fg_pcap.h File Reference

Packet capture support for the Flowgrind daemon. More...

#include "config.h"
#include "daemon.h"

Go to the source code of this file.

Functions
void	fg_pcap_go (struct flow *flow)
	Start a tcpdump to capture traffic of the provided flow. More...
int	fg_pcap_init (void)
	Initialize flowgrind's pcap library. More...

Detailed Description

Packet capture support for the Flowgrind daemon.

Definition in file fg_pcap.h.

Function Documentation

fg_pcap_go()

void fg_pcap_go

(

struct flow *

flow

)

Start a tcpdump to capture traffic of the provided flow.

If the flow was not configured for tcp dumping or dumping is already in progress the method will do nothing and return immediately. Otherwise the method blocks until the actual capturing starts. In case an error occurs a log message is created.

Parameters

[in]

flow

the flow whose traffic should be captured

Definition at line 314 of file fg_pcap.c.

{
        if (!flow->settings.traffic_dump)
                return;
 
        if (dumping) {
                logging(LOG_WARNING, "pcap: dumping already in progress on "
                        "this host");
                return;
        }
 
        DEBUG_MSG(LOG_DEBUG, "called fg_pcap_go() for flow %d", flow->id);
        dumping = true;
 
        int rc = pthread_create(&flow->pcap_thread, NULL, fg_pcap_work,
                                (void*)flow);
 
        /* barrier: dump thread is ready (or aborted) */
        pthread_barrier_wait(&pcap_barrier);
 
        if (rc)
                logging(LOG_WARNING, "could not start pcap thread: %s",
                        strerror(rc) );
}

fg_pcap_init()

int fg_pcap_init

(

void

)

Initialize flowgrind's pcap library.

This method fills internal structures on which other methods of this library depend. It is therefore crucial to call it before any call to other methods of this library.

Returns

return 0 for success, or -1 for failure

Definition at line 84 of file fg_pcap.c.

{
        /* initalize *alldevs for later use */
        if (pcap_findalldevs(&alldevs, errbuf) == -1) {
                logging(LOG_WARNING,"error in pcap_findalldevs: %s\n", errbuf);
                return -1;
        }
 
#ifdef DEBUG
        for (pcap_if_t *d = alldevs; d; d = d->next) {
                char *devdes = NULL;
                if (asprintf(&devdes, "%s: ", d->name) == -1)
                        return -1;
 
                for (pcap_addr_t *a = d->addresses; a; a = a->next) {
                        if (!a->addr)
                                continue;
 
                        asprintf_append(&devdes, "a=%s",
                                        fg_nameinfo(a->addr,
                                                    sizeof(struct sockaddr)));
                        if (a->next)
                                asprintf_append(&devdes, ", ");
                }
                DEBUG_MSG(LOG_ERR, "pcap: found pcapable device (%s)", devdes);
                free(devdes);
        }
#endif /* DEBUG*/
 
        pthread_barrier_init(&pcap_barrier, NULL, 2);
        return 0;
}