path: root/pcap-linux.c
AgeCommit message (Collapse)AuthorFilesLines
2011-01-10Merge branch 'master' of git://bpf.tcpdump.org/libpcapHEADmasterPatrick McHardy1-53/+77
Conflicts: pcap/bpf.h Signed-off-by: Patrick McHardy <kaber@trash.net>
2010-11-14Libnl 2.x returns its own error codes, not errnos; handle that.Guy Harris1-42/+34
While we're at it, don't special-case ENFILE for "delete monitor device" operations; that's not like "add monitor device", where we want to drive on if a device with that name already exists.
2010-11-13Add support for libnl 2.x, adapted from a newer version of the iw command.Guy Harris1-13/+45
2010-10-15Import pcap-dect-linuxPatrick McHardy1-0/+14
Signed-off-by: Patrick McHardy <kaber@trash.net>
2010-08-23Fixes from Scott Mcmillan.Guy Harris1-2/+2
2010-08-22If the specified time stamp type isn't supported, treat that as a warning.Guy Harris1-57/+146
2010-08-22Add support for setting the time stamp type for a capture.Guy Harris1-9/+116
Based on a patch from Scott Mcmillan <scott.a.mcmillan@intel.com>. (Second part of the commit.)
2010-08-06Fix previous checkin.Guy Harris1-8/+7
2010-08-06Use DLT_IEEE802_15_4_NOFCS for 802.15.4 interfaces.Jon Smirl1-0/+7
Reviewed-By: Guy Harris <guy@alum.mit.edu>
2010-05-18Clean up indentation.Guy Harris1-41/+40
2010-04-27Ignore /sys/net/dev files if we get ENODEV for them, not just ENXIO.andy-11-1/+1
Both of them are indications that there's no such interface, so the file probably corresponds to something other than a device. Reviewed-By: Guy Harris <guy@alum.mit.edu>
2010-01-26Add Myricom SNF API support as a new pcap device.Christian Bell1-0/+16
This patch adds support for our NICs when run in a specialized capture mode. It is diffed against the current master. The Myricom Sniffer10G software uses Myri-10G programmable Network Interface Cards (NICs), a firmware extension, a specialized driver and a user-level library (libsnf) to enable sustained capture of 10-Gigabit Ethernet traffic. Small-packet coalescing and an efficient zero-copy path to host memory allow Sniffer10G to capture streams at line rate for all Ethernet packet sizes. Optionally, libpcap can be used concurrently by multiple processes on a single NIC port to partition the incoming traffic across processes. While the Linux kernel enables this through multiple receive queues, the difference is that the myri_snf driver cooperates with libsnf to set up multiple queues that are each independently accessible through user-space. More information here: http://www.myri.com/scs/SNF/doc Signed-off-by: Guy Harris <guy@alum.mit.edu>
2010-01-10Ignore directories in /sys/class/net.Guy Harris1-0/+6
2010-01-10Correctly handle errors other than problems reading /sys/class/net.Guy Harris1-6/+9
2010-01-10Fix some errors in the previous checkin.Guy Harris1-3/+2
2010-01-10Scan /sys/class/net if we have it.Guy Harris1-8/+144
It's a bit easier to scan than /proc/net/dev, as it's a directory.
2010-01-10On Linux, always at least try to scan /proc/net/dev.Guy Harris1-4/+0
If we fail to open it, we just drive on, so it's not a fatal error; yes, it'll slow us down a little, but it's probably not much, and most Linux kernels probably have it in any case.
2010-01-09Include <ctype.h>, as we use macros from it.Guy Harris1-4/+5
Also, use isascii() to avoid surprises from characters with the 8th bit set, rather than playing signed vs. unsigned character games.
2010-01-09Scan /proc/net/dev on Linux regardless of how we get the interface list.Guy Harris1-0/+170
It's a Linuxism, so it's not necessary on other platforms, and is useful even if we have getifaddrs().
2009-12-29Add support for CANbus capture.Felix Obenhuber1-0/+16
Signed-off-by: Guy Harris <guy@alum.mit.edu>
2009-10-12Fix typo^Wbraino.Guy Harris1-1/+1
2009-10-12In pcap_read_linux_mmap(), if there are no frames available, call poll()Guy Harris1-14/+19
even if we're in non-blocking mode, to pick up any error indications - in that case, use a timeout of 0, so poll() doesn't block. Don't test individual exceptional-condition bits in the poll() return unless one of them is set, so we just do one test in the typical (no exceptional condition) case.
2009-10-11If we get POLLERR when polling a socket in memory-mapped mode, do aGuy Harris1-4/+31
recv() on the socket to get the error code.
2009-10-02Fix typo.Guy Harris1-1/+1
2009-10-11When reading from a BPF device, if we get ENXIO, which means "The deviceGuy Harris1-15/+58
went down" on at least some OSes, return a message indicating that. When reading from a Linux PF_PACKET socket, if we get ENETDOWN, which means "The device went down", return a message indicating that. When doing a poll() on a PF_PACKET socket, check for various "something happened on this, but it's not readable" conditions.
2009-09-21Copy the right value to the ps_ifdrop statistic.Guy Harris1-1/+1
2009-09-07Note some other ways to get link statistics.Guy Harris1-1/+8
2009-09-07Note that we might not get an interface drop count from /proc/net/dev.Guy Harris1-1/+2
2009-09-07From Dustin Spicuzza: support ps_ifdrop on Linux, using /proc/net/dev.Guy Harris1-1/+83
Fix the title of the pcap_stats man page, and give more detail - and a lot of caveats.
2009-07-30The pcap_activate() man page says:Guy Harris1-0/+2
If PCAP_WARNING_PROMISC_NOTSUP, PCAP_ERROR_NO_SUCH_DEVICE, or PCAP_ERROR_PERM_DENIED is returned, pcap_geterr() or pcap_perror() may be called with p as an argument to fetch or display an message giving additional details about the problem that might be useful for debugging the problem if it's unexpected. but we weren't always setting the error string in question. Do so. In pcap_open_live(), if the open fails with PCAP_ERROR, include the device name in the error string, and if it fails with PCAP_ERROR_NO_SUCH_DEVICE or PCAP_ERROR_PERM_DENIED, include the device name and both error messages in the error string.
2009-07-24Get rid of unused variable.Guy Harris1-1/+0
2009-07-22From Peter Volkov:Guy Harris1-1/+1
Fix typo pkt_for_oneshot is not difined anywhere, but oneshot_userdata is.
2009-07-16Fix typo.Guy Harris1-2/+2
2009-07-16When doing Linux mmapped capture:Guy Harris1-29/+117
Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-15From Dustin Spicuzza:Guy Harris1-6/+16
- Fixed bug where create_ring would fail for particular snaplen and buffer size combinations - Changed ring allocation to retry with 5% less buffer size instead of 50%
2009-07-11Get rid of an assigned-to-but-unused variable.Guy Harris1-2/+1
2009-07-11For Linux, add to the pcap_md structure a pointer to a memory-mappedGuy Harris1-28/+21
region and the size of the region; use that pointer rather than the bp or buffer member (that means we don't have to worry about pcap_cleanup_live_common() attempting to free that buffer). Use the saved size when unmapping the memory-mapped region. Use that for Linux USB memory-mapped access as well - and unmap the memory-mapped region when we close the pcap_t, because we *do* have to unmap it.
2009-07-06In memory-mapped mode, when turning non-blocking mode on when it's off,Guy Harris1-3/+18
map all non-negative timeouts, including 0, to negative values, so that, even with no timeout set, non-blocking mode will skip the poll() call.
2009-07-04Squelch some compile warnings with older Linux kernels.Guy Harris1-2/+2
2009-07-03Not releasing a packet in Linux memory-mapped mode until we try to readGuy Harris1-60/+17
the next packet breaks select(). Back those changes out; we'll have to fix the behavior of pcap_next* by making a copy of the packet.
2009-07-02If HAVE_PACKET_AUXDATA isn't defined, don't declare a variable that'sGuy Harris1-1/+4
used only if HAVE_PACKET_AUXDATA is defined.
2009-06-01Move some more stuff up before the first use.Guy Harris1-197/+193
2009-06-01Move up the definition of get_mac80211_phydev() before all its uses.Guy Harris1-201/+201
2009-06-01When checking whether a device will let you turn monitor mode on, assumeGuy Harris1-60/+82
mac80211 devices will, regardless of whether they support the Wireless Extensions - wmaster devices will let you turn monitor mode on but don't appear to support the Wireless Extensions. Support turning on monitor mode with libnl even if we don't have support for the Wireless Extensions, just in case the Wireless Extensions go away at some point in the future if every 802.11 device has a mac80211 driver.
2009-05-22To put mac80211 devices in monitor mode, create a "monN" device for theGuy Harris1-17/+550
underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-04-07From a quick look at the hostap driver, it appears that newer versionsGuy Harris1-16/+30
support the Radiotap header.
2009-03-25Don't return PCAP_WARNING if mmapped capturing isn't supported.Guy Harris1-0/+1
2009-03-25prev_pkt is in the pcap_md structure, not the pcap_t structure itself.Guy Harris1-5/+5
2009-03-25Move "union thdr" to pcap-int.h, as we use it in pcap-int.h.Guy Harris1-6/+0
2009-03-23In memory-mapped mode, don't release the packet as soon as the callbackGuy Harris1-11/+60
finishes processing the packet; in some cases, such as pcap_next() and pcap_next_ex(), the packet data is expected to be available after the callback returns, and only discarded when the next packet is read.