2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 * Support for splitting captures into multiple files with a maximum
25 * Seth Webster <swebster@sst.ll.mit.edu>
35 #include <netdissect-stdinc.h>
37 #include "netdissect.h"
38 #include "addrtoname.h"
46 static const struct printer printers[] = {
47 { ether_if_print, DLT_EN10MB },
49 { ipnet_if_print, DLT_IPNET },
51 #ifdef DLT_IEEE802_15_4
52 { ieee802_15_4_if_print, DLT_IEEE802_15_4 },
54 #ifdef DLT_IEEE802_15_4_NOFCS
55 { ieee802_15_4_if_print, DLT_IEEE802_15_4_NOFCS },
58 { ppi_if_print, DLT_PPI },
60 #ifdef DLT_NETANALYZER
61 { netanalyzer_if_print, DLT_NETANALYZER },
63 #ifdef DLT_NETANALYZER_TRANSPARENT
64 { netanalyzer_transparent_if_print, DLT_NETANALYZER_TRANSPARENT },
66 #if defined(DLT_NFLOG) && defined(HAVE_PCAP_NFLOG_H)
67 { nflog_if_print, DLT_NFLOG},
70 { cip_if_print, DLT_CIP },
73 { cip_if_print, DLT_ATM_CLIP },
76 { ipfc_if_print, DLT_IP_OVER_FC },
78 { null_if_print, DLT_NULL },
80 { null_if_print, DLT_LOOP },
82 #ifdef DLT_APPLE_IP_OVER_IEEE1394
83 { ap1394_if_print, DLT_APPLE_IP_OVER_IEEE1394 },
85 #if defined(DLT_BLUETOOTH_HCI_H4_WITH_PHDR) && defined(HAVE_PCAP_BLUETOOTH_H)
86 { bt_if_print, DLT_BLUETOOTH_HCI_H4_WITH_PHDR},
89 { lane_if_print, DLT_LANE8023 },
91 { arcnet_if_print, DLT_ARCNET },
92 #ifdef DLT_ARCNET_LINUX
93 { arcnet_linux_if_print, DLT_ARCNET_LINUX },
95 { raw_if_print, DLT_RAW },
97 { raw_if_print, DLT_IPV4 },
100 { raw_if_print, DLT_IPV6 },
102 #ifdef HAVE_PCAP_USB_H
104 { usb_linux_48_byte_print, DLT_USB_LINUX},
105 #endif /* DLT_USB_LINUX */
106 #ifdef DLT_USB_LINUX_MMAPPED
107 { usb_linux_64_byte_print, DLT_USB_LINUX_MMAPPED},
108 #endif /* DLT_USB_LINUX_MMAPPED */
109 #endif /* HAVE_PCAP_USB_H */
110 #ifdef DLT_SYMANTEC_FIREWALL
111 { symantec_if_print, DLT_SYMANTEC_FIREWALL },
114 { chdlc_if_print, DLT_C_HDLC },
117 { chdlc_if_print, DLT_HDLC },
120 { pppoe_if_print, DLT_PPP_ETHER },
122 #if defined(DLT_PFLOG) && defined(HAVE_NET_IF_PFLOG_H)
123 { pflog_if_print, DLT_PFLOG },
125 { token_if_print, DLT_IEEE802 },
126 { fddi_if_print, DLT_FDDI },
128 { sll_if_print, DLT_LINUX_SLL },
131 { fr_if_print, DLT_FR },
134 { fr_if_print, DLT_FRELAY },
137 { mfr_if_print, DLT_MFR },
139 { atm_if_print, DLT_ATM_RFC1483 },
141 { sunatm_if_print, DLT_SUNATM },
144 { enc_if_print, DLT_ENC },
146 { sl_if_print, DLT_SLIP },
147 #ifdef DLT_SLIP_BSDOS
148 { sl_bsdos_if_print, DLT_SLIP_BSDOS },
151 { ltalk_if_print, DLT_LTALK },
153 #ifdef DLT_JUNIPER_ATM1
154 { juniper_atm1_print, DLT_JUNIPER_ATM1 },
156 #ifdef DLT_JUNIPER_ATM2
157 { juniper_atm2_print, DLT_JUNIPER_ATM2 },
159 #ifdef DLT_JUNIPER_MFR
160 { juniper_mfr_print, DLT_JUNIPER_MFR },
162 #ifdef DLT_JUNIPER_MLFR
163 { juniper_mlfr_print, DLT_JUNIPER_MLFR },
165 #ifdef DLT_JUNIPER_MLPPP
166 { juniper_mlppp_print, DLT_JUNIPER_MLPPP },
168 #ifdef DLT_JUNIPER_PPPOE
169 { juniper_pppoe_print, DLT_JUNIPER_PPPOE },
171 #ifdef DLT_JUNIPER_PPPOE_ATM
172 { juniper_pppoe_atm_print, DLT_JUNIPER_PPPOE_ATM },
174 #ifdef DLT_JUNIPER_GGSN
175 { juniper_ggsn_print, DLT_JUNIPER_GGSN },
177 #ifdef DLT_JUNIPER_ES
178 { juniper_es_print, DLT_JUNIPER_ES },
180 #ifdef DLT_JUNIPER_MONITOR
181 { juniper_monitor_print, DLT_JUNIPER_MONITOR },
183 #ifdef DLT_JUNIPER_SERVICES
184 { juniper_services_print, DLT_JUNIPER_SERVICES },
186 #ifdef DLT_JUNIPER_ETHER
187 { juniper_ether_print, DLT_JUNIPER_ETHER },
189 #ifdef DLT_JUNIPER_PPP
190 { juniper_ppp_print, DLT_JUNIPER_PPP },
192 #ifdef DLT_JUNIPER_FRELAY
193 { juniper_frelay_print, DLT_JUNIPER_FRELAY },
195 #ifdef DLT_JUNIPER_CHDLC
196 { juniper_chdlc_print, DLT_JUNIPER_CHDLC },
199 { pktap_if_print, DLT_PKTAP },
201 #ifdef DLT_IEEE802_11_RADIO
202 { ieee802_11_radio_if_print, DLT_IEEE802_11_RADIO },
204 #ifdef DLT_IEEE802_11
205 { ieee802_11_if_print, DLT_IEEE802_11},
207 #ifdef DLT_IEEE802_11_RADIO_AVS
208 { ieee802_11_radio_avs_if_print, DLT_IEEE802_11_RADIO_AVS },
210 #ifdef DLT_PRISM_HEADER
211 { prism_if_print, DLT_PRISM_HEADER },
213 { ppp_if_print, DLT_PPP },
214 #ifdef DLT_PPP_WITHDIRECTION
215 { ppp_if_print, DLT_PPP_WITHDIRECTION },
218 { ppp_bsdos_if_print, DLT_PPP_BSDOS },
220 #ifdef DLT_PPP_SERIAL
221 { ppp_hdlc_if_print, DLT_PPP_SERIAL },
226 static void ndo_default_print(netdissect_options *ndo, const u_char *bp,
229 static void ndo_error(netdissect_options *ndo,
230 FORMAT_STRING(const char *fmt), ...)
231 NORETURN PRINTFLIKE(2, 3);
232 static void ndo_warning(netdissect_options *ndo,
233 FORMAT_STRING(const char *fmt), ...)
236 static int ndo_printf(netdissect_options *ndo,
237 FORMAT_STRING(const char *fmt), ...)
241 init_print(netdissect_options *ndo, uint32_t localnet, uint32_t mask,
242 uint32_t timezone_offset)
245 thiszone = timezone_offset;
246 init_addrtoname(ndo, localnet, mask);
251 lookup_printer(int type)
253 const struct printer *p;
255 for (p = printers; p->f; ++p)
259 #if defined(DLT_USER2) && defined(DLT_PKTAP)
261 * Apple incorrectly chose to use DLT_USER2 for their PKTAP
264 * We map DLT_PKTAP, whether it's DLT_USER2 as it is on Darwin-
265 * based OSes or the same value as LINKTYPE_PKTAP as it is on
266 * other OSes, to LINKTYPE_PKTAP, so files written with
267 * this version of libpcap for a DLT_PKTAP capture have a link-
268 * layer header type of LINKTYPE_PKTAP.
270 * However, files written on OS X Mavericks for a DLT_PKTAP
271 * capture have a link-layer header type of LINKTYPE_USER2.
272 * If we don't have a printer for DLT_USER2, and type is
273 * DLT_USER2, we look up the printer for DLT_PKTAP and use
276 if (type == DLT_USER2) {
277 for (p = printers; p->f; ++p)
278 if (DLT_PKTAP == p->type)
288 has_printer(int type)
290 return (lookup_printer(type) != NULL);
294 get_if_printer(netdissect_options *ndo, int type)
299 printer = lookup_printer(type);
300 if (printer == NULL) {
301 dltname = pcap_datalink_val_to_name(type);
303 (*ndo->ndo_error)(ndo,
304 "packet printing is not supported for link type %s: use -w",
307 (*ndo->ndo_error)(ndo,
308 "packet printing is not supported for link type %d: use -w", type);
314 pretty_print_packet(netdissect_options *ndo, const struct pcap_pkthdr *h,
315 const u_char *sp, u_int packets_captured)
319 if(ndo->ndo_packet_number)
320 ND_PRINT((ndo, "%5u ", packets_captured));
322 ts_print(ndo, &h->ts);
325 * Some printers want to check that they're not walking off the
327 * Rather than pass it all the way down, we set this member
328 * of the netdissect_options structure.
330 ndo->ndo_snapend = sp + h->caplen;
332 hdrlen = (ndo->ndo_if_printer)(ndo, h, sp);
335 * Restore the original snapend, as a printer might have
338 ndo->ndo_snapend = sp + h->caplen;
339 if (ndo->ndo_Xflag) {
341 * Print the raw packet data in hex and ASCII.
343 if (ndo->ndo_Xflag > 1) {
345 * Include the link-layer header.
347 hex_and_ascii_print(ndo, "\n\t", sp, h->caplen);
350 * Don't include the link-layer header - and if
351 * we have nothing past the link-layer header,
354 if (h->caplen > hdrlen)
355 hex_and_ascii_print(ndo, "\n\t", sp + hdrlen,
358 } else if (ndo->ndo_xflag) {
360 * Print the raw packet data in hex.
362 if (ndo->ndo_xflag > 1) {
364 * Include the link-layer header.
366 hex_print(ndo, "\n\t", sp, h->caplen);
369 * Don't include the link-layer header - and if
370 * we have nothing past the link-layer header,
373 if (h->caplen > hdrlen)
374 hex_print(ndo, "\n\t", sp + hdrlen,
377 } else if (ndo->ndo_Aflag) {
379 * Print the raw packet data in ASCII.
381 if (ndo->ndo_Aflag > 1) {
383 * Include the link-layer header.
385 ascii_print(ndo, sp, h->caplen);
388 * Don't include the link-layer header - and if
389 * we have nothing past the link-layer header,
392 if (h->caplen > hdrlen)
393 ascii_print(ndo, sp + hdrlen, h->caplen - hdrlen);
397 ND_PRINT((ndo, "\n"));
401 * By default, print the specified data out in hex and ASCII.
404 ndo_default_print(netdissect_options *ndo, const u_char *bp, u_int length)
406 hex_and_ascii_print(ndo, "\n\t", bp, length); /* pass on lf and indentation string */
411 ndo_error(netdissect_options *ndo, const char *fmt, ...)
415 if(ndo->program_name)
416 (void)fprintf(stderr, "%s: ", ndo->program_name);
418 (void)vfprintf(stderr, fmt, ap);
423 (void)fputc('\n', stderr);
432 ndo_warning(netdissect_options *ndo, const char *fmt, ...)
436 if(ndo->program_name)
437 (void)fprintf(stderr, "%s: ", ndo->program_name);
438 (void)fprintf(stderr, "WARNING: ");
440 (void)vfprintf(stderr, fmt, ap);
445 (void)fputc('\n', stderr);
450 ndo_printf(netdissect_options *ndo, const char *fmt, ...)
456 ret = vfprintf(stdout, fmt, args);
460 ndo_error(ndo, "Unable to write output: %s", pcap_strerror(errno));
465 ndo_set_function_pointers(netdissect_options *ndo)
467 ndo->ndo_default_print=ndo_default_print;
468 ndo->ndo_printf=ndo_printf;
469 ndo->ndo_error=ndo_error;
470 ndo->ndo_warning=ndo_warning;
474 * c-style: whitesmith