From Xiao Xiangquan:
[obnox/wireshark/wip.git] / dumpcap.c
index 4cc46366cae081809af283c6bd65171b1644a7fb..21e342c1ffb33067d5881ea7c431eefb2404bcf7 100644 (file)
--- a/dumpcap.c
+++ b/dumpcap.c
@@ -59,9 +59,7 @@
 #include <signal.h>
 #include <errno.h>
 
-#ifdef HAVE_GETOPT_H
-#include <getopt.h>
-#else
+#ifndef HAVE_GETOPT
 #include "wsutil/wsgetopt.h"
 #endif
 
@@ -81,6 +79,9 @@
 #include "version_info.h"
 
 #include "capture-pcap-util.h"
+#ifdef _WIN32
+#include "capture-wpcap.h"
+#endif /* _WIN32 */
 
 #include "pcapio.h"
 
@@ -134,10 +135,6 @@ FILE *debug_log;   /* for logging debug messages to  */
                    /*  is defined                    */
 #endif
 
-#ifdef _WIN32
-#define USE_THREADS
-#endif
-
 static GAsyncQueue *pcap_queue;
 static gint64 pcap_queue_bytes;
 static gint64 pcap_queue_packets;
@@ -218,12 +215,6 @@ typedef enum {
     INITFILTER_OTHER_ERROR
 } initfilter_status_t;
 
-typedef struct _pcap_queue_element {
-    guint              interface_id;
-    struct pcap_pkthdr phdr;
-    u_char             *pd;
-} pcap_queue_element;
-
 typedef struct _pcap_options {
     guint32        received;
     guint32        dropped;
@@ -247,9 +238,9 @@ typedef struct _pcap_options {
 #endif
     gboolean       cap_pipe_modified;     /* TRUE if data in the pipe uses modified pcap headers */
     gboolean       cap_pipe_byte_swapped; /* TRUE if data in the pipe is byte swapped */
-#ifdef USE_THREADS
+#if defined(_WIN32)
     char *         cap_pipe_buf;          /* Pointer to the data buffer we read into */
-#endif /* USE_THREADS */
+#endif
     int            cap_pipe_bytes_to_read;/* Used by cap_pipe_dispatch */
     int            cap_pipe_bytes_read;   /* Used by cap_pipe_dispatch */
     enum {
@@ -259,7 +250,7 @@ typedef struct _pcap_options {
         STATE_READ_DATA
     } cap_pipe_state;
     enum { PIPOK, PIPEOF, PIPERR, PIPNEXIST } cap_pipe_err;
-#ifdef USE_THREADS
+#if defined(_WIN32)
     GMutex *cap_pipe_read_mtx;
     GAsyncQueue *cap_pipe_pending_q, *cap_pipe_done_q;
 #endif
@@ -283,6 +274,12 @@ typedef struct _loop_data {
     guint32        autostop_files;
 } loop_data;
 
+typedef struct _pcap_queue_element {
+    pcap_options       *pcap_opts;
+    struct pcap_pkthdr phdr;
+    u_char             *pd;
+} pcap_queue_element;
+
 /*
  * Standard secondary message for unexpected errors.
  */
@@ -324,10 +321,10 @@ static gboolean need_timeout_workaround;
  * WaitForSingleObject. If it's less than 1000 WaitForSingleObject
  * will return immediately.
  */
-#ifndef USE_THREADS
-#define PIPE_READ_TIMEOUT   250000
-#else
+#if defined(_WIN32)
 #define PIPE_READ_TIMEOUT   100000
+#else
+#define PIPE_READ_TIMEOUT   250000
 #endif
 
 #define WRITER_THREAD_TIMEOUT 100000 /* usecs */
@@ -341,9 +338,9 @@ static capture_options global_capture_opts;
 static gboolean quiet = FALSE;
 static gboolean use_threads = FALSE;
 
-static void capture_loop_write_packet_cb(u_char *user, const struct pcap_pkthdr *phdr,
+static void capture_loop_write_packet_cb(u_char *pcap_opts_p, const struct pcap_pkthdr *phdr,
                                          const u_char *pd);
-static void capture_loop_queue_packet_cb(u_char *user, const struct pcap_pkthdr *phdr,
+static void capture_loop_queue_packet_cb(u_char *pcap_opts_p, const struct pcap_pkthdr *phdr,
                                          const u_char *pd);
 static void capture_loop_get_errmsg(char *errmsg, int errmsglen, const char *fname,
                                     int err, gboolean is_close);
@@ -354,7 +351,7 @@ static void report_new_capture_file(const char *filename);
 static void report_packet_count(int packet_count);
 static void report_packet_drops(guint32 received, guint32 drops, gchar *name);
 static void report_capture_error(const char *error_msg, const char *secondary_error_msg);
-static void report_cfilter_error(const char *cfilter, const char *errmsg);
+static void report_cfilter_error(capture_options *capture_opts, guint i, const char *errmsg);
 
 #define MSG_MAX_LENGTH 4096
 
@@ -367,7 +364,7 @@ print_usage(gboolean print_ver)
         output = stdout;
         fprintf(output,
                 "Dumpcap " VERSION "%s\n"
-                "Capture network packets and dump them into a libpcap file.\n"
+                "Capture network packets and dump them into a pcapng file.\n"
                 "See http://www.wireshark.org for more information.\n",
                 wireshark_svnversion);
     } else {
@@ -392,11 +389,11 @@ print_usage(gboolean print_ver)
 #ifdef HAVE_BPF_IMAGE
     fprintf(output, "  -d                       print generated BPF code for capture filter\n");
 #endif
-    fprintf(output, "  -S                       print statistics for each interface once every second\n");
+    fprintf(output, "  -S                       print statistics for each interface once per second\n");
     fprintf(output, "  -M                       for -D, -L, and -S, produce machine-readable output\n");
     fprintf(output, "\n");
 #ifdef HAVE_PCAP_REMOTE
-    fprintf(output, "\nRPCAP options:\n");
+    fprintf(output, "RPCAP options:\n");
     fprintf(output, "  -r                       don't ignore own RPCAP traffic in capture\n");
     fprintf(output, "  -u                       use UDP for RPCAP data transfer\n");
     fprintf(output, "  -A <user>:<password>     use RPCAP password authentication\n");
@@ -418,16 +415,17 @@ print_usage(gboolean print_ver)
     fprintf(output, "  -b <ringbuffer opt.> ... duration:NUM - switch to next file after NUM secs\n");
     fprintf(output, "                           filesize:NUM - switch to next file after NUM KB\n");
     fprintf(output, "                              files:NUM - ringbuffer: replace after NUM files\n");
-    fprintf(output, "  -n                       use pcapng format instead of pcap\n");
-    /*fprintf(output, "\n");*/
+    fprintf(output, "  -n                       use pcapng format instead of pcap (default)\n");
+    fprintf(output, "  -P                       use libpcap format instead of pcapng\n");
+    fprintf(output, "\n");
     fprintf(output, "Miscellaneous:\n");
     fprintf(output, "  -t                       use a separate thread per interface\n");
     fprintf(output, "  -q                       don't report packet capture counts\n");
     fprintf(output, "  -v                       print version information and exit\n");
     fprintf(output, "  -h                       display this help and exit\n");
     fprintf(output, "\n");
-    fprintf(output, "Example: dumpcap -i eth0 -a duration:60 -w output.pcap\n");
-    fprintf(output, "\"Capture network packets from interface eth0 until 60s passed into output.pcap\"\n");
+    fprintf(output, "Example: dumpcap -i eth0 -a duration:60 -w output.pcapng\n");
+    fprintf(output, "\"Capture network packets from interface eth0 until 60s passed into output.pcapng\"\n");
     fprintf(output, "\n");
     fprintf(output, "Use Ctrl-C to stop capturing at any time.\n");
 }
@@ -539,7 +537,7 @@ relinquish_all_capabilities(void)
     cap_t caps = cap_init();    /* all capabilities initialized to off */
     print_caps("Pre-clear");
     if (cap_set_proc(caps)) {
-        cmdarg_err("cap_set_proc() fail return: %s", strerror(errno));
+        cmdarg_err("cap_set_proc() fail return: %s", g_strerror(errno));
     }
     print_caps("Post-clear");
     cap_free(caps);
@@ -562,6 +560,7 @@ open_capture_device(interface_options *interface_opts,
        Some versions of libpcap may put warnings into the error buffer
        if they succeed; to tell if that's happened, we have to clear
        the error buffer, and check if it's still a null string.  */
+    g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "Entering open_capture_device().");
     (*open_err_str)[0] = '\0';
 #if defined(HAVE_PCAP_OPEN) && defined(HAVE_PCAP_REMOTE)
     /*
@@ -574,12 +573,18 @@ open_capture_device(interface_options *interface_opts,
         auth.username = interface_opts->auth_username;
         auth.password = interface_opts->auth_password;
 
+        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+              "Calling pcap_open() using name %s, snaplen %d, promisc_mode %d, datatx_udp %d, nocap_rpcap %d.",
+              interface_opts->name, interface_opts->snaplen, interface_opts->promisc_mode,
+              interface_opts->datatx_udp, interface_opts->nocap_rpcap);
         pcap_h = pcap_open(interface_opts->name, interface_opts->snaplen,
                            /* flags */
                            (interface_opts->promisc_mode ? PCAP_OPENFLAG_PROMISCUOUS : 0) |
                            (interface_opts->datatx_udp ? PCAP_OPENFLAG_DATATX_UDP : 0) |
                            (interface_opts->nocap_rpcap ? PCAP_OPENFLAG_NOCAPTURE_RPCAP : 0),
                            CAP_READ_TIMEOUT, &auth, *open_err_str);
+        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+              "pcap_open() returned %p.", (void *)pcap_h);
     } else
 #endif
     {
@@ -589,18 +594,32 @@ open_capture_device(interface_options *interface_opts,
          * size, otherwise use pcap_open_live().
          */
 #ifdef HAVE_PCAP_CREATE
+        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+              "Calling pcap_create() using %s.", interface_opts->name);
         pcap_h = pcap_create(interface_opts->name, *open_err_str);
+        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+              "pcap_create() returned %p.", (void *)pcap_h);
         if (pcap_h != NULL) {
+            g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+                  "Calling pcap_set_snaplen() with snaplen %d.", interface_opts->snaplen);
             pcap_set_snaplen(pcap_h, interface_opts->snaplen);
+            g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+                  "Calling pcap_set_snaplen() with promisc_mode %d.", interface_opts->promisc_mode);
             pcap_set_promisc(pcap_h, interface_opts->promisc_mode);
             pcap_set_timeout(pcap_h, CAP_READ_TIMEOUT);
 
+            g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+                  "buffersize %d.", interface_opts->buffer_size);
             if (interface_opts->buffer_size > 1) {
                 pcap_set_buffer_size(pcap_h, interface_opts->buffer_size * 1024 * 1024);
             }
+            g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+                  "monitor_mode %d.", interface_opts->monitor_mode);
             if (interface_opts->monitor_mode)
                 pcap_set_rfmon(pcap_h, 1);
             err = pcap_activate(pcap_h);
+            g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+                  "pcap_activate() returned %d.", err);
             if (err < 0) {
                 /* Failed to activate, set to NULL */
                 if (err == PCAP_ERROR)
@@ -612,11 +631,17 @@ open_capture_device(interface_options *interface_opts,
             }
         }
 #else
+        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+              "pcap_open_live() calling using name %s, snaplen %d, promisc_mode %d.",
+              interface_opts->name, interface_opts->snaplen, interface_opts->promisc_mode);
         pcap_h = pcap_open_live(interface_opts->name, interface_opts->snaplen,
                                 interface_opts->promisc_mode, CAP_READ_TIMEOUT,
                                 *open_err_str);
+        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG,
+              "pcap_open_live() returned %p.", (void *)pcap_h);
 #endif
     }
+    g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "open_capture_device %s : %s", pcap_h ? "SUCCESS" : "FAILURE", interface_opts->name);
     return pcap_h;
 }
 
@@ -655,21 +680,40 @@ get_capture_device_open_failure_messages(const char *open_err_str,
         libpcap_warn = "";
     g_snprintf(errmsg, (gulong) errmsg_len,
                "The capture session could not be initiated (%s).", open_err_str);
-#ifndef _WIN32
+#ifdef _WIN32
+    if (!has_wpcap) {
+      g_snprintf(secondary_errmsg, (gulong) secondary_errmsg_len,
+                 "\n"
+                 "In order to capture packets, WinPcap must be installed; see\n"
+                 "\n"
+                 "        http://www.winpcap.org/\n"
+                 "\n"
+                 "or the mirror at\n"
+                 "\n"
+                 "        http://www.mirrors.wiretapped.net/security/packet-capture/winpcap/\n"
+                 "\n"
+                 "or the mirror at\n"
+                 "\n"
+                 "        http://winpcap.cs.pu.edu.tw/\n"
+                 "\n"
+                 "for a downloadable version of WinPcap and for instructions on how to install\n"
+                 "WinPcap.");
+    } else {
+      g_snprintf(secondary_errmsg, (gulong) secondary_errmsg_len,
+                 "\n"
+                 "Please check that \"%s\" is the proper interface.\n"
+                 "\n"
+                 "\n"
+                 "Help can be found at:\n"
+                 "\n"
+                 "       http://wiki.wireshark.org/WinPcap\n"
+                 "       http://wiki.wireshark.org/CaptureSetup\n",
+                 iface);
+    }
+#else
     g_snprintf(secondary_errmsg, (gulong) secondary_errmsg_len,
                "Please check to make sure you have sufficient permissions, and that you have "
                "the proper interface or pipe specified.%s", libpcap_warn);
-#else
-    g_snprintf(secondary_errmsg, (gulong) secondary_errmsg_len,
-               "\n"
-               "Please check that \"%s\" is the proper interface.\n"
-               "\n"
-               "\n"
-               "Help can be found at:\n"
-               "\n"
-               "       http://wiki.wireshark.org/WinPcap\n"
-               "       http://wiki.wireshark.org/CaptureSetup\n",
-               iface);
 #endif /* _WIN32 */
 }
 
@@ -733,7 +777,13 @@ compile_capture_filter(const char *iface, pcap_t *pcap_h,
           "Warning:  Couldn't obtain netmask info (%s).", lookup_net_err_str);*/
         netmask = 0;
     }
-    if (pcap_compile(pcap_h, fcode, cfilter, 1, netmask) < 0)
+
+    /*
+     * Sigh.  Older versions of libpcap don't properly declare the
+     * third argument to pcap_compile() as a const pointer.  Cast
+     * away the warning.
+     */
+    if (pcap_compile(pcap_h, fcode, (char *)cfilter, 1, netmask) < 0)
         return FALSE;
     return TRUE;
 }
@@ -780,7 +830,7 @@ show_filter_code(capture_options *capture_opts)
         if (!compile_capture_filter(interface_opts.name, pcap_h, &fcode,
                                     interface_opts.cfilter)) {
             pcap_close(pcap_h);
-            report_cfilter_error(interface_opts.cfilter, errmsg);
+            report_cfilter_error(capture_opts, j, errmsg);
             return FALSE;
         }
         pcap_close(pcap_h);
@@ -1252,6 +1302,7 @@ print_statistics_loop(gboolean machine_readable)
     if (if_list == NULL) {
         switch (err) {
         case CANT_GET_INTERFACE_LIST:
+        case DONT_HAVE_PCAP:
             cmdarg_err("%s", err_str);
             g_free(err_str);
             break;
@@ -1461,14 +1512,14 @@ relinquish_privs_except_capture(void)
         print_caps("Pre drop, pre set");
 
         if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) == -1) {
-            cmdarg_err("prctl() fail return: %s", strerror(errno));
+            cmdarg_err("prctl() fail return: %s", g_strerror(errno));
         }
 
         cap_set_flag(caps, CAP_PERMITTED,   cl_len, cap_list, CAP_SET);
         cap_set_flag(caps, CAP_INHERITABLE, cl_len, cap_list, CAP_SET);
 
         if (cap_set_proc(caps)) {
-            cmdarg_err("cap_set_proc() fail return: %s", strerror(errno));
+            cmdarg_err("cap_set_proc() fail return: %s", g_strerror(errno));
         }
         print_caps("Pre drop, post set");
 
@@ -1477,7 +1528,7 @@ relinquish_privs_except_capture(void)
         print_caps("Post drop, pre set");
         cap_set_flag(caps, CAP_EFFECTIVE,   cl_len, cap_list, CAP_SET);
         if (cap_set_proc(caps)) {
-            cmdarg_err("cap_set_proc() fail return: %s", strerror(errno));
+            cmdarg_err("cap_set_proc() fail return: %s", g_strerror(errno));
         }
         print_caps("Post drop, post set");
 
@@ -1518,7 +1569,7 @@ cap_pipe_adjust_header(gboolean byte_swapped, struct pcap_hdr *hdr, struct pcapr
     }
 }
 
-#ifdef USE_THREADS
+#if defined(_WIN32)
 /*
  * Thread function that reads from a pipe and pushes the data
  * to the main application thread.
@@ -1604,8 +1655,9 @@ static void *cap_pipe_read(void *arg)
     }
     return NULL;
 }
-#endif /* USE_THREADS */
+#endif
 
+#if !defined(_WIN32) || defined(MUST_DO_SELECT)
 /* Provide select() functionality for a single file descriptor
  * on UNIX/POSIX. Windows uses cap_pipe_read via a thread.
  *
@@ -1625,6 +1677,7 @@ cap_pipe_select(int pipe_fd)
 
     return select(pipe_fd+1, &rfds, NULL, NULL, &timeout);
 }
+#endif
 
 
 /* Mimic pcap_open_live() for pipe captures
@@ -1651,7 +1704,7 @@ cap_pipe_open_live(char *pipename,
     wchar_t *err_str;
 #endif
 #endif
-#ifndef USE_THREADS
+#ifndef _WIN32
     int          sel_ret;
     unsigned int bytes_read;
 #endif
@@ -1682,7 +1735,7 @@ cap_pipe_open_live(char *pipename,
             else {
                 g_snprintf(errmsg, errmsgl,
                            "The capture session could not be initiated "
-                           "due to error getting information on pipe/socket: %s", strerror(errno));
+                           "due to error getting information on pipe/socket: %s", g_strerror(errno));
                 pcap_opts->cap_pipe_err = PIPERR;
             }
             return;
@@ -1692,7 +1745,7 @@ cap_pipe_open_live(char *pipename,
             if (fd == -1) {
                 g_snprintf(errmsg, errmsgl,
                            "The capture session could not be initiated "
-                           "due to error on pipe open: %s", strerror(errno));
+                           "due to error on pipe open: %s", g_strerror(errno));
                 pcap_opts->cap_pipe_err = PIPERR;
                 return;
             }
@@ -1701,7 +1754,7 @@ cap_pipe_open_live(char *pipename,
             if (fd == -1) {
                 g_snprintf(errmsg, errmsgl,
                            "The capture session could not be initiated "
-                           "due to error on socket create: %s", strerror(errno));
+                           "due to error on socket create: %s", g_strerror(errno));
                 pcap_opts->cap_pipe_err = PIPERR;
                 return;
             }
@@ -1741,7 +1794,7 @@ cap_pipe_open_live(char *pipename,
             if (b == -1) {
                 g_snprintf(errmsg, errmsgl,
                            "The capture session coud not be initiated "
-                           "due to error on socket connect: %s", strerror(errno));
+                           "due to error on socket connect: %s", g_strerror(errno));
                 pcap_opts->cap_pipe_err = PIPERR;
                 return;
             }
@@ -1820,14 +1873,14 @@ cap_pipe_open_live(char *pipename,
 
     pcap_opts->from_cap_pipe = TRUE;
 
-#ifndef USE_THREADS
+#ifndef _WIN32
     /* read the pcap header */
     bytes_read = 0;
     while (bytes_read < sizeof magic) {
         sel_ret = cap_pipe_select(fd);
         if (sel_ret < 0) {
             g_snprintf(errmsg, errmsgl,
-                       "Unexpected error from select: %s", strerror(errno));
+                       "Unexpected error from select: %s", g_strerror(errno));
             goto error;
         } else if (sel_ret > 0) {
             b = read(fd, ((char *)&magic)+bytes_read, sizeof magic-bytes_read);
@@ -1836,13 +1889,13 @@ cap_pipe_open_live(char *pipename,
                     g_snprintf(errmsg, errmsgl, "End of file on pipe magic during open");
                 else
                     g_snprintf(errmsg, errmsgl, "Error on pipe magic during open: %s",
-                               strerror(errno));
+                               g_strerror(errno));
                 goto error;
             }
             bytes_read += b;
         }
     }
-#else /* USE_THREADS */
+#else
     g_thread_create(&cap_pipe_read, pcap_opts, FALSE, NULL);
 
     pcap_opts->cap_pipe_buf = (char *) &magic;
@@ -1856,11 +1909,11 @@ cap_pipe_open_live(char *pipename,
             g_snprintf(errmsg, errmsgl, "End of file on pipe magic during open");
         else
             g_snprintf(errmsg, errmsgl, "Error on pipe magic during open: %s",
-                       strerror(errno));
+                       g_strerror(errno));
         goto error;
     }
 
-#endif /* USE_THREADS */
+#endif
 
     switch (magic) {
     case PCAP_MAGIC:
@@ -1895,14 +1948,14 @@ cap_pipe_open_live(char *pipename,
         goto error;
     }
 
-#ifndef USE_THREADS
+#ifndef _WIN32
     /* Read the rest of the header */
     bytes_read = 0;
     while (bytes_read < sizeof(struct pcap_hdr)) {
         sel_ret = cap_pipe_select(fd);
         if (sel_ret < 0) {
             g_snprintf(errmsg, errmsgl,
-                       "Unexpected error from select: %s", strerror(errno));
+                       "Unexpected error from select: %s", g_strerror(errno));
             goto error;
         } else if (sel_ret > 0) {
             b = read(fd, ((char *)hdr)+bytes_read,
@@ -1912,13 +1965,13 @@ cap_pipe_open_live(char *pipename,
                     g_snprintf(errmsg, errmsgl, "End of file on pipe header during open");
                 else
                     g_snprintf(errmsg, errmsgl, "Error on pipe header during open: %s",
-                               strerror(errno));
+                               g_strerror(errno));
                 goto error;
             }
             bytes_read += b;
         }
     }
-#else /* USE_THREADS */
+#else
     pcap_opts->cap_pipe_buf = (char *) hdr;
     pcap_opts->cap_pipe_bytes_read = 0;
     pcap_opts->cap_pipe_bytes_to_read = sizeof(struct pcap_hdr);
@@ -1929,10 +1982,10 @@ cap_pipe_open_live(char *pipename,
             g_snprintf(errmsg, errmsgl, "End of file on pipe header during open");
         else
             g_snprintf(errmsg, errmsgl, "Error on pipe header header during open: %s",
-                       strerror(errno));
+                       g_strerror(errno));
         goto error;
     }
-#endif /* USE_THREADS */
+#endif
 
     if (pcap_opts->cap_pipe_byte_swapped) {
         /* Byte-swap the header fields about which we care. */
@@ -1975,7 +2028,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
     struct pcap_pkthdr phdr;
     enum { PD_REC_HDR_READ, PD_DATA_READ, PD_PIPE_EOF, PD_PIPE_ERR,
            PD_ERR } result;
-#ifdef USE_THREADS
+#ifdef _WIN32
     GTimeVal wait_time;
     gpointer q_status;
 #else
@@ -1992,7 +2045,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
     switch (pcap_opts->cap_pipe_state) {
 
     case STATE_EXPECT_REC_HDR:
-#ifdef USE_THREADS
+#ifdef _WIN32
         if (g_mutex_trylock(pcap_opts->cap_pipe_read_mtx)) {
 #endif
 
@@ -2001,7 +2054,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
                 sizeof(struct pcaprec_modified_hdr) : sizeof(struct pcaprec_hdr);
             pcap_opts->cap_pipe_bytes_read = 0;
 
-#ifdef USE_THREADS
+#ifdef _WIN32
             pcap_opts->cap_pipe_buf = (char *) &pcap_opts->cap_pipe_rechdr;
             g_async_queue_push(pcap_opts->cap_pipe_pending_q, pcap_opts->cap_pipe_buf);
             g_mutex_unlock(pcap_opts->cap_pipe_read_mtx);
@@ -2010,7 +2063,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
         /* Fall through */
 
     case STATE_READ_REC_HDR:
-#ifndef USE_THREADS
+#ifndef _WIN32
         b = read(pcap_opts->cap_pipe_fd, ((char *)&pcap_opts->cap_pipe_rechdr)+pcap_opts->cap_pipe_bytes_read,
                  pcap_opts->cap_pipe_bytes_to_read - pcap_opts->cap_pipe_bytes_read);
         if (b <= 0) {
@@ -2021,7 +2074,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
             break;
         }
         pcap_opts->cap_pipe_bytes_read += b;
-#else /* USE_THREADS */
+#else
         g_get_current_time(&wait_time);
         g_time_val_add(&wait_time, PIPE_READ_TIMEOUT);
         q_status = g_async_queue_timed_pop(pcap_opts->cap_pipe_done_q, &wait_time);
@@ -2035,14 +2088,14 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
         if (!q_status) {
             return 0;
         }
-#endif /* USE_THREADS */
+#endif
         if ((pcap_opts->cap_pipe_bytes_read) < pcap_opts->cap_pipe_bytes_to_read)
             return 0;
         result = PD_REC_HDR_READ;
         break;
 
     case STATE_EXPECT_DATA:
-#ifdef USE_THREADS
+#ifdef _WIN32
         if (g_mutex_trylock(pcap_opts->cap_pipe_read_mtx)) {
 #endif
 
@@ -2050,7 +2103,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
             pcap_opts->cap_pipe_bytes_to_read = pcap_opts->cap_pipe_rechdr.hdr.incl_len;
             pcap_opts->cap_pipe_bytes_read = 0;
 
-#ifdef USE_THREADS
+#ifdef _WIN32
             pcap_opts->cap_pipe_buf = (char *) data;
             g_async_queue_push(pcap_opts->cap_pipe_pending_q, pcap_opts->cap_pipe_buf);
             g_mutex_unlock(pcap_opts->cap_pipe_read_mtx);
@@ -2059,7 +2112,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
         /* Fall through */
 
     case STATE_READ_DATA:
-#ifndef USE_THREADS
+#ifndef _WIN32
         b = read(pcap_opts->cap_pipe_fd, data+pcap_opts->cap_pipe_bytes_read,
                  pcap_opts->cap_pipe_bytes_to_read - pcap_opts->cap_pipe_bytes_read);
         if (b <= 0) {
@@ -2070,7 +2123,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
             break;
         }
         pcap_opts->cap_pipe_bytes_read += b;
-#else /* USE_THREADS */
+#else
         g_get_current_time(&wait_time);
         g_time_val_add(&wait_time, PIPE_READ_TIMEOUT);
         q_status = g_async_queue_timed_pop(pcap_opts->cap_pipe_done_q, &wait_time);
@@ -2084,7 +2137,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
         if (!q_status) {
             return 0;
         }
-#endif /* USE_THREADS */
+#endif
         if ((pcap_opts->cap_pipe_bytes_read) < pcap_opts->cap_pipe_bytes_to_read)
             return 0;
         result = PD_DATA_READ;
@@ -2110,8 +2163,12 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
                        ld->packet_count+1, pcap_opts->cap_pipe_rechdr.hdr.incl_len);
             break;
         }
-        pcap_opts->cap_pipe_state = STATE_EXPECT_DATA;
-        return 0;
+
+        if (pcap_opts->cap_pipe_rechdr.hdr.incl_len) {
+            pcap_opts->cap_pipe_state = STATE_EXPECT_DATA;
+            return 0;
+        }
+        /* no data to read? fall through */
 
     case PD_DATA_READ:
         /* Fill in a "struct pcap_pkthdr", and process the packet. */
@@ -2142,7 +2199,7 @@ cap_pipe_dispatch(loop_data *ld, pcap_options *pcap_opts, guchar *data, char *er
         LocalFree(err_str);
 #else
         g_snprintf(errmsg, errmsgl, "Error reading from pipe: %s",
-                   strerror(errno));
+                   g_strerror(errno));
 #endif
         /* Fall through */
     case PD_ERR:
@@ -2224,7 +2281,7 @@ capture_loop_open_input(capture_options *capture_opts, loop_data *ld,
     if ((use_threads == FALSE) &&
         (capture_opts->ifaces->len > 1)) {
         g_snprintf(errmsg, (gulong) errmsg_len,
-                   "Using threads is required for capturing on mulitple interfaces! Use the -t option.");
+                   "Using threads is required for capturing on mulitple interfaces!");
         return FALSE;
     }
 
@@ -2257,15 +2314,20 @@ capture_loop_open_input(capture_options *capture_opts, loop_data *ld,
 #endif
         pcap_opts->cap_pipe_modified = FALSE;
         pcap_opts->cap_pipe_byte_swapped = FALSE;
-#ifdef USE_THREADS
+#ifdef _WIN32
         pcap_opts->cap_pipe_buf = NULL;
-#endif /* USE_THREADS */
+#endif
         pcap_opts->cap_pipe_bytes_to_read = 0;
         pcap_opts->cap_pipe_bytes_read = 0;
         pcap_opts->cap_pipe_state = 0;
         pcap_opts->cap_pipe_err = PIPOK;
-#ifdef USE_THREADS
+#ifdef _WIN32
+#if GLIB_CHECK_VERSION(2,31,0)
+        pcap_opts->cap_pipe_read_mtx = g_malloc(sizeof(GMutex));
+        g_mutex_init(pcap_opts->cap_pipe_read_mtx);
+#else
         pcap_opts->cap_pipe_read_mtx = g_mutex_new();
+#endif
         pcap_opts->cap_pipe_pending_q = g_async_queue_new();
         pcap_opts->cap_pipe_done_q = g_async_queue_new();
 #endif
@@ -2517,7 +2579,6 @@ capture_loop_init_output(capture_options *capture_opts, loop_data *ld, char *err
                                                                        &err);
             }
         } else {
-            interface_opts = g_array_index(capture_opts->ifaces, interface_options, 0);
             pcap_opts = g_array_index(ld->pcaps, pcap_options *, 0);
             if (pcap_opts->from_cap_pipe) {
                 pcap_opts->snaplen = pcap_opts->cap_pipe_hdr.snaplen;
@@ -2548,7 +2609,7 @@ capture_loop_init_output(capture_options *capture_opts, loop_data *ld, char *err
                 g_snprintf(errmsg, errmsg_len,
                            "The file to which the capture would be"
                            " saved (\"%s\") could not be opened: %s.",
-                           capture_opts->save_file, strerror(err));
+                           capture_opts->save_file, g_strerror(err));
             }
             break;
         }
@@ -2601,7 +2662,7 @@ capture_loop_dispatch(loop_data *ld,
     int       inpkts;
     gint      packet_count_before;
     guchar    pcap_data[WTAP_MAX_PACKET_SIZE];
-#ifndef USE_THREADS
+#ifndef _WIN32
     int       sel_ret;
 #endif
 
@@ -2611,12 +2672,12 @@ capture_loop_dispatch(loop_data *ld,
 #ifdef LOG_CAPTURE_VERBOSE
         g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "capture_loop_dispatch: from capture pipe");
 #endif
-#ifndef USE_THREADS
+#ifndef _WIN32
         sel_ret = cap_pipe_select(pcap_opts->cap_pipe_fd);
         if (sel_ret <= 0) {
             if (sel_ret < 0 && errno != EINTR) {
                 g_snprintf(errmsg, errmsg_len,
-                           "Unexpected error from select: %s", strerror(errno));
+                           "Unexpected error from select: %s", g_strerror(errno));
                 report_capture_error(errmsg, please_report);
                 ld->go = FALSE;
             }
@@ -2624,12 +2685,12 @@ capture_loop_dispatch(loop_data *ld,
             /*
              * "select()" says we can read from the pipe without blocking
              */
-#endif /* USE_THREADS */
+#endif
             inpkts = cap_pipe_dispatch(ld, pcap_opts, pcap_data, errmsg, errmsg_len);
             if (inpkts < 0) {
                 ld->go = FALSE;
             }
-#ifndef USE_THREADS
+#ifndef _WIN32
         }
 #endif
     }
@@ -2680,7 +2741,7 @@ capture_loop_dispatch(loop_data *ld,
             } else {
                 if (sel_ret < 0 && errno != EINTR) {
                     g_snprintf(errmsg, errmsg_len,
-                               "Unexpected error from select: %s", strerror(errno));
+                               "Unexpected error from select: %s", g_strerror(errno));
                     report_capture_error(errmsg, please_report);
                     ld->go = FALSE;
                 }
@@ -2855,15 +2916,17 @@ capture_loop_open_output(capture_options *capture_opts, int *save_file_fd,
         if (global_capture_opts.ifaces->len > 1) {
             prefix = g_strdup_printf("wireshark_%d_interfaces", global_capture_opts.ifaces->len);
         } else {
+            gchar *basename;
 #ifdef _WIN32
             GString *iface;
-
             iface = isolate_uuid(g_array_index(global_capture_opts.ifaces, interface_options, 0).name);
-            prefix = g_strconcat("wireshark_", g_basename(iface->str), NULL);
+            basename = g_path_get_basename(iface->str);
             g_string_free(iface, TRUE);
 #else
-            prefix = g_strconcat("wireshark_", g_basename(g_array_index(global_capture_opts.ifaces, interface_options, 0).name), NULL);
+            basename = g_path_get_basename(g_array_index(global_capture_opts.ifaces, interface_options, 0).name);
 #endif
+            prefix = g_strconcat("wireshark_", basename, NULL);
+            g_free(basename);
         }
         *save_file_fd = create_tempfile(&tmpname, prefix);
         g_free(prefix);
@@ -2876,7 +2939,7 @@ capture_loop_open_output(capture_options *capture_opts, int *save_file_fd,
         if (is_tempfile) {
             g_snprintf(errmsg, errmsg_len,
                        "The temporary file to which the capture would be saved (\"%s\") "
-                       "could not be opened: %s.", capfile_name, strerror(errno));
+                       "could not be opened: %s.", capfile_name, g_strerror(errno));
         } else {
             if (capture_opts->multi_files_on) {
                 ringbuf_error_cleanup();
@@ -2885,7 +2948,7 @@ capture_loop_open_output(capture_options *capture_opts, int *save_file_fd,
             g_snprintf(errmsg, errmsg_len,
                        "The file to which the capture would be saved (\"%s\") "
                        "could not be opened: %s.", capfile_name,
-                       strerror(errno));
+                       g_strerror(errno));
         }
         g_free(capfile_name);
         return FALSE;
@@ -2946,7 +3009,6 @@ do_file_switch_or_stop(capture_options *capture_opts,
                                                                            &global_ld.err);
                 }
             } else {
-                interface_opts = g_array_index(capture_opts->ifaces, interface_options, 0);
                 pcap_opts = g_array_index(global_ld.pcaps, pcap_options *, 0);
                 successful = libpcap_write_file_header(global_ld.pdh, pcap_opts->linktype, pcap_opts->snaplen,
                                                        &global_ld.bytes_written, &global_ld.err);
@@ -3006,7 +3068,7 @@ static gboolean
 capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct pcap_stat *stats)
 {
 #ifdef WIN32
-    time_t upd_time, cur_time;
+    DWORD upd_time, cur_time;   /* GetTickCount() returns a "DWORD" (which is 'unsigned long') */
 #else
     struct timeval upd_time, cur_time;
 #endif
@@ -3023,9 +3085,8 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
     char        secondary_errmsg[MSG_MAX_LENGTH+1];
     pcap_options *pcap_opts;
     interface_options interface_opts;
-    guint i;
+    guint i, error_index = 0;
 
-    interface_opts = capture_opts->default_options;
     *errmsg           = '\0';
     *secondary_errmsg = '\0';
 
@@ -3074,6 +3135,7 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
 
         case INITFILTER_BAD_FILTER:
             cfilter_error = TRUE;
+            error_index = i;
             g_snprintf(errmsg, sizeof(errmsg), "%s", pcap_geterr(pcap_opts->pcap_h));
             goto error;
 
@@ -3153,10 +3215,14 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
         pcap_queue_packets = 0;
         for (i = 0; i < global_ld.pcaps->len; i++) {
             pcap_opts = g_array_index(global_ld.pcaps, pcap_options *, i);
+#if GLIB_CHECK_VERSION(2,31,0)
+            /* XXX - Add an interface name here? */
+            pcap_opts->tid = g_thread_new("Capture read", pcap_read_handler, pcap_opts);
+#else
             pcap_opts->tid = g_thread_create(pcap_read_handler, pcap_opts, TRUE, NULL);
+#endif
         }
     }
-    pcap_opts = g_array_index(global_ld.pcaps, pcap_options *, 0);
     while (global_ld.go) {
         /* dispatch incoming packets */
         if (use_threads) {
@@ -3175,9 +3241,9 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
             if (queue_element) {
                 g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO,
                       "Dequeued a packet of length %d captured on interface %d.",
-                      queue_element->phdr.caplen, queue_element->interface_id);
+                      queue_element->phdr.caplen, queue_element->pcap_opts->interface_id);
 
-                capture_loop_write_packet_cb((u_char *)&queue_element->interface_id,
+                capture_loop_write_packet_cb((u_char *) queue_element->pcap_opts,
                                              &queue_element->phdr,
                                              queue_element->pd);
                 g_free(queue_element->pd);
@@ -3187,6 +3253,7 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
                 inpkts = 0;
             }
         } else {
+            pcap_opts = g_array_index(global_ld.pcaps, pcap_options *, 0);
             inpkts = capture_loop_dispatch(&global_ld, errmsg,
                                            sizeof(errmsg), pcap_opts);
         }
@@ -3229,8 +3296,8 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
 #define DUMPCAP_UPD_TIME 500
 
 #ifdef WIN32
-        cur_time = GetTickCount();
-        if ( (cur_time - upd_time) > DUMPCAP_UPD_TIME) {
+        cur_time = GetTickCount();  /* Note: wraps to 0 if sys runs for 49.7 days */
+        if ((cur_time - upd_time) > DUMPCAP_UPD_TIME) { /* wrap just causes an extra update */
 #else
         gettimeofday(&cur_time, NULL);
         if ((cur_time.tv_sec * 1000000 + cur_time.tv_usec) >
@@ -3299,8 +3366,8 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
             }
             g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO,
                   "Dequeued a packet of length %d captured on interface %d.",
-                  queue_element->phdr.caplen, queue_element->interface_id);
-            capture_loop_write_packet_cb((u_char *)&queue_element->interface_id,
+                  queue_element->phdr.caplen, queue_element->pcap_opts->interface_id);
+            capture_loop_write_packet_cb((u_char *)queue_element->pcap_opts,
                                          &queue_element->phdr,
                                          queue_element->pd);
             g_free(queue_element->pd);
@@ -3330,7 +3397,7 @@ capture_loop_start(capture_options *capture_opts, gboolean *stats_known, struct
             /* On Linux, if an interface goes down while you're capturing on it,
                you'll get a "recvfrom: Network is down" or
                "The interface went down" error (ENETDOWN).
-               (At least you will if strerror() doesn't show a local translation
+               (At least you will if g_strerror() doesn't show a local translation
                of the error.)
 
                On FreeBSD and OS X, if a network adapter disappears while
@@ -3459,7 +3526,7 @@ error:
     }
     capture_opts->save_file = NULL;
     if (cfilter_error)
-        report_cfilter_error(interface_opts.cfilter, errmsg);
+        report_cfilter_error(capture_opts, error_index, errmsg);
     else
         report_capture_error(errmsg, secondary_errmsg);
 
@@ -3520,13 +3587,13 @@ capture_loop_get_errmsg(char *errmsg, int errmsglen, const char *fname,
             g_snprintf(errmsg, errmsglen,
                        "The file to which the capture was being saved\n"
                        "(\"%s\") could not be closed: %s.",
-                       fname, strerror(err));
+                       fname, g_strerror(err));
         } else {
             g_snprintf(errmsg, errmsglen,
                        "An error occurred while writing to the file"
                        " to which the capture was being saved\n"
                        "(\"%s\"): %s.",
-                       fname, strerror(err));
+                       fname, g_strerror(err));
         }
         break;
     }
@@ -3535,10 +3602,10 @@ capture_loop_get_errmsg(char *errmsg, int errmsglen, const char *fname,
 
 /* one packet was captured, process it */
 static void
-capture_loop_write_packet_cb(u_char *user, const struct pcap_pkthdr *phdr,
+capture_loop_write_packet_cb(u_char *pcap_opts_p, const struct pcap_pkthdr *phdr,
                              const u_char *pd)
 {
-    pcap_options *pcap_opts;
+    pcap_options *pcap_opts = (pcap_options *) (void *) pcap_opts_p;
     int err;
 
     /* We may be called multiple times from pcap_dispatch(); if we've set
@@ -3547,7 +3614,6 @@ capture_loop_write_packet_cb(u_char *user, const struct pcap_pkthdr *phdr,
     if (!global_ld.go)
         return;
 
-    pcap_opts = (pcap_options *) (void *) user;
     if (global_ld.pdh) {
         gboolean successful;
 
@@ -3578,10 +3644,10 @@ capture_loop_write_packet_cb(u_char *user, const struct pcap_pkthdr *phdr,
 
 /* one packet was captured, queue it */
 static void
-capture_loop_queue_packet_cb(u_char *user, const struct pcap_pkthdr *phdr,
+capture_loop_queue_packet_cb(u_char *pcap_opts_p, const struct pcap_pkthdr *phdr,
                              const u_char *pd)
 {
-    pcap_options *pcap_opts;
+    pcap_options *pcap_opts = (pcap_options *) (void *) pcap_opts_p;
     pcap_queue_element *queue_element;
     gboolean limit_reached;
 
@@ -3591,13 +3657,12 @@ capture_loop_queue_packet_cb(u_char *user, const struct pcap_pkthdr *phdr,
     if (!global_ld.go)
         return;
 
-    pcap_opts = (pcap_options *) (void *) user;
     queue_element = (pcap_queue_element *)g_malloc(sizeof(pcap_queue_element));
     if (queue_element == NULL) {
        pcap_opts->dropped++;
        return;
     }
-    queue_element->interface_id = pcap_opts->interface_id;
+    queue_element->pcap_opts = pcap_opts;
     queue_element->phdr = *phdr;
     queue_element->pd = (u_char *)g_malloc(phdr->caplen);
     if (queue_element->pd == NULL) {
@@ -3667,6 +3732,7 @@ main(int argc, char *argv[])
 #if defined(__APPLE__) && defined(__LP64__)
     struct utsname       osinfo;
 #endif
+    GString             *str;
 
 #ifdef _WIN32
     arg_list_utf_16to8(argc, argv);
@@ -3714,7 +3780,7 @@ main(int argc, char *argv[])
 #define OPTSTRING_d ""
 #endif
 
-#define OPTSTRING "a:" OPTSTRING_A "b:" OPTSTRING_B "c:" OPTSTRING_d "Df:ghi:" OPTSTRING_I "L" OPTSTRING_m "Mnpq" OPTSTRING_r "Ss:t" OPTSTRING_u "vw:y:Z:"
+#define OPTSTRING "a:" OPTSTRING_A "b:" OPTSTRING_B "c:" OPTSTRING_d "Df:ghi:" OPTSTRING_I "L" OPTSTRING_m "MnpPq" OPTSTRING_r "Ss:t" OPTSTRING_u "vw:y:Z:"
 
 #ifdef DEBUG_CHILD_DUMPCAP
     if ((debug_log = ws_fopen("dumpcap_debug_log.tmp","w")) == NULL) {
@@ -3814,9 +3880,11 @@ main(int argc, char *argv[])
     /* Initialize the pcaps list */
     global_ld.pcaps = g_array_new(FALSE, FALSE, sizeof(pcap_options *));
 
+#if !GLIB_CHECK_VERSION(2,31,0)
     /* Initialize the thread system */
-    if (!g_thread_supported())
-        g_thread_init(NULL);
+    g_thread_init(NULL);
+#endif
+
 #ifdef _WIN32
     /* Load wpcap if possible. Do this before collecting the run-time version information */
     load_wpcap();
@@ -3944,9 +4012,6 @@ main(int argc, char *argv[])
        by the command line parameters. */
     capture_opts_init(&global_capture_opts, NULL);
 
-    /* Default to capturing the entire packet. */
-    global_capture_opts.snaplen             = WTAP_MAX_PACKET_SIZE;
-
     /* We always save to a file - if no file was specified, we save to a
        temporary file. */
     global_capture_opts.saving_to_file      = TRUE;
@@ -3984,6 +4049,7 @@ main(int argc, char *argv[])
         case 'i':        /* Use interface x */
         case 'n':        /* Use pcapng format */
         case 'p':        /* Don't capture in promiscuous mode */
+        case 'P':        /* Use pcap format */
         case 's':        /* Set the snapshot (capture) length */
         case 'w':        /* Write to capture file x */
         case 'g':        /* enable group read accesson file(s) */
@@ -4035,7 +4101,6 @@ main(int argc, char *argv[])
         case 'q':        /* Quiet */
             quiet = TRUE;
             break;
-
         case 't':
             use_threads = TRUE;
             break;
@@ -4063,6 +4128,7 @@ main(int argc, char *argv[])
             break;
         default:
             cmdarg_err("Invalid Option: %s", argv[optind-1]);
+            /* FALLTHROUGH */
         case '?':        /* Bad flag - print usage message */
             arg_error = TRUE;
             break;
@@ -4143,6 +4209,7 @@ main(int argc, char *argv[])
         if (if_list == NULL) {
             switch (err) {
             case CANT_GET_INTERFACE_LIST:
+            case DONT_HAVE_PCAP:
                 cmdarg_err("%s", err_str);
                 g_free(err_str);
                 exit_main(2);
@@ -4191,11 +4258,41 @@ main(int argc, char *argv[])
 
     /* Let the user know what interfaces were chosen. */
     /* get_interface_descriptive_name() is not available! */
-    for (j = 0; j < global_capture_opts.ifaces->len; j++) {
-        interface_options interface_opts;
+    if (capture_child) {
+        for (j = 0; j < global_capture_opts.ifaces->len; j++) {
+            interface_options interface_opts;
 
-        interface_opts = g_array_index(global_capture_opts.ifaces, interface_options, j);
-        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "Interface: %s", interface_opts.name);
+            interface_opts = g_array_index(global_capture_opts.ifaces, interface_options, j);
+            g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "Interface: %s\n",
+                  interface_opts.name);
+        }
+    } else {
+        str = g_string_new("");
+#ifdef _WIN32
+        if (global_capture_opts.ifaces->len < 2) {
+#else
+        if (global_capture_opts.ifaces->len < 4) {
+#endif
+            for (j = 0; j < global_capture_opts.ifaces->len; j++) {
+                interface_options interface_opts;
+
+                interface_opts = g_array_index(global_capture_opts.ifaces, interface_options, j);
+                if (j > 0) {
+                    if (global_capture_opts.ifaces->len > 2) {
+                        g_string_append_printf(str, ",");
+                    }
+                    g_string_append_printf(str, " ");
+                    if (j == global_capture_opts.ifaces->len - 1) {
+                        g_string_append_printf(str, "and ");
+                    }
+                }
+                g_string_append_printf(str, "%s", interface_opts.name);
+            }
+        } else {
+            g_string_append_printf(str, "%u interfaces", global_capture_opts.ifaces->len);
+        }
+        fprintf(stderr, "Capturing on %s\n", str->str);
+        g_string_free(str, TRUE);
     }
 
     if (list_link_layer_types) {
@@ -4402,18 +4499,29 @@ report_new_capture_file(const char *filename)
 }
 
 static void
-report_cfilter_error(const char *cfilter, const char *errmsg)
+report_cfilter_error(capture_options *capture_opts, guint i, const char *errmsg)
 {
-    if (capture_child) {
-        g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "Capture filter error: %s", errmsg);
-        pipe_write_block(2, SP_BAD_FILTER, errmsg);
-    } else {
-        fprintf(stderr,
-          "Invalid capture filter: \"%s\"!\n"
-          "\n"
-          "That string isn't a valid capture filter (%s).\n"
-          "See the User's Guide for a description of the capture filter syntax.\n",
-          cfilter, errmsg);
+    interface_options interface_opts;
+    char tmp[MSG_MAX_LENGTH+1+6];
+
+    if (i < capture_opts->ifaces->len) {
+        if (capture_child) {
+            g_snprintf(tmp, sizeof(tmp), "%u:%s", i, errmsg);
+            g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "Capture filter error: %s", errmsg);
+            pipe_write_block(2, SP_BAD_FILTER, tmp);
+        } else {
+            /*
+             * clopts_step_invalid_capfilter in test/suite-clopts.sh MUST match
+             * the error message below.
+             */
+            interface_opts = g_array_index(capture_opts->ifaces, interface_options, i);
+            cmdarg_err(
+              "Invalid capture filter: \"%s\" for interface %s!\n"
+              "\n"
+              "That string isn't a valid capture filter (%s).\n"
+              "See the User's Guide for a description of the capture filter syntax.",
+              interface_opts.cfilter, interface_opts.name, errmsg);
+        }
     }
 }
 
@@ -4427,9 +4535,9 @@ report_capture_error(const char *error_msg, const char *secondary_error_msg)
             "Secondary Error: %s", secondary_error_msg);
         sync_pipe_errmsg_to_parent(2, error_msg, secondary_error_msg);
     } else {
-        fprintf(stderr, "%s\n", error_msg);
+        cmdarg_err("%s", error_msg);
         if (secondary_error_msg[0] != '\0')
-          fprintf(stderr, "%s\n", secondary_error_msg);
+          cmdarg_err_cont("%s", secondary_error_msg);
     }
 }
 
@@ -4514,6 +4622,6 @@ signal_pipe_check_running(void)
  * indent-tabs-mode: nil
  * End:
  *
- * vi: set shiftwidth=4 tabstop=8 expandtab
+ * vi: set shiftwidth=4 tabstop=8 expandtab:
  * :indentSize=4:tabSize=8:noTabs=true:
  */