6 * Ethereal - Network traffic analyzer
7 * By Gerald Combs <gerald@ethereal.com>
8 * Copyright 1998 Gerald Combs
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version 2
13 * of the License, or (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
40 #include <epan/address.h>
41 #include <epan/addr_resolv.h>
46 * Collect command-line arguments as a string consisting of the arguments,
47 * separated by spaces.
50 get_args_as_string(int argc, char **argv, int optind)
57 * Find out how long the string will be.
60 for (i = optind; i < argc; i++) {
61 len += strlen(argv[i]);
62 len++; /* space, or '\0' if this is the last argument */
66 * Allocate the buffer for the string.
68 argstring = g_malloc(len);
71 * Now construct the string.
73 strcpy(argstring, "");
76 strcat(argstring, argv[i]);
80 strcat(argstring, " ");
85 /* Compute the difference between two seconds/microseconds time stamps. */
87 compute_timestamp_diff(gint *diffsec, gint *diffusec,
88 guint32 sec1, guint32 usec1, guint32 sec2, guint32 usec2)
91 /* The seconds part of the first time is the same as the seconds
92 part of the second time, so if the microseconds part of the first
93 time is less than the microseconds part of the second time, the
94 first time is before the second time. The microseconds part of
95 the delta should just be the difference between the microseconds
96 part of the first time and the microseconds part of the second
97 time; don't adjust the seconds part of the delta, as it's OK if
98 the microseconds part is negative. */
100 *diffsec = sec1 - sec2;
101 *diffusec = usec1 - usec2;
102 } else if (sec1 <= sec2) {
103 /* The seconds part of the first time is less than the seconds part
104 of the second time, so the first time is before the second time.
106 Both the "seconds" and "microseconds" value of the delta
107 should have the same sign, so if the difference between the
108 microseconds values would be *positive*, subtract 1,000,000
109 from it, and add one to the seconds value. */
110 *diffsec = sec1 - sec2;
111 if (usec2 >= usec1) {
112 *diffusec = usec1 - usec2;
114 *diffusec = (usec1 - 1000000) - usec2;
118 /* Oh, good, we're not caught in a chronosynclastic infindibulum. */
119 *diffsec = sec1 - sec2;
120 if (usec2 <= usec1) {
121 *diffusec = usec1 - usec2;
123 *diffusec = (usec1 + 1000000) - usec2;
129 /* Try to figure out if we're remotely connected, e.g. via ssh or
130 Terminal Server, and create a capture filter that matches aspects of the
131 connection. We match the following environment variables:
133 SSH_CONNECTION (ssh): <remote IP> <remote port> <local IP> <local port>
134 SSH_CLIENT (ssh): <remote IP> <remote port> <local port>
135 REMOTEHOST (tcsh, others?): <remote name>
136 DISPLAY (x11): [remote name]:<display num>
137 CLIENTNAME (terminal server): <remote name>
140 const gchar *get_conn_cfilter(void) {
141 static GString *filter_str = NULL;
142 gchar *env, **tokens;
144 if (filter_str == NULL) {
145 filter_str = g_string_new("");
147 if ((env = getenv("SSH_CONNECTION")) != NULL) {
148 tokens = g_strsplit(env, " ", 4);
150 g_string_sprintf(filter_str, "not (tcp port %s and %s host %s "
151 "and tcp port %s and %s host %s)", tokens[1], host_ip_af(tokens[0]), tokens[0],
152 tokens[3], host_ip_af(tokens[2]), tokens[2]);
153 return filter_str->str;
155 } else if ((env = getenv("SSH_CLIENT")) != NULL) {
156 tokens = g_strsplit(env, " ", 3);
157 g_string_sprintf(filter_str, "not (tcp port %s and %s host %s "
158 "and tcp port %s)", tokens[1], host_ip_af(tokens[0]), tokens[0], tokens[2]);
159 return filter_str->str;
160 } else if ((env = getenv("REMOTEHOST")) != NULL) {
161 if (strcasecmp(env, "localhost") == 0 || strcmp(env, "127.0.0.1") == 0) {
164 g_string_sprintf(filter_str, "not %s host %s", host_ip_af(env), env);
165 return filter_str->str;
166 } else if ((env = getenv("DISPLAY")) != NULL) {
167 tokens = g_strsplit(env, ":", 2);
168 if (tokens[0] && tokens[0][0] != 0) {
169 if (strcasecmp(tokens[0], "localhost") == 0 ||
170 strcmp(tokens[0], "127.0.0.1") == 0) {
173 g_string_sprintf(filter_str, "not %s host %s",
174 host_ip_af(tokens[0]), tokens[0]);
175 return filter_str->str;
177 } else if ((env = getenv("CLIENTNAME")) != NULL) {
178 g_string_sprintf(filter_str, "not tcp port 3389");
179 return filter_str->str;