tcpdump.h 3.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101
  1. /* $Id$ */
  2. /*
  3. * Copyright (c) 2001-2010 Aaron Turner <aturner at synfin dot net>
  4. * Copyright (c) 2013-2018 Fred Klassen <tcpreplay at appneta dot com> - AppNeta
  5. *
  6. * The Tcpreplay Suite of tools is free software: you can redistribute it
  7. * and/or modify it under the terms of the GNU General Public License as
  8. * published by the Free Software Foundation, either version 3 of the
  9. * License, or with the authors permission any later version.
  10. *
  11. * The Tcpreplay Suite is distributed in the hope that it will be useful,
  12. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  14. * GNU General Public License for more details.
  15. *
  16. * You should have received a copy of the GNU General Public License
  17. * along with the Tcpreplay Suite. If not, see <http://www.gnu.org/licenses/>.
  18. */
  19. #ifndef __TCPDUMP_H__
  20. #define __TCPDUMP_H__
  21. /* line buffer stdout, read from stdin */
  22. #define TCPDUMP_ARGS " -n -l -r -"
  23. /* max number of tcpdump options; must be a multiple of 4 */
  24. #define OPTIONS_VEC_SIZE 32
  25. /* how long to wait (in ms) to write to tcpdump */
  26. #define TCPDUMP_POLL_TIMEOUT 500
  27. /* delim to be used for strtok() to process tcpdump args */
  28. #define OPT_DELIM " -"
  29. /* output file of data passed to tcpdump when debug level 5 is enabled */
  30. #define TCPDUMP_DEBUG "tcpdump.debug"
  31. /* taken from libpcap's savefile.c */
  32. #define TCPDUMP_MAGIC 0xa1b2c3d4
  33. #define PATCHED_TCPDUMP_MAGIC 0xa1b2cd34
  34. #define TCPDUMP_DECODE_LEN 65535
  35. /*
  36. * fork a copy of tcpdump so we can parse packets and print to the screen. We
  37. * don't allow tcpdump to write directly to the screen, otherwise there
  38. * will be a garbled up mess. Instead we pipe it back to this program and
  39. * print when we are ready to do so.
  40. *
  41. * parent: this program
  42. * child: tcpdump
  43. *
  44. * pipes are unidirectional, so we need to set up 2 pipes:
  45. *
  46. * 1. data from parent to child's STDIN
  47. * 2. child's STDOUT to this program
  48. */
  49. #define NUM_PIPES 2
  50. /* unidirectional rule for pipes: pipe[0] for read, pipe[1] for writes */
  51. enum {
  52. READ_FD,
  53. WRITE_FD,
  54. };
  55. enum {
  56. PARENT_READ_PIPE,
  57. PARENT_WRITE_PIPE,
  58. };
  59. #define PARENT_READ_FD (tcpdump->pipes[PARENT_READ_PIPE][READ_FD])
  60. #define PARENT_WRITE_FD (tcpdump->pipes[PARENT_WRITE_PIPE][WRITE_FD])
  61. #define CHILD_READ_FD (tcpdump->pipes[PARENT_WRITE_PIPE][READ_FD])
  62. #define CHILD_WRITE_FD (tcpdump->pipes[PARENT_READ_PIPE][WRITE_FD])
  63. typedef struct tcpdump_s {
  64. char *filename;
  65. char *args;
  66. struct pcap_file_header pfh;
  67. int pid;
  68. int pipes[NUM_PIPES][2];
  69. /* following vars are for figuring out exactly what we send to
  70. * tcpdump. See TCPDUMP_DEBUG
  71. */
  72. #ifdef DEBUG
  73. int debugfd;
  74. char debugfile[255];
  75. #endif
  76. } tcpdump_t;
  77. //int tcpdump_init(tcpdump_t *tcpdump);
  78. int tcpdump_open(tcpdump_t *tcpdump, pcap_t *pcap);
  79. //int tcpdump_open_live(tcpdump_t *tcpdump, pcap_t *pcap);
  80. int tcpdump_print(tcpdump_t *tcpdump, struct pcap_pkthdr *pkthdr, const u_char *data);
  81. void tcpdump_close(tcpdump_t *tcpdump);
  82. void tcpdump_kill(tcpdump_t *tcpdump);
  83. #endif