/* tshark.c
+ *
+ * Text-mode variant of Wireshark, along the lines of tcpdump and snoop,
+ * by Gilbert Ramirez <gram@alumni.rice.edu> and Guy Harris <guy@alum.mit.edu>.
*
* $Id$
*
* By Gerald Combs <gerald@wireshark.org>
* Copyright 1998 Gerald Combs
*
- * Text-mode variant, by Gilbert Ramirez <gram@alumni.rice.edu>
- * and Guy Harris <guy@alum.mit.edu>.
- *
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
#include "strerror.h"
#endif
-#ifdef NEED_GETOPT_H
-#include "getopt.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#else
+#include "wsgetopt.h"
#endif
#include <glib.h>
#include <epan/epan.h>
#include <epan/filesystem.h>
-#include <epan/privileges.h>
-#include <wiretap/file_util.h>
+#include <wsutil/privileges.h>
#include "globals.h"
#include <epan/timestamp.h>
#include <epan/addr_resolv.h>
#include "util.h"
#include "clopts_common.h"
+#include "console_io.h"
#include "cmdarg_err.h"
#include "version_info.h"
-#include <epan/conversation.h>
#include <epan/plugins.h>
#include "register.h"
#include <epan/epan_dissect.h>
#ifdef HAVE_LIBPCAP
#include "capture_ui_utils.h"
-#include <pcap.h>
+#include "capture_ifinfo.h"
#include "capture-pcap-util.h"
#ifdef _WIN32
#include "capture-wpcap.h"
#endif /* _WIN32 */
#include "capture_sync.h"
#endif /* HAVE_LIBPCAP */
-#include "epan/emem.h"
#include "log.h"
#include <epan/funnel.h>
*/
static const gchar decode_as_arg_template[] = "<layer_type>==<selector>,<decode_as_protocol>";
+static guint32 cum_bytes;
static nstime_t first_ts;
static nstime_t prev_dis_ts;
static nstime_t prev_cap_ts;
-static GString *comp_info_str, *runtime_info_str;
static gboolean print_packet_info; /* TRUE if we're to print packet information */
+
+static gboolean perform_two_pass_analysis;
+
/*
* The way the packet decode is to be written.
*/
WRITE_FIELDS /* User defined list of fields */
/* Add CSV and the like here */
} output_action_e;
+
static output_action_e output_action;
static gboolean do_dissection; /* TRUE if we have to dissect each packet */
static gboolean verbose;
static gboolean print_hex;
static gboolean line_buffered;
-static guint32 cum_bytes = 0;
+
static print_format_e print_format = PR_FMT_TEXT;
static print_stream_t *print_stream;
static gboolean print_packet_counts;
-static capture_options capture_opts;
+static capture_options global_capture_opts;
#ifdef SIGINFO
static gboolean infodelay; /* if TRUE, don't print capture info in SIGINFO handler */
static int load_cap_file(capture_file *, char *, int, int, gint64);
static gboolean process_packet(capture_file *cf, gint64 offset,
const struct wtap_pkthdr *whdr, union wtap_pseudo_header *pseudo_header,
- const guchar *pd);
+ const guchar *pd, gboolean filtering_tap_listeners, guint tap_flags);
static void show_capture_file_io_error(const char *, int, gboolean);
static void show_print_file_io_error(int err);
static gboolean write_preamble(capture_file *cf);
gboolean for_writing);
static void failure_message(const char *msg_format, va_list ap);
static void read_failure_message(const char *filename, int err);
+static void write_failure_message(const char *filename, int err);
capture_file cfile;
+void
+cf_mark_frame(capture_file *cf _U_, frame_data *frame _U_)
+{
+ g_assert_not_reached();
+}
static void list_capture_types(void) {
int i;
fprintf(output, " -f <capture filter> packet filter in libpcap filter syntax\n");
fprintf(output, " -s <snaplen> packet snapshot length (def: 65535)\n");
fprintf(output, " -p don't capture in promiscuous mode\n");
-#ifdef _WIN32
+#ifdef HAVE_PCAP_CREATE
+ fprintf(output, " -I capture in monitor mode, if available\n");
+#endif
+#if defined(_WIN32) || defined(HAVE_PCAP_CREATE)
fprintf(output, " -B <buffer size> size of kernel buffer (def: 1MB)\n");
#endif
fprintf(output, " -y <link type> link layer type (def: first appropriate)\n");
/*fprintf(output, "\n");*/
fprintf(output, "Output:\n");
- fprintf(output, " -w <outfile|-> set the output filename (or '-' for stdout)\n");
+ fprintf(output, " -w <outfile|-> write packets to a pcap-format file named \"outfile\"\n");
+ fprintf(output, " (or to the standard output for \"-\")\n");
+ fprintf(output, " -C <config profile> start with specified configuration profile\n");
fprintf(output, " -F <output file type> set the output file type, default is libpcap\n");
fprintf(output, " an empty \"-F\" option will list the file types\n");
fprintf(output, " -V add output of packet tree (Packet Details)\n");
fprintf(output, " separator=/t|/s|<char> select tab, space, printable character as separator\n");
fprintf(output, " quote=d|s|n select double, single, no quotes for values\n");
fprintf(output, " -t ad|a|r|d|dd|e output format of time stamps (def: r: rel. to first)\n");
+ fprintf(output, " -u s|hms output format of seconds (def: s: seconds)\n");
fprintf(output, " -l flush standard output after each packet\n");
fprintf(output, " -q be more quiet on stdout (e.g. when using statistics)\n");
fprintf(output, " -X <key>:<value> eXtension options, see the man page for details\n");
fprintf(output, " -h display this help and exit\n");
fprintf(output, " -v display version info and exit\n");
fprintf(output, " -o <name>:<value> ... override preference setting\n");
+ fprintf(output, " -K <keytab> keytab file to use for kerberos decryption\n");
}
/*
ftenum_t dissector_table_selector_type;
struct protocol_name_search user_protocol_name;
-/* The following code will allocate and copy the command-line options in a string pointed by decoded_param */
+ /* The following code will allocate and copy the command-line options in a string pointed by decoded_param */
g_assert(cl_param);
- decoded_param = g_malloc( sizeof(gchar) * (strlen(cl_param) + 1) ); /* Allocate enough space to have a working copy of the command-line parameter */
+ decoded_param = g_strdup(cl_param);
g_assert(decoded_param);
- strcpy(decoded_param, cl_param);
/* The lines below will parse this string (modifying it) to extract all
}
static void
-log_func_ignore (const gchar *log_domain _U_, GLogLevelFlags log_level _U_,
- const gchar *message _U_, gpointer user_data _U_)
+tshark_log_handler (const gchar *log_domain, GLogLevelFlags log_level,
+ const gchar *message, gpointer user_data)
{
+ /* ignore log message, if log_level isn't interesting based
+ upon the console log preferences.
+ If the preferences haven't been loaded loaded yet, display the
+ message anyway.
+
+ The default console_log_level preference value is such that only
+ ERROR, CRITICAL and WARNING level messages are processed;
+ MESSAGE, INFO and DEBUG level messages are ignored.
+
+ XXX: Aug 07, 2009: Prior tshark g_log code was hardwired to process only
+ ERROR and CRITICAL level messages so the current code is a behavioral
+ change. The current behavior is the same as in Wireshark.
+ */
+ if((log_level & G_LOG_LEVEL_MASK & prefs.console_log_level) == 0 &&
+ prefs.console_log_level != 0) {
+ return;
+ }
+
+ g_log_default_handler(log_domain, log_level, message, user_data);
+
}
static char *
}
static void
-print_current_user() {
+print_current_user(void) {
gchar *cur_user, *cur_group;
if (started_with_special_privs()) {
cur_user = get_cur_username();
}
static void
-check_capture_privs() {
+check_capture_privs(void) {
#ifdef _WIN32
load_wpcap();
/* Warn the user if npf.sys isn't loaded. */
#endif
}
-
+static void
+show_version(GString *comp_info_str, GString *runtime_info_str)
+{
+ printf("TShark " VERSION "%s\n"
+ "\n"
+ "%s"
+ "\n"
+ "%s"
+ "\n"
+ "%s",
+ wireshark_svnversion, get_copyright_info(), comp_info_str->str,
+ runtime_info_str->str);
+}
int
main(int argc, char *argv[])
{
char *init_progfile_dir_error;
- int opt, i;
- extern char *optarg;
+ int opt;
gboolean arg_error = FALSE;
#ifdef _WIN32
gboolean list_link_layer_types = FALSE;
gboolean start_capture = FALSE;
int status;
+ GList *if_list;
+ gchar *err_str;
#else
gboolean capture_option_specified = FALSE;
#endif
struct bpf_program fcode;
#endif
dfilter_t *rfcode = NULL;
- e_prefs *prefs;
+ e_prefs *prefs_p;
char badopt;
GLogLevelFlags log_flags;
int optind_initial;
-#define OPTSTRING_INIT "a:b:c:d:De:E:f:F:G:hi:lLnN:o:pqr:R:s:St:T:vVw:xX:y:z:"
#ifdef HAVE_LIBPCAP
-#ifdef _WIN32
-#define OPTSTRING_WIN32 "B:"
-#else
-#define OPTSTRING_WIN32 ""
-#endif /* _WIN32 */
+#if defined(_WIN32) || defined(HAVE_PCAP_CREATE)
+#define OPTSTRING_B "B:"
#else
-#define OPTSTRING_WIN32 ""
+#define OPTSTRING_B ""
+#endif /* _WIN32 or HAVE_PCAP_CREATE */
+#else /* HAVE_LIBPCAP */
+#define OPTSTRING_B ""
#endif /* HAVE_LIBPCAP */
- static const char optstring[] = OPTSTRING_INIT OPTSTRING_WIN32;
+#ifdef HAVE_PCAP_CREATE
+#define OPTSTRING_I "I"
+#else
+#define OPTSTRING_I ""
+#endif
+
+#define OPTSTRING "a:b:" OPTSTRING_B "c:C:d:De:E:f:F:G:hi:" OPTSTRING_I "K:lLnN:o:pPqr:R:s:St:T:u:vVw:xX:y:z:"
+
+ static const char optstring[] = OPTSTRING;
/*
* Get credential information for later use.
/*
* Attempt to get the pathname of the executable file.
*/
- init_progfile_dir_error = init_progfile_dir(argv[0]);
+ init_progfile_dir_error = init_progfile_dir(argv[0], main);
if (init_progfile_dir_error != NULL) {
fprintf(stderr, "tshark: Can't get pathname of tshark program: %s.\n",
init_progfile_dir_error);
while ((opt = getopt(argc, argv, optstring)) != -1) {
switch (opt) {
+ case 'C': /* Configuration Profile */
+ if (profile_exists (optarg)) {
+ set_profile_name (optarg);
+ } else {
+ cmdarg_err("Configuration Profile \"%s\" does not exist", optarg);
+ exit(1);
+ }
+ break;
case 'X':
ex_opt_add(optarg);
break;
optind = optind_initial;
opterr = 1;
- /* nothing more than the standard GLib handler, but without a warning */
+
+
+/** Send All g_log messages to our own handler **/
+
log_flags =
+ G_LOG_LEVEL_ERROR|
+ G_LOG_LEVEL_CRITICAL|
G_LOG_LEVEL_WARNING|
G_LOG_LEVEL_MESSAGE|
G_LOG_LEVEL_INFO|
- G_LOG_LEVEL_DEBUG;
+ G_LOG_LEVEL_DEBUG|
+ G_LOG_FLAG_FATAL|G_LOG_FLAG_RECURSION;
g_log_set_handler(NULL,
log_flags,
- log_func_ignore, NULL /* user_data */);
+ tshark_log_handler, NULL /* user_data */);
+ g_log_set_handler(LOG_DOMAIN_MAIN,
+ log_flags,
+ tshark_log_handler, NULL /* user_data */);
+
+#ifdef HAVE_LIBPCAP
g_log_set_handler(LOG_DOMAIN_CAPTURE,
log_flags,
- log_func_ignore, NULL /* user_data */);
+ tshark_log_handler, NULL /* user_data */);
+ g_log_set_handler(LOG_DOMAIN_CAPTURE_CHILD,
+ log_flags,
+ tshark_log_handler, NULL /* user_data */);
+#endif
initialize_funnel_ops();
#ifdef HAVE_LIBPCAP
- capture_opts_init(&capture_opts, NULL /* cfile */);
+ capture_opts_init(&global_capture_opts, &cfile);
#endif
timestamp_set_type(TS_RELATIVE);
timestamp_set_precision(TS_PREC_AUTO);
+ timestamp_set_seconds_type(TS_SECONDS_DEFAULT);
/* Register all dissectors; we must do this before checking for the
"-G" flag, as the "-G" flag dumps information registered by the
dissectors, and we must do it before we read the preferences, in
case any dissectors register preferences. */
epan_init(register_all_protocols, register_all_protocol_handoffs, NULL, NULL,
- failure_message, open_failure_message, read_failure_message);
+ failure_message, open_failure_message, read_failure_message,
+ write_failure_message);
/* Register all tap listeners; we do this before we parse the arguments,
as the "-z" argument can specify a registered tap. */
If none of our build or other processes uses "-G" with no arguments,
we can just process it with the other arguments. */
if (argc >= 2 && strcmp(argv[1], "-G") == 0) {
+ proto_initialize_all_prefixes();
+
if (argc == 2)
proto_registrar_dump_fields(1);
else {
/* Set the C-language locale to the native environment. */
setlocale(LC_ALL, "");
- prefs = read_prefs(&gpf_open_errno, &gpf_read_errno, &gpf_path,
+ prefs_p = read_prefs(&gpf_open_errno, &gpf_read_errno, &gpf_path,
&pf_open_errno, &pf_read_errno, &pf_path);
if (gpf_path != NULL) {
if (gpf_open_errno != 0) {
}
/* Set the name resolution code's flags from the preferences. */
- g_resolv_flags = prefs->name_resolve;
+ g_resolv_flags = prefs_p->name_resolve;
/* Read the disabled protocols file. */
read_disabled_protos_list(&gdp_path, &gdp_open_errno, &gdp_read_errno,
check_capture_privs();
- init_cap_file(&cfile);
-
- /* Assemble the compile-time version information string */
- comp_info_str = g_string_new("Compiled ");
- get_compiled_version_info(comp_info_str, get_epan_compiled_version_info);
-
- /* Assemble the run-time version information string */
- runtime_info_str = g_string_new("Running ");
- get_runtime_version_info(runtime_info_str, NULL);
+ cap_file_init(&cfile);
/* Print format defaults to this. */
print_format = PR_FMT_TEXT;
case 'f': /* capture filter */
case 'i': /* Use interface x */
case 'p': /* Don't capture in promiscuous mode */
+#ifdef HAVE_PCAP_CREATE
+ case 'I': /* Capture in monitor mode, if available */
+#endif
case 's': /* Set the snapshot (capture) length */
case 'w': /* Write to capture file x */
case 'y': /* Set the pcap data link type */
-#ifdef _WIN32
+#if defined(_WIN32) || defined(HAVE_PCAP_CREATE)
case 'B': /* Buffer size */
-#endif /* _WIN32 */
+#endif /* _WIN32 or HAVE_PCAP_CREATE */
#ifdef HAVE_LIBPCAP
- status = capture_opts_add_opt(&capture_opts, opt, optarg, &start_capture);
+ status = capture_opts_add_opt(&global_capture_opts, opt, optarg, &start_capture);
if(status != 0) {
exit(status);
}
arg_error = TRUE;
#endif
break;
+ case 'C':
+ /* Configuration profile settings were already processed just ignore them this time*/
+ break;
case 'd': /* Decode as rule */
if (!add_decode_as(optarg))
exit(1);
break;
+#if defined(HAVE_HEIMDAL_KERBEROS) || defined(HAVE_MIT_KERBEROS)
+ case 'K': /* Kerberos keytab file */
+ read_keytab_file(optarg);
+ break;
+#endif
case 'D': /* Print a list of capture devices and exit */
#ifdef HAVE_LIBPCAP
- status = capture_opts_list_interfaces(FALSE);
- exit(status);
+ if_list = capture_interface_list(&err, &err_str);
+ if (if_list == NULL) {
+ switch (err) {
+ case CANT_GET_INTERFACE_LIST:
+ cmdarg_err("%s", err_str);
+ g_free(err_str);
+ break;
+
+ case NO_INTERFACES_FOUND:
+ cmdarg_err("There are no interfaces on which a capture can be done");
+ break;
+ }
+ exit(2);
+ }
+ capture_opts_print_interfaces(if_list);
+ free_interface_list(if_list);
+ exit(0);
#else
capture_option_specified = TRUE;
arg_error = TRUE;
case 'L': /* Print list of link-layer types and exit */
#ifdef HAVE_LIBPCAP
list_link_layer_types = TRUE;
- break;
#else
capture_option_specified = TRUE;
arg_error = TRUE;
#endif
break;
+#if GLIB_CHECK_VERSION(2,10,0)
+ case 'P': /* Perform two pass analysis */
+ perform_two_pass_analysis = TRUE;
+ break;
+#endif
case 'n': /* No name resolution */
g_resolv_flags = RESOLV_NONE;
break;
exit(1);
}
break;
- case 'v': /* Show version and exit */
- printf("TShark " VERSION "%s\n"
- "\n"
- "%s"
- "\n"
- "%s"
- "\n"
- "%s",
- wireshark_svnversion, get_copyright_info(), comp_info_str->str,
- runtime_info_str->str);
+ case 'u': /* Seconds type */
+ if (strcmp(optarg, "s") == 0)
+ timestamp_set_seconds_type(TS_SECONDS_DEFAULT);
+ else if (strcmp(optarg, "hms") == 0)
+ timestamp_set_seconds_type(TS_SECONDS_HOUR_MIN_SEC);
+ else {
+ cmdarg_err("Invalid seconds type \"%s\"", optarg);
+ cmdarg_err_cont("It must be \"s\" for seconds or \"hms\" for hours, minutes and seconds.");
+ exit(1);
+ }
+ break;
+ case 'v': /* Show version and exit */
+ {
+ GString *comp_info_str;
+ GString *runtime_info_str;
+ /* Assemble the compile-time version information string */
+ comp_info_str = g_string_new("Compiled ");
+ get_compiled_version_info(comp_info_str, get_epan_compiled_version_info);
+
+ /* Assemble the run-time version information string */
+ runtime_info_str = g_string_new("Running ");
+ get_runtime_version_info(runtime_info_str, NULL);
+ show_version(comp_info_str, runtime_info_str);
+ g_string_free(comp_info_str, TRUE);
+ g_string_free(runtime_info_str, TRUE);
exit(0);
break;
+ }
case 'V': /* Verbose */
verbose = TRUE;
+ /* The user asked for a verbose output, so let's ensure they get it,
+ * even if they're writing to a file.
+ */
+ print_packet_info = TRUE;
break;
case 'x': /* Print packet data in hex (and ASCII) */
- print_hex = TRUE;
- break;
+ print_hex = TRUE;
+ /* The user asked for hex output, so let's ensure they get it,
+ * even if they're writing to a file.
+ */
+ print_packet_info = TRUE;
+ break;
case 'X':
- break;
+ break;
case 'z':
/* We won't call the init function for the stat this soon
as it would disallow MATE's fields (which are registered
rfilter = get_args_as_string(argc, argv, optind);
} else {
#ifdef HAVE_LIBPCAP
- if (capture_opts.has_cfilter) {
+ if (global_capture_opts.has_cfilter) {
cmdarg_err("Capture filters were specified both with \"-f\""
" and with additional command-line arguments");
exit(1);
}
- capture_opts.has_cfilter = TRUE;
- capture_opts.cfilter = get_args_as_string(argc, argv, optind);
+ global_capture_opts.has_cfilter = TRUE;
+ global_capture_opts.cfilter = get_args_as_string(argc, argv, optind);
#else
capture_option_specified = TRUE;
#endif
}
#ifdef HAVE_LIBPCAP
- if (!capture_opts.saving_to_file) {
+ if (!global_capture_opts.saving_to_file) {
/* We're not saving the capture to a file; if "-q" wasn't specified,
we should print packet information */
if (!quiet)
output, reject the request. At best, we could redirect that
to the standard error; we *can't* write both to the standard
output and have either of them be useful. */
- if (strcmp(capture_opts.save_file, "-") == 0 && print_packet_info) {
+ if (strcmp(global_capture_opts.save_file, "-") == 0 && print_packet_info) {
cmdarg_err("You can't write both raw packet data and dissected packets"
" to the standard output.");
exit(1);
support in capture files we read). */
#ifdef HAVE_LIBPCAP
if (cf_name != NULL) {
- if (capture_opts.has_cfilter) {
+ if (global_capture_opts.has_cfilter) {
cmdarg_err("Only read filters, not capture filters, "
"can be specified when reading a capture file.");
exit(1);
exit(1);
}
/* No - did they specify a ring buffer option? */
- if (capture_opts.multi_files_on) {
+ if (global_capture_opts.multi_files_on) {
cmdarg_err("Ring buffer requested, but a capture isn't being done.");
exit(1);
}
* "-r" was specified, so we're reading a capture file.
* Capture options don't apply here.
*/
- if (capture_opts.multi_files_on) {
+ if (global_capture_opts.multi_files_on) {
cmdarg_err("Multiple capture files requested, but "
"a capture isn't being done.");
exit(1);
}
- if (capture_opts.has_file_duration) {
+ if (global_capture_opts.has_file_duration) {
cmdarg_err("Switching capture files after a time interval was specified, but "
"a capture isn't being done.");
exit(1);
}
- if (capture_opts.has_ring_num_files) {
+ if (global_capture_opts.has_ring_num_files) {
cmdarg_err("A ring buffer of capture files was specified, but "
"a capture isn't being done.");
exit(1);
}
- if (capture_opts.has_autostop_files) {
+ if (global_capture_opts.has_autostop_files) {
cmdarg_err("A maximum number of capture files was specified, but "
"a capture isn't being done.");
exit(1);
* and byte count as well as a write file. Other autostop options remain valid
* only for a write file.
*/
- if (capture_opts.has_autostop_duration) {
+ if (global_capture_opts.has_autostop_duration) {
cmdarg_err("A maximum capture time was specified, but "
"a capture isn't being done.");
exit(1);
/*
* "-r" wasn't specified, so we're doing a live capture.
*/
- if (capture_opts.saving_to_file) {
+ if (global_capture_opts.saving_to_file) {
/* They specified a "-w" flag, so we'll be saving to a capture file. */
/* When capturing, we only support writing libpcap format. */
cmdarg_err("Live captures can only be saved in libpcap format.");
exit(1);
}
- if (capture_opts.multi_files_on) {
+ if (global_capture_opts.multi_files_on) {
/* Multiple-file mode doesn't work under certain conditions:
a) it doesn't work if you're writing to the standard output;
b) it doesn't work if you're writing to a pipe;
*/
- if (strcmp(capture_opts.save_file, "-") == 0) {
+ if (strcmp(global_capture_opts.save_file, "-") == 0) {
cmdarg_err("Multiple capture files requested, but "
"the capture is being written to the standard output.");
exit(1);
}
- if (capture_opts.output_to_pipe) {
+ if (global_capture_opts.output_to_pipe) {
cmdarg_err("Multiple capture files requested, but "
"the capture file is a pipe.");
exit(1);
}
- if (!capture_opts.has_autostop_filesize &&
- !capture_opts.has_file_duration) {
+ if (!global_capture_opts.has_autostop_filesize &&
+ !global_capture_opts.has_file_duration) {
cmdarg_err("Multiple capture files requested, but "
"no maximum capture file size or duration was specified.");
exit(1);
/* They didn't specify a "-w" flag, so we won't be saving to a
capture file. Check for options that only make sense if
we're saving to a file. */
- if (capture_opts.has_autostop_filesize) {
+ if (global_capture_opts.has_autostop_filesize) {
cmdarg_err("Maximum capture file size specified, but "
"capture isn't being saved to a file.");
exit(1);
}
- if (capture_opts.multi_files_on) {
+ if (global_capture_opts.multi_files_on) {
cmdarg_err("Multiple capture files requested, but "
"the capture isn't being saved to a file.");
exit(1);
}
/* Build the column format array */
- col_setup(&cfile.cinfo, prefs->num_cols);
- for (i = 0; i < cfile.cinfo.num_cols; i++) {
- cfile.cinfo.col_fmt[i] = get_column_format(i);
- cfile.cinfo.col_title[i] = g_strdup(get_column_title(i));
- cfile.cinfo.fmt_matx[i] = (gboolean *) g_malloc0(sizeof(gboolean) *
- NUM_COL_FMTS);
- get_column_format_matches(cfile.cinfo.fmt_matx[i], cfile.cinfo.col_fmt[i]);
- cfile.cinfo.col_data[i] = NULL;
- if (cfile.cinfo.col_fmt[i] == COL_INFO)
- cfile.cinfo.col_buf[i] = (gchar *) g_malloc(sizeof(gchar) * COL_MAX_INFO_LEN);
- else
- cfile.cinfo.col_buf[i] = (gchar *) g_malloc(sizeof(gchar) * COL_MAX_LEN);
- cfile.cinfo.col_fence[i] = 0;
- cfile.cinfo.col_expr[i] = (gchar *) g_malloc(sizeof(gchar) * COL_MAX_LEN);
- cfile.cinfo.col_expr_val[i] = (gchar *) g_malloc(sizeof(gchar) * COL_MAX_LEN);
- }
-
- for (i = 0; i < cfile.cinfo.num_cols; i++) {
- int j;
-
- for (j = 0; j < NUM_COL_FMTS; j++) {
- if (!cfile.cinfo.fmt_matx[i][j])
- continue;
-
- if (cfile.cinfo.col_first[j] == -1)
- cfile.cinfo.col_first[j] = i;
- cfile.cinfo.col_last[j] = i;
- }
- }
+ build_column_format_array(&cfile.cinfo, prefs_p->num_cols, TRUE);
#ifdef HAVE_LIBPCAP
- capture_opts_trim_snaplen(&capture_opts, MIN_PACKET_SIZE);
- capture_opts_trim_ring_num_files(&capture_opts);
+ capture_opts_trim_snaplen(&global_capture_opts, MIN_PACKET_SIZE);
+ capture_opts_trim_ring_num_files(&global_capture_opts);
#endif
if (rfilter != NULL) {
/* Process the packets in the file */
#ifdef HAVE_LIBPCAP
- err = load_cap_file(&cfile, capture_opts.save_file, out_file_type,
- capture_opts.has_autostop_packets ? capture_opts.autostop_packets : 0,
- capture_opts.has_autostop_filesize ? capture_opts.autostop_filesize : 0);
+ err = load_cap_file(&cfile, global_capture_opts.save_file, out_file_type,
+ global_capture_opts.has_autostop_packets ? global_capture_opts.autostop_packets : 0,
+ global_capture_opts.has_autostop_filesize ? global_capture_opts.autostop_filesize : 0);
#else
err = load_cap_file(&cfile, NULL, out_file_type, 0, 0);
#endif
epan_cleanup();
exit(2);
}
- cf_name[0] = '\0';
} else {
/* No capture file specified, so we're supposed to do a live capture
(or get a list of link-layer types for a live capture device);
#endif
/* trim the interface name and exit if that failed */
- if (!capture_opts_trim_iface(&capture_opts,
- (prefs->capture_device) ? get_if_name(prefs->capture_device) : NULL)) {
+ if (!capture_opts_trim_iface(&global_capture_opts,
+ (prefs_p->capture_device) ? get_if_name(prefs_p->capture_device) : NULL)) {
exit(2);
}
/* if requested, list the link layer types and exit */
if (list_link_layer_types) {
- status = capture_opts_list_link_layer_types(&capture_opts, FALSE);
- exit(status);
+ /* Get the list of link-layer types for the capture device. */
+ if_capabilities_t *caps;
+
+ caps = capture_get_if_capabilities(global_capture_opts.iface,
+ global_capture_opts.monitor_mode,
+ &err_str);
+ if (caps == NULL) {
+ cmdarg_err("%s", err_str);
+ g_free(err_str);
+ exit(2);
+ }
+ if (caps->data_link_types == NULL) {
+ cmdarg_err("The capture device \"%s\" has no data link types.", global_capture_opts.iface);
+ exit(2);
+ }
+ capture_opts_print_if_capabilities(caps,
+ global_capture_opts.monitor_mode);
+ free_if_capabilities(caps);
+ exit(0);
}
if (print_packet_info) {
#endif
}
+ g_free(cf_name);
+
+#if GLIB_CHECK_VERSION(2,10,0)
+ if (cfile.plist_start != NULL)
+ g_slice_free_chain(frame_data, cfile.plist_start, next);
+#endif
+
draw_tap_listeners(TRUE);
funnel_dump_all_text_windows();
epan_cleanup();
relinquish_special_privs_perm();
print_current_user();
+ /* Cleanup all data structures used for dissection. */
+ cleanup_dissection();
/* Initialize all data structures used for dissection. */
init_dissection();
#endif /* SIGINFO */
#endif /* _WIN32 */
- capture_opts.state = CAPTURE_PREPARING;
+ global_capture_opts.state = CAPTURE_PREPARING;
/* Let the user know what interface was chosen. */
- capture_opts.iface_descr = get_interface_descriptive_name(capture_opts.iface);
- fprintf(stderr, "Capturing on %s\n", capture_opts.iface_descr);
+ global_capture_opts.iface_descr = get_interface_descriptive_name(global_capture_opts.iface);
+ fprintf(stderr, "Capturing on %s\n", global_capture_opts.iface_descr);
- ret = sync_pipe_start(&capture_opts);
+ ret = sync_pipe_start(&global_capture_opts);
if (!ret)
return FALSE;
{
}
-/* XXX - move the call to simple_dialog() out of capture_sync.c */
-#include "simple_dialog.h"
-
-/* capture_sync.c want's to tell us an error */
-gpointer simple_dialog(ESD_TYPE_E type _U_, gint btn_mask _U_,
- const gchar *msg_format, ...)
-{
- va_list ap;
-
- /* XXX - do we need to display buttons and alike? */
- va_start(ap, msg_format);
- fprintf(stderr, "tshark: ");
- vfprintf(stderr, msg_format, ap);
- fprintf(stderr, "\n");
- va_end(ap);
-
- return NULL;
-}
-
-
/* capture child detected an error */
void
capture_input_error_message(capture_options *capture_opts _U_, char *error_msg, char *secondary_error_msg)
g_assert(capture_opts->state == CAPTURE_PREPARING || capture_opts->state == CAPTURE_RUNNING);
- capture_opts->cf = &cfile;
-
/* free the old filename */
- if(capture_opts->save_file != NULL) {
+ if (capture_opts->save_file != NULL) {
+
/* we start a new capture file, close the old one (if we had one before) */
if( ((capture_file *) capture_opts->cf)->state != FILE_CLOSED) {
- if(capture_opts->cf != NULL && ((capture_file *) capture_opts->cf)->wth != NULL) {
- wtap_close(((capture_file *) capture_opts->cf)->wth);
- }
+ if ( ((capture_file *) capture_opts->cf)->wth != NULL) {
+ wtap_close(((capture_file *) capture_opts->cf)->wth);
+ }
+ ((capture_file *) capture_opts->cf)->state = FILE_CLOSED;
}
+
g_free(capture_opts->save_file);
is_tempfile = FALSE;
} else {
g_free(capture_opts->save_file);
capture_opts->save_file = NULL;
return FALSE;
- break;
}
}
gchar *err_info;
gint64 data_offset;
capture_file *cf = capture_opts->cf;
-
+ gboolean filtering_tap_listeners;
+ guint tap_flags;
#ifdef SIGINFO
/*
infodelay = TRUE;
#endif /* SIGINFO */
+ /* Do we have any tap listeners with filters? */
+ filtering_tap_listeners = have_filtering_tap_listeners();
+
+ /* Get the union of the flags for all tap listeners. */
+ tap_flags = union_of_tap_listener_flags();
+
if(do_dissection) {
while (to_read-- && cf->wth) {
ret = wtap_read(cf->wth, &err, &err_info, &data_offset);
cf->wth = NULL;
} else {
ret = process_packet(cf, data_offset, wtap_phdr(cf->wth),
- wtap_pseudoheader(cf->wth), wtap_buf_ptr(cf->wth));
+ wtap_pseudoheader(cf->wth), wtap_buf_ptr(cf->wth),
+ filtering_tap_listeners, tap_flags);
}
if (ret != FALSE) {
/* packet sucessfully read and gone through the "Read Filter" */
/* capture child detected any packet drops? */
void
-capture_input_drops(capture_options *capture_opts _U_, int dropped)
+capture_input_drops(capture_options *capture_opts _U_, guint32 dropped)
{
- if (print_packet_counts) {
- /* We're printing packet counts to stderr.
- Send a newline so that we move to the line after the packet count. */
- fprintf(stderr, "\n");
- }
-
- if(dropped != 0) {
- /* We're printing packet counts to stderr.
- Send a newline so that we move to the line after the packet count. */
- fprintf(stderr, "%u packet%s dropped\n", dropped, plurality(dropped, "", "s"));
- }
+ if (print_packet_counts) {
+ /* We're printing packet counts to stderr.
+ Send a newline so that we move to the line after the packet count. */
+ fprintf(stderr, "\n");
+ }
+
+ if (dropped != 0) {
+ /* We're printing packet counts to stderr.
+ Send a newline so that we move to the line after the packet count. */
+ fprintf(stderr, "%u packet%s dropped\n", dropped, plurality(dropped, "", "s"));
+ }
}
building it with Cygwin may make the problem go away). */
/* tell the capture child to stop */
- sync_pipe_stop(&capture_opts);
+ sync_pipe_stop(&global_capture_opts);
/* don't stop our own loop already here, otherwise status messages and
* cleanup wouldn't be done properly. The child will indicate the stop of
capture_cleanup(int signum _U_)
{
/* tell the capture child to stop */
- sync_pipe_stop(&capture_opts);
+ sync_pipe_stop(&global_capture_opts);
}
#endif /* _WIN32 */
#endif /* HAVE_LIBPCAP */
+#if GLIB_CHECK_VERSION(2,10,0)
+static gboolean
+process_packet_first_pass(capture_file *cf,
+ gint64 offset, const struct wtap_pkthdr *whdr,
+ union wtap_pseudo_header *pseudo_header, const guchar *pd)
+{
+ frame_data *fdata = g_slice_new(frame_data);
+ epan_dissect_t edt;
+ gboolean passed;
+
+ /* Count this packet. */
+ cf->count++;
+
+ /* If we're not running a display filter and we're not printing any
+ packet information, we don't need to do a dissection. This means
+ that all packets can be marked as 'passed'. */
+ passed = TRUE;
+
+ frame_data_init(fdata, cf->count, whdr, offset, cum_bytes);
+
+ /* If we're going to print packet information, or we're going to
+ run a read filter, or we're going to process taps, set up to
+ do a dissection and do so. */
+ if (do_dissection) {
+ if (g_resolv_flags)
+ /* Grab any resolved addresses */
+ host_name_lookup_process(NULL);
+
+ /* The protocol tree will be "visible", i.e., printed, only if we're
+ printing packet details, which is true if we're printing stuff
+ ("print_packet_info" is true) and we're in verbose mode ("verbose"
+ is true). */
+ epan_dissect_init(&edt, FALSE, FALSE);
+
+ /* If we're running a read filter, prime the epan_dissect_t with that
+ filter. */
+ if (cf->rfcode)
+ epan_dissect_prime_dfilter(&edt, cf->rfcode);
+
+ frame_data_set_before_dissect(fdata, &cf->elapsed_time,
+ &first_ts, &prev_dis_ts, &prev_cap_ts);
+
+ epan_dissect_run(&edt, pseudo_header, pd, fdata, NULL);
+
+ /* Run the read filter if we have one. */
+ if (cf->rfcode)
+ passed = dfilter_apply_edt(cf->rfcode, &edt);
+ }
+
+ if (passed) {
+ frame_data_set_after_dissect(fdata, &cum_bytes, &prev_dis_ts);
+ cap_file_add_fdata(cf, fdata);
+ }
+ else
+ g_slice_free(frame_data, fdata);
+
+ if (do_dissection)
+ epan_dissect_cleanup(&edt);
+
+ return passed;
+}
+
+static gboolean
+process_packet_second_pass(capture_file *cf, frame_data *fdata,
+ union wtap_pseudo_header *pseudo_header, const guchar *pd,
+ gboolean filtering_tap_listeners, guint tap_flags)
+{
+ gboolean create_proto_tree;
+ column_info *cinfo;
+ epan_dissect_t edt;
+ gboolean passed;
+
+ /* If we're not running a display filter and we're not printing any
+ packet information, we don't need to do a dissection. This means
+ that all packets can be marked as 'passed'. */
+ passed = TRUE;
+
+ /* If we're going to print packet information, or we're going to
+ run a read filter, or we're going to process taps, set up to
+ do a dissection and do so. */
+ if (do_dissection) {
+ if (g_resolv_flags)
+ /* Grab any resolved addresses */
+ host_name_lookup_process(NULL);
+
+ if (cf->rfcode || verbose || filtering_tap_listeners ||
+ (tap_flags & TL_REQUIRES_PROTO_TREE) || have_custom_cols(&cf->cinfo))
+ create_proto_tree = TRUE;
+ else
+ create_proto_tree = FALSE;
+
+ /* The protocol tree will be "visible", i.e., printed, only if we're
+ printing packet details, which is true if we're printing stuff
+ ("print_packet_info" is true) and we're in verbose mode ("verbose"
+ is true). */
+ epan_dissect_init(&edt, create_proto_tree, print_packet_info && verbose);
+
+ /* If we're running a read filter, prime the epan_dissect_t with that
+ filter. */
+ if (cf->rfcode)
+ epan_dissect_prime_dfilter(&edt, cf->rfcode);
+
+ col_custom_prime_edt(&edt, &cf->cinfo);
+
+ tap_queue_init(&edt);
+
+ /* We only need the columns if either
+
+ 1) some tap needs the columns
+
+ or
+
+ 2) we're printing packet info but we're *not* verbose; in verbose
+ mode, we print the protocol tree, not the protocol summary. */
+ if ((tap_flags & TL_REQUIRES_COLUMNS) || (print_packet_info && !verbose))
+ cinfo = &cf->cinfo;
+ else
+ cinfo = NULL;
+
+ epan_dissect_run(&edt, pseudo_header, pd, fdata, cinfo);
+
+ tap_push_tapped_queue(&edt);
+
+ /* Run the read filter if we have one. */
+ if (cf->rfcode)
+ passed = dfilter_apply_edt(cf->rfcode, &edt);
+ }
+
+ if (passed) {
+ /* Process this packet. */
+ if (print_packet_info) {
+ /* We're printing packet information; print the information for
+ this packet. */
+ if (do_dissection)
+ print_packet(cf, &edt);
+ else
+ print_packet(cf, NULL);
+
+ /* The ANSI C standard does not appear to *require* that a line-buffered
+ stream be flushed to the host environment whenever a newline is
+ written, it just says that, on such a stream, characters "are
+ intended to be transmitted to or from the host environment as a
+ block when a new-line character is encountered".
+
+ The Visual C++ 6.0 C implementation doesn't do what is intended;
+ even if you set a stream to be line-buffered, it still doesn't
+ flush the buffer at the end of every line.
+
+ So, if the "-l" flag was specified, we flush the standard output
+ at the end of a packet. This will do the right thing if we're
+ printing packet summary lines, and, as we print the entire protocol
+ tree for a single packet without waiting for anything to happen,
+ it should be as good as line-buffered mode if we're printing
+ protocol trees. (The whole reason for the "-l" flag in either
+ tcpdump or TShark is to allow the output of a live capture to
+ be piped to a program or script and to have that script see the
+ information for the packet as soon as it's printed, rather than
+ having to wait until a standard I/O buffer fills up. */
+ if (line_buffered)
+ fflush(stdout);
+
+ if (ferror(stdout)) {
+ show_print_file_io_error(errno);
+ exit(2);
+ }
+ }
+ }
+
+ if (do_dissection) {
+ epan_dissect_cleanup(&edt);
+ }
+ return passed;
+}
+#endif
+
static int
load_cap_file(capture_file *cf, char *save_file, int out_file_type,
int max_packet_count, gint64 max_byte_count)
gchar *err_info;
gint64 data_offset;
char *save_file_string = NULL;
+ gboolean filtering_tap_listeners;
+ guint tap_flags;
linktype = wtap_file_encap(cf->wth);
if (save_file != NULL) {
}
pdh = NULL;
}
- while (wtap_read(cf->wth, &err, &err_info, &data_offset)) {
- if (process_packet(cf, data_offset, wtap_phdr(cf->wth),
- wtap_pseudoheader(cf->wth), wtap_buf_ptr(cf->wth))) {
- /* Either there's no read filtering or this packet passed the
- filter, so, if we're writing to a capture file, write
- this packet out. */
- if (pdh != NULL) {
- if (!wtap_dump(pdh, wtap_phdr(cf->wth),
- wtap_pseudoheader(cf->wth), wtap_buf_ptr(cf->wth),
- &err)) {
- /* Error writing to a capture file */
- show_capture_file_io_error(save_file, err, FALSE);
- wtap_dump_close(pdh, &err);
- exit(2);
+
+ /* Do we have any tap listeners with filters? */
+ filtering_tap_listeners = have_filtering_tap_listeners();
+
+ /* Get the union of the flags for all tap listeners. */
+ tap_flags = union_of_tap_listener_flags();
+
+ if (perform_two_pass_analysis) {
+#if GLIB_CHECK_VERSION(2,10,0)
+ frame_data *fdata;
+ int old_max_packet_count = max_packet_count;
+
+ while (wtap_read(cf->wth, &err, &err_info, &data_offset)) {
+ if (process_packet_first_pass(cf, data_offset, wtap_phdr(cf->wth),
+ wtap_pseudoheader(cf->wth), wtap_buf_ptr(cf->wth))) {
+ /* Stop reading if we have the maximum number of packets;
+ * When the -c option has not been used, max_packet_count
+ * starts at 0, which practically means, never stop reading.
+ * (unless we roll over max_packet_count ?)
+ */
+ if( (--max_packet_count == 0) || (max_byte_count != 0 && data_offset >= max_byte_count)) {
+ err = 0; /* This is not an error */
+ break;
}
}
- /* Stop reading if we have the maximum number of packets;
- * note that a zero max_packet_count will never be matched
- * (unless we roll over the packet number?)
- */
- if(max_packet_count == cf->count || (max_byte_count != 0 && data_offset >= max_byte_count)) {
- err = 0; /* This is not an error */
- break;
+ }
+
+ /* Close the sequential I/O side, to free up memory it requires. */
+ wtap_sequential_close(cf->wth);
+
+ /* Allow the protocol dissectors to free up memory that they
+ * don't need after the sequential run-through of the packets. */
+ postseq_cleanup_all_protocols();
+
+ max_packet_count = old_max_packet_count;
+
+ for (fdata = cf->plist_start; err == 0 && fdata != NULL; fdata = fdata->next) {
+ if (wtap_seek_read(cf->wth, fdata->file_off, &cf->pseudo_header,
+ cf->pd, fdata->cap_len, &err, &err_info)) {
+ if (process_packet_second_pass(cf, fdata,
+ &cf->pseudo_header, cf->pd,
+ filtering_tap_listeners, tap_flags)) {
+ /* Either there's no read filtering or this packet passed the
+ filter, so, if we're writing to a capture file, write
+ this packet out. */
+ if (pdh != NULL) {
+ if (!wtap_dump(pdh, wtap_phdr(cf->wth),
+ wtap_pseudoheader(cf->wth), wtap_buf_ptr(cf->wth),
+ &err)) {
+ /* Error writing to a capture file */
+ show_capture_file_io_error(save_file, err, FALSE);
+ wtap_dump_close(pdh, &err);
+ exit(2);
+ }
+ }
+ /* Stop reading if we have the maximum number of packets;
+ * When the -c option has not been used, max_packet_count
+ * starts at 0, which practically means, never stop reading.
+ * (unless we roll over max_packet_count ?)
+ */
+ if( (--max_packet_count == 0) || (max_byte_count != 0 && data_offset >= max_byte_count)) {
+ err = 0; /* This is not an error */
+ break;
+ }
+ }
}
}
+#endif
}
+ else {
+ while (wtap_read(cf->wth, &err, &err_info, &data_offset)) {
+ if (process_packet(cf, data_offset, wtap_phdr(cf->wth),
+ wtap_pseudoheader(cf->wth), wtap_buf_ptr(cf->wth),
+ filtering_tap_listeners, tap_flags)) {
+ /* Either there's no read filtering or this packet passed the
+ filter, so, if we're writing to a capture file, write
+ this packet out. */
+ if (pdh != NULL) {
+ if (!wtap_dump(pdh, wtap_phdr(cf->wth),
+ wtap_pseudoheader(cf->wth), wtap_buf_ptr(cf->wth),
+ &err)) {
+ /* Error writing to a capture file */
+ show_capture_file_io_error(save_file, err, FALSE);
+ wtap_dump_close(pdh, &err);
+ exit(2);
+ }
+ }
+ /* Stop reading if we have the maximum number of packets;
+ * When the -c option has not been used, max_packet_count
+ * starts at 0, which practically means, never stop reading.
+ * (unless we roll over max_packet_count ?)
+ */
+ if( (--max_packet_count == 0) || (max_byte_count != 0 && data_offset >= max_byte_count)) {
+ err = 0; /* This is not an error */
+ break;
+ }
+ }
+ }
+ }
+
if (err != 0) {
/* Print a message noting that the read failed somewhere along the line. */
switch (err) {
case WTAP_ERR_UNSUPPORTED_ENCAP:
cmdarg_err("\"%s\" has a packet with a network type that TShark doesn't support.\n(%s)",
cf->filename, err_info);
+ g_free(err_info);
break;
case WTAP_ERR_CANT_READ:
case WTAP_ERR_BAD_RECORD:
cmdarg_err("\"%s\" appears to be damaged or corrupt.\n(%s)",
cf->filename, err_info);
+ g_free(err_info);
break;
default:
wtap_close(cf->wth);
cf->wth = NULL;
- if (save_file_string != NULL)
- g_free(save_file_string);
+ g_free(save_file_string);
return err;
}
-static void
-fill_in_fdata(frame_data *fdata, capture_file *cf,
- const struct wtap_pkthdr *phdr, gint64 offset)
-{
- fdata->next = NULL;
- fdata->prev = NULL;
- fdata->pfd = NULL;
- fdata->num = cf->count;
- fdata->pkt_len = phdr->len;
- cum_bytes += phdr->len;
- fdata->cum_bytes = cum_bytes;
- fdata->cap_len = phdr->caplen;
- fdata->file_off = offset;
- fdata->lnk_t = phdr->pkt_encap;
- fdata->abs_ts.secs = phdr->ts.secs;
- fdata->abs_ts.nsecs = phdr->ts.nsecs;
- fdata->flags.passed_dfilter = 0;
- fdata->flags.encoding = CHAR_ASCII;
- fdata->flags.visited = 0;
- fdata->flags.marked = 0;
- fdata->flags.ref_time = 0;
- fdata->color_filter = NULL;
-
- /* If we don't have the time stamp of the first packet in the
- capture, it's because this is the first packet. Save the time
- stamp of this packet as the time stamp of the first packet. */
- if (nstime_is_unset(&first_ts)) {
- first_ts = fdata->abs_ts;
- }
-
- /* If we don't have the time stamp of the previous captured packet,
- it's because this is the first packet. Save the time
- stamp of this packet as the time stamp of the previous captured
- packet. */
- if (nstime_is_unset(&prev_cap_ts)) {
- prev_cap_ts = fdata->abs_ts;
- }
-
- /* Get the time elapsed between the first packet and this packet. */
- nstime_delta(&fdata->rel_ts, &fdata->abs_ts, &first_ts);
-
- /* If it's greater than the current elapsed time, set the elapsed time
- to it (we check for "greater than" so as not to be confused by
- time moving backwards). */
- if ((gint32)cf->elapsed_time.secs < fdata->rel_ts.secs
- || ((gint32)cf->elapsed_time.secs == fdata->rel_ts.secs && (gint32)cf->elapsed_time.nsecs < fdata->rel_ts.nsecs)) {
- cf->elapsed_time = fdata->rel_ts;
- }
-
- /* Get the time elapsed between the previous displayed packet and
- this packet. */
- if (nstime_is_unset(&prev_dis_ts))
- nstime_set_zero(&fdata->del_dis_ts);
- else
- nstime_delta(&fdata->del_dis_ts, &fdata->abs_ts, &prev_dis_ts);
-
- /* Get the time elapsed between the previous captured packet and
- this packet. */
- nstime_delta(&fdata->del_cap_ts, &fdata->abs_ts, &prev_cap_ts);
- prev_cap_ts = fdata->abs_ts;
-}
-
-/* Free up all data attached to a "frame_data" structure. */
-static void
-clear_fdata(frame_data *fdata)
-{
- if (fdata->pfd)
- g_slist_free(fdata->pfd);
-}
-
static gboolean
process_packet(capture_file *cf, gint64 offset, const struct wtap_pkthdr *whdr,
- union wtap_pseudo_header *pseudo_header, const guchar *pd)
+ union wtap_pseudo_header *pseudo_header, const guchar *pd,
+ gboolean filtering_tap_listeners, guint tap_flags)
{
frame_data fdata;
gboolean create_proto_tree;
- epan_dissect_t *edt;
+ column_info *cinfo;
+ epan_dissect_t edt;
gboolean passed;
/* Count this packet. */
cf->count++;
+ /* If we're not running a display filter and we're not printing any
+ packet information, we don't need to do a dissection. This means
+ that all packets can be marked as 'passed'. */
+ passed = TRUE;
+
+ frame_data_init(&fdata, cf->count, whdr, offset, cum_bytes);
+
/* If we're going to print packet information, or we're going to
run a read filter, or we're going to process taps, set up to
do a dissection and do so. */
if (do_dissection) {
- fill_in_fdata(&fdata, cf, whdr, offset);
-
- if (print_packet_info) {
+ if (print_packet_info && g_resolv_flags)
/* Grab any resolved addresses */
+ host_name_lookup_process(NULL);
- if (g_resolv_flags) {
- host_name_lookup_process(NULL);
- }
- }
-
- passed = TRUE;
- if (cf->rfcode || verbose || num_tap_filters!=0)
+ if (cf->rfcode || verbose || filtering_tap_listeners ||
+ (tap_flags & TL_REQUIRES_PROTO_TREE) || have_custom_cols(&cf->cinfo))
create_proto_tree = TRUE;
else
create_proto_tree = FALSE;
+
/* The protocol tree will be "visible", i.e., printed, only if we're
printing packet details, which is true if we're printing stuff
("print_packet_info" is true) and we're in verbose mode ("verbose"
is true). */
- edt = epan_dissect_new(create_proto_tree, print_packet_info && verbose);
+ epan_dissect_init(&edt, create_proto_tree, print_packet_info && verbose);
/* If we're running a read filter, prime the epan_dissect_t with that
filter. */
if (cf->rfcode)
- epan_dissect_prime_dfilter(edt, cf->rfcode);
+ epan_dissect_prime_dfilter(&edt, cf->rfcode);
+
+ col_custom_prime_edt(&edt, &cf->cinfo);
+
+ tap_queue_init(&edt);
+
+ /* We only need the columns if either
+
+ 1) some tap needs the columns
+
+ or
+
+ 2) we're printing packet info but we're *not* verbose; in verbose
+ mode, we print the protocol tree, not the protocol summary. */
+ if ((tap_flags & TL_REQUIRES_COLUMNS) || (print_packet_info && !verbose))
+ cinfo = &cf->cinfo;
+ else
+ cinfo = NULL;
- tap_queue_init(edt);
+ frame_data_set_before_dissect(&fdata, &cf->elapsed_time,
+ &first_ts, &prev_dis_ts, &prev_cap_ts);
- /* We only need the columns if we're printing packet info but we're
- *not* verbose; in verbose mode, we print the protocol tree, not
- the protocol summary. */
- epan_dissect_run(edt, pseudo_header, pd, &fdata,
- (print_packet_info && !verbose) ? &cf->cinfo : NULL);
+ epan_dissect_run(&edt, pseudo_header, pd, &fdata, cinfo);
- tap_push_tapped_queue(edt);
+ tap_push_tapped_queue(&edt);
/* Run the read filter if we have one. */
if (cf->rfcode)
- passed = dfilter_apply_edt(cf->rfcode, edt);
- else
- passed = TRUE;
- } else {
- /* We're not running a display filter and we're not printing any
- packet information, so we don't need to do a dissection, and all
- packets are processed. */
- edt = NULL;
- passed = TRUE;
+ passed = dfilter_apply_edt(cf->rfcode, &edt);
}
if (passed) {
- /* Keep the time of the current packet if the packet passed
- the read filter so that the delta time since last displayed
- packet can be calculated */
- prev_dis_ts = fdata.abs_ts;
+ frame_data_set_after_dissect(&fdata, &cum_bytes, &prev_dis_ts);
/* Process this packet. */
if (print_packet_info) {
/* We're printing packet information; print the information for
this packet. */
- print_packet(cf, edt);
+ if (do_dissection)
+ print_packet(cf, &edt);
+ else
+ print_packet(cf, NULL);
/* The ANSI C standard does not appear to *require* that a line-buffered
stream be flushed to the host environment whenever a newline is
}
if (do_dissection) {
- epan_dissect_free(edt);
- clear_fdata(&fdata);
+ epan_dissect_cleanup(&edt);
+ frame_data_cleanup(&fdata);
}
return passed;
}
-static void
-show_capture_file_io_error(const char *fname, int err, gboolean is_close)
-{
- char *save_file_string;
-
- save_file_string = output_file_description(fname);
-
- switch (err) {
-
- case ENOSPC:
- cmdarg_err("Not all the packets could be written to the %s because there is "
- "no space left on the file system.",
- save_file_string);
- break;
-
-#ifdef EDQUOT
- case EDQUOT:
- cmdarg_err("Not all the packets could be written to the %s because you are "
- "too close to, or over your disk quota.",
- save_file_string);
- break;
-#endif
-
- case WTAP_ERR_CANT_CLOSE:
- cmdarg_err("The %s couldn't be closed for some unknown reason.",
- save_file_string);
- break;
-
- case WTAP_ERR_SHORT_WRITE:
- cmdarg_err("Not all the packets could be written to the %s.",
- save_file_string);
- break;
-
- default:
- if (is_close) {
- cmdarg_err("The %s could not be closed: %s.", save_file_string,
- wtap_strerror(err));
- } else {
- cmdarg_err("An error occurred while writing to the %s: %s.",
- save_file_string, wtap_strerror(err));
- }
- break;
- }
- g_free(save_file_string);
-}
-
static gboolean
write_preamble(capture_file *cf)
{
case WRITE_TEXT:
return print_preamble(print_stream, cf ? cf->filename : NULL);
- break;
case WRITE_XML:
if (verbose)
* the same time, sort of like an "Update list of packets
* in real time" capture in Wireshark.)
*/
- if (capture_opts.iface != NULL)
+ if (global_capture_opts.iface != NULL)
continue;
#endif
column_len = strlen(cf->cinfo.col_data[i]);
}
} else {
/* Just fill in the columns. */
- epan_dissect_fill_in_columns(edt);
+ epan_dissect_fill_in_columns(edt, FALSE, TRUE);
/* Now print them. */
switch (output_action) {
case WRITE_TEXT:
return print_finale(print_stream);
- break;
case WRITE_XML:
if (verbose)
}
}
+cf_status_t
+cf_open(capture_file *cf, const char *fname, gboolean is_tempfile, int *err)
+{
+ wtap *wth;
+ gchar *err_info;
+ char err_msg[2048+1];
+
+ wth = wtap_open_offline(fname, err, &err_info, perform_two_pass_analysis);
+ if (wth == NULL)
+ goto fail;
+
+ /* The open succeeded. Fill in the information for this file. */
+
+ /* Cleanup all data structures used for dissection. */
+ cleanup_dissection();
+ /* Initialize all data structures used for dissection. */
+ init_dissection();
+
+ cf->wth = wth;
+ cf->f_datalen = 0; /* not used, but set it anyway */
+
+ /* Set the file name because we need it to set the follow stream filter.
+ XXX - is that still true? We need it for other reasons, though,
+ in any case. */
+ cf->filename = g_strdup(fname);
+
+ /* Indicate whether it's a permanent or temporary file. */
+ cf->is_tempfile = is_tempfile;
+
+ /* If it's a temporary capture buffer file, mark it as not saved. */
+ cf->user_saved = !is_tempfile;
+
+ cf->cd_t = wtap_file_type(cf->wth);
+ cf->count = 0;
+ cf->drops_known = FALSE;
+ cf->drops = 0;
+ cf->snap = wtap_snapshot_length(cf->wth);
+ if (cf->snap == 0) {
+ /* Snapshot length not known. */
+ cf->has_snap = FALSE;
+ cf->snap = WTAP_MAX_PACKET_SIZE;
+ } else
+ cf->has_snap = TRUE;
+ nstime_set_zero(&cf->elapsed_time);
+ nstime_set_unset(&first_ts);
+ nstime_set_unset(&prev_dis_ts);
+ nstime_set_unset(&prev_cap_ts);
+
+ cf->state = FILE_READ_IN_PROGRESS;
+
+ return CF_OK;
+
+fail:
+ g_snprintf(err_msg, sizeof err_msg,
+ cf_open_error_message(*err, err_info, FALSE, cf->cd_t), fname);
+ cmdarg_err("%s", err_msg);
+ return CF_ERROR;
+}
+
+static void
+show_capture_file_io_error(const char *fname, int err, gboolean is_close)
+{
+ char *save_file_string;
+
+ save_file_string = output_file_description(fname);
+
+ switch (err) {
+
+ case ENOSPC:
+ cmdarg_err("Not all the packets could be written to the %s because there is "
+ "no space left on the file system.",
+ save_file_string);
+ break;
+
+#ifdef EDQUOT
+ case EDQUOT:
+ cmdarg_err("Not all the packets could be written to the %s because you are "
+ "too close to, or over your disk quota.",
+ save_file_string);
+ break;
+#endif
+
+ case WTAP_ERR_CANT_CLOSE:
+ cmdarg_err("The %s couldn't be closed for some unknown reason.",
+ save_file_string);
+ break;
+
+ case WTAP_ERR_SHORT_WRITE:
+ cmdarg_err("Not all the packets could be written to the %s.",
+ save_file_string);
+ break;
+
+ default:
+ if (is_close) {
+ cmdarg_err("The %s could not be closed: %s.", save_file_string,
+ wtap_strerror(err));
+ } else {
+ cmdarg_err("An error occurred while writing to the %s: %s.",
+ save_file_string, wtap_strerror(err));
+ }
+ break;
+ }
+ g_free(save_file_string);
+}
+
static void
show_print_file_io_error(int err)
{
fprintf(stderr, "\n");
}
-cf_status_t
-cf_open(capture_file *cf, const char *fname, gboolean is_tempfile, int *err)
-{
- wtap *wth;
- gchar *err_info;
- char err_msg[2048+1];
-
- wth = wtap_open_offline(fname, err, &err_info, FALSE);
- if (wth == NULL)
- goto fail;
-
- /* The open succeeded. Fill in the information for this file. */
-
- /* Initialize all data structures used for dissection. */
- init_dissection();
-
- cf->wth = wth;
- cf->f_datalen = 0; /* not used, but set it anyway */
-
- /* Set the file name because we need it to set the follow stream filter.
- XXX - is that still true? We need it for other reasons, though,
- in any case. */
- cf->filename = g_strdup(fname);
-
- /* Indicate whether it's a permanent or temporary file. */
- cf->is_tempfile = is_tempfile;
-
- /* If it's a temporary capture buffer file, mark it as not saved. */
- cf->user_saved = !is_tempfile;
-
- cf->cd_t = wtap_file_type(cf->wth);
- cf->count = 0;
- cf->drops_known = FALSE;
- cf->drops = 0;
- cf->snap = wtap_snapshot_length(cf->wth);
- if (cf->snap == 0) {
- /* Snapshot length not known. */
- cf->has_snap = FALSE;
- cf->snap = WTAP_MAX_PACKET_SIZE;
- } else
- cf->has_snap = TRUE;
- nstime_set_zero(&cf->elapsed_time);
- nstime_set_unset(&first_ts);
- nstime_set_unset(&prev_dis_ts);
- nstime_set_unset(&prev_cap_ts);
-
- return CF_OK;
-
-fail:
- g_snprintf(err_msg, sizeof err_msg,
- cf_open_error_message(*err, err_info, FALSE, cf->cd_t), fname);
- cmdarg_err("%s", err_msg);
- return CF_ERROR;
-}
-
/*
* General errors are reported with an console message in TShark.
filename, strerror(err));
}
+/*
+ * Write errors are reported with an console message in TShark.
+ */
+static void
+write_failure_message(const char *filename, int err)
+{
+ cmdarg_err("An error occurred while writing to the file \"%s\": %s.",
+ filename, strerror(err));
+}
+
+/*
+ * Print to the standard error. This is a command-line tool, so there's
+ * no need to pop up a console.
+ */
+void
+vfprintf_stderr(const char *fmt, va_list ap)
+{
+ vfprintf(stderr, fmt, ap);
+}
+
+void
+fprintf_stderr(const char *fmt, ...)
+{
+ va_list ap;
+
+ va_start(ap, fmt);
+ vfprintf_stderr(fmt, ap);
+ va_end(ap);
+}
+
/*
* Report an error in command-line arguments.
*/
va_list ap;
va_start(ap, fmt);
- fprintf(stderr, "tshark: ");
- vfprintf(stderr, fmt, ap);
- fprintf(stderr, "\n");
+ failure_message(fmt, ap);
va_end(ap);
}
fprintf(stderr, "\n");
va_end(ap);
}
-
-
git.samba.org / obnox / wireshark / wip.git / blobdiff