2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 * Support for splitting captures into multiple files with a maximum
25 * Seth Webster <swebster@sst.ll.mit.edu>
29 * tcpdump - dump traffic on a network
31 * First written in 1987 by Van Jacobson, Lawrence Berkeley Laboratory.
32 * Mercilessly hacked and occasionally improved since then via the
33 * combined efforts of Van, Steve McCanne and Craig Leres of LBL.
41 * Some older versions of Mac OS X may ship pcap.h from libpcap 0.6 with a
42 * libpcap based on 0.8. That means it has pcap_findalldevs() but the
43 * header doesn't define pcap_if_t, meaning that we can't actually *use*
46 #ifdef HAVE_PCAP_FINDALLDEVS
47 #ifndef HAVE_PCAP_IF_T
48 #undef HAVE_PCAP_FINDALLDEVS
52 #include "netdissect-stdinc.h"
55 * This must appear after including netdissect-stdinc.h, so that _U_ is
59 static const char copyright[] _U_ =
60 "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\
61 The Regents of the University of California. All rights reserved.\n";
71 #include <openssl/crypto.h>
74 #ifdef HAVE_GETOPT_LONG
77 #include "missing/getopt_long.h"
79 /* Capsicum-specific code requires macros from <net/bpf.h>, which will fail
80 * to compile if <pcap.h> has already been included; including the headers
81 * in the opposite order works fine.
84 #include <sys/capsicum.h>
85 #include <sys/ioccom.h>
89 #include <libcasper.h>
90 #include <casper/cap_dns.h>
92 #endif /* HAVE_CASPER */
93 #endif /* HAVE_CAPSICUM */
96 * We found pcap_open() in the capture library, so we'll be using
97 * the remote capture APIs; define PCAP_REMOTE before we include pcap.h,
98 * so we get those APIs declared, and the types and #defines that they
101 * WinPcap's headers require that PCAP_REMOTE be defined in order to get
102 * remote-capture APIs declared and types and #defines that they use
105 * (Versions of libpcap with those APIs, and thus Npcap, which is based on
106 * those versions of libpcap, don't require it.)
120 #include <sys/time.h>
121 #include <sys/wait.h>
122 #include <sys/resource.h>
128 * Pathname separator.
129 * Use this in pathnames, but do *not* use it in URLs.
132 #define PATH_SEPARATOR '\\'
134 #define PATH_SEPARATOR '/'
137 /* capabilities convenience library */
138 /* If a code depends on HAVE_LIBCAP_NG, it depends also on HAVE_CAP_NG_H.
139 * If HAVE_CAP_NG_H is not defined, undefine HAVE_LIBCAP_NG.
140 * Thus, the later tests are done only on HAVE_LIBCAP_NG.
142 #ifdef HAVE_LIBCAP_NG
146 #undef HAVE_LIBCAP_NG
147 #endif /* HAVE_CAP_NG_H */
148 #endif /* HAVE_LIBCAP_NG */
151 #include <sys/sysctl.h>
152 #endif /* __FreeBSD__ */
154 #include "netdissect-stdinc.h"
155 #include "netdissect.h"
156 #include "interface.h"
157 #include "addrtoname.h"
159 #include "pcap-missing.h"
160 #include "ascii_strcasecmp.h"
167 #define PATH_MAX 1024
171 #define SIGNAL_REQ_INFO SIGINFO
172 #elif defined(SIGUSR1)
173 #define SIGNAL_REQ_INFO SIGUSR1
176 #if defined(HAVE_PCAP_DUMP_FLUSH) && defined(SIGUSR2)
177 #define SIGNAL_FLUSH_PCAP SIGUSR2
180 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
181 static int Bflag; /* buffer size */
183 #ifdef HAVE_PCAP_DUMP_FTELL64
184 static int64_t Cflag; /* rotate dump files after this many bytes */
186 static long Cflag; /* rotate dump files after this many bytes */
188 static int Cflag_count; /* Keep track of which file number we're writing */
189 #ifdef HAVE_PCAP_FINDALLDEVS
190 static int Dflag; /* list available devices and exit */
192 #ifdef HAVE_PCAP_FINDALLDEVS_EX
193 static char *remote_interfaces_source; /* list available devices from this source and exit */
197 * This is exported because, in some versions of libpcap, if libpcap
198 * is built with optimizer debugging code (which is *NOT* the default
199 * configuration!), the library *imports*(!) a variable named dflag,
200 * under the expectation that tcpdump is exporting it, to govern
201 * how much debugging information to print when optimizing
202 * the generated BPF code.
204 * This is a horrible hack; newer versions of libpcap don't import
205 * dflag but, instead, *if* built with optimizer debugging code,
206 * *export* a routine to set that flag.
209 int dflag; /* print filter code */
210 static int Gflag; /* rotate dump files after this many seconds */
211 static int Gflag_count; /* number of files created with Gflag rotation */
212 static time_t Gflag_time; /* The last time_t the dump file was rotated. */
213 static int Lflag; /* list available data link types and exit */
214 static int Iflag; /* rfmon (monitor) mode */
215 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
216 static int Jflag; /* list available time stamp types */
217 static int jflag = -1; /* packet time stamp source */
219 static int lflag; /* line-buffered output */
220 static int pflag; /* don't go promiscuous */
221 #ifdef HAVE_PCAP_SETDIRECTION
222 static int Qflag = -1; /* restrict captured packet by send/receive direction */
224 #ifdef HAVE_PCAP_DUMP_FLUSH
225 static int Uflag; /* "unbuffered" output of dump files */
227 static int Wflag; /* recycle output files after this number of files */
228 static int WflagChars;
229 static char *zflag = NULL; /* compress each savefile using a specified command (like gzip or bzip2) */
230 static int timeout = 1000; /* default timeout = 1000 ms = 1 s */
231 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
232 static int immediate_mode;
234 static int count_mode;
236 static int infodelay;
237 static int infoprint;
242 cap_channel_t *capdns;
246 static NORETURN void error(FORMAT_STRING(const char *), ...) PRINTFLIKE(1, 2);
247 static void warning(FORMAT_STRING(const char *), ...) PRINTFLIKE(1, 2);
248 static NORETURN void exit_tcpdump(int);
249 static void (*setsignal (int sig, void (*func)(int)))(int);
250 static void cleanup(int);
251 static void child_cleanup(int);
252 static void print_version(FILE *);
253 static void print_usage(FILE *);
254 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
255 static NORETURN void show_tstamp_types_and_exit(pcap_t *, const char *device);
257 static NORETURN void show_dlts_and_exit(pcap_t *, const char *device);
258 #ifdef HAVE_PCAP_FINDALLDEVS
259 static NORETURN void show_devices_and_exit(void);
261 #ifdef HAVE_PCAP_FINDALLDEVS_EX
262 static NORETURN void show_remote_devices_and_exit(void);
265 static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
266 static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *);
267 static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
268 static void droproot(const char *, const char *);
270 #ifdef SIGNAL_REQ_INFO
271 static void requestinfo(int);
274 #ifdef SIGNAL_FLUSH_PCAP
275 static void flushpcap(int);
279 static HANDLE timer_handle = INVALID_HANDLE_VALUE;
280 static void CALLBACK verbose_stats_dump(PVOID param, BOOLEAN timer_fired);
282 static void verbose_stats_dump(int sig);
285 static void info(int);
286 static u_int packets_captured;
288 #ifdef HAVE_PCAP_FINDALLDEVS
289 static const struct tok status_flags[] = {
291 { PCAP_IF_UP, "Up" },
293 #ifdef PCAP_IF_RUNNING
294 { PCAP_IF_RUNNING, "Running" },
296 { PCAP_IF_LOOPBACK, "Loopback" },
297 #ifdef PCAP_IF_WIRELESS
298 { PCAP_IF_WIRELESS, "Wireless" },
305 static pcap_dumper_t *pdd = NULL;
307 static int supports_monitor_mode;
315 char *CurrentFileName;
318 netdissect_options *ndo;
324 #if defined(HAVE_PCAP_SET_PARSER_DEBUG)
326 * We have pcap_set_parser_debug() in libpcap; declare it (it's not declared
327 * by any libpcap header, because it's a special hack, only available if
328 * libpcap was configured to include it, and only intended for use by
329 * libpcap developers trying to debug the parser for filter expressions).
332 __declspec(dllimport)
336 void pcap_set_parser_debug(int);
337 #elif defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG)
339 * We don't have pcap_set_parser_debug() in libpcap, but we do have
340 * pcap_debug or yydebug. Make a local version of pcap_set_parser_debug()
341 * to set the flag, and define HAVE_PCAP_SET_PARSER_DEBUG.
344 pcap_set_parser_debug(int value)
346 #ifdef HAVE_PCAP_DEBUG
347 extern int pcap_debug;
350 #else /* HAVE_PCAP_DEBUG */
354 #endif /* HAVE_PCAP_DEBUG */
357 #define HAVE_PCAP_SET_PARSER_DEBUG
360 #if defined(HAVE_PCAP_SET_OPTIMIZER_DEBUG)
362 * We have pcap_set_optimizer_debug() in libpcap; declare it (it's not declared
363 * by any libpcap header, because it's a special hack, only available if
364 * libpcap was configured to include it, and only intended for use by
365 * libpcap developers trying to debug the optimizer for filter expressions).
368 __declspec(dllimport)
372 void pcap_set_optimizer_debug(int);
377 error(const char *fmt, ...)
381 (void)fprintf(stderr, "%s: ", program_name);
383 (void)vfprintf(stderr, fmt, ap);
388 (void)fputc('\n', stderr);
390 exit_tcpdump(S_ERR_HOST_PROGRAM);
396 warning(const char *fmt, ...)
400 (void)fprintf(stderr, "%s: WARNING: ", program_name);
402 (void)vfprintf(stderr, fmt, ap);
407 (void)fputc('\n', stderr);
412 exit_tcpdump(int status)
418 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
420 show_tstamp_types_and_exit(pcap_t *pc, const char *device)
423 int *tstamp_types = 0;
424 const char *tstamp_type_name;
427 n_tstamp_types = pcap_list_tstamp_types(pc, &tstamp_types);
428 if (n_tstamp_types < 0)
429 error("%s", pcap_geterr(pc));
431 if (n_tstamp_types == 0) {
432 fprintf(stderr, "Time stamp type cannot be set for %s\n",
434 exit_tcpdump(S_SUCCESS);
436 fprintf(stderr, "Time stamp types for %s (use option -j to set):\n",
438 for (i = 0; i < n_tstamp_types; i++) {
439 tstamp_type_name = pcap_tstamp_type_val_to_name(tstamp_types[i]);
440 if (tstamp_type_name != NULL) {
441 (void) fprintf(stderr, " %s (%s)\n", tstamp_type_name,
442 pcap_tstamp_type_val_to_description(tstamp_types[i]));
444 (void) fprintf(stderr, " %d\n", tstamp_types[i]);
447 pcap_free_tstamp_types(tstamp_types);
448 exit_tcpdump(S_SUCCESS);
453 show_dlts_and_exit(pcap_t *pc, const char *device)
457 const char *dlt_name;
459 n_dlts = pcap_list_datalinks(pc, &dlts);
461 error("%s", pcap_geterr(pc));
462 else if (n_dlts == 0 || !dlts)
463 error("No data link types.");
466 * If the interface is known to support monitor mode, indicate
467 * whether these are the data link types available when not in
468 * monitor mode, if -I wasn't specified, or when in monitor mode,
469 * when -I was specified (the link-layer types available in
470 * monitor mode might be different from the ones available when
471 * not in monitor mode).
473 if (supports_monitor_mode)
474 (void) fprintf(stderr, "Data link types for %s %s (use option -y to set):\n",
476 Iflag ? "when in monitor mode" : "when not in monitor mode");
478 (void) fprintf(stderr, "Data link types for %s (use option -y to set):\n",
481 for (i = 0; i < n_dlts; i++) {
482 dlt_name = pcap_datalink_val_to_name(dlts[i]);
483 if (dlt_name != NULL) {
484 (void) fprintf(stderr, " %s (%s)", dlt_name,
485 pcap_datalink_val_to_description(dlts[i]));
488 * OK, does tcpdump handle that type?
490 if (!has_printer(dlts[i]))
491 (void) fprintf(stderr, " (printing not supported)");
492 fprintf(stderr, "\n");
494 (void) fprintf(stderr, " DLT %d (printing not supported)\n",
498 #ifdef HAVE_PCAP_FREE_DATALINKS
499 pcap_free_datalinks(dlts);
501 exit_tcpdump(S_SUCCESS);
504 #ifdef HAVE_PCAP_FINDALLDEVS
506 show_devices_and_exit(void)
508 pcap_if_t *dev, *devlist;
509 char ebuf[PCAP_ERRBUF_SIZE];
512 if (pcap_findalldevs(&devlist, ebuf) < 0)
514 for (i = 0, dev = devlist; dev != NULL; i++, dev = dev->next) {
515 printf("%d.%s", i+1, dev->name);
516 if (dev->description != NULL)
517 printf(" (%s)", dev->description);
518 if (dev->flags != 0) {
520 printf("%s", bittok2str(status_flags, "none", dev->flags));
521 #ifdef PCAP_IF_WIRELESS
522 if (dev->flags & PCAP_IF_WIRELESS) {
523 switch (dev->flags & PCAP_IF_CONNECTION_STATUS) {
525 case PCAP_IF_CONNECTION_STATUS_UNKNOWN:
526 printf(", Association status unknown");
529 case PCAP_IF_CONNECTION_STATUS_CONNECTED:
530 printf(", Associated");
533 case PCAP_IF_CONNECTION_STATUS_DISCONNECTED:
534 printf(", Not associated");
537 case PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE:
541 switch (dev->flags & PCAP_IF_CONNECTION_STATUS) {
543 case PCAP_IF_CONNECTION_STATUS_UNKNOWN:
544 printf(", Connection status unknown");
547 case PCAP_IF_CONNECTION_STATUS_CONNECTED:
548 printf(", Connected");
551 case PCAP_IF_CONNECTION_STATUS_DISCONNECTED:
552 printf(", Disconnected");
555 case PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE:
564 pcap_freealldevs(devlist);
565 exit_tcpdump(S_SUCCESS);
567 #endif /* HAVE_PCAP_FINDALLDEVS */
569 #ifdef HAVE_PCAP_FINDALLDEVS_EX
571 show_remote_devices_and_exit(void)
573 pcap_if_t *dev, *devlist;
574 char ebuf[PCAP_ERRBUF_SIZE];
577 if (pcap_findalldevs_ex(remote_interfaces_source, NULL, &devlist,
580 for (i = 0, dev = devlist; dev != NULL; i++, dev = dev->next) {
581 printf("%d.%s", i+1, dev->name);
582 if (dev->description != NULL)
583 printf(" (%s)", dev->description);
585 printf(" [%s]", bittok2str(status_flags, "none", dev->flags));
588 pcap_freealldevs(devlist);
589 exit_tcpdump(S_SUCCESS);
591 #endif /* HAVE_PCAP_FINDALLDEVS */
596 * Note that there we use all letters for short options except for g, k,
597 * o, and P, and those are used by other versions of tcpdump, and we should
598 * only use them for the same purposes that the other versions of tcpdump
601 * macOS tcpdump uses -g to force non--v output for IP to be on one
602 * line, making it more "g"repable;
604 * macOS tcpdump uses -k to specify that packet comments in pcapng files
607 * OpenBSD tcpdump uses -o to indicate that OS fingerprinting should be done
608 * for hosts sending TCP SYN packets;
610 * macOS tcpdump uses -P to indicate that -w should write pcapng rather
613 * macOS tcpdump also uses -Q to specify expressions that match packet
614 * metadata, including but not limited to the packet direction.
615 * The expression syntax is different from a simple "in|out|inout",
616 * and those expressions aren't accepted by macOS tcpdump, but the
617 * equivalents would be "in" = "dir=in", "out" = "dir=out", and
618 * "inout" = "dir=in or dir=out", and the parser could conceivably
619 * special-case "in", "out", and "inout" as expressions for backwards
620 * compatibility, so all is not (yet) lost.
624 * Set up flags that might or might not be supported depending on the
625 * version of libpcap we're using.
627 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
629 #define B_FLAG_USAGE " [ -B size ]"
630 #else /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */
633 #endif /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */
635 #ifdef HAVE_PCAP_FINDALLDEVS
641 #ifdef HAVE_PCAP_CREATE
643 #else /* HAVE_PCAP_CREATE */
645 #endif /* HAVE_PCAP_CREATE */
647 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
649 #define j_FLAG_USAGE " [ -j tstamptype ]"
651 #else /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */
655 #endif /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */
658 #define m_FLAG_USAGE "[ -m module ] ..."
661 #ifdef HAVE_PCAP_SETDIRECTION
663 #define Q_FLAG_USAGE " [ -Q in|out|inout ]"
669 #ifdef HAVE_PCAP_DUMP_FLUSH
675 #define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:s:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#"
680 * We do not currently have long options corresponding to all short
681 * options; we should probably pick appropriate option names for them.
683 * However, the short options where the number of times the option is
684 * specified matters, such as -v and -d and -t, should probably not
685 * just map to a long option, as saying
687 * tcpdump --verbose --verbose
689 * doesn't make sense; it should be --verbosity={N} or something such
692 * For long options with no corresponding short options, we define values
693 * outside the range of ASCII graphic characters, make that the last
694 * component of the entry for the long option, and have a case for that
695 * option in the switch statement.
697 #define OPTION_VERSION 128
698 #define OPTION_TSTAMP_PRECISION 129
699 #define OPTION_IMMEDIATE_MODE 130
700 #define OPTION_PRINT 131
701 #define OPTION_LIST_REMOTE_INTERFACES 132
702 #define OPTION_TSTAMP_MICRO 133
703 #define OPTION_TSTAMP_NANO 134
704 #define OPTION_FP_TYPE 135
705 #define OPTION_COUNT 136
707 static const struct option longopts[] = {
708 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
709 { "buffer-size", required_argument, NULL, 'B' },
711 { "list-interfaces", no_argument, NULL, 'D' },
712 #ifdef HAVE_PCAP_FINDALLDEVS_EX
713 { "list-remote-interfaces", required_argument, NULL, OPTION_LIST_REMOTE_INTERFACES },
715 { "help", no_argument, NULL, 'h' },
716 { "interface", required_argument, NULL, 'i' },
717 #ifdef HAVE_PCAP_CREATE
718 { "monitor-mode", no_argument, NULL, 'I' },
720 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
721 { "time-stamp-type", required_argument, NULL, 'j' },
722 { "list-time-stamp-types", no_argument, NULL, 'J' },
724 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
725 { "micro", no_argument, NULL, OPTION_TSTAMP_MICRO},
726 { "nano", no_argument, NULL, OPTION_TSTAMP_NANO},
727 { "time-stamp-precision", required_argument, NULL, OPTION_TSTAMP_PRECISION},
729 { "dont-verify-checksums", no_argument, NULL, 'K' },
730 { "list-data-link-types", no_argument, NULL, 'L' },
731 { "no-optimize", no_argument, NULL, 'O' },
732 { "no-promiscuous-mode", no_argument, NULL, 'p' },
733 #ifdef HAVE_PCAP_SETDIRECTION
734 { "direction", required_argument, NULL, 'Q' },
736 { "snapshot-length", required_argument, NULL, 's' },
737 { "absolute-tcp-sequence-numbers", no_argument, NULL, 'S' },
738 #ifdef HAVE_PCAP_DUMP_FLUSH
739 { "packet-buffered", no_argument, NULL, 'U' },
741 { "linktype", required_argument, NULL, 'y' },
742 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
743 { "immediate-mode", no_argument, NULL, OPTION_IMMEDIATE_MODE },
745 #ifdef HAVE_PCAP_SET_PARSER_DEBUG
746 { "debug-filter-parser", no_argument, NULL, 'Y' },
748 { "relinquish-privileges", required_argument, NULL, 'Z' },
749 { "count", no_argument, NULL, OPTION_COUNT },
750 { "fp-type", no_argument, NULL, OPTION_FP_TYPE },
751 { "number", no_argument, NULL, '#' },
752 { "print", no_argument, NULL, OPTION_PRINT },
753 { "version", no_argument, NULL, OPTION_VERSION },
757 #ifdef HAVE_PCAP_FINDALLDEVS_EX
758 #define LIST_REMOTE_INTERFACES_USAGE "[ --list-remote-interfaces remote-source ]"
760 #define LIST_REMOTE_INTERFACES_USAGE
763 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
764 #define IMMEDIATE_MODE_USAGE " [ --immediate-mode ]"
766 #define IMMEDIATE_MODE_USAGE ""
770 /* Drop root privileges and chroot if necessary */
772 droproot(const char *username, const char *chroot_dir)
774 struct passwd *pw = NULL;
776 if (chroot_dir && !username)
777 error("Chroot without dropping root is insecure");
779 pw = getpwnam(username);
782 if (chroot(chroot_dir) != 0 || chdir ("/") != 0)
783 error("Couldn't chroot/chdir to '%.64s': %s",
784 chroot_dir, pcap_strerror(errno));
786 #ifdef HAVE_LIBCAP_NG
788 int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG);
790 error("capng_change_id(): return %d\n", ret);
792 fprintf(stderr, "dropped privs to %s\n", username);
795 if (initgroups(pw->pw_name, pw->pw_gid) != 0 ||
796 setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0)
797 error("Couldn't change to '%.32s' uid=%lu gid=%lu: %s",
799 (unsigned long)pw->pw_uid,
800 (unsigned long)pw->pw_gid,
801 pcap_strerror(errno));
803 fprintf(stderr, "dropped privs to %s\n", username);
805 #endif /* HAVE_LIBCAP_NG */
807 error("Couldn't find user '%.32s'", username);
808 #ifdef HAVE_LIBCAP_NG
809 /* We don't need CAP_SETUID, CAP_SETGID and CAP_SYS_CHROOT any more. */
810 DIAG_OFF_CLANG(assign-enum)
813 CAPNG_EFFECTIVE | CAPNG_PERMITTED,
818 DIAG_ON_CLANG(assign-enum)
819 capng_apply(CAPNG_SELECT_BOTH);
820 #endif /* HAVE_LIBCAP_NG */
841 MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars)
843 char *filename = malloc(PATH_MAX + 1);
844 if (filename == NULL)
845 error("%s: malloc", __func__);
847 /* Process with strftime if Gflag is set. */
851 /* Convert Gflag_time to a usable format */
852 if ((local_tm = localtime(&Gflag_time)) == NULL) {
853 error("%s: localtime", __func__);
856 /* There's no good way to detect an error in strftime since a return
857 * value of 0 isn't necessarily failure.
859 strftime(filename, PATH_MAX, orig_name, local_tm);
861 strncpy(filename, orig_name, PATH_MAX);
864 if (cnt == 0 && max_chars == 0)
865 strncpy(buffer, filename, PATH_MAX + 1);
867 if (snprintf(buffer, PATH_MAX + 1, "%s%0*d", filename, max_chars, cnt) > PATH_MAX)
868 /* Report an error if the filename is too large */
869 error("too many output files or filename is too long (> %d)", PATH_MAX);
874 get_next_file(FILE *VFile, char *ptr)
879 ret = fgets(ptr, PATH_MAX, VFile);
884 if (len > 0 && ptr[len - 1] == '\n')
891 static cap_channel_t *
894 cap_channel_t *capcas, *capdnsloc;
895 const char *types[1];
900 error("unable to create casper process");
901 capdnsloc = cap_service_open(capcas, "system.dns");
902 /* Casper capability no longer needed. */
904 if (capdnsloc == NULL)
905 error("unable to open system.dns service");
906 /* Limit system.dns to reverse DNS lookups. */
908 if (cap_dns_type_limit(capdnsloc, types, 1) < 0)
909 error("unable to limit access to system.dns service");
910 families[0] = AF_INET;
911 families[1] = AF_INET6;
912 if (cap_dns_family_limit(capdnsloc, families, 2) < 0)
913 error("unable to limit access to system.dns service");
917 #endif /* HAVE_CASPER */
919 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
921 tstamp_precision_from_string(const char *precision)
923 if (strncmp(precision, "nano", strlen("nano")) == 0)
924 return PCAP_TSTAMP_PRECISION_NANO;
926 if (strncmp(precision, "micro", strlen("micro")) == 0)
927 return PCAP_TSTAMP_PRECISION_MICRO;
933 tstamp_precision_to_string(int precision)
937 case PCAP_TSTAMP_PRECISION_MICRO:
940 case PCAP_TSTAMP_PRECISION_NANO:
951 * Ensure that, on a dump file's descriptor, we have all the rights
952 * necessary to make the standard I/O library work with an fdopen()ed
953 * FILE * from that descriptor.
955 * A long time ago in a galaxy far, far away, AT&T decided that, instead
956 * of providing separate APIs for getting and setting the FD_ flags on a
957 * descriptor, getting and setting the O_ flags on a descriptor, and
958 * locking files, they'd throw them all into a kitchen-sink fcntl() call
959 * along the lines of ioctl(), the fact that ioctl() operations are
960 * largely specific to particular character devices but fcntl() operations
961 * are either generic to all descriptors or generic to all descriptors for
962 * regular files nonwithstanding.
964 * The Capsicum people decided that fine-grained control of descriptor
965 * operations was required, so that you need to grant permission for
966 * reading, writing, seeking, and fcntl-ing. The latter, courtesy of
967 * AT&T's decision, means that "fcntl-ing" isn't a thing, but a motley
968 * collection of things, so there are *individual* fcntls for which
969 * permission needs to be granted.
971 * The FreeBSD standard I/O people implemented some optimizations that
972 * requires that the standard I/O routines be able to determine whether
973 * the descriptor for the FILE * is open append-only or not; as that
974 * descriptor could have come from an open() rather than an fopen(),
975 * that requires that it be able to do an F_GETFL fcntl() to read
978 * Tcpdump uses ftell() to determine how much data has been written
979 * to a file in order to, when used with -C, determine when it's time
980 * to rotate capture files. ftell() therefore needs to do an lseek()
981 * to find out the file offset and must, thanks to the aforementioned
982 * optimization, also know whether the descriptor is open append-only
985 * The net result of all the above is that we need to grant CAP_SEEK,
986 * CAP_WRITE, and CAP_FCNTL with the CAP_FCNTL_GETFL subcapability.
988 * Perhaps this is the universe's way of saying that either
990 * 1) there needs to be an fopenat() call and a pcap_dump_openat() call
991 * using it, so that Capsicum-capable tcpdump wouldn't need to do
996 * 2) there needs to be a cap_fdopen() call in the FreeBSD standard
997 * I/O library that knows what rights are needed by the standard
998 * I/O library, based on the open mode, and assigns them, perhaps
999 * with an additional argument indicating, for example, whether
1000 * seeking should be allowed, so that tcpdump doesn't need to know
1001 * what the standard I/O library happens to require this week.
1004 set_dumper_capsicum_rights(pcap_dumper_t *p)
1006 int fd = fileno(pcap_dump_file(p));
1007 cap_rights_t rights;
1009 cap_rights_init(&rights, CAP_SEEK, CAP_WRITE, CAP_FCNTL);
1010 if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS) {
1011 error("unable to limit dump descriptor");
1013 if (cap_fcntls_limit(fd, CAP_FCNTL_GETFL) < 0 && errno != ENOSYS) {
1014 error("unable to limit dump descriptor fcntls");
1020 * Copy arg vector into a new buffer, concatenating arguments with spaces.
1023 copy_argv(char **argv)
1035 len += strlen(*p++) + 1;
1037 buf = (char *)malloc(len);
1039 error("%s: malloc", __func__);
1043 while ((src = *p++) != NULL) {
1044 while ((*dst++ = *src++) != '\0')
1054 * On Windows, we need to open the file in binary mode, so that
1055 * we get all the bytes specified by the size we get from "fstat()".
1056 * On UNIX, that's not necessary. O_BINARY is defined on Windows;
1057 * we define it as 0 if it's not defined, so it does nothing.
1064 read_infile(char *fname)
1071 fd = open(fname, O_RDONLY|O_BINARY);
1073 error("can't open %s: %s", fname, pcap_strerror(errno));
1075 if (our_fstat(fd, &buf) < 0)
1076 error("can't stat %s: %s", fname, pcap_strerror(errno));
1079 * Reject files whose size doesn't fit into an int; a filter
1080 * *that* large will probably be too big.
1082 if (buf.st_size > INT_MAX)
1083 error("%s is too large", fname);
1085 cp = malloc((u_int)buf.st_size + 1);
1087 error("malloc(%d) for %s: %s", (u_int)buf.st_size + 1,
1088 fname, pcap_strerror(errno));
1089 cc = read(fd, cp, (u_int)buf.st_size);
1091 error("read %s: %s", fname, pcap_strerror(errno));
1092 if (cc != buf.st_size)
1093 error("short read %s (%d != %d)", fname, (int) cc,
1097 /* replace "# comment" with spaces */
1098 for (i = 0; i < cc; i++) {
1100 while (i < cc && cp[i] != '\n')
1107 #ifdef HAVE_PCAP_FINDALLDEVS
1109 parse_interface_number(const char *device)
1116 * Search for a colon, terminating any scheme at the beginning
1119 p = strchr(device, ':');
1122 * We found it. Is it followed by "//"?
1124 p++; /* skip the : */
1125 if (strncmp(p, "//", 2) == 0) {
1127 * Yes. Search for the next /, at the end of the
1128 * authority part of the URL.
1130 p += 2; /* skip the // */
1134 * OK, past the / is the path.
1140 devnum = strtol(device, &end, 10);
1141 if (device != end && *end == '\0') {
1143 * It's all-numeric, but is it a valid number?
1147 * No, it's not an ordinal.
1149 error("Invalid adapter index");
1154 * It's not all-numeric; return -1, so our caller
1162 find_interface_by_number(const char *url
1163 #ifndef HAVE_PCAP_FINDALLDEVS_EX
1168 pcap_if_t *dev, *devlist;
1170 char ebuf[PCAP_ERRBUF_SIZE];
1172 #ifdef HAVE_PCAP_FINDALLDEVS_EX
1178 #ifdef HAVE_PCAP_FINDALLDEVS_EX
1180 * Search for a colon, terminating any scheme at the beginning
1183 endp = strchr(url, ':');
1186 * We found it. Is it followed by "//"?
1188 endp++; /* skip the : */
1189 if (strncmp(endp, "//", 2) == 0) {
1191 * Yes. Search for the next /, at the end of the
1192 * authority part of the URL.
1194 endp += 2; /* skip the // */
1195 endp = strchr(endp, '/');
1201 * OK, everything from device to endp is a URL to hand
1202 * to pcap_findalldevs_ex().
1204 endp++; /* Include the trailing / in the URL; pcap_findalldevs_ex() requires it */
1205 host_url = malloc(endp - url + 1);
1206 if (host_url == NULL && (endp - url + 1) > 0)
1207 error("Invalid allocation for host");
1209 memcpy(host_url, url, endp - url);
1210 host_url[endp - url] = '\0';
1211 status = pcap_findalldevs_ex(host_url, NULL, &devlist, ebuf);
1215 status = pcap_findalldevs(&devlist, ebuf);
1219 * Look for the devnum-th entry in the list of devices (1-based).
1221 for (i = 0, dev = devlist; i < devnum-1 && dev != NULL;
1222 i++, dev = dev->next)
1225 error("Invalid adapter index");
1226 device = strdup(dev->name);
1227 pcap_freealldevs(devlist);
1232 #ifdef HAVE_PCAP_OPEN
1234 * Prefixes for rpcap URLs.
1236 static char rpcap_prefix[] = "rpcap://";
1237 static char rpcap_ssl_prefix[] = "rpcaps://";
1241 open_interface(const char *device, netdissect_options *ndo, char *ebuf)
1244 #ifdef HAVE_PCAP_CREATE
1249 #ifdef HAVE_PCAP_OPEN
1251 * Is this an rpcap URL?
1253 if (strncmp(device, rpcap_prefix, sizeof(rpcap_prefix) - 1) == 0 ||
1254 strncmp(device, rpcap_ssl_prefix, sizeof(rpcap_ssl_prefix) - 1) == 0) {
1256 * Yes. Open it with pcap_open().
1259 pc = pcap_open(device, ndo->ndo_snaplen,
1260 pflag ? 0 : PCAP_OPENFLAG_PROMISCUOUS, timeout, NULL,
1264 * If this failed with "No such device" or "The system
1265 * cannot find the device specified", that means
1266 * the interface doesn't exist; return NULL, so that
1267 * the caller can see whether the device name is
1268 * actually an interface index.
1270 if (strstr(ebuf, "No such device") != NULL ||
1271 strstr(ebuf, "The system cannot find the device specified") != NULL)
1276 warning("%s", ebuf);
1279 #endif /* HAVE_PCAP_OPEN */
1281 #ifdef HAVE_PCAP_CREATE
1282 pc = pcap_create(device, ebuf);
1285 * If this failed with "No such device", that means
1286 * the interface doesn't exist; return NULL, so that
1287 * the caller can see whether the device name is
1288 * actually an interface index.
1290 if (strstr(ebuf, "No such device") != NULL)
1294 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1296 show_tstamp_types_and_exit(pc, device);
1298 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
1299 status = pcap_set_tstamp_precision(pc, ndo->ndo_tstamp_precision);
1301 error("%s: Can't set %ssecond time stamp precision: %s",
1303 tstamp_precision_to_string(ndo->ndo_tstamp_precision),
1304 pcap_statustostr(status));
1307 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
1308 if (immediate_mode) {
1309 status = pcap_set_immediate_mode(pc, 1);
1311 error("%s: Can't set immediate mode: %s",
1312 device, pcap_statustostr(status));
1316 * Is this an interface that supports monitor mode?
1318 if (pcap_can_set_rfmon(pc) == 1)
1319 supports_monitor_mode = 1;
1321 supports_monitor_mode = 0;
1322 if (ndo->ndo_snaplen != 0) {
1324 * A snapshot length was explicitly specified;
1327 status = pcap_set_snaplen(pc, ndo->ndo_snaplen);
1329 error("%s: Can't set snapshot length: %s",
1330 device, pcap_statustostr(status));
1332 status = pcap_set_promisc(pc, !pflag);
1334 error("%s: Can't set promiscuous mode: %s",
1335 device, pcap_statustostr(status));
1337 status = pcap_set_rfmon(pc, 1);
1339 error("%s: Can't set monitor mode: %s",
1340 device, pcap_statustostr(status));
1342 status = pcap_set_timeout(pc, timeout);
1344 error("%s: pcap_set_timeout failed: %s",
1345 device, pcap_statustostr(status));
1347 status = pcap_set_buffer_size(pc, Bflag);
1349 error("%s: Can't set buffer size: %s",
1350 device, pcap_statustostr(status));
1352 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1354 status = pcap_set_tstamp_type(pc, jflag);
1356 error("%s: Can't set time stamp type: %s",
1357 device, pcap_statustostr(status));
1358 else if (status > 0)
1359 warning("When trying to set timestamp type '%s' on %s: %s",
1360 pcap_tstamp_type_val_to_name(jflag), device,
1361 pcap_statustostr(status));
1364 status = pcap_activate(pc);
1367 * pcap_activate() failed.
1369 cp = pcap_geterr(pc);
1370 if (status == PCAP_ERROR)
1372 else if (status == PCAP_ERROR_NO_SUCH_DEVICE) {
1374 * Return an error for our caller to handle.
1376 snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s\n(%s)",
1377 device, pcap_statustostr(status), cp);
1378 } else if (status == PCAP_ERROR_PERM_DENIED && *cp != '\0')
1379 error("%s: %s\n(%s)", device,
1380 pcap_statustostr(status), cp);
1382 else if (status == PCAP_ERROR_RFMON_NOTSUP &&
1383 strncmp(device, "wlan", 4) == 0) {
1384 char parent[8], newdev[8];
1386 size_t s = sizeof(parent);
1388 snprintf(sysctl, sizeof(sysctl),
1389 "net.wlan.%d.%%parent", atoi(device + 4));
1390 sysctlbyname(sysctl, parent, &s, NULL, 0);
1391 strlcpy(newdev, device, sizeof(newdev));
1392 /* Suggest a new wlan device. */
1393 /* FIXME: incrementing the index this way is not going to work well
1394 * when the index is 9 or greater but the only consequence in this
1395 * specific case would be an error message that looks a bit odd.
1397 newdev[strlen(newdev)-1]++;
1398 error("%s is not a monitor mode VAP\n"
1399 "To create a new monitor mode VAP use:\n"
1400 " ifconfig %s create wlandev %s wlanmode monitor\n"
1401 "and use %s as the tcpdump interface",
1402 device, newdev, parent, newdev);
1406 error("%s: %s", device,
1407 pcap_statustostr(status));
1410 } else if (status > 0) {
1412 * pcap_activate() succeeded, but it's warning us
1413 * of a problem it had.
1415 cp = pcap_geterr(pc);
1416 if (status == PCAP_WARNING)
1418 else if (status == PCAP_WARNING_PROMISC_NOTSUP &&
1420 warning("%s: %s\n(%s)", device,
1421 pcap_statustostr(status), cp);
1423 warning("%s: %s", device,
1424 pcap_statustostr(status));
1426 #ifdef HAVE_PCAP_SETDIRECTION
1428 status = pcap_setdirection(pc, Qflag);
1430 error("%s: pcap_setdirection() failed: %s",
1431 device, pcap_geterr(pc));
1433 #endif /* HAVE_PCAP_SETDIRECTION */
1434 #else /* HAVE_PCAP_CREATE */
1437 * If no snapshot length was specified, or a length of 0 was
1438 * specified, default to 256KB.
1440 if (ndo->ndo_snaplen == 0)
1441 ndo->ndo_snaplen = MAXIMUM_SNAPLEN;
1442 pc = pcap_open_live(device, ndo->ndo_snaplen, !pflag, timeout, ebuf);
1445 * If this failed with "No such device", that means
1446 * the interface doesn't exist; return NULL, so that
1447 * the caller can see whether the device name is
1448 * actually an interface index.
1450 if (strstr(ebuf, "No such device") != NULL)
1455 warning("%s", ebuf);
1456 #endif /* HAVE_PCAP_CREATE */
1462 main(int argc, char **argv)
1465 bpf_u_int32 localnet = 0, netmask = 0;
1466 char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName;
1468 pcap_handler callback;
1470 const char *dlt_name;
1471 struct bpf_program fcode;
1473 void (*oldhandler)(int);
1475 struct dump_info dumpinfo;
1476 u_char *pcap_userdata;
1477 char ebuf[PCAP_ERRBUF_SIZE];
1478 char VFileLine[PATH_MAX + 1];
1479 const char *username = NULL;
1481 const char *chroot_dir = NULL;
1485 #ifdef HAVE_PCAP_FINDALLDEVS
1491 #ifdef HAVE_CAPSICUM
1492 cap_rights_t rights;
1494 #endif /* HAVE_CAPSICUM */
1495 int Oflag = 1; /* run filter code optimizer */
1497 const char *yflag_dlt_name = NULL;
1500 netdissect_options Ndo;
1501 netdissect_options *ndo = &Ndo;
1504 * Initialize the netdissect code.
1506 if (nd_init(ebuf, sizeof(ebuf)) == -1)
1509 memset(ndo, 0, sizeof(*ndo));
1510 ndo_set_function_pointers(ndo);
1520 if ((cp = strrchr(argv[0], PATH_SEPARATOR)) != NULL)
1521 ndo->program_name = program_name = cp + 1;
1523 ndo->program_name = program_name = argv[0];
1525 #if defined(HAVE_PCAP_WSOCKINIT)
1526 if (pcap_wsockinit() != 0)
1527 error("Attempting to initialize Winsock failed");
1528 #elif defined(HAVE_WSOCKINIT)
1529 if (wsockinit() != 0)
1530 error("Attempting to initialize Winsock failed");
1534 * On platforms where the CPU doesn't support unaligned loads,
1535 * force unaligned accesses to abort with SIGBUS, rather than
1536 * being fixed up (slowly) by the OS kernel; on those platforms,
1537 * misaligned accesses are bugs, and we want tcpdump to crash so
1538 * that the bugs are reported.
1540 if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0)
1544 (op = getopt_long(argc, argv, SHORTOPTS, longopts, NULL)) != -1)
1548 /* compatibility for old -a */
1559 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
1561 Bflag = atoi(optarg)*1024;
1563 error("invalid packet buffer size %s", optarg);
1565 #endif /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */
1570 error("invalid packet count %s", optarg);
1575 #ifdef HAVE_PCAP_DUMP_FTELL64
1576 Cflag = strtoint64_t(optarg, &endp, 10);
1578 Cflag = strtol(optarg, &endp, 10);
1580 if (endp == optarg || *endp != '\0' || errno != 0
1582 error("invalid file size %s", optarg);
1584 * Will multiplying it by 1000000 overflow?
1586 #ifdef HAVE_PCAP_DUMP_FTELL64
1587 if (Cflag > INT64_T_CONSTANT(0x7fffffffffffffff) / 1000000)
1589 if (Cflag > LONG_MAX / 1000000)
1591 error("file size %s is too large", optarg);
1599 #ifdef HAVE_PCAP_FINDALLDEVS
1605 #ifdef HAVE_PCAP_FINDALLDEVS_EX
1606 case OPTION_LIST_REMOTE_INTERFACES:
1607 remote_interfaces_source = optarg;
1620 #ifndef HAVE_LIBCRYPTO
1621 warning("crypto code not compiled in");
1623 ndo->ndo_espsecret = optarg;
1635 Gflag = atoi(optarg);
1637 error("invalid number of seconds %s", optarg);
1639 /* We will create one file initially. */
1642 /* Grab the current time for rotation use. */
1643 if ((Gflag_time = time(NULL)) == (time_t)-1) {
1644 error("%s: can't get current time: %s",
1645 __func__, pcap_strerror(errno));
1650 print_usage(stdout);
1651 exit_tcpdump(S_SUCCESS);
1662 #ifdef HAVE_PCAP_CREATE
1666 #endif /* HAVE_PCAP_CREATE */
1668 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1670 jflag = pcap_tstamp_type_name_to_val(optarg);
1672 error("invalid time stamp type %s", optarg);
1683 * _IOLBF is the same as _IOFBF in Microsoft's C
1684 * libraries; the only alternative they offer
1687 * XXX - this should really be checking for MSVC++,
1688 * not _WIN32, if, for example, MinGW has its own
1689 * C library that is more UNIX-compatible.
1691 setvbuf(stdout, NULL, _IONBF, 0);
1693 #ifdef HAVE_SETLINEBUF
1696 setvbuf(stdout, NULL, _IOLBF, 0);
1707 if (nd_have_smi_support()) {
1708 if (nd_load_smi_module(optarg, ebuf, sizeof(ebuf)) == -1)
1711 (void)fprintf(stderr, "%s: ignoring option `-m %s' ",
1712 program_name, optarg);
1713 (void)fprintf(stderr, "(no libsmi support)\n");
1718 /* TCP-MD5 shared secret */
1719 #ifndef HAVE_LIBCRYPTO
1720 warning("crypto code not compiled in");
1722 ndo->ndo_sigsecret = optarg;
1743 ++ndo->ndo_suppress_default_print;
1746 #ifdef HAVE_PCAP_SETDIRECTION
1748 if (ascii_strcasecmp(optarg, "in") == 0)
1750 else if (ascii_strcasecmp(optarg, "out") == 0)
1752 else if (ascii_strcasecmp(optarg, "inout") == 0)
1753 Qflag = PCAP_D_INOUT;
1755 error("unknown capture direction `%s'", optarg);
1757 #endif /* HAVE_PCAP_SETDIRECTION */
1764 ndo->ndo_snaplen = (int)strtol(optarg, &end, 0);
1765 if (optarg == end || *end != '\0'
1766 || ndo->ndo_snaplen < 0 || ndo->ndo_snaplen > MAXIMUM_SNAPLEN)
1767 error("invalid snaplen %s (must be >= 0 and <= %d)",
1768 optarg, MAXIMUM_SNAPLEN);
1780 if (ascii_strcasecmp(optarg, "vat") == 0)
1781 ndo->ndo_packettype = PT_VAT;
1782 else if (ascii_strcasecmp(optarg, "wb") == 0)
1783 ndo->ndo_packettype = PT_WB;
1784 else if (ascii_strcasecmp(optarg, "rpc") == 0)
1785 ndo->ndo_packettype = PT_RPC;
1786 else if (ascii_strcasecmp(optarg, "rtp") == 0)
1787 ndo->ndo_packettype = PT_RTP;
1788 else if (ascii_strcasecmp(optarg, "rtcp") == 0)
1789 ndo->ndo_packettype = PT_RTCP;
1790 else if (ascii_strcasecmp(optarg, "snmp") == 0)
1791 ndo->ndo_packettype = PT_SNMP;
1792 else if (ascii_strcasecmp(optarg, "cnfp") == 0)
1793 ndo->ndo_packettype = PT_CNFP;
1794 else if (ascii_strcasecmp(optarg, "tftp") == 0)
1795 ndo->ndo_packettype = PT_TFTP;
1796 else if (ascii_strcasecmp(optarg, "aodv") == 0)
1797 ndo->ndo_packettype = PT_AODV;
1798 else if (ascii_strcasecmp(optarg, "carp") == 0)
1799 ndo->ndo_packettype = PT_CARP;
1800 else if (ascii_strcasecmp(optarg, "radius") == 0)
1801 ndo->ndo_packettype = PT_RADIUS;
1802 else if (ascii_strcasecmp(optarg, "zmtp1") == 0)
1803 ndo->ndo_packettype = PT_ZMTP1;
1804 else if (ascii_strcasecmp(optarg, "vxlan") == 0)
1805 ndo->ndo_packettype = PT_VXLAN;
1806 else if (ascii_strcasecmp(optarg, "pgm") == 0)
1807 ndo->ndo_packettype = PT_PGM;
1808 else if (ascii_strcasecmp(optarg, "pgm_zmtp1") == 0)
1809 ndo->ndo_packettype = PT_PGM_ZMTP1;
1810 else if (ascii_strcasecmp(optarg, "lmp") == 0)
1811 ndo->ndo_packettype = PT_LMP;
1812 else if (ascii_strcasecmp(optarg, "resp") == 0)
1813 ndo->ndo_packettype = PT_RESP;
1814 else if (ascii_strcasecmp(optarg, "ptp") == 0)
1815 ndo->ndo_packettype = PT_PTP;
1816 else if (ascii_strcasecmp(optarg, "someip") == 0)
1817 ndo->ndo_packettype = PT_SOMEIP;
1818 else if (ascii_strcasecmp(optarg, "domain") == 0)
1819 ndo->ndo_packettype = PT_DOMAIN;
1821 error("unknown packet type `%s'", optarg);
1828 #ifdef HAVE_PCAP_DUMP_FLUSH
1847 Wflag = atoi(optarg);
1849 error("invalid number of output files %s", optarg);
1850 WflagChars = getWflagChars(Wflag);
1855 ++ndo->ndo_suppress_default_print;
1860 ++ndo->ndo_suppress_default_print;
1864 yflag_dlt_name = optarg;
1866 pcap_datalink_name_to_val(yflag_dlt_name);
1868 error("invalid data link type %s", yflag_dlt_name);
1871 #ifdef HAVE_PCAP_SET_PARSER_DEBUG
1874 /* Undocumented flag */
1875 pcap_set_parser_debug(1);
1888 ndo->ndo_packet_number = 1;
1891 case OPTION_VERSION:
1892 print_version(stdout);
1893 exit_tcpdump(S_SUCCESS);
1896 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
1897 case OPTION_TSTAMP_PRECISION:
1898 ndo->ndo_tstamp_precision = tstamp_precision_from_string(optarg);
1899 if (ndo->ndo_tstamp_precision < 0)
1900 error("unsupported time stamp precision");
1904 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
1905 case OPTION_IMMEDIATE_MODE:
1914 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
1915 case OPTION_TSTAMP_MICRO:
1916 ndo->ndo_tstamp_precision = PCAP_TSTAMP_PRECISION_MICRO;
1919 case OPTION_TSTAMP_NANO:
1920 ndo->ndo_tstamp_precision = PCAP_TSTAMP_PRECISION_NANO;
1924 case OPTION_FP_TYPE:
1926 * Print out the type of floating-point arithmetic
1927 * we're doing; it's probably IEEE, unless somebody
1928 * tries to run this on a VAX, but the precision
1929 * may differ (e.g., it might be 32-bit, 64-bit,
1932 float_type_check(0x4e93312d);
1940 print_usage(stderr);
1941 exit_tcpdump(S_ERR_HOST_PROGRAM);
1945 #ifdef HAVE_PCAP_FINDALLDEVS
1947 show_devices_and_exit();
1949 #ifdef HAVE_PCAP_FINDALLDEVS_EX
1950 if (remote_interfaces_source != NULL)
1951 show_remote_devices_and_exit();
1954 #if defined(DLT_LINUX_SLL2) && defined(HAVE_PCAP_SET_DATALINK)
1955 /* Set default linktype DLT_LINUX_SLL2 when capturing on the "any" device */
1956 if (device != NULL &&
1957 strncmp (device, "any", strlen("any")) == 0
1959 yflag_dlt = DLT_LINUX_SLL2;
1962 switch (ndo->ndo_tflag) {
1964 case 0: /* Default */
1965 case 1: /* No time stamp */
1966 case 2: /* Unix timeval style */
1967 case 3: /* Microseconds/nanoseconds since previous packet */
1968 case 4: /* Date + Default */
1969 case 5: /* Microseconds/nanoseconds since first packet */
1972 default: /* Not supported */
1973 error("only -t, -tt, -ttt, -tttt and -ttttt are supported");
1977 if (ndo->ndo_fflag != 0 && (VFileName != NULL || RFileName != NULL))
1978 error("-f can not be used with -V or -r");
1980 if (VFileName != NULL && RFileName != NULL)
1981 error("-V and -r are mutually exclusive.");
1984 * If we're printing dissected packets to the standard output,
1985 * and either the standard output is a terminal or we're doing
1986 * "line" buffering, set the capture timeout to .1 second rather
1987 * than 1 second, as the user's probably expecting to see packets
1988 * pop up immediately shortly after they arrive.
1990 * XXX - would there be some value appropriate for all cases,
1991 * based on, say, the buffer size and packet input rate?
1993 if ((WFileName == NULL || print) && (isatty(1) || lflag))
1997 /* if run as root, prepare for chrooting */
1998 if (getuid() == 0 || geteuid() == 0) {
1999 /* future extensibility for cmd-line arguments */
2001 chroot_dir = WITH_CHROOT;
2006 /* if run as root, prepare for dropping root privileges */
2007 if (getuid() == 0 || geteuid() == 0) {
2008 /* Run with '-Z root' to restore old behaviour */
2010 username = WITH_USER;
2014 if (RFileName != NULL || VFileName != NULL) {
2016 * If RFileName is non-null, it's the pathname of a
2017 * savefile to read. If VFileName is non-null, it's
2018 * the pathname of a file containing a list of pathnames
2019 * (one per line) of savefiles to read.
2021 * In either case, we're reading a savefile, not doing
2026 * We don't need network access, so relinquish any set-UID
2027 * or set-GID privileges we have (if any).
2029 * We do *not* want set-UID privileges when opening a
2030 * trace file, as that might let the user read other
2031 * people's trace files (especially if we're set-UID
2034 if (setgid(getgid()) != 0 || setuid(getuid()) != 0 )
2035 fprintf(stderr, "Warning: setgid/setuid failed !\n");
2037 if (VFileName != NULL) {
2038 if (VFileName[0] == '-' && VFileName[1] == '\0')
2041 VFile = fopen(VFileName, "r");
2044 error("Unable to open file: %s\n", pcap_strerror(errno));
2046 ret = get_next_file(VFile, VFileLine);
2048 error("Nothing in %s\n", VFileName);
2049 RFileName = VFileLine;
2052 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
2053 pd = pcap_open_offline_with_tstamp_precision(RFileName,
2054 ndo->ndo_tstamp_precision, ebuf);
2056 pd = pcap_open_offline(RFileName, ebuf);
2061 #ifdef HAVE_CAPSICUM
2062 cap_rights_init(&rights, CAP_READ);
2063 if (cap_rights_limit(fileno(pcap_file(pd)), &rights) < 0 &&
2065 error("unable to limit pcap descriptor");
2068 dlt = pcap_datalink(pd);
2069 dlt_name = pcap_datalink_val_to_name(dlt);
2070 fprintf(stderr, "reading from file %s", RFileName);
2071 if (dlt_name == NULL) {
2072 fprintf(stderr, ", link-type %u", dlt);
2074 fprintf(stderr, ", link-type %s (%s)", dlt_name,
2075 pcap_datalink_val_to_description(dlt));
2077 fprintf(stderr, ", snapshot length %d\n", pcap_snapshot(pd));
2078 #ifdef DLT_LINUX_SLL2
2079 if (dlt == DLT_LINUX_SLL2)
2080 fprintf(stderr, "Warning: interface names might be incorrect\n");
2082 } else if (dflag && !device) {
2083 int dump_dlt = DLT_EN10MB;
2085 * We're dumping the compiled code without an explicit
2086 * device specification. (If a device is specified, we
2087 * definitely want to open it to use the DLT of that device.)
2088 * Either default to DLT_EN10MB with a warning, or use
2089 * the user-specified value if supplied.
2092 * If no snapshot length was specified, or a length of 0 was
2093 * specified, default to 256KB.
2095 if (ndo->ndo_snaplen == 0)
2096 ndo->ndo_snaplen = MAXIMUM_SNAPLEN;
2098 * If a DLT was specified with the -y flag, use that instead.
2100 if (yflag_dlt != -1)
2101 dump_dlt = yflag_dlt;
2103 fprintf(stderr, "Warning: assuming Ethernet\n");
2104 pd = pcap_open_dead(dump_dlt, ndo->ndo_snaplen);
2107 * We're doing a live capture.
2109 if (device == NULL) {
2111 * No interface was specified. Pick one.
2113 #ifdef HAVE_PCAP_FINDALLDEVS
2115 * Find the list of interfaces, and pick
2116 * the first interface.
2118 if (pcap_findalldevs(&devlist, ebuf) == -1)
2120 if (devlist == NULL)
2121 error("no interfaces available for capture");
2122 device = strdup(devlist->name);
2123 pcap_freealldevs(devlist);
2124 #else /* HAVE_PCAP_FINDALLDEVS */
2126 * Use whatever interface pcap_lookupdev()
2129 device = pcap_lookupdev(ebuf);
2136 * Try to open the interface with the specified name.
2138 pd = open_interface(device, ndo, ebuf);
2141 * That failed. If we can get a list of
2142 * interfaces, and the interface name
2143 * is purely numeric, try to use it as
2144 * a 1-based index in the list of
2147 #ifdef HAVE_PCAP_FINDALLDEVS
2148 devnum = parse_interface_number(device);
2151 * It's not a number; just report
2152 * the open error and fail.
2158 * OK, it's a number; try to find the
2159 * interface with that index, and try
2162 * find_interface_by_number() exits if it
2163 * couldn't be found.
2165 device = find_interface_by_number(device, devnum);
2166 pd = open_interface(device, ndo, ebuf);
2169 #else /* HAVE_PCAP_FINDALLDEVS */
2171 * We can't get a list of interfaces; just
2175 #endif /* HAVE_PCAP_FINDALLDEVS */
2179 * Let user own process after capture device has
2183 if (setgid(getgid()) != 0 || setuid(getuid()) != 0)
2184 fprintf(stderr, "Warning: setgid/setuid failed !\n");
2186 #if !defined(HAVE_PCAP_CREATE) && defined(_WIN32)
2188 if(pcap_setbuff(pd, Bflag)==-1){
2189 error("%s", pcap_geterr(pd));
2191 #endif /* !defined(HAVE_PCAP_CREATE) && defined(_WIN32) */
2193 show_dlts_and_exit(pd, device);
2194 if (yflag_dlt >= 0) {
2195 #ifdef HAVE_PCAP_SET_DATALINK
2196 if (pcap_set_datalink(pd, yflag_dlt) < 0)
2197 error("%s", pcap_geterr(pd));
2200 * We don't actually support changing the
2201 * data link type, so we only let them
2202 * set it to what it already is.
2204 if (yflag_dlt != pcap_datalink(pd)) {
2205 error("%s is not one of the DLTs supported by this device\n",
2209 (void)fprintf(stderr, "%s: data link type %s\n",
2211 pcap_datalink_val_to_name(yflag_dlt));
2212 (void)fflush(stderr);
2214 i = pcap_snapshot(pd);
2215 if (ndo->ndo_snaplen < i) {
2216 if (ndo->ndo_snaplen != 0)
2217 warning("snaplen raised from %d to %d", ndo->ndo_snaplen, i);
2218 ndo->ndo_snaplen = i;
2219 } else if (ndo->ndo_snaplen > i) {
2220 warning("snaplen lowered from %d to %d", ndo->ndo_snaplen, i);
2221 ndo->ndo_snaplen = i;
2223 if(ndo->ndo_fflag != 0) {
2224 if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) {
2225 warning("foreign (-f) flag used but: %s", ebuf);
2231 cmdbuf = read_infile(infile);
2233 cmdbuf = copy_argv(&argv[optind]);
2235 #ifdef HAVE_PCAP_SET_OPTIMIZER_DEBUG
2236 pcap_set_optimizer_debug(dflag);
2238 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
2239 error("%s", pcap_geterr(pd));
2241 bpf_dump(&fcode, dflag);
2244 pcap_freecode(&fcode);
2245 exit_tcpdump(S_SUCCESS);
2249 if (!ndo->ndo_nflag)
2250 capdns = capdns_setup();
2251 #endif /* HAVE_CASPER */
2253 init_print(ndo, localnet, netmask);
2256 (void)setsignal(SIGPIPE, cleanup);
2257 (void)setsignal(SIGTERM, cleanup);
2259 (void)setsignal(SIGINT, cleanup);
2260 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
2261 (void)setsignal(SIGCHLD, child_cleanup);
2263 /* Cooperate with nohup(1) */
2265 if ((oldhandler = setsignal(SIGHUP, cleanup)) != SIG_DFL)
2266 (void)setsignal(SIGHUP, oldhandler);
2271 * If a user name was specified with "-Z", attempt to switch to
2272 * that user's UID. This would probably be used with sudo,
2273 * to allow tcpdump to be run in a special restricted
2274 * account (if you just want to allow users to open capture
2275 * devices, and can't just give users that permission,
2276 * you'd make tcpdump set-UID or set-GID).
2278 * Tcpdump doesn't necessarily write only to one savefile;
2279 * the general only way to allow a -Z instance to write to
2280 * savefiles as the user under whose UID it's run, rather
2281 * than as the user specified with -Z, would thus be to switch
2282 * to the original user ID before opening a capture file and
2283 * then switch back to the -Z user ID after opening the savefile.
2284 * Switching to the -Z user ID only after opening the first
2285 * savefile doesn't handle the general case.
2288 if (getuid() == 0 || geteuid() == 0) {
2289 #ifdef HAVE_LIBCAP_NG
2290 /* Initialize capng */
2291 capng_clear(CAPNG_SELECT_BOTH);
2293 DIAG_OFF_CLANG(assign-enum)
2296 CAPNG_PERMITTED | CAPNG_EFFECTIVE,
2300 DIAG_ON_CLANG(assign-enum)
2303 DIAG_OFF_CLANG(assign-enum)
2306 CAPNG_PERMITTED | CAPNG_EFFECTIVE,
2309 DIAG_ON_CLANG(assign-enum)
2313 DIAG_OFF_CLANG(assign-enum)
2316 CAPNG_PERMITTED | CAPNG_EFFECTIVE,
2319 DIAG_ON_CLANG(assign-enum)
2321 capng_apply(CAPNG_SELECT_BOTH);
2322 #endif /* HAVE_LIBCAP_NG */
2323 if (username || chroot_dir)
2324 droproot(username, chroot_dir);
2329 if (pcap_setfilter(pd, &fcode) < 0)
2330 error("%s", pcap_geterr(pd));
2331 #ifdef HAVE_CAPSICUM
2332 if (RFileName == NULL && VFileName == NULL && pcap_fileno(pd) != -1) {
2333 static const unsigned long cmds[] = { BIOCGSTATS, BIOCROTZBUF };
2336 * The various libpcap devices use a combination of
2337 * read (bpf), ioctl (bpf, netmap), poll (netmap)
2338 * so we add the relevant access rights.
2340 cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_EVENT);
2341 if (cap_rights_limit(pcap_fileno(pd), &rights) < 0 &&
2343 error("unable to limit pcap descriptor");
2345 if (cap_ioctls_limit(pcap_fileno(pd), cmds,
2346 sizeof(cmds) / sizeof(cmds[0])) < 0 && errno != ENOSYS) {
2347 error("unable to limit ioctls on pcap descriptor");
2352 /* Do not exceed the default PATH_MAX for files. */
2353 dumpinfo.CurrentFileName = (char *)malloc(PATH_MAX + 1);
2355 if (dumpinfo.CurrentFileName == NULL)
2356 error("malloc of dumpinfo.CurrentFileName");
2358 /* We do not need numbering for dumpfiles if Cflag isn't set. */
2360 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, WflagChars);
2362 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0);
2364 pdd = pcap_dump_open(pd, dumpinfo.CurrentFileName);
2365 #ifdef HAVE_LIBCAP_NG
2366 /* Give up CAP_DAC_OVERRIDE capability.
2367 * Only allow it to be restored if the -C or -G flag have been
2368 * set since we may need to create more files later on.
2372 (Cflag || Gflag ? 0 : CAPNG_PERMITTED)
2376 capng_apply(CAPNG_SELECT_BOTH);
2377 #endif /* HAVE_LIBCAP_NG */
2379 error("%s", pcap_geterr(pd));
2380 #ifdef HAVE_CAPSICUM
2381 set_dumper_capsicum_rights(pdd);
2383 if (Cflag != 0 || Gflag != 0) {
2384 #ifdef HAVE_CAPSICUM
2385 dumpinfo.WFileName = strdup(basename(WFileName));
2386 if (dumpinfo.WFileName == NULL) {
2387 error("Unable to allocate memory for file %s",
2390 dumpinfo.dirfd = open(dirname(WFileName),
2391 O_DIRECTORY | O_RDONLY);
2392 if (dumpinfo.dirfd < 0) {
2393 error("unable to open directory %s",
2394 dirname(WFileName));
2396 cap_rights_init(&rights, CAP_CREATE, CAP_FCNTL,
2397 CAP_FTRUNCATE, CAP_LOOKUP, CAP_SEEK, CAP_WRITE);
2398 if (cap_rights_limit(dumpinfo.dirfd, &rights) < 0 &&
2400 error("unable to limit directory rights");
2402 if (cap_fcntls_limit(dumpinfo.dirfd, CAP_FCNTL_GETFL) < 0 &&
2404 error("unable to limit dump descriptor fcntls");
2406 #else /* !HAVE_CAPSICUM */
2407 dumpinfo.WFileName = WFileName;
2409 callback = dump_packet_and_trunc;
2412 pcap_userdata = (u_char *)&dumpinfo;
2414 callback = dump_packet;
2415 dumpinfo.WFileName = WFileName;
2418 pcap_userdata = (u_char *)&dumpinfo;
2421 dlt = pcap_datalink(pd);
2422 ndo->ndo_if_printer = get_if_printer(dlt);
2425 dumpinfo.ndo = NULL;
2427 #ifdef HAVE_PCAP_DUMP_FLUSH
2429 pcap_dump_flush(pdd);
2432 dlt = pcap_datalink(pd);
2433 ndo->ndo_if_printer = get_if_printer(dlt);
2434 callback = print_packet;
2435 pcap_userdata = (u_char *)ndo;
2438 #ifdef SIGNAL_REQ_INFO
2440 * We can't get statistics when reading from a file rather
2441 * than capturing from a device.
2443 if (RFileName == NULL)
2444 (void)setsignal(SIGNAL_REQ_INFO, requestinfo);
2446 #ifdef SIGNAL_FLUSH_PCAP
2447 (void)setsignal(SIGNAL_FLUSH_PCAP, flushpcap);
2450 if (ndo->ndo_vflag > 0 && WFileName && RFileName == NULL && !print) {
2452 * When capturing to a file, if "--print" wasn't specified,
2453 *"-v" means tcpdump should, once per second,
2454 * "v"erbosely report the number of packets captured.
2455 * Except when reading from a file, because -r, -w and -v
2456 * together used to make a corner case, in which pcap_loop()
2457 * errored due to EINTR (see GH #155 for details).
2461 * https://blogs.msdn.microsoft.com/oldnewthing/20151230-00/?p=92741
2463 * suggests that this dates back to W2K.
2465 * I don't know what a "long wait" is, but we'll assume
2466 * that printing the stats could be a "long wait".
2468 CreateTimerQueueTimer(&timer_handle, NULL,
2469 verbose_stats_dump, NULL, 1000, 1000,
2470 WT_EXECUTEDEFAULT|WT_EXECUTELONGFUNCTION);
2471 setvbuf(stderr, NULL, _IONBF, 0);
2474 * Assume this is UN*X, and that it has setitimer(); that
2475 * dates back to UNIX 95.
2477 struct itimerval timer;
2478 (void)setsignal(SIGALRM, verbose_stats_dump);
2479 timer.it_interval.tv_sec = 1;
2480 timer.it_interval.tv_usec = 0;
2481 timer.it_value.tv_sec = 1;
2482 timer.it_value.tv_usec = 1;
2483 setitimer(ITIMER_REAL, &timer, NULL);
2487 if (RFileName == NULL) {
2489 * Live capture (if -V was specified, we set RFileName
2490 * to a file from the -V file). Print a message to
2491 * the standard error on UN*X.
2493 if (!ndo->ndo_vflag && !WFileName) {
2494 (void)fprintf(stderr,
2495 "%s: verbose output suppressed, use -v[v]... for full protocol decode\n",
2498 (void)fprintf(stderr, "%s: ", program_name);
2499 dlt = pcap_datalink(pd);
2500 dlt_name = pcap_datalink_val_to_name(dlt);
2501 (void)fprintf(stderr, "listening on %s", device);
2502 if (dlt_name == NULL) {
2503 (void)fprintf(stderr, ", link-type %u", dlt);
2505 (void)fprintf(stderr, ", link-type %s (%s)", dlt_name,
2506 pcap_datalink_val_to_description(dlt));
2508 (void)fprintf(stderr, ", snapshot length %d bytes\n", ndo->ndo_snaplen);
2509 (void)fflush(stderr);
2512 #ifdef HAVE_CAPSICUM
2513 cansandbox = (VFileName == NULL && zflag == NULL);
2515 cansandbox = (cansandbox && (ndo->ndo_nflag || capdns != NULL));
2517 cansandbox = (cansandbox && ndo->ndo_nflag);
2518 #endif /* HAVE_CASPER */
2519 if (cansandbox && cap_enter() < 0 && errno != ENOSYS)
2520 error("unable to enter the capability mode");
2521 #endif /* HAVE_CAPSICUM */
2524 status = pcap_loop(pd, cnt, callback, pcap_userdata);
2525 if (WFileName == NULL) {
2527 * We're printing packets. Flush the printed output,
2528 * so it doesn't get intermingled with error output.
2532 * We got interrupted, so perhaps we didn't
2533 * manage to finish a line we were printing.
2534 * Print an extra newline, just in case.
2538 (void)fflush(stdout);
2542 * We got interrupted. If we are reading multiple
2543 * files (via -V) set these so that we stop.
2552 (void)fprintf(stderr, "%s: pcap_loop: %s\n",
2553 program_name, pcap_geterr(pd));
2555 if (RFileName == NULL) {
2557 * We're doing a live capture. Report the capture
2563 if (VFileName != NULL) {
2564 ret = get_next_file(VFile, VFileLine);
2568 RFileName = VFileLine;
2569 pd = pcap_open_offline(RFileName, ebuf);
2572 #ifdef HAVE_CAPSICUM
2573 cap_rights_init(&rights, CAP_READ);
2574 if (cap_rights_limit(fileno(pcap_file(pd)),
2575 &rights) < 0 && errno != ENOSYS) {
2576 error("unable to limit pcap descriptor");
2579 new_dlt = pcap_datalink(pd);
2580 if (new_dlt != dlt) {
2582 * The new file has a different
2583 * link-layer header type from the
2586 if (WFileName != NULL) {
2588 * We're writing raw packets
2589 * that match the filter to
2590 * a pcap file. pcap files
2591 * don't support multiple
2592 * different link-layer
2593 * header types, so we fail
2596 error("%s: new dlt does not match original", RFileName);
2600 * We're printing the decoded packets;
2601 * switch to the new DLT.
2603 * To do that, we need to change
2604 * the printer, change the DLT name,
2605 * and recompile the filter with
2609 ndo->ndo_if_printer = get_if_printer(dlt);
2610 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
2611 error("%s", pcap_geterr(pd));
2615 * Set the filter on the new file.
2617 if (pcap_setfilter(pd, &fcode) < 0)
2618 error("%s", pcap_geterr(pd));
2621 * Report the new file.
2623 dlt_name = pcap_datalink_val_to_name(dlt);
2624 fprintf(stderr, "reading from file %s", RFileName);
2625 if (dlt_name == NULL) {
2626 fprintf(stderr, ", link-type %u", dlt);
2628 fprintf(stderr, ", link-type %s (%s)",
2630 pcap_datalink_val_to_description(dlt));
2632 fprintf(stderr, ", snapshot length %d\n", pcap_snapshot(pd));
2636 while (ret != NULL);
2638 if (count_mode && RFileName != NULL)
2639 fprintf(stdout, "%u packet%s\n", packets_captured,
2640 PLURAL_SUFFIX(packets_captured));
2643 pcap_freecode(&fcode);
2644 exit_tcpdump(status == -1 ? 1 : 0);
2651 (*setsignal (int sig, void (*func)(int)))(int)
2654 return (signal(sig, func));
2656 struct sigaction old, new;
2658 memset(&new, 0, sizeof(new));
2659 new.sa_handler = func;
2661 new.sa_flags = SA_RESTART;
2662 if (sigaction(sig, &new, &old) < 0)
2664 return (old.sa_handler);
2668 /* make a clean exit on interrupts */
2670 cleanup(int signo _U_)
2673 if (timer_handle != INVALID_HANDLE_VALUE) {
2674 DeleteTimerQueueTimer(NULL, timer_handle, NULL);
2675 CloseHandle(timer_handle);
2676 timer_handle = INVALID_HANDLE_VALUE;
2679 struct itimerval timer;
2681 timer.it_interval.tv_sec = 0;
2682 timer.it_interval.tv_usec = 0;
2683 timer.it_value.tv_sec = 0;
2684 timer.it_value.tv_usec = 0;
2685 setitimer(ITIMER_REAL, &timer, NULL);
2688 #ifdef HAVE_PCAP_BREAKLOOP
2690 * We have "pcap_breakloop()"; use it, so that we do as little
2691 * as possible in the signal handler (it's probably not safe
2692 * to do anything with standard I/O streams in a signal handler -
2693 * the ANSI C standard doesn't say it is).
2698 * We don't have "pcap_breakloop()"; this isn't safe, but
2699 * it's the best we can do. Print the summary if we're
2700 * not reading from a savefile - i.e., if we're doing a
2701 * live capture - and exit.
2703 if (pd != NULL && pcap_file(pd) == NULL) {
2705 * We got interrupted, so perhaps we didn't
2706 * manage to finish a line we were printing.
2707 * Print an extra newline, just in case.
2710 (void)fflush(stdout);
2713 exit_tcpdump(S_SUCCESS);
2718 On windows, we do not use a fork, so we do not care less about
2719 waiting a child processes to die
2721 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
2723 child_cleanup(int signo _U_)
2727 #endif /* HAVE_FORK && HAVE_VFORK */
2732 struct pcap_stat stats;
2735 * Older versions of libpcap didn't set ps_ifdrop on some
2736 * platforms; initialize it to 0 to handle that.
2738 stats.ps_ifdrop = 0;
2739 if (pcap_stats(pd, &stats) < 0) {
2740 (void)fprintf(stderr, "pcap_stats: %s\n", pcap_geterr(pd));
2746 fprintf(stderr, "%s: ", program_name);
2748 (void)fprintf(stderr, "%u packet%s captured", packets_captured,
2749 PLURAL_SUFFIX(packets_captured));
2751 fputs(", ", stderr);
2754 (void)fprintf(stderr, "%u packet%s received by filter", stats.ps_recv,
2755 PLURAL_SUFFIX(stats.ps_recv));
2757 fputs(", ", stderr);
2760 (void)fprintf(stderr, "%u packet%s dropped by kernel", stats.ps_drop,
2761 PLURAL_SUFFIX(stats.ps_drop));
2762 if (stats.ps_ifdrop != 0) {
2764 fputs(", ", stderr);
2767 (void)fprintf(stderr, "%u packet%s dropped by interface\n",
2768 stats.ps_ifdrop, PLURAL_SUFFIX(stats.ps_ifdrop));
2774 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
2776 #define fork_subprocess() fork()
2778 #define fork_subprocess() vfork()
2781 compress_savefile(const char *filename)
2785 child = fork_subprocess();
2788 "compress_savefile: fork failed: %s\n",
2789 pcap_strerror(errno));
2793 /* Parent process. */
2799 * Set to lowest priority so that this doesn't disturb the capture.
2802 setpriority(PRIO_PROCESS, 0, NZERO - 1);
2804 setpriority(PRIO_PROCESS, 0, 19);
2806 if (execlp(zflag, zflag, filename, (char *)NULL) == -1)
2808 "compress_savefile: execlp(%s, %s) failed: %s\n",
2811 pcap_strerror(errno));
2813 exit(S_ERR_HOST_PROGRAM);
2815 _exit(S_ERR_HOST_PROGRAM);
2818 #else /* HAVE_FORK && HAVE_VFORK */
2820 compress_savefile(const char *filename)
2823 "compress_savefile failed. Functionality not implemented under your system\n");
2825 #endif /* HAVE_FORK && HAVE_VFORK */
2828 dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
2830 struct dump_info *dump_info;
2836 dump_info = (struct dump_info *)user;
2839 * XXX - this won't force the file to rotate on the specified time
2840 * boundary, but it will rotate on the first packet received after the
2841 * specified Gflag number of seconds. Note: if a Gflag time boundary
2842 * and a Cflag size boundary coincide, the time rotation will occur
2843 * first thereby cancelling the Cflag boundary (since the file should
2847 /* Check if it is time to rotate */
2850 /* Get the current time */
2851 if ((t = time(NULL)) == (time_t)-1) {
2852 error("%s: can't get current_time: %s",
2853 __func__, pcap_strerror(errno));
2857 /* If the time is greater than the specified window, rotate */
2858 if (t - Gflag_time >= Gflag) {
2859 #ifdef HAVE_CAPSICUM
2864 /* Update the Gflag_time */
2866 /* Update Gflag_count */
2869 * Close the current file and open a new one.
2871 pcap_dump_close(dump_info->pdd);
2874 * Compress the file we just closed, if the user asked for it
2877 compress_savefile(dump_info->CurrentFileName);
2880 * Check to see if we've exceeded the Wflag (when
2883 if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) {
2884 (void)fprintf(stderr, "Maximum file limit reached: %d\n",
2887 exit_tcpdump(S_SUCCESS);
2890 if (dump_info->CurrentFileName != NULL)
2891 free(dump_info->CurrentFileName);
2892 /* Allocate space for max filename + \0. */
2893 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1);
2894 if (dump_info->CurrentFileName == NULL)
2895 error("dump_packet_and_trunc: malloc");
2897 * Gflag was set otherwise we wouldn't be here. Reset the count
2898 * so multiple files would end with 1,2,3 in the filename.
2899 * The counting is handled with the -C flow after this.
2904 * This is always the first file in the Cflag
2906 * We also don't need numbering if Cflag is not set.
2909 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0,
2912 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 0);
2914 #ifdef HAVE_LIBCAP_NG
2915 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
2916 capng_apply(CAPNG_SELECT_BOTH);
2917 #endif /* HAVE_LIBCAP_NG */
2918 #ifdef HAVE_CAPSICUM
2919 fd = openat(dump_info->dirfd,
2920 dump_info->CurrentFileName,
2921 O_CREAT | O_WRONLY | O_TRUNC, 0644);
2923 error("unable to open file %s",
2924 dump_info->CurrentFileName);
2926 fp = fdopen(fd, "w");
2928 error("unable to fdopen file %s",
2929 dump_info->CurrentFileName);
2931 dump_info->pdd = pcap_dump_fopen(dump_info->pd, fp);
2932 #else /* !HAVE_CAPSICUM */
2933 dump_info->pdd = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
2935 #ifdef HAVE_LIBCAP_NG
2936 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
2937 capng_apply(CAPNG_SELECT_BOTH);
2938 #endif /* HAVE_LIBCAP_NG */
2939 if (dump_info->pdd == NULL)
2940 error("%s", pcap_geterr(pd));
2941 #ifdef HAVE_CAPSICUM
2942 set_dumper_capsicum_rights(dump_info->pdd);
2948 * XXX - this won't prevent capture files from getting
2949 * larger than Cflag - the last packet written to the
2950 * file could put it over Cflag.
2953 #ifdef HAVE_PCAP_DUMP_FTELL64
2954 int64_t size = pcap_dump_ftell64(dump_info->pdd);
2957 * XXX - this only handles a Cflag value > 2^31-1 on
2958 * LP64 platforms; to handle ILP32 (32-bit UN*X and
2959 * Windows) or LLP64 (64-bit Windows) would require
2960 * a version of libpcap with pcap_dump_ftell64().
2962 long size = pcap_dump_ftell(dump_info->pdd);
2966 error("ftell fails on output file");
2968 #ifdef HAVE_CAPSICUM
2974 * Close the current file and open a new one.
2976 pcap_dump_close(dump_info->pdd);
2979 * Compress the file we just closed, if the user
2983 compress_savefile(dump_info->CurrentFileName);
2987 if (Cflag_count >= Wflag)
2990 if (dump_info->CurrentFileName != NULL)
2991 free(dump_info->CurrentFileName);
2992 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1);
2993 if (dump_info->CurrentFileName == NULL)
2994 error("%s: malloc", __func__);
2995 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars);
2996 #ifdef HAVE_LIBCAP_NG
2997 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
2998 capng_apply(CAPNG_SELECT_BOTH);
2999 #endif /* HAVE_LIBCAP_NG */
3000 #ifdef HAVE_CAPSICUM
3001 fd = openat(dump_info->dirfd, dump_info->CurrentFileName,
3002 O_CREAT | O_WRONLY | O_TRUNC, 0644);
3004 error("unable to open file %s",
3005 dump_info->CurrentFileName);
3007 fp = fdopen(fd, "w");
3009 error("unable to fdopen file %s",
3010 dump_info->CurrentFileName);
3012 dump_info->pdd = pcap_dump_fopen(dump_info->pd, fp);
3013 #else /* !HAVE_CAPSICUM */
3014 dump_info->pdd = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
3016 #ifdef HAVE_LIBCAP_NG
3017 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
3018 capng_apply(CAPNG_SELECT_BOTH);
3019 #endif /* HAVE_LIBCAP_NG */
3020 if (dump_info->pdd == NULL)
3021 error("%s", pcap_geterr(pd));
3022 #ifdef HAVE_CAPSICUM
3023 set_dumper_capsicum_rights(dump_info->pdd);
3028 pcap_dump((u_char *)dump_info->pdd, h, sp);
3029 #ifdef HAVE_PCAP_DUMP_FLUSH
3031 pcap_dump_flush(dump_info->pdd);
3034 if (dump_info->ndo != NULL)
3035 pretty_print_packet(dump_info->ndo, h, sp, packets_captured);
3043 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
3045 struct dump_info *dump_info;
3051 dump_info = (struct dump_info *)user;
3053 pcap_dump((u_char *)dump_info->pdd, h, sp);
3054 #ifdef HAVE_PCAP_DUMP_FLUSH
3056 pcap_dump_flush(dump_info->pdd);
3059 if (dump_info->ndo != NULL)
3060 pretty_print_packet(dump_info->ndo, h, sp, packets_captured);
3068 print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
3075 pretty_print_packet((netdissect_options *)user, h, sp, packets_captured);
3082 #ifdef SIGNAL_REQ_INFO
3084 requestinfo(int signo _U_)
3093 #ifdef SIGNAL_FLUSH_PCAP
3095 flushpcap(int signo _U_)
3098 pcap_dump_flush(pdd);
3103 print_packets_captured (void)
3105 static u_int prev_packets_captured, first = 1;
3107 if (infodelay == 0 && (first || packets_captured != prev_packets_captured)) {
3108 fprintf(stderr, "Got %u\r", packets_captured);
3110 prev_packets_captured = packets_captured;
3115 * Called once each second in verbose mode while dumping to file
3118 static void CALLBACK verbose_stats_dump(PVOID param _U_,
3119 BOOLEAN timer_fired _U_)
3121 print_packets_captured();
3124 static void verbose_stats_dump(int sig _U_)
3126 print_packets_captured();
3130 USES_APPLE_DEPRECATED_API
3132 print_version(FILE *f)
3134 #ifndef HAVE_PCAP_LIB_VERSION
3135 #ifdef HAVE_PCAP_VERSION
3136 extern char pcap_version[];
3137 #else /* HAVE_PCAP_VERSION */
3138 static char pcap_version[] = "unknown";
3139 #endif /* HAVE_PCAP_VERSION */
3140 #endif /* HAVE_PCAP_LIB_VERSION */
3141 const char *smi_version_string;
3143 (void)fprintf(f, "%s version " PACKAGE_VERSION "\n", program_name);
3144 #ifdef HAVE_PCAP_LIB_VERSION
3145 (void)fprintf(f, "%s\n", pcap_lib_version());
3146 #else /* HAVE_PCAP_LIB_VERSION */
3147 (void)fprintf(f, "libpcap version %s\n", pcap_version);
3148 #endif /* HAVE_PCAP_LIB_VERSION */
3150 #if defined(HAVE_LIBCRYPTO) && defined(SSLEAY_VERSION)
3151 (void)fprintf (f, "%s\n", SSLeay_version(SSLEAY_VERSION));
3154 smi_version_string = nd_smi_version_string();
3155 if (smi_version_string != NULL)
3156 (void)fprintf (f, "SMI-library: %s\n", smi_version_string);
3158 #if defined(__SANITIZE_ADDRESS__)
3159 (void)fprintf (f, "Compiled with AddressSanitizer/GCC.\n");
3160 #elif defined(__has_feature)
3161 # if __has_feature(address_sanitizer)
3162 (void)fprintf (f, "Compiled with AddressSanitizer/Clang.\n");
3163 # elif __has_feature(memory_sanitizer)
3164 (void)fprintf (f, "Compiled with MemorySanitizer/Clang.\n");
3166 #endif /* __SANITIZE_ADDRESS__ or __has_feature */
3171 print_usage(FILE *f)
3175 "Usage: %s [-Abd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ] [--count]\n", program_name);
3177 "\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n");
3179 "\t\t[ -i interface ]" IMMEDIATE_MODE_USAGE j_FLAG_USAGE "\n");
3180 #ifdef HAVE_PCAP_FINDALLDEVS_EX
3182 "\t\t" LIST_REMOTE_INTERFACES_USAGE "\n");
3186 "\t\t" m_FLAG_USAGE "\n");
3189 "\t\t[ -M secret ] [ --number ] [ --print ]" Q_FLAG_USAGE "\n");
3191 "\t\t[ -r file ] [ -s snaplen ] [ -T type ] [ --version ]\n");
3193 "\t\t[ -V file ] [ -w file ] [ -W filecount ] [ -y datalinktype ]\n");
3194 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
3196 "\t\t[ --time-stamp-precision precision ] [ --micro ] [ --nano ]\n");
3199 "\t\t[ -z postrotate-command ] [ -Z user ] [ expression ]\n");