summaryrefslogtreecommitdiff
path: root/tcpdump.c
Commit message (Collapse)AuthorAgeFilesLines
...
* remove tcpdump's own CVS keywordsDenis Ovsienko2014-01-031-2/+0
| | | | | | Remove lots of $Header's and a few $Id's that all belong to the former CVS repository of tcpdump itself. These keywords have been frozen since the migration to git in late 2008.
* ndo-ize print-ascii: hex_print_with_offset()Michael Richardson2014-01-011-11/+19
|
* whitespace changesMichael Richardson2014-01-011-10/+10
|
* make more array declarations static/constDenis Ovsienko2013-12-191-4/+4
|
* use -Q instead of -P to set capture directionDenis Ovsienko2013-12-161-16/+18
| | | | | | Guy Harris points that -P is already taken by MacOS derived work and that the only remaining single-letter option is -Q (see GH #252). Fix some formatting while at it.
* Don't use __attribute__((format)) if it's not supported.Guy Harris2013-11-281-2/+10
| | | | Also, *do* use it, if supported, for ndo_warning().
* Put lower-case letters before their upper-case equivalents in getopt().Guy Harris2013-10-181-1/+1
| | | | For consistency - V came before v, unlike all other options.
* make pcap_setdirection() call conditional, GH #252Denis Ovsienko2013-10-151-5/+7
| | | | | | | | | | pcap_setdirection() succeeds only for particular combination of platform, interface type and direction. Calling it on each invocation (with PCAP_D_INOUT by default) was wrong: some interfaces are two-way, others are one-way, and pcap_setdirection() has its own idea what it supports and what doesn't. In particular, it was impossible to do any capture on nflog interface in Linux since commit df7d24f. Now the function is only called on -P flag.
* add support for pcap_setdirection() (GH#252)Thomas Jacob2013-09-121-2/+32
| | | | | Adds -P in|out|inout option, includes man page and command line help updates.
* NFLOG: remove header dependency, add a test caseDenis Ovsienko2013-09-091-2/+0
| | | | | | | | | | | | | This change removes detection of linux/netfilter/nfnetlink_log.h, which was only used to provide two constants. The constants are now defined in print-nflog.c, making it possible to compile (and test) the NFLOG decoder on all systems, not only Linux. There is now a test case for the decoder, it was produced on a Linux host with: iptables -A INPUT -p udp --source 74.82.42.42 -j NFLOG --nflog-group 20 dig @74.82.42.42 ...
* adjust order of elements in ndo_printers[]Denis Ovsienko2013-09-071-5/+5
| | | | | | | | DLT_EN10MB, the most commonly seen datalink type, used to be the first element of ndo_printers[], which lookup_ndo_printer() iterates over, but commit 20ad836 made DLT_NFLOG the first. Move DLT_NFLOG to the last position to make the function spend the same time processing the previously recognized datalink types as before.
* LMP: add -T override and fix version 1 test(s)Denis Ovsienko2013-09-071-0/+2
| | | | | | | | | | | The Link Management Protocol version 1 sample capture added to the tests directory in commit 212eef2 was produced using non-standard UDP port 49998. Later assignment of port 701 reflected in commit 960aee5 made it impossible to decode the capture. This change adds a -T override for LMP, uses it to replace the broken test with two working tests and dismisses the custom test script, lmp.sh.
* IP packet information printing from NFLOG packetPetar2013-08-141-0/+2
| | | | | | Added nflog.h to Makefile.in Alphabetical order in Makefile.in
* Added IP information printing from NFLOG packetPetar2013-05-311-0/+3
|
* improve ZeroMQ support (ZMTP/1.0 inside PGM/EPGM)Denis Ovsienko2013-04-141-0/+2
| | | | | | | | | | | This change adds new code to decode ZeroMQ datagrams, couples it with the PGM decoder and extends the -T option to make all this work. There are two new test cases based on existing captures of ZMTP/1.0 inside [E]PGM to decode the ZMTP/1.0 part of these. This functionality enables decoding of the traffic zeromq library produces for "pgm://" and "epgm://" protocol schemas.
* use existing PGM decoder for UDP-encapsulated PGMDenis Ovsienko2013-04-141-0/+2
| | | | | | | | | The original PGM uses its own IP protocol number. "EPGM" or "PGM/UDP" stands for UDP-encapsulated PGM, which has no assigned UDP port number and can be decoded only by means of -T option, which now accepts "pgm" protocol type for this purpose. There is also a sample capture of EPGM now (similar to the one of native PGM, but produced using the "epgm://" protocol schema) and a respective test case.
* Change C++ style comments to C style commentsfxlb2013-04-141-2/+2
|
* Stop reading multiple files properly on cleanup.Wesley Shields2013-03-271-0/+8
| | | | | | | Prior to this if pcap_breakloop() is called in cleanup() while reading multiple files (via -V) the code would fall through and open the next file in the list. With this change the list is cut short and the program exits normally.
* - Add support for OTV (draft-hasmit-otv-04).Francesco Fondelli2013-02-261-0/+2
| | | | - Use the packettype infrastructure (-T vxlan) for VXLAN parsing (waiting for a well known dest port)
* ZeroMQ initial support (ZMTP/1.0 framing)Denis Ovsienko2013-02-111-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | This change adds support for ZMTP/1.0 (ZeroMQ Message Transport Protocol 1.0) framing in TCP packets, as defined in http://rfc.zeromq.org/spec:13 and implemented in zeromq library. Since there is no assigned port number for ZeroMQ, the user is left responsible for making only the related TCP packets captured and enforcing ZMTP/1.0 decoding through the "-T zmtp1" option. Each ZMTP/1.0 frame of a packet will produce a single additional line of output. The "-v" flag will add up to 8 lines (128 bytes) worth of hex+ASCII dump of the frame body, and "-vv" and higher will dump the full frame body, however long. Beware that this code handles neither IP fragmentation nor TCP segmentation and will incorrectly decode segments not starting at a frame boundary. The included sample capture stands for a short ZeroMQ session between a REQ/REP socket pair doing 3 anonymous 2-way exchanges. It was produced using version 2.1.9 of zeromq library patched to fix its bug #293, so that all MBZ bits of the flags field are set to 0.
* Squelch some warnings, and add some comments to clarify the code path.Guy Harris2012-11-301-0/+23
|
* Fix some more NAME_MAX->PATH_MAX and make some routines static.Guy Harris2012-11-291-4/+8
|
* Merge branch 'master' of https://github.com/mcr/tcpdumpWesley Shields2012-10-011-18/+17
|\ | | | | | | | | Conflicts: tcpdump.c
| * More strictly check for numbers as arguments to -i.Guy Harris2012-09-271-5/+4
| | | | | | | | | | | | Use strtol() and only treat the argument as a number if it's *all* number, so that interface names such as 192_1_2 aren't treated as "interface number 192".
| * Use PATH_MAX, not NAME_MAX.Guy Harris2012-09-271-12/+12
| | | | | | | | | | | | | | | | | | | | | | NAME_MAX is the maximum length of a file pathname *component*; PATH_MAX is the maximum length of a file pathname. We're dealing with pathnames, so use PATH_MAX. (On some systems, NAME_MAX can be as low as 14, presumably for binary compatibility with V7-era data structures containing file names, as there are probably few if any non-historic UN*Xes around with 14-character file name limitations.) Boost the default PATH_MAX to 1024 while we're at it.
| * add missing double quote to fix compilingDenis Ovsienko2012-09-101-1/+1
| |
* | Merge remote-tracking branch 'upstream/master'Wesley Shields2012-09-101-0/+2
|\ \ | |/
| * Indention should match nowBill Parker2012-09-041-2/+2
| | | | | | | | The indentation should match on this file now
| * Sanity Checking for mallocBill Parker2012-09-041-0/+2
| | | | | | | | Added sanity checking for return value to filename being equal to NULL
* | Address Michael's comments.Wesley Shields2012-09-061-9/+17
| | | | | | | | | | | | Be more portable when opening stdin. Refactor reading from VFile into a function.
* | Properly print when dlt changes.Wesley Shields2012-08-111-15/+23
| | | | | | | | When we open a new file we need to get new printinfo.
* | DLT change detection.Wesley Shields2012-08-111-4/+7
| | | | | | | | | | If when writing an output file, error if the DLT of subsequent files is not the same as the original.
* | Add multi-file support.Wesley Shields2012-08-101-40/+97
|/
* Add "radius" as an option for -T.Guy Harris2012-06-301-0/+4
| | | | | | | | This allows tcpdump to handle RADIUS running on non-standard ports. Submitted-By: ssb@sourceforge.net Man page also updated by me.
* Dropping root priviledges using Linux CapabilitiesMichal Sekletar2012-05-251-0/+52
|
* Back out DLT_PFSYNC support.Guy Harris2012-02-291-3/+0
| | | | | | Unfortunately, the DLT_PFSYNC support depends on header files included from the pfctl command's source tree, and trying to arrange to find that would be too much trouble.
* Add DLT_PFSYNC support.Guy Harris2012-02-291-0/+3
| | | | | | From FreeBSD PR bin/124825: tcpdump(8) does not support pfsync(4) data, which in turn was ported over from OpenBSD. We already have CARP support, so we did not port that part over.
* tcpdump now accepts SIGUSR1 as a signal to print the statistics on systems ↵Kenichi Maehashi2012-02-071-4/+10
| | | | that does not support SIGINFO
* Add a CARP dissector and a command-line option to dissect proto 112 as CARP.George Neville-Neil2011-11-231-0/+2
| | | | | | | CARP and VRRP both use IP protocol number 112, so there needs to be a -T flag to specify that protocol 112 be dissected as CARP rather than VRRP. Also update the man page.
* Change name of Hilscher link types to say NETANALYER.Guy Harris2011-09-151-4/+4
| | | | | That makes the names a bit shorter, and mentions the specific Hilscher product to which they apply.
* Add printers for the Hilscher Ethernet link-layer types.Guy Harris2011-09-151-0/+6
|
* Note that ndo_error doesn't, and *ndo_error shouldn't, return.Guy Harris2011-06-241-1/+2
| | | | | Tcpdump's ndo_error() doesn't return. Any other ndo_error routine supplied to netdissect shouldn't, either, as printers expect it not to.
* Use "-H", not "-h", for the 802.11s option, and improve error reporting.Guy Harris2011-06-211-4/+7
| | | | | | | | I was rudely surprised to find that "tcpdump -h" wasn't printing a usage message, and I'm the person who *added* the "-h" option. Make it "-H", and add an explicit "-h" option to print a usage message, so nobody else makes the same mistake. Also, don't clear opterr, so that if you give an illegal command-line option, you get an explanatory error message.
* From: Darren Reed <darren.reed@oracle.com>Michael Richardson2011-05-031-6/+5
| | | | | | | | | | | | | | | To: tcpdump-workers@lists.tcpdump.org Date: Sat, 09 Apr 2011 12:51:14 +1000 Subject: [tcpdump-workers] Printing PPI packets Printing PPI packets with tcpdump does not turn out to be that hard. My simple tests have produced the output as below. It would be worthwhile having some changes made into the tcpdump code base that were similar to the attached that print them out.
* Fix plurals in packet count messages.Guy Harris2011-03-081-5/+8
| | | | | | | | Based on a patch from cr4ckn@sourceforge.net, but with a macro PLURAL_SUFFIX() defined to return either "s" or "" (rather than possibly printing a NUL character with %c), and with that macro used in a couple of cases where the equivalent had been done by hand, and with one case the patch missed fixed as well.
* Add support for nommu systems.Guy Harris2010-11-301-7/+18
| | | | | | | | | | | | | Rather than hardcode the WIN32 define, add proper fork checks to the configure script and check those. This fixes building for nommu systems which lack the fork function. While we're here though, add support for this functionality via vfork so that it does work on nommu systems. And fix an old bug where we exit properly in the forked child when the exec failed instead of just returning to the calling code (which isn't expecting it). Reviewed-By: Guy Harris <guy@alum.mit.edu>
* Switch user ID/root directory with -Z before opening savefiles for output.Paul Ferrell2010-11-061-10/+25
| | | | | | | | | | In addition to Paul's change, I added a comment explaining why we do this, and explaining that doing so after opening the first savefile doesn't help with subsequent savefiles, so you'll have to come up with a better fix if you want the savefiles opened by the original UID or outside the chroot. Reviewed-By: Guy Harris <guy@alum.mit.edu>
* reworked print-ether to use netdissectMichael Richardson2010-10-071-1/+1
|
* Document -j and -J. List -h in the usage message.Guy Harris2010-08-231-1/+1
|
* Handle DLT_IEEE802_15_4_NOFCS like DLT_IEEE802_15_4.Guy Harris2010-08-221-0/+3
|
View Lorry Controller Status