2 * Routines for capture options setting
4 * Wireshark - Network traffic analyzer
5 * By Gerald Combs <gerald@wireshark.org>
6 * Copyright 1998 Gerald Combs
8 * SPDX-License-Identifier: GPL-2.0-or-later
13 #include <wireshark.h>
18 #include <sys/types.h>
26 #include <ws_exit_codes.h>
28 #include "capture_opts.h"
29 #include "ringbuffer.h"
31 #include <wsutil/clopts_common.h>
32 #include <wsutil/cmdarg_err.h>
33 #include <wsutil/file_util.h>
34 #include <wsutil/ws_pipe.h>
35 #include <wsutil/ws_assert.h>
38 #include <wsutil/win32-utils.h>
41 #include "capture/capture_ifinfo.h"
42 #include "capture/capture-pcap-util.h"
44 static gboolean
capture_opts_output_to_pipe(const char *save_file
, gboolean
*is_pipe
);
48 capture_opts_init(capture_options
*capture_opts
, GList
*(*get_iface_list
)(int *, gchar
**))
50 capture_opts
->get_iface_list
= get_iface_list
;
51 capture_opts
->ifaces
= g_array_new(FALSE
, FALSE
, sizeof(interface_options
));
52 capture_opts
->all_ifaces
= g_array_new(FALSE
, FALSE
, sizeof(interface_t
));
53 capture_opts
->num_selected
= 0;
54 capture_opts
->default_options
.name
= NULL
;
55 capture_opts
->default_options
.descr
= NULL
;
56 capture_opts
->default_options
.ifname
= NULL
;
57 capture_opts
->default_options
.hardware
= NULL
;
58 capture_opts
->default_options
.display_name
= NULL
;
59 capture_opts
->default_options
.cfilter
= NULL
;
60 capture_opts
->default_options
.has_snaplen
= FALSE
;
61 capture_opts
->default_options
.snaplen
= WTAP_MAX_PACKET_SIZE_STANDARD
;
62 capture_opts
->default_options
.linktype
= -1; /* use interface default */
63 capture_opts
->default_options
.promisc_mode
= TRUE
;
64 capture_opts
->default_options
.if_type
= IF_WIRED
;
65 capture_opts
->default_options
.extcap
= NULL
;
66 capture_opts
->default_options
.extcap_fifo
= NULL
;
67 capture_opts
->default_options
.extcap_args
= NULL
;
68 capture_opts
->default_options
.extcap_pid
= WS_INVALID_PID
;
69 capture_opts
->default_options
.extcap_pipedata
= NULL
;
70 capture_opts
->default_options
.extcap_stderr
= NULL
;
71 capture_opts
->default_options
.extcap_stdout_watch
= 0;
72 capture_opts
->default_options
.extcap_stderr_watch
= 0;
74 capture_opts
->default_options
.extcap_pipe_h
= INVALID_HANDLE_VALUE
;
75 capture_opts
->default_options
.extcap_control_in_h
= INVALID_HANDLE_VALUE
;
76 capture_opts
->default_options
.extcap_control_out_h
= INVALID_HANDLE_VALUE
;
78 capture_opts
->default_options
.extcap_control_in
= NULL
;
79 capture_opts
->default_options
.extcap_control_out
= NULL
;
80 #ifdef CAN_SET_CAPTURE_BUFFER_SIZE
81 capture_opts
->default_options
.buffer_size
= DEFAULT_CAPTURE_BUFFER_SIZE
;
83 capture_opts
->default_options
.monitor_mode
= FALSE
;
84 #ifdef HAVE_PCAP_REMOTE
85 capture_opts
->default_options
.src_type
= CAPTURE_IFLOCAL
;
86 capture_opts
->default_options
.remote_host
= NULL
;
87 capture_opts
->default_options
.remote_port
= NULL
;
88 capture_opts
->default_options
.auth_type
= CAPTURE_AUTH_NULL
;
89 capture_opts
->default_options
.auth_username
= NULL
;
90 capture_opts
->default_options
.auth_password
= NULL
;
91 capture_opts
->default_options
.datatx_udp
= FALSE
;
92 capture_opts
->default_options
.nocap_rpcap
= TRUE
;
93 capture_opts
->default_options
.nocap_local
= FALSE
;
95 #ifdef HAVE_PCAP_SETSAMPLING
96 capture_opts
->default_options
.sampling_method
= CAPTURE_SAMP_NONE
;
97 capture_opts
->default_options
.sampling_param
= 0;
99 capture_opts
->default_options
.timestamp_type
= NULL
;
100 capture_opts
->saving_to_file
= FALSE
;
101 capture_opts
->save_file
= NULL
;
102 capture_opts
->group_read_access
= FALSE
;
103 capture_opts
->use_pcapng
= TRUE
; /* Save as pcapng by default */
104 capture_opts
->update_interval
= DEFAULT_UPDATE_INTERVAL
; /* 100 ms */
105 capture_opts
->real_time_mode
= TRUE
;
106 capture_opts
->show_info
= TRUE
;
107 capture_opts
->restart
= FALSE
;
108 capture_opts
->orig_save_file
= NULL
;
110 capture_opts
->multi_files_on
= FALSE
;
111 capture_opts
->has_file_duration
= FALSE
;
112 capture_opts
->file_duration
= 60.0; /* 1 min */
113 capture_opts
->has_file_interval
= FALSE
;
114 capture_opts
->has_nametimenum
= FALSE
;
115 capture_opts
->file_interval
= 60; /* 1 min */
116 capture_opts
->has_file_packets
= FALSE
;
117 capture_opts
->file_packets
= 0;
118 capture_opts
->has_ring_num_files
= FALSE
;
119 capture_opts
->ring_num_files
= RINGBUFFER_MIN_NUM_FILES
;
121 capture_opts
->has_autostop_files
= FALSE
;
122 capture_opts
->autostop_files
= 1;
123 capture_opts
->has_autostop_packets
= FALSE
;
124 capture_opts
->autostop_packets
= 0;
125 capture_opts
->has_autostop_written_packets
= FALSE
;
126 capture_opts
->autostop_written_packets
= 0;
127 capture_opts
->has_autostop_filesize
= FALSE
;
128 capture_opts
->autostop_filesize
= 1000; /* 1 MB */
129 capture_opts
->has_autostop_duration
= FALSE
;
130 capture_opts
->autostop_duration
= 60.0; /* 1 min */
132 capture_opts
->output_to_pipe
= FALSE
;
133 capture_opts
->capture_child
= FALSE
;
134 capture_opts
->stop_after_extcaps
= FALSE
;
135 capture_opts
->wait_for_extcap_cbs
= FALSE
;
136 capture_opts
->print_file_names
= FALSE
;
137 capture_opts
->print_name_to
= NULL
;
138 capture_opts
->temp_dir
= NULL
;
139 capture_opts
->compress_type
= NULL
;
140 capture_opts
->closed_msg
= NULL
;
141 capture_opts
->extcap_terminate_id
= 0;
142 capture_opts
->capture_filters_list
= NULL
;
146 capture_opts_cleanup(capture_options
*capture_opts
)
151 if (capture_opts
->ifaces
) {
152 while (capture_opts
->ifaces
->len
> 0) {
153 capture_opts_del_iface(capture_opts
, 0);
155 g_array_free(capture_opts
->ifaces
, TRUE
);
156 capture_opts
->ifaces
= NULL
;
158 if (capture_opts
->all_ifaces
) {
159 while (capture_opts
->all_ifaces
->len
> 0) {
160 interface_t
*device
= &g_array_index(capture_opts
->all_ifaces
, interface_t
, 0);
161 capture_opts_free_interface_t(device
);
162 capture_opts
->all_ifaces
= g_array_remove_index(capture_opts
->all_ifaces
, 0);
164 g_array_free(capture_opts
->all_ifaces
, TRUE
);
165 capture_opts
->all_ifaces
= NULL
;
167 g_free(capture_opts
->save_file
);
168 g_free(capture_opts
->temp_dir
);
170 if (capture_opts
->closed_msg
) {
171 g_free(capture_opts
->closed_msg
);
172 capture_opts
->closed_msg
= NULL
;
174 if (capture_opts
->extcap_terminate_id
> 0) {
175 g_source_remove(capture_opts
->extcap_terminate_id
);
176 capture_opts
->extcap_terminate_id
= 0;
179 if (capture_opts
->capture_filters_list
) {
180 ws_filter_list_free(capture_opts
->capture_filters_list
);
181 capture_opts
->capture_filters_list
= NULL
;
185 /* log content of capture_opts */
187 capture_opts_log(const char *log_domain
, enum ws_log_level log_level
, capture_options
*capture_opts
) {
190 ws_log(log_domain
, log_level
, "CAPTURE OPTIONS :");
192 for (i
= 0; i
< capture_opts
->ifaces
->len
; i
++) {
193 interface_options
*interface_opts
;
195 interface_opts
= &g_array_index(capture_opts
->ifaces
, interface_options
, i
);
196 ws_log(log_domain
, log_level
, "Interface name[%02d] : %s", i
, interface_opts
->name
? interface_opts
->name
: "(unspecified)");
197 ws_log(log_domain
, log_level
, "Interface description[%02d] : %s", i
, interface_opts
->descr
? interface_opts
->descr
: "(unspecified)");
198 ws_log(log_domain
, log_level
, "Interface vendor description[%02d] : %s", i
, interface_opts
->hardware
? interface_opts
->hardware
: "(unspecified)");
199 ws_log(log_domain
, log_level
, "Display name[%02d]: %s", i
, interface_opts
->display_name
? interface_opts
->display_name
: "(unspecified)");
200 ws_log(log_domain
, log_level
, "Capture filter[%02d] : %s", i
, interface_opts
->cfilter
? interface_opts
->cfilter
: "(unspecified)");
201 ws_log(log_domain
, log_level
, "Snap length[%02d] (%u) : %d", i
, interface_opts
->has_snaplen
, interface_opts
->snaplen
);
202 ws_log(log_domain
, log_level
, "Link Type[%02d] : %d", i
, interface_opts
->linktype
);
203 ws_log(log_domain
, log_level
, "Promiscuous Mode[%02d]: %s", i
, interface_opts
->promisc_mode
?"TRUE":"FALSE");
204 ws_log(log_domain
, log_level
, "Extcap[%02d] : %s", i
, interface_opts
->extcap
? interface_opts
->extcap
: "(unspecified)");
205 ws_log(log_domain
, log_level
, "Extcap FIFO[%02d] : %s", i
, interface_opts
->extcap_fifo
? interface_opts
->extcap_fifo
: "(unspecified)");
206 ws_log(log_domain
, log_level
, "Extcap PID[%02d] : %"PRIdMAX
, i
, (intmax_t)interface_opts
->extcap_pid
);
207 #ifdef CAN_SET_CAPTURE_BUFFER_SIZE
208 ws_log(log_domain
, log_level
, "Buffer size[%02d] : %d (MB)", i
, interface_opts
->buffer_size
);
210 ws_log(log_domain
, log_level
, "Monitor Mode[%02d] : %s", i
, interface_opts
->monitor_mode
?"TRUE":"FALSE");
211 #ifdef HAVE_PCAP_REMOTE
212 ws_log(log_domain
, log_level
, "Capture source[%02d] : %s", i
,
213 interface_opts
->src_type
== CAPTURE_IFLOCAL
? "Local interface" :
214 interface_opts
->src_type
== CAPTURE_IFREMOTE
? "Remote interface" :
216 if (interface_opts
->src_type
== CAPTURE_IFREMOTE
) {
217 ws_log(log_domain
, log_level
, "Remote host[%02d] : %s", i
, interface_opts
->remote_host
? interface_opts
->remote_host
: "(unspecified)");
218 ws_log(log_domain
, log_level
, "Remote port[%02d] : %s", i
, interface_opts
->remote_port
? interface_opts
->remote_port
: "(unspecified)");
220 ws_log(log_domain
, log_level
, "Authentication[%02d] : %s", i
,
221 interface_opts
->auth_type
== CAPTURE_AUTH_NULL
? "Null" :
222 interface_opts
->auth_type
== CAPTURE_AUTH_PWD
? "By username/password" :
224 if (interface_opts
->auth_type
== CAPTURE_AUTH_PWD
) {
225 ws_log(log_domain
, log_level
, "Auth username[%02d] : %s", i
, interface_opts
->auth_username
? interface_opts
->auth_username
: "(unspecified)");
226 ws_log(log_domain
, log_level
, "Auth password[%02d] : <hidden>", i
);
228 ws_log(log_domain
, log_level
, "UDP data tfer[%02d] : %u", i
, interface_opts
->datatx_udp
);
229 ws_log(log_domain
, log_level
, "No cap. RPCAP[%02d] : %u", i
, interface_opts
->nocap_rpcap
);
230 ws_log(log_domain
, log_level
, "No cap. local[%02d] : %u", i
, interface_opts
->nocap_local
);
232 #ifdef HAVE_PCAP_SETSAMPLING
233 ws_log(log_domain
, log_level
, "Sampling meth.[%02d] : %d", i
, interface_opts
->sampling_method
);
234 ws_log(log_domain
, log_level
, "Sampling param.[%02d] : %d", i
, interface_opts
->sampling_param
);
236 ws_log(log_domain
, log_level
, "Timestamp type [%02d] : %s", i
, interface_opts
->timestamp_type
);
238 ws_log(log_domain
, log_level
, "Interface name[df] : %s", capture_opts
->default_options
.name
? capture_opts
->default_options
.name
: "(unspecified)");
239 ws_log(log_domain
, log_level
, "Interface Descr[df] : %s", capture_opts
->default_options
.descr
? capture_opts
->default_options
.descr
: "(unspecified)");
240 ws_log(log_domain
, log_level
, "Interface Hardware Descr[df] : %s", capture_opts
->default_options
.hardware
? capture_opts
->default_options
.hardware
: "(unspecified)");
241 ws_log(log_domain
, log_level
, "Interface display name[df] : %s", capture_opts
->default_options
.display_name
? capture_opts
->default_options
.display_name
: "(unspecified)");
242 ws_log(log_domain
, log_level
, "Capture filter[df] : %s", capture_opts
->default_options
.cfilter
? capture_opts
->default_options
.cfilter
: "(unspecified)");
243 ws_log(log_domain
, log_level
, "Snap length[df] (%u) : %d", capture_opts
->default_options
.has_snaplen
, capture_opts
->default_options
.snaplen
);
244 ws_log(log_domain
, log_level
, "Link Type[df] : %d", capture_opts
->default_options
.linktype
);
245 ws_log(log_domain
, log_level
, "Promiscuous Mode[df]: %s", capture_opts
->default_options
.promisc_mode
?"TRUE":"FALSE");
246 ws_log(log_domain
, log_level
, "Extcap[df] : %s", capture_opts
->default_options
.extcap
? capture_opts
->default_options
.extcap
: "(unspecified)");
247 ws_log(log_domain
, log_level
, "Extcap FIFO[df] : %s", capture_opts
->default_options
.extcap_fifo
? capture_opts
->default_options
.extcap_fifo
: "(unspecified)");
248 #ifdef CAN_SET_CAPTURE_BUFFER_SIZE
249 ws_log(log_domain
, log_level
, "Buffer size[df] : %d (MB)", capture_opts
->default_options
.buffer_size
);
251 ws_log(log_domain
, log_level
, "Monitor Mode[df] : %s", capture_opts
->default_options
.monitor_mode
?"TRUE":"FALSE");
252 #ifdef HAVE_PCAP_REMOTE
253 ws_log(log_domain
, log_level
, "Capture source[df] : %s",
254 capture_opts
->default_options
.src_type
== CAPTURE_IFLOCAL
? "Local interface" :
255 capture_opts
->default_options
.src_type
== CAPTURE_IFREMOTE
? "Remote interface" :
257 if (capture_opts
->default_options
.src_type
== CAPTURE_IFREMOTE
) {
258 ws_log(log_domain
, log_level
, "Remote host[df] : %s", capture_opts
->default_options
.remote_host
? capture_opts
->default_options
.remote_host
: "(unspecified)");
259 ws_log(log_domain
, log_level
, "Remote port[df] : %s", capture_opts
->default_options
.remote_port
? capture_opts
->default_options
.remote_port
: "(unspecified)");
261 ws_log(log_domain
, log_level
, "Authentication[df] : %s",
262 capture_opts
->default_options
.auth_type
== CAPTURE_AUTH_NULL
? "Null" :
263 capture_opts
->default_options
.auth_type
== CAPTURE_AUTH_PWD
? "By username/password" :
265 if (capture_opts
->default_options
.auth_type
== CAPTURE_AUTH_PWD
) {
266 ws_log(log_domain
, log_level
, "Auth username[df] : %s", capture_opts
->default_options
.auth_username
? capture_opts
->default_options
.auth_username
: "(unspecified)");
267 ws_log(log_domain
, log_level
, "Auth password[df] : <hidden>");
269 ws_log(log_domain
, log_level
, "UDP data tfer[df] : %u", capture_opts
->default_options
.datatx_udp
);
270 ws_log(log_domain
, log_level
, "No cap. RPCAP[df] : %u", capture_opts
->default_options
.nocap_rpcap
);
271 ws_log(log_domain
, log_level
, "No cap. local[df] : %u", capture_opts
->default_options
.nocap_local
);
273 #ifdef HAVE_PCAP_SETSAMPLING
274 ws_log(log_domain
, log_level
, "Sampling meth. [df] : %d", capture_opts
->default_options
.sampling_method
);
275 ws_log(log_domain
, log_level
, "Sampling param.[df] : %d", capture_opts
->default_options
.sampling_param
);
277 ws_log(log_domain
, log_level
, "Timestamp type [df] : %s", capture_opts
->default_options
.timestamp_type
? capture_opts
->default_options
.timestamp_type
: "(unspecified)");
278 ws_log(log_domain
, log_level
, "SavingToFile : %u", capture_opts
->saving_to_file
);
279 ws_log(log_domain
, log_level
, "SaveFile : %s", (capture_opts
->save_file
) ? capture_opts
->save_file
: "");
280 ws_log(log_domain
, log_level
, "GroupReadAccess : %u", capture_opts
->group_read_access
);
281 ws_log(log_domain
, log_level
, "Fileformat : %s", (capture_opts
->use_pcapng
) ? "PCAPNG" : "PCAP");
282 ws_log(log_domain
, log_level
, "UpdateInterval : %u (ms)", capture_opts
->update_interval
);
283 ws_log(log_domain
, log_level
, "RealTimeMode : %u", capture_opts
->real_time_mode
);
284 ws_log(log_domain
, log_level
, "ShowInfo : %u", capture_opts
->show_info
);
286 ws_log(log_domain
, log_level
, "MultiFilesOn : %u", capture_opts
->multi_files_on
);
287 ws_log(log_domain
, log_level
, "FileDuration (%u) : %.3f", capture_opts
->has_file_duration
, capture_opts
->file_duration
);
288 ws_log(log_domain
, log_level
, "FileInterval (%u) : %u", capture_opts
->has_file_interval
, capture_opts
->file_interval
);
289 ws_log(log_domain
, log_level
, "FilePackets (%u) : %u", capture_opts
->has_file_packets
, capture_opts
->file_packets
);
290 ws_log(log_domain
, log_level
, "FileNameType : %s", (capture_opts
->has_nametimenum
) ? "prefix_time_num.suffix" : "prefix_num_time.suffix");
291 ws_log(log_domain
, log_level
, "RingNumFiles (%u) : %u", capture_opts
->has_ring_num_files
, capture_opts
->ring_num_files
);
292 ws_log(log_domain
, log_level
, "RingPrintFiles (%u) : %s", capture_opts
->print_file_names
, (capture_opts
->print_file_names
? capture_opts
->print_name_to
: ""));
294 ws_log(log_domain
, log_level
, "AutostopFiles (%u) : %u", capture_opts
->has_autostop_files
, capture_opts
->autostop_files
);
295 ws_log(log_domain
, log_level
, "AutostopPackets (%u) : %u", capture_opts
->has_autostop_packets
, capture_opts
->autostop_packets
);
296 ws_log(log_domain
, log_level
, "AutostopWrittenPackets (%u) : %u", capture_opts
->has_autostop_written_packets
, capture_opts
->autostop_written_packets
);
297 ws_log(log_domain
, log_level
, "AutostopFilesize(%u) : %u (KB)", capture_opts
->has_autostop_filesize
, capture_opts
->autostop_filesize
);
298 ws_log(log_domain
, log_level
, "AutostopDuration(%u) : %.3f", capture_opts
->has_autostop_duration
, capture_opts
->autostop_duration
);
299 ws_log(log_domain
, log_level
, "Temporary Directory : %s", capture_opts
->temp_dir
&& capture_opts
->temp_dir
[0] ? capture_opts
->temp_dir
: g_get_tmp_dir());
303 * Given a string of the form "<autostop criterion>:<value>", as might appear
304 * as an argument to a "-a" option, parse it and set the criterion in
305 * question. Return an indication of whether it succeeded or failed
309 set_autostop_criterion(capture_options
*capture_opts
, const char *autostoparg
)
313 colonp
= strchr(autostoparg
, ':');
321 * Skip over any white space (there probably won't be any, but
322 * as we allow it in the preferences file, we might as well
325 while (g_ascii_isspace(*p
))
329 * Put the colon back, so if our caller uses, in an
330 * error message, the string they passed us, the message
336 if (strcmp(autostoparg
,"duration") == 0) {
337 capture_opts
->has_autostop_duration
= TRUE
;
338 capture_opts
->autostop_duration
= get_positive_double(p
,"autostop duration");
339 } else if (strcmp(autostoparg
,"filesize") == 0) {
340 capture_opts
->has_autostop_filesize
= TRUE
;
341 capture_opts
->autostop_filesize
= get_nonzero_guint32(p
,"autostop filesize");
342 } else if (strcmp(autostoparg
,"files") == 0) {
343 capture_opts
->multi_files_on
= TRUE
;
344 capture_opts
->has_autostop_files
= TRUE
;
345 capture_opts
->autostop_files
= get_positive_int(p
,"autostop files");
346 } else if (strcmp(autostoparg
,"packets") == 0) {
347 capture_opts
->has_autostop_written_packets
= TRUE
;
348 capture_opts
->autostop_written_packets
= get_positive_int(p
,"packet write count");
352 *colonp
= ':'; /* put the colon back */
356 static gboolean
get_filter_arguments(capture_options
* capture_opts
, const char* arg
)
360 char* filter_exp
= NULL
;
362 colonp
= strchr(arg
, ':');
367 if (strcmp(arg
, "predef") == 0) {
370 filterItem
= capture_opts
->capture_filters_list
->list
;
371 while (filterItem
!= NULL
) {
372 filter_def
*filterDef
;
374 filterDef
= (filter_def
*)filterItem
->data
;
375 if (g_ascii_strcasecmp(val
, filterDef
->name
) == 0) {
376 filter_exp
= g_strdup(filterDef
->strval
);
379 filterItem
= filterItem
->next
;
384 if (filter_exp
== NULL
) {
385 /* No filter expression found yet; fallback to previous implementation
386 and assume the arg contains a filter expression */
388 *colonp
= ':'; /* restore colon */
390 filter_exp
= g_strdup(arg
);
393 if (capture_opts
->ifaces
->len
> 0) {
394 interface_options
*interface_opts
;
396 interface_opts
= &g_array_index(capture_opts
->ifaces
, interface_options
, capture_opts
->ifaces
->len
- 1);
397 g_free(interface_opts
->cfilter
);
398 interface_opts
->cfilter
= filter_exp
;
402 g_free(capture_opts
->default_options
.cfilter
);
403 capture_opts
->default_options
.cfilter
= filter_exp
;
409 * Given a string of the form "<ring buffer file>:<duration>", as might appear
410 * as an argument to a "-b" option, parse it and set the arguments in
411 * question. Return an indication of whether it succeeded or failed
415 get_ring_arguments(capture_options
*capture_opts
, const char *arg
)
417 gchar
*p
= NULL
, *colonp
;
419 colonp
= strchr(arg
, ':');
427 * Skip over any white space (there probably won't be any, but
428 * as we allow it in the preferences file, we might as well
431 while (g_ascii_isspace(*p
))
435 * Put the colon back, so if our caller uses, in an
436 * error message, the string they passed us, the message
443 if (strcmp(arg
,"files") == 0) {
444 capture_opts
->has_ring_num_files
= TRUE
;
445 capture_opts
->ring_num_files
= get_nonzero_guint32(p
, "number of ring buffer files");
446 } else if (strcmp(arg
,"filesize") == 0) {
447 capture_opts
->has_autostop_filesize
= TRUE
;
448 capture_opts
->autostop_filesize
= get_nonzero_guint32(p
, "ring buffer filesize");
449 } else if (strcmp(arg
,"duration") == 0) {
450 capture_opts
->has_file_duration
= TRUE
;
451 capture_opts
->file_duration
= get_positive_double(p
, "ring buffer duration");
452 } else if (strcmp(arg
,"interval") == 0) {
453 capture_opts
->has_file_interval
= TRUE
;
454 capture_opts
->file_interval
= get_positive_int(p
, "ring buffer interval");
455 } else if (strcmp(arg
,"nametimenum") == 0) {
456 int val
= get_positive_int(p
, "file name: time before num");
457 capture_opts
->has_nametimenum
= (val
> 1);
458 } else if (strcmp(arg
,"packets") == 0) {
459 capture_opts
->has_file_packets
= TRUE
;
460 capture_opts
->file_packets
= get_positive_int(p
, "ring buffer packet count");
461 } else if (strcmp(arg
,"printname") == 0) {
462 capture_opts
->print_file_names
= TRUE
;
463 capture_opts
->print_name_to
= g_strdup(p
);
468 *colonp
= ':'; /* put the colon back */
472 #ifdef HAVE_PCAP_SETSAMPLING
474 * Given a string of the form "<sampling type>:<value>", as might appear
475 * as an argument to a "-m" option, parse it and set the arguments in
476 * question. Return an indication of whether it succeeded or failed
480 get_sampling_arguments(capture_options
*capture_opts
, const char *arg
)
482 gchar
*p
= NULL
, *colonp
;
484 colonp
= strchr(arg
, ':');
491 while (g_ascii_isspace(*p
))
498 if (strcmp(arg
, "count") == 0) {
499 if (capture_opts
->ifaces
->len
> 0) {
500 interface_options
*interface_opts
;
502 interface_opts
= &g_array_index(capture_opts
->ifaces
, interface_options
, capture_opts
->ifaces
->len
- 1);
503 interface_opts
->sampling_method
= CAPTURE_SAMP_BY_COUNT
;
504 interface_opts
->sampling_param
= get_positive_int(p
, "sampling count");
506 capture_opts
->default_options
.sampling_method
= CAPTURE_SAMP_BY_COUNT
;
507 capture_opts
->default_options
.sampling_param
= get_positive_int(p
, "sampling count");
509 } else if (strcmp(arg
, "timer") == 0) {
510 if (capture_opts
->ifaces
->len
> 0) {
511 interface_options
*interface_opts
;
513 interface_opts
= &g_array_index(capture_opts
->ifaces
, interface_options
, capture_opts
->ifaces
->len
- 1);
514 interface_opts
->sampling_method
= CAPTURE_SAMP_BY_TIMER
;
515 interface_opts
->sampling_param
= get_positive_int(p
, "sampling timer");
517 capture_opts
->default_options
.sampling_method
= CAPTURE_SAMP_BY_TIMER
;
518 capture_opts
->default_options
.sampling_param
= get_positive_int(p
, "sampling timer");
526 #ifdef HAVE_PCAP_REMOTE
528 * Given a string of the form "<username>:<password>", as might appear
529 * as an argument to a "-A" option, parse it and set the arguments in
530 * question. Return an indication of whether it succeeded or failed
534 get_auth_arguments(capture_options
*capture_opts
, const char *arg
)
536 gchar
*p
= NULL
, *colonp
;
538 colonp
= strchr(arg
, ':');
545 while (g_ascii_isspace(*p
))
548 if (capture_opts
->ifaces
->len
> 0) {
549 interface_options
*interface_opts
;
551 interface_opts
= &g_array_index(capture_opts
->ifaces
, interface_options
, capture_opts
->ifaces
->len
- 1);
552 interface_opts
->auth_type
= CAPTURE_AUTH_PWD
;
553 interface_opts
->auth_username
= g_strdup(arg
);
554 interface_opts
->auth_password
= g_strdup(p
);
556 capture_opts
->default_options
.auth_type
= CAPTURE_AUTH_PWD
;
557 capture_opts
->default_options
.auth_username
= g_strdup(arg
);
558 capture_opts
->default_options
.auth_password
= g_strdup(p
);
567 capture_opts_generate_display_name(const char *friendly_name
,
568 const char *name _U_
)
571 * Display the friendly name rather than the not-so-friendly
572 * GUID-based interface name.
574 return g_strdup(friendly_name
);
578 capture_opts_generate_display_name(const char *friendly_name
,
582 * On UN*X, however, users are more used to interface names,
583 * and may find it helpful to see them.
585 return ws_strdup_printf("%s: %s", friendly_name
, name
);
590 fill_in_interface_opts_defaults(interface_options
*interface_opts
, const capture_options
*capture_opts
)
593 interface_opts
->cfilter
= g_strdup(capture_opts
->default_options
.cfilter
);
594 interface_opts
->snaplen
= capture_opts
->default_options
.snaplen
;
595 interface_opts
->has_snaplen
= capture_opts
->default_options
.has_snaplen
;
596 interface_opts
->linktype
= capture_opts
->default_options
.linktype
;
597 interface_opts
->promisc_mode
= capture_opts
->default_options
.promisc_mode
;
598 interface_opts
->extcap_fifo
= g_strdup(capture_opts
->default_options
.extcap_fifo
);
599 interface_opts
->extcap_args
= NULL
;
600 interface_opts
->extcap_pid
= WS_INVALID_PID
;
601 interface_opts
->extcap_pipedata
= NULL
;
602 interface_opts
->extcap_stderr
= NULL
;
603 interface_opts
->extcap_stdout_watch
= 0;
604 interface_opts
->extcap_stderr_watch
= 0;
606 interface_opts
->extcap_pipe_h
= INVALID_HANDLE_VALUE
;
607 interface_opts
->extcap_control_in_h
= INVALID_HANDLE_VALUE
;
608 interface_opts
->extcap_control_out_h
= INVALID_HANDLE_VALUE
;
610 interface_opts
->extcap_control_in
= g_strdup(capture_opts
->default_options
.extcap_control_in
);
611 interface_opts
->extcap_control_out
= g_strdup(capture_opts
->default_options
.extcap_control_out
);
612 #ifdef CAN_SET_CAPTURE_BUFFER_SIZE
613 interface_opts
->buffer_size
= capture_opts
->default_options
.buffer_size
;
615 interface_opts
->monitor_mode
= capture_opts
->default_options
.monitor_mode
;
616 #ifdef HAVE_PCAP_REMOTE
617 interface_opts
->src_type
= capture_opts
->default_options
.src_type
;
618 interface_opts
->remote_host
= g_strdup(capture_opts
->default_options
.remote_host
);
619 interface_opts
->remote_port
= g_strdup(capture_opts
->default_options
.remote_port
);
620 interface_opts
->auth_type
= capture_opts
->default_options
.auth_type
;
621 interface_opts
->auth_username
= g_strdup(capture_opts
->default_options
.auth_username
);
622 interface_opts
->auth_password
= g_strdup(capture_opts
->default_options
.auth_password
);
623 interface_opts
->datatx_udp
= capture_opts
->default_options
.datatx_udp
;
624 interface_opts
->nocap_rpcap
= capture_opts
->default_options
.nocap_rpcap
;
625 interface_opts
->nocap_local
= capture_opts
->default_options
.nocap_local
;
627 #ifdef HAVE_PCAP_SETSAMPLING
628 interface_opts
->sampling_method
= capture_opts
->default_options
.sampling_method
;
629 interface_opts
->sampling_param
= capture_opts
->default_options
.sampling_param
;
631 interface_opts
->timestamp_type
= capture_opts
->default_options
.timestamp_type
;
635 fill_in_interface_opts_from_ifinfo(interface_options
*interface_opts
,
636 const if_info_t
*if_info
)
638 interface_opts
->name
= g_strdup(if_info
->name
);
640 interface_opts
->hardware
= g_strdup(if_info
->vendor_description
);
641 /* XXX: ui/capture_ui_utils.c get_interface_descriptive_name()
642 * does several things different in setting descr (and thus
644 * 1. It checks for a user-supplied description via
645 * capture_dev_user_descr_find(if_info->name), including a
646 * long-standing -X option of "stdin_descr" that dates back to 1.0
647 * 2. If we don't have a friendly name, but do have a vendor
648 * description (set to hardware above), that is used as the
651 * Perhaps we don't want to introduce a dependency on the prefs
652 * and ex-opts here. We could do 2 here, though.
654 * Because we always set interface_opts->display_name here, it is
655 * never NULL when get_iface_list_string is called, so that never
656 * calls get_interface_descriptive_name(). (And thus, we never
657 * actually use the vendor description in the display name/descr
660 if (if_info
->friendly_name
!= NULL
) {
662 * We have a friendly name; remember it as the
665 interface_opts
->descr
= g_strdup(if_info
->friendly_name
);
667 * ...and use it in the console display name.
669 interface_opts
->display_name
= capture_opts_generate_display_name(if_info
->friendly_name
, if_info
->name
);
671 /* fallback to the interface name */
672 interface_opts
->descr
= NULL
;
673 interface_opts
->display_name
= g_strdup(if_info
->name
);
675 interface_opts
->ifname
= NULL
;
676 interface_opts
->if_type
= if_info
->type
;
677 interface_opts
->extcap
= g_strdup(if_info
->extcap
);
681 find_ifinfo_by_name(GList
*if_list
, const char *name
)
684 if_info_t
*matched_if_info
;
685 size_t prefix_length
;
687 matched_if_info
= NULL
;
688 if (if_list
!= NULL
) {
690 * Try and do an exact match (case insensitive) on the
691 * interface name, the interface description, and the
692 * hardware description.
694 for (if_entry
= g_list_first(if_list
); if_entry
!= NULL
;
695 if_entry
= g_list_next(if_entry
))
697 if_info_t
*if_info
= (if_info_t
*)if_entry
->data
;
700 * Does the specified name match the interface name
701 * with a case-insensitive match?
703 if (g_ascii_strcasecmp(if_info
->name
, name
) == 0) {
707 matched_if_info
= if_info
;
712 * Does this interface have a friendly name and, if so,
713 * does the specified name match the friendly name with
714 * a case-insensitive match?
716 if (if_info
->friendly_name
!= NULL
&&
717 g_ascii_strcasecmp(if_info
->friendly_name
, name
) == 0) {
721 matched_if_info
= if_info
;
727 * On Windows, we store interface names in preferences as:
728 * friendlyname (name)
729 * Do we have a case-insensitive match for that?
731 if (if_info
->friendly_name
!= NULL
) {
732 GString
* combined_name
= g_string_new(if_info
->friendly_name
);
733 g_string_append_printf(combined_name
, " (%s)", if_info
->name
);
734 if (g_ascii_strcasecmp(combined_name
->str
, name
) == 0) {
738 matched_if_info
= if_info
;
740 g_string_free(combined_name
, TRUE
);
741 if (matched_if_info
!= NULL
) {
748 if (matched_if_info
== NULL
) {
750 * We didn't find it; attempt a case-insensitive prefix match
751 * of the friendly name.
753 prefix_length
= strlen(name
);
754 for (if_entry
= g_list_first(if_list
); if_entry
!= NULL
;
755 if_entry
= g_list_next(if_entry
))
757 if_info_t
*if_info
= (if_info_t
*)if_entry
->data
;
759 if (if_info
->friendly_name
!= NULL
&&
760 g_ascii_strncasecmp(if_info
->friendly_name
, name
, prefix_length
) == 0) {
762 * We found an interface whose friendly name matches
763 * with a case-insensitive prefix match.
765 matched_if_info
= if_info
;
772 return matched_if_info
;
776 capture_opts_add_iface_opt(capture_options
*capture_opts
, const char *optarg_str_p
)
784 interface_options interface_opts
;
787 * If the argument is a number, treat it as an index into the list
788 * of adapters, as printed by "tshark -D".
790 * This should be OK on UN*X systems, as interfaces shouldn't have
791 * names that begin with digits. It can be useful on Windows, where
792 * more than one interface can have the same name.
794 * XXX - "shouldn't have names that begin with digits" is not true
797 * https://github.com/the-tcpdump-group/tcpdump/issues/522
799 * tcpdump handles that by trying to open the device by name and,
800 * if that fails *and* the name is a syntactically valid number
801 * (optional sign, followed by decimal digits), reports an error
802 * if it's not a valid interface index, and otherwise uses it as
803 * an interface index.
805 adapter_index
= strtol(optarg_str_p
, &p
, 10);
806 if (p
!= NULL
&& *p
== '\0') {
807 if (adapter_index
< 0) {
808 cmdarg_err("The specified adapter index is a negative number");
811 if (adapter_index
> INT_MAX
) {
812 cmdarg_err("The specified adapter index is too large (greater than %d)",
816 if (adapter_index
== 0) {
817 cmdarg_err("There is no interface with that adapter index");
820 if_list
= capture_opts
->get_iface_list(&err
, &err_str
);
821 if (if_list
== NULL
) {
823 cmdarg_err("There are no interfaces on which a capture can be done");
825 cmdarg_err("%s", err_str
);
830 if_info
= (if_info_t
*)g_list_nth_data(if_list
, (int)(adapter_index
- 1));
831 if (if_info
== NULL
) {
832 cmdarg_err("There is no interface with that adapter index");
833 free_interface_list(if_list
);
836 fill_in_interface_opts_from_ifinfo(&interface_opts
, if_info
);
837 free_interface_list(if_list
);
838 } else if (capture_opts
->capture_child
) {
840 * In Wireshark capture child mode, so the exact interface name
841 * is supplied, and we don't need to look it up.
843 if_info
= if_info_get(optarg_str_p
);
844 fill_in_interface_opts_from_ifinfo(&interface_opts
, if_info
);
845 if_info_free(if_info
);
846 } else if (g_strcmp0(optarg_str_p
, "-") == 0) {
848 * Standard input. Don't bother to retrieve the interface_list;
849 * assume that there isn't a device named "-". (Retrieving the
850 * interface list involves spawning a privileged dumpcap process.)
852 interface_opts
.name
= g_strdup(optarg_str_p
);
853 interface_opts
.descr
= g_strdup("Standard input");
854 interface_opts
.hardware
= NULL
;
855 interface_opts
.display_name
= g_strdup(interface_opts
.descr
);
856 interface_opts
.ifname
= NULL
;
857 interface_opts
.if_type
= IF_STDIN
;
858 interface_opts
.extcap
= g_strdup(capture_opts
->default_options
.extcap
);
860 } else if (win32_is_pipe_name(optarg_str_p
)) {
862 * Special named pipe name on Windows.
863 * https://learn.microsoft.com/en-us/windows/win32/ipc/pipe-names
864 * Don't bother retrieving the interface list.
866 interface_opts
.name
= g_strdup(optarg_str_p
);
867 interface_opts
.descr
= NULL
;
868 interface_opts
.hardware
= NULL
;
869 interface_opts
.display_name
= g_strdup(optarg_str_p
);
870 interface_opts
.ifname
= NULL
;
871 interface_opts
.if_type
= IF_PIPE
;
872 interface_opts
.extcap
= g_strdup(capture_opts
->default_options
.extcap
);
876 * Search for that name in the interface list and, if we found
877 * it, fill in fields in the interface_opts structure.
879 * XXX - if we can't get the interface list, we don't report
880 * an error, as, on Windows, that might be due to WinPcap or
881 * Npcap not being installed, but the specified "interface"
882 * might be the standard input ("-") or a pipe, and dumpcap
883 * should support capturing from the standard input or from
884 * a pipe even if there's no capture support from *pcap.
886 * Perhaps doing something similar to what was suggested
887 * for numerical interfaces should be done.
889 * XXX: If we ever save pipe settings permanently, it should be
890 * capture_interface_list that tries to check saved pipes (or
891 * extcaps), possibly before retrieving the list.
893 if_list
= capture_opts
->get_iface_list(&err
, &err_str
);
894 if_info
= find_ifinfo_by_name(if_list
, optarg_str_p
);
895 if (if_info
!= NULL
) {
897 * We found the interface in the list; fill in the
898 * interface_opts structure from its if_info.
900 fill_in_interface_opts_from_ifinfo(&interface_opts
, if_info
);
903 * We didn't find the interface in the list; just use
904 * the specified name, so that, for example, if an
905 * interface doesn't show up in the list for some
906 * reason, the user can try specifying it explicitly
907 * for testing purposes.
909 interface_opts
.name
= g_strdup(optarg_str_p
);
910 interface_opts
.descr
= NULL
;
911 interface_opts
.hardware
= NULL
;
912 interface_opts
.display_name
= g_strdup(optarg_str_p
);
913 interface_opts
.ifname
= NULL
;
914 interface_opts
.if_type
= capture_opts
->default_options
.if_type
;
915 interface_opts
.extcap
= g_strdup(capture_opts
->default_options
.extcap
);
917 free_interface_list(if_list
);
920 fill_in_interface_opts_defaults(&interface_opts
, capture_opts
);
922 g_array_append_val(capture_opts
->ifaces
, interface_opts
);
929 capture_opts_add_opt(capture_options
*capture_opts
, int opt
, const char *optarg_str_p
)
935 case 'a': /* autostop criteria */
936 if (set_autostop_criterion(capture_opts
, optarg_str_p
) == FALSE
) {
937 cmdarg_err("Invalid or unknown -a flag \"%s\"", optarg_str_p
);
941 #ifdef HAVE_PCAP_REMOTE
943 if (get_auth_arguments(capture_opts
, optarg_str_p
) == FALSE
) {
944 cmdarg_err("Invalid or unknown -A arg \"%s\"", optarg_str_p
);
949 case 'b': /* Ringbuffer option */
950 capture_opts
->multi_files_on
= TRUE
;
951 if (get_ring_arguments(capture_opts
, optarg_str_p
) == FALSE
) {
952 cmdarg_err("Invalid or unknown -b arg \"%s\"", optarg_str_p
);
956 #ifdef CAN_SET_CAPTURE_BUFFER_SIZE
957 case 'B': /* Buffer size */
958 if (capture_opts
->ifaces
->len
> 0) {
959 interface_options
*interface_opts
;
961 interface_opts
= &g_array_index(capture_opts
->ifaces
, interface_options
, capture_opts
->ifaces
->len
- 1);
962 interface_opts
->buffer_size
= get_positive_int(optarg_str_p
, "buffer size");
964 capture_opts
->default_options
.buffer_size
= get_positive_int(optarg_str_p
, "buffer size");
968 case 'c': /* Capture n packets */
969 /* XXX Use set_autostop_criterion instead? */
970 capture_opts
->has_autostop_packets
= TRUE
;
971 capture_opts
->autostop_packets
= get_positive_int(optarg_str_p
, "packet count");
973 case 'f': /* capture filter */
974 if (capture_opts
->capture_filters_list
== NULL
)
975 capture_opts
->capture_filters_list
= ws_filter_list_read(CFILTER_LIST
);
976 get_filter_arguments(capture_opts
, optarg_str_p
);
978 case 'g': /* enable group read access on the capture file(s) */
979 capture_opts
->group_read_access
= TRUE
;
981 case 'H': /* Hide capture info dialog box */
982 capture_opts
->show_info
= FALSE
;
984 case LONGOPT_SET_TSTAMP_TYPE
: /* Set capture time stamp type */
985 if (capture_opts
->ifaces
->len
> 0) {
986 interface_options
*interface_opts
;
988 interface_opts
= &g_array_index(capture_opts
->ifaces
, interface_options
, capture_opts
->ifaces
->len
- 1);
989 g_free(interface_opts
->timestamp_type
);
990 interface_opts
->timestamp_type
= g_strdup(optarg_str_p
);
992 g_free(capture_opts
->default_options
.timestamp_type
);
993 capture_opts
->default_options
.timestamp_type
= g_strdup(optarg_str_p
);
996 case 'i': /* Use interface x */
997 status
= capture_opts_add_iface_opt(capture_opts
, optarg_str_p
);
1002 #ifdef HAVE_PCAP_CREATE
1003 case 'I': /* Capture in monitor mode */
1004 if (capture_opts
->ifaces
->len
> 0) {
1005 interface_options
*interface_opts
;
1007 interface_opts
= &g_array_index(capture_opts
->ifaces
, interface_options
, capture_opts
->ifaces
->len
- 1);
1008 interface_opts
->monitor_mode
= TRUE
;
1010 capture_opts
->default_options
.monitor_mode
= TRUE
;
1014 case 'l': /* tshark "Line-buffer" standard output */
1015 capture_opts
->update_interval
= 0;
1016 /* Wireshark uses 'l' for Automatic scrolling in live capture mode,
1017 * but ui/commandline.c should not and does not call this function
1021 #ifdef HAVE_PCAP_SETSAMPLING
1023 if (get_sampling_arguments(capture_opts
, optarg_str_p
) == FALSE
) {
1024 cmdarg_err("Invalid or unknown -m arg \"%s\"", optarg_str_p
);
1029 case 'n': /* Use pcapng format */
1030 capture_opts
->use_pcapng
= TRUE
;
1032 case 'p': /* Don't capture in promiscuous mode */
1033 if (capture_opts
->ifaces
->len
> 0) {
1034 interface_options
*interface_opts
;
1036 interface_opts
= &g_array_index(capture_opts
->ifaces
, interface_options
, capture_opts
->ifaces
->len
- 1);
1037 interface_opts
->promisc_mode
= FALSE
;
1039 capture_opts
->default_options
.promisc_mode
= FALSE
;
1042 case 'P': /* Use pcap format */
1043 capture_opts
->use_pcapng
= FALSE
;
1045 #ifdef HAVE_PCAP_REMOTE
1047 if (capture_opts
->ifaces
->len
> 0) {
1048 interface_options
*interface_opts
;
1050 interface_opts
= &g_array_index(capture_opts
->ifaces
, interface_options
, capture_opts
->ifaces
->len
- 1);
1051 interface_opts
->nocap_rpcap
= FALSE
;
1053 capture_opts
->default_options
.nocap_rpcap
= FALSE
;
1057 case 's': /* Set the snapshot (capture) length */
1058 snaplen
= get_natural_int(optarg_str_p
, "snapshot length");
1060 * Make a snapshot length of 0 equivalent to the maximum packet
1061 * length, mirroring what tcpdump does.
1064 snaplen
= WTAP_MAX_PACKET_SIZE_STANDARD
;
1065 if (capture_opts
->ifaces
->len
> 0) {
1066 interface_options
*interface_opts
;
1068 interface_opts
= &g_array_index(capture_opts
->ifaces
, interface_options
, capture_opts
->ifaces
->len
- 1);
1069 interface_opts
->has_snaplen
= TRUE
;
1070 interface_opts
->snaplen
= snaplen
;
1072 capture_opts
->default_options
.snaplen
= snaplen
;
1073 capture_opts
->default_options
.has_snaplen
= TRUE
;
1076 case 'S': /* "Real-Time" mode: used for following file ala tail -f */
1077 capture_opts
->real_time_mode
= TRUE
;
1079 #ifdef HAVE_PCAP_REMOTE
1081 if (capture_opts
->ifaces
->len
> 0) {
1082 interface_options
*interface_opts
;
1084 interface_opts
= &g_array_index(capture_opts
->ifaces
, interface_options
, capture_opts
->ifaces
->len
- 1);
1085 interface_opts
->datatx_udp
= TRUE
;
1087 capture_opts
->default_options
.datatx_udp
= TRUE
;
1091 case 'w': /* Write to capture file x */
1092 capture_opts
->saving_to_file
= TRUE
;
1093 g_free(capture_opts
->save_file
);
1094 capture_opts
->save_file
= g_strdup(optarg_str_p
);
1095 capture_opts
->orig_save_file
= g_strdup(optarg_str_p
);
1096 status
= capture_opts_output_to_pipe(capture_opts
->save_file
, &capture_opts
->output_to_pipe
);
1098 case 'y': /* Set the pcap data link type */
1099 if (capture_opts
->ifaces
->len
> 0) {
1100 interface_options
*interface_opts
;
1102 interface_opts
= &g_array_index(capture_opts
->ifaces
, interface_options
, capture_opts
->ifaces
->len
- 1);
1103 interface_opts
->linktype
= linktype_name_to_val(optarg_str_p
);
1104 if (interface_opts
->linktype
== -1) {
1105 cmdarg_err("The specified data link type \"%s\" isn't valid",
1110 capture_opts
->default_options
.linktype
= linktype_name_to_val(optarg_str_p
);
1111 if (capture_opts
->default_options
.linktype
== -1) {
1112 cmdarg_err("The specified data link type \"%s\" isn't valid",
1118 case LONGOPT_COMPRESS_TYPE
: /* compress type */
1119 if (capture_opts
->compress_type
) {
1120 cmdarg_err("--compress-type can be set only once");
1123 if (strcmp(optarg_str_p
, "none") == 0) {
1125 } else if (strcmp(optarg_str_p
, "gzip") == 0) {
1129 cmdarg_err("'gzip' compression is not supported");
1134 cmdarg_err("parameter of --compress-type can be 'none' or 'gzip'");
1136 cmdarg_err("parameter of --compress-type can only be 'none'");
1140 capture_opts
->compress_type
= g_strdup(optarg_str_p
);
1142 case LONGOPT_CAPTURE_TMPDIR
: /* capture temporary directory */
1143 if (capture_opts
->temp_dir
) {
1144 cmdarg_err("--temp-dir can be set only once");
1147 if (ws_stat64(optarg_str_p
, &fstat
) < 0) {
1148 cmdarg_err("Can't set temporary directory %s: %s",
1149 optarg_str_p
, g_strerror(errno
));
1152 if (!S_ISDIR(fstat
.st_mode
)) {
1153 cmdarg_err("Can't set temporary directory %s: not a directory",
1158 if ((fstat
.st_mode
& S_IRWXU
) != S_IRWXU
) {
1159 cmdarg_err("Can't set temporary directory %s: not a writable directory",
1163 #endif /* S_IRWXU */
1164 capture_opts
->temp_dir
= g_strdup(optarg_str_p
);
1166 case LONGOPT_UPDATE_INTERVAL
: /* capture update interval */
1167 capture_opts
->update_interval
= get_natural_int(optarg_str_p
, "update interval");
1170 /* the caller is responsible to send us only the right opt's */
1171 ws_assert_not_reached();
1178 capture_opts_print_if_capabilities(if_capabilities_t
*caps
,
1179 const interface_options
*interface_opts
,
1182 GList
*lt_entry
, *ts_entry
;
1184 if (caps
->primary_msg
) {
1185 cmdarg_err("The capabilities of the capture device "
1186 "\"%s\" could not be obtained (%s).%s%s",
1187 interface_opts
->name
, caps
->primary_msg
,
1188 caps
->secondary_msg
? "\n" : "",
1189 caps
->secondary_msg
? caps
->secondary_msg
: "");
1190 return WS_EXIT_INVALID_CAPABILITY
;
1193 if (queries
& CAPS_QUERY_LINK_TYPES
) {
1194 if (caps
->data_link_types
== NULL
) {
1195 cmdarg_err("The capture device \"%s\" has no data link types.",
1196 interface_opts
->name
);
1197 return WS_EXIT_IFACE_HAS_NO_LINK_TYPES
;
1199 if (caps
->can_set_rfmon
)
1200 printf("Data link types of interface %s when not in monitor mode (use option -y to set):\n",
1201 interface_opts
->name
);
1203 printf("Data link types of interface %s (use option -y to set):\n",
1204 interface_opts
->name
);
1205 for (lt_entry
= caps
->data_link_types
; lt_entry
!= NULL
;
1206 lt_entry
= g_list_next(lt_entry
)) {
1207 data_link_info_t
*data_link_info
= (data_link_info_t
*)lt_entry
->data
;
1208 printf(" %s", data_link_info
->name
);
1209 if (data_link_info
->description
!= NULL
)
1210 printf(" (%s)", data_link_info
->description
);
1212 printf(" (not supported)");
1215 if (caps
->can_set_rfmon
) {
1216 printf("Data link types of interface %s when in monitor mode (use option -y to set):\n",
1217 interface_opts
->name
);
1218 for (lt_entry
= caps
->data_link_types_rfmon
; lt_entry
!= NULL
;
1219 lt_entry
= g_list_next(lt_entry
)) {
1220 data_link_info_t
*data_link_info
= (data_link_info_t
*)lt_entry
->data
;
1221 printf(" %s", data_link_info
->name
);
1222 if (data_link_info
->description
!= NULL
)
1223 printf(" (%s)", data_link_info
->description
);
1225 printf(" (not supported)");
1231 if (queries
& CAPS_QUERY_TIMESTAMP_TYPES
) {
1232 if (caps
->timestamp_types
== NULL
) {
1233 cmdarg_err("The capture device \"%s\" has no timestamp types.",
1234 interface_opts
->name
);
1235 return WS_EXIT_IFACE_HAS_NO_TIMESTAMP_TYPES
;
1237 printf("Timestamp types of the interface (use option --time-stamp-type to set):\n");
1238 for (ts_entry
= caps
->timestamp_types
; ts_entry
!= NULL
;
1239 ts_entry
= g_list_next(ts_entry
)) {
1240 timestamp_info_t
*timestamp
= (timestamp_info_t
*)ts_entry
->data
;
1241 printf(" %s", timestamp
->name
);
1242 if (timestamp
->description
!= NULL
)
1243 printf(" (%s)", timestamp
->description
);
1249 return EXIT_SUCCESS
;
1252 /* Print an ASCII-formatted list of interfaces. */
1254 capture_opts_print_interfaces(GList
*if_list
)
1260 i
= 1; /* Interface id number */
1261 for (if_entry
= g_list_first(if_list
); if_entry
!= NULL
;
1262 if_entry
= g_list_next(if_entry
)) {
1263 if_info
= (if_info_t
*)if_entry
->data
;
1264 printf("%d. %s", i
++, if_info
->name
);
1266 /* Print the interface friendly name, if it exists;
1267 if not, fall back to the vendor description, if it exists. */
1268 if (if_info
->friendly_name
!= NULL
){
1269 printf(" (%s)", if_info
->friendly_name
);
1271 if (if_info
->vendor_description
!= NULL
)
1272 printf(" (%s)", if_info
->vendor_description
);
1280 capture_opts_trim_snaplen(capture_options
*capture_opts
, int snaplen_min
)
1283 interface_options
*interface_opts
;
1285 if (capture_opts
->ifaces
->len
> 0) {
1286 for (i
= 0; i
< capture_opts
->ifaces
->len
; i
++) {
1287 interface_opts
= &g_array_index(capture_opts
->ifaces
, interface_options
, 0);
1288 if (interface_opts
->snaplen
< 1)
1289 interface_opts
->snaplen
= WTAP_MAX_PACKET_SIZE_STANDARD
;
1290 else if (interface_opts
->snaplen
< snaplen_min
)
1291 interface_opts
->snaplen
= snaplen_min
;
1294 if (capture_opts
->default_options
.snaplen
< 1)
1295 capture_opts
->default_options
.snaplen
= WTAP_MAX_PACKET_SIZE_STANDARD
;
1296 else if (capture_opts
->default_options
.snaplen
< snaplen_min
)
1297 capture_opts
->default_options
.snaplen
= snaplen_min
;
1303 capture_opts_trim_ring_num_files(capture_options
*capture_opts
)
1305 /* Check the value range of the ring_num_files parameter */
1306 if (capture_opts
->ring_num_files
> RINGBUFFER_MAX_NUM_FILES
) {
1307 cmdarg_err("Too many ring buffer files (%u). Reducing to %u.\n", capture_opts
->ring_num_files
, RINGBUFFER_MAX_NUM_FILES
);
1308 capture_opts
->ring_num_files
= RINGBUFFER_MAX_NUM_FILES
;
1309 } else if (capture_opts
->ring_num_files
> RINGBUFFER_WARN_NUM_FILES
) {
1310 cmdarg_err("%u is a lot of ring buffer files.\n", capture_opts
->ring_num_files
);
1312 #if RINGBUFFER_MIN_NUM_FILES > 0
1313 else if (capture_opts
->ring_num_files
< RINGBUFFER_MIN_NUM_FILES
) {
1314 cmdarg_err("Too few ring buffer files (%u). Increasing to %u.\n", capture_opts
->ring_num_files
, RINGBUFFER_MIN_NUM_FILES
);
1315 capture_opts
->ring_num_files
= RINGBUFFER_MIN_NUM_FILES
;
1321 * If no interface was specified explicitly, pick a default.
1324 capture_opts_default_iface_if_necessary(capture_options
*capture_opts
,
1325 const char *capture_device
)
1329 /* Did the user specify an interface to use? */
1330 if (capture_opts
->num_selected
!= 0 || capture_opts
->ifaces
->len
!= 0) {
1331 /* yes they did, return immediately - nothing further to do here */
1335 /* No - is a default specified in the preferences file? */
1336 if (capture_device
!= NULL
) {
1338 status
= capture_opts_add_iface_opt(capture_opts
, capture_device
);
1341 /* No default in preferences file, just pick the first interface from the list of interfaces. */
1342 return capture_opts_add_iface_opt(capture_opts
, "1");
1346 #define S_IFIFO _S_IFIFO
1349 #define S_ISFIFO(mode) (((mode) & S_IFMT) == S_IFIFO)
1352 /* copied from filesystem.c */
1354 capture_opts_test_for_fifo(const char *path
)
1358 if (ws_stat64(path
, &statb
) < 0)
1361 if (S_ISFIFO(statb
.st_mode
))
1368 capture_opts_output_to_pipe(const char *save_file
, gboolean
*is_pipe
)
1374 if (save_file
!= NULL
) {
1375 /* We're writing to a capture file. */
1376 if (strcmp(save_file
, "-") == 0) {
1377 /* Writing to stdout. */
1378 /* XXX - should we check whether it's a pipe? It's arguably
1379 silly to do "-w - >output_file" rather than "-w output_file",
1380 but by not checking we might be violating the Principle Of
1381 Least Astonishment. */
1384 /* not writing to stdout, test for a FIFO (aka named pipe) */
1385 err
= capture_opts_test_for_fifo(save_file
);
1388 case ENOENT
: /* it doesn't exist, so we'll be creating it,
1389 and it won't be a FIFO */
1390 case 0: /* found it, but it's not a FIFO */
1393 case ESPIPE
: /* it is a FIFO */
1397 default: /* couldn't stat it */
1398 break; /* ignore: later attempt to open */
1399 /* will generate a nice msg */
1408 interface_opts_free(interface_options
*interface_opts
)
1410 if (interface_opts
== NULL
)
1413 g_free(interface_opts
->name
);
1414 g_free(interface_opts
->descr
);
1415 g_free(interface_opts
->hardware
);
1416 g_free(interface_opts
->display_name
);
1417 g_free(interface_opts
->ifname
);
1418 g_free(interface_opts
->cfilter
);
1419 g_free(interface_opts
->timestamp_type
);
1420 g_free(interface_opts
->extcap
);
1421 g_free(interface_opts
->extcap_fifo
);
1422 if (interface_opts
->extcap_args
)
1423 g_hash_table_unref(interface_opts
->extcap_args
);
1424 if (interface_opts
->extcap_pid
!= WS_INVALID_PID
)
1425 ws_warning("Extcap still running during interface delete");
1426 g_free(interface_opts
->extcap_pipedata
);
1427 if (interface_opts
->extcap_stderr
)
1428 g_string_free(interface_opts
->extcap_stderr
, TRUE
);
1429 g_free(interface_opts
->extcap_control_in
);
1430 g_free(interface_opts
->extcap_control_out
);
1431 #ifdef HAVE_PCAP_REMOTE
1432 if (interface_opts
->src_type
== CAPTURE_IFREMOTE
) {
1433 g_free(interface_opts
->remote_host
);
1434 g_free(interface_opts
->remote_port
);
1435 g_free(interface_opts
->auth_username
);
1436 g_free(interface_opts
->auth_password
);
1442 capture_opts_del_iface(capture_options
*capture_opts
, guint if_index
)
1444 interface_options
*interface_opts
;
1446 interface_opts
= &g_array_index(capture_opts
->ifaces
, interface_options
, if_index
);
1447 /* XXX - check if found? */
1448 interface_opts_free(interface_opts
);
1450 capture_opts
->ifaces
= g_array_remove_index(capture_opts
->ifaces
, if_index
);
1454 interface_opts_from_if_info(capture_options
*capture_opts
, const if_info_t
*if_info
)
1456 interface_options
*interface_opts
= g_new(interface_options
, 1);
1458 fill_in_interface_opts_from_ifinfo(interface_opts
, if_info
);
1459 fill_in_interface_opts_defaults(interface_opts
, capture_opts
);
1461 return interface_opts
;
1465 * Add all non-hidden selected interfaces in the "all interfaces" list
1466 * to the list of interfaces for the capture.
1469 collect_ifaces(capture_options
*capture_opts
)
1472 interface_t
*device
;
1473 interface_options interface_opts
;
1475 /* Empty out the existing list of interfaces. */
1476 for (i
= capture_opts
->ifaces
->len
; i
!= 0; i
--)
1477 capture_opts_del_iface(capture_opts
, i
-1);
1479 /* Now fill the list up again. */
1480 for (i
= 0; i
< capture_opts
->all_ifaces
->len
; i
++) {
1481 device
= &g_array_index(capture_opts
->all_ifaces
, interface_t
, i
);
1482 if (device
->selected
) {
1483 interface_opts
.name
= g_strdup(device
->name
);
1484 interface_opts
.descr
= g_strdup(device
->if_info
.friendly_name
);
1485 interface_opts
.ifname
= NULL
;
1486 interface_opts
.hardware
= g_strdup(device
->if_info
.vendor_description
);
1487 interface_opts
.display_name
= g_strdup(device
->display_name
);
1488 interface_opts
.linktype
= device
->active_dlt
;
1489 interface_opts
.cfilter
= g_strdup(device
->cfilter
);
1490 interface_opts
.timestamp_type
= g_strdup(device
->timestamp_type
);
1491 interface_opts
.snaplen
= device
->snaplen
;
1492 interface_opts
.has_snaplen
= device
->has_snaplen
;
1493 interface_opts
.promisc_mode
= device
->pmode
;
1494 interface_opts
.if_type
= device
->if_info
.type
;
1495 interface_opts
.extcap
= g_strdup(device
->if_info
.extcap
);
1496 interface_opts
.extcap_fifo
= NULL
;
1497 interface_opts
.extcap_pipedata
= NULL
;
1498 interface_opts
.extcap_args
= device
->external_cap_args_settings
;
1499 interface_opts
.extcap_pid
= WS_INVALID_PID
;
1500 if (interface_opts
.extcap_args
)
1501 g_hash_table_ref(interface_opts
.extcap_args
);
1502 interface_opts
.extcap_pipedata
= NULL
;
1503 interface_opts
.extcap_stderr
= NULL
;
1505 interface_opts
.extcap_pipe_h
= INVALID_HANDLE_VALUE
;
1506 interface_opts
.extcap_control_in_h
= INVALID_HANDLE_VALUE
;
1507 interface_opts
.extcap_control_out_h
= INVALID_HANDLE_VALUE
;
1509 interface_opts
.extcap_control_in
= NULL
;
1510 interface_opts
.extcap_control_out
= NULL
;
1511 #ifdef CAN_SET_CAPTURE_BUFFER_SIZE
1512 interface_opts
.buffer_size
= device
->buffer
;
1514 #ifdef HAVE_PCAP_CREATE
1515 interface_opts
.monitor_mode
= device
->monitor_mode_enabled
;
1517 #ifdef HAVE_PCAP_REMOTE
1518 interface_opts
.src_type
= CAPTURE_IFREMOTE
;
1519 interface_opts
.remote_host
= g_strdup(device
->remote_opts
.remote_host_opts
.remote_host
);
1520 interface_opts
.remote_port
= g_strdup(device
->remote_opts
.remote_host_opts
.remote_port
);
1521 interface_opts
.auth_type
= device
->remote_opts
.remote_host_opts
.auth_type
;
1522 interface_opts
.auth_username
= g_strdup(device
->remote_opts
.remote_host_opts
.auth_username
);
1523 interface_opts
.auth_password
= g_strdup(device
->remote_opts
.remote_host_opts
.auth_password
);
1524 interface_opts
.datatx_udp
= device
->remote_opts
.remote_host_opts
.datatx_udp
;
1525 interface_opts
.nocap_rpcap
= device
->remote_opts
.remote_host_opts
.nocap_rpcap
;
1526 interface_opts
.nocap_local
= device
->remote_opts
.remote_host_opts
.nocap_local
;
1528 #ifdef HAVE_PCAP_SETSAMPLING
1529 interface_opts
.sampling_method
= device
->remote_opts
.sampling_method
;
1530 interface_opts
.sampling_param
= device
->remote_opts
.sampling_param
;
1532 g_array_append_val(capture_opts
->ifaces
, interface_opts
);
1540 capture_opts_free_link_row(gpointer elem
)
1542 link_row
* e
= (link_row
*)elem
;
1549 capture_opts_free_interface_t(interface_t
*device
)
1551 if (device
!= NULL
) {
1552 g_free(device
->name
);
1553 g_free(device
->display_name
);
1554 g_free(device
->addresses
);
1555 g_free(device
->cfilter
);
1556 g_free(device
->timestamp_type
);
1557 g_list_free_full(device
->links
, capture_opts_free_link_row
);
1558 #ifdef HAVE_PCAP_REMOTE
1559 g_free(device
->remote_opts
.remote_host_opts
.remote_host
);
1560 g_free(device
->remote_opts
.remote_host_opts
.remote_port
);
1561 g_free(device
->remote_opts
.remote_host_opts
.auth_username
);
1562 g_free(device
->remote_opts
.remote_host_opts
.auth_password
);
1564 g_free(device
->if_info
.name
);
1565 g_free(device
->if_info
.friendly_name
);
1566 g_free(device
->if_info
.vendor_description
);
1567 g_slist_free_full(device
->if_info
.addrs
, g_free
);
1568 g_free(device
->if_info
.extcap
);
1569 if (device
->if_info
.caps
) {
1570 free_if_capabilities(device
->if_info
.caps
);
1572 if (device
->external_cap_args_settings
) {
1573 g_hash_table_unref(device
->external_cap_args_settings
);
1578 #endif /* HAVE_LIBPCAP */
1581 * Editor modelines - https://www.wireshark.org/tools/modelines.html
1586 * indent-tabs-mode: nil
1589 * vi: set shiftwidth=4 tabstop=8 expandtab:
1590 * :indentSize=4:tabSize=8:noTabs=true: