301  * End:
 302  *
 303  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
 304  * :indentSize=8:tabSize=8:noTabs=false:
 305  */