[netsniff-ng] Re: [PATCH] netsniff-ng: Create out pcap only if first packet passed

[Tobias Klauser]

On 2016-05-16 at 18:58:21 +0200, Vadim Kochan  wrote:
> If all packets did not pass the filter then output pcap
> file will be created with pcap header, which might be not what user
> expect - to see only interested pcap files.

IMO, an output file should always be created, even if it contains no
packets. Otherwise it's not entirely obvious whether there was an error
in netsniff-ng or whether there just weren't any passed packets. Also,
in case the file can't be created (e.g. due to lacking permissions) and
the first packet to be written only arrives a large amount of time after
program start, the user would only notice by then.

BTW, an empty pcap opens just fine in e.g. Wireshark.

-- 
You received this message because you are subscribed to the Google Groups 
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to netsniff-ng+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[netsniff-ng] Re: [PATCH] netsniff-ng: Create out pcap only if first packet passed

[Vadim Kochan]

On Mon, May 16, 2016 at 7:58 PM, Vadim Kochan  wrote:
> If all packets did not pass the filter then output pcap
> file will be created with pcap header, which might be not what user
> expect - to see only interested pcap files.
>
> Signed-off-by: Vadim Kochan 
> ---
>  netsniff-ng.c | 33 +
>  1 file changed, 21 insertions(+), 12 deletions(-)
>
> diff --git a/netsniff-ng.c b/netsniff-ng.c
> index 8d22151..89d983c 100644
> --- a/netsniff-ng.c
> +++ b/netsniff-ng.c
> @@ -603,6 +603,7 @@ static void read_pcap(struct ctx *ctx)
> struct timeval start, end, diff;
> bool is_out_pcap = ctx->device_out && strstr(ctx->device_out, 
> ".pcap");
> const struct pcap_file_ops *pcap_out_ops = pcap_ops[PCAP_OPS_RW];
> +   bool is_out_created = false;
>
> bug_on(!__pcap_io);
>
> @@ -652,19 +653,12 @@ static void read_pcap(struct ctx *ctx)
> if (!strncmp("-", ctx->device_out, strlen("-"))) {
> fdo = dup_or_die(fileno(stdout));
> close(fileno(stdout));
> -   } else {
> +   } else if (!is_out_pcap) {
> fdo = open_or_die_m(ctx->device_out, O_RDWR | O_CREAT 
> |
> O_TRUNC | O_LARGEFILE, 
> DEFFILEMODE);
> }
> }
>
> -   if (is_out_pcap) {
> -   ret = pcap_out_ops->push_fhdr_pcap(fdo, ctx->magic,
> -  ctx->link_type);
> -   if (ret)
> -   panic("Error writing pcap header!\n");
> -   }
> -
> drop_privileges(ctx->enforce, ctx->uid, ctx->gid);
>
> printf("Running! Hang up with ^C!\n\n");
> @@ -705,10 +699,25 @@ static void read_pcap(struct ctx *ctx)
>   _ll);
>
> if (is_out_pcap) {
> -   size_t pcap_len = pcap_get_length(, ctx->magic);
> -   int wlen = pcap_out_ops->write_pcap(fdo, ,
> -   ctx->magic, out,
> -   pcap_len);
> +   size_t pcap_len;
> +   int wlen;
> +
> +   if (unlikely(!is_out_created)) {
> +   fdo = open_or_die_m(ctx->device_out, O_RDWR | 
> O_CREAT |
> +   O_TRUNC | O_LARGEFILE, 
> DEFFILEMODE);
> +
> +   ret = pcap_out_ops->push_fhdr_pcap(fdo, 
> ctx->magic,
> +   ctx->link_type);
> +   if (ret)
> +   panic("Error writing pcap header!\n");
> +   is_out_created = true;
> +   }
> +
> +   pcap_len = pcap_get_length(, ctx->magic);
> +   wlen = pcap_out_ops->write_pcap(fdo, ,
> +   ctx->magic, out,
> +   pcap_len);
> +
> if (unlikely(wlen != 
> (int)pcap_get_total_length(, ctx->magic)))
> panic("Error writing to pcap!\n");
> } else if (ctx->device_out) {
> --
> 2.6.3
>

Hi Tobias,

Just softly ping in case if it was missed.

Regards,

-- 
You received this message because you are subscribed to the Google Groups 
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to netsniff-ng+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[netsniff-ng] Re: [PATCH 0/6] trafgen: Implement ICMPv4 packet creation

[Vadim Kochan]

Hi Tobias,

On Sat, Apr 30, 2016 at 6:01 PM, Tobias Klauser  wrote:
> Hi Vadim
>
> Thanks for the series. I'll be travelling for a while starting tomorrow,
> so it will probably take a while until I get to review the patches.
>
> Thanks
> Tobias


Will you look on this series ?

Regards,

-- 
You received this message because you are subscribed to the Google Groups 
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to netsniff-ng+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.