/* tethereal.c
*
- * $Id: tethereal.c,v 1.208 2003/12/09 05:56:30 gram Exp $
+ * $Id$
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*/
+/* With MSVC and a libethereal.dll this file needs to import some variables
+ in a special way. Therefore _NEED_VAR_IMPORT_ is defined. */
+#define _NEED_VAR_IMPORT_
+
#ifdef HAVE_CONFIG_H
# include "config.h"
#endif
#include "getopt.h"
#endif
+#include "svnversion.h"
+
#include <glib.h>
#include <epan/epan.h>
#include <epan/filesystem.h>
#include "print.h"
#include <epan/resolv.h>
#include "util.h"
+#include "version_info.h"
#ifdef HAVE_LIBPCAP
#include "pcap-util.h"
#endif
#include "ringbuffer.h"
#include <epan/epan_dissect.h>
#include "tap.h"
+#include <epan/timestamp.h>
#ifdef HAVE_LIBPCAP
#include <wiretap/wtap-capture.h>
* various functions that output the usage for this parameter.
*/
static const gchar decode_as_arg_template[] = "<layer_type>==<selector>,<decode_as_protocol>";
+
static guint32 firstsec, firstusec;
static guint32 prevsec, prevusec;
static GString *comp_info_str, *runtime_info_str;
static gboolean quiet;
-static gboolean decode;
+
+static gboolean print_packet_info; /* TRUE if we're to print packet information */
+/*
+ * The way the packet decode is to be written.
+ */
+typedef enum {
+ WRITE_TEXT, /* summary or detail text */
+ WRITE_XML /* PDML or PSML */
+ /* Add CSV and the like here */
+} output_action_e;
+static output_action_e output_action;
+static gboolean do_dissection; /* TRUE if we have to dissect each packet */
static gboolean verbose;
static gboolean print_hex;
static gboolean line_buffered;
-static guint32 cul_bytes = 0;
-static int print_format;
+static guint32 cum_bytes = 0;
+static print_format_e print_format = PR_FMT_TEXT;
+static print_stream_t *print_stream;
#ifdef HAVE_LIBPCAP
typedef struct _loop_data {
#endif /* _WIN32 */
#endif /* HAVE_LIBPCAP */
-typedef struct {
- capture_file *cf;
- wtap_dumper *pdh;
-} cb_args_t;
-
static int load_cap_file(capture_file *, int);
-static void wtap_dispatch_cb_write(guchar *, const struct wtap_pkthdr *, long,
- union wtap_pseudo_header *, const guchar *);
+static gboolean process_packet(capture_file *cf, wtap_dumper *pdh, long offset,
+ const struct wtap_pkthdr *whdr, union wtap_pseudo_header *pseudo_header,
+ const guchar *pd, int *err);
static void show_capture_file_io_error(const char *, int, gboolean);
-static void wtap_dispatch_cb_print(guchar *, const struct wtap_pkthdr *, long,
- union wtap_pseudo_header *, const guchar *);
+static void show_print_file_io_error(int err);
+static gboolean write_preamble(capture_file *cf);
+static gboolean print_packet(capture_file *cf, epan_dissect_t *edt);
+static gboolean write_finale(void);
+static char *cf_open_error_message(int err, gchar *err_info,
+ gboolean for_writing, int file_type);
#ifdef HAVE_LIBPCAP
#ifndef _WIN32
static void adjust_header(loop_data *, struct pcap_hdr *, struct pcaprec_hdr *);
#endif /* _WIN32 */
#endif
+static void open_failure_message(const char *filename, int err,
+ gboolean for_writing);
+static void failure_message(const char *msg_format, va_list ap);
+static void read_failure_message(const char *filename, int err);
+
capture_file cfile;
-ts_type timestamp_type = RELATIVE;
#ifdef HAVE_LIBPCAP
typedef struct {
int snaplen; /* Maximum captured packet length */
print_usage(gboolean print_ver)
{
int i;
+ FILE *output;
if (print_ver) {
- fprintf(stderr, "This is GNU t%s %s\n%s\n%s\n", PACKAGE, VERSION,
+ output = stdout;
+ fprintf(output, "This is GNU t" PACKAGE " " VERSION
+#ifdef SVNVERSION
+ " (" SVNVERSION ")"
+#endif
+ "\n (C) 1998-2004 Gerald Combs <gerald@ethereal.com>"
+ "\n%s\n%s\n",
+
comp_info_str->str, runtime_info_str->str);
+ } else {
+ output = stderr;
}
#ifdef HAVE_LIBPCAP
- fprintf(stderr, "\nt%s [ -vh ] [ -DlLnpqSVx ] [ -a <capture autostop condition> ] ...\n",
+ fprintf(output, "\nt%s [ -vh ] [ -DlLnpqSVx ] [ -a <capture autostop condition> ] ...\n",
PACKAGE);
- fprintf(stderr, "\t[ -b <number of ring buffer files>[:<duration>] ] [ -c <count> ]\n");
- fprintf(stderr, "\t[ -d %s ] ...\n", decode_as_arg_template);
- fprintf(stderr, "\t[ -f <capture filter> ] [ -F <output file type> ] [ -i <interface> ]\n");
- fprintf(stderr, "\t[ -N <resolving> ] [ -o <preference setting> ] ... [ -r <infile> ]\n");
- fprintf(stderr, "\t[ -R <read filter> ] [ -s <snaplen> ] [ -t <time stamp format> ]\n");
- fprintf(stderr, "\t[ -T pdml|ps|text ] [ -w <savefile> ] [ -y <link type> ]\n");
- fprintf(stderr, "\t[ -z <statistics string> ]\n");
+ fprintf(output, "\t[ -b <number of ring buffer files>[:<duration>] ] [ -c <count> ]\n");
+ fprintf(output, "\t[ -d %s ] ...\n", decode_as_arg_template);
+ fprintf(output, "\t[ -f <capture filter> ] [ -F <output file type> ] [ -i <interface> ]\n");
+ fprintf(output, "\t[ -N <resolving> ] [ -o <preference setting> ] ... [ -r <infile> ]\n");
+ fprintf(output, "\t[ -R <read filter> ] [ -s <snaplen> ] [ -t <time stamp format> ]\n");
+ fprintf(output, "\t[ -T pdml|ps|text ] [ -w <savefile> ] [ -y <link type> ]\n");
+ fprintf(output, "\t[ -z <statistics string> ]\n");
#else
- fprintf(stderr, "\nt%s [ -vh ] [ -lnVx ]\n", PACKAGE);
- fprintf(stderr, "\t[ -d %s ] ...\n", decode_as_arg_template);
- fprintf(stderr, "\t[ -F <output file type> ] [ -N <resolving> ]\n");
- fprintf(stderr, "\t[ -o <preference setting> ] ... [ -r <infile> ] [ -R <read filter> ]\n");
- fprintf(stderr, "\t[ -t <time stamp format> ] [ -T pdml|ps|text ] [ -w <savefile> ]\n");
- fprintf(stderr, "\t[ -z <statistics string> ]\n");
+ fprintf(output, "\nt%s [ -vh ] [ -lnVx ]\n", PACKAGE);
+ fprintf(output, "\t[ -d %s ] ...\n", decode_as_arg_template);
+ fprintf(output, "\t[ -F <output file type> ] [ -N <resolving> ]\n");
+ fprintf(output, "\t[ -o <preference setting> ] ... [ -r <infile> ] [ -R <read filter> ]\n");
+ fprintf(output, "\t[ -t <time stamp format> ] [ -T pdml|ps|text ] [ -w <savefile> ]\n");
+ fprintf(output, "\t[ -z <statistics string> ]\n");
#endif
- fprintf(stderr, "Valid file type arguments to the \"-F\" flag:\n");
+ fprintf(output, "Valid file type arguments to the \"-F\" flag:\n");
for (i = 0; i < WTAP_NUM_FILE_TYPES; i++) {
if (wtap_dump_can_open(i))
- fprintf(stderr, "\t%s - %s\n",
+ fprintf(output, "\t%s - %s\n",
wtap_file_type_short_string(i), wtap_file_type_string(i));
}
- fprintf(stderr, "\tdefault is libpcap\n");
+ fprintf(output, "\tdefault is libpcap\n");
}
#ifdef HAVE_LIBPCAP
#endif /* _WIN32 */
char *gpf_path, *pf_path;
- char *dp_path;
+ char *gdp_path, *dp_path;
int gpf_open_errno, gpf_read_errno;
int pf_open_errno, pf_read_errno;
+ int gdp_open_errno, gdp_read_errno;
int dp_open_errno, dp_read_errno;
int err;
#ifdef HAVE_LIBPCAP
long adapter_index;
char *p;
gchar err_str[PCAP_ERRBUF_SIZE];
+ gchar *cant_get_if_list_errstr;
#else
gboolean capture_option_specified = FALSE;
#endif
GList *lt_list, *lt_entry;
data_link_info_t *data_link_info;
#endif
-#ifdef HAVE_PCAP_COMPILE_NOPCAP
+#ifdef HAVE_PCAP_OPEN_DEAD
struct bpf_program fcode;
#endif
dfilter_t *rfcode = NULL;
char badopt;
ethereal_tap_list *tli;
+ set_timestamp_setting(TS_RELATIVE);
+
/* Register all dissectors; we must do this before checking for the
"-G" flag, as the "-G" flag dumps information registered by the
dissectors, and we must do it before we read the preferences, in
case any dissectors register preferences. */
- epan_init(PLUGIN_DIR,register_all_protocols,register_all_protocol_handoffs);
+ epan_init(PLUGIN_DIR,register_all_protocols,register_all_protocol_handoffs,
+ failure_message,open_failure_message,read_failure_message);
/* Register all tap listeners; we do this before we parse the arguments,
as the "-z" argument can specify a registered tap. */
g_resolv_flags = prefs->name_resolve;
/* Read the disabled protocols file. */
- read_disabled_protos_list(&dp_path, &dp_open_errno, &dp_read_errno);
+ read_disabled_protos_list(&gdp_path, &gdp_open_errno, &gdp_read_errno,
+ &dp_path, &dp_open_errno, &dp_read_errno);
+ if (gdp_path != NULL) {
+ if (gdp_open_errno != 0) {
+ fprintf(stderr,
+ "Could not open global disabled protocols file\n\"%s\": %s.\n",
+ gdp_path, strerror(gdp_open_errno));
+ }
+ if (gdp_read_errno != 0) {
+ fprintf(stderr,
+ "I/O error reading global disabled protocols file\n\"%s\": %s.\n",
+ gdp_path, strerror(gdp_read_errno));
+ }
+ g_free(gdp_path);
+ }
if (dp_path != NULL) {
if (dp_open_errno != 0) {
fprintf(stderr,
switch (err) {
case CANT_GET_INTERFACE_LIST:
- fprintf(stderr, "tethereal: Can't get list of interfaces: %s\n",
- err_str);
+ cant_get_if_list_errstr =
+ cant_get_if_list_error_message(err_str);
+ fprintf(stderr, "tethereal: %s\n", cant_get_if_list_errstr);
+ g_free(cant_get_if_list_errstr);
break;
case NO_INTERFACES_FOUND:
switch (err) {
case CANT_GET_INTERFACE_LIST:
- fprintf(stderr, "tethereal: Can't get list of interfaces: %s\n",
- err_str);
+ cant_get_if_list_errstr =
+ cant_get_if_list_error_message(err_str);
+ fprintf(stderr, "tethereal: %s\n", cant_get_if_list_errstr);
+ g_free(cant_get_if_list_errstr);
break;
case NO_INTERFACES_FOUND:
is probably actually better for "-V", as it does fewer
writes).
- See the comment in "wtap_dispatch_cb_print()" for an
- explanation of why we do that, and why we don't just
- use "setvbuf()" to make the standard output line-buffered
- (short version: in Windows, "line-buffered" is the same
- as "fully-buffered", and the output buffer is only flushed
- when it fills up). */
+ See the comment in "process_packet()" for an explanation of
+ why we do that, and why we don't just use "setvbuf()" to
+ make the standard output line-buffered (short version: in
+ Windows, "line-buffered" is the same as "fully-buffered",
+ and the output buffer is only flushed when it fills up). */
line_buffered = TRUE;
break;
case 'L': /* Print list of link-layer types and exit */
#endif
break;
case 'S': /* show packets in real time */
- decode = TRUE;
+ print_packet_info = TRUE;
break;
case 't': /* Time stamp type */
if (strcmp(optarg, "r") == 0)
- timestamp_type = RELATIVE;
+ set_timestamp_setting(TS_RELATIVE);
else if (strcmp(optarg, "a") == 0)
- timestamp_type = ABSOLUTE;
+ set_timestamp_setting(TS_ABSOLUTE);
else if (strcmp(optarg, "ad") == 0)
- timestamp_type = ABSOLUTE_WITH_DATE;
+ set_timestamp_setting(TS_ABSOLUTE_WITH_DATE);
else if (strcmp(optarg, "d") == 0)
- timestamp_type = DELTA;
+ set_timestamp_setting(TS_DELTA);
else {
fprintf(stderr, "tethereal: Invalid time stamp type \"%s\"\n",
optarg);
}
break;
case 'T': /* printing Type */
- if (strcmp(optarg, "text") == 0)
- print_format = PR_FMT_TEXT;
- else if (strcmp(optarg, "pdml") == 0)
- print_format = PR_FMT_PDML;
- else if (strcmp(optarg, "ps") == 0)
- print_format = PR_FMT_PS;
- else {
- fprintf(stderr, "tethereal: Invalid -T parameter.\n");
- fprintf(stderr, "It must be \"ps\", \"text\" or \"pdml\".\n");
- exit(1);
+ if (strcmp(optarg, "text") == 0) {
+ output_action = WRITE_TEXT;
+ print_format = PR_FMT_TEXT;
+ } else if (strcmp(optarg, "ps") == 0) {
+ output_action = WRITE_TEXT;
+ print_format = PR_FMT_PS;
+ } else if (strcmp(optarg, "pdml") == 0) {
+ output_action = WRITE_XML;
+ verbose = TRUE;
+ } else if (strcmp(optarg, "psml") == 0) {
+ output_action = WRITE_XML;
+ verbose = FALSE;
+ } else {
+ fprintf(stderr, "tethereal: Invalid -T parameter.\n");
+ fprintf(stderr, "It must be \"ps\", \"text\", \"pdml\", or \"psml\".\n");
+ exit(1);
}
break;
case 'v': /* Show version and exit */
- printf("t%s %s\n%s\n%s\n", PACKAGE, VERSION, comp_info_str->str,
- runtime_info_str->str);
+ printf("t" PACKAGE " " VERSION
+#ifdef SVNVERSION
+ " (" SVNVERSION ")"
+#endif
+ "\n%s\n%s\n",
+ comp_info_str->str, runtime_info_str->str);
exit(0);
break;
case 'w': /* Write to capture file xxx */
}
}
- /* If printing PDML or PS, force -V */
- if (print_format == PR_FMT_PDML || PR_FMT_PS)
- verbose = TRUE;
-
/* If no capture filter or read filter has been specified, and there are
still command-line arguments, treat them as the tokens of a capture
filter (if no "-r" flag was specified) or a read filter (if a "-r"
ld.output_to_pipe = FALSE;
#endif
if (cfile.save_file != NULL) {
+ /* We're writing to a capture file. */
if (strcmp(cfile.save_file, "-") == 0) {
- /* stdout */
+ /* Write to the standard output. */
g_free(cfile.save_file);
cfile.save_file = g_strdup("");
#ifdef HAVE_LIBPCAP
+ /* XXX - should we check whether it's a pipe? It's arguably
+ silly to do "-w - >output_file" rather than "-w output_file",
+ but by not checking we might be violating the Principle Of
+ Least Astonishment. */
ld.output_to_pipe = TRUE;
#endif
}
}
}
#endif
+ } else {
+ /* We're not writing to a file, so we should print packet information
+ unless "-q" was specified. */
+ if (!quiet)
+ print_packet_info = TRUE;
}
#ifndef HAVE_LIBPCAP
exit(1);
}
+ if (print_hex) {
+ if (output_action != WRITE_TEXT) {
+ fprintf(stderr, "tethereal: Raw packet hex data can only be printed as text or PostScript\n");
+ exit(1);
+ }
+ }
+
#ifdef HAVE_LIBPCAP
if (list_link_layer_types) {
/* We're supposed to list the link-layer types for an interface;
prefs_apply_all();
/* disabled protocols as per configuration file */
- if (dp_path == NULL) {
+ if (gdp_path == NULL && dp_path == NULL) {
set_disabled_protos_list();
}
if (!dfilter_compile(rfilter, &rfcode)) {
fprintf(stderr, "tethereal: %s\n", dfilter_error_msg);
epan_cleanup();
-#ifdef HAVE_PCAP_COMPILE_NOPCAP
- if (pcap_compile_nopcap(DLT_EN10MB, 0, &fcode, rfilter, 0, 0) != -1) {
- fprintf(stderr,
- " Note: This display filter code looks like a valid capture filter;\n"
- " maybe you mixed them up?\n");
+#ifdef HAVE_PCAP_OPEN_DEAD
+ {
+ pcap_t *p;
+
+ p = pcap_open_dead(DLT_EN10MB, MIN_PACKET_SIZE);
+ if (p != NULL) {
+ if (pcap_compile(p, &fcode, rfilter, 0, 0) != -1) {
+ fprintf(stderr,
+ " Note: That display filter code looks like a valid capture filter;\n"
+ " maybe you mixed them up?\n");
+ }
+ pcap_close(p);
+ }
}
#endif
exit(2);
}
}
cfile.rfcode = rfcode;
+
+ if (print_packet_info) {
+ /* If we're printing as text or PostScript, we have
+ to create a print stream. */
+ if (output_action == WRITE_TEXT) {
+ switch (print_format) {
+
+ case PR_FMT_TEXT:
+ print_stream = print_stream_text_stdio_new(stdout);
+ break;
+
+ case PR_FMT_PS:
+ print_stream = print_stream_ps_stdio_new(stdout);
+ break;
+
+ default:
+ g_assert_not_reached();
+ }
+ }
+ }
+
+ /* We have to dissect each packet if:
+
+ we're printing information about each packet;
+
+ we're using a read filter on the packets;
+
+ we're using any taps. */
+ do_dissection = print_packet_info || rfcode || have_tap_listeners();
+
if (cf_name) {
/*
* We're reading a capture file.
switch (err) {
case CANT_GET_INTERFACE_LIST:
- fprintf(stderr, "tethereal: Can't get list of interfaces: %s\n",
- err_str);
+ cant_get_if_list_errstr =
+ cant_get_if_list_error_message(err_str);
+ fprintf(stderr, "tethereal: %s\n", cant_get_if_list_errstr);
+ g_free(cant_get_if_list_errstr);
break;
case NO_INTERFACES_FOUND:
/* Do the low-level work of a capture.
Returns TRUE if it succeeds, FALSE otherwise. */
-static condition *volatile cnd_ring_timeout = NULL; /* this must be visible in wtap_dispatch_cb_write */
+static condition *volatile cnd_ring_timeout = NULL; /* this must be visible in process_packet */
static int
capture(int out_file_type)
bpf_u_int32 netnum, netmask;
struct bpf_program fcode;
const char *set_linktype_err_str;
- void (*oldhandler)(int);
int err = 0;
int volatile volatile_err = 0;
int volatile inpkts = 0;
condition *volatile cnd_stop_capturesize = NULL;
condition *volatile cnd_stop_timeout = NULL;
#ifndef _WIN32
+ void (*oldhandler)(int);
static const char ppamsg[] = "can't find PPA for ";
char *libpcap_warn;
volatile int pipe_fd = -1;
"The capture session could not be initiated (%s).\n"
"Please check that you have the proper interface specified.\n"
"\n"
- "Note that the driver Tethereal uses for packet capture on Windows doesn't\n"
- "support capturing on PPP/WAN interfaces in Windows NT/2000/XP/.NET Server.\n",
+ "Note that the WinPcap 2.x version of the driver Ethereal uses for packet\n"
+ "capture on Windows doesn't support capturing on PPP/WAN interfaces in\n"
+ "Windows NT/2000/XP/2003 Server, and that the WinPcap 3.0 and later versions\n"
+ "don't support capturing on PPP/WAN interfaces at all.\n",
open_err_str);
goto error;
#else
if (ld.pdh == NULL) {
snprintf(errmsg, sizeof errmsg,
- file_open_error_message(err, TRUE, out_file_type),
+ cf_open_error_message(err, NULL, TRUE, out_file_type),
*cfile.save_file == '\0' ? "stdout" : cfile.save_file);
goto error;
}
struct wtap_pkthdr whdr;
union wtap_pseudo_header pseudo_header;
loop_data *ld = (loop_data *) user;
- cb_args_t args;
+ int loop_err;
int err;
/* Convert from libpcap to Wiretap format.
written an error message). */
pd = wtap_process_pcap_packet(ld->linktype, phdr, pd, &pseudo_header,
&whdr, &err);
- if (pd == NULL) {
+ if (pd == NULL)
return;
+
+#ifdef SIGINFO
+ /*
+ * Prevent a SIGINFO handler from writing to stdout while we're
+ * doing so; instead, have it just set a flag telling us to print
+ * that information when we're done.
+ */
+ infodelay = TRUE;
+#endif /* SIGINFO */
+
+ /* The current packet may have arrived after a very long silence,
+ * way past the time to switch files. In order not to have
+ * the first packet of a new series of events as the last
+ * [or only] packet in the file, switch before writing!
+ */
+ if (cnd_ring_timeout != NULL && cnd_eval(cnd_ring_timeout)) {
+ /* time elapsed for this ring file, switch to the next */
+ if (ringbuf_switch_file(&cfile, &ld->pdh, &loop_err)) {
+ /* File switch succeeded: reset the condition */
+ cnd_reset(cnd_ring_timeout);
+ } else {
+ /* File switch failed: stop here */
+ /* XXX - we should do something with "loop_err" */
+ ld->go = FALSE;
+ }
}
- args.cf = &cfile;
- args.pdh = ld->pdh;
- if (ld->pdh) {
- wtap_dispatch_cb_write((guchar *)&args, &whdr, 0, &pseudo_header, pd);
- /* Report packet capture count if not quiet */
+ if (!process_packet(&cfile, ld->pdh, 0, &whdr, &pseudo_header, pd, &err)) {
+ /* Error writing to a capture file */
if (!quiet) {
- if (!decode) {
- if (ld->packet_count != 0) {
- fprintf(stderr, "\r%u ", ld->packet_count);
- /* stderr could be line buffered */
- fflush(stderr);
- }
- } else {
- wtap_dispatch_cb_print((guchar *)&args, &whdr, 0,
- &pseudo_header, pd);
- }
+ /* We're capturing packets, so (if -q not specified) we're printing
+ a count of packets captured; move to the line after the count. */
+ fprintf(stderr, "\n");
}
- } else {
- wtap_dispatch_cb_print((guchar *)&args, &whdr, 0, &pseudo_header, pd);
+ show_capture_file_io_error(cfile.save_file, err, FALSE);
+ pcap_close(ld->pch);
+ wtap_dump_close(ld->pdh, &err);
+ exit(2);
}
+
+#ifdef SIGINFO
+ /*
+ * Allow SIGINFO handlers to write.
+ */
+ infodelay = FALSE;
+
+ /*
+ * If a SIGINFO handler asked us to write out capture counts, do so.
+ */
+ if (infoprint)
+ report_counts();
+#endif /* SIGINFO */
}
#ifdef _WIN32
signal(SIGINFO, report_counts_siginfo);
#endif /* SIGINFO */
- if (cfile.save_file != NULL && quiet) {
- /* Report the count only if we're capturing to a file (rather
- than printing captured packet information out) and aren't
- updating a count as packets arrive. */
+ if (quiet || print_packet_info) {
+ /* Report the count only if we aren't printing a packet count
+ as packets arrive. */
fprintf(stderr, "%u packets captured\n", ld.packet_count);
}
#ifdef SIGINFO
int snapshot_length;
wtap_dumper *pdh;
int err;
- int success;
- cb_args_t args;
+ gchar *err_info;
+ long data_offset;
linktype = wtap_file_encap(cf->wth);
if (cf->save_file != NULL) {
}
goto out;
}
- args.cf = cf;
- args.pdh = pdh;
- success = wtap_loop(cf->wth, 0, wtap_dispatch_cb_write, (guchar *) &args,
- &err);
-
- /* Now close the capture file. */
- if (!wtap_dump_close(pdh, &err))
- show_capture_file_io_error(cfile.save_file, err, TRUE);
} else {
- args.cf = cf;
- args.pdh = NULL;
- print_preamble(stdout, print_format);
- success = wtap_loop(cf->wth, 0, wtap_dispatch_cb_print, (guchar *) &args,
- &err);
- print_finale(stdout, print_format);
- }
- if (!success) {
- /* Print up a message box noting that the read failed somewhere along
- the line. */
+ if (!write_preamble(cf)) {
+ err = errno;
+ show_print_file_io_error(err);
+ goto out;
+ }
+ pdh = NULL;
+ }
+ while (wtap_read(cf->wth, &err, &err_info, &data_offset)) {
+ if (!process_packet(cf, pdh, data_offset, wtap_phdr(cf->wth),
+ wtap_pseudoheader(cf->wth), wtap_buf_ptr(cf->wth),
+ &err)) {
+ /* Error writing to a capture file */
+ show_capture_file_io_error(cf->save_file, err, FALSE);
+ wtap_dump_close(pdh, &err);
+ exit(2);
+ }
+ }
+ if (err != 0) {
+ /* Print a message noting that the read failed somewhere along the line. */
switch (err) {
case WTAP_ERR_UNSUPPORTED_ENCAP:
fprintf(stderr,
-"tethereal: \"%s\" is a capture file is for a network type that Tethereal doesn't support.\n",
- cf->filename);
+"tethereal: \"%s\" has a packet with a network type that Tethereal doesn't support.\n(%s)\n",
+ cf->filename, err_info);
break;
case WTAP_ERR_CANT_READ:
case WTAP_ERR_BAD_RECORD:
fprintf(stderr,
-"tethereal: \"%s\" appears to be damaged or corrupt.\n",
- cf->filename);
+"tethereal: \"%s\" appears to be damaged or corrupt.\n(%s)\n",
+ cf->filename, err_info);
break;
default:
cf->filename, wtap_strerror(err));
break;
}
+ if (cf->save_file != NULL) {
+ /* Now close the capture file. */
+ if (!wtap_dump_close(pdh, &err))
+ show_capture_file_io_error(cfile.save_file, err, TRUE);
+ }
+ } else {
+ if (cf->save_file != NULL) {
+ /* Now close the capture file. */
+ if (!wtap_dump_close(pdh, &err))
+ show_capture_file_io_error(cfile.save_file, err, TRUE);
+ } else {
+ if (!write_finale()) {
+ err = errno;
+ show_print_file_io_error(err);
+ }
+ }
}
out:
fdata->pfd = NULL;
fdata->num = cf->count;
fdata->pkt_len = phdr->len;
- cul_bytes += phdr->len;
- fdata->cul_bytes = cul_bytes;
+ cum_bytes += phdr->len;
+ fdata->cum_bytes = cum_bytes;
fdata->cap_len = phdr->caplen;
fdata->file_off = offset;
fdata->lnk_t = phdr->pkt_encap;
g_slist_free(fdata->pfd);
}
-static void
-wtap_dispatch_cb_write(guchar *user, const struct wtap_pkthdr *phdr,
- long offset, union wtap_pseudo_header *pseudo_header, const guchar *buf)
+static gboolean
+process_packet(capture_file *cf, wtap_dumper *pdh, long offset,
+ const struct wtap_pkthdr *whdr,
+ union wtap_pseudo_header *pseudo_header, const guchar *pd,
+ int *err)
{
- cb_args_t *args = (cb_args_t *) user;
- capture_file *cf = args->cf;
- wtap_dumper *pdh = args->pdh;
- frame_data fdata;
- int err;
- gboolean passed;
+ frame_data fdata;
+ gboolean create_proto_tree;
epan_dissect_t *edt;
+ gboolean passed;
-#ifdef HAVE_LIBPCAP
-#ifdef SIGINFO
- /*
- * Prevent a SIGINFO handler from writing to stdout while we're
- * doing so; instead, have it just set a flag telling us to print
- * that information when we're done.
- */
- infodelay = TRUE;
-#endif /* SIGINFO */
-#endif /* HAVE_LIBPCAP */
-
+ /* Count this packet. */
cf->count++;
- if (cf->rfcode) {
- fill_in_fdata(&fdata, cf, phdr, offset);
- edt = epan_dissect_new(TRUE, FALSE);
- epan_dissect_prime_dfilter(edt, cf->rfcode);
- epan_dissect_run(edt, pseudo_header, buf, &fdata, NULL);
- passed = dfilter_apply_edt(cf->rfcode, edt);
- } else {
+
+ /* If we're going to print packet information, or we're going to
+ run a read filter, or we're going to process taps, set up to
+ do a dissection and do so. */
+ if (do_dissection) {
+ fill_in_fdata(&fdata, cf, whdr, offset);
+
+ if (print_packet_info) {
+ /* Grab any resolved addresses */
+
+ if (g_resolv_flags) {
+ host_name_lookup_process(NULL);
+ }
+ }
+
passed = TRUE;
+ if (cf->rfcode || verbose || num_tap_filters!=0)
+ create_proto_tree = TRUE;
+ else
+ create_proto_tree = FALSE;
+ /* The protocol tree will be "visible", i.e., printed, only if we're
+ printing packet details, which is true if we're printing stuff
+ ("print_packet_info" is true) and we're in verbose mode ("verbose"
+ is true). */
+ edt = epan_dissect_new(create_proto_tree, print_packet_info && verbose);
+
+ /* If we're running a read filter, prime the epan_dissect_t with that
+ filter. */
+ if (cf->rfcode)
+ epan_dissect_prime_dfilter(edt, cf->rfcode);
+
+ tap_queue_init(edt);
+
+ /* We only need the columns if we're printing packet info but we're
+ *not* verbose; in verbose mode, we print the protocol tree, not
+ the protocol summary. */
+ epan_dissect_run(edt, pseudo_header, pd, &fdata,
+ (print_packet_info && !verbose) ? &cf->cinfo : NULL);
+
+ tap_push_tapped_queue(edt);
+
+ /* Run the read filter if we have one. */
+ if (cf->rfcode)
+ passed = dfilter_apply_edt(cf->rfcode, edt);
+ else
+ passed = TRUE;
+ } else {
+ /* We're not running a display filter and we're not printing any
+ packet information, so we don't need to do a dissection, and all
+ packets are processed. */
edt = NULL;
+ passed = TRUE;
}
+
if (passed) {
- /* The packet passed the read filter. */
+ /* Count this packet. */
#ifdef HAVE_LIBPCAP
- int loop_err;
-
ld.packet_count++;
+#endif
- /* The current packet may have arrived after a very long silence,
- * way past the time to switch files. In order not to have
- * the first packet of a new series of events as the last
- * [or only] packet in the file, switch before writing!
- */
- if (cnd_ring_timeout != NULL && cnd_eval(cnd_ring_timeout)) {
- /* time elasped for this ring file, switch to the next */
- if (ringbuf_switch_file(&cfile, &ld.pdh, &loop_err)) {
- /* File switch succeeded: reset the condition */
- cnd_reset(cnd_ring_timeout);
- } else {
- /* File switch failed: stop here */
- /* XXX - we should do something with "loop_err" */
- ld.go = FALSE;
+ /* Process this packet. */
+ if (pdh != NULL) {
+ /* We're writing to a capture file; write this packet. */
+ if (!wtap_dump(pdh, whdr, pseudo_header, pd, err))
+ return FALSE;
+ /* Report packet capture count if not quiet */
+ if (!quiet && !print_packet_info) {
+ /* Don't print a packet count if we were asked not to with "-q"
+ or if we're also printing packet info. */
+ if (ld.packet_count != 0) {
+ fprintf(stderr, "\r%u ", ld.packet_count);
+ /* stderr could be line buffered */
+ fflush(stderr);
+ }
}
}
-#endif
- if (!wtap_dump(pdh, phdr, pseudo_header, buf, &err)) {
-#ifdef HAVE_LIBPCAP
- if (ld.pch != NULL && !quiet) {
- /* We're capturing packets, so (if -q not specified) we're printing
- a count of packets captured; move to the line after the count. */
- fprintf(stderr, "\n");
+ if (print_packet_info) {
+ /* We're printing packet information; print the information for
+ this packet. */
+ print_packet(cf, edt);
+
+ /* The ANSI C standard does not appear to *require* that a line-buffered
+ stream be flushed to the host environment whenever a newline is
+ written, it just says that, on such a stream, characters "are
+ intended to be transmitted to or from the host environment as a
+ block when a new-line character is encountered".
+
+ The Visual C++ 6.0 C implementation doesn't do what is intended;
+ even if you set a stream to be line-buffered, it still doesn't
+ flush the buffer at the end of every line.
+
+ So, if the "-l" flag was specified, we flush the standard output
+ at the end of a packet. This will do the right thing if we're
+ printing packet summary lines, and, as we print the entire protocol
+ tree for a single packet without waiting for anything to happen,
+ it should be as good as line-buffered mode if we're printing
+ protocol trees. (The whole reason for the "-l" flag in either
+ tcpdump or Tethereal is to allow the output of a live capture to
+ be piped to a program or script and to have that script see the
+ information for the packet as soon as it's printed, rather than
+ having to wait until a standard I/O buffer fills up. */
+ if (line_buffered)
+ fflush(stdout);
+
+ if (ferror(stdout)) {
+ show_print_file_io_error(errno);
+ exit(2);
}
-#endif
- show_capture_file_io_error(cf->save_file, err, FALSE);
-#ifdef HAVE_LIBPCAP
- if (ld.pch != NULL)
- pcap_close(ld.pch);
-#endif
- wtap_dump_close(pdh, &err);
- exit(2);
}
}
- if (edt != NULL)
+
+ if (do_dissection) {
epan_dissect_free(edt);
- if (cf->rfcode)
clear_fdata(&fdata);
-
-#ifdef HAVE_LIBPCAP
-#ifdef SIGINFO
- /*
- * Allow SIGINFO handlers to write.
- */
- infodelay = FALSE;
-
- /*
- * If a SIGINFO handler asked us to write out capture counts, do so.
- */
- if (infoprint)
- report_counts();
-#endif /* SIGINFO */
-#endif /* HAVE_LIBPCAP */
+ }
+ return TRUE;
}
static void
}
}
-static void
-wtap_dispatch_cb_print(guchar *user, const struct wtap_pkthdr *phdr,
- long offset, union wtap_pseudo_header *pseudo_header, const guchar *buf)
+static gboolean
+write_preamble(capture_file *cf)
{
- cb_args_t *args = (cb_args_t *) user;
- capture_file *cf = args->cf;
- frame_data fdata;
- gboolean passed;
- print_args_t print_args;
- epan_dissect_t *edt;
- gboolean create_proto_tree;
- int i;
+ switch (output_action) {
- cf->count++;
+ case WRITE_TEXT:
+ return print_preamble(print_stream, cf->filename);
+ break;
- fill_in_fdata(&fdata, cf, phdr, offset);
+ case WRITE_XML:
+ if (verbose)
+ write_pdml_preamble(stdout);
+ else
+ write_psml_preamble(stdout);
+ return !ferror(stdout);
- /* Grab any resolved addresses */
- if (g_resolv_flags) {
- host_name_lookup_process(NULL);
+ default:
+ g_assert_not_reached();
+ return FALSE;
}
+}
- passed = TRUE;
- if (cf->rfcode || verbose || num_tap_filters!=0)
- create_proto_tree = TRUE;
- else
- create_proto_tree = FALSE;
- /* The protocol tree will be "visible", i.e., printed, only if we're
- not printing a summary.
+static gboolean
+print_columns(capture_file *cf)
+{
+ static char *line_bufp = NULL;
+ static size_t line_buf_len = 0;
+ int i;
+ size_t buf_offset;
+ size_t column_len;
+
+ if (line_bufp == NULL) {
+ line_buf_len = 256;
+ line_bufp = g_malloc(line_buf_len + 1);
+ }
+ buf_offset = 0;
+ *line_bufp = '\0';
+ for (i = 0; i < cf->cinfo.num_cols; i++) {
+ switch (cf->cinfo.col_fmt[i]) {
+ case COL_NUMBER:
+ /*
+ * Don't print this if we're doing a live capture from a network
+ * interface - if we're doing a live capture, you won't be
+ * able to look at the capture in the future (it's not being
+ * saved anywhere), so the frame numbers are unlikely to be
+ * useful.
+ *
+ * (XXX - it might be nice to be able to save and print at
+ * the same time, sort of like an "Update list of packets
+ * in real time" capture in Ethereal.)
+ */
+ if (cf->iface != NULL)
+ continue;
+ column_len = strlen(cf->cinfo.col_data[i]);
+ if (column_len < 3)
+ column_len = 3;
+ if (buf_offset + column_len > line_buf_len) {
+ line_buf_len *= 2;
+ line_bufp = g_realloc(line_bufp, line_buf_len + 1);
+ }
+ snprintf(line_bufp + buf_offset, COL_MAX_LEN+1, "%3s", cf->cinfo.col_data[i]);
+ break;
- We only need the columns if we're *not* verbose; in verbose mode,
- we print the protocol tree, not the protocol summary. */
+ case COL_CLS_TIME:
+ case COL_REL_TIME:
+ case COL_ABS_TIME:
+ case COL_ABS_DATE_TIME: /* XXX - wider */
+ column_len = strlen(cf->cinfo.col_data[i]);
+ if (column_len < 10)
+ column_len = 10;
+ if (buf_offset + column_len > line_buf_len) {
+ line_buf_len *= 2;
+ line_bufp = g_realloc(line_bufp, line_buf_len + 1);
+ }
+ snprintf(line_bufp + buf_offset, COL_MAX_LEN+1, "%10s", cf->cinfo.col_data[i]);
+ break;
- edt = epan_dissect_new(create_proto_tree, verbose);
- if (cf->rfcode) {
- epan_dissect_prime_dfilter(edt, cf->rfcode);
- }
+ case COL_DEF_SRC:
+ case COL_RES_SRC:
+ case COL_UNRES_SRC:
+ case COL_DEF_DL_SRC:
+ case COL_RES_DL_SRC:
+ case COL_UNRES_DL_SRC:
+ case COL_DEF_NET_SRC:
+ case COL_RES_NET_SRC:
+ case COL_UNRES_NET_SRC:
+ column_len = strlen(cf->cinfo.col_data[i]);
+ if (column_len < 12)
+ column_len = 12;
+ if (buf_offset + column_len > line_buf_len) {
+ line_buf_len *= 2;
+ line_bufp = g_realloc(line_bufp, line_buf_len + 1);
+ }
+ snprintf(line_bufp + buf_offset, COL_MAX_LEN+1, "%12s", cf->cinfo.col_data[i]);
+ break;
- tap_queue_init(edt);
- epan_dissect_run(edt, pseudo_header, buf, &fdata, verbose ? NULL : &cf->cinfo);
- tap_push_tapped_queue(edt);
+ case COL_DEF_DST:
+ case COL_RES_DST:
+ case COL_UNRES_DST:
+ case COL_DEF_DL_DST:
+ case COL_RES_DL_DST:
+ case COL_UNRES_DL_DST:
+ case COL_DEF_NET_DST:
+ case COL_RES_NET_DST:
+ case COL_UNRES_NET_DST:
+ column_len = strlen(cf->cinfo.col_data[i]);
+ if (column_len < 12)
+ column_len = 12;
+ if (buf_offset + column_len > line_buf_len) {
+ line_buf_len *= 2;
+ line_bufp = g_realloc(line_bufp, line_buf_len + 1);
+ }
+ snprintf(line_bufp + buf_offset, COL_MAX_LEN+1, "%-12s", cf->cinfo.col_data[i]);
+ break;
- if (cf->rfcode) {
- passed = dfilter_apply_edt(cf->rfcode, edt);
- }
- if (passed) {
- /* The packet passed the read filter. */
-#ifdef HAVE_LIBPCAP
- ld.packet_count++;
-#endif
- if (verbose) {
- /* Print the information in the protocol tree. */
- print_args.to_file = TRUE;
- print_args.format = print_format;
- print_args.print_summary = FALSE;
- print_args.print_hex = print_hex;
- print_args.expand_all = TRUE;
- print_args.print_only_marked = FALSE;
- proto_tree_print(&print_args, edt, stdout);
- if (!print_hex) {
- /* "print_hex_data()" will put out a leading blank line, as well
- as a trailing one; print one here, to separate the packets,
- only if "print_hex_data()" won't be called. */
- printf("\n");
+ default:
+ column_len = strlen(cf->cinfo.col_data[i]);
+ if (buf_offset + column_len > line_buf_len) {
+ line_buf_len *= 2;
+ line_bufp = g_realloc(line_bufp, line_buf_len + 1);
}
- } else {
- /* Just fill in the columns. */
- epan_dissect_fill_in_columns(edt);
-
- /* Now print them. */
- for (i = 0; i < cf->cinfo.num_cols; i++) {
- switch (cf->cinfo.col_fmt[i]) {
- case COL_NUMBER:
- /*
- * Don't print this if we're doing a live capture from a network
- * interface - if we're doing a live capture, you won't be
- * able to look at the capture in the future (it's not being
- * saved anywhere), so the frame numbers are unlikely to be
- * useful.
- *
- * (XXX - it might be nice to be able to save and print at
- * the same time, sort of like an "Update list of packets
- * in real time" capture in Ethereal.)
- */
- if (cf->iface != NULL)
- continue;
- printf("%3s", cf->cinfo.col_data[i]);
+ strcat(line_bufp + buf_offset, cf->cinfo.col_data[i]);
+ break;
+ }
+ buf_offset += column_len;
+ if (i != cf->cinfo.num_cols - 1) {
+ /*
+ * This isn't the last column, so we need to print a
+ * separator between this column and the next.
+ *
+ * If we printed a network source and are printing a
+ * network destination of the same type next, separate
+ * them with "->"; if we printed a network destination
+ * and are printing a network source of the same type
+ * next, separate them with "<-"; otherwise separate them
+ * with a space.
+ *
+ * We add enough space to the buffer for " <- " or " -> ",
+ * even if we're only adding " ".
+ */
+ if (buf_offset + 4 > line_buf_len) {
+ line_buf_len *= 2;
+ line_bufp = g_realloc(line_bufp, line_buf_len + 1);
+ }
+ switch (cf->cinfo.col_fmt[i]) {
+
+ case COL_DEF_SRC:
+ case COL_RES_SRC:
+ case COL_UNRES_SRC:
+ switch (cf->cinfo.col_fmt[i + 1]) {
+
+ case COL_DEF_DST:
+ case COL_RES_DST:
+ case COL_UNRES_DST:
+ strcat(line_bufp + buf_offset, " -> ");
+ buf_offset += 4;
+ break;
+
+ default:
+ strcat(line_bufp + buf_offset, " ");
+ buf_offset += 1;
+ break;
+ }
+ break;
+
+ case COL_DEF_DL_SRC:
+ case COL_RES_DL_SRC:
+ case COL_UNRES_DL_SRC:
+ switch (cf->cinfo.col_fmt[i + 1]) {
+
+ case COL_DEF_DL_DST:
+ case COL_RES_DL_DST:
+ case COL_UNRES_DL_DST:
+ strcat(line_bufp + buf_offset, " -> ");
+ buf_offset += 4;
+ break;
+
+ default:
+ strcat(line_bufp + buf_offset, " ");
+ buf_offset += 1;
+ break;
+ }
+ break;
+
+ case COL_DEF_NET_SRC:
+ case COL_RES_NET_SRC:
+ case COL_UNRES_NET_SRC:
+ switch (cf->cinfo.col_fmt[i + 1]) {
+
+ case COL_DEF_NET_DST:
+ case COL_RES_NET_DST:
+ case COL_UNRES_NET_DST:
+ strcat(line_bufp + buf_offset, " -> ");
+ buf_offset += 4;
break;
- case COL_CLS_TIME:
- case COL_REL_TIME:
- case COL_ABS_TIME:
- case COL_ABS_DATE_TIME: /* XXX - wider */
- printf("%10s", cf->cinfo.col_data[i]);
+ default:
+ strcat(line_bufp + buf_offset, " ");
+ buf_offset += 1;
break;
+ }
+ break;
+
+ case COL_DEF_DST:
+ case COL_RES_DST:
+ case COL_UNRES_DST:
+ switch (cf->cinfo.col_fmt[i + 1]) {
case COL_DEF_SRC:
case COL_RES_SRC:
case COL_UNRES_SRC:
+ strcat(line_bufp + buf_offset, " <- ");
+ buf_offset += 4;
+ break;
+
+ default:
+ strcat(line_bufp + buf_offset, " ");
+ buf_offset += 1;
+ break;
+ }
+ break;
+
+ case COL_DEF_DL_DST:
+ case COL_RES_DL_DST:
+ case COL_UNRES_DL_DST:
+ switch (cf->cinfo.col_fmt[i + 1]) {
+
case COL_DEF_DL_SRC:
case COL_RES_DL_SRC:
case COL_UNRES_DL_SRC:
+ strcat(line_bufp + buf_offset, " <- ");
+ buf_offset += 4;
+ break;
+
+ default:
+ strcat(line_bufp + buf_offset, " ");
+ buf_offset += 1;
+ break;
+ }
+ break;
+
+ case COL_DEF_NET_DST:
+ case COL_RES_NET_DST:
+ case COL_UNRES_NET_DST:
+ switch (cf->cinfo.col_fmt[i + 1]) {
+
case COL_DEF_NET_SRC:
case COL_RES_NET_SRC:
case COL_UNRES_NET_SRC:
- printf("%12s", cf->cinfo.col_data[i]);
- break;
-
- case COL_DEF_DST:
- case COL_RES_DST:
- case COL_UNRES_DST:
- case COL_DEF_DL_DST:
- case COL_RES_DL_DST:
- case COL_UNRES_DL_DST:
- case COL_DEF_NET_DST:
- case COL_RES_NET_DST:
- case COL_UNRES_NET_DST:
- printf("%-12s", cf->cinfo.col_data[i]);
+ strcat(line_bufp + buf_offset, " <- ");
+ buf_offset += 4;
break;
default:
- printf("%s", cf->cinfo.col_data[i]);
+ strcat(line_bufp + buf_offset, " ");
+ buf_offset += 1;
break;
}
- if (i != cf->cinfo.num_cols - 1) {
- /*
- * This isn't the last column, so we need to print a
- * separator between this column and the next.
- *
- * If we printed a network source and are printing a
- * network destination of the same type next, separate
- * them with "->"; if we printed a network destination
- * and are printing a network source of the same type
- * next, separate them with "<-"; otherwise separate them
- * with a space.
- */
- switch (cf->cinfo.col_fmt[i]) {
-
- case COL_DEF_SRC:
- case COL_RES_SRC:
- case COL_UNRES_SRC:
- switch (cf->cinfo.col_fmt[i + 1]) {
-
- case COL_DEF_DST:
- case COL_RES_DST:
- case COL_UNRES_DST:
- printf(" -> ");
- break;
-
- default:
- putchar(' ');
- break;
- }
- break;
-
- case COL_DEF_DL_SRC:
- case COL_RES_DL_SRC:
- case COL_UNRES_DL_SRC:
- switch (cf->cinfo.col_fmt[i + 1]) {
-
- case COL_DEF_DL_DST:
- case COL_RES_DL_DST:
- case COL_UNRES_DL_DST:
- printf(" -> ");
- break;
-
- default:
- putchar(' ');
- break;
- }
- break;
-
- case COL_DEF_NET_SRC:
- case COL_RES_NET_SRC:
- case COL_UNRES_NET_SRC:
- switch (cf->cinfo.col_fmt[i + 1]) {
-
- case COL_DEF_NET_DST:
- case COL_RES_NET_DST:
- case COL_UNRES_NET_DST:
- printf(" -> ");
- break;
-
- default:
- putchar(' ');
- break;
- }
- break;
-
- case COL_DEF_DST:
- case COL_RES_DST:
- case COL_UNRES_DST:
- switch (cf->cinfo.col_fmt[i + 1]) {
-
- case COL_DEF_SRC:
- case COL_RES_SRC:
- case COL_UNRES_SRC:
- printf(" <- ");
- break;
-
- default:
- putchar(' ');
- break;
- }
- break;
-
- case COL_DEF_DL_DST:
- case COL_RES_DL_DST:
- case COL_UNRES_DL_DST:
- switch (cf->cinfo.col_fmt[i + 1]) {
-
- case COL_DEF_DL_SRC:
- case COL_RES_DL_SRC:
- case COL_UNRES_DL_SRC:
- printf(" <- ");
- break;
-
- default:
- putchar(' ');
- break;
- }
- break;
-
- case COL_DEF_NET_DST:
- case COL_RES_NET_DST:
- case COL_UNRES_NET_DST:
- switch (cf->cinfo.col_fmt[i + 1]) {
-
- case COL_DEF_NET_SRC:
- case COL_RES_NET_SRC:
- case COL_UNRES_NET_SRC:
- printf(" <- ");
- break;
-
- default:
- putchar(' ');
- break;
- }
- break;
+ break;
- default:
- putchar(' ');
- break;
- }
- }
+ default:
+ strcat(line_bufp + buf_offset, " ");
+ buf_offset += 1;
+ break;
}
- putchar('\n');
- }
- if (print_hex) {
- print_hex_data(stdout, print_args.format, edt);
- putchar('\n');
}
}
+ return print_line(print_stream, 0, line_bufp);
+}
- /* The ANSI C standard does not appear to *require* that a line-buffered
- stream be flushed to the host environment whenever a newline is
- written, it just says that, on such a stream, characters "are
- intended to be transmitted to or from the host environment as a
- block when a new-line character is encountered".
+static gboolean
+print_packet(capture_file *cf, epan_dissect_t *edt)
+{
+ print_args_t print_args;
- The Visual C++ 6.0 C implementation doesn't do what is intended;
- even if you set a stream to be line-buffered, it still doesn't
- flush the buffer at the end of every line.
+ if (verbose) {
+ /* Print the information in the protocol tree. */
+ switch (output_action) {
- So, if the "-l" flag was specified, we flush the standard output
- at the end of a packet. This will do the right thing if we're
- printing packet summary lines, and, as we print the entire protocol
- tree for a single packet without waiting for anything to happen,
- it should be as good as line-buffered mode if we're printing
- protocol trees. (The whole reason for the "-l" flag in either
- tcpdump or Tethereal is to allow the output of a live capture to
- be piped to a program or script and to have that script see the
- information for the packet as soon as it's printed, rather than
- having to wait until a standard I/O buffer fills up. */
- if (line_buffered)
- fflush(stdout);
+ case WRITE_TEXT:
+ print_args.to_file = TRUE;
+ print_args.format = print_format;
+ print_args.print_summary = !verbose;
+ print_args.print_hex = verbose && print_hex;
+ print_args.print_formfeed = FALSE;
+ print_args.print_dissections = verbose ? print_dissections_expanded : print_dissections_none;
- epan_dissect_free(edt);
+ /* init the packet range */
+ packet_range_init(&print_args.range);
- clear_fdata(&fdata);
+ if (!proto_tree_print(&print_args, edt, print_stream))
+ return FALSE;
+ if (!print_hex) {
+ /* "print_hex_data()" will put out a leading blank line, as well
+ as a trailing one; print one here, to separate the packets,
+ only if "print_hex_data()" won't be called. */
+ if (!print_line(print_stream, 0, ""))
+ return FALSE;
+ }
+ break;
+
+ case WRITE_XML:
+ proto_tree_write_pdml(edt, stdout);
+ printf("\n");
+ return !ferror(stdout);
+ }
+ } else {
+ /* Just fill in the columns. */
+ epan_dissect_fill_in_columns(edt);
+
+ /* Now print them. */
+ switch (output_action) {
+
+ case WRITE_TEXT:
+ if (!print_columns(cf))
+ return FALSE;
+ break;
+
+ case WRITE_XML:
+ proto_tree_write_psml(edt, stdout);
+ return !ferror(stdout);
+ }
+ }
+ if (print_hex) {
+ if (!print_hex_data(print_stream, edt))
+ return FALSE;
+ if (!print_line(print_stream, 0, ""))
+ return FALSE;
+ }
+ return TRUE;
}
-char *
-file_open_error_message(int err, gboolean for_writing, int file_type)
+static gboolean
+write_finale(void)
{
- char *errmsg;
- static char errmsg_errno[1024+1];
+ switch (output_action) {
+
+ case WRITE_TEXT:
+ return print_finale(print_stream);
+ break;
+
+ case WRITE_XML:
+ if (verbose)
+ write_pdml_finale(stdout);
+ else
+ write_psml_finale(stdout);
+ return !ferror(stdout);
+
+ default:
+ g_assert_not_reached();
+ return FALSE;
+ }
+}
+static void
+show_print_file_io_error(int err)
+{
switch (err) {
- case WTAP_ERR_NOT_REGULAR_FILE:
- errmsg = "The file \"%s\" is a \"special file\" or socket or other non-regular file.";
+ case ENOSPC:
+ fprintf(stderr,
+"tethereal: Not all the packets could be printed because there is "
+"no space left on the file system.\n");
break;
- case WTAP_ERR_FILE_UNKNOWN_FORMAT:
- case WTAP_ERR_UNSUPPORTED:
- /* Seen only when opening a capture file for reading. */
- errmsg = "The file \"%s\" is not a capture file in a format Tethereal understands.";
- break;
+#ifdef EDQUOT
+ case EDQUOT:
+ fprintf(stderr,
+"tethereal: Not all the packets could be printed because you are "
+"too close to, or over your disk quota.\n");
+ break;
+#endif
- case WTAP_ERR_CANT_WRITE_TO_PIPE:
- /* Seen only when opening a capture file for writing. */
- snprintf(errmsg_errno, sizeof(errmsg_errno),
- "The file \"%%s\" is a pipe, and %s capture files cannot be "
- "written to a pipe.", wtap_file_type_string(file_type));
- errmsg = errmsg_errno;
+ default:
+ fprintf(stderr,
+"tethereal: An error occurred while printing packets: %s.\n",
+ strerror(err));
break;
+ }
+}
- case WTAP_ERR_UNSUPPORTED_FILE_TYPE:
- /* Seen only when opening a capture file for writing. */
- errmsg = "Tethereal does not support writing capture files in that format.";
- break;
+static char *
+cf_open_error_message(int err, gchar *err_info, gboolean for_writing,
+ int file_type)
+{
+ char *errmsg;
+ static char errmsg_errno[1024+1];
- case WTAP_ERR_UNSUPPORTED_ENCAP:
- case WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED:
- if (for_writing)
- errmsg = "Tethereal cannot save this capture in that format.";
- else
- errmsg = "The file \"%s\" is a capture for a network type that Tethereal doesn't support.";
- break;
+ if (err < 0) {
+ /* Wiretap error. */
+ switch (err) {
- case WTAP_ERR_BAD_RECORD:
- errmsg = "The file \"%s\" appears to be damaged or corrupt.";
- break;
+ case WTAP_ERR_NOT_REGULAR_FILE:
+ errmsg = "The file \"%s\" is a \"special file\" or socket or other non-regular file.";
+ break;
- case WTAP_ERR_CANT_OPEN:
- if (for_writing)
- errmsg = "The file \"%s\" could not be created for some unknown reason.";
- else
- errmsg = "The file \"%s\" could not be opened for some unknown reason.";
- break;
+ case WTAP_ERR_FILE_UNKNOWN_FORMAT:
+ /* Seen only when opening a capture file for reading. */
+ errmsg = "The file \"%s\" is not a capture file in a format Tethereal understands.";
+ break;
- case WTAP_ERR_SHORT_READ:
- errmsg = "The file \"%s\" appears to have been cut short"
- " in the middle of a packet or other data.";
- break;
+ case WTAP_ERR_UNSUPPORTED:
+ /* Seen only when opening a capture file for reading. */
+ snprintf(errmsg_errno, sizeof(errmsg_errno),
+ "The file \"%%s\" is not a capture file in a format Tethereal understands.\n"
+ "(%s)", err_info);
+ g_free(err_info);
+ errmsg = errmsg_errno;
+ break;
- case WTAP_ERR_SHORT_WRITE:
- errmsg = "A full header couldn't be written to the file \"%s\".";
- break;
+ case WTAP_ERR_CANT_WRITE_TO_PIPE:
+ /* Seen only when opening a capture file for writing. */
+ snprintf(errmsg_errno, sizeof(errmsg_errno),
+ "The file \"%%s\" is a pipe, and %s capture files cannot be "
+ "written to a pipe.", wtap_file_type_string(file_type));
+ errmsg = errmsg_errno;
+ break;
- case ENOENT:
- if (for_writing)
- errmsg = "The path to the file \"%s\" does not exist.";
- else
- errmsg = "The file \"%s\" does not exist.";
- break;
+ case WTAP_ERR_UNSUPPORTED_FILE_TYPE:
+ /* Seen only when opening a capture file for writing. */
+ errmsg = "Tethereal does not support writing capture files in that format.";
+ break;
- case EACCES:
- if (for_writing)
- errmsg = "You do not have permission to create or write to the file \"%s\".";
- else
- errmsg = "You do not have permission to read the file \"%s\".";
- break;
+ case WTAP_ERR_UNSUPPORTED_ENCAP:
+ if (for_writing)
+ errmsg = "Tethereal cannot save this capture in that format.";
+ else {
+ snprintf(errmsg_errno, sizeof(errmsg_errno),
+ "The file \"%%s\" is a capture for a network type that Tethereal doesn't support.\n"
+ "(%s)", err_info);
+ g_free(err_info);
+ errmsg = errmsg_errno;
+ }
+ break;
- case EISDIR:
- errmsg = "\"%s\" is a directory (folder), not a file.";
- break;
+ case WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED:
+ if (for_writing)
+ errmsg = "Tethereal cannot save this capture in that format.";
+ else
+ errmsg = "The file \"%s\" is a capture for a network type that Tethereal doesn't support.";
+ break;
- default:
- snprintf(errmsg_errno, sizeof(errmsg_errno),
- "The file \"%%s\" could not be %s: %s.",
- for_writing ? "created" : "opened",
- wtap_strerror(err));
- errmsg = errmsg_errno;
- break;
- }
+ case WTAP_ERR_BAD_RECORD:
+ /* Seen only when opening a capture file for reading. */
+ snprintf(errmsg_errno, sizeof(errmsg_errno),
+ "The file \"%%s\" appears to be damaged or corrupt.\n"
+ "(%s)", err_info);
+ g_free(err_info);
+ errmsg = errmsg_errno;
+ break;
+
+ case WTAP_ERR_CANT_OPEN:
+ if (for_writing)
+ errmsg = "The file \"%s\" could not be created for some unknown reason.";
+ else
+ errmsg = "The file \"%s\" could not be opened for some unknown reason.";
+ break;
+
+ case WTAP_ERR_SHORT_READ:
+ errmsg = "The file \"%s\" appears to have been cut short"
+ " in the middle of a packet or other data.";
+ break;
+
+ case WTAP_ERR_SHORT_WRITE:
+ errmsg = "A full header couldn't be written to the file \"%s\".";
+ break;
+
+ default:
+ snprintf(errmsg_errno, sizeof(errmsg_errno),
+ "The file \"%%s\" could not be %s: %s.",
+ for_writing ? "created" : "opened",
+ wtap_strerror(err));
+ errmsg = errmsg_errno;
+ break;
+ }
+ } else
+ errmsg = file_open_error_message(err, for_writing);
return errmsg;
}
+/*
+ * Open/create errors are reported with an console message in Tethereal.
+ */
+static void
+open_failure_message(const char *filename, int err, gboolean for_writing)
+{
+ fprintf(stderr, "tethereal: ");
+ fprintf(stderr, file_open_error_message(err, for_writing), filename);
+ fprintf(stderr, "\n");
+}
+
int
cf_open(char *fname, gboolean is_tempfile, capture_file *cf)
{
wtap *wth;
int err;
+ gchar *err_info;
char err_msg[2048+1];
- wth = wtap_open_offline(fname, &err, FALSE);
+ wth = wtap_open_offline(fname, &err, &err_info, FALSE);
if (wth == NULL)
goto fail;
cf->snap = WTAP_MAX_PACKET_SIZE;
} else
cf->has_snap = TRUE;
- cf->progbar_quantum = 0;
- cf->progbar_nextstep = 0;
firstsec = 0, firstusec = 0;
prevsec = 0, prevusec = 0;
return (0);
fail:
- snprintf(err_msg, sizeof err_msg, file_open_error_message(err, FALSE, 0),
- fname);
+ snprintf(err_msg, sizeof err_msg,
+ cf_open_error_message(err, err_info, FALSE, 0), fname);
fprintf(stderr, "tethereal: %s\n", err_msg);
return (err);
}
}
#endif /* _WIN32 */
#endif /* HAVE_LIBPCAP */
+
+/*
+ * General errors are reported with an console message in Tethereal.
+ */
+static void
+failure_message(const char *msg_format, va_list ap)
+{
+ fprintf(stderr, "tethereal: ");
+ vfprintf(stderr, msg_format, ap);
+ fprintf(stderr, "\n");
+}
+
+/*
+ * Read errors are reported with an console message in Tethereal.
+ */
+static void
+read_failure_message(const char *filename, int err)
+{
+ fprintf(stderr, "tethereal: An error occurred while reading from the file \"%s\": %s.\n",
+ filename, strerror(err));
+}