xref: /freebsd/contrib/tcpdump/tcpdump.c (revision ddd5b8e9b4d8957fce018c520657cdfa4ecffad3)
1 /*
2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that: (1) source code distributions
7  * retain the above copyright notice and this paragraph in its entirety, (2)
8  * distributions including binary code include the above copyright notice and
9  * this paragraph in its entirety in the documentation or other materials
10  * provided with the distribution, and (3) all advertising materials mentioning
11  * features or use of this software display the following acknowledgement:
12  * ``This product includes software developed by the University of California,
13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14  * the University nor the names of its contributors may be used to endorse
15  * or promote products derived from this software without specific prior
16  * written permission.
17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20  *
21  * Support for splitting captures into multiple files with a maximum
22  * file size:
23  *
24  * Copyright (c) 2001
25  *	Seth Webster <swebster@sst.ll.mit.edu>
26  */
27 
28 #ifndef lint
29 static const char copyright[] _U_ =
30     "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\
31 The Regents of the University of California.  All rights reserved.\n";
32 static const char rcsid[] _U_ =
33     "@(#) $Header: /tcpdump/master/tcpdump/tcpdump.c,v 1.283 2008-09-25 21:45:50 guy Exp $ (LBL)";
34 #endif
35 
36 /* $FreeBSD$ */
37 
38 /*
39  * tcpdump - monitor tcp/ip traffic on an ethernet.
40  *
41  * First written in 1987 by Van Jacobson, Lawrence Berkeley Laboratory.
42  * Mercilessly hacked and occasionally improved since then via the
43  * combined efforts of Van, Steve McCanne and Craig Leres of LBL.
44  */
45 
46 #ifdef HAVE_CONFIG_H
47 #include "config.h"
48 #endif
49 
50 #include <tcpdump-stdinc.h>
51 
52 #ifdef WIN32
53 #include "getopt.h"
54 #include "w32_fzs.h"
55 extern int strcasecmp (const char *__s1, const char *__s2);
56 extern int SIZE_BUF;
57 #define off_t long
58 #define uint UINT
59 #endif /* WIN32 */
60 
61 #ifdef HAVE_SMI_H
62 #include <smi.h>
63 #endif
64 
65 #include <pcap.h>
66 #include <signal.h>
67 #include <stdio.h>
68 #include <stdlib.h>
69 #include <string.h>
70 #include <limits.h>
71 #ifndef WIN32
72 #include <sys/wait.h>
73 #include <sys/resource.h>
74 #include <pwd.h>
75 #include <grp.h>
76 #include <errno.h>
77 #endif /* WIN32 */
78 
79 
80 #include "netdissect.h"
81 #include "interface.h"
82 #include "addrtoname.h"
83 #include "machdep.h"
84 #include "setsignal.h"
85 #include "gmt2local.h"
86 #include "pcap-missing.h"
87 
88 #ifndef NAME_MAX
89 #define NAME_MAX 255
90 #endif
91 
92 #ifdef SIGINFO
93 #define SIGNAL_REQ_INFO SIGINFO
94 #elif SIGUSR1
95 #define SIGNAL_REQ_INFO SIGUSR1
96 #endif
97 
98 netdissect_options Gndo;
99 netdissect_options *gndo = &Gndo;
100 
101 static int dflag;			/* print filter code */
102 static int Lflag;			/* list available data link types and exit */
103 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
104 static int Jflag;			/* list available time stamp types */
105 #endif
106 static char *zflag = NULL;		/* compress each savefile using a specified command (like gzip or bzip2) */
107 
108 static int infodelay;
109 static int infoprint;
110 
111 char *program_name;
112 
113 int32_t thiszone;		/* seconds offset from gmt to local time */
114 
115 /* Forwards */
116 static RETSIGTYPE cleanup(int);
117 static RETSIGTYPE child_cleanup(int);
118 static void usage(void) __attribute__((noreturn));
119 static void show_dlts_and_exit(const char *device, pcap_t *pd) __attribute__((noreturn));
120 
121 static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
122 static void ndo_default_print(netdissect_options *, const u_char *, u_int);
123 static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *);
124 static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
125 static void droproot(const char *, const char *);
126 static void ndo_error(netdissect_options *ndo, const char *fmt, ...)
127      __attribute__ ((noreturn, format (printf, 2, 3)));
128 static void ndo_warning(netdissect_options *ndo, const char *fmt, ...);
129 
130 #ifdef SIGNAL_REQ_INFO
131 RETSIGTYPE requestinfo(int);
132 #endif
133 
134 #if defined(USE_WIN32_MM_TIMER)
135   #include <MMsystem.h>
136   static UINT timer_id;
137   static void CALLBACK verbose_stats_dump(UINT, UINT, DWORD_PTR, DWORD_PTR, DWORD_PTR);
138 #elif defined(HAVE_ALARM)
139   static void verbose_stats_dump(int sig);
140 #endif
141 
142 static void info(int);
143 static u_int packets_captured;
144 
145 struct printer {
146         if_printer f;
147 	int type;
148 };
149 
150 
151 struct ndo_printer {
152         if_ndo_printer f;
153 	int type;
154 };
155 
156 
157 static struct printer printers[] = {
158 	{ arcnet_if_print,	DLT_ARCNET },
159 #ifdef DLT_ARCNET_LINUX
160 	{ arcnet_linux_if_print, DLT_ARCNET_LINUX },
161 #endif
162 	{ token_if_print,	DLT_IEEE802 },
163 #ifdef DLT_LANE8023
164 	{ lane_if_print,        DLT_LANE8023 },
165 #endif
166 #ifdef DLT_CIP
167 	{ cip_if_print,         DLT_CIP },
168 #endif
169 #ifdef DLT_ATM_CLIP
170 	{ cip_if_print,		DLT_ATM_CLIP },
171 #endif
172 	{ sl_if_print,		DLT_SLIP },
173 #ifdef DLT_SLIP_BSDOS
174 	{ sl_bsdos_if_print,	DLT_SLIP_BSDOS },
175 #endif
176 	{ ppp_if_print,		DLT_PPP },
177 #ifdef DLT_PPP_WITHDIRECTION
178 	{ ppp_if_print,		DLT_PPP_WITHDIRECTION },
179 #endif
180 #ifdef DLT_PPP_BSDOS
181 	{ ppp_bsdos_if_print,	DLT_PPP_BSDOS },
182 #endif
183 	{ fddi_if_print,	DLT_FDDI },
184 	{ null_if_print,	DLT_NULL },
185 #ifdef DLT_LOOP
186 	{ null_if_print,	DLT_LOOP },
187 #endif
188 	{ raw_if_print,		DLT_RAW },
189 	{ atm_if_print,		DLT_ATM_RFC1483 },
190 #ifdef DLT_C_HDLC
191 	{ chdlc_if_print,	DLT_C_HDLC },
192 #endif
193 #ifdef DLT_HDLC
194 	{ chdlc_if_print,	DLT_HDLC },
195 #endif
196 #ifdef DLT_PPP_SERIAL
197 	{ ppp_hdlc_if_print,	DLT_PPP_SERIAL },
198 #endif
199 #ifdef DLT_PPP_ETHER
200 	{ pppoe_if_print,	DLT_PPP_ETHER },
201 #endif
202 #ifdef DLT_LINUX_SLL
203 	{ sll_if_print,		DLT_LINUX_SLL },
204 #endif
205 #ifdef DLT_IEEE802_11
206 	{ ieee802_11_if_print,	DLT_IEEE802_11},
207 #endif
208 #ifdef DLT_LTALK
209 	{ ltalk_if_print,	DLT_LTALK },
210 #endif
211 #if defined(DLT_PFLOG) && defined(HAVE_NET_PFVAR_H)
212 	{ pflog_if_print,	DLT_PFLOG },
213 #endif
214 #ifdef DLT_FR
215 	{ fr_if_print,		DLT_FR },
216 #endif
217 #ifdef DLT_FRELAY
218 	{ fr_if_print,		DLT_FRELAY },
219 #endif
220 #ifdef DLT_SUNATM
221 	{ sunatm_if_print,	DLT_SUNATM },
222 #endif
223 #ifdef DLT_IP_OVER_FC
224 	{ ipfc_if_print,	DLT_IP_OVER_FC },
225 #endif
226 #ifdef DLT_PRISM_HEADER
227 	{ prism_if_print,	DLT_PRISM_HEADER },
228 #endif
229 #ifdef DLT_IEEE802_11_RADIO
230 	{ ieee802_11_radio_if_print,	DLT_IEEE802_11_RADIO },
231 #endif
232 #ifdef DLT_ENC
233 	{ enc_if_print,		DLT_ENC },
234 #endif
235 #ifdef DLT_SYMANTEC_FIREWALL
236 	{ symantec_if_print,	DLT_SYMANTEC_FIREWALL },
237 #endif
238 #ifdef DLT_APPLE_IP_OVER_IEEE1394
239 	{ ap1394_if_print,	DLT_APPLE_IP_OVER_IEEE1394 },
240 #endif
241 #ifdef DLT_IEEE802_11_RADIO_AVS
242 	{ ieee802_11_radio_avs_if_print,	DLT_IEEE802_11_RADIO_AVS },
243 #endif
244 #ifdef DLT_JUNIPER_ATM1
245 	{ juniper_atm1_print,	DLT_JUNIPER_ATM1 },
246 #endif
247 #ifdef DLT_JUNIPER_ATM2
248 	{ juniper_atm2_print,	DLT_JUNIPER_ATM2 },
249 #endif
250 #ifdef DLT_JUNIPER_MFR
251 	{ juniper_mfr_print,	DLT_JUNIPER_MFR },
252 #endif
253 #ifdef DLT_JUNIPER_MLFR
254 	{ juniper_mlfr_print,	DLT_JUNIPER_MLFR },
255 #endif
256 #ifdef DLT_JUNIPER_MLPPP
257 	{ juniper_mlppp_print,	DLT_JUNIPER_MLPPP },
258 #endif
259 #ifdef DLT_JUNIPER_PPPOE
260 	{ juniper_pppoe_print,	DLT_JUNIPER_PPPOE },
261 #endif
262 #ifdef DLT_JUNIPER_PPPOE_ATM
263 	{ juniper_pppoe_atm_print, DLT_JUNIPER_PPPOE_ATM },
264 #endif
265 #ifdef DLT_JUNIPER_GGSN
266 	{ juniper_ggsn_print,	DLT_JUNIPER_GGSN },
267 #endif
268 #ifdef DLT_JUNIPER_ES
269 	{ juniper_es_print,	DLT_JUNIPER_ES },
270 #endif
271 #ifdef DLT_JUNIPER_MONITOR
272 	{ juniper_monitor_print, DLT_JUNIPER_MONITOR },
273 #endif
274 #ifdef DLT_JUNIPER_SERVICES
275 	{ juniper_services_print, DLT_JUNIPER_SERVICES },
276 #endif
277 #ifdef DLT_JUNIPER_ETHER
278 	{ juniper_ether_print,	DLT_JUNIPER_ETHER },
279 #endif
280 #ifdef DLT_JUNIPER_PPP
281 	{ juniper_ppp_print,	DLT_JUNIPER_PPP },
282 #endif
283 #ifdef DLT_JUNIPER_FRELAY
284 	{ juniper_frelay_print,	DLT_JUNIPER_FRELAY },
285 #endif
286 #ifdef DLT_JUNIPER_CHDLC
287 	{ juniper_chdlc_print,	DLT_JUNIPER_CHDLC },
288 #endif
289 #ifdef DLT_MFR
290 	{ mfr_if_print,		DLT_MFR },
291 #endif
292 #if defined(DLT_BLUETOOTH_HCI_H4_WITH_PHDR) && defined(HAVE_PCAP_BLUETOOTH_H)
293 	{ bt_if_print,		DLT_BLUETOOTH_HCI_H4_WITH_PHDR},
294 #endif
295 #ifdef HAVE_PCAP_USB_H
296 #ifdef DLT_USB_LINUX
297 	{ usb_linux_48_byte_print, DLT_USB_LINUX},
298 #endif /* DLT_USB_LINUX */
299 #ifdef DLT_USB_LINUX_MMAPPED
300 	{ usb_linux_64_byte_print, DLT_USB_LINUX_MMAPPED},
301 #endif /* DLT_USB_LINUX_MMAPPED */
302 #endif /* HAVE_PCAP_USB_H */
303 #ifdef DLT_IPV4
304 	{ raw_if_print,		DLT_IPV4 },
305 #endif
306 #ifdef DLT_IPV6
307 	{ raw_if_print,		DLT_IPV6 },
308 #endif
309 	{ NULL,			0 },
310 };
311 
312 static struct ndo_printer ndo_printers[] = {
313 	{ ether_if_print,	DLT_EN10MB },
314 #ifdef DLT_IPNET
315 	{ ipnet_if_print,	DLT_IPNET },
316 #endif
317 #ifdef DLT_IEEE802_15_4
318 	{ ieee802_15_4_if_print, DLT_IEEE802_15_4 },
319 #endif
320 #ifdef DLT_IEEE802_15_4_NOFCS
321 	{ ieee802_15_4_if_print, DLT_IEEE802_15_4_NOFCS },
322 #endif
323 #ifdef DLT_PPI
324 	{ ppi_if_print,		DLT_PPI },
325 #endif
326 #ifdef DLT_NETANALYZER
327 	{ netanalyzer_if_print, DLT_NETANALYZER },
328 #endif
329 #ifdef DLT_NETANALYZER_TRANSPARENT
330 	{ netanalyzer_transparent_if_print, DLT_NETANALYZER_TRANSPARENT },
331 #endif
332 	{ NULL,			0 },
333 };
334 
335 if_printer
336 lookup_printer(int type)
337 {
338 	struct printer *p;
339 
340 	for (p = printers; p->f; ++p)
341 		if (type == p->type)
342 			return p->f;
343 
344 	return NULL;
345 	/* NOTREACHED */
346 }
347 
348 if_ndo_printer
349 lookup_ndo_printer(int type)
350 {
351 	struct ndo_printer *p;
352 
353 	for (p = ndo_printers; p->f; ++p)
354 		if (type == p->type)
355 			return p->f;
356 
357 	return NULL;
358 	/* NOTREACHED */
359 }
360 
361 static pcap_t *pd;
362 
363 static int supports_monitor_mode;
364 
365 extern int optind;
366 extern int opterr;
367 extern char *optarg;
368 
369 struct print_info {
370         netdissect_options *ndo;
371         union {
372                 if_printer     printer;
373                 if_ndo_printer ndo_printer;
374         } p;
375         int ndo_type;
376 };
377 
378 struct dump_info {
379 	char	*WFileName;
380 	char	*CurrentFileName;
381 	pcap_t	*pd;
382 	pcap_dumper_t *p;
383 };
384 
385 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
386 static void
387 show_tstamp_types_and_exit(const char *device, pcap_t *pd)
388 {
389 	int n_tstamp_types;
390 	int *tstamp_types = 0;
391 	const char *tstamp_type_name;
392 	int i;
393 
394 	n_tstamp_types = pcap_list_tstamp_types(pd, &tstamp_types);
395 	if (n_tstamp_types < 0)
396 		error("%s", pcap_geterr(pd));
397 
398 	if (n_tstamp_types == 0) {
399 		fprintf(stderr, "Time stamp type cannot be set for %s\n",
400 		    device);
401 		exit(0);
402 	}
403 	fprintf(stderr, "Time stamp types for %s (use option -j to set):\n",
404 	    device);
405 	for (i = 0; i < n_tstamp_types; i++) {
406 		tstamp_type_name = pcap_tstamp_type_val_to_name(tstamp_types[i]);
407 		if (tstamp_type_name != NULL) {
408 			(void) fprintf(stderr, "  %s (%s)\n", tstamp_type_name,
409 			    pcap_tstamp_type_val_to_description(tstamp_types[i]));
410 		} else {
411 			(void) fprintf(stderr, "  %d\n", tstamp_types[i]);
412 		}
413 	}
414 	pcap_free_tstamp_types(tstamp_types);
415 	exit(0);
416 }
417 #endif
418 
419 static void
420 show_dlts_and_exit(const char *device, pcap_t *pd)
421 {
422 	int n_dlts;
423 	int *dlts = 0;
424 	const char *dlt_name;
425 
426 	n_dlts = pcap_list_datalinks(pd, &dlts);
427 	if (n_dlts < 0)
428 		error("%s", pcap_geterr(pd));
429 	else if (n_dlts == 0 || !dlts)
430 		error("No data link types.");
431 
432 	/*
433 	 * If the interface is known to support monitor mode, indicate
434 	 * whether these are the data link types available when not in
435 	 * monitor mode, if -I wasn't specified, or when in monitor mode,
436 	 * when -I was specified (the link-layer types available in
437 	 * monitor mode might be different from the ones available when
438 	 * not in monitor mode).
439 	 */
440 	if (supports_monitor_mode)
441 		(void) fprintf(stderr, "Data link types for %s %s (use option -y to set):\n",
442 		    device,
443 		    Iflag ? "when in monitor mode" : "when not in monitor mode");
444 	else
445 		(void) fprintf(stderr, "Data link types for %s (use option -y to set):\n",
446 		    device);
447 
448 	while (--n_dlts >= 0) {
449 		dlt_name = pcap_datalink_val_to_name(dlts[n_dlts]);
450 		if (dlt_name != NULL) {
451 			(void) fprintf(stderr, "  %s (%s)", dlt_name,
452 			    pcap_datalink_val_to_description(dlts[n_dlts]));
453 
454 			/*
455 			 * OK, does tcpdump handle that type?
456 			 */
457 			if (lookup_printer(dlts[n_dlts]) == NULL
458                             && lookup_ndo_printer(dlts[n_dlts]) == NULL)
459 				(void) fprintf(stderr, " (printing not supported)");
460 			fprintf(stderr, "\n");
461 		} else {
462 			(void) fprintf(stderr, "  DLT %d (printing not supported)\n",
463 			    dlts[n_dlts]);
464 		}
465 	}
466 	pcap_free_datalinks(dlts);
467 	exit(0);
468 }
469 
470 /*
471  * Set up flags that might or might not be supported depending on the
472  * version of libpcap we're using.
473  */
474 #if defined(HAVE_PCAP_CREATE) || defined(WIN32)
475 #define B_FLAG		"B:"
476 #define B_FLAG_USAGE	" [ -B size ]"
477 #else /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */
478 #define B_FLAG
479 #define B_FLAG_USAGE
480 #endif /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */
481 
482 #ifdef HAVE_PCAP_CREATE
483 #define I_FLAG		"I"
484 #else /* HAVE_PCAP_CREATE */
485 #define I_FLAG
486 #endif /* HAVE_PCAP_CREATE */
487 
488 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
489 #define j_FLAG		"j:"
490 #define j_FLAG_USAGE	" [ -j tstamptype ]"
491 #define J_FLAG		"J"
492 #else /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */
493 #define j_FLAG
494 #define j_FLAG_USAGE
495 #define J_FLAG
496 #endif /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */
497 
498 #ifdef HAVE_PCAP_FINDALLDEVS
499 #ifndef HAVE_PCAP_IF_T
500 #undef HAVE_PCAP_FINDALLDEVS
501 #endif
502 #endif
503 
504 #ifdef HAVE_PCAP_FINDALLDEVS
505 #define D_FLAG	"D"
506 #else
507 #define D_FLAG
508 #endif
509 
510 #ifdef HAVE_PCAP_DUMP_FLUSH
511 #define U_FLAG	"U"
512 #else
513 #define U_FLAG
514 #endif
515 
516 #ifndef WIN32
517 /* Drop root privileges and chroot if necessary */
518 static void
519 droproot(const char *username, const char *chroot_dir)
520 {
521 	struct passwd *pw = NULL;
522 
523 	if (chroot_dir && !username) {
524 		fprintf(stderr, "tcpdump: Chroot without dropping root is insecure\n");
525 		exit(1);
526 	}
527 
528 	pw = getpwnam(username);
529 	if (pw) {
530 		if (chroot_dir) {
531 			if (chroot(chroot_dir) != 0 || chdir ("/") != 0) {
532 				fprintf(stderr, "tcpdump: Couldn't chroot/chdir to '%.64s': %s\n",
533 				    chroot_dir, pcap_strerror(errno));
534 				exit(1);
535 			}
536 		}
537 		if (initgroups(pw->pw_name, pw->pw_gid) != 0 ||
538 		    setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0) {
539 			fprintf(stderr, "tcpdump: Couldn't change to '%.32s' uid=%lu gid=%lu: %s\n",
540 			    username,
541 			    (unsigned long)pw->pw_uid,
542 			    (unsigned long)pw->pw_gid,
543 			    pcap_strerror(errno));
544 			exit(1);
545 		}
546 	}
547 	else {
548 		fprintf(stderr, "tcpdump: Couldn't find user '%.32s'\n",
549 		    username);
550 		exit(1);
551 	}
552 }
553 #endif /* WIN32 */
554 
555 static int
556 getWflagChars(int x)
557 {
558 	int c = 0;
559 
560 	x -= 1;
561 	while (x > 0) {
562 		c += 1;
563 		x /= 10;
564 	}
565 
566 	return c;
567 }
568 
569 
570 static void
571 MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars)
572 {
573         char *filename = malloc(NAME_MAX + 1);
574 
575         /* Process with strftime if Gflag is set. */
576         if (Gflag != 0) {
577           struct tm *local_tm;
578 
579           /* Convert Gflag_time to a usable format */
580           if ((local_tm = localtime(&Gflag_time)) == NULL) {
581                   error("MakeTimedFilename: localtime");
582           }
583 
584           /* There's no good way to detect an error in strftime since a return
585            * value of 0 isn't necessarily failure.
586            */
587           strftime(filename, NAME_MAX, orig_name, local_tm);
588         } else {
589           strncpy(filename, orig_name, NAME_MAX);
590         }
591 
592 	if (cnt == 0 && max_chars == 0)
593 		strncpy(buffer, filename, NAME_MAX + 1);
594 	else
595 		if (snprintf(buffer, NAME_MAX + 1, "%s%0*d", filename, max_chars, cnt) > NAME_MAX)
596                   /* Report an error if the filename is too large */
597                   error("too many output files or filename is too long (> %d)", NAME_MAX);
598         free(filename);
599 }
600 
601 static int tcpdump_printf(netdissect_options *ndo _U_,
602 			  const char *fmt, ...)
603 {
604 
605   va_list args;
606   int ret;
607 
608   va_start(args, fmt);
609   ret=vfprintf(stdout, fmt, args);
610   va_end(args);
611 
612   return ret;
613 }
614 
615 int
616 main(int argc, char **argv)
617 {
618 	register int cnt, op, i;
619 	bpf_u_int32 localnet, netmask;
620 	register char *cp, *infile, *cmdbuf, *device, *RFileName, *WFileName;
621 	pcap_handler callback;
622 	int type;
623 	struct bpf_program fcode;
624 #ifndef WIN32
625 	RETSIGTYPE (*oldhandler)(int);
626 #endif
627 	struct print_info printinfo;
628 	struct dump_info dumpinfo;
629 	u_char *pcap_userdata;
630 	char ebuf[PCAP_ERRBUF_SIZE];
631 	char *username = NULL;
632 	char *chroot_dir = NULL;
633 #ifdef HAVE_PCAP_FINDALLDEVS
634 	pcap_if_t *devpointer;
635 	int devnum;
636 #endif
637 	int status;
638 #ifdef WIN32
639 	if(wsockinit() != 0) return 1;
640 #endif /* WIN32 */
641 
642 	jflag=-1;	/* not set */
643         gndo->ndo_Oflag=1;
644 	gndo->ndo_Rflag=1;
645 	gndo->ndo_dlt=-1;
646 	gndo->ndo_default_print=ndo_default_print;
647 	gndo->ndo_printf=tcpdump_printf;
648 	gndo->ndo_error=ndo_error;
649 	gndo->ndo_warning=ndo_warning;
650 	gndo->ndo_snaplen = DEFAULT_SNAPLEN;
651 
652 	cnt = -1;
653 	device = NULL;
654 	infile = NULL;
655 	RFileName = NULL;
656 	WFileName = NULL;
657 	if ((cp = strrchr(argv[0], '/')) != NULL)
658 		program_name = cp + 1;
659 	else
660 		program_name = argv[0];
661 
662 	if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0)
663 		error("%s", ebuf);
664 
665 #ifdef LIBSMI
666 	smiInit("tcpdump");
667 #endif
668 
669 	while (
670 	    (op = getopt(argc, argv, "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpqr:Rs:StT:u" U_FLAG "vw:W:xXy:Yz:Z:")) != -1)
671 		switch (op) {
672 
673 		case 'a':
674 			/* compatibility for old -a */
675 			break;
676 
677 		case 'A':
678 			++Aflag;
679 			break;
680 
681 		case 'b':
682 			++bflag;
683 			break;
684 
685 #if defined(HAVE_PCAP_CREATE) || defined(WIN32)
686 		case 'B':
687 			Bflag = atoi(optarg)*1024;
688 			if (Bflag <= 0)
689 				error("invalid packet buffer size %s", optarg);
690 			break;
691 #endif /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */
692 
693 		case 'c':
694 			cnt = atoi(optarg);
695 			if (cnt <= 0)
696 				error("invalid packet count %s", optarg);
697 			break;
698 
699 		case 'C':
700 			Cflag = atoi(optarg) * 1000000;
701 			if (Cflag < 0)
702 				error("invalid file size %s", optarg);
703 			break;
704 
705 		case 'd':
706 			++dflag;
707 			break;
708 
709 #ifdef HAVE_PCAP_FINDALLDEVS
710 		case 'D':
711 			if (pcap_findalldevs(&devpointer, ebuf) < 0)
712 				error("%s", ebuf);
713 			else {
714 				for (i = 0; devpointer != 0; i++) {
715 					printf("%d.%s", i+1, devpointer->name);
716 					if (devpointer->description != NULL)
717 						printf(" (%s)", devpointer->description);
718 					printf("\n");
719 					devpointer = devpointer->next;
720 				}
721 			}
722 			return 0;
723 #endif /* HAVE_PCAP_FINDALLDEVS */
724 
725 		case 'L':
726 			Lflag++;
727 			break;
728 
729 		case 'e':
730 			++eflag;
731 			break;
732 
733 		case 'E':
734 #ifndef HAVE_LIBCRYPTO
735 			warning("crypto code not compiled in");
736 #endif
737 			gndo->ndo_espsecret = optarg;
738 			break;
739 
740 		case 'f':
741 			++fflag;
742 			break;
743 
744 		case 'F':
745 			infile = optarg;
746 			break;
747 
748 		case 'G':
749 			Gflag = atoi(optarg);
750 			if (Gflag < 0)
751 				error("invalid number of seconds %s", optarg);
752 
753                         /* We will create one file initially. */
754                         Gflag_count = 0;
755 
756 			/* Grab the current time for rotation use. */
757 			if ((Gflag_time = time(NULL)) == (time_t)-1) {
758 				error("main: can't get current time: %s",
759 				    pcap_strerror(errno));
760 			}
761 			break;
762 
763 		case 'h':
764 			usage();
765 			break;
766 
767 		case 'H':
768 			++Hflag;
769 			break;
770 
771 		case 'i':
772 			if (optarg[0] == '0' && optarg[1] == 0)
773 				error("Invalid adapter index");
774 
775 #ifdef HAVE_PCAP_FINDALLDEVS
776 			/*
777 			 * If the argument is a number, treat it as
778 			 * an index into the list of adapters, as
779 			 * printed by "tcpdump -D".
780 			 *
781 			 * This should be OK on UNIX systems, as interfaces
782 			 * shouldn't have names that begin with digits.
783 			 * It can be useful on Windows, where more than
784 			 * one interface can have the same name.
785 			 */
786 			if ((devnum = atoi(optarg)) != 0) {
787 				if (devnum < 0)
788 					error("Invalid adapter index");
789 
790 				if (pcap_findalldevs(&devpointer, ebuf) < 0)
791 					error("%s", ebuf);
792 				else {
793 					/*
794 					 * Look for the devnum-th entry
795 					 * in the list of devices
796 					 * (1-based).
797 					 */
798 					for (i = 0;
799 					    i < devnum-1 && devpointer != NULL;
800 					    i++, devpointer = devpointer->next)
801 						;
802 					if (devpointer == NULL)
803 						error("Invalid adapter index");
804 				}
805 				device = devpointer->name;
806 				break;
807 			}
808 #endif /* HAVE_PCAP_FINDALLDEVS */
809 			device = optarg;
810 			break;
811 
812 #ifdef HAVE_PCAP_CREATE
813 		case 'I':
814 			++Iflag;
815 			break;
816 #endif /* HAVE_PCAP_CREATE */
817 
818 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
819 		case 'j':
820 			jflag = pcap_tstamp_type_name_to_val(optarg);
821 			if (jflag < 0)
822 				error("invalid time stamp type %s", optarg);
823 			break;
824 
825 		case 'J':
826 			Jflag++;
827 			break;
828 #endif
829 
830 		case 'l':
831 #ifdef WIN32
832 			/*
833 			 * _IOLBF is the same as _IOFBF in Microsoft's C
834 			 * libraries; the only alternative they offer
835 			 * is _IONBF.
836 			 *
837 			 * XXX - this should really be checking for MSVC++,
838 			 * not WIN32, if, for example, MinGW has its own
839 			 * C library that is more UNIX-compatible.
840 			 */
841 			setvbuf(stdout, NULL, _IONBF, 0);
842 #else /* WIN32 */
843 #ifdef HAVE_SETLINEBUF
844 			setlinebuf(stdout);
845 #else
846 			setvbuf(stdout, NULL, _IOLBF, 0);
847 #endif
848 #endif /* WIN32 */
849 			break;
850 
851 		case 'K':
852 			++Kflag;
853 			break;
854 
855 		case 'm':
856 #ifdef LIBSMI
857 			if (smiLoadModule(optarg) == 0) {
858 				error("could not load MIB module %s", optarg);
859 			}
860 			sflag = 1;
861 #else
862 			(void)fprintf(stderr, "%s: ignoring option `-m %s' ",
863 				      program_name, optarg);
864 			(void)fprintf(stderr, "(no libsmi support)\n");
865 #endif
866 			break;
867 
868 		case 'M':
869 			/* TCP-MD5 shared secret */
870 #ifndef HAVE_LIBCRYPTO
871 			warning("crypto code not compiled in");
872 #endif
873 			sigsecret = optarg;
874 			break;
875 
876 		case 'n':
877 			++nflag;
878 			break;
879 
880 		case 'N':
881 			++Nflag;
882 			break;
883 
884 		case 'O':
885 			Oflag = 0;
886 			break;
887 
888 		case 'p':
889 			++pflag;
890 			break;
891 
892 		case 'q':
893 			++qflag;
894 			++suppress_default_print;
895 			break;
896 
897 		case 'r':
898 			RFileName = optarg;
899 			break;
900 
901 		case 'R':
902 			Rflag = 0;
903 			break;
904 
905 		case 's': {
906 			char *end;
907 
908 			snaplen = strtol(optarg, &end, 0);
909 			if (optarg == end || *end != '\0'
910 			    || snaplen < 0 || snaplen > MAXIMUM_SNAPLEN)
911 				error("invalid snaplen %s", optarg);
912 			else if (snaplen == 0)
913 				snaplen = MAXIMUM_SNAPLEN;
914 			break;
915 		}
916 
917 		case 'S':
918 			++Sflag;
919 			break;
920 
921 		case 't':
922 			++tflag;
923 			break;
924 
925 		case 'T':
926 			if (strcasecmp(optarg, "vat") == 0)
927 				packettype = PT_VAT;
928 			else if (strcasecmp(optarg, "wb") == 0)
929 				packettype = PT_WB;
930 			else if (strcasecmp(optarg, "rpc") == 0)
931 				packettype = PT_RPC;
932 			else if (strcasecmp(optarg, "rtp") == 0)
933 				packettype = PT_RTP;
934 			else if (strcasecmp(optarg, "rtcp") == 0)
935 				packettype = PT_RTCP;
936 			else if (strcasecmp(optarg, "snmp") == 0)
937 				packettype = PT_SNMP;
938 			else if (strcasecmp(optarg, "cnfp") == 0)
939 				packettype = PT_CNFP;
940 			else if (strcasecmp(optarg, "tftp") == 0)
941 				packettype = PT_TFTP;
942 			else if (strcasecmp(optarg, "aodv") == 0)
943 				packettype = PT_AODV;
944 			else if (strcasecmp(optarg, "carp") == 0)
945 				packettype = PT_CARP;
946 			else
947 				error("unknown packet type `%s'", optarg);
948 			break;
949 
950 		case 'u':
951 			++uflag;
952 			break;
953 
954 #ifdef HAVE_PCAP_DUMP_FLUSH
955 		case 'U':
956 			++Uflag;
957 			break;
958 #endif
959 
960 		case 'v':
961 			++vflag;
962 			break;
963 
964 		case 'w':
965 			WFileName = optarg;
966 			break;
967 
968 		case 'W':
969 			Wflag = atoi(optarg);
970 			if (Wflag < 0)
971 				error("invalid number of output files %s", optarg);
972 			WflagChars = getWflagChars(Wflag);
973 			break;
974 
975 		case 'x':
976 			++xflag;
977 			++suppress_default_print;
978 			break;
979 
980 		case 'X':
981 			++Xflag;
982 			++suppress_default_print;
983 			break;
984 
985 		case 'y':
986 			gndo->ndo_dltname = optarg;
987 			gndo->ndo_dlt =
988 			  pcap_datalink_name_to_val(gndo->ndo_dltname);
989 			if (gndo->ndo_dlt < 0)
990 				error("invalid data link type %s", gndo->ndo_dltname);
991 			break;
992 
993 #if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG)
994 		case 'Y':
995 			{
996 			/* Undocumented flag */
997 #ifdef HAVE_PCAP_DEBUG
998 			extern int pcap_debug;
999 			pcap_debug = 1;
1000 #else
1001 			extern int yydebug;
1002 			yydebug = 1;
1003 #endif
1004 			}
1005 			break;
1006 #endif
1007 		case 'z':
1008 			if (optarg) {
1009 				zflag = strdup(optarg);
1010 			} else {
1011 				usage();
1012 				/* NOTREACHED */
1013 			}
1014 			break;
1015 
1016 		case 'Z':
1017 			if (optarg) {
1018 				username = strdup(optarg);
1019 			}
1020 			else {
1021 				usage();
1022 				/* NOTREACHED */
1023 			}
1024 			break;
1025 
1026 		default:
1027 			usage();
1028 			/* NOTREACHED */
1029 		}
1030 
1031 	switch (tflag) {
1032 
1033 	case 0: /* Default */
1034 	case 4: /* Default + Date*/
1035 		thiszone = gmt2local(0);
1036 		break;
1037 
1038 	case 1: /* No time stamp */
1039 	case 2: /* Unix timeval style */
1040 	case 3: /* Microseconds since previous packet */
1041         case 5: /* Microseconds since first packet */
1042 		break;
1043 
1044 	default: /* Not supported */
1045 		error("only -t, -tt, -ttt, -tttt and -ttttt are supported");
1046 		break;
1047 	}
1048 
1049 #ifdef WITH_CHROOT
1050 	/* if run as root, prepare for chrooting */
1051 	if (getuid() == 0 || geteuid() == 0) {
1052 		/* future extensibility for cmd-line arguments */
1053 		if (!chroot_dir)
1054 			chroot_dir = WITH_CHROOT;
1055 	}
1056 #endif
1057 
1058 #ifdef WITH_USER
1059 	/* if run as root, prepare for dropping root privileges */
1060 	if (getuid() == 0 || geteuid() == 0) {
1061 		/* Run with '-Z root' to restore old behaviour */
1062 		if (!username)
1063 			username = WITH_USER;
1064 	}
1065 #endif
1066 
1067 	if (RFileName != NULL) {
1068 		int dlt;
1069 		const char *dlt_name;
1070 
1071 #ifndef WIN32
1072 		/*
1073 		 * We don't need network access, so relinquish any set-UID
1074 		 * or set-GID privileges we have (if any).
1075 		 *
1076 		 * We do *not* want set-UID privileges when opening a
1077 		 * trace file, as that might let the user read other
1078 		 * people's trace files (especially if we're set-UID
1079 		 * root).
1080 		 */
1081 		if (setgid(getgid()) != 0 || setuid(getuid()) != 0 )
1082 			fprintf(stderr, "Warning: setgid/setuid failed !\n");
1083 #endif /* WIN32 */
1084 		pd = pcap_open_offline(RFileName, ebuf);
1085 		if (pd == NULL)
1086 			error("%s", ebuf);
1087 		dlt = pcap_datalink(pd);
1088 		dlt_name = pcap_datalink_val_to_name(dlt);
1089 		if (dlt_name == NULL) {
1090 			fprintf(stderr, "reading from file %s, link-type %u\n",
1091 			    RFileName, dlt);
1092 		} else {
1093 			fprintf(stderr,
1094 			    "reading from file %s, link-type %s (%s)\n",
1095 			    RFileName, dlt_name,
1096 			    pcap_datalink_val_to_description(dlt));
1097 		}
1098 		localnet = 0;
1099 		netmask = 0;
1100 		if (fflag != 0)
1101 			error("-f and -r options are incompatible");
1102 	} else {
1103 		if (device == NULL) {
1104 			device = pcap_lookupdev(ebuf);
1105 			if (device == NULL)
1106 				error("%s", ebuf);
1107 		}
1108 #ifdef WIN32
1109 		if(strlen(device) == 1)	//we assume that an ASCII string is always longer than 1 char
1110 		{						//a Unicode string has a \0 as second byte (so strlen() is 1)
1111 			fprintf(stderr, "%s: listening on %ws\n", program_name, device);
1112 		}
1113 		else
1114 		{
1115 			fprintf(stderr, "%s: listening on %s\n", program_name, device);
1116 		}
1117 
1118 		fflush(stderr);
1119 #endif /* WIN32 */
1120 #ifdef HAVE_PCAP_CREATE
1121 		pd = pcap_create(device, ebuf);
1122 		if (pd == NULL)
1123 			error("%s", ebuf);
1124 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1125 		if (Jflag)
1126 			show_tstamp_types_and_exit(device, pd);
1127 #endif
1128 		/*
1129 		 * Is this an interface that supports monitor mode?
1130 		 */
1131 		if (pcap_can_set_rfmon(pd) == 1)
1132 			supports_monitor_mode = 1;
1133 		else
1134 			supports_monitor_mode = 0;
1135 		status = pcap_set_snaplen(pd, snaplen);
1136 		if (status != 0)
1137 			error("%s: Can't set snapshot length: %s",
1138 			    device, pcap_statustostr(status));
1139 		status = pcap_set_promisc(pd, !pflag);
1140 		if (status != 0)
1141 			error("%s: Can't set promiscuous mode: %s",
1142 			    device, pcap_statustostr(status));
1143 		if (Iflag) {
1144 			status = pcap_set_rfmon(pd, 1);
1145 			if (status != 0)
1146 				error("%s: Can't set monitor mode: %s",
1147 				    device, pcap_statustostr(status));
1148 		}
1149 		status = pcap_set_timeout(pd, 1000);
1150 		if (status != 0)
1151 			error("%s: pcap_set_timeout failed: %s",
1152 			    device, pcap_statustostr(status));
1153 		if (Bflag != 0) {
1154 			status = pcap_set_buffer_size(pd, Bflag);
1155 			if (status != 0)
1156 				error("%s: Can't set buffer size: %s",
1157 				    device, pcap_statustostr(status));
1158 		}
1159 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1160                 if (jflag != -1) {
1161 			status = pcap_set_tstamp_type(pd, jflag);
1162 			if (status < 0)
1163 				error("%s: Can't set time stamp type: %s",
1164 			    	    device, pcap_statustostr(status));
1165 		}
1166 #endif
1167 		status = pcap_activate(pd);
1168 		if (status < 0) {
1169 			/*
1170 			 * pcap_activate() failed.
1171 			 */
1172 			cp = pcap_geterr(pd);
1173 			if (status == PCAP_ERROR)
1174 				error("%s", cp);
1175 			else if ((status == PCAP_ERROR_NO_SUCH_DEVICE ||
1176 			          status == PCAP_ERROR_PERM_DENIED) &&
1177 			         *cp != '\0')
1178 				error("%s: %s\n(%s)", device,
1179 				    pcap_statustostr(status), cp);
1180 			else
1181 				error("%s: %s", device,
1182 				    pcap_statustostr(status));
1183 		} else if (status > 0) {
1184 			/*
1185 			 * pcap_activate() succeeded, but it's warning us
1186 			 * of a problem it had.
1187 			 */
1188 			cp = pcap_geterr(pd);
1189 			if (status == PCAP_WARNING)
1190 				warning("%s", cp);
1191 			else if (status == PCAP_WARNING_PROMISC_NOTSUP &&
1192 			         *cp != '\0')
1193 				warning("%s: %s\n(%s)", device,
1194 				    pcap_statustostr(status), cp);
1195 			else
1196 				warning("%s: %s", device,
1197 				    pcap_statustostr(status));
1198 		}
1199 #else
1200 		*ebuf = '\0';
1201 		pd = pcap_open_live(device, snaplen, !pflag, 1000, ebuf);
1202 		if (pd == NULL)
1203 			error("%s", ebuf);
1204 		else if (*ebuf)
1205 			warning("%s", ebuf);
1206 #endif /* HAVE_PCAP_CREATE */
1207 		/*
1208 		 * Let user own process after socket has been opened.
1209 		 */
1210 #ifndef WIN32
1211 		if (setgid(getgid()) != 0 || setuid(getuid()) != 0)
1212 			fprintf(stderr, "Warning: setgid/setuid failed !\n");
1213 #endif /* WIN32 */
1214 #if !defined(HAVE_PCAP_CREATE) && defined(WIN32)
1215 		if(Bflag != 0)
1216 			if(pcap_setbuff(pd, Bflag)==-1){
1217 				error("%s", pcap_geterr(pd));
1218 			}
1219 #endif /* !defined(HAVE_PCAP_CREATE) && defined(WIN32) */
1220 		if (Lflag)
1221 			show_dlts_and_exit(device, pd);
1222 		if (gndo->ndo_dlt >= 0) {
1223 #ifdef HAVE_PCAP_SET_DATALINK
1224 			if (pcap_set_datalink(pd, gndo->ndo_dlt) < 0)
1225 				error("%s", pcap_geterr(pd));
1226 #else
1227 			/*
1228 			 * We don't actually support changing the
1229 			 * data link type, so we only let them
1230 			 * set it to what it already is.
1231 			 */
1232 			if (gndo->ndo_dlt != pcap_datalink(pd)) {
1233 				error("%s is not one of the DLTs supported by this device\n",
1234 				      gndo->ndo_dltname);
1235 			}
1236 #endif
1237 			(void)fprintf(stderr, "%s: data link type %s\n",
1238 				      program_name, gndo->ndo_dltname);
1239 			(void)fflush(stderr);
1240 		}
1241 		i = pcap_snapshot(pd);
1242 		if (snaplen < i) {
1243 			warning("snaplen raised from %d to %d", snaplen, i);
1244 			snaplen = i;
1245 		}
1246 		if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) {
1247 			localnet = 0;
1248 			netmask = 0;
1249 			warning("%s", ebuf);
1250 		}
1251 	}
1252 	if (infile)
1253 		cmdbuf = read_infile(infile);
1254 	else
1255 		cmdbuf = copy_argv(&argv[optind]);
1256 
1257 	if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
1258 		error("%s", pcap_geterr(pd));
1259 	free(cmdbuf);
1260 	if (dflag) {
1261 		bpf_dump(&fcode, dflag);
1262 		pcap_close(pd);
1263 		exit(0);
1264 	}
1265 	init_addrtoname(localnet, netmask);
1266         init_checksum();
1267 
1268 #ifndef WIN32
1269 	(void)setsignal(SIGPIPE, cleanup);
1270 	(void)setsignal(SIGTERM, cleanup);
1271 	(void)setsignal(SIGINT, cleanup);
1272 #endif /* WIN32 */
1273 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
1274 	(void)setsignal(SIGCHLD, child_cleanup);
1275 #endif
1276 	/* Cooperate with nohup(1) */
1277 #ifndef WIN32
1278 	if ((oldhandler = setsignal(SIGHUP, cleanup)) != SIG_DFL)
1279 		(void)setsignal(SIGHUP, oldhandler);
1280 #endif /* WIN32 */
1281 
1282 #ifndef WIN32
1283 	/*
1284 	 * If a user name was specified with "-Z", attempt to switch to
1285 	 * that user's UID.  This would probably be used with sudo,
1286 	 * to allow tcpdump to be run in a special restricted
1287 	 * account (if you just want to allow users to open capture
1288 	 * devices, and can't just give users that permission,
1289 	 * you'd make tcpdump set-UID or set-GID).
1290 	 *
1291 	 * Tcpdump doesn't necessarily write only to one savefile;
1292 	 * the general only way to allow a -Z instance to write to
1293 	 * savefiles as the user under whose UID it's run, rather
1294 	 * than as the user specified with -Z, would thus be to switch
1295 	 * to the original user ID before opening a capture file and
1296 	 * then switch back to the -Z user ID after opening the savefile.
1297 	 * Switching to the -Z user ID only after opening the first
1298 	 * savefile doesn't handle the general case.
1299 	 */
1300 	if (getuid() == 0 || geteuid() == 0) {
1301 		if (username || chroot_dir)
1302 			droproot(username, chroot_dir);
1303 	}
1304 #endif /* WIN32 */
1305 
1306 	if (pcap_setfilter(pd, &fcode) < 0)
1307 		error("%s", pcap_geterr(pd));
1308 	if (WFileName) {
1309 		pcap_dumper_t *p;
1310 		/* Do not exceed the default NAME_MAX for files. */
1311 		dumpinfo.CurrentFileName = (char *)malloc(NAME_MAX + 1);
1312 
1313 		if (dumpinfo.CurrentFileName == NULL)
1314 			error("malloc of dumpinfo.CurrentFileName");
1315 
1316 		/* We do not need numbering for dumpfiles if Cflag isn't set. */
1317 		if (Cflag != 0)
1318 		  MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, WflagChars);
1319 		else
1320 		  MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0);
1321 
1322 		p = pcap_dump_open(pd, dumpinfo.CurrentFileName);
1323 		if (p == NULL)
1324 			error("%s", pcap_geterr(pd));
1325 		if (Cflag != 0 || Gflag != 0) {
1326 			callback = dump_packet_and_trunc;
1327 			dumpinfo.WFileName = WFileName;
1328 			dumpinfo.pd = pd;
1329 			dumpinfo.p = p;
1330 			pcap_userdata = (u_char *)&dumpinfo;
1331 		} else {
1332 			callback = dump_packet;
1333 			pcap_userdata = (u_char *)p;
1334 		}
1335 #ifdef HAVE_PCAP_DUMP_FLUSH
1336 		if (Uflag)
1337 			pcap_dump_flush(p);
1338 #endif
1339 	} else {
1340 		type = pcap_datalink(pd);
1341                 printinfo.ndo_type = 1;
1342                 printinfo.ndo = gndo;
1343 		printinfo.p.ndo_printer = lookup_ndo_printer(type);
1344                 if (printinfo.p.ndo_printer == NULL) {
1345                         printinfo.p.printer = lookup_printer(type);
1346                         printinfo.ndo_type = 0;
1347                         if (printinfo.p.printer == NULL) {
1348                                 gndo->ndo_dltname = pcap_datalink_val_to_name(type);
1349                                 if (gndo->ndo_dltname != NULL)
1350                                         error("packet printing is not supported for link type %s: use -w",
1351                                               gndo->ndo_dltname);
1352                                 else
1353                                         error("packet printing is not supported for link type %d: use -w", type);
1354                         }
1355                 }
1356 		callback = print_packet;
1357 		pcap_userdata = (u_char *)&printinfo;
1358 	}
1359 
1360 #ifdef SIGNAL_REQ_INFO
1361 	/*
1362 	 * We can't get statistics when reading from a file rather
1363 	 * than capturing from a device.
1364 	 */
1365 	if (RFileName == NULL)
1366 		(void)setsignal(SIGNAL_REQ_INFO, requestinfo);
1367 #endif
1368 
1369 	if (vflag > 0 && WFileName) {
1370 		/*
1371 		 * When capturing to a file, "-v" means tcpdump should,
1372 		 * every 10 secodns, "v"erbosely report the number of
1373 		 * packets captured.
1374 		 */
1375 #ifdef USE_WIN32_MM_TIMER
1376 		/* call verbose_stats_dump() each 1000 +/-100msec */
1377 		timer_id = timeSetEvent(1000, 100, verbose_stats_dump, 0, TIME_PERIODIC);
1378 		setvbuf(stderr, NULL, _IONBF, 0);
1379 #elif defined(HAVE_ALARM)
1380 		(void)setsignal(SIGALRM, verbose_stats_dump);
1381 		alarm(1);
1382 #endif
1383 	}
1384 
1385 #ifndef WIN32
1386 	if (RFileName == NULL) {
1387 		int dlt;
1388 		const char *dlt_name;
1389 
1390 		if (!vflag && !WFileName) {
1391 			(void)fprintf(stderr,
1392 			    "%s: verbose output suppressed, use -v or -vv for full protocol decode\n",
1393 			    program_name);
1394 		} else
1395 			(void)fprintf(stderr, "%s: ", program_name);
1396 		dlt = pcap_datalink(pd);
1397 		dlt_name = pcap_datalink_val_to_name(dlt);
1398 		if (dlt_name == NULL) {
1399 			(void)fprintf(stderr, "listening on %s, link-type %u, capture size %u bytes\n",
1400 			    device, dlt, snaplen);
1401 		} else {
1402 			(void)fprintf(stderr, "listening on %s, link-type %s (%s), capture size %u bytes\n",
1403 			    device, dlt_name,
1404 			    pcap_datalink_val_to_description(dlt), snaplen);
1405 		}
1406 		(void)fflush(stderr);
1407 	}
1408 #endif /* WIN32 */
1409 	status = pcap_loop(pd, cnt, callback, pcap_userdata);
1410 	if (WFileName == NULL) {
1411 		/*
1412 		 * We're printing packets.  Flush the printed output,
1413 		 * so it doesn't get intermingled with error output.
1414 		 */
1415 		if (status == -2) {
1416 			/*
1417 			 * We got interrupted, so perhaps we didn't
1418 			 * manage to finish a line we were printing.
1419 			 * Print an extra newline, just in case.
1420 			 */
1421 			putchar('\n');
1422 		}
1423 		(void)fflush(stdout);
1424 	}
1425 	if (status == -1) {
1426 		/*
1427 		 * Error.  Report it.
1428 		 */
1429 		(void)fprintf(stderr, "%s: pcap_loop: %s\n",
1430 		    program_name, pcap_geterr(pd));
1431 	}
1432 	if (RFileName == NULL) {
1433 		/*
1434 		 * We're doing a live capture.  Report the capture
1435 		 * statistics.
1436 		 */
1437 		info(1);
1438 	}
1439 	pcap_close(pd);
1440 	exit(status == -1 ? 1 : 0);
1441 }
1442 
1443 /* make a clean exit on interrupts */
1444 static RETSIGTYPE
1445 cleanup(int signo _U_)
1446 {
1447 #ifdef USE_WIN32_MM_TIMER
1448 	if (timer_id)
1449 		timeKillEvent(timer_id);
1450 	timer_id = 0;
1451 #elif defined(HAVE_ALARM)
1452 	alarm(0);
1453 #endif
1454 
1455 #ifdef HAVE_PCAP_BREAKLOOP
1456 	/*
1457 	 * We have "pcap_breakloop()"; use it, so that we do as little
1458 	 * as possible in the signal handler (it's probably not safe
1459 	 * to do anything with standard I/O streams in a signal handler -
1460 	 * the ANSI C standard doesn't say it is).
1461 	 */
1462 	pcap_breakloop(pd);
1463 #else
1464 	/*
1465 	 * We don't have "pcap_breakloop()"; this isn't safe, but
1466 	 * it's the best we can do.  Print the summary if we're
1467 	 * not reading from a savefile - i.e., if we're doing a
1468 	 * live capture - and exit.
1469 	 */
1470 	if (pd != NULL && pcap_file(pd) == NULL) {
1471 		/*
1472 		 * We got interrupted, so perhaps we didn't
1473 		 * manage to finish a line we were printing.
1474 		 * Print an extra newline, just in case.
1475 		 */
1476 		putchar('\n');
1477 		(void)fflush(stdout);
1478 		info(1);
1479 	}
1480 	exit(0);
1481 #endif
1482 }
1483 
1484 /*
1485   On windows, we do not use a fork, so we do not care less about
1486   waiting a child processes to die
1487  */
1488 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
1489 static RETSIGTYPE
1490 child_cleanup(int signo _U_)
1491 {
1492   wait(NULL);
1493 }
1494 #endif /* HAVE_FORK && HAVE_VFORK */
1495 
1496 static void
1497 info(register int verbose)
1498 {
1499 	struct pcap_stat stat;
1500 
1501 	/*
1502 	 * Older versions of libpcap didn't set ps_ifdrop on some
1503 	 * platforms; initialize it to 0 to handle that.
1504 	 */
1505 	stat.ps_ifdrop = 0;
1506 	if (pcap_stats(pd, &stat) < 0) {
1507 		(void)fprintf(stderr, "pcap_stats: %s\n", pcap_geterr(pd));
1508 		infoprint = 0;
1509 		return;
1510 	}
1511 
1512 	if (!verbose)
1513 		fprintf(stderr, "%s: ", program_name);
1514 
1515 	(void)fprintf(stderr, "%u packet%s captured", packets_captured,
1516 	    PLURAL_SUFFIX(packets_captured));
1517 	if (!verbose)
1518 		fputs(", ", stderr);
1519 	else
1520 		putc('\n', stderr);
1521 	(void)fprintf(stderr, "%u packet%s received by filter", stat.ps_recv,
1522 	    PLURAL_SUFFIX(stat.ps_recv));
1523 	if (!verbose)
1524 		fputs(", ", stderr);
1525 	else
1526 		putc('\n', stderr);
1527 	(void)fprintf(stderr, "%u packet%s dropped by kernel", stat.ps_drop,
1528 	    PLURAL_SUFFIX(stat.ps_drop));
1529 	if (stat.ps_ifdrop != 0) {
1530 		if (!verbose)
1531 			fputs(", ", stderr);
1532 		else
1533 			putc('\n', stderr);
1534 		(void)fprintf(stderr, "%u packet%s dropped by interface\n",
1535 		    stat.ps_ifdrop, PLURAL_SUFFIX(stat.ps_ifdrop));
1536 	} else
1537 		putc('\n', stderr);
1538 	infoprint = 0;
1539 }
1540 
1541 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
1542 static void
1543 compress_savefile(const char *filename)
1544 {
1545 # ifdef HAVE_FORK
1546 	if (fork())
1547 # else
1548 	if (vfork())
1549 # endif
1550 		return;
1551 	/*
1552 	 * Set to lowest priority so that this doesn't disturb the capture
1553 	 */
1554 #ifdef NZERO
1555 	setpriority(PRIO_PROCESS, 0, NZERO - 1);
1556 #else
1557 	setpriority(PRIO_PROCESS, 0, 19);
1558 #endif
1559 	if (execlp(zflag, zflag, filename, (char *)NULL) == -1)
1560 		fprintf(stderr,
1561 			"compress_savefile:execlp(%s, %s): %s\n",
1562 			zflag,
1563 			filename,
1564 			strerror(errno));
1565 # ifdef HAVE_FORK
1566 	exit(1);
1567 # else
1568 	_exit(1);
1569 # endif
1570 }
1571 #else  /* HAVE_FORK && HAVE_VFORK */
1572 static void
1573 compress_savefile(const char *filename)
1574 {
1575 	fprintf(stderr,
1576 		"compress_savefile failed. Functionality not implemented under your system\n");
1577 }
1578 #endif /* HAVE_FORK && HAVE_VFORK */
1579 
1580 static void
1581 dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
1582 {
1583 	struct dump_info *dump_info;
1584 
1585 	++packets_captured;
1586 
1587 	++infodelay;
1588 
1589 	dump_info = (struct dump_info *)user;
1590 
1591 	/*
1592 	 * XXX - this won't force the file to rotate on the specified time
1593 	 * boundary, but it will rotate on the first packet received after the
1594 	 * specified Gflag number of seconds. Note: if a Gflag time boundary
1595 	 * and a Cflag size boundary coincide, the time rotation will occur
1596 	 * first thereby cancelling the Cflag boundary (since the file should
1597 	 * be 0).
1598 	 */
1599 	if (Gflag != 0) {
1600 		/* Check if it is time to rotate */
1601 		time_t t;
1602 
1603 		/* Get the current time */
1604 		if ((t = time(NULL)) == (time_t)-1) {
1605 			error("dump_and_trunc_packet: can't get current_time: %s",
1606 			    pcap_strerror(errno));
1607 		}
1608 
1609 
1610 		/* If the time is greater than the specified window, rotate */
1611 		if (t - Gflag_time >= Gflag) {
1612 			/* Update the Gflag_time */
1613 			Gflag_time = t;
1614 			/* Update Gflag_count */
1615 			Gflag_count++;
1616 			/*
1617 			 * Close the current file and open a new one.
1618 			 */
1619 			pcap_dump_close(dump_info->p);
1620 
1621 			/*
1622 			 * Compress the file we just closed, if the user asked for it
1623 			 */
1624 			if (zflag != NULL)
1625 				compress_savefile(dump_info->CurrentFileName);
1626 
1627 			/*
1628 			 * Check to see if we've exceeded the Wflag (when
1629 			 * not using Cflag).
1630 			 */
1631 			if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) {
1632 				(void)fprintf(stderr, "Maximum file limit reached: %d\n",
1633 				    Wflag);
1634 				exit(0);
1635 				/* NOTREACHED */
1636 			}
1637 			if (dump_info->CurrentFileName != NULL)
1638 				free(dump_info->CurrentFileName);
1639 			/* Allocate space for max filename + \0. */
1640 			dump_info->CurrentFileName = (char *)malloc(NAME_MAX + 1);
1641 			if (dump_info->CurrentFileName == NULL)
1642 				error("dump_packet_and_trunc: malloc");
1643 			/*
1644 			 * This is always the first file in the Cflag
1645 			 * rotation: e.g. 0
1646 			 * We also don't need numbering if Cflag is not set.
1647 			 */
1648 			if (Cflag != 0)
1649 				MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0,
1650 				    WflagChars);
1651 			else
1652 				MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 0);
1653 
1654 			dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
1655 			if (dump_info->p == NULL)
1656 				error("%s", pcap_geterr(pd));
1657 		}
1658 	}
1659 
1660 	/*
1661 	 * XXX - this won't prevent capture files from getting
1662 	 * larger than Cflag - the last packet written to the
1663 	 * file could put it over Cflag.
1664 	 */
1665 	if (Cflag != 0 && pcap_dump_ftell(dump_info->p) > Cflag) {
1666 		/*
1667 		 * Close the current file and open a new one.
1668 		 */
1669 		pcap_dump_close(dump_info->p);
1670 
1671 		/*
1672 		 * Compress the file we just closed, if the user asked for it
1673 		 */
1674 		if (zflag != NULL)
1675 			compress_savefile(dump_info->CurrentFileName);
1676 
1677 		Cflag_count++;
1678 		if (Wflag > 0) {
1679 			if (Cflag_count >= Wflag)
1680 				Cflag_count = 0;
1681 		}
1682 		if (dump_info->CurrentFileName != NULL)
1683 			free(dump_info->CurrentFileName);
1684 		dump_info->CurrentFileName = (char *)malloc(NAME_MAX + 1);
1685 		if (dump_info->CurrentFileName == NULL)
1686 			error("dump_packet_and_trunc: malloc");
1687 		MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars);
1688 		dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
1689 		if (dump_info->p == NULL)
1690 			error("%s", pcap_geterr(pd));
1691 	}
1692 
1693 	pcap_dump((u_char *)dump_info->p, h, sp);
1694 #ifdef HAVE_PCAP_DUMP_FLUSH
1695 	if (Uflag)
1696 		pcap_dump_flush(dump_info->p);
1697 #endif
1698 
1699 	--infodelay;
1700 	if (infoprint)
1701 		info(0);
1702 }
1703 
1704 static void
1705 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
1706 {
1707 	++packets_captured;
1708 
1709 	++infodelay;
1710 
1711 	pcap_dump(user, h, sp);
1712 #ifdef HAVE_PCAP_DUMP_FLUSH
1713 	if (Uflag)
1714 		pcap_dump_flush((pcap_dumper_t *)user);
1715 #endif
1716 
1717 	--infodelay;
1718 	if (infoprint)
1719 		info(0);
1720 }
1721 
1722 static void
1723 print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
1724 {
1725 	struct print_info *print_info;
1726 	u_int hdrlen;
1727 
1728 	++packets_captured;
1729 
1730 	++infodelay;
1731 	ts_print(&h->ts);
1732 
1733 	print_info = (struct print_info *)user;
1734 
1735 	/*
1736 	 * Some printers want to check that they're not walking off the
1737 	 * end of the packet.
1738 	 * Rather than pass it all the way down, we set this global.
1739 	 */
1740 	snapend = sp + h->caplen;
1741 
1742         if(print_info->ndo_type) {
1743                 hdrlen = (*print_info->p.ndo_printer)(print_info->ndo, h, sp);
1744         } else {
1745                 hdrlen = (*print_info->p.printer)(h, sp);
1746         }
1747 
1748 	if (Xflag) {
1749 		/*
1750 		 * Print the raw packet data in hex and ASCII.
1751 		 */
1752 		if (Xflag > 1) {
1753 			/*
1754 			 * Include the link-layer header.
1755 			 */
1756 			hex_and_ascii_print("\n\t", sp, h->caplen);
1757 		} else {
1758 			/*
1759 			 * Don't include the link-layer header - and if
1760 			 * we have nothing past the link-layer header,
1761 			 * print nothing.
1762 			 */
1763 			if (h->caplen > hdrlen)
1764 				hex_and_ascii_print("\n\t", sp + hdrlen,
1765 				    h->caplen - hdrlen);
1766 		}
1767 	} else if (xflag) {
1768 		/*
1769 		 * Print the raw packet data in hex.
1770 		 */
1771 		if (xflag > 1) {
1772 			/*
1773 			 * Include the link-layer header.
1774 			 */
1775 			hex_print("\n\t", sp, h->caplen);
1776 		} else {
1777 			/*
1778 			 * Don't include the link-layer header - and if
1779 			 * we have nothing past the link-layer header,
1780 			 * print nothing.
1781 			 */
1782 			if (h->caplen > hdrlen)
1783 				hex_print("\n\t", sp + hdrlen,
1784 				    h->caplen - hdrlen);
1785 		}
1786 	} else if (Aflag) {
1787 		/*
1788 		 * Print the raw packet data in ASCII.
1789 		 */
1790 		if (Aflag > 1) {
1791 			/*
1792 			 * Include the link-layer header.
1793 			 */
1794 			ascii_print(sp, h->caplen);
1795 		} else {
1796 			/*
1797 			 * Don't include the link-layer header - and if
1798 			 * we have nothing past the link-layer header,
1799 			 * print nothing.
1800 			 */
1801 			if (h->caplen > hdrlen)
1802 				ascii_print(sp + hdrlen, h->caplen - hdrlen);
1803 		}
1804 	}
1805 
1806 	putchar('\n');
1807 
1808 	--infodelay;
1809 	if (infoprint)
1810 		info(0);
1811 }
1812 
1813 #ifdef WIN32
1814 	/*
1815 	 * XXX - there should really be libpcap calls to get the version
1816 	 * number as a string (the string would be generated from #defines
1817 	 * at run time, so that it's not generated from string constants
1818 	 * in the library, as, on many UNIX systems, those constants would
1819 	 * be statically linked into the application executable image, and
1820 	 * would thus reflect the version of libpcap on the system on
1821 	 * which the application was *linked*, not the system on which it's
1822 	 * *running*.
1823 	 *
1824 	 * That routine should be documented, unlike the "version[]"
1825 	 * string, so that UNIX vendors providing their own libpcaps
1826 	 * don't omit it (as a couple of vendors have...).
1827 	 *
1828 	 * Packet.dll should perhaps also export a routine to return the
1829 	 * version number of the Packet.dll code, to supply the
1830 	 * "Wpcap_version" information on Windows.
1831 	 */
1832 	char WDversion[]="current-cvs.tcpdump.org";
1833 #if !defined(HAVE_GENERATED_VERSION)
1834 	char version[]="current-cvs.tcpdump.org";
1835 #endif
1836 	char pcap_version[]="current-cvs.tcpdump.org";
1837 	char Wpcap_version[]="3.1";
1838 #endif
1839 
1840 /*
1841  * By default, print the specified data out in hex and ASCII.
1842  */
1843 static void
1844 ndo_default_print(netdissect_options *ndo _U_, const u_char *bp, u_int length)
1845 {
1846 	hex_and_ascii_print("\n\t", bp, length); /* pass on lf and identation string */
1847 }
1848 
1849 void
1850 default_print(const u_char *bp, u_int length)
1851 {
1852 	ndo_default_print(gndo, bp, length);
1853 }
1854 
1855 #ifdef SIGNAL_REQ_INFO
1856 RETSIGTYPE requestinfo(int signo _U_)
1857 {
1858 	if (infodelay)
1859 		++infoprint;
1860 	else
1861 		info(0);
1862 }
1863 #endif
1864 
1865 /*
1866  * Called once each second in verbose mode while dumping to file
1867  */
1868 #ifdef USE_WIN32_MM_TIMER
1869 void CALLBACK verbose_stats_dump (UINT timer_id _U_, UINT msg _U_, DWORD_PTR arg _U_,
1870 				  DWORD_PTR dw1 _U_, DWORD_PTR dw2 _U_)
1871 {
1872 	struct pcap_stat stat;
1873 
1874 	if (infodelay == 0 && pcap_stats(pd, &stat) >= 0)
1875 		fprintf(stderr, "Got %u\r", packets_captured);
1876 }
1877 #elif defined(HAVE_ALARM)
1878 static void verbose_stats_dump(int sig _U_)
1879 {
1880 	struct pcap_stat stat;
1881 
1882 	if (infodelay == 0 && pcap_stats(pd, &stat) >= 0)
1883 		fprintf(stderr, "Got %u\r", packets_captured);
1884 	alarm(1);
1885 }
1886 #endif
1887 
1888 static void
1889 usage(void)
1890 {
1891 	extern char version[];
1892 #ifndef HAVE_PCAP_LIB_VERSION
1893 #if defined(WIN32) || defined(HAVE_PCAP_VERSION)
1894 	extern char pcap_version[];
1895 #else /* defined(WIN32) || defined(HAVE_PCAP_VERSION) */
1896 	static char pcap_version[] = "unknown";
1897 #endif /* defined(WIN32) || defined(HAVE_PCAP_VERSION) */
1898 #endif /* HAVE_PCAP_LIB_VERSION */
1899 
1900 #ifdef HAVE_PCAP_LIB_VERSION
1901 #ifdef WIN32
1902 	(void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version);
1903 #else /* WIN32 */
1904 	(void)fprintf(stderr, "%s version %s\n", program_name, version);
1905 #endif /* WIN32 */
1906 	(void)fprintf(stderr, "%s\n",pcap_lib_version());
1907 #else /* HAVE_PCAP_LIB_VERSION */
1908 #ifdef WIN32
1909 	(void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version);
1910 	(void)fprintf(stderr, "WinPcap version %s, based on libpcap version %s\n",Wpcap_version, pcap_version);
1911 #else /* WIN32 */
1912 	(void)fprintf(stderr, "%s version %s\n", program_name, version);
1913 	(void)fprintf(stderr, "libpcap version %s\n", pcap_version);
1914 #endif /* WIN32 */
1915 #endif /* HAVE_PCAP_LIB_VERSION */
1916 	(void)fprintf(stderr,
1917 "Usage: %s [-aAbd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqRStu" U_FLAG "vxX]" B_FLAG_USAGE " [ -c count ]\n", program_name);
1918 	(void)fprintf(stderr,
1919 "\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n");
1920 	(void)fprintf(stderr,
1921 "\t\t[ -i interface ]" j_FLAG_USAGE " [ -M secret ]\n");
1922 	(void)fprintf(stderr,
1923 "\t\t[ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]\n");
1924 	(void)fprintf(stderr,
1925 "\t\t[ -W filecount ] [ -y datalinktype ] [ -z command ]\n");
1926 	(void)fprintf(stderr,
1927 "\t\t[ -Z user ] [ expression ]\n");
1928 	exit(1);
1929 }
1930 
1931 
1932 
1933 /* VARARGS */
1934 static void
1935 ndo_error(netdissect_options *ndo _U_, const char *fmt, ...)
1936 {
1937 	va_list ap;
1938 
1939 	(void)fprintf(stderr, "%s: ", program_name);
1940 	va_start(ap, fmt);
1941 	(void)vfprintf(stderr, fmt, ap);
1942 	va_end(ap);
1943 	if (*fmt) {
1944 		fmt += strlen(fmt);
1945 		if (fmt[-1] != '\n')
1946 			(void)fputc('\n', stderr);
1947 	}
1948 	exit(1);
1949 	/* NOTREACHED */
1950 }
1951 
1952 /* VARARGS */
1953 static void
1954 ndo_warning(netdissect_options *ndo _U_, const char *fmt, ...)
1955 {
1956 	va_list ap;
1957 
1958 	(void)fprintf(stderr, "%s: WARNING: ", program_name);
1959 	va_start(ap, fmt);
1960 	(void)vfprintf(stderr, fmt, ap);
1961 	va_end(ap);
1962 	if (*fmt) {
1963 		fmt += strlen(fmt);
1964 		if (fmt[-1] != '\n')
1965 			(void)fputc('\n', stderr);
1966 	}
1967 }
1968