If all packets did not pass the filter then output pcap file will be created with pcap header, which might be not what user expect - to see only interested pcap files.
Signed-off-by: Vadim Kochan <[email protected]> --- netsniff-ng.c | 33 +++++++++++++++++++++------------ 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/netsniff-ng.c b/netsniff-ng.c index 8d22151..89d983c 100644 --- a/netsniff-ng.c +++ b/netsniff-ng.c @@ -603,6 +603,7 @@ static void read_pcap(struct ctx *ctx) struct timeval start, end, diff; bool is_out_pcap = ctx->device_out && strstr(ctx->device_out, ".pcap"); const struct pcap_file_ops *pcap_out_ops = pcap_ops[PCAP_OPS_RW]; + bool is_out_created = false; bug_on(!__pcap_io); @@ -652,19 +653,12 @@ static void read_pcap(struct ctx *ctx) if (!strncmp("-", ctx->device_out, strlen("-"))) { fdo = dup_or_die(fileno(stdout)); close(fileno(stdout)); - } else { + } else if (!is_out_pcap) { fdo = open_or_die_m(ctx->device_out, O_RDWR | O_CREAT | O_TRUNC | O_LARGEFILE, DEFFILEMODE); } } - if (is_out_pcap) { - ret = pcap_out_ops->push_fhdr_pcap(fdo, ctx->magic, - ctx->link_type); - if (ret) - panic("Error writing pcap header!\n"); - } - drop_privileges(ctx->enforce, ctx->uid, ctx->gid); printf("Running! Hang up with ^C!\n\n"); @@ -705,10 +699,25 @@ static void read_pcap(struct ctx *ctx) &fm.s_ll); if (is_out_pcap) { - size_t pcap_len = pcap_get_length(&phdr, ctx->magic); - int wlen = pcap_out_ops->write_pcap(fdo, &phdr, - ctx->magic, out, - pcap_len); + size_t pcap_len; + int wlen; + + if (unlikely(!is_out_created)) { + fdo = open_or_die_m(ctx->device_out, O_RDWR | O_CREAT | + O_TRUNC | O_LARGEFILE, DEFFILEMODE); + + ret = pcap_out_ops->push_fhdr_pcap(fdo, ctx->magic, + ctx->link_type); + if (ret) + panic("Error writing pcap header!\n"); + is_out_created = true; + } + + pcap_len = pcap_get_length(&phdr, ctx->magic); + wlen = pcap_out_ops->write_pcap(fdo, &phdr, + ctx->magic, out, + pcap_len); + if (unlikely(wlen != (int)pcap_get_total_length(&phdr, ctx->magic))) panic("Error writing to pcap!\n"); } else if (ctx->device_out) { -- 2.6.3 -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
