summaryrefslogtreecommitdiffstats
path: root/lib/libpcap (follow)
Commit message (Collapse)AuthorAgeFilesLines
* typo; spotted by jmcsthen2021-01-201-3/+3
|
* support PCAP_NETMASK_UNKNOWN, adapted from an old commit in upstreamsthen2021-01-183-6/+20
| | | | | | | libpcap, ok dlg@ https://github.com/the-tcpdump-group/libpcap/commit/74b2de364f3443fc2414d0160b0b942f347c6fd4 https://github.com/the-tcpdump-group/libpcap/commit/117cb5eb2eb4fe212d3851f1205bb0b8f57873c6
* Fix byte order handling for DLT_LOOP linkskn2020-09-121-4/+21
| | | | | | | | | | | | | | | | | | | | | | | Fixing filters on DLT_LOOP revealed that we treat DLT_NULL, DLT_ENC and DLT_LOOP the same way even though DLT_LOOP stores the AF value in network not byte order like the rest. This amends the missing conversion which ought to land with the recent commit exposing the byte order mismatch: revision 1.53 date: 2020/07/21 22:44:55; author: dlg; state: Exp; lines: +2 -2; DLT_LOOP does have a link header, so tell pcap-filter so it can use it. ... debugged with and ok kn@ Discussed with bluhm who reported src/regress/sys/netinet6/rip6cksum/ failing on i386 after above commit. The comment in this commit is taken from libpcap upstream as is modulo additional file-save related byte-order handling which we don't seem to do. OK bluhm
* crank the major cos grammar.c has grown.dlg2020-08-031-2/+2
| | | | | | | | pointed out by tb@, who also provided the diff. maybe someone should/could add a Symbols.list here? ok tb@ deraadt@
* add "sample NUM" so you can ask to capture 1/NUM packets from a filter.dlg2020-08-035-6/+33
| | | | | | | | | | | | | | | the use of the sample keyword matches similar config in other products. NUM can be a number between 2 and 1048576, and is used to divide 0x100000000 into a threshold that is then compared against a randomly generated number produced by a load of BPF_RND. having sampling as part of the grammar means you can write things like "icmp or sample 128". this lets you capture all icmp traffic and a sample of the rest of the traffic. ok jmatthew@ kn@ tb@
* add support for handling loads from BPF_RND.dlg2020-08-037-10/+38
| | | | | | | | | | this adds "rnd" and "random" as keywords in the grammar, and handles them as an arithmetic operator. the decoder recognises the load, so tcpdump can print it as 'ld #random'. most of the handling is copied from the "len"/"length" keywoard handling that generates and decodes a load of the actual wire length of the packet. ok jmatthew@ tb@ kn@
* DLT_LOOP does have a link header, so tell pcap-filter so it can use it.dlg2020-07-211-2/+2
| | | | | | | | | | | | | | matthieu@ reported that asking tcpdump to look at ip or ip6 traffic on a wg(4) interface caused all packets to be captured. this is because pcap assumes that if your link type doesn't have a link header then it is always ip or ip6 (which is weird anyway) and captures everything. there was already code to generate a filter for the DLT_LOOP link header, it was just bypassed cos earlier code said that there wasn't one. debugged with and ok kn@
* from edgar pettijohn: correct return type in pcap_open_live.3;jmc2020-05-291-3/+3
| | | | ok djm
* add support for pcap_breakloop when reading packets from files.dlg2020-05-271-1/+18
| | | | | | | | | djm pulled support in for pcap_breakloop on the bpf side of things, this makes it work when reading files too. from Caspar Schutijser lteo@ seems keen ok djm@
* Fix bogus ".It .Cm"jca2019-12-171-3/+3
|
* Fix typo in comment in struct pcap_pkthdrakoshibe2019-11-281-2/+2
|
* the mentioned .Fn functions are in a another file, so .Xr themderaadt2019-09-251-5/+5
| | | | ok jmc
* pcap-filter now section 5: adjust Xrjmc2019-09-251-3/+3
|
* mdoc version of pcap-filter;jmc2019-09-253-759/+927
| | | | | | | conversion suggested by deraadt, as well as renaming from section 7 to section 5; ok deraadt
* pcap-filter(3) is not a function, it is a language description. It wasderaadt2019-09-033-6/+6
| | | | | | mostly cobbled together from a pre-mandoc tcpdump manual page, and desperately needs some loving. First step is to name it right. Discussed with jmc
* there is no pcap(3) function, "man pcap" returns an incorrect result.deraadt2019-08-302-4/+4
| | | | | this page should be called by one of the functions, so i chose the first one: pcap_open_live(3)
* add "slow" to the list of ethernet protocol names.dlg2019-07-191-1/+2
| | | | | this allows "tcpdump ether proto slow", which makes looking at lacp frames a bit easier.
* When system calls indicate an error they return -1, not some arbitraryderaadt2019-06-282-24/+24
| | | | | | value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
* further document pcap_dump; from jan staryjmc2018-12-131-5/+13
| | | | text tweaked and ok djm
* some pcap_setdirection details; from jan staryjmc2018-12-121-2/+11
| | | | ok djm
* add basic MPLS filtering supportdenis2018-12-095-8/+67
| | | | OK claudio@ jca@
* unbreak VLAN filteringdenis2018-11-101-2/+7
| | | | OK dlg@
* fix a typodenis2018-11-091-2/+2
| | | | OK jca@ (from a long time ago...)
* Sync manual with the const changes introduced in pcap.h rev 1.20.tb2018-06-031-5/+5
|
* Change some libpcap functions which use pointers as arguments andsthen2018-06-036-20/+20
| | | | | | | | | | | | returns to const pointers: - the prefix argument to pcap_perror(); - the return value of pcap_strerror(); - the filter expression argument to pcap_compile() and pcap_compile_nopcap(); - the BPF filter program argument to bpf_image(). Matches changes made earlier in tcpdump.org's version of libpcap. From Guy Harris, ok tb@, been through a bulk ports build.
* Convert a format string variable to a static const char[] to reduce warningsguenther2018-04-261-2/+3
| | | | ok tb@ millert@ krw@
* Import pcap_set_immediate_mode() from mainline libpcap which allows alteo2018-04-056-7/+39
| | | | | | | | libpcap-based program to process packets as soon as they arrive. feedback from jasper@ ok jca@ (a long time ago)
* recognise DLT_PPP_SERIAL.dlg2018-02-062-2/+8
| | | | | | | shlib version doesnt need a bump before no new symbols were added or removed. part of a larger diff that was ok sthen@
* Simple USBPcap parser for tcpdump(8). Raw dumps can be nicely analysedmpi2018-02-032-2/+5
| | | | | | in wireshark. ok deraadt@, dlg@
* Fix wrong ETHERTYPE_IPV6denis2018-01-011-2/+2
| | | | OK jca@ kettenis@ job@
* use working boilerplate for yacc/lex instead of homemade rules.espie2017-07-092-10/+6
| | | | | okay millert@ (forgot the obvious scanner.l tweak in my diff)
* Remove the "volatile" attribute from bpf_error(). The "volatile"millert2017-04-271-2/+2
| | | | | | attribute is an obsolete way of saying "noreturn". clang doesn't recognize it and the function is already marked __dead so it is superfluous anyway.
* Switch base tools from /dev/bpf0 to /dev/bpf. Now that /dev/bpf has beennatano2017-04-191-3/+3
| | | | | | around for two releases, it should be safe to do so. ok bluhm deraadt sthen tb yasuoka
* add "lldp" to the ether protocol name db.dlg2016-12-021-1/+2
| | | | | | | this lets me go "tcpdump ether proto lldp" to easily read lldp packets off the wire without other noise getting in the way. ok deraadt@ jca@ sthen@
* Stop exporting the eproto_db array, export a pointer to it instead.jca2016-11-292-6/+8
| | | | | | | | | | | | | | tcpdump directly uses eproto_db even though it is not part of the libpcap API. This means that we can't freely add members to this array, else ld.so complains about size mismatches. Keep the data in a static array instead and make it usable by tcpdump through a pointer whose size won't change in the future. A minor bump is enough here for ld.so to stop complaining. While here, mark _eproto_db and llc_db as const, as they are meant to be. Suggested by and ok deraadt@
* Extend the DLT_OPENFLOW header to include the switch datapath id.reyk2016-11-201-2/+2
| | | | OK rzalamena@
* Add new DLT_OPENFLOW link-type to allow using tcpdump to debug switch(4),reyk2016-11-163-3/+9
| | | | | | | | eg. tcpdump -y openflow -i switch0 Includes a minor bump for libpcap. Feedback and OK rzalamena@
* Add missing argument names for pcap_offline_filter.lteo2016-10-171-3/+3
|
* Use /dev/bpf0 instead of /dev/bpf (without loop though), as suggested bynatano2016-05-081-3/+3
| | | | | | sthen@. to make remote upgrades without media less painful. ok tb@
* Move to /dev/bpf; ok lteonatano2016-05-031-60/+11
|
* bad spell of whether...jmc2016-04-061-2/+2
|
* add two functions from libpcap-1.7.4 which are required by at least gopacketjasper2016-04-064-7/+57
| | | | ok lteo@ "go for it" dlg@
* Move more fcntl(,F_GETFL,0) -> fcntl(,F_GETFL).krw2016-04-051-3/+3
| | | | | | No functional change. ok guenther@
* refactor bpf_filter a bit.dlg2016-04-021-3/+1
| | | | | | | | | | | | | | | | | | | | | | | the code was confusing around how it dealt with packets in mbufs vs plain memory buffers with a lenght. this renames bpf_filter to _bpf_filter, and changes it so the packet memory is referred to by an opaque pointer, and callers have to provide a set of operations to extra values from that opaque pointer. bpf_filter is now provided as a wrapper around _bpf_filter. it provides a set of operators that work on a straight buffer with a lenght. this also adds a bpf_mfilter function which takes an mbuf instead of a buffer, and it provides explicit operations for extracting values from mbufs. if we want to use bpf filters against other data structures (usb or scsi packets maybe?) we are able to provide functions for extracting payloads from them and use _bpf_filter as is. ok canacar@
* for some time now mandoc has not required MLINKS to functionjmc2016-03-301-27/+1
| | | | | | | | | | | | correctly - logically complete that now by removing MLINKS from base; authors need only to ensure there is an entry in NAME for any function/ util being added. MLINKS will still work, and remain for perl to ease upgrades; ok nicm (curses) bcook (ssl) ok schwarze, who provided a lot of feedback and assistance ok tb natano jung
* Use the correct structure size when allocating the array for nodes.canacar2016-02-051-2/+2
| | | | ok tb@ millert@
* remove NULL-checks before free()mmcc2015-12-225-27/+19
|
* Remove register keyword.mmcc2015-11-179-74/+74
| | | | ok deraadt@
* memory.h -> string.hmmcc2015-11-176-12/+10
| | | | ok deraadt@
* update NAME; ok schwarzejmc2015-11-151-4/+59
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.