29  * tcpdump - dump traffic on a network
50 #include "netdissect-stdinc.h"
53  * This must appear after including netdissect-stdinc.h, so that _U_ is
75 /* Capsicum-specific code requires macros from <net/bpf.h>, which will fail
100  * remote-capture APIs declared and types and #defines that they use
142 #include <cap-ng.h>
152 #include "netdissect-stdinc.h"
157 #include "pcap-missing.h"
162 #include "diag-control.h"
217 static int jflag = -1;			/* packet time stamp source */
219 static int lflag;			/* line-buffered output */
222 static int Qflag = -1;			/* restrict captured packet by send/receive direction */
251 static void (*setsignal (int sig, void (*func)(int)))(int);
284   static void verbose_stats_dump(int sig);
389 		if (fmt[-1] != '\n')  in error()
408 		if (fmt[-1] != '\n')  in warning()
438 	fprintf(stdout, "Time stamp types for %s (use option -j to set):\n",  in show_tstamp_types_and_exit()
470 	 * monitor mode, if -I wasn't specified, or when in monitor mode,  in show_dlts_and_exit()
471 	 * when -I was specified (the link-layer types available in  in show_dlts_and_exit()
483 	(void) fprintf(stdout, " (use option -y to set):\n");  in show_dlts_and_exit()
518 	for (i = 0, dev = devlist; dev != NULL; i++, dev = dev->next) {  in show_devices_and_exit()
519 		printf("%d.%s", i+1, dev->name);  in show_devices_and_exit()
520 		if (dev->description != NULL)  in show_devices_and_exit()
521 			printf(" (%s)", dev->description);  in show_devices_and_exit()
522 		if (dev->flags != 0) {  in show_devices_and_exit()
524 			printf("%s", bittok2str(status_flags, "none", dev->flags));  in show_devices_and_exit()
526 			if (dev->flags & PCAP_IF_WIRELESS) {  in show_devices_and_exit()
527 				switch (dev->flags & PCAP_IF_CONNECTION_STATUS) {  in show_devices_and_exit()
545 				switch (dev->flags & PCAP_IF_CONNECTION_STATUS) {  in show_devices_and_exit()
584 	for (i = 0, dev = devlist; dev != NULL; i++, dev = dev->next) {  in show_remote_devices_and_exit()
585 		printf("%d.%s", i+1, dev->name);  in show_remote_devices_and_exit()
586 		if (dev->description != NULL)  in show_remote_devices_and_exit()
587 			printf(" (%s)", dev->description);  in show_remote_devices_and_exit()
588 		if (dev->flags != 0)  in show_remote_devices_and_exit()
589 			printf(" [%s]", bittok2str(status_flags, "none", dev->flags));  in show_remote_devices_and_exit()
605  * macOS tcpdump uses -g to force non--v output for IP to be on one
608  * macOS tcpdump uses -k to specify that packet comments in pcapng files
611  * OpenBSD tcpdump uses -o to indicate that OS fingerprinting should be done
614  * macOS tcpdump uses -P to indicate that -w should write pcapng rather
617  * macOS tcpdump also uses -Q to specify expressions that match packet
621  * equivalents would be "in" = "dir=in", "out" = "dir=out", and
622  * "inout" = "dir=in or dir=out", and the parser could conceivably
623  * special-case "in", "out", and "inout" as expressions for backwards
633 #define B_FLAG_USAGE	" [ -B size ]"
653 #define j_FLAG_USAGE	" [ -j tstamptype ]"
662 #define m_FLAG_USAGE "[ -m module ] ..."
667 #define Q_FLAG_USAGE " [ -Q in|out|inout ]"
688  * specified matters, such as -v and -d and -t, should probably not
691  *  tcpdump --verbose --verbose
693  * doesn't make sense; it should be --verbosity={N} or something such
713 	{ "buffer-size", required_argument, NULL, 'B' },
715 	{ "list-interfaces", no_argument, NULL, 'D' },
717 	{ "list-remote-interfaces", required_argument, NULL, OPTION_LIST_REMOTE_INTERFACES },
722 	{ "monitor-mode", no_argument, NULL, 'I' },
725 	{ "time-stamp-type", required_argument, NULL, 'j' },
726 	{ "list-time-stamp-types", no_argument, NULL, 'J' },
731 	{ "time-stamp-precision", required_argument, NULL, OPTION_TSTAMP_PRECISION},
733 	{ "dont-verify-checksums", no_argument, NULL, 'K' },
734 	{ "list-data-link-types", no_argument, NULL, 'L' },
735 	{ "no-optimize", no_argument, NULL, 'O' },
736 	{ "no-promiscuous-mode", no_argument, NULL, 'p' },
740 	{ "snapshot-length", required_argument, NULL, 's' },
741 	{ "absolute-tcp-sequence-numbers", no_argument, NULL, 'S' },
743 	{ "packet-buffered", no_argument, NULL, 'U' },
747 	{ "immediate-mode", no_argument, NULL, OPTION_IMMEDIATE_MODE },
750 	{ "debug-filter-parser", no_argument, NULL, 'Y' },
752 	{ "relinquish-privileges", required_argument, NULL, 'Z' },
754 	{ "fp-type", no_argument, NULL, OPTION_FP_TYPE },
762 #define LIST_REMOTE_INTERFACES_USAGE "[ --list-remote-interfaces remote-source ]"
768 #define IMMEDIATE_MODE_USAGE " [ --immediate-mode ]"
792 			int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG);  in droproot()
799 		if (initgroups(pw->pw_name, pw->pw_gid) != 0 ||  in droproot()
800 		    setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0)  in droproot()
803 				(unsigned long)pw->pw_uid,  in droproot()
804 				(unsigned long)pw->pw_gid,  in droproot()
821 		-1);  in droproot()
834 	x -= 1;  in getWflagChars()
871            * strftime() if it's non-empty, in which case the return  in MakeFilename()
875            * (We check above because, even if we don't use -G, we  in MakeFilename()
906 	if (len > 0 && ptr[len - 1] == '\n')  in get_next_file()
907 		ptr[len - 1] = '\0';  in get_next_file()
951 	return -EINVAL;  in tstamp_precision_from_string()
980  * locking files, they'd throw them all into a kitchen-sink fcntl() call
986  * The Capsicum people decided that fine-grained control of descriptor
988  * reading, writing, seeking, and fcntl-ing.  The latter, courtesy of
989  * AT&T's decision, means that "fcntl-ing" isn't a thing, but a motley
995  * the descriptor for the FILE * is open append-only or not; as that
1001  * to a file in order to, when used with -C, determine when it's time
1004  * optimization, also know whether the descriptor is open append-only
1013  *	   using it, so that Capsicum-capable tcpdump wouldn't need to do
1068 		dst[-1] = ' ';  in copy_argv()
1070 	dst[-1] = '\0';  in copy_argv()
1165 		 * It's all-numeric, but is it a valid number?  in parse_interface_number()
1176 		 * It's not all-numeric; return -1, so our caller  in parse_interface_number()
1179 		return (-1);  in parse_interface_number()
1227 		host_url = malloc(endp - url + 1);  in find_interface_by_number()
1228 		if (host_url == NULL && (endp - url + 1) > 0)  in find_interface_by_number()
1231 		memcpy(host_url, url, endp - url);  in find_interface_by_number()
1232 		host_url[endp - url] = '\0';  in find_interface_by_number()
1241 	 * Look for the devnum-th entry in the list of devices (1-based).  in find_interface_by_number()
1243 	for (i = 0, dev = devlist; i < devnum-1 && dev != NULL;  in find_interface_by_number()
1244 	    i++, dev = dev->next)  in find_interface_by_number()
1251 	device = strdup(dev->name);  in find_interface_by_number()
1278 	if (strncmp(device, rpcap_prefix, sizeof(rpcap_prefix) - 1) == 0 ||  in open_interface()
1279 	    strncmp(device, rpcap_ssl_prefix, sizeof(rpcap_ssl_prefix) - 1) == 0) {  in open_interface()
1284 		pc = pcap_open(device, ndo->ndo_snaplen,  in open_interface()
1324 	status = pcap_set_tstamp_precision(pc, ndo->ndo_tstamp_precision);  in open_interface()
1328 		    tstamp_precision_to_string(ndo->ndo_tstamp_precision),  in open_interface()
1347 	if (ndo->ndo_snaplen != 0) {  in open_interface()
1352 		status = pcap_set_snaplen(pc, ndo->ndo_snaplen);  in open_interface()
1378 	if (jflag != -1) {  in open_interface()
1422 			newdev[strlen(newdev)-1]++;  in open_interface()
1452 	if (Qflag != -1) {  in open_interface()
1465 	if (ndo->ndo_snaplen == 0)  in open_interface()
1466 		ndo->ndo_snaplen = MAXIMUM_SNAPLEN;  in open_interface()
1467 	pc = pcap_open_live(device, ndo->ndo_snaplen, !pflag, timeout, ebuf);  in open_interface()
1521 	int yflag_dlt = -1;  in main()
1531 	if (nd_init(ebuf, sizeof(ebuf)) == -1)  in main()
1537 	cnt = -1;  in main()
1544 	dlt = -1;  in main()
1546 		ndo->program_name = program_name = cp + 1;  in main()
1548 		ndo->program_name = program_name = argv[0];  in main()
1576 	    (op = getopt_long(argc, argv, SHORTOPTS, longopts, NULL)) != -1)  in main()
1580 			/* compatibility for old -a */  in main()
1584 			++ndo->ndo_Aflag;  in main()
1588 			++ndo->ndo_bflag;  in main()
1648 			++ndo->ndo_eflag;  in main()
1655 			ndo->ndo_espsecret = optarg;  in main()
1659 			++ndo->ndo_fflag;  in main()
1675 			if ((Gflag_time = time(NULL)) == (time_t)-1) {  in main()
1687 			++ndo->ndo_Hflag;  in main()
1719 			 * XXX - this should really be checking for MSVC++,  in main()
1721 			 * C library that is more UNIX-compatible.  in main()
1735 			++ndo->ndo_Kflag;  in main()
1740 				if (nd_load_smi_module(optarg, ebuf, sizeof(ebuf)) == -1)  in main()
1743 				(void)fprintf(stderr, "%s: ignoring option '-m %s' ",  in main()
1750 			/* TCP-MD5 shared secret */  in main()
1754 			ndo->ndo_sigsecret = optarg;  in main()
1758 			++ndo->ndo_nflag;  in main()
1762 			++ndo->ndo_Nflag;  in main()
1774 			++ndo->ndo_qflag;  in main()
1775 			++ndo->ndo_suppress_default_print;  in main()
1796 			ndo->ndo_snaplen = (int)strtol(optarg, &end, 0);  in main()
1798 			    || ndo->ndo_snaplen < 0 || ndo->ndo_snaplen > MAXIMUM_SNAPLEN)  in main()
1804 			++ndo->ndo_Sflag;  in main()
1808 			++ndo->ndo_tflag;  in main()
1813 				ndo->ndo_packettype = PT_VAT;  in main()
1815 				ndo->ndo_packettype = PT_WB;  in main()
1817 				ndo->ndo_packettype = PT_RPC;  in main()
1819 				ndo->ndo_packettype = PT_RTP;  in main()
1821 				ndo->ndo_packettype = PT_RTCP;  in main()
1823 				ndo->ndo_packettype = PT_SNMP;  in main()
1825 				ndo->ndo_packettype = PT_CNFP;  in main()
1827 				ndo->ndo_packettype = PT_TFTP;  in main()
1829 				ndo->ndo_packettype = PT_AODV;  in main()
1831 				ndo->ndo_packettype = PT_CARP;  in main()
1833 				ndo->ndo_packettype = PT_RADIUS;  in main()
1835 				ndo->ndo_packettype = PT_ZMTP1;  in main()
1837 				ndo->ndo_packettype = PT_VXLAN;  in main()
1839 				ndo->ndo_packettype = PT_PGM;  in main()
1841 				ndo->ndo_packettype = PT_PGM_ZMTP1;  in main()
1843 				ndo->ndo_packettype = PT_LMP;  in main()
1845 				ndo->ndo_packettype = PT_RESP;  in main()
1847 				ndo->ndo_packettype = PT_PTP;  in main()
1849 				ndo->ndo_packettype = PT_SOMEIP;  in main()
1851 				ndo->ndo_packettype = PT_DOMAIN;  in main()
1857 			++ndo->ndo_uflag;  in main()
1867 			++ndo->ndo_vflag;  in main()
1886 			++ndo->ndo_xflag;  in main()
1887 			++ndo->ndo_suppress_default_print;  in main()
1891 			++ndo->ndo_Xflag;  in main()
1892 			++ndo->ndo_suppress_default_print;  in main()
1920 			ndo->ndo_packet_number = 1;  in main()
1930 			ndo->ndo_tstamp_precision = tstamp_precision_from_string(optarg);  in main()
1931 			if (ndo->ndo_tstamp_precision < 0)  in main()
1948 			ndo->ndo_tstamp_precision = PCAP_TSTAMP_PRECISION_MICRO;  in main()
1952 			ndo->ndo_tstamp_precision = PCAP_TSTAMP_PRECISION_NANO;  in main()
1958 			 * Print out the type of floating-point arithmetic  in main()
1961 			 * may differ (e.g., it might be 32-bit, 64-bit,  in main()
1962 			 * or 80-bit).  in main()
1986 	switch (ndo->ndo_tflag) {  in main()
1997 		error("only -t, -tt, -ttt, -tttt and -ttttt are supported");  in main()
2001 	if (ndo->ndo_fflag != 0 && (VFileName != NULL || RFileName != NULL))  in main()
2002 		error("-f can not be used with -V or -r");  in main()
2005 		error("-V and -r are mutually exclusive.");  in main()
2014 	 * XXX - would there be some value appropriate for all cases,  in main()
2023 		/* future extensibility for cmd-line arguments */  in main()
2032 		/* Run with '-Z root' to restore old behaviour */  in main()
2042 		 * If RFileName is non-null, it's the pathname of a  in main()
2043 		 * savefile to read.  If VFileName is non-null, it's  in main()
2052 		 * We don't need network access, so relinquish any set-UID  in main()
2053 		 * or set-GID privileges we have (if any).  in main()
2055 		 * We do *not* want set-UID privileges when opening a  in main()
2057 		 * people's trace files (especially if we're set-UID  in main()
2064 			if (VFileName[0] == '-' && VFileName[1] == '\0')  in main()
2080 		    ndo->ndo_tstamp_precision, ebuf);  in main()
2098 			fprintf(stderr, ", link-type %u", dlt);  in main()
2100 			fprintf(stderr, ", link-type %s (%s)", dlt_name,  in main()
2115 		 * the user-specified value if supplied.  in main()
2121 		if (ndo->ndo_snaplen == 0)  in main()
2122 			ndo->ndo_snaplen = MAXIMUM_SNAPLEN;  in main()
2124 		 * If a DLT was specified with the -y flag, use that instead.  in main()
2126 		if (yflag_dlt != -1)  in main()
2130 	        pd = pcap_open_dead(dump_dlt, ndo->ndo_snaplen);  in main()
2144 			if (pcap_findalldevs(&devlist, ebuf) == -1)  in main()
2148 			device = strdup(devlist->name);  in main()
2170 			 * a 1-based index in the list of  in main()
2175 			if (devnum == -1) {  in main()
2214 			if(pcap_setbuff(pd, Bflag)==-1){  in main()
2248 			 * on; this may be a non-Linux "any" device  in main()
2259 		if (ndo->ndo_snaplen < i) {  in main()
2260 			if (ndo->ndo_snaplen != 0)  in main()
2261 				warning("snaplen raised from %d to %d", ndo->ndo_snaplen, i);  in main()
2262 			ndo->ndo_snaplen = i;  in main()
2263 		} else if (ndo->ndo_snaplen > i) {  in main()
2264 			warning("snaplen lowered from %d to %d", ndo->ndo_snaplen, i);  in main()
2265 			ndo->ndo_snaplen = i;  in main()
2267                 if(ndo->ndo_fflag != 0) {  in main()
2269                                 warning("foreign (-f) flag used but: %s", ebuf);  in main()
2293 	if (!ndo->ndo_nflag)  in main()
2311 	 * generate a -Wstrict-prototypes warning here, see [1].  The  in main()
2329 	 * If a user name was specified with "-Z", attempt to switch to  in main()
2334 	 * you'd make tcpdump set-UID or set-GID).  in main()
2337 	 * the general only way to allow a -Z instance to write to  in main()
2339 	 * than as the user specified with -Z, would thus be to switch  in main()
2341 	 * then switch back to the -Z user ID after opening the savefile.  in main()
2342 	 * Switching to the -Z user ID only after opening the first  in main()
2357 				-1);  in main()
2390 	if (RFileName == NULL && VFileName == NULL && pcap_fileno(pd) != -1) {  in main()
2425 		 * Only allow it to be restored if the -C or -G flag have been  in main()
2507 			ndo->ndo_if_printer = get_if_printer(dlt);  in main()
2518 		ndo->ndo_if_printer = get_if_printer(dlt);  in main()
2535 	if (ndo->ndo_vflag > 0 && WFileName && RFileName == NULL && !print) {  in main()
2537 		 * When capturing to a file, if "--print" wasn't specified,  in main()
2538 		 *"-v" means tcpdump should, once per second,  in main()
2540 		 * Except when reading from a file, because -r, -w and -v  in main()
2546 		 * https://blogs.msdn.microsoft.com/oldnewthing/20151230-00/?p=92741  in main()
2574 		 * Live capture (if -V was specified, we set RFileName  in main()
2575 		 * to a file from the -V file).  Print a message to  in main()
2578 		if (!ndo->ndo_vflag && !WFileName) {  in main()
2580 			    "%s: verbose output suppressed, use -v[v]... for full protocol decode\n",  in main()
2588 			(void)fprintf(stderr, ", link-type %u", dlt);  in main()
2590 			(void)fprintf(stderr, ", link-type %s (%s)", dlt_name,  in main()
2593 		(void)fprintf(stderr, ", snapshot length %d bytes\n", ndo->ndo_snaplen);  in main()
2599 	    ndo->ndo_espsecret == NULL);  in main()
2601 	cansandbox = (cansandbox && (ndo->ndo_nflag || capdns != NULL));  in main()
2603 	cansandbox = (cansandbox && ndo->ndo_nflag);  in main()
2605 	cansandbox = (cansandbox && (pcap_fileno(pd) != -1 ||  in main()
2619 			if (status == -2) {  in main()
2629                 if (status == -2) {  in main()
2632 			 * files (via -V) set these so that we stop.  in main()
2637 		if (status == -1) {  in main()
2672 					 * link-layer header type from the  in main()
2681 						 * different link-layer  in main()
2698 					ndo->ndo_if_printer = get_if_printer(dlt);  in main()
2717 					fprintf(stderr, ", link-type %u", dlt);  in main()
2719 					fprintf(stderr, ", link-type %s (%s)",  in main()
2735 	exit_tcpdump(status == -1 ? S_ERR_HOST_PROGRAM : S_SUCCESS);  in main()
2742 (*setsignal (int sig, void (*func)(int)))(int)  in setsignal()  argument
2745 	return (signal(sig, func));  in setsignal()
2751 	if ((sig == SIGCHLD)  in setsignal()
2753 		|| (sig == SIGNAL_REQ_INFO)  in setsignal()
2756 		|| (sig == SIGNAL_FLUSH_PCAP)  in setsignal()
2760 	if (sigaction(sig, &new, &old) < 0)  in setsignal()
2797 	 * to do anything with standard I/O streams in a signal handler -  in cleanup()
2805 	 * not reading from a savefile - i.e., if we're doing a  in cleanup()
2806 	 * live capture - and exit.  in cleanup()
2830   while (waitpid(-1, NULL, WNOHANG) >= 0);  in child_cleanup()
2891 	if (child == -1) {  in compress_savefile()
2907 	setpriority(PRIO_PROCESS, 0, NZERO - 1);  in compress_savefile()
2911 	if (execlp(zflag, zflag, filename, (char *)NULL) == -1)  in compress_savefile()
2944 	 * XXX - this won't force the file to rotate on the specified time  in dump_packet_and_trunc()
2956 		if ((t = time(NULL)) == (time_t)-1) {  in dump_packet_and_trunc()
2963 		if (t - Gflag_time >= Gflag) {  in dump_packet_and_trunc()
2976 			pcap_dump_close(dump_info->pdd);  in dump_packet_and_trunc()
2982 				compress_savefile(dump_info->CurrentFileName);  in dump_packet_and_trunc()
2995 			if (dump_info->CurrentFileName != NULL)  in dump_packet_and_trunc()
2996 				free(dump_info->CurrentFileName);  in dump_packet_and_trunc()
2998 			dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1);  in dump_packet_and_trunc()
2999 			if (dump_info->CurrentFileName == NULL)  in dump_packet_and_trunc()
3004 			 * The counting is handled with the -C flow after this.  in dump_packet_and_trunc()
3014 				MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0,  in dump_packet_and_trunc()
3017 				MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 0);  in dump_packet_and_trunc()
3024 			fd = openat(dump_info->dirfd,  in dump_packet_and_trunc()
3025 			    dump_info->CurrentFileName,  in dump_packet_and_trunc()
3029 				    dump_info->CurrentFileName);  in dump_packet_and_trunc()
3034 				    dump_info->CurrentFileName);  in dump_packet_and_trunc()
3036 			dump_info->pdd = pcap_dump_fopen(dump_info->pd, fp);  in dump_packet_and_trunc()
3038 			dump_info->pdd = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);  in dump_packet_and_trunc()
3044 			if (dump_info->pdd == NULL)  in dump_packet_and_trunc()
3047 			set_dumper_capsicum_rights(dump_info->pdd);  in dump_packet_and_trunc()
3053 	 * XXX - this won't prevent capture files from getting  in dump_packet_and_trunc()
3054 	 * larger than Cflag - the last packet written to the  in dump_packet_and_trunc()
3059 		int64_t size = pcap_dump_ftell64(dump_info->pdd);  in dump_packet_and_trunc()
3062 		 * XXX - this only handles a Cflag value > 2^31-1 on  in dump_packet_and_trunc()
3063 		 * LP64 platforms; to handle ILP32 (32-bit UN*X and  in dump_packet_and_trunc()
3064 		 * Windows) or LLP64 (64-bit Windows) would require  in dump_packet_and_trunc()
3067 		long size = pcap_dump_ftell(dump_info->pdd);  in dump_packet_and_trunc()
3070 		if (size == -1)  in dump_packet_and_trunc()
3081 			pcap_dump_close(dump_info->pdd);  in dump_packet_and_trunc()
3088 				compress_savefile(dump_info->CurrentFileName);  in dump_packet_and_trunc()
3095 			if (dump_info->CurrentFileName != NULL)  in dump_packet_and_trunc()
3096 				free(dump_info->CurrentFileName);  in dump_packet_and_trunc()
3097 			dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1);  in dump_packet_and_trunc()
3098 			if (dump_info->CurrentFileName == NULL)  in dump_packet_and_trunc()
3100 			MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars);  in dump_packet_and_trunc()
3106 			fd = openat(dump_info->dirfd, dump_info->CurrentFileName,  in dump_packet_and_trunc()
3110 				    dump_info->CurrentFileName);  in dump_packet_and_trunc()
3115 				    dump_info->CurrentFileName);  in dump_packet_and_trunc()
3117 			dump_info->pdd = pcap_dump_fopen(dump_info->pd, fp);  in dump_packet_and_trunc()
3119 			dump_info->pdd = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);  in dump_packet_and_trunc()
3125 			if (dump_info->pdd == NULL)  in dump_packet_and_trunc()
3128 			set_dumper_capsicum_rights(dump_info->pdd);  in dump_packet_and_trunc()
3133 	pcap_dump((u_char *)dump_info->pdd, h, sp);  in dump_packet_and_trunc()
3136 		pcap_dump_flush(dump_info->pdd);  in dump_packet_and_trunc()
3139 	if (dump_info->ndo != NULL)  in dump_packet_and_trunc()
3140 		pretty_print_packet(dump_info->ndo, h, sp, packets_captured);  in dump_packet_and_trunc()
3142 	--infodelay;  in dump_packet_and_trunc()
3158 	pcap_dump((u_char *)dump_info->pdd, h, sp);  in dump_packet()
3161 		pcap_dump_flush(dump_info->pdd);  in dump_packet()
3164 	if (dump_info->ndo != NULL)  in dump_packet()
3165 		pretty_print_packet(dump_info->ndo, h, sp, packets_captured);  in dump_packet()
3167 	--infodelay;  in dump_packet()
3182 	--infodelay;  in print_packet()
3229 static void verbose_stats_dump(int sig _U_)  in verbose_stats_dump()
3261 		(void)fprintf (f, "SMI-library: %s\n", smi_version_string);  in print_version()
3272 	(void)fprintf (f, "%zu-bit build, %zu-bit time_t\n",  in print_version()
3282 "Usage: %s [-Abd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c coun…  in print_usage()
3284 "\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n");  in print_usage()
3286 "\t\t[ -i interface ]" IMMEDIATE_MODE_USAGE j_FLAG_USAGE "\n");  in print_usage()
3296 "\t\t[ -M secret ] [ --number ] [ --print ]" Q_FLAG_USAGE "\n");  in print_usage()
3298 "\t\t[ -r file ] [ -s snaplen ] [ -T type ] [ --version ]\n");  in print_usage()
3300 "\t\t[ -V file ] [ -w file ] [ -W filecount ] [ -y datalinktype ]\n");  in print_usage()
3303 "\t\t[ --time-stamp-precision precision ] [ --micro ] [ --nano ]\n");  in print_usage()
3306 "\t\t[ -z postrotate-command ] [ -Z user ] [ expression ]\n");  in print_usage()