From e6890cb3e59ec4bdbe57e999592b9488fcfa1f80 Mon Sep 17 00:00:00 2001 From: Vadim Kochan Date: Sat, 24 Jan 2015 15:37:09 +0200 Subject: netsniff: Allow filter input pcap file to output pcap It might be useful to filter out interesting traffic from input pcap to output pcap file which will contain only filtered packets: $ netsniff-ng -i input.pcap -o output.pcap ip src 192.168.1.198 Now it is possible by specifying output pcap file with ".pcap" extension, otherwise the trafgen file will be generated as by default. Signed-off-by: Vadim Kochan [tklauser: small wording and whitespace adjustment] Signed-off-by: Tobias Klauser --- netsniff-ng.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) (limited to 'netsniff-ng.c') diff --git a/netsniff-ng.c b/netsniff-ng.c index 477c81d..5477257 100644 --- a/netsniff-ng.c +++ b/netsniff-ng.c @@ -528,6 +528,8 @@ static void read_pcap(struct ctx *ctx) struct sock_fprog bpf_ops; struct frame_map fm; struct timeval start, end, diff; + bool is_out_pcap = ctx->device_out && strstr(ctx->device_out, ".pcap"); + const struct pcap_file_ops *pcap_out_ops = pcap_ops[PCAP_OPS_RW]; bug_on(!__pcap_io); @@ -574,6 +576,13 @@ static void read_pcap(struct ctx *ctx) } } + if (is_out_pcap) { + ret = pcap_out_ops->push_fhdr_pcap(fdo, ctx->magic, + ctx->link_type); + if (ret) + panic("Error writing pcap header!\n"); + } + drop_privileges(ctx->enforce, ctx->uid, ctx->gid); printf("Running! Hang up with ^C!\n\n"); @@ -612,8 +621,16 @@ static void read_pcap(struct ctx *ctx) dissector_entry_point(out, fm.tp_h.tp_snaplen, ctx->link_type, ctx->print_mode); - if (ctx->device_out) + if (is_out_pcap) { + size_t pcap_len = pcap_get_length(&phdr, ctx->magic); + int wlen = pcap_out_ops->write_pcap(fdo, &phdr, + ctx->magic, out, + pcap_len); + if (unlikely(wlen != (int)pcap_get_total_length(&phdr, ctx->magic))) + panic("Error writing to pcap!\n"); + } else if (ctx->device_out) { translate_pcap_to_txf(fdo, out, fm.tp_h.tp_snaplen); + } if (frame_count_max != 0) { if (ctx->tx_packets >= frame_count_max) { @@ -1132,6 +1149,7 @@ static void __noreturn help(void) " netsniff-ng --in wlan0 --rfraw --out dump.pcap --silent --bind-cpu 0\n" " netsniff-ng --in dump.pcap --mmap --out eth0 -k1000 --silent --bind-cpu 0\n" " netsniff-ng --in dump.pcap --out dump.cfg --silent --bind-cpu 0\n" + " netsniff-ng --in dump.pcap --out dump2.pcap --silent tcp\n" " netsniff-ng --in eth0 --out eth1 --silent --bind-cpu 0 -J --type host\n" " netsniff-ng --in eth1 --out /opt/probe/ -s -m --interval 100MiB -b 0\n" " netsniff-ng --in vlan0 --out dump.pcap -c -u `id -u bob` -g `id -g bob`\n" -- cgit v1.2.3-54-g00ecf