contrib/tcpdump/tcpdump.c

   1 /*
   2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  * Support for splitting captures into multiple files with a maximum
  22  * file size:
  23  *
  24  * Copyright (c) 2001
  25  *      Seth Webster <swebster@sst.ll.mit.edu>
  26  */
  27
  28 #ifndef lint
  29 static const char copyright[] _U_ =
  30     "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\
  31 The Regents of the University of California.  All rights reserved.\n";
  32 #endif
  33
  34 /* $FreeBSD$ */
  35
  36 /*
  37  * tcpdump - monitor tcp/ip traffic on an ethernet.
  38  *
  39  * First written in 1987 by Van Jacobson, Lawrence Berkeley Laboratory.
  40  * Mercilessly hacked and occasionally improved since then via the
  41  * combined efforts of Van, Steve McCanne and Craig Leres of LBL.
  42  */
  43
  44 #ifdef HAVE_CONFIG_H
  45 #include "config.h"
  46 #endif
  47
  48 #include <tcpdump-stdinc.h>
  49
  50 #ifdef WIN32
  51 #include "w32_fzs.h"
  52 extern int strcasecmp (const char *__s1, const char *__s2);
  53 extern int SIZE_BUF;
  54 #define off_t long
  55 #define uint UINT
  56 #endif /* WIN32 */
  57
  58 #ifdef USE_LIBSMI
  59 #include <smi.h>
  60 #endif
  61
  62 #ifdef HAVE_LIBCRYPTO
  63 #include <openssl/crypto.h>
  64 #endif
  65
  66 #ifdef HAVE_GETOPT_LONG
  67 #include <getopt.h>
  68 #else
  69 #include "getopt_long.h"
  70 #endif
  71 #include <pcap.h>
  72 #include <signal.h>
  73 #include <stdio.h>
  74 #include <stdlib.h>
  75 #include <string.h>
  76 #include <limits.h>
  77 #ifdef __FreeBSD__
  78 #include <sys/capsicum.h>
  79 #include <sys/sysctl.h>
  80 #endif /* __FreeBSD__ */
  81 #ifdef HAVE_CAPSICUM
  82 #include <libcapsicum.h>
  83 #include <libcapsicum_dns.h>
  84 #include <libcapsicum_service.h>
  85 #include <sys/nv.h>
  86 #include <sys/capability.h>
  87 #include <sys/ioccom.h>
  88 #include <net/bpf.h>
  89 #include <fcntl.h>
  90 #include <libgen.h>
  91 #endif  /* HAVE_CAPSICUM */
  92 #ifndef WIN32
  93 #include <sys/wait.h>
  94 #include <sys/resource.h>
  95 #include <pwd.h>
  96 #include <grp.h>
  97 #endif /* WIN32 */
  98
  99 /* capabilities convinience library */
 100 #ifdef HAVE_CAP_NG_H
 101 #include <cap-ng.h>
 102 #endif /* HAVE_CAP_NG_H */
 103
 104 #include "netdissect.h"
 105 #include "interface.h"
 106 #include "addrtoname.h"
 107 #include "machdep.h"
 108 #include "setsignal.h"
 109 #include "gmt2local.h"
 110 #include "pcap-missing.h"
 111
 112 #ifndef PATH_MAX
 113 #define PATH_MAX 1024
 114 #endif
 115
 116 #ifdef SIGINFO
 117 #define SIGNAL_REQ_INFO SIGINFO
 118 #elif SIGUSR1
 119 #define SIGNAL_REQ_INFO SIGUSR1
 120 #endif
 121
 122 netdissect_options Gndo;
 123 netdissect_options *gndo = &Gndo;
 124
 125 static int Dflag;                       /* list available devices and exit */
 126 static int dflag;                       /* print filter code */
 127 static int Lflag;                       /* list available data link types and exit */
 128 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
 129 static int Jflag;                       /* list available time stamp types */
 130 #endif
 131 #ifdef HAVE_PCAP_SETDIRECTION
 132 int Qflag = -1;                         /* restrict captured packet by send/receive direction */
 133 #endif
 134 static char *zflag = NULL;              /* compress each savefile using a specified command (like gzip or bzip2) */
 135
 136 static int infodelay;
 137 static int infoprint;
 138
 139 char *program_name;
 140
 141 #ifdef HAVE_CAPSICUM
 142 cap_channel_t *capdns;
 143 #endif
 144
 145 int32_t thiszone;               /* seconds offset from gmt to local time */
 146
 147 /* Forwards */
 148 static RETSIGTYPE cleanup(int);
 149 static RETSIGTYPE child_cleanup(int);
 150 static void print_version(void);
 151 static void print_usage(void);
 152 static void show_dlts_and_exit(const char *device, pcap_t *pd) __attribute__((noreturn));
 153
 154 static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
 155 static void ndo_default_print(netdissect_options *, const u_char *, u_int);
 156 static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *);
 157 static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
 158 static void droproot(const char *, const char *);
 159 static void ndo_error(netdissect_options *ndo, const char *fmt, ...)
 160      __attribute__((noreturn))
 161 #ifdef __ATTRIBUTE___FORMAT_OK
 162      __attribute__((format (printf, 2, 3)))
 163 #endif /* __ATTRIBUTE___FORMAT_OK */
 164     ;
 165 static void ndo_warning(netdissect_options *ndo, const char *fmt, ...)
 166 #ifdef __ATTRIBUTE___FORMAT_OK
 167      __attribute__((format (printf, 2, 3)))
 168 #endif /* __ATTRIBUTE___FORMAT_OK */
 169     ;
 170
 171 #ifdef SIGNAL_REQ_INFO
 172 RETSIGTYPE requestinfo(int);
 173 #endif
 174
 175 #if defined(USE_WIN32_MM_TIMER)
 176   #include <MMsystem.h>
 177   static UINT timer_id;
 178   static void CALLBACK verbose_stats_dump(UINT, UINT, DWORD_PTR, DWORD_PTR, DWORD_PTR);
 179 #elif defined(HAVE_ALARM)
 180   static void verbose_stats_dump(int sig);
 181 #endif
 182
 183 static void info(int);
 184 static u_int packets_captured;
 185
 186 struct printer {
 187         if_printer f;
 188         int type;
 189 };
 190
 191
 192 struct ndo_printer {
 193         if_ndo_printer f;
 194         int type;
 195 };
 196
 197
 198 static const struct printer printers[] = {
 199         { NULL,                 0 },
 200 };
 201
 202 static const struct ndo_printer ndo_printers[] = {
 203         { ether_if_print,       DLT_EN10MB },
 204 #ifdef DLT_IPNET
 205         { ipnet_if_print,       DLT_IPNET },
 206 #endif
 207 #ifdef DLT_IEEE802_15_4
 208         { ieee802_15_4_if_print, DLT_IEEE802_15_4 },
 209 #endif
 210 #ifdef DLT_IEEE802_15_4_NOFCS
 211         { ieee802_15_4_if_print, DLT_IEEE802_15_4_NOFCS },
 212 #endif
 213 #ifdef DLT_PPI
 214         { ppi_if_print,         DLT_PPI },
 215 #endif
 216 #ifdef DLT_NETANALYZER
 217         { netanalyzer_if_print, DLT_NETANALYZER },
 218 #endif
 219 #ifdef DLT_NETANALYZER_TRANSPARENT
 220         { netanalyzer_transparent_if_print, DLT_NETANALYZER_TRANSPARENT },
 221 #endif
 222 #if defined(DLT_NFLOG) && defined(HAVE_PCAP_NFLOG_H)
 223         { nflog_if_print,       DLT_NFLOG},
 224 #endif
 225 #ifdef DLT_CIP
 226         { cip_if_print,         DLT_CIP },
 227 #endif
 228 #ifdef DLT_ATM_CLIP
 229         { cip_if_print,         DLT_ATM_CLIP },
 230 #endif
 231 #ifdef DLT_IP_OVER_FC
 232         { ipfc_if_print,        DLT_IP_OVER_FC },
 233 #endif
 234         { null_if_print,        DLT_NULL },
 235 #ifdef DLT_LOOP
 236         { null_if_print,        DLT_LOOP },
 237 #endif
 238 #ifdef DLT_APPLE_IP_OVER_IEEE1394
 239         { ap1394_if_print,      DLT_APPLE_IP_OVER_IEEE1394 },
 240 #endif
 241 #if defined(DLT_BLUETOOTH_HCI_H4_WITH_PHDR) && defined(HAVE_PCAP_BLUETOOTH_H)
 242         { bt_if_print,          DLT_BLUETOOTH_HCI_H4_WITH_PHDR},
 243 #endif
 244 #ifdef DLT_LANE8023
 245         { lane_if_print,        DLT_LANE8023 },
 246 #endif
 247         { arcnet_if_print,      DLT_ARCNET },
 248 #ifdef DLT_ARCNET_LINUX
 249         { arcnet_linux_if_print, DLT_ARCNET_LINUX },
 250 #endif
 251         { raw_if_print,         DLT_RAW },
 252 #ifdef DLT_IPV4
 253         { raw_if_print,         DLT_IPV4 },
 254 #endif
 255 #ifdef DLT_IPV6
 256         { raw_if_print,         DLT_IPV6 },
 257 #endif
 258 #ifdef HAVE_PCAP_USB_H
 259 #ifdef DLT_USB_LINUX
 260         { usb_linux_48_byte_print, DLT_USB_LINUX},
 261 #endif /* DLT_USB_LINUX */
 262 #ifdef DLT_USB_LINUX_MMAPPED
 263         { usb_linux_64_byte_print, DLT_USB_LINUX_MMAPPED},
 264 #endif /* DLT_USB_LINUX_MMAPPED */
 265 #endif /* HAVE_PCAP_USB_H */
 266 #ifdef DLT_SYMANTEC_FIREWALL
 267         { symantec_if_print,    DLT_SYMANTEC_FIREWALL },
 268 #endif
 269 #ifdef DLT_C_HDLC
 270         { chdlc_if_print,       DLT_C_HDLC },
 271 #endif
 272 #ifdef DLT_HDLC
 273         { chdlc_if_print,       DLT_HDLC },
 274 #endif
 275 #ifdef DLT_PPP_ETHER
 276         { pppoe_if_print,       DLT_PPP_ETHER },
 277 #endif
 278 #if defined(DLT_PFLOG) && defined(HAVE_NET_PFVAR_H)
 279         { pflog_if_print,       DLT_PFLOG },
 280 #endif
 281         { token_if_print,       DLT_IEEE802 },
 282         { fddi_if_print,        DLT_FDDI },
 283 #ifdef DLT_LINUX_SLL
 284         { sll_if_print,         DLT_LINUX_SLL },
 285 #endif
 286 #ifdef DLT_FR
 287         { fr_if_print,          DLT_FR },
 288 #endif
 289 #ifdef DLT_FRELAY
 290         { fr_if_print,          DLT_FRELAY },
 291 #endif
 292 #ifdef DLT_MFR
 293         { mfr_if_print,         DLT_MFR },
 294 #endif
 295         { atm_if_print,         DLT_ATM_RFC1483 },
 296 #ifdef DLT_SUNATM
 297         { sunatm_if_print,      DLT_SUNATM },
 298 #endif
 299 #ifdef DLT_ENC
 300         { enc_if_print,         DLT_ENC },
 301 #endif
 302         { sl_if_print,          DLT_SLIP },
 303 #ifdef DLT_SLIP_BSDOS
 304         { sl_bsdos_if_print,    DLT_SLIP_BSDOS },
 305 #endif
 306 #ifdef DLT_LTALK
 307         { ltalk_if_print,       DLT_LTALK },
 308 #endif
 309 #ifdef DLT_JUNIPER_ATM1
 310         { juniper_atm1_print,   DLT_JUNIPER_ATM1 },
 311 #endif
 312 #ifdef DLT_JUNIPER_ATM2
 313         { juniper_atm2_print,   DLT_JUNIPER_ATM2 },
 314 #endif
 315 #ifdef DLT_JUNIPER_MFR
 316         { juniper_mfr_print,    DLT_JUNIPER_MFR },
 317 #endif
 318 #ifdef DLT_JUNIPER_MLFR
 319         { juniper_mlfr_print,   DLT_JUNIPER_MLFR },
 320 #endif
 321 #ifdef DLT_JUNIPER_MLPPP
 322         { juniper_mlppp_print,  DLT_JUNIPER_MLPPP },
 323 #endif
 324 #ifdef DLT_JUNIPER_PPPOE
 325         { juniper_pppoe_print,  DLT_JUNIPER_PPPOE },
 326 #endif
 327 #ifdef DLT_JUNIPER_PPPOE_ATM
 328         { juniper_pppoe_atm_print, DLT_JUNIPER_PPPOE_ATM },
 329 #endif
 330 #ifdef DLT_JUNIPER_GGSN
 331         { juniper_ggsn_print,   DLT_JUNIPER_GGSN },
 332 #endif
 333 #ifdef DLT_JUNIPER_ES
 334         { juniper_es_print,     DLT_JUNIPER_ES },
 335 #endif
 336 #ifdef DLT_JUNIPER_MONITOR
 337         { juniper_monitor_print, DLT_JUNIPER_MONITOR },
 338 #endif
 339 #ifdef DLT_JUNIPER_SERVICES
 340         { juniper_services_print, DLT_JUNIPER_SERVICES },
 341 #endif
 342 #ifdef DLT_JUNIPER_ETHER
 343         { juniper_ether_print,  DLT_JUNIPER_ETHER },
 344 #endif
 345 #ifdef DLT_JUNIPER_PPP
 346         { juniper_ppp_print,    DLT_JUNIPER_PPP },
 347 #endif
 348 #ifdef DLT_JUNIPER_FRELAY
 349         { juniper_frelay_print, DLT_JUNIPER_FRELAY },
 350 #endif
 351 #ifdef DLT_JUNIPER_CHDLC
 352         { juniper_chdlc_print,  DLT_JUNIPER_CHDLC },
 353 #endif
 354 #ifdef DLT_PKTAP
 355         { pktap_if_print,       DLT_PKTAP },
 356 #endif
 357 #ifdef DLT_IEEE802_11_RADIO
 358         { ieee802_11_radio_if_print,    DLT_IEEE802_11_RADIO },
 359 #endif
 360 #ifdef DLT_IEEE802_11
 361         { ieee802_11_if_print,  DLT_IEEE802_11},
 362 #endif
 363 #ifdef DLT_IEEE802_11_RADIO_AVS
 364         { ieee802_11_radio_avs_if_print,        DLT_IEEE802_11_RADIO_AVS },
 365 #endif
 366 #ifdef DLT_PRISM_HEADER
 367         { prism_if_print,       DLT_PRISM_HEADER },
 368 #endif
 369         { ppp_if_print,         DLT_PPP },
 370 #ifdef DLT_PPP_WITHDIRECTION
 371         { ppp_if_print,         DLT_PPP_WITHDIRECTION },
 372 #endif
 373 #ifdef DLT_PPP_BSDOS
 374         { ppp_bsdos_if_print,   DLT_PPP_BSDOS },
 375 #endif
 376 #ifdef DLT_PPP_SERIAL
 377         { ppp_hdlc_if_print,    DLT_PPP_SERIAL },
 378 #endif
 379         { NULL,                 0 },
 380 };
 381
 382 static const struct tok status_flags[] = {
 383 #ifdef PCAP_IF_UP
 384         { PCAP_IF_UP,       "Up"       },
 385 #endif
 386 #ifdef PCAP_IF_RUNNING
 387         { PCAP_IF_RUNNING,  "Running"  },
 388 #endif
 389         { PCAP_IF_LOOPBACK, "Loopback" },
 390         { 0, NULL }
 391 };
 392
 393 if_printer
 394 lookup_printer(int type)
 395 {
 396         const struct printer *p;
 397
 398         for (p = printers; p->f; ++p)
 399                 if (type == p->type)
 400                         return p->f;
 401
 402         return NULL;
 403         /* NOTREACHED */
 404 }
 405
 406 if_ndo_printer
 407 lookup_ndo_printer(int type)
 408 {
 409         const struct ndo_printer *p;
 410
 411         for (p = ndo_printers; p->f; ++p)
 412                 if (type == p->type)
 413                         return p->f;
 414
 415 #if defined(DLT_USER2) && defined(DLT_PKTAP)
 416         /*
 417          * Apple incorrectly chose to use DLT_USER2 for their PKTAP
 418          * header.
 419          *
 420          * We map DLT_PKTAP, whether it's DLT_USER2 as it is on Darwin-
 421          * based OSes or the same value as LINKTYPE_PKTAP as it is on
 422          * other OSes, to LINKTYPE_PKTAP, so files written with
 423          * this version of libpcap for a DLT_PKTAP capture have a link-
 424          * layer header type of LINKTYPE_PKTAP.
 425          *
 426          * However, files written on OS X Mavericks for a DLT_PKTAP
 427          * capture have a link-layer header type of LINKTYPE_USER2.
 428          * If we don't have a printer for DLT_USER2, and type is
 429          * DLT_USER2, we look up the printer for DLT_PKTAP and use
 430          * that.
 431          */
 432         if (type == DLT_USER2) {
 433                 for (p = ndo_printers; p->f; ++p)
 434                         if (DLT_PKTAP == p->type)
 435                                 return p->f;
 436         }
 437 #endif
 438
 439         return NULL;
 440         /* NOTREACHED */
 441 }
 442
 443 static pcap_t *pd;
 444
 445 static int supports_monitor_mode;
 446
 447 extern int optind;
 448 extern int opterr;
 449 extern char *optarg;
 450
 451 struct print_info {
 452         netdissect_options *ndo;
 453         union {
 454                 if_printer     printer;
 455                 if_ndo_printer ndo_printer;
 456         } p;
 457         int ndo_type;
 458 };
 459
 460 struct dump_info {
 461         char    *WFileName;
 462         char    *CurrentFileName;
 463         pcap_t  *pd;
 464         pcap_dumper_t *p;
 465 #ifdef HAVE_CAPSICUM
 466         int     dirfd;
 467 #endif
 468 };
 469
 470 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
 471 static void
 472 show_tstamp_types_and_exit(const char *device, pcap_t *pd)
 473 {
 474         int n_tstamp_types;
 475         int *tstamp_types = 0;
 476         const char *tstamp_type_name;
 477         int i;
 478
 479         n_tstamp_types = pcap_list_tstamp_types(pd, &tstamp_types);
 480         if (n_tstamp_types < 0)
 481                 error("%s", pcap_geterr(pd));
 482
 483         if (n_tstamp_types == 0) {
 484                 fprintf(stderr, "Time stamp type cannot be set for %s\n",
 485                     device);
 486                 exit(0);
 487         }
 488         fprintf(stderr, "Time stamp types for %s (use option -j to set):\n",
 489             device);
 490         for (i = 0; i < n_tstamp_types; i++) {
 491                 tstamp_type_name = pcap_tstamp_type_val_to_name(tstamp_types[i]);
 492                 if (tstamp_type_name != NULL) {
 493                         (void) fprintf(stderr, "  %s (%s)\n", tstamp_type_name,
 494                             pcap_tstamp_type_val_to_description(tstamp_types[i]));
 495                 } else {
 496                         (void) fprintf(stderr, "  %d\n", tstamp_types[i]);
 497                 }
 498         }
 499         pcap_free_tstamp_types(tstamp_types);
 500         exit(0);
 501 }
 502 #endif
 503
 504 static void
 505 show_dlts_and_exit(const char *device, pcap_t *pd)
 506 {
 507         int n_dlts;
 508         int *dlts = 0;
 509         const char *dlt_name;
 510
 511         n_dlts = pcap_list_datalinks(pd, &dlts);
 512         if (n_dlts < 0)
 513                 error("%s", pcap_geterr(pd));
 514         else if (n_dlts == 0 || !dlts)
 515                 error("No data link types.");
 516
 517         /*
 518          * If the interface is known to support monitor mode, indicate
 519          * whether these are the data link types available when not in
 520          * monitor mode, if -I wasn't specified, or when in monitor mode,
 521          * when -I was specified (the link-layer types available in
 522          * monitor mode might be different from the ones available when
 523          * not in monitor mode).
 524          */
 525         if (supports_monitor_mode)
 526                 (void) fprintf(stderr, "Data link types for %s %s (use option -y to set):\n",
 527                     device,
 528                     Iflag ? "when in monitor mode" : "when not in monitor mode");
 529         else
 530                 (void) fprintf(stderr, "Data link types for %s (use option -y to set):\n",
 531                     device);
 532
 533         while (--n_dlts >= 0) {
 534                 dlt_name = pcap_datalink_val_to_name(dlts[n_dlts]);
 535                 if (dlt_name != NULL) {
 536                         (void) fprintf(stderr, "  %s (%s)", dlt_name,
 537                             pcap_datalink_val_to_description(dlts[n_dlts]));
 538
 539                         /*
 540                          * OK, does tcpdump handle that type?
 541                          */
 542                         if (lookup_printer(dlts[n_dlts]) == NULL
 543                             && lookup_ndo_printer(dlts[n_dlts]) == NULL)
 544                                 (void) fprintf(stderr, " (printing not supported)");
 545                         fprintf(stderr, "\n");
 546                 } else {
 547                         (void) fprintf(stderr, "  DLT %d (printing not supported)\n",
 548                             dlts[n_dlts]);
 549                 }
 550         }
 551 #ifdef HAVE_PCAP_FREE_DATALINKS
 552         pcap_free_datalinks(dlts);
 553 #endif
 554         exit(0);
 555 }
 556
 557 #ifdef HAVE_PCAP_FINDALLDEVS
 558 static void
 559 show_devices_and_exit (void)
 560 {
 561         pcap_if_t *devpointer;
 562         char ebuf[PCAP_ERRBUF_SIZE];
 563         int i;
 564
 565         if (pcap_findalldevs(&devpointer, ebuf) < 0)
 566                 error("%s", ebuf);
 567         else {
 568                 for (i = 0; devpointer != NULL; i++) {
 569                         printf("%d.%s", i+1, devpointer->name);
 570                         if (devpointer->description != NULL)
 571                                 printf(" (%s)", devpointer->description);
 572                         if (devpointer->flags != 0)
 573                                 printf(" [%s]", bittok2str(status_flags, "none", devpointer->flags));
 574                         printf("\n");
 575                         devpointer = devpointer->next;
 576                 }
 577         }
 578         exit(0);
 579 }
 580 #endif /* HAVE_PCAP_FINDALLDEVS */
 581
 582 /*
 583  * Short options.
 584  *
 585  * Note that there we use all letters for short options except for g, k,
 586  * o, and P, and those are used by other versions of tcpdump, and we should
 587  * only use them for the same purposes that the other versions of tcpdump
 588  * use them:
 589  *
 590  * OS X tcpdump uses -g to force non--v output for IP to be on one
 591  * line, making it more "g"repable;
 592  *
 593  * OS X tcpdump uses -k tospecify that packet comments in pcap-ng files
 594  * should be printed;
 595  *
 596  * OpenBSD tcpdump uses -o to indicate that OS fingerprinting should be done
 597  * for hosts sending TCP SYN packets;
 598  *
 599  * OS X tcpdump uses -P to indicate that -w should write pcap-ng rather
 600  * than pcap files.
 601  */
 602
 603 /*
 604  * Set up flags that might or might not be supported depending on the
 605  * version of libpcap we're using.
 606  */
 607 #if defined(HAVE_PCAP_CREATE) || defined(WIN32)
 608 #define B_FLAG          "B:"
 609 #define B_FLAG_USAGE    " [ -B size ]"
 610 #else /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */
 611 #define B_FLAG
 612 #define B_FLAG_USAGE
 613 #endif /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */
 614
 615 #ifdef HAVE_PCAP_CREATE
 616 #define I_FLAG          "I"
 617 #else /* HAVE_PCAP_CREATE */
 618 #define I_FLAG
 619 #endif /* HAVE_PCAP_CREATE */
 620
 621 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
 622 #define j_FLAG          "j:"
 623 #define j_FLAG_USAGE    " [ -j tstamptype ]"
 624 #define J_FLAG          "J"
 625 #else /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */
 626 #define j_FLAG
 627 #define j_FLAG_USAGE
 628 #define J_FLAG
 629 #endif /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */
 630
 631 #ifdef HAVE_PCAP_FINDALLDEVS
 632 #ifndef HAVE_PCAP_IF_T
 633 #undef HAVE_PCAP_FINDALLDEVS
 634 #endif
 635 #endif
 636
 637 #ifdef HAVE_PCAP_FINDALLDEVS
 638 #define D_FLAG  "D"
 639 #else
 640 #define D_FLAG
 641 #endif
 642
 643 #ifdef HAVE_PCAP_DUMP_FLUSH
 644 #define U_FLAG  "U"
 645 #else
 646 #define U_FLAG
 647 #endif
 648
 649 #ifdef HAVE_PCAP_SETDIRECTION
 650 #define Q_FLAG "Q:"
 651 #else
 652 #define Q_FLAG
 653 #endif
 654
 655 /*
 656  * Long options.
 657  *
 658  * We do not currently have long options corresponding to all short
 659  * options; we should probably pick appropriate option names for them.
 660  *
 661  * However, the short options where the number of times the option is
 662  * specified matters, such as -v and -d and -t, should probably not
 663  * just map to a long option, as saying
 664  *
 665  *  tcpdump --verbose --verbose
 666  *
 667  * doesn't make sense; it should be --verbosity={N} or something such
 668  * as that.
 669  *
 670  * For long options with no corresponding short options, we define values
 671  * outside the range of ASCII graphic characters, make that the last
 672  * component of the entry for the long option, and have a case for that
 673  * option in the switch statement.
 674  */
 675 #define OPTION_VERSION          128
 676 #define OPTION_TSTAMP_PRECISION 129
 677
 678 static const struct option longopts[] = {
 679 #if defined(HAVE_PCAP_CREATE) || defined(WIN32)
 680         { "buffer-size", required_argument, NULL, 'B' },
 681 #endif
 682         { "list-interfaces", no_argument, NULL, 'D' },
 683         { "help", no_argument, NULL, 'h' },
 684         { "interface", required_argument, NULL, 'i' },
 685 #ifdef HAVE_PCAP_CREATE
 686         { "monitor-mode", no_argument, NULL, 'I' },
 687 #endif
 688 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
 689         { "time-stamp-type", required_argument, NULL, 'j' },
 690         { "list-time-stamp-types", no_argument, NULL, 'J' },
 691 #endif
 692 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
 693         { "time-stamp-precision", required_argument, NULL, OPTION_TSTAMP_PRECISION},
 694 #endif
 695         { "dont-verify-checksums", no_argument, NULL, 'K' },
 696         { "list-data-link-types", no_argument, NULL, 'L' },
 697         { "no-optimize", no_argument, NULL, 'O' },
 698         { "no-promiscuous-mode", no_argument, NULL, 'p' },
 699 #ifdef HAVE_PCAP_SETDIRECTION
 700         { "direction", required_argument, NULL, 'Q' },
 701 #endif
 702         { "snapshot-length", required_argument, NULL, 's' },
 703         { "absolute-tcp-sequence-numbers", no_argument, NULL, 'S' },
 704 #ifdef HAVE_PCAP_DUMP_FLUSH
 705         { "packet-buffered", no_argument, NULL, 'U' },
 706 #endif
 707         { "linktype", required_argument, NULL, 'y' },
 708 #if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG)
 709         { "debug-filter-parser", no_argument, NULL, 'Y' },
 710 #endif
 711         { "relinquish-privileges", required_argument, NULL, 'Z' },
 712         { "number", no_argument, NULL, '#' },
 713         { "version", no_argument, NULL, OPTION_VERSION },
 714         { NULL, 0, NULL, 0 }
 715 };
 716
 717 #ifndef WIN32
 718 /* Drop root privileges and chroot if necessary */
 719 static void
 720 droproot(const char *username, const char *chroot_dir)
 721 {
 722         struct passwd *pw = NULL;
 723
 724         if (chroot_dir && !username) {
 725                 fprintf(stderr, "tcpdump: Chroot without dropping root is insecure\n");
 726                 exit(1);
 727         }
 728
 729         pw = getpwnam(username);
 730         if (pw) {
 731                 if (chroot_dir) {
 732                         if (chroot(chroot_dir) != 0 || chdir ("/") != 0) {
 733                                 fprintf(stderr, "tcpdump: Couldn't chroot/chdir to '%.64s': %s\n",
 734                                     chroot_dir, pcap_strerror(errno));
 735                                 exit(1);
 736                         }
 737                 }
 738 #ifdef HAVE_CAP_NG_H
 739                 int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG);
 740                 if (ret < 0) {
 741                         fprintf(stderr, "error : ret %d\n", ret);
 742                 }
 743                 else {
 744                         printf("dropped privs to %s\n", username);
 745                 }
 746                 /* We don't need CAP_SETUID and CAP_SETGID */
 747                 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_SETUID);
 748                 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_SETUID);
 749                 capng_update(CAPNG_DROP, CAPNG_PERMITTED, CAP_SETUID);
 750                 capng_update(CAPNG_DROP, CAPNG_PERMITTED, CAP_SETUID);
 751                 capng_apply(CAPNG_SELECT_BOTH);
 752
 753 #else
 754                 if (initgroups(pw->pw_name, pw->pw_gid) != 0 ||
 755                     setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0) {
 756                         fprintf(stderr, "tcpdump: Couldn't change to '%.32s' uid=%lu gid=%lu: %s\n",
 757                             username,
 758                             (unsigned long)pw->pw_uid,
 759                             (unsigned long)pw->pw_gid,
 760                             pcap_strerror(errno));
 761                         exit(1);
 762                 }
 763                 else {
 764                         printf("dropped privs to %s\n", username);
 765                 }
 766 #endif /* HAVE_CAP_NG_H */
 767         }
 768         else {
 769                 fprintf(stderr, "tcpdump: Couldn't find user '%.32s'\n",
 770                     username);
 771                 exit(1);
 772         }
 773 }
 774 #endif /* WIN32 */
 775
 776 static int
 777 getWflagChars(int x)
 778 {
 779         int c = 0;
 780
 781         x -= 1;
 782         while (x > 0) {
 783                 c += 1;
 784                 x /= 10;
 785         }
 786
 787         return c;
 788 }
 789
 790
 791 static void
 792 MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars)
 793 {
 794         char *filename = malloc(PATH_MAX + 1);
 795         if (filename == NULL)
 796             error("Makefilename: malloc");
 797
 798         /* Process with strftime if Gflag is set. */
 799         if (Gflag != 0) {
 800           struct tm *local_tm;
 801
 802           /* Convert Gflag_time to a usable format */
 803           if ((local_tm = localtime(&Gflag_time)) == NULL) {
 804                   error("MakeTimedFilename: localtime");
 805           }
 806
 807           /* There's no good way to detect an error in strftime since a return
 808            * value of 0 isn't necessarily failure.
 809            */
 810           strftime(filename, PATH_MAX, orig_name, local_tm);
 811         } else {
 812           strncpy(filename, orig_name, PATH_MAX);
 813         }
 814
 815         if (cnt == 0 && max_chars == 0)
 816                 strncpy(buffer, filename, PATH_MAX + 1);
 817         else
 818                 if (snprintf(buffer, PATH_MAX + 1, "%s%0*d", filename, max_chars, cnt) > PATH_MAX)
 819                   /* Report an error if the filename is too large */
 820                   error("too many output files or filename is too long (> %d)", PATH_MAX);
 821         free(filename);
 822 }
 823
 824 static int tcpdump_printf(netdissect_options *ndo _U_,
 825                           const char *fmt, ...)
 826 {
 827
 828   va_list args;
 829   int ret;
 830
 831   va_start(args, fmt);
 832   ret=vfprintf(stdout, fmt, args);
 833   va_end(args);
 834
 835   return ret;
 836 }
 837
 838 static struct print_info
 839 get_print_info(int type)
 840 {
 841         struct print_info printinfo;
 842
 843         printinfo.ndo_type = 1;
 844         printinfo.ndo = gndo;
 845         printinfo.p.ndo_printer = lookup_ndo_printer(type);
 846         if (printinfo.p.ndo_printer == NULL) {
 847                 printinfo.p.printer = lookup_printer(type);
 848                 printinfo.ndo_type = 0;
 849                 if (printinfo.p.printer == NULL) {
 850                         gndo->ndo_dltname = pcap_datalink_val_to_name(type);
 851                         if (gndo->ndo_dltname != NULL)
 852                                 error("packet printing is not supported for link type %s: use -w",
 853                                       gndo->ndo_dltname);
 854                         else
 855                                 error("packet printing is not supported for link type %d: use -w", type);
 856                 }
 857         }
 858         return (printinfo);
 859 }
 860
 861 static char *
 862 get_next_file(FILE *VFile, char *ptr)
 863 {
 864         char *ret;
 865
 866         ret = fgets(ptr, PATH_MAX, VFile);
 867         if (!ret)
 868                 return NULL;
 869
 870         if (ptr[strlen(ptr) - 1] == '\n')
 871                 ptr[strlen(ptr) - 1] = '\0';
 872
 873         return ret;
 874 }
 875
 876 #ifdef HAVE_CAPSICUM
 877 static cap_channel_t *
 878 capdns_setup(void)
 879 {
 880         cap_channel_t *capcas, *capdnsloc;
 881         const char *types[1];
 882         int families[2];
 883
 884         capcas = cap_init();
 885         if (capcas == NULL) {
 886                 warning("unable to contact casperd");
 887                 return (NULL);
 888         }
 889         capdnsloc = cap_service_open(capcas, "system.dns");
 890         /* Casper capability no longer needed. */
 891         cap_close(capcas);
 892         if (capdnsloc == NULL)
 893                 error("unable to open system.dns service");
 894         /* Limit system.dns to reverse DNS lookups. */
 895         types[0] = "ADDR";
 896         if (cap_dns_type_limit(capdnsloc, types, 1) < 0)
 897                 error("unable to limit access to system.dns service");
 898         families[0] = AF_INET;
 899         families[1] = AF_INET6;
 900         if (cap_dns_family_limit(capdnsloc, families, 2) < 0)
 901                 error("unable to limit access to system.dns service");
 902
 903         return (capdnsloc);
 904 }
 905 #endif  /* HAVE_CAPSICUM */
 906
 907 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
 908 static int
 909 tstamp_precision_from_string(const char *precision)
 910 {
 911         if (strncmp(precision, "nano", strlen("nano")) == 0)
 912                 return PCAP_TSTAMP_PRECISION_NANO;
 913
 914         if (strncmp(precision, "micro", strlen("micro")) == 0)
 915                 return PCAP_TSTAMP_PRECISION_MICRO;
 916
 917         return -EINVAL;
 918 }
 919
 920 static const char *
 921 tstamp_precision_to_string(int precision)
 922 {
 923         switch (precision) {
 924
 925         case PCAP_TSTAMP_PRECISION_MICRO:
 926                 return "micro";
 927
 928         case PCAP_TSTAMP_PRECISION_NANO:
 929                 return "nano";
 930
 931         default:
 932                 return "unknown";
 933         }
 934 }
 935 #endif
 936
 937 int
 938 main(int argc, char **argv)
 939 {
 940         register int cnt, op, i;
 941         bpf_u_int32 localnet =0 , netmask = 0;
 942         register char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName;
 943         pcap_handler callback;
 944         int type;
 945         int dlt;
 946         int new_dlt;
 947         const char *dlt_name;
 948         struct bpf_program fcode;
 949 #ifndef WIN32
 950         RETSIGTYPE (*oldhandler)(int);
 951 #endif
 952         struct print_info printinfo;
 953         struct dump_info dumpinfo;
 954         u_char *pcap_userdata;
 955         char ebuf[PCAP_ERRBUF_SIZE];
 956         char VFileLine[PATH_MAX + 1];
 957         char *username = NULL;
 958         char *chroot_dir = NULL;
 959         char *ret = NULL;
 960         char *end;
 961 #ifdef HAVE_PCAP_FINDALLDEVS
 962         pcap_if_t *devpointer;
 963         int devnum;
 964 #endif
 965         int status;
 966         FILE *VFile;
 967 #ifdef HAVE_CAPSICUM
 968         cap_rights_t rights;
 969 #endif  /* HAVE_CAPSICUM */
 970         int cansandbox;
 971
 972 #ifdef WIN32
 973         if(wsockinit() != 0) return 1;
 974 #endif /* WIN32 */
 975
 976         jflag=-1;       /* not set */
 977         gndo->ndo_Oflag=1;
 978         gndo->ndo_Rflag=1;
 979         gndo->ndo_dlt=-1;
 980         gndo->ndo_default_print=ndo_default_print;
 981         gndo->ndo_printf=tcpdump_printf;
 982         gndo->ndo_error=ndo_error;
 983         gndo->ndo_warning=ndo_warning;
 984         gndo->ndo_snaplen = DEFAULT_SNAPLEN;
 985
 986         cnt = -1;
 987         device = NULL;
 988         infile = NULL;
 989         RFileName = NULL;
 990         VFileName = NULL;
 991         VFile = NULL;
 992         WFileName = NULL;
 993         dlt = -1;
 994         if ((cp = strrchr(argv[0], '/')) != NULL)
 995                 program_name = cp + 1;
 996         else
 997                 program_name = argv[0];
 998
 999         if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0)
1000                 error("%s", ebuf);
1001
1002 #ifdef USE_LIBSMI
1003         smiInit("tcpdump");
1004 #endif
1005
1006         while (
1007             (op = getopt_long(argc, argv, "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:Rs:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#", longopts, NULL)) != -1)
1008                 switch (op) {
1009
1010                 case 'a':
1011                         /* compatibility for old -a */
1012                         break;
1013
1014                 case 'A':
1015                         ++Aflag;
1016                         break;
1017
1018                 case 'b':
1019                         ++bflag;
1020                         break;
1021
1022 #if defined(HAVE_PCAP_CREATE) || defined(WIN32)
1023                 case 'B':
1024                         Bflag = atoi(optarg)*1024;
1025                         if (Bflag <= 0)
1026                                 error("invalid packet buffer size %s", optarg);
1027                         break;
1028 #endif /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */
1029
1030                 case 'c':
1031                         cnt = atoi(optarg);
1032                         if (cnt <= 0)
1033                                 error("invalid packet count %s", optarg);
1034                         break;
1035
1036                 case 'C':
1037                         Cflag = atoi(optarg) * 1000000;
1038                         if (Cflag < 0)
1039                                 error("invalid file size %s", optarg);
1040                         break;
1041
1042                 case 'd':
1043                         ++dflag;
1044                         break;
1045
1046                 case 'D':
1047                         Dflag++;
1048                         break;
1049
1050                 case 'L':
1051                         Lflag++;
1052                         break;
1053
1054                 case 'e':
1055                         ++eflag;
1056                         break;
1057
1058                 case 'E':
1059 #ifndef HAVE_LIBCRYPTO
1060                         warning("crypto code not compiled in");
1061 #endif
1062                         gndo->ndo_espsecret = optarg;
1063                         break;
1064
1065                 case 'f':
1066                         ++fflag;
1067                         break;
1068
1069                 case 'F':
1070                         infile = optarg;
1071                         break;
1072
1073                 case 'G':
1074                         Gflag = atoi(optarg);
1075                         if (Gflag < 0)
1076                                 error("invalid number of seconds %s", optarg);
1077
1078                         /* We will create one file initially. */
1079                         Gflag_count = 0;
1080
1081                         /* Grab the current time for rotation use. */
1082                         if ((Gflag_time = time(NULL)) == (time_t)-1) {
1083                                 error("main: can't get current time: %s",
1084                                     pcap_strerror(errno));
1085                         }
1086                         break;
1087
1088                 case 'h':
1089                         print_usage();
1090                         exit(0);
1091                         break;
1092
1093                 case 'H':
1094                         ++Hflag;
1095                         break;
1096
1097                 case 'i':
1098                         if (optarg[0] == '0' && optarg[1] == 0)
1099                                 error("Invalid adapter index");
1100
1101 #ifdef HAVE_PCAP_FINDALLDEVS
1102                         /*
1103                          * If the argument is a number, treat it as
1104                          * an index into the list of adapters, as
1105                          * printed by "tcpdump -D".
1106                          *
1107                          * This should be OK on UNIX systems, as interfaces
1108                          * shouldn't have names that begin with digits.
1109                          * It can be useful on Windows, where more than
1110                          * one interface can have the same name.
1111                          */
1112                         devnum = strtol(optarg, &end, 10);
1113                         if (optarg != end && *end == '\0') {
1114                                 if (devnum < 0)
1115                                         error("Invalid adapter index");
1116
1117                                 if (pcap_findalldevs(&devpointer, ebuf) < 0)
1118                                         error("%s", ebuf);
1119                                 else {
1120                                         /*
1121                                          * Look for the devnum-th entry
1122                                          * in the list of devices
1123                                          * (1-based).
1124                                          */
1125                                         for (i = 0;
1126                                             i < devnum-1 && devpointer != NULL;
1127                                             i++, devpointer = devpointer->next)
1128                                                 ;
1129                                         if (devpointer == NULL)
1130                                                 error("Invalid adapter index");
1131                                 }
1132                                 device = devpointer->name;
1133                                 break;
1134                         }
1135 #endif /* HAVE_PCAP_FINDALLDEVS */
1136                         device = optarg;
1137                         break;
1138
1139 #ifdef HAVE_PCAP_CREATE
1140                 case 'I':
1141                         ++Iflag;
1142                         break;
1143 #endif /* HAVE_PCAP_CREATE */
1144
1145 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1146                 case 'j':
1147                         jflag = pcap_tstamp_type_name_to_val(optarg);
1148                         if (jflag < 0)
1149                                 error("invalid time stamp type %s", optarg);
1150                         break;
1151
1152                 case 'J':
1153                         Jflag++;
1154                         break;
1155 #endif
1156
1157                 case 'l':
1158 #ifdef WIN32
1159                         /*
1160                          * _IOLBF is the same as _IOFBF in Microsoft's C
1161                          * libraries; the only alternative they offer
1162                          * is _IONBF.
1163                          *
1164                          * XXX - this should really be checking for MSVC++,
1165                          * not WIN32, if, for example, MinGW has its own
1166                          * C library that is more UNIX-compatible.
1167                          */
1168                         setvbuf(stdout, NULL, _IONBF, 0);
1169 #else /* WIN32 */
1170 #ifdef HAVE_SETLINEBUF
1171                         setlinebuf(stdout);
1172 #else
1173                         setvbuf(stdout, NULL, _IOLBF, 0);
1174 #endif
1175 #endif /* WIN32 */
1176                         break;
1177
1178                 case 'K':
1179                         ++Kflag;
1180                         break;
1181
1182                 case 'm':
1183 #ifdef USE_LIBSMI
1184                         if (smiLoadModule(optarg) == 0) {
1185                                 error("could not load MIB module %s", optarg);
1186                         }
1187                         sflag = 1;
1188 #else
1189                         (void)fprintf(stderr, "%s: ignoring option `-m %s' ",
1190                                       program_name, optarg);
1191                         (void)fprintf(stderr, "(no libsmi support)\n");
1192 #endif
1193                         break;
1194
1195                 case 'M':
1196                         /* TCP-MD5 shared secret */
1197 #ifndef HAVE_LIBCRYPTO
1198                         warning("crypto code not compiled in");
1199 #endif
1200                         sigsecret = optarg;
1201                         break;
1202
1203                 case 'n':
1204                         ++nflag;
1205                         break;
1206
1207                 case 'N':
1208                         ++Nflag;
1209                         break;
1210
1211                 case 'O':
1212                         Oflag = 0;
1213                         break;
1214
1215                 case 'p':
1216                         ++pflag;
1217                         break;
1218
1219                 case 'q':
1220                         ++qflag;
1221                         ++suppress_default_print;
1222                         break;
1223
1224 #ifdef HAVE_PCAP_SETDIRECTION
1225                 case 'Q':
1226                         if (strcasecmp(optarg, "in") == 0)
1227                                 Qflag = PCAP_D_IN;
1228                         else if (strcasecmp(optarg, "out") == 0)
1229                                 Qflag = PCAP_D_OUT;
1230                         else if (strcasecmp(optarg, "inout") == 0)
1231                                 Qflag = PCAP_D_INOUT;
1232                         else
1233                                 error("unknown capture direction `%s'", optarg);
1234                         break;
1235 #endif /* HAVE_PCAP_SETDIRECTION */
1236
1237                 case 'r':
1238                         RFileName = optarg;
1239                         break;
1240
1241                 case 'R':
1242                         Rflag = 0;
1243                         break;
1244
1245                 case 's':
1246                         snaplen = strtol(optarg, &end, 0);
1247                         if (optarg == end || *end != '\0'
1248                             || snaplen < 0 || snaplen > MAXIMUM_SNAPLEN)
1249                                 error("invalid snaplen %s", optarg);
1250                         else if (snaplen == 0)
1251                                 snaplen = MAXIMUM_SNAPLEN;
1252                         break;
1253
1254                 case 'S':
1255                         ++Sflag;
1256                         break;
1257
1258                 case 't':
1259                         ++tflag;
1260                         break;
1261
1262                 case 'T':
1263                         if (strcasecmp(optarg, "vat") == 0)
1264                                 packettype = PT_VAT;
1265                         else if (strcasecmp(optarg, "wb") == 0)
1266                                 packettype = PT_WB;
1267                         else if (strcasecmp(optarg, "rpc") == 0)
1268                                 packettype = PT_RPC;
1269                         else if (strcasecmp(optarg, "rtp") == 0)
1270                                 packettype = PT_RTP;
1271                         else if (strcasecmp(optarg, "rtcp") == 0)
1272                                 packettype = PT_RTCP;
1273                         else if (strcasecmp(optarg, "snmp") == 0)
1274                                 packettype = PT_SNMP;
1275                         else if (strcasecmp(optarg, "cnfp") == 0)
1276                                 packettype = PT_CNFP;
1277                         else if (strcasecmp(optarg, "tftp") == 0)
1278                                 packettype = PT_TFTP;
1279                         else if (strcasecmp(optarg, "aodv") == 0)
1280                                 packettype = PT_AODV;
1281                         else if (strcasecmp(optarg, "carp") == 0)
1282                                 packettype = PT_CARP;
1283                         else if (strcasecmp(optarg, "radius") == 0)
1284                                 packettype = PT_RADIUS;
1285                         else if (strcasecmp(optarg, "zmtp1") == 0)
1286                                 packettype = PT_ZMTP1;
1287                         else if (strcasecmp(optarg, "vxlan") == 0)
1288                                 packettype = PT_VXLAN;
1289                         else if (strcasecmp(optarg, "pgm") == 0)
1290                                 packettype = PT_PGM;
1291                         else if (strcasecmp(optarg, "pgm_zmtp1") == 0)
1292                                 packettype = PT_PGM_ZMTP1;
1293                         else if (strcasecmp(optarg, "lmp") == 0)
1294                                 packettype = PT_LMP;
1295                         else
1296                                 error("unknown packet type `%s'", optarg);
1297                         break;
1298
1299                 case 'u':
1300                         ++uflag;
1301                         break;
1302
1303 #ifdef HAVE_PCAP_DUMP_FLUSH
1304                 case 'U':
1305                         ++Uflag;
1306                         break;
1307 #endif
1308
1309                 case 'v':
1310                         ++vflag;
1311                         break;
1312
1313                 case 'V':
1314                         VFileName = optarg;
1315                         break;
1316
1317                 case 'w':
1318                         WFileName = optarg;
1319                         break;
1320
1321                 case 'W':
1322                         Wflag = atoi(optarg);
1323                         if (Wflag < 0)
1324                                 error("invalid number of output files %s", optarg);
1325                         WflagChars = getWflagChars(Wflag);
1326                         break;
1327
1328                 case 'x':
1329                         ++xflag;
1330                         ++suppress_default_print;
1331                         break;
1332
1333                 case 'X':
1334                         ++Xflag;
1335                         ++suppress_default_print;
1336                         break;
1337
1338                 case 'y':
1339                         gndo->ndo_dltname = optarg;
1340                         gndo->ndo_dlt =
1341                           pcap_datalink_name_to_val(gndo->ndo_dltname);
1342                         if (gndo->ndo_dlt < 0)
1343                                 error("invalid data link type %s", gndo->ndo_dltname);
1344                         break;
1345
1346 #if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG)
1347                 case 'Y':
1348                         {
1349                         /* Undocumented flag */
1350 #ifdef HAVE_PCAP_DEBUG
1351                         extern int pcap_debug;
1352                         pcap_debug = 1;
1353 #else
1354                         extern int yydebug;
1355                         yydebug = 1;
1356 #endif
1357                         }
1358                         break;
1359 #endif
1360                 case 'z':
1361                         zflag = strdup(optarg);
1362                         break;
1363
1364                 case 'Z':
1365                         username = strdup(optarg);
1366                         break;
1367
1368                 case '#':
1369                         gndo->ndo_packet_number = 1;
1370                         break;
1371
1372                 case OPTION_VERSION:
1373                         print_version();
1374                         exit(0);
1375                         break;
1376
1377 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
1378                 case OPTION_TSTAMP_PRECISION:
1379                         gndo->ndo_tstamp_precision = tstamp_precision_from_string(optarg);
1380                         if (gndo->ndo_tstamp_precision < 0)
1381                                 error("unsupported time stamp precision");
1382                         break;
1383 #endif
1384
1385                 default:
1386                         print_usage();
1387                         exit(1);
1388                         /* NOTREACHED */
1389                 }
1390
1391 #ifdef HAVE_PCAP_FINDALLDEVS
1392         if (Dflag)
1393                 show_devices_and_exit();
1394 #endif
1395
1396         switch (tflag) {
1397
1398         case 0: /* Default */
1399         case 4: /* Default + Date*/
1400                 thiszone = gmt2local(0);
1401                 break;
1402
1403         case 1: /* No time stamp */
1404         case 2: /* Unix timeval style */
1405         case 3: /* Microseconds since previous packet */
1406         case 5: /* Microseconds since first packet */
1407                 break;
1408
1409         default: /* Not supported */
1410                 error("only -t, -tt, -ttt, -tttt and -ttttt are supported");
1411                 break;
1412         }
1413
1414         if (fflag != 0 && (VFileName != NULL || RFileName != NULL))
1415                 error("-f can not be used with -V or -r");
1416
1417         if (VFileName != NULL && RFileName != NULL)
1418                 error("-V and -r are mutually exclusive.");
1419
1420 #ifdef WITH_CHROOT
1421         /* if run as root, prepare for chrooting */
1422         if (getuid() == 0 || geteuid() == 0) {
1423                 /* future extensibility for cmd-line arguments */
1424                 if (!chroot_dir)
1425                         chroot_dir = WITH_CHROOT;
1426         }
1427 #endif
1428
1429 #ifdef WITH_USER
1430         /* if run as root, prepare for dropping root privileges */
1431         if (getuid() == 0 || geteuid() == 0) {
1432                 /* Run with '-Z root' to restore old behaviour */
1433                 if (!username)
1434                         username = WITH_USER;
1435         }
1436 #endif
1437
1438         if (RFileName != NULL || VFileName != NULL) {
1439                 /*
1440                  * If RFileName is non-null, it's the pathname of a
1441                  * savefile to read.  If VFileName is non-null, it's
1442                  * the pathname of a file containing a list of pathnames
1443                  * (one per line) of savefiles to read.
1444                  *
1445                  * In either case, we're reading a savefile, not doing
1446                  * a live capture.
1447                  */
1448 #ifndef WIN32
1449                 /*
1450                  * We don't need network access, so relinquish any set-UID
1451                  * or set-GID privileges we have (if any).
1452                  *
1453                  * We do *not* want set-UID privileges when opening a
1454                  * trace file, as that might let the user read other
1455                  * people's trace files (especially if we're set-UID
1456                  * root).
1457                  */
1458                 if (setgid(getgid()) != 0 || setuid(getuid()) != 0 )
1459                         fprintf(stderr, "Warning: setgid/setuid failed !\n");
1460 #endif /* WIN32 */
1461                 if (VFileName != NULL) {
1462                         if (VFileName[0] == '-' && VFileName[1] == '\0')
1463                                 VFile = stdin;
1464                         else
1465                                 VFile = fopen(VFileName, "r");
1466
1467                         if (VFile == NULL)
1468                                 error("Unable to open file: %s\n", strerror(errno));
1469
1470                         ret = get_next_file(VFile, VFileLine);
1471                         if (!ret)
1472                                 error("Nothing in %s\n", VFileName);
1473                         RFileName = VFileLine;
1474                 }
1475
1476 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
1477                 pd = pcap_open_offline_with_tstamp_precision(RFileName,
1478                     gndo->ndo_tstamp_precision, ebuf);
1479 #else
1480                 pd = pcap_open_offline(RFileName, ebuf);
1481 #endif
1482
1483                 if (pd == NULL)
1484                         error("%s", ebuf);
1485 #ifdef HAVE_CAPSICUM
1486                 cap_rights_init(&rights, CAP_READ);
1487                 if (cap_rights_limit(fileno(pcap_file(pd)), &rights) < 0 &&
1488                     errno != ENOSYS) {
1489                         error("unable to limit pcap descriptor");
1490                 }
1491 #endif
1492                 dlt = pcap_datalink(pd);
1493                 dlt_name = pcap_datalink_val_to_name(dlt);
1494                 if (dlt_name == NULL) {
1495                         fprintf(stderr, "reading from file %s, link-type %u\n",
1496                             RFileName, dlt);
1497                 } else {
1498                         fprintf(stderr,
1499                             "reading from file %s, link-type %s (%s)\n",
1500                             RFileName, dlt_name,
1501                             pcap_datalink_val_to_description(dlt));
1502                 }
1503         } else {
1504                 /*
1505                  * We're doing a live capture.
1506                  */
1507                 if (device == NULL) {
1508                         device = pcap_lookupdev(ebuf);
1509                         if (device == NULL)
1510                                 error("%s", ebuf);
1511                 }
1512 #ifdef WIN32
1513                 /*
1514                  * Print a message to the standard error on Windows.
1515                  * XXX - why do it here, with a different message?
1516                  */
1517                 if(strlen(device) == 1) /* we assume that an ASCII string is always longer than 1 char */
1518                 {                                               /* a Unicode string has a \0 as second byte (so strlen() is 1) */
1519                         fprintf(stderr, "%s: listening on %ws\n", program_name, device);
1520                 }
1521                 else
1522                 {
1523                         fprintf(stderr, "%s: listening on %s\n", program_name, device);
1524                 }
1525
1526                 fflush(stderr);
1527 #endif /* WIN32 */
1528 #ifdef HAVE_PCAP_CREATE
1529                 pd = pcap_create(device, ebuf);
1530                 if (pd == NULL)
1531                         error("%s", ebuf);
1532 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1533                 if (Jflag)
1534                         show_tstamp_types_and_exit(device, pd);
1535 #endif
1536 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
1537                 status = pcap_set_tstamp_precision(pd, gndo->ndo_tstamp_precision);
1538                 if (status != 0)
1539                         error("%s: Can't set %ssecond time stamp precision: %s",
1540                                 device,
1541                                 tstamp_precision_to_string(gndo->ndo_tstamp_precision),
1542                                 pcap_statustostr(status));
1543 #endif
1544
1545                 /*
1546                  * Is this an interface that supports monitor mode?
1547                  */
1548                 if (pcap_can_set_rfmon(pd) == 1)
1549                         supports_monitor_mode = 1;
1550                 else
1551                         supports_monitor_mode = 0;
1552                 status = pcap_set_snaplen(pd, snaplen);
1553                 if (status != 0)
1554                         error("%s: Can't set snapshot length: %s",
1555                             device, pcap_statustostr(status));
1556                 status = pcap_set_promisc(pd, !pflag);
1557                 if (status != 0)
1558                         error("%s: Can't set promiscuous mode: %s",
1559                             device, pcap_statustostr(status));
1560                 if (Iflag) {
1561                         status = pcap_set_rfmon(pd, 1);
1562                         if (status != 0)
1563                                 error("%s: Can't set monitor mode: %s",
1564                                     device, pcap_statustostr(status));
1565                 }
1566                 status = pcap_set_timeout(pd, 1000);
1567                 if (status != 0)
1568                         error("%s: pcap_set_timeout failed: %s",
1569                             device, pcap_statustostr(status));
1570                 if (Bflag != 0) {
1571                         status = pcap_set_buffer_size(pd, Bflag);
1572                         if (status != 0)
1573                                 error("%s: Can't set buffer size: %s",
1574                                     device, pcap_statustostr(status));
1575                 }
1576 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1577                 if (jflag != -1) {
1578                         status = pcap_set_tstamp_type(pd, jflag);
1579                         if (status < 0)
1580                                 error("%s: Can't set time stamp type: %s",
1581                                     device, pcap_statustostr(status));
1582                 }
1583 #endif
1584                 status = pcap_activate(pd);
1585                 if (status < 0) {
1586                         /*
1587                          * pcap_activate() failed.
1588                          */
1589                         cp = pcap_geterr(pd);
1590                         if (status == PCAP_ERROR)
1591                                 error("%s", cp);
1592                         else if ((status == PCAP_ERROR_NO_SUCH_DEVICE ||
1593                                   status == PCAP_ERROR_PERM_DENIED) &&
1594                                  *cp != '\0')
1595                                 error("%s: %s\n(%s)", device,
1596                                     pcap_statustostr(status), cp);
1597 #ifdef __FreeBSD__
1598                         else if (status == PCAP_ERROR_RFMON_NOTSUP &&
1599                             strncmp(device, "wlan", 4) == 0) {
1600                                 char parent[8], newdev[8];
1601                                 char sysctl[32];
1602                                 size_t s = sizeof(parent);
1603
1604                                 snprintf(sysctl, sizeof(sysctl),
1605                                     "net.wlan.%d.%%parent", atoi(device + 4));
1606                                 sysctlbyname(sysctl, parent, &s, NULL, 0);
1607                                 strlcpy(newdev, device, sizeof(newdev));
1608                                 /* Suggest a new wlan device. */
1609                                 newdev[strlen(newdev)-1]++;
1610                                 error("%s is not a monitor mode VAP\n"
1611                                     "To create a new monitor mode VAP use:\n"
1612                                     "  ifconfig %s create wlandev %s wlanmode "
1613                                     "monitor\nand use %s as the tcpdump "
1614                                     "interface", device, newdev, parent,
1615                                     newdev);
1616                         }
1617 #endif
1618                         else
1619                                 error("%s: %s", device,
1620                                     pcap_statustostr(status));
1621                 } else if (status > 0) {
1622                         /*
1623                          * pcap_activate() succeeded, but it's warning us
1624                          * of a problem it had.
1625                          */
1626                         cp = pcap_geterr(pd);
1627                         if (status == PCAP_WARNING)
1628                                 warning("%s", cp);
1629                         else if (status == PCAP_WARNING_PROMISC_NOTSUP &&
1630                                  *cp != '\0')
1631                                 warning("%s: %s\n(%s)", device,
1632                                     pcap_statustostr(status), cp);
1633                         else
1634                                 warning("%s: %s", device,
1635                                     pcap_statustostr(status));
1636                 }
1637 #ifdef HAVE_PCAP_SETDIRECTION
1638                 if (Qflag != -1) {
1639                         status = pcap_setdirection(pd, Qflag);
1640                         if (status != 0)
1641                                 error("%s: pcap_setdirection() failed: %s",
1642                                       device,  pcap_geterr(pd));
1643                 }
1644 #endif /* HAVE_PCAP_SETDIRECTION */
1645 #else
1646                 *ebuf = '\0';
1647                 pd = pcap_open_live(device, snaplen, !pflag, 1000, ebuf);
1648                 if (pd == NULL)
1649                         error("%s", ebuf);
1650                 else if (*ebuf)
1651                         warning("%s", ebuf);
1652 #endif /* HAVE_PCAP_CREATE */
1653                 /*
1654                  * Let user own process after socket has been opened.
1655                  */
1656 #ifndef WIN32
1657                 if (setgid(getgid()) != 0 || setuid(getuid()) != 0)
1658                         fprintf(stderr, "Warning: setgid/setuid failed !\n");
1659 #endif /* WIN32 */
1660 #if !defined(HAVE_PCAP_CREATE) && defined(WIN32)
1661                 if(Bflag != 0)
1662                         if(pcap_setbuff(pd, Bflag)==-1){
1663                                 error("%s", pcap_geterr(pd));
1664                         }
1665 #endif /* !defined(HAVE_PCAP_CREATE) && defined(WIN32) */
1666                 if (Lflag)
1667                         show_dlts_and_exit(device, pd);
1668                 if (gndo->ndo_dlt >= 0) {
1669 #ifdef HAVE_PCAP_SET_DATALINK
1670                         if (pcap_set_datalink(pd, gndo->ndo_dlt) < 0)
1671                                 error("%s", pcap_geterr(pd));
1672 #else
1673                         /*
1674                          * We don't actually support changing the
1675                          * data link type, so we only let them
1676                          * set it to what it already is.
1677                          */
1678                         if (gndo->ndo_dlt != pcap_datalink(pd)) {
1679                                 error("%s is not one of the DLTs supported by this device\n",
1680                                       gndo->ndo_dltname);
1681                         }
1682 #endif
1683                         (void)fprintf(stderr, "%s: data link type %s\n",
1684                                       program_name, gndo->ndo_dltname);
1685                         (void)fflush(stderr);
1686                 }
1687                 i = pcap_snapshot(pd);
1688                 if (snaplen < i) {
1689                         warning("snaplen raised from %d to %d", snaplen, i);
1690                         snaplen = i;
1691                 }
1692                 if(fflag != 0) {
1693                         if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) {
1694                                 warning("foreign (-f) flag used but: %s", ebuf);
1695                         }
1696                 }
1697
1698         }
1699         if (infile)
1700                 cmdbuf = read_infile(infile);
1701         else
1702                 cmdbuf = copy_argv(&argv[optind]);
1703
1704         if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
1705                 error("%s", pcap_geterr(pd));
1706         if (dflag) {
1707                 bpf_dump(&fcode, dflag);
1708                 pcap_close(pd);
1709                 free(cmdbuf);
1710                 exit(0);
1711         }
1712
1713 #ifdef HAVE_CAPSICUM
1714         if (!nflag)
1715                 capdns = capdns_setup();
1716 #endif  /* HAVE_CAPSICUM */
1717
1718         init_addrtoname(gndo, localnet, netmask);
1719         init_checksum();
1720
1721 #ifndef WIN32
1722         (void)setsignal(SIGPIPE, cleanup);
1723         (void)setsignal(SIGTERM, cleanup);
1724         (void)setsignal(SIGINT, cleanup);
1725 #endif /* WIN32 */
1726 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
1727         (void)setsignal(SIGCHLD, child_cleanup);
1728 #endif
1729         /* Cooperate with nohup(1) */
1730 #ifndef WIN32
1731         if ((oldhandler = setsignal(SIGHUP, cleanup)) != SIG_DFL)
1732                 (void)setsignal(SIGHUP, oldhandler);
1733 #endif /* WIN32 */
1734
1735 #ifndef WIN32
1736         /*
1737          * If a user name was specified with "-Z", attempt to switch to
1738          * that user's UID.  This would probably be used with sudo,
1739          * to allow tcpdump to be run in a special restricted
1740          * account (if you just want to allow users to open capture
1741          * devices, and can't just give users that permission,
1742          * you'd make tcpdump set-UID or set-GID).
1743          *
1744          * Tcpdump doesn't necessarily write only to one savefile;
1745          * the general only way to allow a -Z instance to write to
1746          * savefiles as the user under whose UID it's run, rather
1747          * than as the user specified with -Z, would thus be to switch
1748          * to the original user ID before opening a capture file and
1749          * then switch back to the -Z user ID after opening the savefile.
1750          * Switching to the -Z user ID only after opening the first
1751          * savefile doesn't handle the general case.
1752          */
1753
1754 #ifdef HAVE_CAP_NG_H
1755         /* We are running as root and we will be writing to savefile */
1756         if ((getuid() == 0 || geteuid() == 0) && WFileName) {
1757                 if (username) {
1758                         /* Drop all capabilities from effective set */
1759                         capng_clear(CAPNG_EFFECTIVE);
1760                         /* Add capabilities we will need*/
1761                         capng_update(CAPNG_ADD, CAPNG_PERMITTED, CAP_SETUID);
1762                         capng_update(CAPNG_ADD, CAPNG_PERMITTED, CAP_SETGID);
1763                         capng_update(CAPNG_ADD, CAPNG_PERMITTED, CAP_DAC_OVERRIDE);
1764
1765                         capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_SETUID);
1766                         capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_SETGID);
1767                         capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
1768
1769                         capng_apply(CAPNG_SELECT_BOTH);
1770                 }
1771         }
1772 #endif /* HAVE_CAP_NG_H */
1773
1774         if (getuid() == 0 || geteuid() == 0) {
1775                 if (username || chroot_dir)
1776                         droproot(username, chroot_dir);
1777
1778         }
1779 #endif /* WIN32 */
1780
1781         if (pcap_setfilter(pd, &fcode) < 0)
1782                 error("%s", pcap_geterr(pd));
1783 #ifdef HAVE_CAPSICUM
1784         if (RFileName == NULL && VFileName == NULL) {
1785                 static const unsigned long cmds[] = { BIOCGSTATS };
1786
1787                 cap_rights_init(&rights, CAP_IOCTL, CAP_READ);
1788                 if (cap_rights_limit(pcap_fileno(pd), &rights) < 0 &&
1789                     errno != ENOSYS) {
1790                         error("unable to limit pcap descriptor");
1791                 }
1792                 if (cap_ioctls_limit(pcap_fileno(pd), cmds,
1793                     sizeof(cmds) / sizeof(cmds[0])) < 0 && errno != ENOSYS) {
1794                         error("unable to limit ioctls on pcap descriptor");
1795                 }
1796         }
1797 #endif
1798         if (WFileName) {
1799                 pcap_dumper_t *p;
1800                 /* Do not exceed the default PATH_MAX for files. */
1801                 dumpinfo.CurrentFileName = (char *)malloc(PATH_MAX + 1);
1802
1803                 if (dumpinfo.CurrentFileName == NULL)
1804                         error("malloc of dumpinfo.CurrentFileName");
1805
1806                 /* We do not need numbering for dumpfiles if Cflag isn't set. */
1807                 if (Cflag != 0)
1808                   MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, WflagChars);
1809                 else
1810                   MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0);
1811
1812                 p = pcap_dump_open(pd, dumpinfo.CurrentFileName);
1813 #ifdef HAVE_CAP_NG_H
1814         /* Give up capabilities, clear Effective set */
1815         capng_clear(CAPNG_EFFECTIVE);
1816 #endif
1817                 if (p == NULL)
1818                         error("%s", pcap_geterr(pd));
1819 #ifdef HAVE_CAPSICUM
1820                 cap_rights_init(&rights, CAP_SEEK, CAP_WRITE);
1821                 if (cap_rights_limit(fileno(pcap_dump_file(p)), &rights) < 0 &&
1822                     errno != ENOSYS) {
1823                         error("unable to limit dump descriptor");
1824                 }
1825 #endif
1826                 if (Cflag != 0 || Gflag != 0) {
1827 #ifdef HAVE_CAPSICUM
1828                         dumpinfo.WFileName = strdup(basename(WFileName));
1829                         dumpinfo.dirfd = open(dirname(WFileName),
1830                             O_DIRECTORY | O_RDONLY);
1831                         if (dumpinfo.dirfd < 0) {
1832                                 error("unable to open directory %s",
1833                                     dirname(WFileName));
1834                         }
1835                         cap_rights_init(&rights, CAP_CREATE, CAP_FCNTL,
1836                             CAP_FTRUNCATE, CAP_LOOKUP, CAP_SEEK, CAP_WRITE);
1837                         if (cap_rights_limit(dumpinfo.dirfd, &rights) < 0 &&
1838                             errno != ENOSYS) {
1839                                 error("unable to limit directory rights");
1840                         }
1841 #else   /* !HAVE_CAPSICUM */
1842                         dumpinfo.WFileName = WFileName;
1843 #endif
1844                         callback = dump_packet_and_trunc;
1845                         dumpinfo.pd = pd;
1846                         dumpinfo.p = p;
1847                         pcap_userdata = (u_char *)&dumpinfo;
1848                 } else {
1849                         callback = dump_packet;
1850                         pcap_userdata = (u_char *)p;
1851                 }
1852 #ifdef HAVE_PCAP_DUMP_FLUSH
1853                 if (Uflag)
1854                         pcap_dump_flush(p);
1855 #endif
1856         } else {
1857                 type = pcap_datalink(pd);
1858                 printinfo = get_print_info(type);
1859                 callback = print_packet;
1860                 pcap_userdata = (u_char *)&printinfo;
1861         }
1862
1863 #ifdef SIGNAL_REQ_INFO
1864         /*
1865          * We can't get statistics when reading from a file rather
1866          * than capturing from a device.
1867          */
1868         if (RFileName == NULL)
1869                 (void)setsignal(SIGNAL_REQ_INFO, requestinfo);
1870 #endif
1871
1872         if (vflag > 0 && WFileName) {
1873                 /*
1874                  * When capturing to a file, "-v" means tcpdump should,
1875                  * every 10 secodns, "v"erbosely report the number of
1876                  * packets captured.
1877                  */
1878 #ifdef USE_WIN32_MM_TIMER
1879                 /* call verbose_stats_dump() each 1000 +/-100msec */
1880                 timer_id = timeSetEvent(1000, 100, verbose_stats_dump, 0, TIME_PERIODIC);
1881                 setvbuf(stderr, NULL, _IONBF, 0);
1882 #elif defined(HAVE_ALARM)
1883                 (void)setsignal(SIGALRM, verbose_stats_dump);
1884                 alarm(1);
1885 #endif
1886         }
1887
1888 #ifndef WIN32
1889         if (RFileName == NULL) {
1890                 /*
1891                  * Live capture (if -V was specified, we set RFileName
1892                  * to a file from the -V file).  Print a message to
1893                  * the standard error on UN*X.
1894                  */
1895                 if (!vflag && !WFileName) {
1896                         (void)fprintf(stderr,
1897                             "%s: verbose output suppressed, use -v or -vv for full protocol decode\n",
1898                             program_name);
1899                 } else
1900                         (void)fprintf(stderr, "%s: ", program_name);
1901                 dlt = pcap_datalink(pd);
1902                 dlt_name = pcap_datalink_val_to_name(dlt);
1903                 if (dlt_name == NULL) {
1904                         (void)fprintf(stderr, "listening on %s, link-type %u, capture size %u bytes\n",
1905                             device, dlt, snaplen);
1906                 } else {
1907                         (void)fprintf(stderr, "listening on %s, link-type %s (%s), capture size %u bytes\n",
1908                             device, dlt_name,
1909                             pcap_datalink_val_to_description(dlt), snaplen);
1910                 }
1911                 (void)fflush(stderr);
1912         }
1913 #endif /* WIN32 */
1914
1915 #ifdef __FreeBSD__
1916         cansandbox = (VFileName == NULL && zflag == NULL);
1917 #ifdef HAVE_CAPSICUM
1918         cansandbox = (cansandbox && (nflag || capdns != NULL));
1919 #else
1920         cansandbox = (cansandbox && nflag);
1921 #endif
1922         if (cansandbox && cap_enter() < 0 && errno != ENOSYS)
1923                 error("unable to enter the capability mode");
1924 #endif  /* __FreeBSD__ */
1925
1926         do {
1927                 status = pcap_loop(pd, cnt, callback, pcap_userdata);
1928                 if (WFileName == NULL) {
1929                         /*
1930                          * We're printing packets.  Flush the printed output,
1931                          * so it doesn't get intermingled with error output.
1932                          */
1933                         if (status == -2) {
1934                                 /*
1935                                  * We got interrupted, so perhaps we didn't
1936                                  * manage to finish a line we were printing.
1937                                  * Print an extra newline, just in case.
1938                                  */
1939                                 putchar('\n');
1940                         }
1941                         (void)fflush(stdout);
1942                 }
1943                 if (status == -2) {
1944                         /*
1945                          * We got interrupted. If we are reading multiple
1946                          * files (via -V) set these so that we stop.
1947                          */
1948                         VFileName = NULL;
1949                         ret = NULL;
1950                 }
1951                 if (status == -1) {
1952                         /*
1953                          * Error.  Report it.
1954                          */
1955                         (void)fprintf(stderr, "%s: pcap_loop: %s\n",
1956                             program_name, pcap_geterr(pd));
1957                 }
1958                 if (RFileName == NULL) {
1959                         /*
1960                          * We're doing a live capture.  Report the capture
1961                          * statistics.
1962                          */
1963                         info(1);
1964                 }
1965                 pcap_close(pd);
1966                 if (VFileName != NULL) {
1967                         ret = get_next_file(VFile, VFileLine);
1968                         if (ret) {
1969                                 RFileName = VFileLine;
1970                                 pd = pcap_open_offline(RFileName, ebuf);
1971                                 if (pd == NULL)
1972                                         error("%s", ebuf);
1973 #ifdef HAVE_CAPSICUM
1974                                 cap_rights_init(&rights, CAP_READ);
1975                                 if (cap_rights_limit(fileno(pcap_file(pd)),
1976                                     &rights) < 0 && errno != ENOSYS) {
1977                                         error("unable to limit pcap descriptor");
1978                                 }
1979 #endif
1980                                 new_dlt = pcap_datalink(pd);
1981                                 if (WFileName && new_dlt != dlt)
1982                                         error("%s: new dlt does not match original", RFileName);
1983                                 printinfo = get_print_info(new_dlt);
1984                                 dlt_name = pcap_datalink_val_to_name(new_dlt);
1985                                 if (dlt_name == NULL) {
1986                                         fprintf(stderr, "reading from file %s, link-type %u\n",
1987                                         RFileName, new_dlt);
1988                                 } else {
1989                                         fprintf(stderr,
1990                                         "reading from file %s, link-type %s (%s)\n",
1991                                         RFileName, dlt_name,
1992                                         pcap_datalink_val_to_description(new_dlt));
1993                                 }
1994                                 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
1995                                         error("%s", pcap_geterr(pd));
1996                                 if (pcap_setfilter(pd, &fcode) < 0)
1997                                         error("%s", pcap_geterr(pd));
1998                         }
1999                 }
2000         }
2001         while (ret != NULL);
2002
2003         free(cmdbuf);
2004         exit(status == -1 ? 1 : 0);
2005 }
2006
2007 /* make a clean exit on interrupts */
2008 static RETSIGTYPE
2009 cleanup(int signo _U_)
2010 {
2011 #ifdef USE_WIN32_MM_TIMER
2012         if (timer_id)
2013                 timeKillEvent(timer_id);
2014         timer_id = 0;
2015 #elif defined(HAVE_ALARM)
2016         alarm(0);
2017 #endif
2018
2019 #ifdef HAVE_PCAP_BREAKLOOP
2020         /*
2021          * We have "pcap_breakloop()"; use it, so that we do as little
2022          * as possible in the signal handler (it's probably not safe
2023          * to do anything with standard I/O streams in a signal handler -
2024          * the ANSI C standard doesn't say it is).
2025          */
2026         pcap_breakloop(pd);
2027 #else
2028         /*
2029          * We don't have "pcap_breakloop()"; this isn't safe, but
2030          * it's the best we can do.  Print the summary if we're
2031          * not reading from a savefile - i.e., if we're doing a
2032          * live capture - and exit.
2033          */
2034         if (pd != NULL && pcap_file(pd) == NULL) {
2035                 /*
2036                  * We got interrupted, so perhaps we didn't
2037                  * manage to finish a line we were printing.
2038                  * Print an extra newline, just in case.
2039                  */
2040                 putchar('\n');
2041                 (void)fflush(stdout);
2042                 info(1);
2043         }
2044         exit(0);
2045 #endif
2046 }
2047
2048 /*
2049   On windows, we do not use a fork, so we do not care less about
2050   waiting a child processes to die
2051  */
2052 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
2053 static RETSIGTYPE
2054 child_cleanup(int signo _U_)
2055 {
2056   wait(NULL);
2057 }
2058 #endif /* HAVE_FORK && HAVE_VFORK */
2059
2060 static void
2061 info(register int verbose)
2062 {
2063         struct pcap_stat stat;
2064
2065         /*
2066          * Older versions of libpcap didn't set ps_ifdrop on some
2067          * platforms; initialize it to 0 to handle that.
2068          */
2069         stat.ps_ifdrop = 0;
2070         if (pcap_stats(pd, &stat) < 0) {
2071                 (void)fprintf(stderr, "pcap_stats: %s\n", pcap_geterr(pd));
2072                 infoprint = 0;
2073                 return;
2074         }
2075
2076         if (!verbose)
2077                 fprintf(stderr, "%s: ", program_name);
2078
2079         (void)fprintf(stderr, "%u packet%s captured", packets_captured,
2080             PLURAL_SUFFIX(packets_captured));
2081         if (!verbose)
2082                 fputs(", ", stderr);
2083         else
2084                 putc('\n', stderr);
2085         (void)fprintf(stderr, "%u packet%s received by filter", stat.ps_recv,
2086             PLURAL_SUFFIX(stat.ps_recv));
2087         if (!verbose)
2088                 fputs(", ", stderr);
2089         else
2090                 putc('\n', stderr);
2091         (void)fprintf(stderr, "%u packet%s dropped by kernel", stat.ps_drop,
2092             PLURAL_SUFFIX(stat.ps_drop));
2093         if (stat.ps_ifdrop != 0) {
2094                 if (!verbose)
2095                         fputs(", ", stderr);
2096                 else
2097                         putc('\n', stderr);
2098                 (void)fprintf(stderr, "%u packet%s dropped by interface\n",
2099                     stat.ps_ifdrop, PLURAL_SUFFIX(stat.ps_ifdrop));
2100         } else
2101                 putc('\n', stderr);
2102         infoprint = 0;
2103 }
2104
2105 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
2106 static void
2107 compress_savefile(const char *filename)
2108 {
2109 # ifdef HAVE_FORK
2110         if (fork())
2111 # else
2112         if (vfork())
2113 # endif
2114                 return;
2115         /*
2116          * Set to lowest priority so that this doesn't disturb the capture
2117          */
2118 #ifdef NZERO
2119         setpriority(PRIO_PROCESS, 0, NZERO - 1);
2120 #else
2121         setpriority(PRIO_PROCESS, 0, 19);
2122 #endif
2123         if (execlp(zflag, zflag, filename, (char *)NULL) == -1)
2124                 fprintf(stderr,
2125                         "compress_savefile:execlp(%s, %s): %s\n",
2126                         zflag,
2127                         filename,
2128                         strerror(errno));
2129 # ifdef HAVE_FORK
2130         exit(1);
2131 # else
2132         _exit(1);
2133 # endif
2134 }
2135 #else  /* HAVE_FORK && HAVE_VFORK */
2136 static void
2137 compress_savefile(const char *filename)
2138 {
2139         fprintf(stderr,
2140                 "compress_savefile failed. Functionality not implemented under your system\n");
2141 }
2142 #endif /* HAVE_FORK && HAVE_VFORK */
2143
2144 static void
2145 dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
2146 {
2147         struct dump_info *dump_info;
2148 #ifdef HAVE_CAPSICUM
2149         cap_rights_t rights;
2150 #endif
2151
2152         ++packets_captured;
2153
2154         ++infodelay;
2155
2156         dump_info = (struct dump_info *)user;
2157
2158         /*
2159          * XXX - this won't force the file to rotate on the specified time
2160          * boundary, but it will rotate on the first packet received after the
2161          * specified Gflag number of seconds. Note: if a Gflag time boundary
2162          * and a Cflag size boundary coincide, the time rotation will occur
2163          * first thereby cancelling the Cflag boundary (since the file should
2164          * be 0).
2165          */
2166         if (Gflag != 0) {
2167                 /* Check if it is time to rotate */
2168                 time_t t;
2169
2170                 /* Get the current time */
2171                 if ((t = time(NULL)) == (time_t)-1) {
2172                         error("dump_and_trunc_packet: can't get current_time: %s",
2173                             pcap_strerror(errno));
2174                 }
2175
2176
2177                 /* If the time is greater than the specified window, rotate */
2178                 if (t - Gflag_time >= Gflag) {
2179 #ifdef HAVE_CAPSICUM
2180                         FILE *fp;
2181                         int fd;
2182 #endif
2183
2184                         /* Update the Gflag_time */
2185                         Gflag_time = t;
2186                         /* Update Gflag_count */
2187                         Gflag_count++;
2188                         /*
2189                          * Close the current file and open a new one.
2190                          */
2191                         pcap_dump_close(dump_info->p);
2192
2193                         /*
2194                          * Compress the file we just closed, if the user asked for it
2195                          */
2196                         if (zflag != NULL)
2197                                 compress_savefile(dump_info->CurrentFileName);
2198
2199                         /*
2200                          * Check to see if we've exceeded the Wflag (when
2201                          * not using Cflag).
2202                          */
2203                         if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) {
2204                                 (void)fprintf(stderr, "Maximum file limit reached: %d\n",
2205                                     Wflag);
2206                                 exit(0);
2207                                 /* NOTREACHED */
2208                         }
2209                         if (dump_info->CurrentFileName != NULL)
2210                                 free(dump_info->CurrentFileName);
2211                         /* Allocate space for max filename + \0. */
2212                         dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1);
2213                         if (dump_info->CurrentFileName == NULL)
2214                                 error("dump_packet_and_trunc: malloc");
2215                         /*
2216                          * Gflag was set otherwise we wouldn't be here. Reset the count
2217                          * so multiple files would end with 1,2,3 in the filename.
2218                          * The counting is handled with the -C flow after this.
2219                          */
2220                         Cflag_count = 0;
2221
2222                         /*
2223                          * This is always the first file in the Cflag
2224                          * rotation: e.g. 0
2225                          * We also don't need numbering if Cflag is not set.
2226                          */
2227                         if (Cflag != 0)
2228                                 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0,
2229                                     WflagChars);
2230                         else
2231                                 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 0);
2232
2233 #ifdef HAVE_CAP_NG_H
2234                         capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
2235                         capng_apply(CAPNG_EFFECTIVE);
2236 #endif /* HAVE_CAP_NG_H */
2237 #ifdef HAVE_CAPSICUM
2238                         fd = openat(dump_info->dirfd,
2239                             dump_info->CurrentFileName,
2240                             O_CREAT | O_WRONLY | O_TRUNC, 0644);
2241                         if (fd < 0) {
2242                                 error("unable to open file %s",
2243                                     dump_info->CurrentFileName);
2244                         }
2245                         fp = fdopen(fd, "w");
2246                         if (fp == NULL) {
2247                                 error("unable to fdopen file %s",
2248                                     dump_info->CurrentFileName);
2249                         }
2250                         dump_info->p = pcap_dump_fopen(dump_info->pd, fp);
2251 #else   /* !HAVE_CAPSICUM */
2252                         dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
2253 #endif
2254 #ifdef HAVE_CAP_NG_H
2255                         capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
2256                         capng_apply(CAPNG_EFFECTIVE);
2257 #endif /* HAVE_CAP_NG_H */
2258                         if (dump_info->p == NULL)
2259                                 error("%s", pcap_geterr(pd));
2260 #ifdef HAVE_CAPSICUM
2261                         cap_rights_init(&rights, CAP_SEEK, CAP_WRITE);
2262                         if (cap_rights_limit(fileno(pcap_dump_file(dump_info->p)),
2263                             &rights) < 0 && errno != ENOSYS) {
2264                                 error("unable to limit dump descriptor");
2265                         }
2266 #endif
2267                 }
2268         }
2269
2270         /*
2271          * XXX - this won't prevent capture files from getting
2272          * larger than Cflag - the last packet written to the
2273          * file could put it over Cflag.
2274          */
2275         if (Cflag != 0 && pcap_dump_ftell(dump_info->p) > Cflag) {
2276 #ifdef HAVE_CAPSICUM
2277                 FILE *fp;
2278                 int fd;
2279 #endif
2280
2281                 /*
2282                  * Close the current file and open a new one.
2283                  */
2284                 pcap_dump_close(dump_info->p);
2285
2286                 /*
2287                  * Compress the file we just closed, if the user asked for it
2288                  */
2289                 if (zflag != NULL)
2290                         compress_savefile(dump_info->CurrentFileName);
2291
2292                 Cflag_count++;
2293                 if (Wflag > 0) {
2294                         if (Cflag_count >= Wflag)
2295                                 Cflag_count = 0;
2296                 }
2297                 if (dump_info->CurrentFileName != NULL)
2298                         free(dump_info->CurrentFileName);
2299                 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1);
2300                 if (dump_info->CurrentFileName == NULL)
2301                         error("dump_packet_and_trunc: malloc");
2302                 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars);
2303 #ifdef HAVE_CAPSICUM
2304                 fd = openat(dump_info->dirfd, dump_info->CurrentFileName,
2305                     O_CREAT | O_WRONLY | O_TRUNC, 0644);
2306                 if (fd < 0) {
2307                         error("unable to open file %s",
2308                             dump_info->CurrentFileName);
2309                 }
2310                 fp = fdopen(fd, "w");
2311                 if (fp == NULL) {
2312                         error("unable to fdopen file %s",
2313                             dump_info->CurrentFileName);
2314                 }
2315                 dump_info->p = pcap_dump_fopen(dump_info->pd, fp);
2316 #else   /* !HAVE_CAPSICUM */
2317                 dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
2318 #endif
2319                 if (dump_info->p == NULL)
2320                         error("%s", pcap_geterr(pd));
2321 #ifdef HAVE_CAPSICUM
2322                 cap_rights_init(&rights, CAP_SEEK, CAP_WRITE);
2323                 if (cap_rights_limit(fileno(pcap_dump_file(dump_info->p)),
2324                     &rights) < 0 && errno != ENOSYS) {
2325                         error("unable to limit dump descriptor");
2326                 }
2327 #endif
2328         }
2329
2330         pcap_dump((u_char *)dump_info->p, h, sp);
2331 #ifdef HAVE_PCAP_DUMP_FLUSH
2332         if (Uflag)
2333                 pcap_dump_flush(dump_info->p);
2334 #endif
2335
2336         --infodelay;
2337         if (infoprint)
2338                 info(0);
2339 }
2340
2341 static void
2342 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
2343 {
2344         ++packets_captured;
2345
2346         ++infodelay;
2347
2348         pcap_dump(user, h, sp);
2349 #ifdef HAVE_PCAP_DUMP_FLUSH
2350         if (Uflag)
2351                 pcap_dump_flush((pcap_dumper_t *)user);
2352 #endif
2353
2354         --infodelay;
2355         if (infoprint)
2356                 info(0);
2357 }
2358
2359 static void
2360 print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
2361 {
2362         struct print_info *print_info;
2363         u_int hdrlen;
2364         netdissect_options *ndo;
2365
2366         ++packets_captured;
2367
2368         ++infodelay;
2369
2370         print_info = (struct print_info *)user;
2371         ndo = print_info->ndo;
2372
2373         if(ndo->ndo_packet_number)
2374                 ND_PRINT((ndo, "%5u  ", packets_captured));
2375
2376         ts_print(ndo, &h->ts);
2377
2378         /*
2379          * Some printers want to check that they're not walking off the
2380          * end of the packet.
2381          * Rather than pass it all the way down, we set this global.
2382          */
2383         ndo->ndo_snapend = sp + h->caplen;
2384
2385         if(print_info->ndo_type) {
2386                 hdrlen = (*print_info->p.ndo_printer)(print_info->ndo, h, sp);
2387         } else {
2388                 hdrlen = (*print_info->p.printer)(h, sp);
2389         }
2390
2391         if (ndo->ndo_Xflag) {
2392                 /*
2393                  * Print the raw packet data in hex and ASCII.
2394                  */
2395                 if (ndo->ndo_Xflag > 1) {
2396                         /*
2397                          * Include the link-layer header.
2398                          */
2399                         hex_and_ascii_print(ndo, "\n\t", sp, h->caplen);
2400                 } else {
2401                         /*
2402                          * Don't include the link-layer header - and if
2403                          * we have nothing past the link-layer header,
2404                          * print nothing.
2405                          */
2406                         if (h->caplen > hdrlen)
2407                                 hex_and_ascii_print(ndo, "\n\t", sp + hdrlen,
2408                                     h->caplen - hdrlen);
2409                 }
2410         } else if (ndo->ndo_xflag) {
2411                 /*
2412                  * Print the raw packet data in hex.
2413                  */
2414                 if (ndo->ndo_xflag > 1) {
2415                         /*
2416                          * Include the link-layer header.
2417                          */
2418                         hex_print(ndo, "\n\t", sp, h->caplen);
2419                 } else {
2420                         /*
2421                          * Don't include the link-layer header - and if
2422                          * we have nothing past the link-layer header,
2423                          * print nothing.
2424                          */
2425                         if (h->caplen > hdrlen)
2426                                 hex_print(ndo, "\n\t", sp + hdrlen,
2427                                           h->caplen - hdrlen);
2428                 }
2429         } else if (ndo->ndo_Aflag) {
2430                 /*
2431                  * Print the raw packet data in ASCII.
2432                  */
2433                 if (ndo->ndo_Aflag > 1) {
2434                         /*
2435                          * Include the link-layer header.
2436                          */
2437                         ascii_print(ndo, sp, h->caplen);
2438                 } else {
2439                         /*
2440                          * Don't include the link-layer header - and if
2441                          * we have nothing past the link-layer header,
2442                          * print nothing.
2443                          */
2444                         if (h->caplen > hdrlen)
2445                                 ascii_print(ndo, sp + hdrlen, h->caplen - hdrlen);
2446                 }
2447         }
2448
2449         putchar('\n');
2450
2451         --infodelay;
2452         if (infoprint)
2453                 info(0);
2454 }
2455
2456 #ifdef WIN32
2457         /*
2458          * XXX - there should really be libpcap calls to get the version
2459          * number as a string (the string would be generated from #defines
2460          * at run time, so that it's not generated from string constants
2461          * in the library, as, on many UNIX systems, those constants would
2462          * be statically linked into the application executable image, and
2463          * would thus reflect the version of libpcap on the system on
2464          * which the application was *linked*, not the system on which it's
2465          * *running*.
2466          *
2467          * That routine should be documented, unlike the "version[]"
2468          * string, so that UNIX vendors providing their own libpcaps
2469          * don't omit it (as a couple of vendors have...).
2470          *
2471          * Packet.dll should perhaps also export a routine to return the
2472          * version number of the Packet.dll code, to supply the
2473          * "Wpcap_version" information on Windows.
2474          */
2475         char WDversion[]="current-git.tcpdump.org";
2476 #if !defined(HAVE_GENERATED_VERSION)
2477         char version[]="current-git.tcpdump.org";
2478 #endif
2479         char pcap_version[]="current-git.tcpdump.org";
2480         char Wpcap_version[]="3.1";
2481 #endif
2482
2483 /*
2484  * By default, print the specified data out in hex and ASCII.
2485  */
2486 static void
2487 ndo_default_print(netdissect_options *ndo, const u_char *bp, u_int length)
2488 {
2489         hex_and_ascii_print(ndo, "\n\t", bp, length); /* pass on lf and identation string */
2490 }
2491
2492 void
2493 default_print(const u_char *bp, u_int length)
2494 {
2495         ndo_default_print(gndo, bp, length);
2496 }
2497
2498 #ifdef SIGNAL_REQ_INFO
2499 RETSIGTYPE requestinfo(int signo _U_)
2500 {
2501         if (infodelay)
2502                 ++infoprint;
2503         else
2504                 info(0);
2505 }
2506 #endif
2507
2508 /*
2509  * Called once each second in verbose mode while dumping to file
2510  */
2511 #ifdef USE_WIN32_MM_TIMER
2512 void CALLBACK verbose_stats_dump (UINT timer_id _U_, UINT msg _U_, DWORD_PTR arg _U_,
2513                                   DWORD_PTR dw1 _U_, DWORD_PTR dw2 _U_)
2514 {
2515         struct pcap_stat stat;
2516
2517         if (infodelay == 0 && pcap_stats(pd, &stat) >= 0)
2518                 fprintf(stderr, "Got %u\r", packets_captured);
2519 }
2520 #elif defined(HAVE_ALARM)
2521 static void verbose_stats_dump(int sig _U_)
2522 {
2523         struct pcap_stat stat;
2524
2525         if (infodelay == 0 && pcap_stats(pd, &stat) >= 0)
2526                 fprintf(stderr, "Got %u\r", packets_captured);
2527         alarm(1);
2528 }
2529 #endif
2530
2531 USES_APPLE_DEPRECATED_API
2532 static void
2533 print_version(void)
2534 {
2535         extern char version[];
2536 #ifndef HAVE_PCAP_LIB_VERSION
2537 #if defined(WIN32) || defined(HAVE_PCAP_VERSION)
2538         extern char pcap_version[];
2539 #else /* defined(WIN32) || defined(HAVE_PCAP_VERSION) */
2540         static char pcap_version[] = "unknown";
2541 #endif /* defined(WIN32) || defined(HAVE_PCAP_VERSION) */
2542 #endif /* HAVE_PCAP_LIB_VERSION */
2543
2544 #ifdef HAVE_PCAP_LIB_VERSION
2545 #ifdef WIN32
2546         (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version);
2547 #else /* WIN32 */
2548         (void)fprintf(stderr, "%s version %s\n", program_name, version);
2549 #endif /* WIN32 */
2550         (void)fprintf(stderr, "%s\n",pcap_lib_version());
2551 #else /* HAVE_PCAP_LIB_VERSION */
2552 #ifdef WIN32
2553         (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version);
2554         (void)fprintf(stderr, "WinPcap version %s, based on libpcap version %s\n",Wpcap_version, pcap_version);
2555 #else /* WIN32 */
2556         (void)fprintf(stderr, "%s version %s\n", program_name, version);
2557         (void)fprintf(stderr, "libpcap version %s\n", pcap_version);
2558 #endif /* WIN32 */
2559 #endif /* HAVE_PCAP_LIB_VERSION */
2560
2561 #if defined(HAVE_LIBCRYPTO) && defined(SSLEAY_VERSION)
2562         (void)fprintf (stderr, "%s\n", SSLeay_version(SSLEAY_VERSION));
2563 #endif
2564
2565 #ifdef USE_LIBSMI
2566         (void)fprintf (stderr, "SMI-library: %s\n", smi_version_string);
2567 #endif
2568 }
2569 USES_APPLE_RST
2570
2571 static void
2572 print_usage(void)
2573 {
2574         print_version();
2575         (void)fprintf(stderr,
2576 "Usage: %s [-aAbd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqRStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ]\n", program_name);
2577         (void)fprintf(stderr,
2578 "\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n");
2579         (void)fprintf(stderr,
2580 "\t\t[ -i interface ]" j_FLAG_USAGE " [ -M secret ] [ --number ]\n");
2581 #ifdef HAVE_PCAP_SETDIRECTION
2582         (void)fprintf(stderr,
2583 "\t\t[ -Q in|out|inout ]\n");
2584 #endif
2585         (void)fprintf(stderr,
2586 "\t\t[ -r file ] [ -s snaplen ] ");
2587 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
2588         (void)fprintf(stderr, "[ --time-stamp-precision precision ]\n");
2589         (void)fprintf(stderr,
2590 "\t\t");
2591 #endif
2592         (void)fprintf(stderr, "[ -T type ] [ --version ] [ -V file ]\n");
2593         (void)fprintf(stderr,
2594 "\t\t[ -w file ] [ -W filecount ] [ -y datalinktype ] [ -z command ]\n");
2595         (void)fprintf(stderr,
2596 "\t\t[ -Z user ] [ expression ]\n");
2597 }
2598
2599
2600
2601 /* VARARGS */
2602 static void
2603 ndo_error(netdissect_options *ndo _U_, const char *fmt, ...)
2604 {
2605         va_list ap;
2606
2607         (void)fprintf(stderr, "%s: ", program_name);
2608         va_start(ap, fmt);
2609         (void)vfprintf(stderr, fmt, ap);
2610         va_end(ap);
2611         if (*fmt) {
2612                 fmt += strlen(fmt);
2613                 if (fmt[-1] != '\n')
2614                         (void)fputc('\n', stderr);
2615         }
2616         exit(1);
2617         /* NOTREACHED */
2618 }
2619
2620 /* VARARGS */
2621 static void
2622 ndo_warning(netdissect_options *ndo _U_, const char *fmt, ...)
2623 {
2624         va_list ap;
2625
2626         (void)fprintf(stderr, "%s: WARNING: ", program_name);
2627         va_start(ap, fmt);
2628         (void)vfprintf(stderr, fmt, ap);
2629         va_end(ap);
2630         if (*fmt) {
2631                 fmt += strlen(fmt);
2632                 if (fmt[-1] != '\n')
2633                         (void)fputc('\n', stderr);
2634         }
2635 }
2636 /*
2637  * Local Variables:
2638  * c-style: whitesmith
2639  * c-basic-offset: 8
2640  * End:
2641  */