summaryrefslogtreecommitdiff
path: root/tcpdump.c
Commit message (Collapse)AuthorAgeFilesLines
...
* add support for DLT_JUNIPER{PPP,ETHER,FRELAY,CHDLC} printershannes2005-08-231-1/+13
|
* Add a flag to suppress the "default_print()" call made in variousguy2005-07-071-1/+4
| | | | | | | | link-layer print routines if no other print routine claimed the packet. Test whether that flag is set rather than testing whether neither of -x or -q were specified, and have -x, -q, *and* -X set that flag, so that -X suppresses it just as -x does. That way you don't get those pckets dumped twice if -X was specified.
* Have "ascii_print()" do the "-A" output, and nothing but the "-A"guy2005-07-061-13/+29
| | | | | | | | | | | | | | output. Have "hex_and_ascii_print_with_offset()" and "hex_and_ascii_print()" to the "-X"-style offset, leaving "hex_print_with_offset()" and "hex_print()" doing the "-x"-style output. Don't have any of them check "xflag", "Xflag", or "Aflag" - they print what they're intended to print, and the caller should check the flags in question. Don't have "-A" set "xflag" or "Xflag". This cleans up some problems with "-A" printing hex informatioin - it's not supposed to.
* Use pcap_dump_ftell() rather than casting a pcap_dumper_t * to a FILE *guy2005-06-031-2/+2
| | | | | | | | | | | and using ftell(); that won't necessarily work on Windows (if libpcap was built with a different version of the C runtime library than tcpdump is), and, even on UN*X, would break if a pcap_dumper_t * were ever made something other than a FILE *. Provide a pcap_dump_ftell() implementation that does that cheating cast for use if libpcap doesn't have it (a pcap_dumper_t * is just a FILE * on those older versions of libpcap).
* add basic support for DLT_JUNIPER_{GGSN,ES,MONITOR,SERVICES}, better ↵hannes2005-05-221-1/+13
| | | | boundary checking when parsing the juniper headers
* add support for DLT_JUNIPER_PPPOE_ATM printerhannes2005-05-121-1/+4
| | | | | replace the JUNIPER_ enums with real DLT_JUNIPER types (does this break environments where an old libpcap is present ?)
* add support for DLT_JUNIPER_PPPOE, fix zero-length cookieshannes2005-05-031-1/+4
|
* refactor the juniper_parse header printer, add juniper FRF.16 dissectorhannes2005-04-201-1/+4
|
* add support for Juniper ML-PPP DLT for printing captureshannes2005-01-271-1/+4
| | | | taken on the Link-Service (LS) and Multi-Link (ML) PICs
* add support for printing Multi-Link Frame Relayhannes2005-01-271-1/+4
| | | | captured on Juniper ML-PIC and LS-PIC cards
* There isn't a "default_print_unaligned" routine, so there's no need forguy2004-12-231-3/+11
| | | | | | | | | | an "ndo_default_print_unaligned" member of the "netdissect_options" structure. There is, however, a need for an "ndo_default_print" routine, which takes a "netdissect_options *" as its first argument, to initialize the "ndo_default_print" member of that structure, as "ND_DEFAULTPRINT()" uses it.
* If libpcap is configured with --enable-optimizer-dbg, it expects dflagguy2004-11-071-2/+3
| | | | | | to be a global supplied by the application using it. In tcpdump, "-d" is a specialized flag, and doesn't apply to packet dissection, so it doesn't belong in the netdissect structure - make it a global again.
* add support for dissecting DLT_JUNIPER_ATM1 (137) and DLT_JUNIPER_ATM2 (135)hannes2004-10-191-1/+7
|
* From Sebastien Vincent <svincent@idems.fr>: fix the handling of "-x" andguy2004-09-041-5/+23
| | | | "-X" so that "-x" prints only hex, not hex and ASCII.
* add ppp support for DLT_PPP_WITHDIRECTION; print direction (hidden under eflag)hannes2004-08-181-1/+4
|
* Get rid of a stray semicolon.guy2004-07-211-4/+4
| | | | | Define "ndo_error()" and "ndo_warning()" as static, to match their forward declarations.
* Catch invalid "-t" counts.guy2004-06-151-3/+12
| | | | Fix up the usage message.
* Make "tflag" count the number of "-t"s, to make it more obvious whatguy2004-06-151-4/+8
| | | | | | | | tflag values correspond to what output formats (e.g., 4 means "-tttt"). Switch on the tflag value to determine whether to call "gmt2local()" to set "thiszone", just as we switch on it to determine the format for time stamps, to make it more obvious in what cases we call it.
* From Raphael Raimbault <raphael.raimbault@netasq.com>: "-tttt" requiresguy2004-06-151-2/+2
| | | | the time zone offset, so get it with "gmt2local()" if "tflag" is -3.
* On most UN*Xes, "uid_t" and "gid_t" are unsigned, and, on someguy2004-04-071-8/+14
| | | | | | | | | | platforms, they're "unsigned long"; use "%lu" to print "pw_uid" and "pw_gid", and cast them to "unsigned long" for the benefit of platforms where they're not "unsigned long". When chrooting and giving up privileges, if a call fails, use "pcap_strerror()" to report the reason why it failed. Add "tcpdump:" to those error messages.
* Fixed a bug that caused "windump" with no parameters not to display therisso2004-04-061-8/+9
| | | | | | | adapter name correctly on win32. Modified some code so that windump retrieves the winpcap lib version with "pcap_lib_version()" on win32. Upgraded the Wpcap_version string to 3.1.
* print-esp has been "NDO"-ized.mcr2004-04-051-5/+46
| | | | | replace error() and warning() with ndo-ized version. moved snaplen/snapend to ndo structure.
* update changes filemcr2004-03-301-43/+39
|
* Use right prereqs for <netinet/if_ether.h> to avoid "autoconf bug!"fenner2004-03-231-1/+7
| | | | | | | error. Check for pcap_if_t in <pcap.h> if we have pcap_findalldevs; MacOS X 10.3.3 ships a newer libpcap which has pcap_findalldevs but an older pcap.h which doesn't have a pcap_if_t.
* From Bruce M. Simpson: add a "-M" flag to specify a shared secret forguy2004-03-231-4/+13
| | | | TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
* Exclude droproot from Win32, since it's not used and it prevents the ↵risso2004-03-191-1/+5
| | | | compilation of tcpdump.c.
* Add support for Apple's IP-over-IEEE 1394 encapsulation.guy2004-03-171-1/+4
|
* Add support for DLT_ value 99, as used by the Axent Raptorguy2004-03-111-1/+4
| | | | | firewall/Symantec Enterprise Firewall. Thanks, Axent/Symantec, for not asking us for a DLT_ value and not telling us about the link-layer type.
* from Pekka Savola <pekkas@netcore.fi>:hannes2004-02-261-3/+5
| | | | - only droproot() if we are root
* from Pekka Savola <pekkas@netcore.fi>:hannes2004-02-251-8/+28
| | | | | - add compile time option WITH_CHROOT - chroot() when dropping privileges
* from Pekka Savola <pekkas@netcore.fi>:hannes2004-02-241-30/+28
| | | | | -drop root privileges earlier -restore the old -Z behaviour
* "dflag" is exported to libpcap if libpcap is compiled with BDEBUG, so weguy2004-01-311-2/+2
| | | | make it non-static.
* Fix the usage message (add entry for "-W", and word-wrap at 80guy2004-01-261-2/+4
| | | | characters).
* From Chris Cogdon <chris@cogdon.org>:guy2004-01-261-44/+75
| | | | | | | | | | | | | | | | | | | | | | | | Fix a segfault with the -C option when the number of files grows to 1000. Limit has been increased to 1,000,000, and the code will check for exceeding this. Also, add a -W option which will limit the number of files created before 'wrapping around' and writing to the first file again, creating a 'loop tape'. Very useful if you want to have this running permanently to capture traffic up to a irregular event. Change the way that output files with -C are numbered. -C alone goes <none>, 1, 2, 3.... -C with -W will number 0, 1, 2 ... or 00, 01, 02 ... etc, depending on the value of -W. I.e., it sorts properly. (Old behaviour was to go <none>, 2, 3...) Close the current capture file before trying to allocate the buffer for the new file's name, so that if that allocation fails we've at least written out all of the previous file. Make some variables for command-line arguments, and some functions not used outside tcpdump.c, static.
* from Pekka Savola <pekkas@netcore.fi>:hannes2004-01-221-1/+11
| | | | | add a compile time option --with-user=USERNAME that drops privileges by default to USERNAME
* from Pekka Savola <pekkas@netcore.fi>:hannes2004-01-221-5/+50
| | | | add infrastructure for dropping root privileges
* From Gisle Vanem: fix a comment.guy2004-01-151-2/+2
|
* From Gisle Vanem:guy2004-01-151-1/+63
| | | | | | | | When saving to a file with "-w", have the "-v" flag make tcpdump report, every 10 seconds, the number of packets captured. Include <smi.h> if we're building with libsmi, to declare "smiInit()" and "smiLoadModule()".
* From Gisle Vanem: fix the "-m" case in the argument processing not toguy2004-01-141-1/+2
| | | | fall through to the "-O" case.
* clean up the default_print() related functions:hannes2003-12-291-30/+4
| | | | | | | | - call always into print_ascii() b/c just hexdump data is uninteresting; hex-offsets plus ascii representation is what most people are looking for - remove default_print_unaligned() as it is now obsolete
* From George Bakos: send the "reading from" messages to stderr, notguy2003-12-181-3/+4
| | | | stdout, so only output for packets goes to stdout.
* Print both the name and the description of a link-layer type (the nameguy2003-11-181-10/+19
| | | | | | | | isn't always very suggestive - for example, somebody might think "EN10MB" is always 10 MB/s, and might not know that "IEEE802" is Token Ring), using "pcap_datalink_val_to_description()". Supply our own "pcap_datalink_val_to_description()" if libpcap doesn't have it (even if it has "pcap_datalink_name_to_val()").
* In MSVC++'s C library, _IOLBF is the same as _IOFBF; use _IONBF instead.guy2003-11-181-2/+15
| | | | | Fix the timeout in the "pcap_open_live()" call - I accidentally checked in a larger value I was using while testing pcap_breakloop().
* Have the configure script arrange that the Makefile define _U_guy2003-11-161-7/+7
| | | | | | | | | | appropriately, and that GNUmakefile and the MSVC++ project file define it apppriately, as we do with libpcap, rather than defining it in "interface.h". Undo the rcsid-shuffling and addition of extra #includes, as we no longer need to arrange that "interface.h" be included before using _U_ in an RCS ID or copyright.
* From Neil Spring:guy2003-11-151-7/+7
| | | | | | | | | | | use "_U_" in the definitions of "rcsid[]", to eliminate complaints about those variables being unused; move the definitions after the include of "interface.h", or add an include of "interface.h", so that "_U_" is defined. Include "config.h" before including "tcpdump-stdinc.h" in "missing/datalinks.c".
* Check whether we have "pcap_breakloop()", and use it if we do - it's aguy2003-11-041-14/+54
| | | | | | | | | | | safer way to terminate "pcap_loop()" in a signal handler (it just sets a flag, it doesn't muck with data structures that might have been in the middle of being updated). Have "setsignal()" not request SA_RESTART, so that if we call "pcap_breakloop()" in a signal handler and then return, we don't restart a call that was waiting for captured packets, we just make that call EINTR out.
* Add to the packet counts a count of packets that tcpdump has seen andguy2003-09-161-1/+13
| | | | | | | | | | | | | | | | | | processed - people often get confused by the "received by filter" count, as they might not realize that, in some systems, it counts packets that were handed to the filter mechanism regardless of whether they pass or, if they pass, they have yet been read by the application and, on some other systems, it counts packets that passed the filter but still counts them in the kernel before they're read by the application. They're probably mostly interested in the count of packets processed by tcpdump; the "received by filter" count is probably of interest only if you want to know how effective your filter is (and even then it's of interest only if it counts packets handed to the filter rather than packets that passed the filter). Give more details on why the "received by filter" count doesn't necessarily mean what you think it means.
* Cleanup of the Windows portion. The result of the GetVersion() function, ↵risso2003-08-081-11/+16
| | | | | | that obtains the Windows OS version, was never used: avoid to call it. Removed the call to PrinCapBegins in w32_fzs.c.
* From Bruce M. Simpson <bms@spc.org>: RFC 3561 AODV support.guy2003-08-061-1/+3
|
* Print the link-type name along with the link-type when starting up.fenner2003-08-011-6/+19
|
View Lorry Controller Status