From Xiao Xiangquan:

[obnox/wireshark/wip.git] / dumpcap.c
diff --git a/dumpcap.c b/dumpcap.c

index 40c27cec48de642eba66c3c2f6f561d8e773be1d..21e342c1ffb33067d5881ea7c431eefb2404bcf7 100644 (file)
--- a/dumpcap.c
+++ b/dumpcap.c
@@ -59,9 +59,7 @@
  #include <signal.h>
  #include <errno.h>
  
  #include <signal.h>
  #include <errno.h>
  
-#ifdef HAVE_GETOPT_H
-#include <getopt.h>
-#else
+#ifndef HAVE_GETOPT
  #include "wsutil/wsgetopt.h"
  #endif
  
  #include "wsutil/wsgetopt.h"
  #endif
  
@@ -81,11 +79,13 @@
  #include "version_info.h"
  
  #include "capture-pcap-util.h"
  #include "version_info.h"
  
  #include "capture-pcap-util.h"
+#ifdef _WIN32
+#include "capture-wpcap.h"
+#endif /* _WIN32 */
  
  #include "pcapio.h"
  
  #ifdef _WIN32
  
  #include "pcapio.h"
  
  #ifdef _WIN32
-#include <shellapi.h>
  #include "capture-wpcap.h"
  #include <wsutil/unicode-utils.h>
  #endif
  #include "capture-wpcap.h"
  #include <wsutil/unicode-utils.h>
  #endif
@@ -135,11 +135,11 @@ FILE *debug_log;   /* for logging debug messages to  */
                     /*  is defined                    */
  #endif
  
                     /*  is defined                    */
  #endif
  
-#ifdef _WIN32
-#define USE_THREADS
-#endif
-
  static GAsyncQueue *pcap_queue;
  static GAsyncQueue *pcap_queue;
+static gint64 pcap_queue_bytes;
+static gint64 pcap_queue_packets;
+static gint64 pcap_queue_byte_limit = 1024 * 1024;
+static gint64 pcap_queue_packet_limit = 1000;
  
  static gboolean capture_child = FALSE; /* FALSE: standalone call, TRUE: this is an Wireshark capture child */
  #ifdef _WIN32
  
  static gboolean capture_child = FALSE; /* FALSE: standalone call, TRUE: this is an Wireshark capture child */
  #ifdef _WIN32
@@ -215,13 +215,9 @@ typedef enum {
      INITFILTER_OTHER_ERROR
  } initfilter_status_t;
  
      INITFILTER_OTHER_ERROR
  } initfilter_status_t;
  
-typedef struct _pcap_queue_element {
-    guint              interface_id;
-    struct pcap_pkthdr phdr;
-    u_char             *pd;
-} pcap_queue_element;
-
  typedef struct _pcap_options {
  typedef struct _pcap_options {
+    guint32        received;
+    guint32        dropped;
      pcap_t         *pcap_h;
  #ifdef MUST_DO_SELECT
      int            pcap_fd;               /* pcap file descriptor */
      pcap_t         *pcap_h;
  #ifdef MUST_DO_SELECT
      int            pcap_fd;               /* pcap file descriptor */
@@ -242,9 +238,9 @@ typedef struct _pcap_options {
  #endif
      gboolean       cap_pipe_modified;     /* TRUE if data in the pipe uses modified pcap headers */
      gboolean       cap_pipe_byte_swapped; /* TRUE if data in the pipe is byte swapped */
  #endif
      gboolean       cap_pipe_modified;     /* TRUE if data in the pipe uses modified pcap headers */
      gboolean       cap_pipe_byte_swapped; /* TRUE if data in the pipe is byte swapped */
-#ifdef USE_THREADS
+#if defined(_WIN32)
      char *         cap_pipe_buf;          /* Pointer to the data buffer we read into */
      char *         cap_pipe_buf;          /* Pointer to the data buffer we read into */
-#endif /* USE_THREADS */
+#endif
      int            cap_pipe_bytes_to_read;/* Used by cap_pipe_dispatch */
      int            cap_pipe_bytes_read;   /* Used by cap_pipe_dispatch */
      enum {
      int            cap_pipe_bytes_to_read;/* Used by cap_pipe_dispatch */
      int            cap_pipe_bytes_read;   /* Used by cap_pipe_dispatch */
      enum {
@@ -254,7 +250,7 @@ typedef struct _pcap_options {
          STATE_READ_DATA
      } cap_pipe_state;
      enum { PIPOK, PIPEOF, PIPERR, PIPNEXIST } cap_pipe_err;
          STATE_READ_DATA
      } cap_pipe_state;
      enum { PIPOK, PIPEOF, PIPERR, PIPNEXIST } cap_pipe_err;
-#ifdef USE_THREADS
+#if defined(_WIN32)
      GMutex *cap_pipe_read_mtx;
      GAsyncQueue *cap_pipe_pending_q, *cap_pipe_done_q;
  #endif
      GMutex *cap_pipe_read_mtx;
      GAsyncQueue *cap_pipe_pending_q, *cap_pipe_done_q;
  #endif
@@ -278,6 +274,12 @@ typedef struct _loop_data {
      guint32        autostop_files;
  } loop_data;
  
      guint32        autostop_files;
  } loop_data;
  
+typedef struct _pcap_queue_element {
+    pcap_options       *pcap_opts;
+    struct pcap_pkthdr phdr;
+    u_char             *pd;
+} pcap_queue_element;
+
  /*
   * Standard secondary message for unexpected errors.
   */
  /*
   * Standard secondary message for unexpected errors.
   */
@@ -319,12 +321,11 @@ static gboolean need_timeout_workaround;
   * WaitForSingleObject. If it's less than 1000 WaitForSingleObject
   * will return immediately.
   */
   * WaitForSingleObject. If it's less than 1000 WaitForSingleObject
   * will return immediately.
   */
-#ifndef USE_THREADS
-#define PIPE_READ_TIMEOUT   250000
-#else
+#if defined(_WIN32)
  #define PIPE_READ_TIMEOUT   100000
  #define PIPE_READ_TIMEOUT   100000
+#else
+#define PIPE_READ_TIMEOUT   250000
  #endif
  #endif
-static const char *cap_pipe_err_str;
  
  #define WRITER_THREAD_TIMEOUT 100000 /* usecs */
  
  
  #define WRITER_THREAD_TIMEOUT 100000 /* usecs */
  
@@ -337,9 +338,9 @@ static capture_options global_capture_opts;
  static gboolean quiet = FALSE;
  static gboolean use_threads = FALSE;
  
  static gboolean quiet = FALSE;
  static gboolean use_threads = FALSE;
  
-static void capture_loop_write_packet_cb(u_char *user, const struct pcap_pkthdr *phdr,
+static void capture_loop_write_packet_cb(u_char *pcap_opts_p, const struct pcap_pkthdr *phdr,
                                           const u_char *pd);
                                           const u_char *pd);
-static void capture_loop_queue_packet_cb(u_char *user, const struct pcap_pkthdr *phdr,
+static void capture_loop_queue_packet_cb(u_char *pcap_opts_p, const struct pcap_pkthdr *phdr,
                                           const u_char *pd);
  static void capture_loop_get_errmsg(char *errmsg, int errmsglen, const char *fname,
                                      int err, gboolean is_close);
                                           const u_char *pd);
  static void capture_loop_get_errmsg(char *errmsg, int errmsglen, const char *fname,
                                      int err, gboolean is_close);
@@ -350,7 +351,7 @@ static void report_new_capture_file(const char *filename);
  static void report_packet_count(int packet_count);
  static void report_packet_drops(guint32 received, guint32 drops, gchar *name);
  static void report_capture_error(const char *error_msg, const char *secondary_error_msg);
  static void report_packet_count(int packet_count);
  static void report_packet_drops(guint32 received, guint32 drops, gchar *name);
  static void report_capture_error(const char *error_msg, const char *secondary_error_msg);
-static void report_cfilter_error(const char *cfilter, const char *errmsg);
+static void report_cfilter_error(capture_options *capture_opts, guint i, const char *errmsg);
  
  #define MSG_MAX_LENGTH 4096
  
  
  #define MSG_MAX_LENGTH 4096
  
@@ -363,7 +364,7 @@ print_usage(gboolean print_ver)
          output = stdout;
          fprintf(output,
                  "Dumpcap " VERSION "%s\n"
          output = stdout;
          fprintf(output,
                  "Dumpcap " VERSION "%s\n"
-                "Capture network packets and dump them into a libpcap file.\n"
+                "Capture network packets and dump them into a pcapng file.\n"
                  "See http://www.wireshark.org for more information.\n",
                  wireshark_svnversion);
      } else {
                  "See http://www.wireshark.org for more information.\n",
                  wireshark_svnversion);
      } else {
@@ -388,11 +389,11 @@ print_usage(gboolean print_ver)
  #ifdef HAVE_BPF_IMAGE
      fprintf(output, "  -d                       print generated BPF code for capture filter\n");
  #endif
  #ifdef HAVE_BPF_IMAGE
      fprintf(output, "  -d                       print generated BPF code for capture filter\n");
  #endif
-    fprintf(output, "  -S                       print statistics for each interface once every second\n");
+    fprintf(output, "  -S                       print statistics for each interface once per second\n");
      fprintf(output, "  -M                       for -D, -L, and -S, produce machine-readable output\n");
      fprintf(output, "\n");
  #ifdef HAVE_PCAP_REMOTE
      fprintf(output, "  -M                       for -D, -L, and -S, produce machine-readable output\n");
      fprintf(output, "\n");
  #ifdef HAVE_PCAP_REMOTE
-    fprintf(output, "\nRPCAP options:\n");
+    fprintf(output, "RPCAP options:\n");
      fprintf(output, "  -r                       don't ignore own RPCAP traffic in capture\n");
      fprintf(output, "  -u                       use UDP for RPCAP data transfer\n");
      fprintf(output, "  -A <user>:<password>     use RPCAP password authentication\n");
      fprintf(output, "  -r                       don't ignore own RPCAP traffic in capture\n");
      fprintf(output, "  -u                       use UDP for RPCAP data transfer\n");
      fprintf(output, "  -A <user>:<password>     use RPCAP password authentication\n");
@@ -414,16 +415,17 @@ print_usage(gboolean print_ver)
      fprintf(output, "  -b <ringbuffer opt.> ... duration:NUM - switch to next file after NUM secs\n");
      fprintf(output, "                           filesize:NUM - switch to next file after NUM KB\n");
      fprintf(output, "                              files:NUM - ringbuffer: replace after NUM files\n");
      fprintf(output, "  -b <ringbuffer opt.> ... duration:NUM - switch to next file after NUM secs\n");
      fprintf(output, "                           filesize:NUM - switch to next file after NUM KB\n");
      fprintf(output, "                              files:NUM - ringbuffer: replace after NUM files\n");
-    fprintf(output, "  -n                       use pcapng format instead of pcap\n");
-    /*fprintf(output, "\n");*/
+    fprintf(output, "  -n                       use pcapng format instead of pcap (default)\n");
+    fprintf(output, "  -P                       use libpcap format instead of pcapng\n");
+    fprintf(output, "\n");
      fprintf(output, "Miscellaneous:\n");
      fprintf(output, "  -t                       use a separate thread per interface\n");
      fprintf(output, "  -q                       don't report packet capture counts\n");
      fprintf(output, "  -v                       print version information and exit\n");
      fprintf(output, "  -h                       display this help and exit\n");
      fprintf(output, "\n");
      fprintf(output, "Miscellaneous:\n");
      fprintf(output, "  -t                       use a separate thread per interface\n");
      fprintf(output, "  -q                       don't report packet capture counts\n");
      fprintf(output, "  -v                       print version information and exit\n");
      fprintf(output, "  -h                       display this help and exit\n");
      fprintf(output, "\n");
-    fprintf(output, "Example: dumpcap -i eth0 -a duration:60 -w output.pcap\n");
-    fprintf(output, "\"Capture network packets from interface eth0 until 60s passed into output.pcap\"\n");
+    fprintf(output, "Example: dumpcap -i eth0 -a duration:60 -w output.pcapng\n");
+    fprintf(output, "\"Capture network packets from interface eth0 until 60s passed into output.pcapng\"\n");
      fprintf(output, "\n");
      fprintf(output, "Use Ctrl-C to stop capturing at any time.\n");
  }
      fprintf(output, "\n");
      fprintf(output, "Use Ctrl-C to stop capturing at any time.\n");
  }
@@ -535,7 +537,7 @@ relinquish_all_capabilities(void)
      cap_t caps = cap_init();    /* all capabilities initialized to off */
      print_caps("Pre-clear");
      if (cap_set_proc(caps)) {
      cap_t caps = cap_init();    /* all capabilities initialized to off */
      print_caps("Pre-clear");
      if (cap_set_proc(caps)) {
-        cmdarg_err("cap_set_proc() fail return: %s", strerror(errno));
+        cmdarg_err("cap_set_proc() fail return: %s", g_strerror(errno));
      }
      print_caps("Post-clear");
      cap_free(caps);
      }
      print_caps("Post-clear");
      cap_free(caps);
@@ -558,6 +560,7 @@ open_capture_device(interface_options *interface_opts,
         Some versions of libpcap may put warnings into the error buffer
         if they succeed; to tell if that's happened, we have to clear
         the error buffer, and check if it's still a null string.  */
         Some versions of libpcap may put warnings into the error buffer
         if they succeed; to tell if that's happened, we have to clear
         the error buffer, and check if it's still a null string.  */
+    g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "Entering open_capture_device().");
      (*open_err_str)[0] = '\0';
  #if defined(HAVE_PCAP_OPEN) && defined(HAVE_PCAP_REMOTE)
      /*
      (*open_err_str)[0] = '\0';
  #if defined(HAVE_PCAP_OPEN) && defined(HAVE_PCAP_REMOTE)
      /*
@@ -570,12 +573,18 @@ open_capture_device(interface_options *interface_opts,
          auth.username = interface_opts->auth_username;
          auth.password = interface_opts->auth_password;
  
          auth.username = interface_opts->auth_username;
          auth.password = interface_opts->auth_password;
  
+        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+              "Calling pcap_open() using name %s, snaplen %d, promisc_mode %d, datatx_udp %d, nocap_rpcap %d.",
+              interface_opts->name, interface_opts->snaplen, interface_opts->promisc_mode,
+              interface_opts->datatx_udp, interface_opts->nocap_rpcap);
          pcap_h = pcap_open(interface_opts->name, interface_opts->snaplen,
                             /* flags */
                             (interface_opts->promisc_mode ? PCAP_OPENFLAG_PROMISCUOUS : 0) |
                             (interface_opts->datatx_udp ? PCAP_OPENFLAG_DATATX_UDP : 0) |
                             (interface_opts->nocap_rpcap ? PCAP_OPENFLAG_NOCAPTURE_RPCAP : 0),
                             CAP_READ_TIMEOUT, &auth, *open_err_str);
          pcap_h = pcap_open(interface_opts->name, interface_opts->snaplen,
                             /* flags */
                             (interface_opts->promisc_mode ? PCAP_OPENFLAG_PROMISCUOUS : 0) |
                             (interface_opts->datatx_udp ? PCAP_OPENFLAG_DATATX_UDP : 0) |
                             (interface_opts->nocap_rpcap ? PCAP_OPENFLAG_NOCAPTURE_RPCAP : 0),
                             CAP_READ_TIMEOUT, &auth, *open_err_str);
+        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+              "pcap_open() returned %p.", (void *)pcap_h);
      } else
  #endif
      {
      } else
  #endif
      {
@@ -585,18 +594,32 @@ open_capture_device(interface_options *interface_opts,
           * size, otherwise use pcap_open_live().
           */
  #ifdef HAVE_PCAP_CREATE
           * size, otherwise use pcap_open_live().
           */
  #ifdef HAVE_PCAP_CREATE
+        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+              "Calling pcap_create() using %s.", interface_opts->name);
          pcap_h = pcap_create(interface_opts->name, *open_err_str);
          pcap_h = pcap_create(interface_opts->name, *open_err_str);
+        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+              "pcap_create() returned %p.", (void *)pcap_h);
          if (pcap_h != NULL) {
          if (pcap_h != NULL) {
+            g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+                  "Calling pcap_set_snaplen() with snaplen %d.", interface_opts->snaplen);
              pcap_set_snaplen(pcap_h, interface_opts->snaplen);
              pcap_set_snaplen(pcap_h, interface_opts->snaplen);
+            g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+                  "Calling pcap_set_snaplen() with promisc_mode %d.", interface_opts->promisc_mode);
              pcap_set_promisc(pcap_h, interface_opts->promisc_mode);
              pcap_set_timeout(pcap_h, CAP_READ_TIMEOUT);
  
              pcap_set_promisc(pcap_h, interface_opts->promisc_mode);
              pcap_set_timeout(pcap_h, CAP_READ_TIMEOUT);
  
+            g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+                  "buffersize %d.", interface_opts->buffer_size);
              if (interface_opts->buffer_size > 1) {
                  pcap_set_buffer_size(pcap_h, interface_opts->buffer_size * 1024 * 1024);
              }
              if (interface_opts->buffer_size > 1) {
                  pcap_set_buffer_size(pcap_h, interface_opts->buffer_size * 1024 * 1024);
              }
+            g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+                  "monitor_mode %d.", interface_opts->monitor_mode);
              if (interface_opts->monitor_mode)
                  pcap_set_rfmon(pcap_h, 1);
              err = pcap_activate(pcap_h);
              if (interface_opts->monitor_mode)
                  pcap_set_rfmon(pcap_h, 1);
              err = pcap_activate(pcap_h);
+            g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+                  "pcap_activate() returned %d.", err);
              if (err < 0) {
                  /* Failed to activate, set to NULL */
                  if (err == PCAP_ERROR)
              if (err < 0) {
                  /* Failed to activate, set to NULL */
                  if (err == PCAP_ERROR)
@@ -608,23 +631,17 @@ open_capture_device(interface_options *interface_opts,
              }
          }
  #else
              }
          }
  #else
+        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+              "pcap_open_live() calling using name %s, snaplen %d, promisc_mode %d.",
+              interface_opts->name, interface_opts->snaplen, interface_opts->promisc_mode);
          pcap_h = pcap_open_live(interface_opts->name, interface_opts->snaplen,
                                  interface_opts->promisc_mode, CAP_READ_TIMEOUT,
                                  *open_err_str);
          pcap_h = pcap_open_live(interface_opts->name, interface_opts->snaplen,
                                  interface_opts->promisc_mode, CAP_READ_TIMEOUT,
                                  *open_err_str);
+        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+              "pcap_open_live() returned %p.", (void *)pcap_h);
  #endif
      }
  #endif
      }
-
-    /* If not using libcap: we now can now set euid/egid to ruid/rgid         */
-    /*  to remove any suid privileges.                                        */
-    /* If using libcap: we can now remove NET_RAW and NET_ADMIN capabilities  */
-    /*  (euid/egid have already previously been set to ruid/rgid.             */
-    /* (See comment in main() for details)                                    */
-#ifndef HAVE_LIBCAP
-    relinquish_special_privs_perm();
-#else
-    relinquish_all_capabilities();
-#endif
-
+    g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "open_capture_device %s : %s", pcap_h ? "SUCCESS" : "FAILURE", interface_opts->name);
      return pcap_h;
  }
  
      return pcap_h;
  }
  
@@ -663,21 +680,40 @@ get_capture_device_open_failure_messages(const char *open_err_str,
          libpcap_warn = "";
      g_snprintf(errmsg, (gulong) errmsg_len,
                 "The capture session could not be initiated (%s).", open_err_str);
          libpcap_warn = "";
      g_snprintf(errmsg, (gulong) errmsg_len,
                 "The capture session could not be initiated (%s).", open_err_str);
-#ifndef _WIN32
+#ifdef _WIN32
+    if (!has_wpcap) {
+      g_snprintf(secondary_errmsg, (gulong) secondary_errmsg_len,
+                 "\n"
+                 "In order to capture packets, WinPcap must be installed; see\n"
+                 "\n"
+                 "        http://www.winpcap.org/\n"
+                 "\n"
+                 "or the mirror at\n"
+                 "\n"
+                 "        http://www.mirrors.wiretapped.net/security/packet-capture/winpcap/\n"
+                 "\n"
+                 "or the mirror at\n"
+                 "\n"
+                 "        http://winpcap.cs.pu.edu.tw/\n"
+                 "\n"
+                 "for a downloadable version of WinPcap and for instructions on how to install\n"
+                 "WinPcap.");
+    } else {
+      g_snprintf(secondary_errmsg, (gulong) secondary_errmsg_len,
+                 "\n"
+                 "Please check that \"%s\" is the proper interface.\n"
+                 "\n"
+                 "\n"
+                 "Help can be found at:\n"
+                 "\n"
+                 "       http://wiki.wireshark.org/WinPcap\n"
+                 "       http://wiki.wireshark.org/CaptureSetup\n",
+                 iface);
+    }
+#else
      g_snprintf(secondary_errmsg, (gulong) secondary_errmsg_len,
                 "Please check to make sure you have sufficient permissions, and that you have "
                 "the proper interface or pipe specified.%s", libpcap_warn);
      g_snprintf(secondary_errmsg, (gulong) secondary_errmsg_len,
                 "Please check to make sure you have sufficient permissions, and that you have "
                 "the proper interface or pipe specified.%s", libpcap_warn);
-#else
-    g_snprintf(secondary_errmsg, (gulong) secondary_errmsg_len,
-               "\n"
-               "Please check that \"%s\" is the proper interface.\n"
-               "\n"
-               "\n"
-               "Help can be found at:\n"
-               "\n"
-               "       http://wiki.wireshark.org/WinPcap\n"
-               "       http://wiki.wireshark.org/CaptureSetup\n",
-               iface);
  #endif /* _WIN32 */
  }
  
  #endif /* _WIN32 */
  }
  
@@ -722,7 +758,7 @@ set_pcap_linktype(pcap_t *pcap_h, int linktype,
  
  static gboolean
  compile_capture_filter(const char *iface, pcap_t *pcap_h,
  
  static gboolean
  compile_capture_filter(const char *iface, pcap_t *pcap_h,
-                       struct bpf_program *fcode, char *cfilter)
+                       struct bpf_program *fcode, const char *cfilter)
  {
      bpf_u_int32 netnum, netmask;
      gchar       lookup_net_err_str[PCAP_ERRBUF_SIZE];
  {
      bpf_u_int32 netnum, netmask;
      gchar       lookup_net_err_str[PCAP_ERRBUF_SIZE];
@@ -741,7 +777,13 @@ compile_capture_filter(const char *iface, pcap_t *pcap_h,
            "Warning:  Couldn't obtain netmask info (%s).", lookup_net_err_str);*/
          netmask = 0;
      }
            "Warning:  Couldn't obtain netmask info (%s).", lookup_net_err_str);*/
          netmask = 0;
      }
-    if (pcap_compile(pcap_h, fcode, cfilter, 1, netmask) < 0)
+
+    /*
+     * Sigh.  Older versions of libpcap don't properly declare the
+     * third argument to pcap_compile() as a const pointer.  Cast
+     * away the warning.
+     */
+    if (pcap_compile(pcap_h, fcode, (char *)cfilter, 1, netmask) < 0)
          return FALSE;
      return TRUE;
  }
          return FALSE;
      return TRUE;
  }
@@ -788,7 +830,7 @@ show_filter_code(capture_options *capture_opts)
          if (!compile_capture_filter(interface_opts.name, pcap_h, &fcode,
                                      interface_opts.cfilter)) {
              pcap_close(pcap_h);
          if (!compile_capture_filter(interface_opts.name, pcap_h, &fcode,
                                      interface_opts.cfilter)) {
              pcap_close(pcap_h);
-            report_cfilter_error(interface_opts.cfilter, errmsg);
+            report_cfilter_error(capture_opts, j, errmsg);
              return FALSE;
          }
          pcap_close(pcap_h);
              return FALSE;
          }
          pcap_close(pcap_h);
@@ -799,6 +841,16 @@ show_filter_code(capture_options *capture_opts)
          for (i = 0; i < fcode.bf_len; insn++, i++)
              printf("%s\n", bpf_image(insn, i));
      }
          for (i = 0; i < fcode.bf_len; insn++, i++)
              printf("%s\n", bpf_image(insn, i));
      }
+    /* If not using libcap: we now can now set euid/egid to ruid/rgid         */
+    /*  to remove any suid privileges.                                        */
+    /* If using libcap: we can now remove NET_RAW and NET_ADMIN capabilities  */
+    /*  (euid/egid have already previously been set to ruid/rgid.             */
+    /* (See comment in main() for details)                                    */
+#ifndef HAVE_LIBCAP
+    relinquish_special_privs_perm();
+#else
+    relinquish_all_capabilities();
+#endif
      if (capture_child) {
          /* Let our parent know we succeeded. */
          pipe_write_block(2, SP_SUCCESS, NULL);
      if (capture_child) {
          /* Let our parent know we succeeded. */
          pipe_write_block(2, SP_SUCCESS, NULL);
@@ -1250,6 +1302,7 @@ print_statistics_loop(gboolean machine_readable)
      if (if_list == NULL) {
          switch (err) {
          case CANT_GET_INTERFACE_LIST:
      if (if_list == NULL) {
          switch (err) {
          case CANT_GET_INTERFACE_LIST:
+        case DONT_HAVE_PCAP:
              cmdarg_err("%s", err_str);
              g_free(err_str);
              break;
              cmdarg_err("%s", err_str);
              g_free(err_str);
              break;
@@ -1379,17 +1432,13 @@ capture_cleanup_handler(int signum _U_)
  
  
  static void
  
  
  static void
-report_capture_count(void)
+report_capture_count(gboolean reportit)
  {
      /* Don't print this if we're a capture child. */
  {
      /* Don't print this if we're a capture child. */
-    if (!capture_child) {
-        if (quiet) {
-            /* Report the count only if we aren't printing a packet count
-               as packets arrive. */
-            fprintf(stderr, "Packets captured: %u\n", global_ld.packet_count);
-            /* stderr could be line buffered */
-            fflush(stderr);
-        }
+    if (!capture_child && reportit) {
+        fprintf(stderr, "\rPackets captured: %u\n", global_ld.packet_count);
+        /* stderr could be line buffered */
+        fflush(stderr);
      }
  }
  
      }
  }
  
@@ -1398,7 +1447,7 @@ report_capture_count(void)
  static void
  report_counts_for_siginfo(void)
  {
  static void
  report_counts_for_siginfo(void)
  {
-    report_capture_count();
+    report_capture_count(quiet);
      infoprint = FALSE; /* we just reported it */
  }
  
      infoprint = FALSE; /* we just reported it */
  }
  
@@ -1463,14 +1512,14 @@ relinquish_privs_except_capture(void)
          print_caps("Pre drop, pre set");
  
          if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) == -1) {
          print_caps("Pre drop, pre set");
  
          if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) == -1) {
-            cmdarg_err("prctl() fail return: %s", strerror(errno));
+            cmdarg_err("prctl() fail return: %s", g_strerror(errno));
          }
  
          cap_set_flag(caps, CAP_PERMITTED,   cl_len, cap_list, CAP_SET);
          cap_set_flag(caps, CAP_INHERITABLE, cl_len, cap_list, CAP_SET);
  
          if (cap_set_proc(caps)) {
          }
  
          cap_set_flag(caps, CAP_PERMITTED,   cl_len, cap_list, CAP_SET);
          cap_set_flag(caps, CAP_INHERITABLE, cl_len, cap_list, CAP_SET);
  
          if (cap_set_proc(caps)) {
-            cmdarg_err("cap_set_proc() fail return: %s", strerror(errno));
+            cmdarg_err("cap_set_proc() fail return: %s", g_strerror(errno));
          }
          print_caps("Pre drop, post set");
  
          }
          print_caps("Pre drop, post set");
  
@@ -1479,7 +1528,7 @@ relinquish_privs_except_capture(void)
          print_caps("Post drop, pre set");
          cap_set_flag(caps, CAP_EFFECTIVE,   cl_len, cap_list, CAP_SET);
          if (cap_set_proc(caps)) {
          print_caps("Post drop, pre set");
          cap_set_flag(caps, CAP_EFFECTIVE,   cl_len, cap_list, CAP_SET);
          if (cap_set_proc(caps)) {
-            cmdarg_err("cap_set_proc() fail return: %s", strerror(errno));
+            cmdarg_err("cap_set_proc() fail return: %s", g_strerror(errno));
          }
          print_caps("Post drop, post set");
  
          }
          print_caps("Post drop, post set");
  
@@ -1520,7 +1569,7 @@ cap_pipe_adjust_header(gboolean byte_swapped, struct pcap_hdr *hdr, struct pcapr
      }
  }
  
      }
  }
  
-#ifdef USE_THREADS
+#if defined(_WIN32)
  /*
   * Thread function that reads from a pipe and pushes the data
   * to the main application thread.
  /*
   * Thread function that reads from a pipe and pushes the data
   * to the main application thread.
@@ -1539,7 +1588,7 @@ cap_pipe_adjust_header(gboolean byte_swapped, struct pcap_hdr *hdr, struct pcapr
   */
  static void *cap_pipe_read(void *arg)
  {
   */
  static void *cap_pipe_read(void *arg)
  {
-    pcap_options *pcap_opts = (pcap_options *)arg;
+    pcap_options *pcap_opts;
      int bytes_read;
  #ifdef _WIN32
      BOOL res;
      int bytes_read;
  #ifdef _WIN32
      BOOL res;
@@ -1548,6 +1597,7 @@ static void *cap_pipe_read(void *arg)
      int b;
  #endif /* _WIN32 */
  
      int b;
  #endif /* _WIN32 */
  
+    pcap_opts = (pcap_options *)arg;
      while (pcap_opts->cap_pipe_err == PIPOK) {
          g_async_queue_pop(pcap_opts->cap_pipe_pending_q); /* Wait for our cue (ahem) from the main thread */
          g_mutex_lock(pcap_opts->cap_pipe_read_mtx);
      while (pcap_opts->cap_pipe_err == PIPOK) {
          g_async_queue_pop(pcap_opts->cap_pipe_pending_q); /* Wait for our cue (ahem) from the main thread */
          g_mutex_lock(pcap_opts->cap_pipe_read_mtx);
@@ -1605,22 +1655,19 @@ static void *cap_pipe_read(void *arg)
      }
      return NULL;
  }
      }
      return NULL;
  }
-#endif /* USE_THREADS */
+#endif
  
  
+#if !defined(_WIN32) || defined(MUST_DO_SELECT)
  /* Provide select() functionality for a single file descriptor
   * on UNIX/POSIX. Windows uses cap_pipe_read via a thread.
   *
  /* Provide select() functionality for a single file descriptor
   * on UNIX/POSIX. Windows uses cap_pipe_read via a thread.
   *
- * Returns the same values as select.  If an error is returned,
- * the string cap_pipe_err_str should be used instead of errno.
+ * Returns the same values as select.
   */
  static int
  cap_pipe_select(int pipe_fd)
  {
      fd_set      rfds;
      struct timeval timeout;
   */
  static int
  cap_pipe_select(int pipe_fd)
  {
      fd_set      rfds;
      struct timeval timeout;
-    int sel_ret;
-
-    cap_pipe_err_str = "Unknown error";
  
      FD_ZERO(&rfds);
      FD_SET(pipe_fd, &rfds);
  
      FD_ZERO(&rfds);
      FD_SET(pipe_fd, &rfds);
@@ -1628,11 +1675,9 @@ cap_pipe_select(int pipe_fd)
      timeout.tv_sec = PIPE_READ_TIMEOUT / 1000000;
      timeout.tv_usec = PIPE_READ_TIMEOUT % 1000000;
  
      timeout.tv_sec = PIPE_READ_TIMEOUT / 1000000;
      timeout.tv_usec = PIPE_READ_TIMEOUT % 1000000;
  
-    sel_ret = select(pipe_fd+1, &rfds, NULL, NULL, &timeout);
-    if (sel_ret < 0)
-        cap_pipe_err_str = strerror(errno);
-    return sel_ret;
+    return select(pipe_fd+1, &rfds, NULL, NULL, &timeout);
  }
  }
+#endif
  
  
  /* Mimic pcap_open_live() for pipe captures
  
  
  /* Mimic pcap_open_live() for pipe captures
@@ -1659,7 +1704,7 @@ cap_pipe_open_live(char *pipename,
      wchar_t *err_str;
  #endif
  #endif
      wchar_t *err_str;
  #endif
  #endif
-#ifndef USE_THREADS
+#ifndef _WIN32
      int          sel_ret;
      unsigned int bytes_read;
  #endif
      int          sel_ret;
      unsigned int bytes_read;
  #endif
@@ -1690,7 +1735,7 @@ cap_pipe_open_live(char *pipename,
              else {
                  g_snprintf(errmsg, errmsgl,
                             "The capture session could not be initiated "
              else {
                  g_snprintf(errmsg, errmsgl,
                             "The capture session could not be initiated "
-                           "due to error getting information on pipe/socket: %s", strerror(errno));
+                           "due to error getting information on pipe/socket: %s", g_strerror(errno));
                  pcap_opts->cap_pipe_err = PIPERR;
              }
              return;
                  pcap_opts->cap_pipe_err = PIPERR;
              }
              return;
@@ -1700,7 +1745,7 @@ cap_pipe_open_live(char *pipename,
              if (fd == -1) {
                  g_snprintf(errmsg, errmsgl,
                             "The capture session could not be initiated "
              if (fd == -1) {
                  g_snprintf(errmsg, errmsgl,
                             "The capture session could not be initiated "
-                           "due to error on pipe open: %s", strerror(errno));
+                           "due to error on pipe open: %s", g_strerror(errno));
                  pcap_opts->cap_pipe_err = PIPERR;
                  return;
              }
                  pcap_opts->cap_pipe_err = PIPERR;
                  return;
              }
@@ -1709,7 +1754,7 @@ cap_pipe_open_live(char *pipename,
              if (fd == -1) {
                  g_snprintf(errmsg, errmsgl,
                             "The capture session could not be initiated "
              if (fd == -1) {
                  g_snprintf(errmsg, errmsgl,
                             "The capture session could not be initiated "
-                           "due to error on socket create: %s", strerror(errno));
+                           "due to error on socket create: %s", g_strerror(errno));
                  pcap_opts->cap_pipe_err = PIPERR;
                  return;
              }
                  pcap_opts->cap_pipe_err = PIPERR;
                  return;
              }
@@ -1749,7 +1794,7 @@ cap_pipe_open_live(char *pipename,
              if (b == -1) {
                  g_snprintf(errmsg, errmsgl,
                             "The capture session coud not be initiated "
              if (b == -1) {
                  g_snprintf(errmsg, errmsgl,
                             "The capture session coud not be initiated "
-                           "due to error on socket connect: %s", strerror(errno));
+                           "due to error on socket connect: %s", g_strerror(errno));
                  pcap_opts->cap_pipe_err = PIPERR;
                  return;
              }
                  pcap_opts->cap_pipe_err = PIPERR;
                  return;
              }
@@ -1828,14 +1873,14 @@ cap_pipe_open_live(char *pipename,
  
      pcap_opts->from_cap_pipe = TRUE;
  
  
      pcap_opts->from_cap_pipe = TRUE;
  
-#ifndef USE_THREADS
+#ifndef _WIN32
      /* read the pcap header */
      bytes_read = 0;
      while (bytes_read < sizeof magic) {
          sel_ret = cap_pipe_select(fd);
          if (sel_ret < 0) {
              g_snprintf(errmsg, errmsgl,
      /* read the pcap header */
      bytes_read = 0;
      while (bytes_read < sizeof magic) {
          sel_ret = cap_pipe_select(fd);
          if (sel_ret < 0) {
              g_snprintf(errmsg, errmsgl,
-                       "Unexpected error from select: %s", strerror(errno));
+                       "Unexpected error from select: %s", g_strerror(errno));
              goto error;
          } else if (sel_ret > 0) {
              b = read(fd, ((char *)&magic)+bytes_read, sizeof magic-bytes_read);
              goto error;
          } else if (sel_ret > 0) {
              b = read(fd, ((char *)&magic)+bytes_read, sizeof magic-bytes_read);
@@ -1844,14 +1889,14 @@ cap_pipe_open_live(char *pipename,
                      g_snprintf(errmsg, errmsgl, "End of file on pipe magic during open");
                  else
                      g_snprintf(errmsg, errmsgl, "Error on pipe magic during open: %s",
                      g_snprintf(errmsg, errmsgl, "End of file on pipe magic during open");
                  else
                      g_snprintf(errmsg, errmsgl, "Error on pipe magic during open: %s",
-                               strerror(errno));
+                               g_strerror(errno));
                  goto error;
              }
              bytes_read += b;
          }
      }
                  goto error;
              }
              bytes_read += b;
          }
      }
-#else /* USE_THREADS */
-    g_thread_create(&cap_pipe_read, &pcap_opts, FALSE, NULL);
+#else
+    g_thread_create(&cap_pipe_read, pcap_opts, FALSE, NULL);
  
      pcap_opts->cap_pipe_buf = (char *) &magic;
      pcap_opts->cap_pipe_bytes_read = 0;
  
      pcap_opts->cap_pipe_buf = (char *) &magic;
      pcap_opts->cap_pipe_bytes_read = 0;
@@ -1864,11 +1909,11 @@ cap_pipe_open_live(char *pipename,
              g_snprintf(errmsg, errmsgl, "End of file on pipe magic during open");
          else
              g_snprintf(errmsg, errmsgl, "Error on pipe magic during open: %s",
              g_snprintf(errmsg, errmsgl, "End of file on pipe magic during open");
          else
              g_snprintf(errmsg, errmsgl, "Error on pipe magic during open: %s",
-                       strerror(errno));
+                       g_strerror(errno));
          goto error;
      }
  
          goto error;
      }
  
-#endif /* USE_THREADS */
+#endif
  
      switch (magic) {
      case PCAP_MAGIC:
  
      switch (magic) {
      case PCAP_MAGIC:
@@ -1903,14 +1948,14 @@ cap_pipe_open_live(char *pipename,
          goto error;
      }
  
          goto error;
      }
  
-#ifndef USE_THREADS
+#ifndef _WIN32
      /* Read the rest of the header */
      bytes_read = 0;
      while (bytes_read < sizeof(struct pcap_hdr)) {
          sel_ret = cap_pipe_select(fd);
          if (sel_ret < 0) {
              g_snprintf(errmsg, errmsgl,
      /* Read the rest of the header */
      bytes_read = 0;
      while (bytes_read < sizeof(struct pcap_hdr)) {
          sel_ret = cap_pipe_select(fd);
          if (sel_ret < 0) {
              g_snprintf(errmsg, errmsgl,
-                       "Unexpected error from select: %s", strerror(errno));
+                       "Unexpected error from select: %s", g_strerror(errno));
              goto error;
          } else if (sel_ret > 0) {
              b = read(fd, ((char *)hdr)+bytes_read,
              goto error;
          } else if (sel_ret > 0) {
              b = read(fd, ((char *)hdr)+bytes_read,
@@ -1920,13 +1965,13 @@ cap_pipe_open_live(char *pipename,
                      g_snprintf(errmsg, errmsgl, "End of file on pipe header during open");
                  else
                      g_snprintf(errmsg, errmsgl, "Error on pipe header during open: %s",
                      g_snprintf(errmsg, errmsgl, "End of file on pipe header during open");
                  else
                      g_snprintf(errmsg, errmsgl, "Error on pipe header during open: %s",
-                               strerror(errno));
+                               g_strerror(errno));
                  goto error;
              }
              bytes_read += b;
          }
      }
                  goto error;
              }
              bytes_read += b;
          }
      }
-#else /* USE_THREADS */
+#else
      pcap_opts->cap_pipe_buf = (char *) hdr;
      pcap_opts->cap_pipe_bytes_read = 0;
      pcap_opts->cap_pipe_bytes_to_read = sizeof(struct pcap_hdr);
      pcap_opts->cap_pipe_buf = (char *) hdr;
      pcap_opts->cap_pipe_bytes_read = 0;
      pcap_opts->cap_pipe_bytes_to_read = sizeof(struct pcap_hdr);
@@ -1937,10 +1982,10 @@ cap_pipe_open_live(char *pipename,
              g_snprintf(errmsg, errmsgl, "End of file on pipe header during open");
          else
              g_snprintf(errmsg, errmsgl, "Error on pipe header header during open: %s",
              g_snprintf(errmsg, errmsgl, "End of file on pipe header during open");
          else
              g_snprintf(errmsg, errmsgl, "Error on pipe header header during open: %s",
-                       strerror(errno));
+                       g_strerror(errno));
          goto error;
      }
          goto error;
      }
-#endif /* USE_THREADS */
+#endif
  
      if (pcap_opts->cap_pipe_byte_swapped) {
          /* Byte-swap the header fields about which we care. */
  
      if (pcap_opts->cap_pipe_byte_swapped) {
          /* Byte-swap the header fields about which we care. */
@@ -1983,7 +2028,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
      struct pcap_pkthdr phdr;
      enum { PD_REC_HDR_READ, PD_DATA_READ, PD_PIPE_EOF, PD_PIPE_ERR,
             PD_ERR } result;
      struct pcap_pkthdr phdr;
      enum { PD_REC_HDR_READ, PD_DATA_READ, PD_PIPE_EOF, PD_PIPE_ERR,
             PD_ERR } result;
-#ifdef USE_THREADS
+#ifdef _WIN32
      GTimeVal wait_time;
      gpointer q_status;
  #else
      GTimeVal wait_time;
      gpointer q_status;
  #else
@@ -2000,7 +2045,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
      switch (pcap_opts->cap_pipe_state) {
  
      case STATE_EXPECT_REC_HDR:
      switch (pcap_opts->cap_pipe_state) {
  
      case STATE_EXPECT_REC_HDR:
-#ifdef USE_THREADS
+#ifdef _WIN32
          if (g_mutex_trylock(pcap_opts->cap_pipe_read_mtx)) {
  #endif
  
          if (g_mutex_trylock(pcap_opts->cap_pipe_read_mtx)) {
  #endif
  
@@ -2009,7 +2054,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
                  sizeof(struct pcaprec_modified_hdr) : sizeof(struct pcaprec_hdr);
              pcap_opts->cap_pipe_bytes_read = 0;
  
                  sizeof(struct pcaprec_modified_hdr) : sizeof(struct pcaprec_hdr);
              pcap_opts->cap_pipe_bytes_read = 0;
  
-#ifdef USE_THREADS
+#ifdef _WIN32
              pcap_opts->cap_pipe_buf = (char *) &pcap_opts->cap_pipe_rechdr;
              g_async_queue_push(pcap_opts->cap_pipe_pending_q, pcap_opts->cap_pipe_buf);
              g_mutex_unlock(pcap_opts->cap_pipe_read_mtx);
              pcap_opts->cap_pipe_buf = (char *) &pcap_opts->cap_pipe_rechdr;
              g_async_queue_push(pcap_opts->cap_pipe_pending_q, pcap_opts->cap_pipe_buf);
              g_mutex_unlock(pcap_opts->cap_pipe_read_mtx);
@@ -2018,7 +2063,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
          /* Fall through */
  
      case STATE_READ_REC_HDR:
          /* Fall through */
  
      case STATE_READ_REC_HDR:
-#ifndef USE_THREADS
+#ifndef _WIN32
          b = read(pcap_opts->cap_pipe_fd, ((char *)&pcap_opts->cap_pipe_rechdr)+pcap_opts->cap_pipe_bytes_read,
                   pcap_opts->cap_pipe_bytes_to_read - pcap_opts->cap_pipe_bytes_read);
          if (b <= 0) {
          b = read(pcap_opts->cap_pipe_fd, ((char *)&pcap_opts->cap_pipe_rechdr)+pcap_opts->cap_pipe_bytes_read,
                   pcap_opts->cap_pipe_bytes_to_read - pcap_opts->cap_pipe_bytes_read);
          if (b <= 0) {
@@ -2029,7 +2074,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
              break;
          }
          pcap_opts->cap_pipe_bytes_read += b;
              break;
          }
          pcap_opts->cap_pipe_bytes_read += b;
-#else /* USE_THREADS */
+#else
          g_get_current_time(&wait_time);
          g_time_val_add(&wait_time, PIPE_READ_TIMEOUT);
          q_status = g_async_queue_timed_pop(pcap_opts->cap_pipe_done_q, &wait_time);
          g_get_current_time(&wait_time);
          g_time_val_add(&wait_time, PIPE_READ_TIMEOUT);
          q_status = g_async_queue_timed_pop(pcap_opts->cap_pipe_done_q, &wait_time);
@@ -2043,14 +2088,14 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
          if (!q_status) {
              return 0;
          }
          if (!q_status) {
              return 0;
          }
-#endif /* USE_THREADS */
+#endif
          if ((pcap_opts->cap_pipe_bytes_read) < pcap_opts->cap_pipe_bytes_to_read)
              return 0;
          result = PD_REC_HDR_READ;
          break;
  
      case STATE_EXPECT_DATA:
          if ((pcap_opts->cap_pipe_bytes_read) < pcap_opts->cap_pipe_bytes_to_read)
              return 0;
          result = PD_REC_HDR_READ;
          break;
  
      case STATE_EXPECT_DATA:
-#ifdef USE_THREADS
+#ifdef _WIN32
          if (g_mutex_trylock(pcap_opts->cap_pipe_read_mtx)) {
  #endif
  
          if (g_mutex_trylock(pcap_opts->cap_pipe_read_mtx)) {
  #endif
  
@@ -2058,7 +2103,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
              pcap_opts->cap_pipe_bytes_to_read = pcap_opts->cap_pipe_rechdr.hdr.incl_len;
              pcap_opts->cap_pipe_bytes_read = 0;
  
              pcap_opts->cap_pipe_bytes_to_read = pcap_opts->cap_pipe_rechdr.hdr.incl_len;
              pcap_opts->cap_pipe_bytes_read = 0;
  
-#ifdef USE_THREADS
+#ifdef _WIN32
              pcap_opts->cap_pipe_buf = (char *) data;
              g_async_queue_push(pcap_opts->cap_pipe_pending_q, pcap_opts->cap_pipe_buf);
              g_mutex_unlock(pcap_opts->cap_pipe_read_mtx);
              pcap_opts->cap_pipe_buf = (char *) data;
              g_async_queue_push(pcap_opts->cap_pipe_pending_q, pcap_opts->cap_pipe_buf);
              g_mutex_unlock(pcap_opts->cap_pipe_read_mtx);
@@ -2067,7 +2112,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
          /* Fall through */
  
      case STATE_READ_DATA:
          /* Fall through */
  
      case STATE_READ_DATA:
-#ifndef USE_THREADS
+#ifndef _WIN32
          b = read(pcap_opts->cap_pipe_fd, data+pcap_opts->cap_pipe_bytes_read,
                   pcap_opts->cap_pipe_bytes_to_read - pcap_opts->cap_pipe_bytes_read);
          if (b <= 0) {
          b = read(pcap_opts->cap_pipe_fd, data+pcap_opts->cap_pipe_bytes_read,
                   pcap_opts->cap_pipe_bytes_to_read - pcap_opts->cap_pipe_bytes_read);
          if (b <= 0) {
@@ -2078,7 +2123,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
              break;
          }
          pcap_opts->cap_pipe_bytes_read += b;
              break;
          }
          pcap_opts->cap_pipe_bytes_read += b;
-#else /* USE_THREADS */
+#else
          g_get_current_time(&wait_time);
          g_time_val_add(&wait_time, PIPE_READ_TIMEOUT);
          q_status = g_async_queue_timed_pop(pcap_opts->cap_pipe_done_q, &wait_time);
          g_get_current_time(&wait_time);
          g_time_val_add(&wait_time, PIPE_READ_TIMEOUT);
          q_status = g_async_queue_timed_pop(pcap_opts->cap_pipe_done_q, &wait_time);
@@ -2092,7 +2137,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
          if (!q_status) {
              return 0;
          }
          if (!q_status) {
              return 0;
          }
-#endif /* USE_THREADS */
+#endif
          if ((pcap_opts->cap_pipe_bytes_read) < pcap_opts->cap_pipe_bytes_to_read)
              return 0;
          result = PD_DATA_READ;
          if ((pcap_opts->cap_pipe_bytes_read) < pcap_opts->cap_pipe_bytes_to_read)
              return 0;
          result = PD_DATA_READ;
@@ -2118,8 +2163,12 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
                         ld->packet_count+1, pcap_opts->cap_pipe_rechdr.hdr.incl_len);
              break;
          }
                         ld->packet_count+1, pcap_opts->cap_pipe_rechdr.hdr.incl_len);
              break;
          }
-        pcap_opts->cap_pipe_state = STATE_EXPECT_DATA;
-        return 0;
+
+        if (pcap_opts->cap_pipe_rechdr.hdr.incl_len) {
+            pcap_opts->cap_pipe_state = STATE_EXPECT_DATA;
+            return 0;
+        }
+        /* no data to read? fall through */
  
      case PD_DATA_READ:
          /* Fill in a "struct pcap_pkthdr", and process the packet. */
  
      case PD_DATA_READ:
          /* Fill in a "struct pcap_pkthdr", and process the packet. */
@@ -2129,9 +2178,9 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
          phdr.len = pcap_opts->cap_pipe_rechdr.hdr.orig_len;
  
          if (use_threads) {
          phdr.len = pcap_opts->cap_pipe_rechdr.hdr.orig_len;
  
          if (use_threads) {
-            capture_loop_queue_packet_cb((u_char *)&pcap_opts->interface_id, &phdr, data);
+            capture_loop_queue_packet_cb((u_char *)pcap_opts, &phdr, data);
          } else {
          } else {
-            capture_loop_write_packet_cb((u_char *)&pcap_opts->interface_id, &phdr, data);
+            capture_loop_write_packet_cb((u_char *)pcap_opts, &phdr, data);
          }
          pcap_opts->cap_pipe_state = STATE_EXPECT_REC_HDR;
          return 1;
          }
          pcap_opts->cap_pipe_state = STATE_EXPECT_REC_HDR;
          return 1;
@@ -2150,7 +2199,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
          LocalFree(err_str);
  #else
          g_snprintf(errmsg, errmsgl, "Error reading from pipe: %s",
          LocalFree(err_str);
  #else
          g_snprintf(errmsg, errmsgl, "Error reading from pipe: %s",
-                   strerror(errno));
+                   g_strerror(errno));
  #endif
          /* Fall through */
      case PD_ERR:
  #endif
          /* Fall through */
      case PD_ERR:
@@ -2173,7 +2222,7 @@ capture_loop_open_input(capture_options *capture_opts, loop_data *ld,
      gchar             open_err_str[PCAP_ERRBUF_SIZE];
      gchar             *sync_msg_str;
      interface_options interface_opts;
      gchar             open_err_str[PCAP_ERRBUF_SIZE];
      gchar             *sync_msg_str;
      interface_options interface_opts;
-    pcap_options      pcap_opts;
+    pcap_options      *pcap_opts;
      guint             i;
  #ifdef _WIN32
      int         err;
      guint             i;
  #ifdef _WIN32
      int         err;
@@ -2232,53 +2281,67 @@ capture_loop_open_input(capture_options *capture_opts, loop_data *ld,
      if ((use_threads == FALSE) &&
          (capture_opts->ifaces->len > 1)) {
          g_snprintf(errmsg, (gulong) errmsg_len,
      if ((use_threads == FALSE) &&
          (capture_opts->ifaces->len > 1)) {
          g_snprintf(errmsg, (gulong) errmsg_len,
-                   "Using threads is required for capturing on mulitple interfaces! Use the -t option.");
+                   "Using threads is required for capturing on mulitple interfaces!");
          return FALSE;
      }
  
      for (i = 0; i < capture_opts->ifaces->len; i++) {
          interface_opts = g_array_index(capture_opts->ifaces, interface_options, i);
          return FALSE;
      }
  
      for (i = 0; i < capture_opts->ifaces->len; i++) {
          interface_opts = g_array_index(capture_opts->ifaces, interface_options, i);
-        pcap_opts.pcap_h = NULL;
+        pcap_opts = (pcap_options *)g_malloc(sizeof (pcap_options));
+        if (pcap_opts == NULL) {
+            g_snprintf(errmsg, (gulong) errmsg_len,
+                   "Could not allocate memory.");
+            return FALSE;
+        }
+        pcap_opts->received = 0;
+        pcap_opts->dropped = 0;
+        pcap_opts->pcap_h = NULL;
  #ifdef MUST_DO_SELECT
  #ifdef MUST_DO_SELECT
-        pcap_opts.pcap_fd = -1;
-#endif
-        pcap_opts.pcap_err = FALSE;
-        pcap_opts.interface_id = i;
-        pcap_opts.tid = NULL;
-        pcap_opts.snaplen = 0;
-        pcap_opts.linktype = -1;
-        pcap_opts.from_cap_pipe = FALSE;
-        memset(&pcap_opts.cap_pipe_hdr, 0, sizeof(struct pcap_hdr));
-        memset(&pcap_opts.cap_pipe_rechdr, 0, sizeof(struct pcaprec_modified_hdr));
+        pcap_opts->pcap_fd = -1;
+#endif
+        pcap_opts->pcap_err = FALSE;
+        pcap_opts->interface_id = i;
+        pcap_opts->tid = NULL;
+        pcap_opts->snaplen = 0;
+        pcap_opts->linktype = -1;
+        pcap_opts->from_cap_pipe = FALSE;
+        memset(&pcap_opts->cap_pipe_hdr, 0, sizeof(struct pcap_hdr));
+        memset(&pcap_opts->cap_pipe_rechdr, 0, sizeof(struct pcaprec_modified_hdr));
+#ifdef _WIN32
+        pcap_opts->cap_pipe_h = INVALID_HANDLE_VALUE;
+#else
+        pcap_opts->cap_pipe_fd = -1;
+#endif
+        pcap_opts->cap_pipe_modified = FALSE;
+        pcap_opts->cap_pipe_byte_swapped = FALSE;
  #ifdef _WIN32
  #ifdef _WIN32
-        pcap_opts.cap_pipe_h = INVALID_HANDLE_VALUE;
+        pcap_opts->cap_pipe_buf = NULL;
+#endif
+        pcap_opts->cap_pipe_bytes_to_read = 0;
+        pcap_opts->cap_pipe_bytes_read = 0;
+        pcap_opts->cap_pipe_state = 0;
+        pcap_opts->cap_pipe_err = PIPOK;
+#ifdef _WIN32
+#if GLIB_CHECK_VERSION(2,31,0)
+        pcap_opts->cap_pipe_read_mtx = g_malloc(sizeof(GMutex));
+        g_mutex_init(pcap_opts->cap_pipe_read_mtx);
  #else
  #else
-        pcap_opts.cap_pipe_fd = -1;
-#endif
-        pcap_opts.cap_pipe_modified = FALSE;
-        pcap_opts.cap_pipe_byte_swapped = FALSE;
-#ifdef USE_THREADS
-        pcap_opts.cap_pipe_buf = NULL;
-#endif /* USE_THREADS */
-        pcap_opts.cap_pipe_bytes_to_read = 0;
-        pcap_opts.cap_pipe_bytes_read = 0;
-        pcap_opts.cap_pipe_state = 0;
-        pcap_opts.cap_pipe_err = PIPOK;
-#ifdef USE_THREADS
-        pcap_opts.cap_pipe_read_mtx = g_mutex_new();
-        pcap_opts.cap_pipe_pending_q = g_async_queue_new();
-        pcap_opts.cap_pipe_done_q = g_async_queue_new();
+        pcap_opts->cap_pipe_read_mtx = g_mutex_new();
  #endif
  #endif
+        pcap_opts->cap_pipe_pending_q = g_async_queue_new();
+        pcap_opts->cap_pipe_done_q = g_async_queue_new();
+#endif
+        g_array_append_val(ld->pcaps, pcap_opts);
  
          g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "capture_loop_open_input : %s", interface_opts.name);
  
          g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "capture_loop_open_input : %s", interface_opts.name);
-        pcap_opts.pcap_h = open_capture_device(&interface_opts, &open_err_str);
+        pcap_opts->pcap_h = open_capture_device(&interface_opts, &open_err_str);
  
  
-        if (pcap_opts.pcap_h != NULL) {
+        if (pcap_opts->pcap_h != NULL) {
              /* we've opened "iface" as a network device */
  #ifdef _WIN32
              /* try to set the capture buffer size */
              if (interface_opts.buffer_size > 1 &&
              /* we've opened "iface" as a network device */
  #ifdef _WIN32
              /* try to set the capture buffer size */
              if (interface_opts.buffer_size > 1 &&
-                pcap_setbuff(pcap_opts.pcap_h, interface_opts.buffer_size * 1024 * 1024) != 0) {
+                pcap_setbuff(pcap_opts->pcap_h, interface_opts.buffer_size * 1024 * 1024) != 0) {
                  sync_secondary_msg_str = g_strdup_printf(
                      "The capture buffer size of %dMB seems to be too high for your machine,\n"
                      "the default of 1MB will be used.\n"
                  sync_secondary_msg_str = g_strdup_printf(
                      "The capture buffer size of %dMB seems to be too high for your machine,\n"
                      "the default of 1MB will be used.\n"
@@ -2295,7 +2358,7 @@ capture_loop_open_input(capture_options *capture_opts, loop_data *ld,
              if (interface_opts.sampling_method != CAPTURE_SAMP_NONE) {
                  struct pcap_samp *samp;
  
              if (interface_opts.sampling_method != CAPTURE_SAMP_NONE) {
                  struct pcap_samp *samp;
  
-                if ((samp = pcap_setsampling(pcap_opts.pcap_h)) != NULL) {
+                if ((samp = pcap_setsampling(pcap_opts->pcap_h)) != NULL) {
                      switch (interface_opts.sampling_method) {
                      case CAPTURE_SAMP_BY_COUNT:
                          samp->method = PCAP_SAMP_1_EVERY_N;
                      switch (interface_opts.sampling_method) {
                      case CAPTURE_SAMP_BY_COUNT:
                          samp->method = PCAP_SAMP_1_EVERY_N;
@@ -2319,29 +2382,27 @@ capture_loop_open_input(capture_options *capture_opts, loop_data *ld,
                      report_capture_error("Couldn't set the capture sampling",
                                           "Cannot get packet sampling data structure");
                  }
                      report_capture_error("Couldn't set the capture sampling",
                                           "Cannot get packet sampling data structure");
                  }
-
              }
  #endif
  
              /* setting the data link type only works on real interfaces */
              }
  #endif
  
              /* setting the data link type only works on real interfaces */
-            if (!set_pcap_linktype(pcap_opts.pcap_h, interface_opts.linktype, interface_opts.name,
+            if (!set_pcap_linktype(pcap_opts->pcap_h, interface_opts.linktype, interface_opts.name,
                                     errmsg, errmsg_len,
                                     secondary_errmsg, secondary_errmsg_len)) {
                                     errmsg, errmsg_len,
                                     secondary_errmsg, secondary_errmsg_len)) {
-                g_array_append_val(ld->pcaps, pcap_opts);
                  return FALSE;
              }
                  return FALSE;
              }
-            pcap_opts.linktype = get_pcap_linktype(pcap_opts.pcap_h, interface_opts.name);
+            pcap_opts->linktype = get_pcap_linktype(pcap_opts->pcap_h, interface_opts.name);
          } else {
              /* We couldn't open "iface" as a network device. */
              /* Try to open it as a pipe */
          } else {
              /* We couldn't open "iface" as a network device. */
              /* Try to open it as a pipe */
-            cap_pipe_open_live(interface_opts.name, &pcap_opts, &pcap_opts.cap_pipe_hdr, errmsg, (int) errmsg_len);
+            cap_pipe_open_live(interface_opts.name, pcap_opts, &pcap_opts->cap_pipe_hdr, errmsg, (int) errmsg_len);
  
  #ifndef _WIN32
  
  #ifndef _WIN32
-            if (pcap_opts.cap_pipe_fd == -1) {
+            if (pcap_opts->cap_pipe_fd == -1) {
  #else
  #else
-            if (pcap_opts.cap_pipe_h == INVALID_HANDLE_VALUE) {
+            if (pcap_opts->cap_pipe_h == INVALID_HANDLE_VALUE) {
  #endif
  #endif
-                if (pcap_opts.cap_pipe_err == PIPNEXIST) {
+                if (pcap_opts->cap_pipe_err == PIPNEXIST) {
                      /* Pipe doesn't exist, so output message for interface */
                      get_capture_device_open_failure_messages(open_err_str,
                                                               interface_opts.name,
                      /* Pipe doesn't exist, so output message for interface */
                      get_capture_device_open_failure_messages(open_err_str,
                                                               interface_opts.name,
@@ -2354,7 +2415,6 @@ capture_loop_open_input(capture_options *capture_opts, loop_data *ld,
                   * Else pipe (or file) does exist and cap_pipe_open_live() has
                   * filled in errmsg
                   */
                   * Else pipe (or file) does exist and cap_pipe_open_live() has
                   * filled in errmsg
                   */
-                g_array_append_val(ld->pcaps, pcap_opts);
                  return FALSE;
              } else {
                  /* cap_pipe_open_live() succeeded; don't want
                  return FALSE;
              } else {
                  /* cap_pipe_open_live() succeeded; don't want
@@ -2365,11 +2425,11 @@ capture_loop_open_input(capture_options *capture_opts, loop_data *ld,
  
  /* XXX - will this work for tshark? */
  #ifdef MUST_DO_SELECT
  
  /* XXX - will this work for tshark? */
  #ifdef MUST_DO_SELECT
-        if (!pcap_opts.from_cap_pipe) {
+        if (!pcap_opts->from_cap_pipe) {
  #ifdef HAVE_PCAP_GET_SELECTABLE_FD
  #ifdef HAVE_PCAP_GET_SELECTABLE_FD
-            pcap_opts.pcap_fd = pcap_get_selectable_fd(pcap_opts.pcap_h);
+            pcap_opts->pcap_fd = pcap_get_selectable_fd(pcap_opts->pcap_h);
  #else
  #else
-            pcap_opts.pcap_fd = pcap_fileno(pcap_opts.pcap_h);
+            pcap_opts->pcap_fd = pcap_fileno(pcap_opts->pcap_h);
  #endif
          }
  #endif
  #endif
          }
  #endif
@@ -2383,9 +2443,18 @@ capture_loop_open_input(capture_options *capture_opts, loop_data *ld,
          }
          capture_opts->ifaces = g_array_remove_index(capture_opts->ifaces, i);
          g_array_insert_val(capture_opts->ifaces, i, interface_opts);
          }
          capture_opts->ifaces = g_array_remove_index(capture_opts->ifaces, i);
          g_array_insert_val(capture_opts->ifaces, i, interface_opts);
-        g_array_append_val(ld->pcaps, pcap_opts);
      }
  
      }
  
+    /* If not using libcap: we now can now set euid/egid to ruid/rgid         */
+    /*  to remove any suid privileges.                                        */
+    /* If using libcap: we can now remove NET_RAW and NET_ADMIN capabilities  */
+    /*  (euid/egid have already previously been set to ruid/rgid.             */
+    /* (See comment in main() for details)                                    */
+#ifndef HAVE_LIBCAP
+    relinquish_special_privs_perm();
+#else
+    relinquish_all_capabilities();
+#endif
      return TRUE;
  }
  
      return TRUE;
  }
  
@@ -2393,30 +2462,30 @@ capture_loop_open_input(capture_options *capture_opts, loop_data *ld,
  static void capture_loop_close_input(loop_data *ld)
  {
      guint i;
  static void capture_loop_close_input(loop_data *ld)
  {
      guint i;
-    pcap_options pcap_opts;
+    pcap_options *pcap_opts;
  
      g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "capture_loop_close_input");
  
      for (i = 0; i < ld->pcaps->len; i++) {
  
      g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "capture_loop_close_input");
  
      for (i = 0; i < ld->pcaps->len; i++) {
-        pcap_opts = g_array_index(ld->pcaps, pcap_options, i);
+        pcap_opts = g_array_index(ld->pcaps, pcap_options *, i);
          /* if open, close the capture pipe "input file" */
  #ifndef _WIN32
          /* if open, close the capture pipe "input file" */
  #ifndef _WIN32
-        if (pcap_opts.cap_pipe_fd >= 0) {
-            g_assert(pcap_opts.from_cap_pipe);
-            ws_close(pcap_opts.cap_pipe_fd);
-            pcap_opts.cap_pipe_fd = -1;
+        if (pcap_opts->cap_pipe_fd >= 0) {
+            g_assert(pcap_opts->from_cap_pipe);
+            ws_close(pcap_opts->cap_pipe_fd);
+            pcap_opts->cap_pipe_fd = -1;
          }
  #else
          }
  #else
-        if (pcap_opts.cap_pipe_h != INVALID_HANDLE_VALUE) {
-            CloseHandle(pcap_opts.cap_pipe_h);
-            pcap_opts.cap_pipe_h = INVALID_HANDLE_VALUE;
+        if (pcap_opts->cap_pipe_h != INVALID_HANDLE_VALUE) {
+            CloseHandle(pcap_opts->cap_pipe_h);
+            pcap_opts->cap_pipe_h = INVALID_HANDLE_VALUE;
          }
  #endif
          /* if open, close the pcap "input file" */
          }
  #endif
          /* if open, close the pcap "input file" */
-        if (pcap_opts.pcap_h != NULL) {
-            g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "capture_loop_close_input: closing %p", pcap_opts.pcap_h);
-            pcap_close(pcap_opts.pcap_h);
-            pcap_opts.pcap_h = NULL;
+        if (pcap_opts->pcap_h != NULL) {
+            g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "capture_loop_close_input: closing %p", (void *)pcap_opts->pcap_h);
+            pcap_close(pcap_opts->pcap_h);
+            pcap_opts->pcap_h = NULL;
          }
      }
  
          }
      }
  
@@ -2432,7 +2501,7 @@ static void capture_loop_close_input(loop_data *ld)
  /* init the capture filter */
  static initfilter_status_t
  capture_loop_init_filter(pcap_t *pcap_h, gboolean from_cap_pipe,
  /* init the capture filter */
  static initfilter_status_t
  capture_loop_init_filter(pcap_t *pcap_h, gboolean from_cap_pipe,
-                         gchar * name, gchar * cfilter)
+                         const gchar * name, const gchar * cfilter)
  {
      struct bpf_program fcode;
  
  {
      struct bpf_program fcode;
  
@@ -2468,7 +2537,7 @@ capture_loop_init_output(capture_options *capture_opts, loop_data *ld, char *err
  {
      int err;
      guint i;
  {
      int err;
      guint i;
-    pcap_options pcap_opts;
+    pcap_options *pcap_opts;
      interface_options interface_opts;
      gboolean successful;
  
      interface_options interface_opts;
      gboolean successful;
  
@@ -2495,29 +2564,28 @@ capture_loop_init_output(capture_options *capture_opts, loop_data *ld, char *err
              successful = libpcap_write_session_header_block(ld->pdh, appname, &ld->bytes_written, &err);
              for (i = 0; successful && (i < capture_opts->ifaces->len); i++) {
                  interface_opts = g_array_index(capture_opts->ifaces, interface_options, i);
              successful = libpcap_write_session_header_block(ld->pdh, appname, &ld->bytes_written, &err);
              for (i = 0; successful && (i < capture_opts->ifaces->len); i++) {
                  interface_opts = g_array_index(capture_opts->ifaces, interface_options, i);
-                pcap_opts = g_array_index(ld->pcaps, pcap_options, i);
-                if (pcap_opts.from_cap_pipe) {
-                    pcap_opts.snaplen = pcap_opts.cap_pipe_hdr.snaplen;
+                pcap_opts = g_array_index(ld->pcaps, pcap_options *, i);
+                if (pcap_opts->from_cap_pipe) {
+                    pcap_opts->snaplen = pcap_opts->cap_pipe_hdr.snaplen;
                  } else {
                  } else {
-                    pcap_opts.snaplen = pcap_snapshot(pcap_opts.pcap_h);
+                    pcap_opts->snaplen = pcap_snapshot(pcap_opts->pcap_h);
                  }
                  successful = libpcap_write_interface_description_block(ld->pdh,
                                                                         interface_opts.name,
                  }
                  successful = libpcap_write_interface_description_block(ld->pdh,
                                                                         interface_opts.name,
-                                                                       interface_opts.cfilter,
-                                                                       pcap_opts.linktype,
-                                                                       pcap_opts.snaplen,
+                                                                       interface_opts.cfilter?interface_opts.cfilter:"",
+                                                                       pcap_opts->linktype,
+                                                                       pcap_opts->snaplen,
                                                                         &ld->bytes_written,
                                                                         &err);
              }
          } else {
                                                                         &ld->bytes_written,
                                                                         &err);
              }
          } else {
-            interface_opts = g_array_index(capture_opts->ifaces, interface_options, 0);
-            pcap_opts = g_array_index(ld->pcaps, pcap_options, 0);
-            if (pcap_opts.from_cap_pipe) {
-                pcap_opts.snaplen = pcap_opts.cap_pipe_hdr.snaplen;
+            pcap_opts = g_array_index(ld->pcaps, pcap_options *, 0);
+            if (pcap_opts->from_cap_pipe) {
+                pcap_opts->snaplen = pcap_opts->cap_pipe_hdr.snaplen;
              } else {
              } else {
-                pcap_opts.snaplen = pcap_snapshot(pcap_opts.pcap_h);
+                pcap_opts->snaplen = pcap_snapshot(pcap_opts->pcap_h);
              }
              }
-            successful = libpcap_write_file_header(ld->pdh, pcap_opts.linktype, pcap_opts.snaplen,
+            successful = libpcap_write_file_header(ld->pdh, pcap_opts->linktype, pcap_opts->snaplen,
                                                     &ld->bytes_written, &err);
          }
          if (!successful) {
                                                     &ld->bytes_written, &err);
          }
          if (!successful) {
@@ -2541,7 +2609,7 @@ capture_loop_init_output(capture_options *capture_opts, loop_data *ld, char *err
                  g_snprintf(errmsg, errmsg_len,
                             "The file to which the capture would be"
                             " saved (\"%s\") could not be opened: %s.",
                  g_snprintf(errmsg, errmsg_len,
                             "The file to which the capture would be"
                             " saved (\"%s\") could not be opened: %s.",
-                           capture_opts->save_file, strerror(err));
+                           capture_opts->save_file, g_strerror(err));
              }
              break;
          }
              }
              break;
          }
@@ -2557,7 +2625,7 @@ capture_loop_close_output(capture_options *capture_opts, loop_data *ld, int *err
  {
  
      unsigned int i;
  {
  
      unsigned int i;
-    pcap_options  pcap_opts;
+    pcap_options *pcap_opts;
  
      g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "capture_loop_close_output");
  
  
      g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "capture_loop_close_output");
  
@@ -2566,9 +2634,9 @@ capture_loop_close_output(capture_options *capture_opts, loop_data *ld, int *err
      } else {
          if (capture_opts->use_pcapng) {
              for (i = 0; i < global_ld.pcaps->len; i++) {
      } else {
          if (capture_opts->use_pcapng) {
              for (i = 0; i < global_ld.pcaps->len; i++) {
-                pcap_opts = g_array_index(global_ld.pcaps, pcap_options, i);
-                if (!pcap_opts.from_cap_pipe) {
-                    libpcap_write_interface_statistics_block(ld->pdh, i, pcap_opts.pcap_h, &ld->bytes_written, err_close);
+                pcap_opts = g_array_index(global_ld.pcaps, pcap_options *, i);
+                if (!pcap_opts->from_cap_pipe) {
+                    libpcap_write_interface_statistics_block(ld->pdh, i, pcap_opts->pcap_h, &ld->bytes_written, err_close);
                  }
              }
          }
                  }
              }
          }
@@ -2594,7 +2662,7 @@ capture_loop_dispatch(loop_data *ld,
      int       inpkts;
      gint      packet_count_before;
      guchar    pcap_data[WTAP_MAX_PACKET_SIZE];
      int       inpkts;
      gint      packet_count_before;
      guchar    pcap_data[WTAP_MAX_PACKET_SIZE];
-#ifndef USE_THREADS
+#ifndef _WIN32
      int       sel_ret;
  #endif
  
      int       sel_ret;
  #endif
  
@@ -2604,12 +2672,12 @@ capture_loop_dispatch(loop_data *ld,
  #ifdef LOG_CAPTURE_VERBOSE
          g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "capture_loop_dispatch: from capture pipe");
  #endif
  #ifdef LOG_CAPTURE_VERBOSE
          g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "capture_loop_dispatch: from capture pipe");
  #endif
-#ifndef USE_THREADS
+#ifndef _WIN32
          sel_ret = cap_pipe_select(pcap_opts->cap_pipe_fd);
          if (sel_ret <= 0) {
              if (sel_ret < 0 && errno != EINTR) {
                  g_snprintf(errmsg, errmsg_len,
          sel_ret = cap_pipe_select(pcap_opts->cap_pipe_fd);
          if (sel_ret <= 0) {
              if (sel_ret < 0 && errno != EINTR) {
                  g_snprintf(errmsg, errmsg_len,
-                           "Unexpected error from select: %s", strerror(errno));
+                           "Unexpected error from select: %s", g_strerror(errno));
                  report_capture_error(errmsg, please_report);
                  ld->go = FALSE;
              }
                  report_capture_error(errmsg, please_report);
                  ld->go = FALSE;
              }
@@ -2617,12 +2685,12 @@ capture_loop_dispatch(loop_data *ld,
              /*
               * "select()" says we can read from the pipe without blocking
               */
              /*
               * "select()" says we can read from the pipe without blocking
               */
-#endif /* USE_THREADS */
+#endif
              inpkts = cap_pipe_dispatch(ld, pcap_opts, pcap_data, errmsg, errmsg_len);
              if (inpkts < 0) {
                  ld->go = FALSE;
              }
              inpkts = cap_pipe_dispatch(ld, pcap_opts, pcap_data, errmsg, errmsg_len);
              if (inpkts < 0) {
                  ld->go = FALSE;
              }
-#ifndef USE_THREADS
+#ifndef _WIN32
          }
  #endif
      }
          }
  #endif
      }
@@ -2658,12 +2726,10 @@ capture_loop_dispatch(loop_data *ld,
                   * processing immediately, rather than processing all packets
                   * in a batch before quitting.
                   */
                   * processing immediately, rather than processing all packets
                   * in a batch before quitting.
                   */
-                if (use_threads) { 
-                    inpkts = pcap_dispatch(pcap_opts->pcap_h, 1, capture_loop_queue_packet_cb,
-                                       (u_char *)&(pcap_opts->interface_id));
+                if (use_threads) {
+                    inpkts = pcap_dispatch(pcap_opts->pcap_h, 1, capture_loop_queue_packet_cb, (u_char *)pcap_opts);
                  } else {
                  } else {
-                    inpkts = pcap_dispatch(pcap_opts->pcap_h, 1, capture_loop_write_packet_cb,
-                                       (u_char *)&(pcap_opts->interface_id));
+                    inpkts = pcap_dispatch(pcap_opts->pcap_h, 1, capture_loop_write_packet_cb, (u_char *)pcap_opts);
                  }
                  if (inpkts < 0) {
                      if (inpkts == -1) {
                  }
                  if (inpkts < 0) {
                      if (inpkts == -1) {
@@ -2675,7 +2741,7 @@ capture_loop_dispatch(loop_data *ld,
              } else {
                  if (sel_ret < 0 && errno != EINTR) {
                      g_snprintf(errmsg, errmsg_len,
              } else {
                  if (sel_ret < 0 && errno != EINTR) {
                      g_snprintf(errmsg, errmsg_len,
-                               "Unexpected error from select: %s", strerror(errno));
+                               "Unexpected error from select: %s", g_strerror(errno));
                      report_capture_error(errmsg, please_report);
                      ld->go = FALSE;
                  }
                      report_capture_error(errmsg, please_report);
                      ld->go = FALSE;
                  }
@@ -2696,16 +2762,16 @@ capture_loop_dispatch(loop_data *ld,
               * after processing packets.  We therefore process only one packet
               * at a time, so that we can check the pipe after every packet.
               */
               * after processing packets.  We therefore process only one packet
               * at a time, so that we can check the pipe after every packet.
               */
-            if (use_threads) { 
-                inpkts = pcap_dispatch(pcap_opts->pcap_h, 1, capture_loop_queue_packet_cb, (u_char *)&pcap_opts->interface_id);
+            if (use_threads) {
+                inpkts = pcap_dispatch(pcap_opts->pcap_h, 1, capture_loop_queue_packet_cb, (u_char *)pcap_opts);
              } else {
              } else {
-                inpkts = pcap_dispatch(pcap_opts->pcap_h, 1, capture_loop_write_packet_cb, (u_char *)&pcap_opts->interface_id);
+                inpkts = pcap_dispatch(pcap_opts->pcap_h, 1, capture_loop_write_packet_cb, (u_char *)pcap_opts);
              }
  #else
              }
  #else
-            if (use_threads) { 
-                inpkts = pcap_dispatch(pcap_opts->pcap_h, -1, capture_loop_queue_packet_cb, (u_char *)&pcap_opts->interface_id);
+            if (use_threads) {
+                inpkts = pcap_dispatch(pcap_opts->pcap_h, -1, capture_loop_queue_packet_cb, (u_char *)pcap_opts);
              } else {
              } else {
-                inpkts = pcap_dispatch(pcap_opts->pcap_h, -1, capture_loop_write_packet_cb, (u_char *)&pcap_opts->interface_id);
+                inpkts = pcap_dispatch(pcap_opts->pcap_h, -1, capture_loop_write_packet_cb, (u_char *)pcap_opts);
              }
  #endif
              if (inpkts < 0) {
              }
  #endif
              if (inpkts < 0) {
@@ -2740,9 +2806,9 @@ capture_loop_dispatch(loop_data *ld,
                  while(ld->go &&
                        (in = pcap_next_ex(pcap_opts->pcap_h, &pkt_header, &pkt_data)) == 1) {
                      if (use_threads) {
                  while(ld->go &&
                        (in = pcap_next_ex(pcap_opts->pcap_h, &pkt_header, &pkt_data)) == 1) {
                      if (use_threads) {
-                        capture_loop_queue_packet_cb((u_char *)&pcap_opts->interface_id, pkt_header, pkt_data);
+                        capture_loop_queue_packet_cb((u_char *)pcap_opts, pkt_header, pkt_data);
                      } else {
                      } else {
-                        capture_loop_write_packet_cb((u_char *)&pcap_opts->interface_id, pkt_header, pkt_data);
+                        capture_loop_write_packet_cb((u_char *)pcap_opts, pkt_header, pkt_data);
                      }
                  }
  
                      }
                  }
  
@@ -2847,15 +2913,21 @@ capture_loop_open_output(capture_options *capture_opts, int *save_file_fd,
          is_tempfile = FALSE;
      } else {
          /* Choose a random name for the temporary capture buffer */
          is_tempfile = FALSE;
      } else {
          /* Choose a random name for the temporary capture buffer */
+        if (global_capture_opts.ifaces->len > 1) {
+            prefix = g_strdup_printf("wireshark_%d_interfaces", global_capture_opts.ifaces->len);
+        } else {
+            gchar *basename;
  #ifdef _WIN32
  #ifdef _WIN32
-        GString *iface;
-
-        iface = isolate_uuid(g_array_index(global_capture_opts.ifaces, interface_options, global_capture_opts.ifaces->len - 1).name);
-        prefix = g_strconcat("wireshark_", g_basename(iface->str), NULL);
-        g_string_free(iface, TRUE);
+            GString *iface;
+            iface = isolate_uuid(g_array_index(global_capture_opts.ifaces, interface_options, 0).name);
+            basename = g_path_get_basename(iface->str);
+            g_string_free(iface, TRUE);
  #else
  #else
-        prefix = g_strconcat("wireshark_", g_basename(g_array_index(global_capture_opts.ifaces, interface_options, global_capture_opts.ifaces->len - 1).name), NULL);
+            basename = g_path_get_basename(g_array_index(global_capture_opts.ifaces, interface_options, 0).name);
  #endif
  #endif
+            prefix = g_strconcat("wireshark_", basename, NULL);
+            g_free(basename);
+        }
          *save_file_fd = create_tempfile(&tmpname, prefix);
          g_free(prefix);
          capfile_name = g_strdup(tmpname);
          *save_file_fd = create_tempfile(&tmpname, prefix);
          g_free(prefix);
          capfile_name = g_strdup(tmpname);
@@ -2867,7 +2939,7 @@ capture_loop_open_output(capture_options *capture_opts, int *save_file_fd,
          if (is_tempfile) {
              g_snprintf(errmsg, errmsg_len,
                         "The temporary file to which the capture would be saved (\"%s\") "
          if (is_tempfile) {
              g_snprintf(errmsg, errmsg_len,
                         "The temporary file to which the capture would be saved (\"%s\") "
-                       "could not be opened: %s.", capfile_name, strerror(errno));
+                       "could not be opened: %s.", capfile_name, g_strerror(errno));
          } else {
              if (capture_opts->multi_files_on) {
                  ringbuf_error_cleanup();
          } else {
              if (capture_opts->multi_files_on) {
                  ringbuf_error_cleanup();
@@ -2876,7 +2948,7 @@ capture_loop_open_output(capture_options *capture_opts, int *save_file_fd,
              g_snprintf(errmsg, errmsg_len,
                         "The file to which the capture would be saved (\"%s\") "
                         "could not be opened: %s.", capfile_name,
              g_snprintf(errmsg, errmsg_len,
                         "The file to which the capture would be saved (\"%s\") "
                         "could not be opened: %s.", capfile_name,
-                       strerror(errno));
+                       g_strerror(errno));
          }
          g_free(capfile_name);
          return FALSE;
          }
          g_free(capfile_name);
          return FALSE;
@@ -2902,7 +2974,7 @@ do_file_switch_or_stop(capture_options *capture_opts,
                         condition *cnd_file_duration)
  {
      guint i;
                         condition *cnd_file_duration)
  {
      guint i;
-    pcap_options pcap_opts;
+    pcap_options *pcap_opts;
      interface_options interface_opts;
      gboolean successful;
  
      interface_options interface_opts;
      gboolean successful;
  
@@ -2927,19 +2999,18 @@ do_file_switch_or_stop(capture_options *capture_opts,
                  successful = libpcap_write_session_header_block(global_ld.pdh, appname, &(global_ld.bytes_written), &global_ld.err);
                  for (i = 0; successful && (i < capture_opts->ifaces->len); i++) {
                      interface_opts = g_array_index(capture_opts->ifaces, interface_options, i);
                  successful = libpcap_write_session_header_block(global_ld.pdh, appname, &(global_ld.bytes_written), &global_ld.err);
                  for (i = 0; successful && (i < capture_opts->ifaces->len); i++) {
                      interface_opts = g_array_index(capture_opts->ifaces, interface_options, i);
-                    pcap_opts = g_array_index(global_ld.pcaps, pcap_options, i);
+                    pcap_opts = g_array_index(global_ld.pcaps, pcap_options *, i);
                      successful = libpcap_write_interface_description_block(global_ld.pdh,
                                                                             interface_opts.name,
                      successful = libpcap_write_interface_description_block(global_ld.pdh,
                                                                             interface_opts.name,
-                                                                           interface_opts.cfilter,
-                                                                           pcap_opts.linktype,
-                                                                           pcap_opts.snaplen,
+                                                                           interface_opts.cfilter?interface_opts.cfilter:"",
+                                                                           pcap_opts->linktype,
+                                                                           pcap_opts->snaplen,
                                                                             &(global_ld.bytes_written),
                                                                             &global_ld.err);
                  }
              } else {
                                                                             &(global_ld.bytes_written),
                                                                             &global_ld.err);
                  }
              } else {
-                interface_opts = g_array_index(capture_opts->ifaces, interface_options, 0);
-                pcap_opts = g_array_index(global_ld.pcaps, pcap_options, 0);
-                successful = libpcap_write_file_header(global_ld.pdh, pcap_opts.linktype, pcap_opts.snaplen,
+                pcap_opts = g_array_index(global_ld.pcaps, pcap_options *, 0);
+                successful = libpcap_write_file_header(global_ld.pdh, pcap_opts->linktype, pcap_opts->snaplen,
                                                         &global_ld.bytes_written, &global_ld.err);
              }
              if (!successful) {
                                                         &global_ld.bytes_written, &global_ld.err);
              }
              if (!successful) {
@@ -2973,23 +3044,20 @@ do_file_switch_or_stop(capture_options *capture_opts,
  static void *
  pcap_read_handler(void* arg)
  {
  static void *
  pcap_read_handler(void* arg)
  {
-    pcap_options pcap_opts;
-    guint interface_id;
+    pcap_options *pcap_opts;
      char errmsg[MSG_MAX_LENGTH+1];
  
      char errmsg[MSG_MAX_LENGTH+1];
  
-    interface_id = *(guint *)arg;
-    g_free(arg);
-    pcap_opts = g_array_index(global_ld.pcaps, pcap_options, interface_id);
+    pcap_opts = (pcap_options *)arg;
  
      g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO, "Started thread for interface %d.",
  
      g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO, "Started thread for interface %d.",
-          interface_id);
+          pcap_opts->interface_id);
  
      while (global_ld.go) {
          /* dispatch incoming packets */
  
      while (global_ld.go) {
          /* dispatch incoming packets */
-        capture_loop_dispatch(&global_ld, errmsg, sizeof(errmsg), &pcap_opts);
+        capture_loop_dispatch(&global_ld, errmsg, sizeof(errmsg), pcap_opts);
      }
      g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO, "Stopped thread for interface %d.",
      }
      g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO, "Stopped thread for interface %d.",
-          interface_id);
+          pcap_opts->interface_id);
      g_thread_exit(NULL);
      return (NULL);
  }
      g_thread_exit(NULL);
      return (NULL);
  }
@@ -3000,7 +3068,7 @@ static gboolean
  capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct pcap_stat *stats)
  {
  #ifdef WIN32
  capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct pcap_stat *stats)
  {
  #ifdef WIN32
-    time_t upd_time, cur_time;
+    DWORD upd_time, cur_time;   /* GetTickCount() returns a "DWORD" (which is 'unsigned long') */
  #else
      struct timeval upd_time, cur_time;
  #endif
  #else
      struct timeval upd_time, cur_time;
  #endif
@@ -3015,11 +3083,10 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
      gboolean    cfilter_error = FALSE;
      char        errmsg[MSG_MAX_LENGTH+1];
      char        secondary_errmsg[MSG_MAX_LENGTH+1];
      gboolean    cfilter_error = FALSE;
      char        errmsg[MSG_MAX_LENGTH+1];
      char        secondary_errmsg[MSG_MAX_LENGTH+1];
-    pcap_options pcap_opts;
+    pcap_options *pcap_opts;
      interface_options interface_opts;
      interface_options interface_opts;
-    guint i;
+    guint i, error_index = 0;
  
  
-    interface_opts = capture_opts->default_options;
      *errmsg           = '\0';
      *secondary_errmsg = '\0';
  
      *errmsg           = '\0';
      *secondary_errmsg = '\0';
  
@@ -3029,7 +3096,6 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
  #ifdef SIGINFO
      global_ld.report_packet_count = FALSE;
  #endif
  #ifdef SIGINFO
      global_ld.report_packet_count = FALSE;
  #endif
-    global_ld.pcaps               = g_array_new(FALSE, FALSE, sizeof(pcap_options));
      if (capture_opts->has_autostop_packets)
          global_ld.packet_max      = capture_opts->autostop_packets;
      else
      if (capture_opts->has_autostop_packets)
          global_ld.packet_max      = capture_opts->autostop_packets;
      else
@@ -3052,24 +3118,30 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
          goto error;
      }
      for (i = 0; i < capture_opts->ifaces->len; i++) {
          goto error;
      }
      for (i = 0; i < capture_opts->ifaces->len; i++) {
-        pcap_opts = g_array_index(global_ld.pcaps, pcap_options, i);
+        pcap_opts = g_array_index(global_ld.pcaps, pcap_options *, i);
          interface_opts = g_array_index(capture_opts->ifaces, interface_options, i);
          /* init the input filter from the network interface (capture pipe will do nothing) */
          interface_opts = g_array_index(capture_opts->ifaces, interface_options, i);
          /* init the input filter from the network interface (capture pipe will do nothing) */
-        switch (capture_loop_init_filter(pcap_opts.pcap_h, pcap_opts.from_cap_pipe,
+        /*
+         * When remote capturing WinPCap crashes when the capture filter
+         * is NULL. This might be a bug in WPCap. Therefore we provide an emtpy
+         * string.
+         */
+        switch (capture_loop_init_filter(pcap_opts->pcap_h, pcap_opts->from_cap_pipe,
                                           interface_opts.name,
                                           interface_opts.name,
-                                         interface_opts.cfilter)) {
+                                         interface_opts.cfilter?interface_opts.cfilter:"")) {
  
          case INITFILTER_NO_ERROR:
              break;
  
          case INITFILTER_BAD_FILTER:
              cfilter_error = TRUE;
  
          case INITFILTER_NO_ERROR:
              break;
  
          case INITFILTER_BAD_FILTER:
              cfilter_error = TRUE;
-            g_snprintf(errmsg, sizeof(errmsg), "%s", pcap_geterr(pcap_opts.pcap_h));
+            error_index = i;
+            g_snprintf(errmsg, sizeof(errmsg), "%s", pcap_geterr(pcap_opts->pcap_h));
              goto error;
  
          case INITFILTER_OTHER_ERROR:
              g_snprintf(errmsg, sizeof(errmsg), "Can't install filter (%s).",
              goto error;
  
          case INITFILTER_OTHER_ERROR:
              g_snprintf(errmsg, sizeof(errmsg), "Can't install filter (%s).",
-                       pcap_geterr(pcap_opts.pcap_h));
+                       pcap_geterr(pcap_opts->pcap_h));
              g_snprintf(secondary_errmsg, sizeof(secondary_errmsg), "%s", please_report);
              goto error;
          }
              g_snprintf(secondary_errmsg, sizeof(secondary_errmsg), "%s", please_report);
              goto error;
          }
@@ -3139,32 +3211,39 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
      /* please fasten your seat belts, we will enter now the actual capture loop */
      if (use_threads) {
          pcap_queue = g_async_queue_new();
      /* please fasten your seat belts, we will enter now the actual capture loop */
      if (use_threads) {
          pcap_queue = g_async_queue_new();
+        pcap_queue_bytes = 0;
+        pcap_queue_packets = 0;
          for (i = 0; i < global_ld.pcaps->len; i++) {
          for (i = 0; i < global_ld.pcaps->len; i++) {
-            gint *interface_id;
-
-            interface_id = (gint *)g_malloc(sizeof(guint));
-            *interface_id = i;
-            pcap_opts = g_array_index(global_ld.pcaps, pcap_options, i);
-            pcap_opts.tid = g_thread_create(pcap_read_handler, interface_id, TRUE, NULL);
-            global_ld.pcaps = g_array_remove_index(global_ld.pcaps, i);
-            g_array_insert_val(global_ld.pcaps, i, pcap_opts);
+            pcap_opts = g_array_index(global_ld.pcaps, pcap_options *, i);
+#if GLIB_CHECK_VERSION(2,31,0)
+            /* XXX - Add an interface name here? */
+            pcap_opts->tid = g_thread_new("Capture read", pcap_read_handler, pcap_opts);
+#else
+            pcap_opts->tid = g_thread_create(pcap_read_handler, pcap_opts, TRUE, NULL);
+#endif
          }
      }
      while (global_ld.go) {
          /* dispatch incoming packets */
          if (use_threads) {
          }
      }
      while (global_ld.go) {
          /* dispatch incoming packets */
          if (use_threads) {
-            GTimeVal    write_thread_time;
+            GTimeVal write_thread_time;
              pcap_queue_element *queue_element;
  
              g_get_current_time(&write_thread_time);
              g_time_val_add(&write_thread_time, WRITER_THREAD_TIMEOUT);
              pcap_queue_element *queue_element;
  
              g_get_current_time(&write_thread_time);
              g_time_val_add(&write_thread_time, WRITER_THREAD_TIMEOUT);
-            queue_element = g_async_queue_timed_pop(pcap_queue, &write_thread_time);
+            g_async_queue_lock(pcap_queue);
+            queue_element = g_async_queue_timed_pop_unlocked(pcap_queue, &write_thread_time);
+            if (queue_element) {
+                pcap_queue_bytes -= queue_element->phdr.caplen;
+                pcap_queue_packets -= 1;
+            }
+            g_async_queue_unlock(pcap_queue);
              if (queue_element) {
                  g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO,
                        "Dequeued a packet of length %d captured on interface %d.",
              if (queue_element) {
                  g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO,
                        "Dequeued a packet of length %d captured on interface %d.",
-                      queue_element->phdr.caplen,queue_element->interface_id);
+                      queue_element->phdr.caplen, queue_element->pcap_opts->interface_id);
  
  
-                capture_loop_write_packet_cb((u_char *)&queue_element->interface_id,
+                capture_loop_write_packet_cb((u_char *) queue_element->pcap_opts,
                                               &queue_element->phdr,
                                               queue_element->pd);
                  g_free(queue_element->pd);
                                               &queue_element->phdr,
                                               queue_element->pd);
                  g_free(queue_element->pd);
@@ -3174,8 +3253,9 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
                  inpkts = 0;
              }
          } else {
                  inpkts = 0;
              }
          } else {
+            pcap_opts = g_array_index(global_ld.pcaps, pcap_options *, 0);
              inpkts = capture_loop_dispatch(&global_ld, errmsg,
              inpkts = capture_loop_dispatch(&global_ld, errmsg,
-                                           sizeof(errmsg), &pcap_opts);
+                                           sizeof(errmsg), pcap_opts);
          }
  #ifdef SIGINFO
          /* Were we asked to print packet counts by the SIGINFO handler? */
          }
  #ifdef SIGINFO
          /* Were we asked to print packet counts by the SIGINFO handler? */
@@ -3216,8 +3296,8 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
  #define DUMPCAP_UPD_TIME 500
  
  #ifdef WIN32
  #define DUMPCAP_UPD_TIME 500
  
  #ifdef WIN32
-        cur_time = GetTickCount();
-        if ( (cur_time - upd_time) > DUMPCAP_UPD_TIME) {
+        cur_time = GetTickCount();  /* Note: wraps to 0 if sys runs for 49.7 days */
+        if ((cur_time - upd_time) > DUMPCAP_UPD_TIME) { /* wrap just causes an extra update */
  #else
          gettimeofday(&cur_time, NULL);
          if ((cur_time.tv_sec * 1000000 + cur_time.tv_usec) >
  #else
          gettimeofday(&cur_time, NULL);
          if ((cur_time.tv_sec * 1000000 + cur_time.tv_usec) >
@@ -3266,18 +3346,28 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
          pcap_queue_element *queue_element;
  
          for (i = 0; i < global_ld.pcaps->len; i++) {
          pcap_queue_element *queue_element;
  
          for (i = 0; i < global_ld.pcaps->len; i++) {
-            pcap_opts = g_array_index(global_ld.pcaps, pcap_options, i);
+            pcap_opts = g_array_index(global_ld.pcaps, pcap_options *, i);
              g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO, "Waiting for thread of interface %u...",
              g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO, "Waiting for thread of interface %u...",
-                  pcap_opts.interface_id);
-            g_thread_join(pcap_opts.tid);
+                  pcap_opts->interface_id);
+            g_thread_join(pcap_opts->tid);
              g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO, "Thread of interface %u terminated.",
              g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO, "Thread of interface %u terminated.",
-                  pcap_opts.interface_id);
+                  pcap_opts->interface_id);
          }
          }
-        while ((queue_element = g_async_queue_try_pop(pcap_queue))) {
+        while (1) {
+            g_async_queue_lock(pcap_queue);
+            queue_element = g_async_queue_try_pop_unlocked(pcap_queue);
+            if (queue_element) {
+                pcap_queue_bytes -= queue_element->phdr.caplen;
+                pcap_queue_packets -= 1;
+            }
+            g_async_queue_unlock(pcap_queue);
+            if (queue_element == NULL) {
+                break;
+            }
              g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO,
                    "Dequeued a packet of length %d captured on interface %d.",
              g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO,
                    "Dequeued a packet of length %d captured on interface %d.",
-                  queue_element->phdr.caplen,queue_element->interface_id);
-            capture_loop_write_packet_cb((u_char *)&queue_element->interface_id,
+                  queue_element->phdr.caplen, queue_element->pcap_opts->interface_id);
+            capture_loop_write_packet_cb((u_char *)queue_element->pcap_opts,
                                           &queue_element->phdr,
                                           queue_element->pd);
              g_free(queue_element->pd);
                                           &queue_element->phdr,
                                           queue_element->pd);
              g_free(queue_element->pd);
@@ -3300,14 +3390,14 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
      if (cnd_autostop_duration != NULL)
          cnd_delete(cnd_autostop_duration);
  
      if (cnd_autostop_duration != NULL)
          cnd_delete(cnd_autostop_duration);
  
-    /* did we had a pcap (input) error? */
+    /* did we have a pcap (input) error? */
      for (i = 0; i < capture_opts->ifaces->len; i++) {
      for (i = 0; i < capture_opts->ifaces->len; i++) {
-        pcap_opts = g_array_index(global_ld.pcaps, pcap_options, i);
-        if (pcap_opts.pcap_err) {
+        pcap_opts = g_array_index(global_ld.pcaps, pcap_options *, i);
+        if (pcap_opts->pcap_err) {
              /* On Linux, if an interface goes down while you're capturing on it,
                 you'll get a "recvfrom: Network is down" or
                 "The interface went down" error (ENETDOWN).
              /* On Linux, if an interface goes down while you're capturing on it,
                 you'll get a "recvfrom: Network is down" or
                 "The interface went down" error (ENETDOWN).
-               (At least you will if strerror() doesn't show a local translation
+               (At least you will if g_strerror() doesn't show a local translation
                 of the error.)
  
                 On FreeBSD and OS X, if a network adapter disappears while
                 of the error.)
  
                 On FreeBSD and OS X, if a network adapter disappears while
@@ -3319,7 +3409,7 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
                 These should *not* be reported to the Wireshark developers. */
              char *cap_err_str;
  
                 These should *not* be reported to the Wireshark developers. */
              char *cap_err_str;
  
-            cap_err_str = pcap_geterr(pcap_opts.pcap_h);
+            cap_err_str = pcap_geterr(pcap_opts->pcap_h);
              if (strcmp(cap_err_str, "recvfrom: Network is down") == 0 ||
                  strcmp(cap_err_str, "The interface went down") == 0 ||
                  strcmp(cap_err_str, "read: Device not configured") == 0 ||
              if (strcmp(cap_err_str, "recvfrom: Network is down") == 0 ||
                  strcmp(cap_err_str, "The interface went down") == 0 ||
                  strcmp(cap_err_str, "read: Device not configured") == 0 ||
@@ -3334,7 +3424,7 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
                  report_capture_error(errmsg, please_report);
              }
              break;
                  report_capture_error(errmsg, please_report);
              }
              break;
-        } else if (pcap_opts.from_cap_pipe && pcap_opts.cap_pipe_err == PIPERR) {
+        } else if (pcap_opts->from_cap_pipe && pcap_opts->cap_pipe_err == PIPERR) {
              report_capture_error(errmsg, "");
              break;
          }
              report_capture_error(errmsg, "");
              break;
          }
@@ -3380,26 +3470,32 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
       * mode, cap_pipe_open_live() will say "End of file on pipe during open".
       */
  
       * mode, cap_pipe_open_live() will say "End of file on pipe during open".
       */
  
-    report_capture_count();  /* print final capture count only if (quiet && !capture_child) */
+    report_capture_count(TRUE);
  
      /* get packet drop statistics from pcap */
      for (i = 0; i < capture_opts->ifaces->len; i++) {
  
      /* get packet drop statistics from pcap */
      for (i = 0; i < capture_opts->ifaces->len; i++) {
-        pcap_opts = g_array_index(global_ld.pcaps, pcap_options, i);
+        guint32 received;
+        guint32 dropped;
+
+        pcap_opts = g_array_index(global_ld.pcaps, pcap_options *, i);
          interface_opts = g_array_index(capture_opts->ifaces, interface_options, i);
          interface_opts = g_array_index(capture_opts->ifaces, interface_options, i);
-        if (pcap_opts.pcap_h != NULL) {
-            g_assert(!pcap_opts.from_cap_pipe);
+        received = pcap_opts->received;
+        dropped = pcap_opts->dropped;
+        if (pcap_opts->pcap_h != NULL) {
+            g_assert(!pcap_opts->from_cap_pipe);
              /* Get the capture statistics, so we know how many packets were dropped. */
              /* Get the capture statistics, so we know how many packets were dropped. */
-            if (pcap_stats(pcap_opts.pcap_h, stats) >= 0) {
+            if (pcap_stats(pcap_opts->pcap_h, stats) >= 0) {
                  *stats_known = TRUE;
                  /* Let the parent process know. */
                  *stats_known = TRUE;
                  /* Let the parent process know. */
-                report_packet_drops(stats->ps_recv, stats->ps_drop, interface_opts.name);
+                dropped += stats->ps_drop;
              } else {
                  g_snprintf(errmsg, sizeof(errmsg),
                             "Can't get packet-drop statistics: %s",
              } else {
                  g_snprintf(errmsg, sizeof(errmsg),
                             "Can't get packet-drop statistics: %s",
-                           pcap_geterr(pcap_opts.pcap_h));
+                           pcap_geterr(pcap_opts->pcap_h));
                  report_capture_error(errmsg, please_report);
              }
          }
                  report_capture_error(errmsg, please_report);
              }
          }
+        report_packet_drops(received, dropped, interface_opts.name);
      }
  
      /* close the input file (pcap or capture pipe) */
      }
  
      /* close the input file (pcap or capture pipe) */
@@ -3430,7 +3526,7 @@ error:
      }
      capture_opts->save_file = NULL;
      if (cfilter_error)
      }
      capture_opts->save_file = NULL;
      if (cfilter_error)
-        report_cfilter_error(interface_opts.cfilter, errmsg);
+        report_cfilter_error(capture_opts, error_index, errmsg);
      else
          report_capture_error(errmsg, secondary_errmsg);
  
      else
          report_capture_error(errmsg, secondary_errmsg);
  
@@ -3447,12 +3543,12 @@ static void capture_loop_stop(void)
  {
  #ifdef HAVE_PCAP_BREAKLOOP
      guint i;
  {
  #ifdef HAVE_PCAP_BREAKLOOP
      guint i;
-    pcap_options pcap_opts;
+    pcap_options *pcap_opts;
  
      for (i = 0; i < global_ld.pcaps->len; i++) {
  
      for (i = 0; i < global_ld.pcaps->len; i++) {
-        pcap_opts = g_array_index(global_ld.pcaps, pcap_options, i);
-        if (pcap_opts.pcap_h != NULL)
-            pcap_breakloop(pcap_opts.pcap_h);
+        pcap_opts = g_array_index(global_ld.pcaps, pcap_options *, i);
+        if (pcap_opts->pcap_h != NULL)
+            pcap_breakloop(pcap_opts->pcap_h);
      }
  #endif
      global_ld.go = FALSE;
      }
  #endif
      global_ld.go = FALSE;
@@ -3491,13 +3587,13 @@ capture_loop_get_errmsg(char *errmsg, int errmsglen, const char *fname,
              g_snprintf(errmsg, errmsglen,
                         "The file to which the capture was being saved\n"
                         "(\"%s\") could not be closed: %s.",
              g_snprintf(errmsg, errmsglen,
                         "The file to which the capture was being saved\n"
                         "(\"%s\") could not be closed: %s.",
-                       fname, strerror(err));
+                       fname, g_strerror(err));
          } else {
              g_snprintf(errmsg, errmsglen,
                         "An error occurred while writing to the file"
                         " to which the capture was being saved\n"
                         "(\"%s\"): %s.",
          } else {
              g_snprintf(errmsg, errmsglen,
                         "An error occurred while writing to the file"
                         " to which the capture was being saved\n"
                         "(\"%s\"): %s.",
-                       fname, strerror(err));
+                       fname, g_strerror(err));
          }
          break;
      }
          }
          break;
      }
@@ -3506,10 +3602,10 @@ capture_loop_get_errmsg(char *errmsg, int errmsglen, const char *fname,
  
  /* one packet was captured, process it */
  static void
  
  /* one packet was captured, process it */
  static void
-capture_loop_write_packet_cb(u_char *user, const struct pcap_pkthdr *phdr,
+capture_loop_write_packet_cb(u_char *pcap_opts_p, const struct pcap_pkthdr *phdr,
                               const u_char *pd)
  {
                               const u_char *pd)
  {
-    guint interface_id = *(guint *) (void *) user;
+    pcap_options *pcap_opts = (pcap_options *) (void *) pcap_opts_p;
      int err;
  
      /* We may be called multiple times from pcap_dispatch(); if we've set
      int err;
  
      /* We may be called multiple times from pcap_dispatch(); if we've set
@@ -3525,7 +3621,7 @@ capture_loop_write_packet_cb(u_char *user, const struct pcap_pkthdr *phdr,
             If this fails, set "ld->go" to FALSE, to stop the capture, and set
             "ld->err" to the error. */
          if (global_capture_opts.use_pcapng) {
             If this fails, set "ld->go" to FALSE, to stop the capture, and set
             "ld->err" to the error. */
          if (global_capture_opts.use_pcapng) {
-            successful = libpcap_write_enhanced_packet_block(global_ld.pdh, phdr, interface_id, pd, &global_ld.bytes_written, &err);
+            successful = libpcap_write_enhanced_packet_block(global_ld.pdh, phdr, pcap_opts->interface_id, pd, &global_ld.bytes_written, &err);
          } else {
              successful = libpcap_write_packet(global_ld.pdh, phdr, pd, &global_ld.bytes_written, &err);
          }
          } else {
              successful = libpcap_write_packet(global_ld.pdh, phdr, pd, &global_ld.bytes_written, &err);
          }
@@ -3535,8 +3631,9 @@ capture_loop_write_packet_cb(u_char *user, const struct pcap_pkthdr *phdr,
          } else {
              g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO,
                    "Wrote a packet of length %d captured on interface %u.",
          } else {
              g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO,
                    "Wrote a packet of length %d captured on interface %u.",
-                   phdr->caplen, interface_id);
+                   phdr->caplen, pcap_opts->interface_id);
              global_ld.packet_count++;
              global_ld.packet_count++;
+            pcap_opts->received++;
              /* if the user told us to stop after x packets, do we already have enough? */
              if ((global_ld.packet_max > 0) && (global_ld.packet_count >= global_ld.packet_max)) {
                  global_ld.go = FALSE;
              /* if the user told us to stop after x packets, do we already have enough? */
              if ((global_ld.packet_max > 0) && (global_ld.packet_count >= global_ld.packet_max)) {
                  global_ld.go = FALSE;
@@ -3547,11 +3644,12 @@ capture_loop_write_packet_cb(u_char *user, const struct pcap_pkthdr *phdr,
  
  /* one packet was captured, queue it */
  static void
  
  /* one packet was captured, queue it */
  static void
-capture_loop_queue_packet_cb(u_char *user, const struct pcap_pkthdr *phdr,
+capture_loop_queue_packet_cb(u_char *pcap_opts_p, const struct pcap_pkthdr *phdr,
                               const u_char *pd)
  {
                               const u_char *pd)
  {
+    pcap_options *pcap_opts = (pcap_options *) (void *) pcap_opts_p;
      pcap_queue_element *queue_element;
      pcap_queue_element *queue_element;
-    guint interface_id;
+    gboolean limit_reached;
  
      /* We may be called multiple times from pcap_dispatch(); if we've set
         the "stop capturing" flag, ignore this packet, as we're not
  
      /* We may be called multiple times from pcap_dispatch(); if we've set
         the "stop capturing" flag, ignore this packet, as we're not
@@ -3559,16 +3657,49 @@ capture_loop_queue_packet_cb(u_char *user, const struct pcap_pkthdr *phdr,
      if (!global_ld.go)
          return;
  
      if (!global_ld.go)
          return;
  
-    interface_id = *(guint *) (void *) user;
      queue_element = (pcap_queue_element *)g_malloc(sizeof(pcap_queue_element));
      queue_element = (pcap_queue_element *)g_malloc(sizeof(pcap_queue_element));
-    queue_element->interface_id = interface_id;
+    if (queue_element == NULL) {
+       pcap_opts->dropped++;
+       return;
+    }
+    queue_element->pcap_opts = pcap_opts;
      queue_element->phdr = *phdr;
      queue_element->pd = (u_char *)g_malloc(phdr->caplen);
      queue_element->phdr = *phdr;
      queue_element->pd = (u_char *)g_malloc(phdr->caplen);
+    if (queue_element->pd == NULL) {
+        pcap_opts->dropped++;
+        g_free(queue_element);
+        return;
+    }
      memcpy(queue_element->pd, pd, phdr->caplen);
      memcpy(queue_element->pd, pd, phdr->caplen);
-    g_async_queue_push(pcap_queue, queue_element);
+    g_async_queue_lock(pcap_queue);
+    if (((pcap_queue_byte_limit > 0) && (pcap_queue_bytes < pcap_queue_byte_limit)) &&
+        ((pcap_queue_packet_limit > 0) && (pcap_queue_packets < pcap_queue_packet_limit))) {
+        limit_reached = FALSE;
+        g_async_queue_push_unlocked(pcap_queue, queue_element);
+        pcap_queue_bytes += phdr->caplen;
+        pcap_queue_packets += 1;
+    } else {
+        limit_reached = TRUE;
+    }
+    g_async_queue_unlock(pcap_queue);
+    if (limit_reached) {
+        pcap_opts->dropped++;
+        g_free(queue_element->pd);
+        g_free(queue_element);
+        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO,
+              "Dropped a packet of length %d captured on interface %u.",
+              phdr->caplen, pcap_opts->interface_id);
+    } else {
+        pcap_opts->received++;
+        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO,
+              "Queued a packet of length %d captured on interface %u.",
+              phdr->caplen, pcap_opts->interface_id);
+    }
+    /* I don't want to hold the mutex over the debug output. So the
+       output may be wrong */
      g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO,
      g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO,
-          "Queued a packet of length %d captured on interface %u.",
-          phdr->caplen, interface_id);
+          "Queue size is now %" G_GINT64_MODIFIER "d bytes (%" G_GINT64_MODIFIER "d packets)",
+          pcap_queue_bytes, pcap_queue_packets);
  }
  
  /* And now our feature presentation... [ fade to music ] */
  }
  
  /* And now our feature presentation... [ fade to music ] */
@@ -3580,8 +3711,6 @@ main(int argc, char *argv[])
  
  #ifdef _WIN32
      WSADATA              wsaData;
  
  #ifdef _WIN32
      WSADATA              wsaData;
-    LPWSTR              *wc_argv;
-    int                  wc_argc;
  #else
      struct sigaction action, oldaction;
  #endif
  #else
      struct sigaction action, oldaction;
  #endif
@@ -3603,15 +3732,10 @@ main(int argc, char *argv[])
  #if defined(__APPLE__) && defined(__LP64__)
      struct utsname       osinfo;
  #endif
  #if defined(__APPLE__) && defined(__LP64__)
      struct utsname       osinfo;
  #endif
+    GString             *str;
  
  #ifdef _WIN32
  
  #ifdef _WIN32
-    /* Convert our arg list to UTF-8. */
-    wc_argv = CommandLineToArgvW(GetCommandLineW(), &wc_argc);
-    if (wc_argv && wc_argc == argc) {
-        for (i = 0; i < argc; i++) {
-            argv[i] = g_utf16_to_utf8(wc_argv[i], -1, NULL, NULL, NULL);
-        }
-    } /* XXX else bail because something is horribly, horribly wrong? */
+    arg_list_utf_16to8(argc, argv);
  #endif /* _WIN32 */
  
  #ifdef _WIN32
  #endif /* _WIN32 */
  
  #ifdef _WIN32
@@ -3656,7 +3780,7 @@ main(int argc, char *argv[])
  #define OPTSTRING_d ""
  #endif
  
  #define OPTSTRING_d ""
  #endif
  
-#define OPTSTRING "a:" OPTSTRING_A "b:" OPTSTRING_B "c:" OPTSTRING_d "Df:ghi:" OPTSTRING_I "L" OPTSTRING_m "Mnpq" OPTSTRING_r "Ss:t" OPTSTRING_u "vw:y:Z:"
+#define OPTSTRING "a:" OPTSTRING_A "b:" OPTSTRING_B "c:" OPTSTRING_d "Df:ghi:" OPTSTRING_I "L" OPTSTRING_m "MnpPq" OPTSTRING_r "Ss:t" OPTSTRING_u "vw:y:Z:"
  
  #ifdef DEBUG_CHILD_DUMPCAP
      if ((debug_log = ws_fopen("dumpcap_debug_log.tmp","w")) == NULL) {
  
  #ifdef DEBUG_CHILD_DUMPCAP
      if ((debug_log = ws_fopen("dumpcap_debug_log.tmp","w")) == NULL) {
@@ -3753,9 +3877,14 @@ main(int argc, char *argv[])
                        log_flags,
                        console_log_handler, NULL /* user_data */);
  
                        log_flags,
                        console_log_handler, NULL /* user_data */);
  
+    /* Initialize the pcaps list */
+    global_ld.pcaps = g_array_new(FALSE, FALSE, sizeof(pcap_options *));
+
+#if !GLIB_CHECK_VERSION(2,31,0)
      /* Initialize the thread system */
      /* Initialize the thread system */
-    if (!g_thread_supported())
-        g_thread_init(NULL);
+    g_thread_init(NULL);
+#endif
+
  #ifdef _WIN32
      /* Load wpcap if possible. Do this before collecting the run-time version information */
      load_wpcap();
  #ifdef _WIN32
      /* Load wpcap if possible. Do this before collecting the run-time version information */
      load_wpcap();
@@ -3883,9 +4012,6 @@ main(int argc, char *argv[])
         by the command line parameters. */
      capture_opts_init(&global_capture_opts, NULL);
  
         by the command line parameters. */
      capture_opts_init(&global_capture_opts, NULL);
  
-    /* Default to capturing the entire packet. */
-    global_capture_opts.snaplen             = WTAP_MAX_PACKET_SIZE;
-
      /* We always save to a file - if no file was specified, we save to a
         temporary file. */
      global_capture_opts.saving_to_file      = TRUE;
      /* We always save to a file - if no file was specified, we save to a
         temporary file. */
      global_capture_opts.saving_to_file      = TRUE;
@@ -3923,6 +4049,7 @@ main(int argc, char *argv[])
          case 'i':        /* Use interface x */
          case 'n':        /* Use pcapng format */
          case 'p':        /* Don't capture in promiscuous mode */
          case 'i':        /* Use interface x */
          case 'n':        /* Use pcapng format */
          case 'p':        /* Don't capture in promiscuous mode */
+        case 'P':        /* Use pcap format */
          case 's':        /* Set the snapshot (capture) length */
          case 'w':        /* Write to capture file x */
          case 'g':        /* enable group read accesson file(s) */
          case 's':        /* Set the snapshot (capture) length */
          case 'w':        /* Write to capture file x */
          case 'g':        /* enable group read accesson file(s) */
@@ -3974,7 +4101,6 @@ main(int argc, char *argv[])
          case 'q':        /* Quiet */
              quiet = TRUE;
              break;
          case 'q':        /* Quiet */
              quiet = TRUE;
              break;
-
          case 't':
              use_threads = TRUE;
              break;
          case 't':
              use_threads = TRUE;
              break;
@@ -4001,28 +4127,30 @@ main(int argc, char *argv[])
              machine_readable = TRUE;
              break;
          default:
              machine_readable = TRUE;
              break;
          default:
-        case '?':        /* Bad flag - print usage message */
              cmdarg_err("Invalid Option: %s", argv[optind-1]);
              cmdarg_err("Invalid Option: %s", argv[optind-1]);
+            /* FALLTHROUGH */
+        case '?':        /* Bad flag - print usage message */
              arg_error = TRUE;
              break;
          }
      }
              arg_error = TRUE;
              break;
          }
      }
-    argc -= optind;
-    argv += optind;
-    if (argc >= 1) {
-        /* user specified file name as regular command-line argument */
-        /* XXX - use it as the capture file name (or something else)? */
-        argc--;
-        argv++;
-    }
-
-    if (argc != 0) {
-        /*
-         * Extra command line arguments were specified; complain.
-         * XXX - interpret as capture filter, as tcpdump and tshark do?
-         */
-        cmdarg_err("Invalid argument: %s", argv[0]);
-        arg_error = TRUE;
+    if (!arg_error) {
+        argc -= optind;
+        argv += optind;
+        if (argc >= 1) {
+            /* user specified file name as regular command-line argument */
+            /* XXX - use it as the capture file name (or something else)? */
+            argc--;
+            argv++;
+        }
+        if (argc != 0) {
+            /*
+             * Extra command line arguments were specified; complain.
+             * XXX - interpret as capture filter, as tcpdump and tshark do?
+             */
+            cmdarg_err("Invalid argument: %s", argv[0]);
+            arg_error = TRUE;
+        }
      }
  
      if (arg_error) {
      }
  
      if (arg_error) {
@@ -4041,8 +4169,13 @@ main(int argc, char *argv[])
              exit_main(1);
          }
      } else {
              exit_main(1);
          }
      } else {
-        /* We're supposed to capture traffic; was the ring buffer option
-           specified and, if so, does it make sense? */
+        /* We're supposed to capture traffic; */
+        /* Are we capturing on multiple interface? If so, use threads and pcapng. */
+        if (global_capture_opts.ifaces->len > 1) {
+            use_threads = TRUE;
+            global_capture_opts.use_pcapng = TRUE;
+        }
+        /* Was the ring buffer option specified and, if so, does it make sense? */
          if (global_capture_opts.multi_files_on) {
              /* Ring buffer works only under certain conditions:
                 a) ring buffer does not work with temporary files;
          if (global_capture_opts.multi_files_on) {
              /* Ring buffer works only under certain conditions:
                 a) ring buffer does not work with temporary files;
@@ -4076,6 +4209,7 @@ main(int argc, char *argv[])
          if (if_list == NULL) {
              switch (err) {
              case CANT_GET_INTERFACE_LIST:
          if (if_list == NULL) {
              switch (err) {
              case CANT_GET_INTERFACE_LIST:
+            case DONT_HAVE_PCAP:
                  cmdarg_err("%s", err_str);
                  g_free(err_str);
                  exit_main(2);
                  cmdarg_err("%s", err_str);
                  g_free(err_str);
                  exit_main(2);
@@ -4124,11 +4258,41 @@ main(int argc, char *argv[])
  
      /* Let the user know what interfaces were chosen. */
      /* get_interface_descriptive_name() is not available! */
  
      /* Let the user know what interfaces were chosen. */
      /* get_interface_descriptive_name() is not available! */
-    for (j = 0; j < global_capture_opts.ifaces->len; j++) {
-        interface_options interface_opts;
+    if (capture_child) {
+        for (j = 0; j < global_capture_opts.ifaces->len; j++) {
+            interface_options interface_opts;
+
+            interface_opts = g_array_index(global_capture_opts.ifaces, interface_options, j);
+            g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "Interface: %s\n",
+                  interface_opts.name);
+        }
+    } else {
+        str = g_string_new("");
+#ifdef _WIN32
+        if (global_capture_opts.ifaces->len < 2) {
+#else
+        if (global_capture_opts.ifaces->len < 4) {
+#endif
+            for (j = 0; j < global_capture_opts.ifaces->len; j++) {
+                interface_options interface_opts;
  
  
-        interface_opts = g_array_index(global_capture_opts.ifaces, interface_options, j);
-        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "Interface: %s", interface_opts.name);
+                interface_opts = g_array_index(global_capture_opts.ifaces, interface_options, j);
+                if (j > 0) {
+                    if (global_capture_opts.ifaces->len > 2) {
+                        g_string_append_printf(str, ",");
+                    }
+                    g_string_append_printf(str, " ");
+                    if (j == global_capture_opts.ifaces->len - 1) {
+                        g_string_append_printf(str, "and ");
+                    }
+                }
+                g_string_append_printf(str, "%s", interface_opts.name);
+            }
+        } else {
+            g_string_append_printf(str, "%u interfaces", global_capture_opts.ifaces->len);
+        }
+        fprintf(stderr, "Capturing on %s\n", str->str);
+        g_string_free(str, TRUE);
      }
  
      if (list_link_layer_types) {
      }
  
      if (list_link_layer_types) {
@@ -4300,7 +4464,7 @@ report_packet_count(int packet_count)
      }
  }
  
      }
  }
  
-void
+static void
  report_new_capture_file(const char *filename)
  {
      if(capture_child) {
  report_new_capture_file(const char *filename)
  {
      if(capture_child) {
@@ -4334,23 +4498,34 @@ report_new_capture_file(const char *filename)
      }
  }
  
      }
  }
  
-void
-report_cfilter_error(const char *cfilter, const char *errmsg)
+static void
+report_cfilter_error(capture_options *capture_opts, guint i, const char *errmsg)
  {
  {
-    if (capture_child) {
-        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "Capture filter error: %s", errmsg);
-        pipe_write_block(2, SP_BAD_FILTER, errmsg);
-    } else {
-        fprintf(stderr,
-          "Invalid capture filter: \"%s\"!\n"
-          "\n"
-          "That string isn't a valid capture filter (%s).\n"
-          "See the User's Guide for a description of the capture filter syntax.\n",
-          cfilter, errmsg);
+    interface_options interface_opts;
+    char tmp[MSG_MAX_LENGTH+1+6];
+
+    if (i < capture_opts->ifaces->len) {
+        if (capture_child) {
+            g_snprintf(tmp, sizeof(tmp), "%u:%s", i, errmsg);
+            g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "Capture filter error: %s", errmsg);
+            pipe_write_block(2, SP_BAD_FILTER, tmp);
+        } else {
+            /*
+             * clopts_step_invalid_capfilter in test/suite-clopts.sh MUST match
+             * the error message below.
+             */
+            interface_opts = g_array_index(capture_opts->ifaces, interface_options, i);
+            cmdarg_err(
+              "Invalid capture filter: \"%s\" for interface %s!\n"
+              "\n"
+              "That string isn't a valid capture filter (%s).\n"
+              "See the User's Guide for a description of the capture filter syntax.",
+              interface_opts.cfilter, interface_opts.name, errmsg);
+        }
      }
  }
  
      }
  }
  
-void
+static void
  report_capture_error(const char *error_msg, const char *secondary_error_msg)
  {
      if(capture_child) {
  report_capture_error(const char *error_msg, const char *secondary_error_msg)
  {
      if(capture_child) {
@@ -4360,27 +4535,30 @@ report_capture_error(const char *error_msg, const char *secondary_error_msg)
              "Secondary Error: %s", secondary_error_msg);
          sync_pipe_errmsg_to_parent(2, error_msg, secondary_error_msg);
      } else {
              "Secondary Error: %s", secondary_error_msg);
          sync_pipe_errmsg_to_parent(2, error_msg, secondary_error_msg);
      } else {
-        fprintf(stderr, "%s\n", error_msg);
+        cmdarg_err("%s", error_msg);
          if (secondary_error_msg[0] != '\0')
          if (secondary_error_msg[0] != '\0')
-          fprintf(stderr, "%s\n", secondary_error_msg);
+          cmdarg_err_cont("%s", secondary_error_msg);
      }
  }
  
      }
  }
  
-void
+static void
  report_packet_drops(guint32 received, guint32 drops, gchar *name)
  {
  report_packet_drops(guint32 received, guint32 drops, gchar *name)
  {
-    char tmp1[SP_DECISIZE+1+1];
-    char tmp2[SP_DECISIZE+1+1];
+    char tmp[SP_DECISIZE+1+1];
  
  
-    g_snprintf(tmp1, sizeof(tmp1), "%u", received);
-    g_snprintf(tmp2, sizeof(tmp2), "%u", drops);
+    g_snprintf(tmp, sizeof(tmp), "%u", drops);
  
      if(capture_child) {
  
      if(capture_child) {
-        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "Packets captured/dropped on interface %s: %s/%s", name, tmp1, tmp2);
+        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+            "Packets received/dropped on interface %s: %u/%u",
+            name, received, drops);
          /* XXX: Need to provide interface id, changes to consumers required. */
          /* XXX: Need to provide interface id, changes to consumers required. */
-        pipe_write_block(2, SP_DROPS, tmp2);
+        pipe_write_block(2, SP_DROPS, tmp);
      } else {
      } else {
-        fprintf(stderr, "Packets captured/dropped on interface %s: %s/%s\n", name, tmp1, tmp2);
+        fprintf(stderr,
+            "Packets received/dropped on interface %s: %u/%u (%.1f%%)\n",
+            name, received, drops,
+            received ? 100.0 * received / (received + drops) : 0.0);
          /* stderr could be line buffered */
          fflush(stderr);
      }
          /* stderr could be line buffered */
          fflush(stderr);
      }
@@ -4444,6 +4622,6 @@ signal_pipe_check_running(void)
   * indent-tabs-mode: nil
   * End:
   *
   * indent-tabs-mode: nil
   * End:
   *
- * vi: set shiftwidth=4 tabstop=8 expandtab
+ * vi: set shiftwidth=4 tabstop=8 expandtab:
   * :indentSize=4:tabSize=8:noTabs=true:
   */
   * :indentSize=4:tabSize=8:noTabs=true:
   */