| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
| |
we're about to apply the filter, so that if it's changed by a callback
routine, we get the current filter, rather than the one in effect when
we started the loop.
|
|
|
|
|
|
|
|
|
|
| |
"pcap_dump_fopen()" to open a pcap_t given a FILE *, and add
"pcap_dump_fopen()" to open a pcap_dumper_t given a FILE *.
On Windows, if we're opening the standard input, put it in binary mode.
Check for errors from "sf_write_header()" and return an error if we get
an error.
|
|
|
|
| |
that have them (Linux).
|
|
|
|
|
|
| |
"uname()" end with "-RELEASE" (or "-CURRENT" or "-STABLE" or...), so
check the first 4 characters of the release number string for the
version number followed by "-".
|
|
|
|
|
| |
12 bits of the VLAN field - check only those bits, not the priority or
CFI flag.
|
|
|
|
| |
Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>.
|
|
|
|
|
|
|
|
|
|
| |
In the Linux kernel the packet statistics are zeroed during each retrieval.
In contrast, on FreeBSD, the packet statistics are retrived using
ioctl(BIOCGSTATS):
The patch adds a static variable to pcap_stats_linux() which
holds a running total of the packet statistics so that the behaviour
of pcap_stats() on Linux matches the behaviour of FreeBSD.
|
| |
|
|
|
|
|
|
| |
"snprintf()", include one in libpcap with the name "pcap_snprintf()", so
applications don't have to supply their own "snprintf()" on those
platforms in order to use libpcap.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Added support for nonblocking operation.
Added support for processing more than a single packet in
pcap_dispatch().
Fixed bug in loss counter code.
Improved portability of loss counter code (e.g. use UINT_MAX
instead of 0xffff).
Removed unused local variables.
Added required headers (ctype.h, limits.h, unistd.h,
netinet/in.h).
Changed semantics to match those of standard pcap on linux.
- packets rejected by the filter are not counted.
|
| |
|
|
|
|
| |
Linux.
|
|
|
|
| |
actively committing code now.
|
|
|
|
|
|
|
|
| |
correctly handle loopback devices on IRIX and UNICOS/mp (tweak
the packet header so that it's a 4-byte AF_ value rather than
the 2-byte AF_ value supplied on snoop sockets);
add support for IP-over-FC and pseudo-link devices on UNICOS/mp.
|
|
|
|
|
|
|
| |
detail if we get a premature EOF when reading packet data.
Also, do the same check when reading the packet *header*, and check for
I/O errors as well.
|
|
|
|
|
|
|
|
|
|
| |
support Linux Frame Relay ARPHRD_FRAD as Frame Relay with an FR
header;
support Linux Frame Relay ARPHRD_DLCI in cooked mode;
current Linux kernels use the name ARPHRD_CISCO for Cisco HDLC
(513).
|
|
|
|
|
| |
passed to it is NULL, as it might be if, for example, the address or the
netmask isn't supplied.
|
|
|
|
| |
Endace DAG devices.
|
|
|
|
|
|
|
| |
where we wire in the idea that it can't handle unaligned accesses. (I
don't know why the test program doesn't work - but perhaps the test
program is the wrong answer anyway, as it doesn't work when
cross-compiling.)
|
|
|
|
|
|
|
| |
case in e.g. FreeBSD where /etc/services lists port 4 for the ddp "echo"
service.
Submitted by: Alan Bawden <Alan@LCS.MIT.EDU>
|
| |
|
|
|
|
|
|
|
|
|
|
| |
create the BPF device nodes if necessary, and rename our "bpf.h" to
"pcap-bpf.h" and install it in "/usr/include", so that "pcap-bpf.c" gets
the system's bpf.h file if it includes <net/bpf.h> - on AIX, it needs to
get an AIX-specific structure from that header in order to support
loading the driver and creating the nodes.
Update "packaging/pcap.spec".
|
|
|
|
| |
expressions.
|
|
|
|
|
|
|
|
|
|
|
| |
which supplies different headers from BSD ARCNET, and fixes to the
ARCNET code generator (the protocol ID field is 1 byte, so the values
for it shouldn't be byte-swapped).
Whitespace cleanups.
The "NetBSD-style" ARCNET headers are used in other BSDs as well, so
just call them "BSD-style".
|
|
|
|
|
| |
documentation for "pcap_next()" to indicate that it returns a "const
u_char *", not just a "u_char *".
|
|
|
|
|
|
|
| |
argument to "pcap_open_live()" a "const" pointer.
Constify some additional device name arguments, and update the man page
to reflect some arguments that were already consts.
|
|
|
|
|
| |
to flush the standard I/O buffer for a "pcap_dumper_t" and force all
packets written with "pcap_dump()" to the savefile.
|
|
|
|
|
|
|
|
|
|
|
|
| |
Young <dyoung@ojctech.com>, with some minor changes by Jason R. Thorpe
<thorpej@netbsd.org>, and further changes by me to support it on BPF
systems lacking BIOCGDLTLIST and other platforms lacking an equivalent
feature.
Update Jason Thorpe's e-mail address (Zembu is going away, if it hasn't
done so already).
Add APIs to map DLT names to DLT values and vice versa.
|
|
|
|
|
|
| |
"getifaddrs()" can be null, so make "SA_LEN()" return 0 if the argument
is null, rather than dereferencing the argument and crashing if it's
null.
|
|
|
|
| |
<Don.Ebright@compuware.com>: ignore EFAULT from a BPF read in AIX.
|
|
|
|
| |
null-terminate the interface name when doing an NIOCBIND.
|
|
|
|
|
| |
add Fulvio Risso and Juergen Schoenwaelder to the list of maintainers, as
they have CVS commit privileges.
|
|
|
|
| |
WinPcap developers.
|
|
|
|
| |
WinPcap credits page.
|
| |
|
|
|
|
| |
University.
|
| |
|
|
|
|
| |
Kaelbling <drk@sgi.com>.
|
|
|
|
|
| |
synchronous board in Raw HDLC mode, from Octavian Cerna
<tavy@ylabs.com>.
|
|
|
|
|
|
| |
read packets is "p->bufsize" bytes long, not MAXDLBUF bytes long
("p->bufsize" is set to (MAXDLBUF * sizeof sizeof(bpf_u_int32))), so
supply that as the "maxlen" value in the "data" argument to "getmsg()".
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
1. During termination processing set up by atexit() under a 2.0.x
kernel, if a socket had been previously closed and the handle freed
due to an error, pcap_close_all() and pcap_close_linux() would
nevertheless try to work with these structures and then crash.
pcap_close_linux() is now called directly when necessary during
error processing.
2. atexit() could get called more than once because the did_atexit
flag wasn't being set.
3. If iface_get_arptype() returns an error because the ioctl() call
failed (probably due to "no such device"), live_open_new() now
returns a fatal error to pcap_open_live() and the call to
live_open_old() is short-circuited.
4. Applications using libpcap would appear to listen on an interface
that was down.
a. iface_bind() and iface_bind_old() now check for pending errors
after bind(). In turn, pcap_open_live() now returns an error
status if there was a pending error after bind().
b. After draining the socket, set_kernel_filter() now checks to see
if the error was the expected EAGAIN and returns a fatal error
to pcap_setfilter() if not. In turn, pcap_setfilter() now
returns an error status if there was a network error.
5. pcap_setfilter() was putting an error message into errbuf after a
failed call to install_bpf_program(). This was unnecessary since
install_bpf_program() puts its own error message into errbuf.
|
|
|
|
|
|
| |
ARPHRD_IEEE80211_PRISM, for sniffing on Prism II-based 802.11 interfaces
and getting the special Prism header, so we should map it to
DLT_PRISM_HEADER.
|
|
|
|
|
|
|
| |
didn't define ARPHRD_HDLC - define it as per Linux 2.1.13, if it's not
defined.
Do the same with ARPHRD_FDDI, as that's not defined by 2.0, either.
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Don't subtract "tp_drops" from "tp_packets" - "ps_recv", on BSD,
at least, includes packets dropped due to lack of buffer space,
so it should do so on Linux as well.
The "len" argument to "getsockopt()" is a value-result
parameter, initially containing the size of the buffer being
supplied; set it before the call.
Catch "getsockopt()" errors and, if it's an error other than
EOPNOTSUPP, return an error.
|
|
|
|
|
| |
platforms as always requiring strict alignment, rather than doing
configure-time testing with a sample program.
|
|
|
|
|
| |
the SAP on AIX if a SAP of 1537 doesn't work; he says that 2 works on
Token Ring but 0 doesn't.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Add a new "pcap_findalldevs()" routine to get a list of all
interfaces that can be opened with "pcap_open_live()", and a
"pcap_freealldevs()" routine to free the list.
Make "pcap_lookupdev()" use it, which also arranges that it will
not return a device that cannot be opened by "pcap_open_live()".
Allow the "any" device to be opened, on Linux, with "promisc"
non-zero; ignore the request for promiscuity, and return a
warning message indicating that promiscuous mode isn't supported
on the "any" device.
Document "pcap_findalldevs()" and "pcap_lookupdev()", and clean up some
items in the libpcap man page.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
packets queued up on the socket when we set a kernel filter on the
socket, so that if there are any queue-up packets that wouldn't have
passed the new filter, we don't see them. (Some other packet capture
mechanisms do this automatically; this prevents tcpdump, for example,
from showing or saving, when run with a filter, some packets that
wouldn't have passed the filter.)
XXX - do we have to do this on any other platforms?
Choose whether to compile in the code to modify filter programs for use
in the kernel, and to flush queued-up packet and set a kernel filter, on
whether SO_ATTACH_FILTER is defined (i.e., on whether we have kernel
filter support in our build environment), rather than on whether
HAVE_PF_PACKET_SOCKETS is defined (i.e., on whether we have PF_PACKET
support in our build environment), as we choose whether to *use* that
code based on whether SO_ATTACH_FILTER is defined.
|
|
|
|
|
|
|
|
|
|
|
|
| |
SOL_PACKET/PACKET_STATISTICS "getsockopt()" call, on Linux kernels that
support it, to get packet statistics, so that we can report the number
of dropped packets, and always use <linux/if_packet.h> to get
definitions for PF_PACKET sockets, so that we don't depend on glibc's
header files having been updated to support all the latest shiniest
kernel features (many systems with 2.4[.x] kernels don't have a
<netpacket/packet.h> that defines "struct tpacket_stats", for example,
so we wouldn't have been able to support that kernel feature on those
systems).
|
|
|
|
|
| |
Adapt to (temporary) DLT_PPP_ETHER useage by the pppoe code in tree
now. This needs to be fixed when a generic PPP sheme is implemented.
|