2 * Copyright (c) 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 * sf-pcap.c - libpcap-file-format-specific code from savefile.c
22 * Extraction/creation by Jeffrey Mogul, DECWRL
23 * Modified by Steve McCanne, LBL.
25 * Used to save the received packet headers, after filtering, to
26 * a file, and then read them later.
27 * The first record in the file contains saved values for the machine
28 * dependent values so we can print the dump file on any architecture.
32 static const char rcsid[] _U_ =
33 "@(#) $Header$ (LBL)";
41 #include <pcap-stdinc.h>
48 #ifdef HAVE_SYS_BITYPES_H
49 #include <sys/bitypes.h>
51 #include <sys/types.h>
62 #include "pcap-common.h"
64 #ifdef HAVE_OS_PROTO_H
71 * Setting O_BINARY on DOS/Windows is a bit tricky
74 #define SET_BINMODE(f) _setmode(_fileno(f), _O_BINARY)
76 #if defined(__HIGHC__)
77 #define SET_BINMODE(f) setmode(f, O_BINARY)
79 #define SET_BINMODE(f) setmode(fileno(f), O_BINARY)
84 * Standard libpcap format.
86 #define TCPDUMP_MAGIC 0xa1b2c3d4
89 * Alexey Kuznetzov's modified libpcap format.
91 #define KUZNETZOV_TCPDUMP_MAGIC 0xa1b2cd34
94 * Reserved for Francisco Mesquita <francisco.mesquita@radiomovel.pt>
95 * for another modified format.
97 #define FMESQUITA_TCPDUMP_MAGIC 0xa1b234cd
100 * Navtel Communcations' format, with nanosecond timestamps,
101 * as per a request from Dumas Hwang <dumas.hwang@navtelcom.com>.
103 #define NAVTEL_TCPDUMP_MAGIC 0xa12b3c4d
106 * Normal libpcap format, except for seconds/nanoseconds timestamps,
107 * as per a request by Ulf Lamping <ulf.lamping@web.de>
109 #define NSEC_TCPDUMP_MAGIC 0xa1b23c4d
112 * Mechanism for storing information about a capture in the upper
113 * 6 bits of a linktype value in a capture file.
115 * LT_LINKTYPE_EXT(x) extracts the additional information.
117 * The rest of the bits are for a value describing the link-layer
118 * value. LT_LINKTYPE(x) extracts that value.
120 #define LT_LINKTYPE(x) ((x) & 0x03FFFFFF)
121 #define LT_LINKTYPE_EXT(x) ((x) & 0xFC000000)
123 static int pcap_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **datap);
126 * Private data for reading pcap savefiles.
138 } tstamp_scale_type_t;
142 swapped_type_t lengths_swapped;
143 tstamp_scale_type_t scale_type;
147 * Check whether this is a pcap savefile and, if it is, extract the
148 * relevant information from the header.
151 pcap_check_header(bpf_u_int32 magic, FILE *fp, u_int precision, char *errbuf,
154 struct pcap_file_header hdr;
161 * Assume no read errors.
166 * Check whether the first 4 bytes of the file are the magic
167 * number for a pcap savefile, or for a byte-swapped pcap
170 if (magic != TCPDUMP_MAGIC && magic != KUZNETZOV_TCPDUMP_MAGIC &&
171 magic != NSEC_TCPDUMP_MAGIC) {
172 magic = SWAPLONG(magic);
173 if (magic != TCPDUMP_MAGIC && magic != KUZNETZOV_TCPDUMP_MAGIC &&
174 magic != NSEC_TCPDUMP_MAGIC)
175 return (NULL); /* nope */
180 * They are. Put the magic number in the header, and read
181 * the rest of the header.
184 amt_read = fread(((char *)&hdr) + sizeof hdr.magic, 1,
185 sizeof(hdr) - sizeof(hdr.magic), fp);
186 if (amt_read != sizeof(hdr) - sizeof(hdr.magic)) {
188 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
189 "error reading dump file: %s",
190 pcap_strerror(errno));
192 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
193 "truncated dump file; tried to read %lu file header bytes, only got %lu",
194 (unsigned long)sizeof(hdr),
195 (unsigned long)amt_read);
202 * If it's a byte-swapped capture file, byte-swap the header.
205 hdr.version_major = SWAPSHORT(hdr.version_major);
206 hdr.version_minor = SWAPSHORT(hdr.version_minor);
207 hdr.thiszone = SWAPLONG(hdr.thiszone);
208 hdr.sigfigs = SWAPLONG(hdr.sigfigs);
209 hdr.snaplen = SWAPLONG(hdr.snaplen);
210 hdr.linktype = SWAPLONG(hdr.linktype);
213 if (hdr.version_major < PCAP_VERSION_MAJOR) {
214 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
215 "archaic pcap savefile format");
221 * currently only versions 2.[0-4] are supported with
222 * the exception of 543.0 for DG/UX tcpdump.
224 if (! ((hdr.version_major == PCAP_VERSION_MAJOR &&
225 hdr.version_minor <= PCAP_VERSION_MINOR) ||
226 (hdr.version_major == 543 &&
227 hdr.version_minor == 0))) {
228 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
229 "unsupported pcap savefile version %u.%u",
230 hdr.version_major, hdr.version_minor);
235 if (hdr.snaplen > MAXIMUM_SNAPLEN) {
236 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
237 "invalid file capture length %u, bigger than "
238 "maximum of %u", hdr.snaplen, MAXIMUM_SNAPLEN);
244 * OK, this is a good pcap file.
245 * Allocate a pcap_t for it.
247 p = pcap_open_offline_common(errbuf, sizeof (struct pcap_sf));
249 /* Allocation failed. */
253 p->swapped = swapped;
254 p->version_major = hdr.version_major;
255 p->version_minor = hdr.version_minor;
256 p->tzoff = hdr.thiszone;
257 p->snapshot = hdr.snaplen;
258 p->linktype = linktype_to_dlt(LT_LINKTYPE(hdr.linktype));
259 p->linktype_ext = LT_LINKTYPE_EXT(hdr.linktype);
261 p->next_packet_op = pcap_next_packet;
265 p->opt.tstamp_precision = precision;
268 * Will we need to scale the timestamps to match what the
273 case PCAP_TSTAMP_PRECISION_MICRO:
274 if (magic == NSEC_TCPDUMP_MAGIC) {
276 * The file has nanoseconds, the user
277 * wants microseconds; scale the
280 ps->scale_type = SCALE_DOWN;
283 * The file has microseconds, the
284 * user wants microseconds; nothing to do.
286 ps->scale_type = PASS_THROUGH;
290 case PCAP_TSTAMP_PRECISION_NANO:
291 if (magic == NSEC_TCPDUMP_MAGIC) {
293 * The file has nanoseconds, the
294 * user wants nanoseconds; nothing to do.
296 ps->scale_type = PASS_THROUGH;
299 * The file has microoseconds, the user
300 * wants nanoseconds; scale the
303 ps->scale_type = SCALE_UP;
308 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
309 "unknown time stamp resolution %u", precision);
316 * We interchanged the caplen and len fields at version 2.3,
317 * in order to match the bpf header layout. But unfortunately
318 * some files were written with version 2.3 in their headers
319 * but without the interchanged fields.
321 * In addition, DG/UX tcpdump writes out files with a version
322 * number of 543.0, and with the caplen and len fields in the
325 switch (hdr.version_major) {
328 if (hdr.version_minor < 3)
329 ps->lengths_swapped = SWAPPED;
330 else if (hdr.version_minor == 3)
331 ps->lengths_swapped = MAYBE_SWAPPED;
333 ps->lengths_swapped = NOT_SWAPPED;
337 ps->lengths_swapped = SWAPPED;
341 ps->lengths_swapped = NOT_SWAPPED;
345 if (magic == KUZNETZOV_TCPDUMP_MAGIC) {
347 * XXX - the patch that's in some versions of libpcap
348 * changes the packet header but not the magic number,
349 * and some other versions with this magic number have
350 * some extra debugging information in the packet header;
351 * we'd have to use some hacks^H^H^H^H^Hheuristics to
352 * detect those variants.
354 * Ethereal does that, but it does so by trying to read
355 * the first two packets of the file with each of the
356 * record header formats. That currently means it seeks
357 * backwards and retries the reads, which doesn't work
358 * on pipes. We want to be able to read from a pipe, so
359 * that strategy won't work; we'd have to buffer some
360 * data ourselves and read from that buffer in order to
363 ps->hdrsize = sizeof(struct pcap_sf_patched_pkthdr);
365 if (p->linktype == DLT_EN10MB) {
367 * This capture might have been done in raw mode
370 * If it was done in cooked mode, p->snapshot was
371 * passed to recvfrom() as the buffer size, meaning
372 * that the most packet data that would be copied
373 * would be p->snapshot. However, a faked Ethernet
374 * header would then have been added to it, so the
375 * most data that would be in a packet in the file
376 * would be p->snapshot + 14.
378 * We can't easily tell whether the capture was done
379 * in raw mode or cooked mode, so we'll assume it was
380 * cooked mode, and add 14 to the snapshot length.
381 * That means that, for a raw capture, the snapshot
382 * length will be misleading if you use it to figure
383 * out why a capture doesn't have all the packet data,
384 * but there's not much we can do to avoid that.
389 ps->hdrsize = sizeof(struct pcap_sf_pkthdr);
392 * Allocate a buffer for the packet data.
394 p->bufsize = p->snapshot;
395 if (p->bufsize <= 0) {
397 * Bogus snapshot length; use the maximum as a fallback.
399 p->bufsize = MAXIMUM_SNAPLEN;
401 p->buffer = malloc(p->bufsize);
402 if (p->buffer == NULL) {
403 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory");
409 p->cleanup_op = sf_cleanup;
415 * Read and return the next packet from the savefile. Return the header
416 * in hdr and a pointer to the contents in data. Return 0 on success, 1
417 * if there were no more packets, and -1 on an error.
420 pcap_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **data)
422 struct pcap_sf *ps = p->priv;
423 struct pcap_sf_patched_pkthdr sf_hdr;
429 * Read the packet header; the structure we use as a buffer
430 * is the longer structure for files generated by the patched
431 * libpcap, but if the file has the magic number for an
432 * unpatched libpcap we only read as many bytes as the regular
435 amt_read = fread(&sf_hdr, 1, ps->hdrsize, fp);
436 if (amt_read != ps->hdrsize) {
438 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
439 "error reading dump file: %s",
440 pcap_strerror(errno));
444 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
445 "truncated dump file; tried to read %lu header bytes, only got %lu",
446 (unsigned long)ps->hdrsize,
447 (unsigned long)amt_read);
456 /* these were written in opposite byte order */
457 hdr->caplen = SWAPLONG(sf_hdr.caplen);
458 hdr->len = SWAPLONG(sf_hdr.len);
459 hdr->ts.tv_sec = SWAPLONG(sf_hdr.ts.tv_sec);
460 hdr->ts.tv_usec = SWAPLONG(sf_hdr.ts.tv_usec);
462 hdr->caplen = sf_hdr.caplen;
463 hdr->len = sf_hdr.len;
464 hdr->ts.tv_sec = sf_hdr.ts.tv_sec;
465 hdr->ts.tv_usec = sf_hdr.ts.tv_usec;
468 switch (ps->scale_type) {
472 * Just pass the time stamp through.
478 * File has microseconds, user wants nanoseconds; convert
481 hdr->ts.tv_usec = hdr->ts.tv_usec * 1000;
486 * File has nanoseconds, user wants microseconds; convert
489 hdr->ts.tv_usec = hdr->ts.tv_usec / 1000;
493 /* Swap the caplen and len fields, if necessary. */
494 switch (ps->lengths_swapped) {
500 if (hdr->caplen <= hdr->len) {
502 * The captured length is <= the actual length,
503 * so presumably they weren't swapped.
511 hdr->caplen = hdr->len;
516 if (hdr->caplen > p->bufsize) {
518 * This can happen due to Solaris 2.3 systems tripping
519 * over the BUFMOD problem and not setting the snapshot
520 * correctly in the savefile header.
521 * This can also happen with a corrupted savefile or a
522 * savefile built/modified by a fuzz tester.
523 * If the caplen isn't grossly wrong, try to salvage.
525 size_t bytes_to_discard;
526 size_t bytes_to_read, bytes_read;
527 char discard_buf[4096];
529 if (hdr->caplen > MAXIMUM_SNAPLEN) {
530 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
531 "invalid packet capture length %u, bigger than "
532 "maximum of %u", hdr->caplen, MAXIMUM_SNAPLEN);
537 * XXX - we don't grow the buffer here because some
538 * program might assume that it will never get packets
539 * bigger than the snapshot length; for example, it might
540 * copy data from our buffer to a buffer of its own,
541 * allocated based on the return value of pcap_snapshot().
543 * Read the first p->bufsize bytes into the buffer.
545 amt_read = fread(p->buffer, 1, p->bufsize, fp);
546 if (amt_read != p->bufsize) {
548 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
549 "error reading dump file: %s",
550 pcap_strerror(errno));
553 * Yes, this uses hdr->caplen; technically,
554 * it's true, because we would try to read
555 * and discard the rest of those bytes, and
556 * that would fail because we got EOF before
559 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
560 "truncated dump file; tried to read %u captured bytes, only got %lu",
561 hdr->caplen, (unsigned long)amt_read);
567 * Now read and discard what's left.
569 bytes_to_discard = hdr->caplen - p->bufsize;
570 bytes_read = amt_read;
571 while (bytes_to_discard != 0) {
572 bytes_to_read = bytes_to_discard;
573 if (bytes_to_read > sizeof (discard_buf))
574 bytes_to_read = sizeof (discard_buf);
575 amt_read = fread(discard_buf, 1, bytes_to_read, fp);
576 bytes_read += amt_read;
577 if (amt_read != bytes_to_read) {
579 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
580 "error reading dump file: %s",
581 pcap_strerror(errno));
583 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
584 "truncated dump file; tried to read %u captured bytes, only got %lu",
585 hdr->caplen, (unsigned long)bytes_read);
589 bytes_to_discard -= amt_read;
593 * Adjust caplen accordingly, so we don't get confused later
594 * as to how many bytes we have to play with.
596 hdr->caplen = p->bufsize;
598 /* read the packet itself */
599 amt_read = fread(p->buffer, 1, hdr->caplen, fp);
600 if (amt_read != hdr->caplen) {
602 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
603 "error reading dump file: %s",
604 pcap_strerror(errno));
606 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
607 "truncated dump file; tried to read %u captured bytes, only got %lu",
608 hdr->caplen, (unsigned long)amt_read);
616 swap_pseudo_headers(p->linktype, hdr, *data);
622 sf_write_header(pcap_t *p, FILE *fp, int linktype, int thiszone, int snaplen)
624 struct pcap_file_header hdr;
626 hdr.magic = p->opt.tstamp_precision == PCAP_TSTAMP_PRECISION_NANO ? NSEC_TCPDUMP_MAGIC : TCPDUMP_MAGIC;
627 hdr.version_major = PCAP_VERSION_MAJOR;
628 hdr.version_minor = PCAP_VERSION_MINOR;
630 hdr.thiszone = thiszone;
631 hdr.snaplen = snaplen;
633 hdr.linktype = linktype;
635 if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1)
642 * Output a packet to the initialized dump file.
645 pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
648 struct pcap_sf_pkthdr sf_hdr;
651 sf_hdr.ts.tv_sec = h->ts.tv_sec;
652 sf_hdr.ts.tv_usec = h->ts.tv_usec;
653 sf_hdr.caplen = h->caplen;
655 /* XXX we should check the return status */
656 (void)fwrite(&sf_hdr, sizeof(sf_hdr), 1, f);
657 (void)fwrite(sp, h->caplen, 1, f);
660 static pcap_dumper_t *
661 pcap_setup_dump(pcap_t *p, int linktype, FILE *f, const char *fname)
664 #if defined(_WIN32) || defined(MSDOS)
666 * If we're writing to the standard output, put it in binary
667 * mode, as savefiles are binary files.
669 * Otherwise, we turn off buffering.
670 * XXX - why? And why not on the standard output?
677 if (sf_write_header(p, f, linktype, p->tzoff, p->snapshot) == -1) {
678 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Can't write to %s: %s",
679 fname, pcap_strerror(errno));
684 return ((pcap_dumper_t *)f);
688 * Initialize so that sf_write() will output to the file named 'fname'.
691 pcap_dump_open(pcap_t *p, const char *fname)
697 * If this pcap_t hasn't been activated, it doesn't have a
698 * link-layer type, so we can't use it.
701 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
702 "%s: not-yet-activated pcap_t passed to pcap_dump_open",
706 linktype = dlt_to_linktype(p->linktype);
707 if (linktype == -1) {
708 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
709 "%s: link-layer type %d isn't supported in savefiles",
713 linktype |= p->linktype_ext;
716 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
717 "A null pointer was supplied as the file name");
720 if (fname[0] == '-' && fname[1] == '\0') {
722 fname = "standard output";
724 #if !defined(_WIN32) && !defined(MSDOS)
725 f = fopen(fname, "w");
727 f = fopen(fname, "wb");
730 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s",
731 fname, pcap_strerror(errno));
735 return (pcap_setup_dump(p, linktype, f, fname));
739 * Initialize so that sf_write() will output to the given stream.
742 pcap_dump_fopen(pcap_t *p, FILE *f)
746 linktype = dlt_to_linktype(p->linktype);
747 if (linktype == -1) {
748 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
749 "stream: link-layer type %d isn't supported in savefiles",
753 linktype |= p->linktype_ext;
755 return (pcap_setup_dump(p, linktype, f, "stream"));
759 pcap_dump_open_append(pcap_t *p, const char *fname)
764 struct pcap_file_header ph;
766 linktype = dlt_to_linktype(p->linktype);
767 if (linktype == -1) {
768 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
769 "%s: link-layer type %d isn't supported in savefiles",
775 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
776 "A null pointer was supplied as the file name");
779 if (fname[0] == '-' && fname[1] == '\0')
780 return (pcap_setup_dump(p, linktype, stdout, "standard output"));
782 #if !defined(_WIN32) && !defined(MSDOS)
783 f = fopen(fname, "r+");
785 f = fopen(fname, "rb+");
788 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s",
789 fname, pcap_strerror(errno));
794 * Try to read a pcap header.
796 amt_read = fread(&ph, 1, sizeof (ph), f);
797 if (amt_read != sizeof (ph)) {
799 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s",
800 fname, pcap_strerror(errno));
803 } else if (feof(f) && amt_read > 0) {
804 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
805 "%s: truncated pcap file header", fname);
811 #if defined(_WIN32) || defined(MSDOS)
813 * We turn off buffering.
814 * XXX - why? And why not on the standard output?
820 * If a header is already present and:
822 * it's not for a pcap file of the appropriate resolution
823 * and the right byte order for this machine;
825 * the link-layer header types don't match;
827 * the snapshot lengths don't match;
833 * A header is already present.
839 if (p->opt.tstamp_precision != PCAP_TSTAMP_PRECISION_MICRO) {
840 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
841 "%s: different time stamp precision, cannot append to file", fname);
847 case NSEC_TCPDUMP_MAGIC:
848 if (p->opt.tstamp_precision != PCAP_TSTAMP_PRECISION_NANO) {
849 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
850 "%s: different time stamp precision, cannot append to file", fname);
856 case SWAPLONG(TCPDUMP_MAGIC):
857 case SWAPLONG(NSEC_TCPDUMP_MAGIC):
858 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
859 "%s: different byte order, cannot append to file", fname);
863 case KUZNETZOV_TCPDUMP_MAGIC:
864 case SWAPLONG(KUZNETZOV_TCPDUMP_MAGIC):
865 case NAVTEL_TCPDUMP_MAGIC:
866 case SWAPLONG(NAVTEL_TCPDUMP_MAGIC):
867 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
868 "%s: not a pcap file to which we can append", fname);
873 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
874 "%s: not a pcap file", fname);
882 if (ph.version_major != PCAP_VERSION_MAJOR ||
883 ph.version_minor != PCAP_VERSION_MINOR) {
884 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
885 "%s: version is %u.%u, cannot append to file", fname,
886 ph.version_major, ph.version_minor);
890 if ((bpf_u_int32)linktype != ph.linktype) {
891 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
892 "%s: different linktype, cannot append to file", fname);
896 if ((bpf_u_int32)p->snapshot != ph.snaplen) {
897 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
898 "%s: different snaplen, cannot append to file", fname);
904 * A header isn't present; attempt to write it.
906 if (sf_write_header(p, f, linktype, p->tzoff, p->snapshot) == -1) {
907 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Can't write to %s: %s",
908 fname, pcap_strerror(errno));
915 * Start writing at the end of the file.
917 if (fseek(f, 0, SEEK_END) == -1) {
918 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Can't seek to end of %s: %s",
919 fname, pcap_strerror(errno));
923 return ((pcap_dumper_t *)f);
927 pcap_dump_file(pcap_dumper_t *p)
933 pcap_dump_ftell(pcap_dumper_t *p)
935 return (ftell((FILE *)p));
939 pcap_dump_flush(pcap_dumper_t *p)
942 if (fflush((FILE *)p) == EOF)
949 pcap_dump_close(pcap_dumper_t *p)
953 if (ferror((FILE *)p))
955 /* XXX should check return from fclose() too */
957 (void)fclose((FILE *)p);