2 * This code is derived from code formerly in pcap-dlpi.c, originally
3 * contributed by Atanu Ghosh (atanu@cs.ucl.ac.uk), University College
4 * London, and subsequently modified by Guy Harris (guy@alum.mit.edu),
5 * Mark Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>,
6 * Mark C. Brown (mbrown@hp.com), and Sagun Shakya <Sagun.Shakya@Sun.COM>.
10 * This file contains dlpi/libdlpi related common functions used
11 * by pcap-[dlpi,libdlpi].c.
14 static const char rcsid[] _U_ =
15 "@(#) $Header: /tcpdump/master/libpcap/dlpisubs.c,v 1.1.2.2 2008-04-04 19:39:05 guy Exp $ (LBL)";
22 #ifdef HAVE_SYS_BUFMOD_H
24 * Size of a bufmod chunk to pass upstream; that appears to be the
25 * biggest value to which you can set it, and setting it to that value
26 * (which is bigger than what appears to be the Solaris default of 8192)
27 * reduces the number of packet drops.
29 #define CHUNKSIZE 65536
32 * Size of the buffer to allocate for packet data we read; it must be
33 * large enough to hold a chunk.
35 #define PKTBUFSIZE CHUNKSIZE
37 #else /* HAVE_SYS_BUFMOD_H */
40 * Size of the buffer to allocate for packet data we read; this is
41 * what the value used to be - there's no particular reason why it
42 * should be tied to MAXDLBUF, but we'll leave it as this for now.
44 #define PKTBUFSIZE (MAXDLBUF * sizeof(bpf_u_int32))
48 #include <sys/types.h>
50 #ifdef HAVE_SYS_BUFMOD_H
51 #include <sys/bufmod.h>
54 #include <sys/stream.h>
67 static void pcap_stream_err(const char *, int, char *);
70 * Get the packet statistics.
73 pcap_stats_dlpi(pcap_t *p, struct pcap_stat *ps)
77 * "ps_recv" counts packets handed to the filter, not packets
78 * that passed the filter. As filtering is done in userland,
79 * this would not include packets dropped because we ran out
80 * of buffer space; in order to make this more like other
81 * platforms (Linux 2.4 and later, BSDs with BPF), where the
82 * "packets received" count includes packets received but dropped
83 * due to running out of buffer space, and to keep from confusing
84 * applications that, for example, compute packet drop percentages,
85 * we also make it count packets dropped by "bufmod" (otherwise we
86 * might run the risk of the packet drop count being bigger than
87 * the received-packet count).
89 * "ps_drop" counts packets dropped by "bufmod" because of
90 * flow control requirements or resource exhaustion; it doesn't
91 * count packets dropped by the interface driver, or packets
92 * dropped upstream. As filtering is done in userland, it counts
93 * packets regardless of whether they would've passed the filter.
95 * These statistics don't include packets not yet read from
96 * the kernel by libpcap, but they may include packets not
97 * yet read from libpcap by the application.
102 * Add in the drop count, as per the above comment.
104 ps->ps_recv += ps->ps_drop;
109 * Loop through the packets and call the callback for each packet.
110 * Return the number of packets read.
113 pcap_process_pkts(pcap_t *p, pcap_handler callback, u_char *user,
114 int count, u_char *bufp, int len)
116 int n, caplen, origlen;
118 struct pcap_pkthdr pkthdr;
119 #ifdef HAVE_SYS_BUFMOD_H
126 /* Loop through packets */
130 #ifdef HAVE_SYS_BUFMOD_H
133 * Has "pcap_breakloop()" been called?
134 * If so, return immediately - if we haven't read any
135 * packets, clear the flag and return -2 to indicate
136 * that we were told to break out of the loop, otherwise
137 * leave the flag set, so that the *next* call will break
138 * out of the loop without having read any packets, and
139 * return the number of packets we've processed so far.
152 if ((long)bufp & 3) {
154 memcpy(sbp, bufp, sizeof(*sbp));
157 sbp = (struct sb_hdr *)bufp;
158 p->md.stat.ps_drop = sbp->sbh_drops;
159 pk = bufp + sizeof(*sbp);
160 bufp += sbp->sbh_totlen;
161 origlen = sbp->sbh_origlen;
162 caplen = sbp->sbh_msglen;
165 caplen = min(p->snapshot, len);
169 ++p->md.stat.ps_recv;
170 if (bpf_filter(p->fcode.bf_insns, pk, origlen, caplen)) {
171 #ifdef HAVE_SYS_BUFMOD_H
172 pkthdr.ts.tv_sec = sbp->sbh_timestamp.tv_sec;
173 pkthdr.ts.tv_usec = sbp->sbh_timestamp.tv_usec;
175 (void) gettimeofday(&pkthdr.ts, NULL);
177 pkthdr.len = origlen;
178 pkthdr.caplen = caplen;
179 /* Insure caplen does not exceed snapshot */
180 if (pkthdr.caplen > p->snapshot)
181 pkthdr.caplen = p->snapshot;
182 (*callback)(user, &pkthdr, pk);
183 if (++n >= count && count >= 0) {
189 #ifdef HAVE_SYS_BUFMOD_H
197 * Process the mac type. Returns -1 if no matching mac type found, otherwise 0.
200 pcap_process_mactype(pcap_t *p, u_int mactype)
208 p->linktype = DLT_EN10MB;
211 * This is (presumably) a real Ethernet capture; give it a
212 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so
213 * that an application can let you choose it, in case you're
214 * capturing DOCSIS traffic that a Cisco Cable Modem
215 * Termination System is putting out onto an Ethernet (it
216 * doesn't put an Ethernet header onto the wire, it puts raw
217 * DOCSIS frames out on the wire inside the low-level
220 p->dlt_list = (u_int *)malloc(sizeof(u_int) * 2);
222 * If that fails, just leave the list empty.
224 if (p->dlt_list != NULL) {
225 p->dlt_list[0] = DLT_EN10MB;
226 p->dlt_list[1] = DLT_DOCSIS;
232 p->linktype = DLT_FDDI;
237 /* XXX - what about DL_TPB? Is that Token Bus? */
238 p->linktype = DLT_IEEE802;
244 p->linktype = DLT_SUNATM;
245 p->offset = 0; /* works for LANE and LLC encapsulation */
250 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "unknown mactype %u",
258 #ifdef HAVE_SYS_BUFMOD_H
260 * Push and configure the buffer module. Returns -1 for error, otherwise 0.
263 pcap_conf_bufmod(pcap_t *p, int snaplen, int timeout)
267 bpf_u_int32 ss, chunksize;
269 /* Non-standard call to get the data nicely buffered. */
270 if (ioctl(p->fd, I_PUSH, "bufmod") != 0) {
271 pcap_stream_err("I_PUSH bufmod", errno, p->errbuf);
277 strioctl(p->fd, SBIOCSSNAP, sizeof(ss), (char *)&ss) != 0) {
278 pcap_stream_err("SBIOCSSNAP", errno, p->errbuf);
282 /* Set up the bufmod timeout. */
286 to.tv_sec = timeout / 1000;
287 to.tv_usec = (timeout * 1000) % 1000000;
288 if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) {
289 pcap_stream_err("SBIOCSTIME", errno, p->errbuf);
294 /* Set the chunk length. */
295 chunksize = CHUNKSIZE;
296 if (strioctl(p->fd, SBIOCSCHUNK, sizeof(chunksize), (char *)&chunksize)
298 pcap_stream_err("SBIOCSCHUNKP", errno, p->errbuf);
304 #endif /* HAVE_SYS_BUFMOD_H */
307 * Allocate data buffer. Returns -1 if memory allocation fails, else 0.
310 pcap_alloc_databuf(pcap_t *p)
312 p->bufsize = PKTBUFSIZE;
313 p->buffer = (u_char *)malloc(p->bufsize + p->offset);
314 if (p->buffer == NULL) {
315 strlcpy(p->errbuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE);
323 * Issue a STREAMS I_STR ioctl. Returns -1 on error, otherwise
324 * length of returned data on success.
327 strioctl(int fd, int cmd, int len, char *dp)
336 if ((retv = ioctl(fd, I_STR, &str)) < 0)
343 * Write stream error message to errbuf.
346 pcap_stream_err(const char *func, int err, char *errbuf)
348 snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", func, pcap_strerror(err));