CSE2410 Fall 2014 the Passive Aggressors

Extcap Capture Interface

Extcap is a plugin interface, which allows for the usage
 of external capture interfaces via pipes using a predefined
 configuration language which results in a graphical gui.

This implementation seeks for a generic implementation,...

Rename parameter if_index to stop clang warning:

capture_opts.c:1017:61: error: declaration of 'index' shadows a global declaration [-Werror=shadow]

Change-Id: Ie409b4fa7abeb85e460bea398735cdc98d9034b1
Reviewed-on: https://code.wireshark.org/review/3041...

GTK Remote Capturing

Move the GTK files necessary for managing the recnet remote host from capture_dlg.c to recent.c in order to use them in QT, too.

Change-Id: I3f3fd31ce928162de08c6db7309ef2a9b1e97760
Reviewed-on: https://code.wireshark.org/review/2955...

Move utility routines for capturing into a libcaputils static library.

Some of those routines are used only in dumpcap; others are used in
TShark and Wireshark as well.

Change-Id: I9d92483f2fcff57a7d8b6bf6bdf2870505d19fb7
Reviewed-on: https://code.wireshark.org/review/2841...

Move the "capture-comment" long option to LONGOPT_CAPTURE_COMMON.

Change-Id: I55884d48911de307cde52accfebbda69f2989526
Reviewed-on: https://code.wireshark.org/review/2505
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Add long names for -a, -b, and -p.

(The name for -p matches what's in the tcpdump trunk.)

Change-Id: If4f1824518aee1f0213f140d884db9c676dd15c4
Reviewed-on: https://code.wireshark.org/review/2497
Reviewed-by: Guy Harris <guy@alum.mit.edu>

"-d" isn't common to all capturing programs, it's dumpcap-specific.

Change-Id: I827615d45051c9d66407516b311d3de448de6d07
Reviewed-on: https://code.wireshark.org/review/2495
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Add --help and --version long options.

Also, make the convention for long-only options be that their
case-statement values start at 128, so they avoid colliding with any
ASCII code points, including control characters.

Make the tables of long options "static const" while we're at it, and...

Remove all $Id$ from top of file

(Using sed : sed -i '/^ \* \$Id\$/,+1 d')

Fix manually some typo (in export_object_dicom.c and crc16-plain.c)

Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8
Reviewed-on: https://code.wireshark.org/review/497
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Add a comment about the "default options".

svn path=/trunk/; revision=53590

Handle the 2GiB boundary case of the max filesize autostop condition properly so that we avoid overflow conditions and so that we ensure we don't capture more than 2GiB. Also, document the max filesize autostop value of 2GIB as well as indicating that it's truly GiB and not GB....

Clean up indentation.

svn path=/trunk/; revision=50953

add capture_comment to the capture_options structure

svn path=/trunk/; revision=50943

Pull the capture-session state information out of capture_opts and put
it into a separate capture_session structure. capture_opts should
contain only user-specified option information (and stuff directly
derived from it, such as the "capturing from a pipe" flag)....

On OS X, get the interface type from the System Configuration framework.

svn path=/trunk/; revision=49486

Add buffersize and snap length to the preferences.

svn path=/trunk/; revision=48163

On error, have capture_opts_trim_iface() return the exit status that
should be used (on success, have it return 0). Exit with that exit
status; if the problem is that we couldn't get the interface list or if
there are no interfaces in that list, return 2, as that's not a...

It looks like we haven't inserted anything into the cap_settings_history
hash table since r40715. Remove it and its associated functions.

C++-ize iface_lists.h.

svn path=/trunk/; revision=44197

scan_local_interfaces() isn't in capture_opts.c; don't declare it in
capture_opts.h. (It arguably belongs somewhere other than in a file in
ui/gtk, but, if so, move it there, e.g. to something in ui.)

svn path=/trunk/; revision=41712

Actually, you only have monitor mode support if you have pcap_create() -
without pcap_create() and pcap_activate() you don't have any API to turn
it on.

svn path=/trunk/; revision=40725

Third try. This time pipes and stdin are supported and the
test scripts are passed.

Use a global list containing all interfaces and only change
properties of the entries when changes are made in the GUI.
Do not misuse the list of interfaces specified on the command...

Second try. This time pipes and stdin are supported.

Use a global list containing all interfaces and only change
properties of the entries when changes are made in the GUI.
Do not misuse the list of interfaces specified on the command
line anymore.

This patch does not provide any new functionality, it just...

Back out infrastructure change. We missed supporting
stdin and pipes.

svn path=/trunk/; revision=39498

Get rid of old non-interface specific settings which are now interface
specifc. This finalizes the change of the infrastructure.
This patch is based on work by Irene Ruengeler.

svn path=/trunk/; revision=37794

Make remote capturing settings a per interface thing. You can now
configure that you want to capture on multiple remote interfaces
on mulitple hosts.
Improve some #ifdef mess in dumpcap.

svn path=/trunk/; revision=37178

• Fix a bug when printing a pointer.
• Remove number_of_ifaces, since ifaces->len can be used instead.

svn path=/trunk/; revision=37174

Add support for handling multiple interfaces as command line
parameters. An array of interface specific data is handled
in addition to the current way.
This change should not have any effect right now, it will
be used by dumpcap when supporting multiple interfaces...

Jeff Morris's change to make the autostop file size 64-bit. Fixes bug
5691.

svn path=/trunk/; revision=36551

As mentioned on the users-mailinglist¹, it could be useful to have groups read access to the ringbuffer that dumpcap creates. That way, a group of people can access the capture files without having to use root access.

[1] http://www.wireshark.org/lists/wireshark-users/201008/msg00235.html...

Make -q not a capture option again - it's used by tshark even when not
capturing, and thus even when we build without pcap.

svn path=/trunk/; revision=32988

Um, no, the problem with the Leopard x86 build is that we first do a
build without libpcap, to make sure that works, and then do a build with
libpcap, to put into a binary release. It's the former that's failing;
I'll back out the previous change and then work on that....

Fetch an indication of whether the interface supports capturing in
monitor mode at the same time that we fetch its list of link-layer
types. Support fetching that list in monitor mode, as the list may be
different in regular and monitor mode. If the interface supports...

For TShark and Wireshark, get the list of link-layer types for an
interface by running dumpcap, so that if you need privileges to open an
interface, and dumpcap has those privileges, neither TShark nor
Wireshark need them.

svn path=/trunk/; revision=32710

Just check for pcap_create(); it first appeared in libpcap 1.0.0, and
pcap_set_buffer_size() did as well, so there aren't any libpcap releases
with pcap_create() but not pcap_set_buffer_size().

Only do one check for pcap_create.

svn path=/trunk/; revision=32695

Add -n option to dumpcap. It will save the capture files in
pcapng format instead of pcap. The default is to use pcap.

svn path=/trunk/; revision=28170

Rename a variable to avoid collisions with a global variable, as noted
by John Smith.

svn path=/trunk/; revision=25549

Support for RPCAP features in GUI (from Boris Misenov, see Bug 1366)
- retrieving the list of remote PCAP interfaces
- password authentication support
- UDP data fransfer
- packet sampling (available in WinPcap 4.x)
etc.

fix problem if non-default rpcap port is used...

gcc 4 doesn't like my macro for getting the interface description: it says there's an invalid lvalue in it. I don't see what's wrong with it, but replace the macro with a function. Also: don't include the .xpm files in gtk/main.c if we're building without PCAP (as they're not used in that configuration)....

Add a "-S" flag to dumpcap, which prints out interface statistics. Use
this in the GUI rather than calling pcap_stats() directly. This gets rid
of the last pcap_open_live() call in the GUI code. Update
README.packaging.

svn path=/trunk/; revision=22443

One more step in privilege separation.

Add a capture_interface_list(), which works similar to
get_interface_list() except that it forks dumpcap instead of calling
the pcap routines directly. Use it in the GUI.

Add a "-I" flag to dumpcap, which prints out verbose interface...

name change

svn path=/trunk/; revision=18197

the point of no return ...

using dumpcap as the capture child for Ethereal.

dumpcap is a plain console application now, even for Win32 (so no WinMain, create_console and special piping stuff reguired). The undocumented command line option -Z will switch dumpcap into "child mode", using binary instead of plain text output messages to communicate with a parent Ethereal....

move output_to_pipe flag from tethereal's loop_data into capture_opts, so it can be used by dumpcap (capture_loop.c) as well

svn path=/trunk/; revision=16972

HUGE STEP (hopefully toward the right direction):
remove a lot of redundant code from tethereal and use (move) stuff from capture_loop.c instead.

concentrate common capture related code in capture_opts.c, e.g. trying to find the right interface to capture from (command line option, preference, first usable) instead of duplicating this code over several files....

split capture.h into capture.h, capture_loop.h and capture_opts.h and place the parts into the corresponding files

svn path=/trunk/; revision=16664