xref: /onnv-gate/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_capture.c (revision 10616:3be00c4a6835)
10Sstevel@tonic-gate /*
20Sstevel@tonic-gate  * CDDL HEADER START
30Sstevel@tonic-gate  *
40Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
51676Sjpk  * Common Development and Distribution License (the "License").
61676Sjpk  * You may not use this file except in compliance with the License.
70Sstevel@tonic-gate  *
80Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
90Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
100Sstevel@tonic-gate  * See the License for the specific language governing permissions
110Sstevel@tonic-gate  * and limitations under the License.
120Sstevel@tonic-gate  *
130Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
140Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
150Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
160Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
170Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
180Sstevel@tonic-gate  *
190Sstevel@tonic-gate  * CDDL HEADER END
200Sstevel@tonic-gate  */
210Sstevel@tonic-gate /*
228485SPeter.Memishian@Sun.COM  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
230Sstevel@tonic-gate  * Use is subject to license terms.
240Sstevel@tonic-gate  */
250Sstevel@tonic-gate 
260Sstevel@tonic-gate #include <stdio.h>
270Sstevel@tonic-gate #include <string.h>
288868SPeter.Memishian@Sun.COM #include <strings.h>
290Sstevel@tonic-gate #include <errno.h>
300Sstevel@tonic-gate #include <fcntl.h>
310Sstevel@tonic-gate #include <setjmp.h>
320Sstevel@tonic-gate #include <sys/types.h>
330Sstevel@tonic-gate #include <sys/signal.h>
340Sstevel@tonic-gate #include <sys/time.h>
350Sstevel@tonic-gate #include <sys/socket.h>
360Sstevel@tonic-gate #include <sys/sockio.h>
370Sstevel@tonic-gate #include <netinet/in.h>
380Sstevel@tonic-gate #include <netinet/ip.h>
390Sstevel@tonic-gate #include <sys/pfmod.h>
400Sstevel@tonic-gate #include <sys/mman.h>
410Sstevel@tonic-gate #include <sys/stat.h>
420Sstevel@tonic-gate #include <sys/bufmod.h>
430Sstevel@tonic-gate 
440Sstevel@tonic-gate #include <unistd.h>
450Sstevel@tonic-gate #include <stropts.h>
460Sstevel@tonic-gate #include <stdlib.h>
470Sstevel@tonic-gate #include <ctype.h>
480Sstevel@tonic-gate #include <values.h>
490Sstevel@tonic-gate #include <libdlpi.h>
500Sstevel@tonic-gate 
510Sstevel@tonic-gate #include "snoop.h"
520Sstevel@tonic-gate 
531676Sjpk /*
541676Sjpk  * Old header format.
551676Sjpk  * Actually two concatenated structs:  nit_bufhdr + nit_head
561676Sjpk  */
571676Sjpk struct ohdr {
581676Sjpk 	/* nit_bufhdr */
591676Sjpk 	int	o_msglen;
601676Sjpk 	int	o_totlen;
611676Sjpk 	/* nit_head */
621676Sjpk 	struct timeval o_time;
631676Sjpk 	int	o_drops;
641676Sjpk 	int	o_len;
651676Sjpk };
661676Sjpk 
671676Sjpk static void scan(char *, int, int, int, int, void (*)(), int, int, int);
680Sstevel@tonic-gate void convert_to_network();
690Sstevel@tonic-gate void convert_from_network();
701676Sjpk static void convert_old(struct ohdr *);
710Sstevel@tonic-gate extern sigjmp_buf jmp_env, ojmp_env;
723628Sss150715 static dlpi_info_t dlinfo;
731676Sjpk static char *bufp;	/* pointer to read buffer */
740Sstevel@tonic-gate 
751676Sjpk static int strioctl(int, int, int, int, void *);
76410Skcpoon 
778868SPeter.Memishian@Sun.COM enum { DWA_NONE, DWA_EXISTS, DWA_PLUMBED };
788868SPeter.Memishian@Sun.COM 
798868SPeter.Memishian@Sun.COM typedef struct dlpi_walk_arg {
808868SPeter.Memishian@Sun.COM 	char	dwa_linkname[MAXLINKNAMELEN];
818868SPeter.Memishian@Sun.COM 	int	dwa_type;	/* preference type above */
828868SPeter.Memishian@Sun.COM 	int	dwa_s4;		/* IPv4 socket */
838868SPeter.Memishian@Sun.COM 	int	dwa_s6;		/* IPv6 socket */
848868SPeter.Memishian@Sun.COM } dlpi_walk_arg_t;
858868SPeter.Memishian@Sun.COM 
868868SPeter.Memishian@Sun.COM static boolean_t
878868SPeter.Memishian@Sun.COM select_datalink(const char *linkname, void *arg)
880Sstevel@tonic-gate {
898868SPeter.Memishian@Sun.COM 	struct lifreq lifr;
908868SPeter.Memishian@Sun.COM 	dlpi_walk_arg_t *dwap = arg;
918868SPeter.Memishian@Sun.COM 	int s4 = dwap->dwa_s4;
928868SPeter.Memishian@Sun.COM 	int s6 = dwap->dwa_s6;
938868SPeter.Memishian@Sun.COM 
948868SPeter.Memishian@Sun.COM 	(void) strlcpy(dwap->dwa_linkname, linkname, MAXLINKNAMELEN);
958868SPeter.Memishian@Sun.COM 	dwap->dwa_type = DWA_EXISTS;
963628Sss150715 
970Sstevel@tonic-gate 	/*
988868SPeter.Memishian@Sun.COM 	 * See if it's plumbed by IP.  We prefer such links because they're
998868SPeter.Memishian@Sun.COM 	 * more likely to have interesting traffic.
1000Sstevel@tonic-gate 	 */
1018868SPeter.Memishian@Sun.COM 	bzero(&lifr, sizeof (lifr));
1028868SPeter.Memishian@Sun.COM 	(void) strlcpy(lifr.lifr_name, linkname, LIFNAMSIZ);
1038868SPeter.Memishian@Sun.COM 	if ((s4 != -1 && ioctl(s4, SIOCGLIFFLAGS, &lifr) != -1) ||
1048868SPeter.Memishian@Sun.COM 	    (s6 != -1 && ioctl(s6, SIOCGLIFFLAGS, &lifr) != -1)) {
1058868SPeter.Memishian@Sun.COM 		dwap->dwa_type = DWA_PLUMBED;
1068868SPeter.Memishian@Sun.COM 		return (B_TRUE);
1078868SPeter.Memishian@Sun.COM 	}
1088868SPeter.Memishian@Sun.COM 	return (B_FALSE);
1098868SPeter.Memishian@Sun.COM }
1100Sstevel@tonic-gate 
1118868SPeter.Memishian@Sun.COM /*
1128868SPeter.Memishian@Sun.COM  * Open `linkname' in raw/passive mode (see dlpi_open(3DLPI)).  If `linkname'
1138868SPeter.Memishian@Sun.COM  * is NULL, pick a datalink as per snoop(1M).  Also gather some information
1148868SPeter.Memishian@Sun.COM  * about the datalink useful for building the proper packet filters.
1158868SPeter.Memishian@Sun.COM  */
1168868SPeter.Memishian@Sun.COM boolean_t
1178868SPeter.Memishian@Sun.COM open_datalink(dlpi_handle_t *dhp, const char *linkname)
1188868SPeter.Memishian@Sun.COM {
1198868SPeter.Memishian@Sun.COM 	int retval;
1208868SPeter.Memishian@Sun.COM 	int flags = DLPI_PASSIVE | DLPI_RAW;
1218868SPeter.Memishian@Sun.COM 	dlpi_walk_arg_t dwa;
1228868SPeter.Memishian@Sun.COM 
1238868SPeter.Memishian@Sun.COM 	if (linkname == NULL) {
1248868SPeter.Memishian@Sun.COM 		/*
1258868SPeter.Memishian@Sun.COM 		 * Select a datalink to use by default.  Prefer datalinks that
1268868SPeter.Memishian@Sun.COM 		 * are plumbed by IP.
1278868SPeter.Memishian@Sun.COM 		 */
1288868SPeter.Memishian@Sun.COM 		bzero(&dwa, sizeof (dwa));
1298868SPeter.Memishian@Sun.COM 		dwa.dwa_s4 = socket(AF_INET, SOCK_DGRAM, 0);
1308868SPeter.Memishian@Sun.COM 		dwa.dwa_s6 = socket(AF_INET6, SOCK_DGRAM, 0);
1318868SPeter.Memishian@Sun.COM 		dlpi_walk(select_datalink, &dwa, 0);
1328868SPeter.Memishian@Sun.COM 		(void) close(dwa.dwa_s4);
1338868SPeter.Memishian@Sun.COM 		(void) close(dwa.dwa_s6);
1348868SPeter.Memishian@Sun.COM 
1358868SPeter.Memishian@Sun.COM 		if (dwa.dwa_type == DWA_NONE)
1368868SPeter.Memishian@Sun.COM 			pr_err("no datalinks found");
1378868SPeter.Memishian@Sun.COM 		if (dwa.dwa_type == DWA_EXISTS) {
1388868SPeter.Memishian@Sun.COM 			(void) fprintf(stderr, "snoop: WARNING: "
1398868SPeter.Memishian@Sun.COM 			    "no datalinks plumbed for IP traffic\n");
1400Sstevel@tonic-gate 		}
1418868SPeter.Memishian@Sun.COM 		linkname = dwa.dwa_linkname;
1420Sstevel@tonic-gate 	}
1438023SPhil.Kirk@Sun.COM 	if (Iflg)
1448023SPhil.Kirk@Sun.COM 		flags |= DLPI_DEVIPNET;
1458868SPeter.Memishian@Sun.COM 	if (Iflg || strcmp(linkname, "lo0") == 0)
1468023SPhil.Kirk@Sun.COM 		flags |= DLPI_IPNETINFO;
1478868SPeter.Memishian@Sun.COM 	if ((retval = dlpi_open(linkname, dhp, flags)) != DLPI_SUCCESS) {
1488868SPeter.Memishian@Sun.COM 		pr_err("cannot open \"%s\": %s", linkname,
1493628Sss150715 		    dlpi_strerror(retval));
1500Sstevel@tonic-gate 	}
1510Sstevel@tonic-gate 
1523628Sss150715 	if ((retval = dlpi_info(*dhp, &dlinfo, 0)) != DLPI_SUCCESS)
1533628Sss150715 		pr_errdlpi(*dhp, "dlpi_info failed", retval);
1540Sstevel@tonic-gate 
1550Sstevel@tonic-gate 	for (interface = &INTERFACES[0]; interface->mac_type != -1; interface++)
1563628Sss150715 		if (interface->mac_type == dlinfo.di_mactype)
1570Sstevel@tonic-gate 			break;
1580Sstevel@tonic-gate 
1593628Sss150715 	/* allow limited functionality even if interface isn't known */
1600Sstevel@tonic-gate 	if (interface->mac_type == -1) {
1613628Sss150715 		(void) fprintf(stderr, "snoop: WARNING: Mac Type = %x "
1623628Sss150715 		    "not supported\n", dlinfo.di_mactype);
1630Sstevel@tonic-gate 	}
1640Sstevel@tonic-gate 
1650Sstevel@tonic-gate 	/* for backward compatibility, allow known interface mtu_sizes */
1663628Sss150715 	if (interface->mtu_size > dlinfo.di_max_sdu)
1673628Sss150715 		dlinfo.di_max_sdu = interface->mtu_size;
1680Sstevel@tonic-gate 
1692760Sdg199075 	return (interface->try_kernel_filter);
1700Sstevel@tonic-gate }
1710Sstevel@tonic-gate 
1720Sstevel@tonic-gate /*
1738868SPeter.Memishian@Sun.COM  * Initialize `dh' for packet capture using the provided arguments.
1740Sstevel@tonic-gate  */
1750Sstevel@tonic-gate void
1768868SPeter.Memishian@Sun.COM init_datalink(dlpi_handle_t dh, ulong_t snaplen, ulong_t chunksize,
1773628Sss150715     struct timeval *timeout, struct Pf_ext_packetfilt *fp)
1780Sstevel@tonic-gate {
1793628Sss150715 	int 	retv;
1803628Sss150715 	int 	netfd;
1810Sstevel@tonic-gate 
1823628Sss150715 	retv = dlpi_bind(dh, DLPI_ANY_SAP, NULL);
1833628Sss150715 	if (retv != DLPI_SUCCESS)
1843628Sss150715 		pr_errdlpi(dh, "cannot bind on", retv);
1850Sstevel@tonic-gate 
1868023SPhil.Kirk@Sun.COM 	if (Iflg) {
1878023SPhil.Kirk@Sun.COM 		(void) fprintf(stderr, "Using device ipnet/%s ",
1888023SPhil.Kirk@Sun.COM 		    dlpi_linkname(dh));
1898023SPhil.Kirk@Sun.COM 	} else {
1908023SPhil.Kirk@Sun.COM 		(void) fprintf(stderr, "Using device %s ", dlpi_linkname(dh));
1918023SPhil.Kirk@Sun.COM 	}
1920Sstevel@tonic-gate 
1930Sstevel@tonic-gate 	/*
1940Sstevel@tonic-gate 	 * If Pflg not set - use physical level
1950Sstevel@tonic-gate 	 * promiscuous mode.  Otherwise - just SAP level.
1960Sstevel@tonic-gate 	 */
1970Sstevel@tonic-gate 	if (!Pflg) {
1980Sstevel@tonic-gate 		(void) fprintf(stderr, "(promiscuous mode)\n");
1993628Sss150715 		retv = dlpi_promiscon(dh, DL_PROMISC_PHYS);
2003628Sss150715 		if (retv != DLPI_SUCCESS) {
2013628Sss150715 			pr_errdlpi(dh, "promiscuous mode(physical) failed",
2023628Sss150715 			    retv);
2033628Sss150715 		}
2040Sstevel@tonic-gate 	} else {
2050Sstevel@tonic-gate 		(void) fprintf(stderr, "(non promiscuous)\n");
2063628Sss150715 		retv = dlpi_promiscon(dh, DL_PROMISC_MULTI);
2073628Sss150715 		if (retv != DLPI_SUCCESS) {
2083628Sss150715 			pr_errdlpi(dh, "promiscuous mode(multicast) failed",
2093628Sss150715 			    retv);
2103628Sss150715 		}
2110Sstevel@tonic-gate 	}
2120Sstevel@tonic-gate 
2133628Sss150715 	retv = dlpi_promiscon(dh, DL_PROMISC_SAP);
2143628Sss150715 	if (retv != DLPI_SUCCESS)
2153628Sss150715 		pr_errdlpi(dh, "promiscuous mode(SAP) failed", retv);
2160Sstevel@tonic-gate 
2173628Sss150715 	netfd = dlpi_fd(dh);
2180Sstevel@tonic-gate 
2190Sstevel@tonic-gate 	if (fp) {
2200Sstevel@tonic-gate 		/*
2210Sstevel@tonic-gate 		 * push and configure the packet filtering module
2220Sstevel@tonic-gate 		 */
2233628Sss150715 		if (ioctl(netfd, I_PUSH, "pfmod") < 0)
2243628Sss150715 			pr_errdlpi(dh, "cannot push \"pfmod\"", DL_SYSERR);
2250Sstevel@tonic-gate 
226410Skcpoon 		if (strioctl(netfd, PFIOCSETF, -1, sizeof (*fp),
2273628Sss150715 		    (char *)fp) < 0)
2283628Sss150715 			pr_errdlpi(dh, "PFIOCSETF", DL_SYSERR);
2290Sstevel@tonic-gate 	}
2300Sstevel@tonic-gate 
2313628Sss150715 	if (ioctl(netfd, I_PUSH, "bufmod") < 0)
2323628Sss150715 		pr_errdlpi(dh, "cannot push \"bufmod\"", DL_SYSERR);
2333628Sss150715 
2340Sstevel@tonic-gate 	if (strioctl(netfd, SBIOCSTIME, -1, sizeof (struct timeval),
2353628Sss150715 	    (char *)timeout) < 0)
2363628Sss150715 		pr_errdlpi(dh, "SBIOCSTIME", DL_SYSERR);
2370Sstevel@tonic-gate 
2380Sstevel@tonic-gate 	if (strioctl(netfd, SBIOCSCHUNK, -1, sizeof (uint_t),
2393628Sss150715 	    (char *)&chunksize) < 0)
2403628Sss150715 		pr_errdlpi(dh, "SBIOCGCHUNK", DL_SYSERR);
2410Sstevel@tonic-gate 
2420Sstevel@tonic-gate 	if (strioctl(netfd, SBIOCSSNAP, -1, sizeof (uint_t),
2433628Sss150715 	    (char *)&snaplen) < 0)
2443628Sss150715 		pr_errdlpi(dh, "SBIOCSSNAP", DL_SYSERR);
2450Sstevel@tonic-gate 
2460Sstevel@tonic-gate 	/*
2470Sstevel@tonic-gate 	 * Flush the read queue, to get rid of anything that
2480Sstevel@tonic-gate 	 * accumulated before the device reached its final configuration.
2490Sstevel@tonic-gate 	 */
2503628Sss150715 	if (ioctl(netfd, I_FLUSH, FLUSHR) < 0)
2513628Sss150715 		pr_errdlpi(dh, "cannot flush \"I_FLUSH\"", DL_SYSERR);
2520Sstevel@tonic-gate }
2530Sstevel@tonic-gate 
2540Sstevel@tonic-gate /*
2558868SPeter.Memishian@Sun.COM  * Read packets from the network.  init_datalink() is called in
2560Sstevel@tonic-gate  * here to set up the network interface for reading of
2570Sstevel@tonic-gate  * raw ethernet packets in promiscuous mode into a buffer.
2580Sstevel@tonic-gate  * Packets are read and either written directly to a file
2590Sstevel@tonic-gate  * or interpreted for display on the fly.
2600Sstevel@tonic-gate  */
2610Sstevel@tonic-gate void
2623628Sss150715 net_read(dlpi_handle_t dh, size_t chunksize, int filter, void (*proc)(),
2633628Sss150715     int flags)
2640Sstevel@tonic-gate {
2653628Sss150715 	int 	retval;
2660Sstevel@tonic-gate 	extern int count;
2673628Sss150715 	size_t	msglen;
2680Sstevel@tonic-gate 
2690Sstevel@tonic-gate 	count = 0;
2700Sstevel@tonic-gate 
2710Sstevel@tonic-gate 	/* allocate a read buffer */
2720Sstevel@tonic-gate 	bufp = malloc(chunksize);
2730Sstevel@tonic-gate 	if (bufp == NULL)
2743628Sss150715 		pr_err("no memory for %d buffer", chunksize);
2750Sstevel@tonic-gate 
2760Sstevel@tonic-gate 	/*
2773628Sss150715 	 * read frames
2780Sstevel@tonic-gate 	 */
2790Sstevel@tonic-gate 	for (;;) {
2803628Sss150715 		msglen = chunksize;
2813628Sss150715 		retval = dlpi_recv(dh, NULL, NULL, bufp, &msglen, -1, NULL);
2820Sstevel@tonic-gate 
2833628Sss150715 		if (retval != DLPI_SUCCESS || quitting)
2840Sstevel@tonic-gate 			break;
2850Sstevel@tonic-gate 
2863628Sss150715 		if (msglen != 0)
2873628Sss150715 			scan(bufp, msglen, filter, 0, 0, proc, 0, 0, flags);
2880Sstevel@tonic-gate 	}
2890Sstevel@tonic-gate 
2900Sstevel@tonic-gate 	free(bufp);
2910Sstevel@tonic-gate 
2923628Sss150715 	if (!quitting)
2933628Sss150715 		pr_errdlpi(dh, "network read failed", retval);
2940Sstevel@tonic-gate }
2950Sstevel@tonic-gate 
2960Sstevel@tonic-gate #ifdef DEBUG
2970Sstevel@tonic-gate /*
2980Sstevel@tonic-gate  * corrupt: simulate packet corruption for debugging interpreters
2990Sstevel@tonic-gate  */
3000Sstevel@tonic-gate void
3010Sstevel@tonic-gate corrupt(volatile char *pktp, volatile char *pstop, char *buf,
3020Sstevel@tonic-gate 	volatile char *bufstop)
3030Sstevel@tonic-gate {
3040Sstevel@tonic-gate 	int c;
3050Sstevel@tonic-gate 	int i;
3060Sstevel@tonic-gate 	int p;
3070Sstevel@tonic-gate 	int li = rand() % (pstop - pktp - 1) + 1;
3080Sstevel@tonic-gate 	volatile char *pp = pktp;
3090Sstevel@tonic-gate 	volatile char *pe = bufstop < pstop ? bufstop : pstop;
3100Sstevel@tonic-gate 
3110Sstevel@tonic-gate 	if (pktp < buf || pktp > bufstop)
3120Sstevel@tonic-gate 		return;
3130Sstevel@tonic-gate 
3140Sstevel@tonic-gate 	for (pp = pktp; pp < pe; pp += li) {
3150Sstevel@tonic-gate 		c = ((pe - pp) < li ? pe - pp : li);
3160Sstevel@tonic-gate 		i = (rand() % c)>>1;
3170Sstevel@tonic-gate 		while (--i > 0) {
3180Sstevel@tonic-gate 			p = (rand() % c);
3190Sstevel@tonic-gate 			pp[p] = (unsigned char)(rand() & 0xFF);
3200Sstevel@tonic-gate 		}
3210Sstevel@tonic-gate 	}
3220Sstevel@tonic-gate }
3230Sstevel@tonic-gate #endif /* DEBUG */
3240Sstevel@tonic-gate 
3251676Sjpk static void
3261676Sjpk scan(char *buf, int len, int filter, int cap, int old, void (*proc)(),
3271676Sjpk     int first, int last, int flags)
3280Sstevel@tonic-gate {
3290Sstevel@tonic-gate 	volatile char *bp, *bufstop;
3300Sstevel@tonic-gate 	volatile struct sb_hdr *hdrp;
3310Sstevel@tonic-gate 	volatile struct sb_hdr nhdr, *nhdrp;
3320Sstevel@tonic-gate 	volatile char *pktp;
3330Sstevel@tonic-gate 	volatile struct timeval last_timestamp;
3340Sstevel@tonic-gate 	volatile int header_okay;
3350Sstevel@tonic-gate 	extern int count, maxcount;
3360Sstevel@tonic-gate 	extern int snoop_nrecover;
3370Sstevel@tonic-gate #ifdef	DEBUG
3380Sstevel@tonic-gate 	extern int zflg;
3390Sstevel@tonic-gate #endif	/* DEBUG */
3400Sstevel@tonic-gate 
3410Sstevel@tonic-gate 	proc(0, 0, 0);
3420Sstevel@tonic-gate 	bufstop = buf + len;
3430Sstevel@tonic-gate 
3440Sstevel@tonic-gate 	/*
3450Sstevel@tonic-gate 	 *
3460Sstevel@tonic-gate 	 * Loop through each packet in the buffer
3470Sstevel@tonic-gate 	 */
3480Sstevel@tonic-gate 	last_timestamp.tv_sec = 0;
3490Sstevel@tonic-gate 	(void) memcpy((char *)ojmp_env, (char *)jmp_env, sizeof (jmp_env));
3500Sstevel@tonic-gate 	for (bp = buf; bp < bufstop; bp += nhdrp->sbh_totlen) {
3510Sstevel@tonic-gate 		/*
3520Sstevel@tonic-gate 		 * Gracefully exit if user terminates
3530Sstevel@tonic-gate 		 */
3540Sstevel@tonic-gate 		if (quitting)
3550Sstevel@tonic-gate 			break;
3560Sstevel@tonic-gate 		/*
3570Sstevel@tonic-gate 		 * Global error recocery: Prepare to continue when a corrupt
3580Sstevel@tonic-gate 		 * packet or header is encountered.
3590Sstevel@tonic-gate 		 */
3600Sstevel@tonic-gate 		if (sigsetjmp(jmp_env, 1)) {
3610Sstevel@tonic-gate 			goto err;
3620Sstevel@tonic-gate 		}
3630Sstevel@tonic-gate 
3640Sstevel@tonic-gate 		header_okay = 0;
3650Sstevel@tonic-gate 		hdrp = (struct sb_hdr *)bp;
3660Sstevel@tonic-gate 		nhdrp = hdrp;
3670Sstevel@tonic-gate 		pktp = (char *)hdrp + sizeof (*hdrp);
3680Sstevel@tonic-gate 
3690Sstevel@tonic-gate 		/*
3700Sstevel@tonic-gate 		 * If reading a capture file
3710Sstevel@tonic-gate 		 * convert the headers from network
3720Sstevel@tonic-gate 		 * byte order (for little-endians like X86)
3730Sstevel@tonic-gate 		 */
3740Sstevel@tonic-gate 		if (cap) {
3750Sstevel@tonic-gate 			/*
3760Sstevel@tonic-gate 			 * If the packets come from an old
3770Sstevel@tonic-gate 			 * capture file, convert the header.
3780Sstevel@tonic-gate 			 */
3790Sstevel@tonic-gate 			if (old) {
3801676Sjpk 				convert_old((struct ohdr *)hdrp);
3810Sstevel@tonic-gate 			}
3820Sstevel@tonic-gate 
3830Sstevel@tonic-gate 			nhdrp = &nhdr;
3840Sstevel@tonic-gate 
3850Sstevel@tonic-gate 			nhdrp->sbh_origlen = ntohl(hdrp->sbh_origlen);
3860Sstevel@tonic-gate 			nhdrp->sbh_msglen = ntohl(hdrp->sbh_msglen);
3870Sstevel@tonic-gate 			nhdrp->sbh_totlen = ntohl(hdrp->sbh_totlen);
3880Sstevel@tonic-gate 			nhdrp->sbh_drops = ntohl(hdrp->sbh_drops);
3890Sstevel@tonic-gate 			nhdrp->sbh_timestamp.tv_sec =
3908023SPhil.Kirk@Sun.COM 			    ntohl(hdrp->sbh_timestamp.tv_sec);
3910Sstevel@tonic-gate 			nhdrp->sbh_timestamp.tv_usec =
3928023SPhil.Kirk@Sun.COM 			    ntohl(hdrp->sbh_timestamp.tv_usec);
3930Sstevel@tonic-gate 		}
3940Sstevel@tonic-gate 
3950Sstevel@tonic-gate 		/* Enhanced check for valid header */
3960Sstevel@tonic-gate 
3970Sstevel@tonic-gate 		if ((nhdrp->sbh_totlen == 0) ||
3980Sstevel@tonic-gate 		    (bp + nhdrp->sbh_totlen) < bp ||
3990Sstevel@tonic-gate 		    (bp + nhdrp->sbh_totlen) > bufstop ||
4000Sstevel@tonic-gate 		    (nhdrp->sbh_origlen == 0) ||
4010Sstevel@tonic-gate 		    (bp + nhdrp->sbh_origlen) < bp ||
4020Sstevel@tonic-gate 		    (nhdrp->sbh_msglen == 0) ||
4030Sstevel@tonic-gate 		    (bp + nhdrp->sbh_msglen) < bp ||
4040Sstevel@tonic-gate 		    (bp + nhdrp->sbh_msglen) > bufstop ||
4050Sstevel@tonic-gate 		    (nhdrp->sbh_msglen > nhdrp->sbh_origlen) ||
4060Sstevel@tonic-gate 		    (nhdrp->sbh_totlen < nhdrp->sbh_msglen) ||
4070Sstevel@tonic-gate 		    (nhdrp->sbh_timestamp.tv_sec == 0)) {
4088023SPhil.Kirk@Sun.COM 			if (cap) {
4093628Sss150715 				(void) fprintf(stderr, "(warning) bad packet "
4103628Sss150715 				    "header in capture file");
4118023SPhil.Kirk@Sun.COM 			} else {
4123628Sss150715 				(void) fprintf(stderr, "(warning) bad packet "
4133628Sss150715 				    "header in buffer");
4148023SPhil.Kirk@Sun.COM 			}
4150Sstevel@tonic-gate 			(void) fprintf(stderr, " offset %d: length=%d\n",
4168023SPhil.Kirk@Sun.COM 			    bp - buf, nhdrp->sbh_totlen);
4170Sstevel@tonic-gate 			goto err;
4180Sstevel@tonic-gate 		}
4190Sstevel@tonic-gate 
4200Sstevel@tonic-gate 		if (nhdrp->sbh_totlen >
4213628Sss150715 		    (dlinfo.di_max_sdu + MAX_HDRTRAILER)) {
4220Sstevel@tonic-gate 			if (cap)
4233628Sss150715 				(void) fprintf(stderr, "(warning) packet length"
4243628Sss150715 				    " greater than MTU in capture file");
4250Sstevel@tonic-gate 			else
4263628Sss150715 				(void) fprintf(stderr, "(warning) packet length"
4273628Sss150715 				    " greater than MTU in buffer");
4280Sstevel@tonic-gate 
4290Sstevel@tonic-gate 			(void) fprintf(stderr, " offset %d: length=%d\n",
4308023SPhil.Kirk@Sun.COM 			    bp - buf, nhdrp->sbh_totlen);
4310Sstevel@tonic-gate 		}
4320Sstevel@tonic-gate 
4330Sstevel@tonic-gate 		/*
4340Sstevel@tonic-gate 		 * Check for incomplete packet.  We are conservative here,
4350Sstevel@tonic-gate 		 * since we don't know how good the checking is in other
4360Sstevel@tonic-gate 		 * parts of the code.  We pass a partial packet, with
4370Sstevel@tonic-gate 		 * a warning.
4380Sstevel@tonic-gate 		 */
4390Sstevel@tonic-gate 		if (pktp + nhdrp->sbh_msglen > bufstop) {
4403628Sss150715 			(void) fprintf(stderr, "truncated packet buffer\n");
4410Sstevel@tonic-gate 			nhdrp->sbh_msglen = bufstop - pktp;
4420Sstevel@tonic-gate 		}
4430Sstevel@tonic-gate 
4440Sstevel@tonic-gate #ifdef DEBUG
4450Sstevel@tonic-gate 		if (zflg)
4460Sstevel@tonic-gate 			corrupt(pktp, pktp + nhdrp->sbh_msglen, buf, bufstop);
4470Sstevel@tonic-gate #endif /* DEBUG */
4480Sstevel@tonic-gate 
4490Sstevel@tonic-gate 		header_okay = 1;
4500Sstevel@tonic-gate 		if (!filter ||
451*10616SSebastien.Roy@Sun.COM 		    want_packet((uchar_t *)pktp,
4528023SPhil.Kirk@Sun.COM 		    nhdrp->sbh_msglen,
4538023SPhil.Kirk@Sun.COM 		    nhdrp->sbh_origlen)) {
4540Sstevel@tonic-gate 			count++;
4550Sstevel@tonic-gate 
4560Sstevel@tonic-gate 			/*
4570Sstevel@tonic-gate 			 * Start deadman timer for interpreter processing
4580Sstevel@tonic-gate 			 */
4590Sstevel@tonic-gate 			(void) snoop_alarm(SNOOP_ALARM_GRAN*SNOOP_MAXRECOVER,
4608023SPhil.Kirk@Sun.COM 			    NULL);
4610Sstevel@tonic-gate 
4620Sstevel@tonic-gate 			encap_levels = 0;
4630Sstevel@tonic-gate 			if (!cap || count >= first)
4640Sstevel@tonic-gate 				proc(nhdrp, pktp, count, flags);
4650Sstevel@tonic-gate 
4660Sstevel@tonic-gate 			if (cap && count >= last) {
4670Sstevel@tonic-gate 				(void) snoop_alarm(0, NULL);
4680Sstevel@tonic-gate 				break;
4690Sstevel@tonic-gate 			}
4700Sstevel@tonic-gate 
4710Sstevel@tonic-gate 			if (maxcount && count >= maxcount) {
4723628Sss150715 				(void) fprintf(stderr, "%d packets captured\n",
4733628Sss150715 				    count);
4740Sstevel@tonic-gate 				exit(0);
4750Sstevel@tonic-gate 			}
4760Sstevel@tonic-gate 
4770Sstevel@tonic-gate 			snoop_nrecover = 0;			/* success */
4780Sstevel@tonic-gate 			(void) snoop_alarm(0, NULL);
4790Sstevel@tonic-gate 			last_timestamp = hdrp->sbh_timestamp;	/* save stamp */
4800Sstevel@tonic-gate 		}
4810Sstevel@tonic-gate 		continue;
4820Sstevel@tonic-gate err:
4830Sstevel@tonic-gate 		/*
4840Sstevel@tonic-gate 		 * Corruption has been detected. Reset errors.
4850Sstevel@tonic-gate 		 */
4860Sstevel@tonic-gate 		snoop_recover();
4870Sstevel@tonic-gate 
4880Sstevel@tonic-gate 		/*
4890Sstevel@tonic-gate 		 * packet header was apparently okay. Continue.
4900Sstevel@tonic-gate 		 */
4910Sstevel@tonic-gate 		if (header_okay)
4920Sstevel@tonic-gate 			continue;
4930Sstevel@tonic-gate 
4940Sstevel@tonic-gate 		/*
4950Sstevel@tonic-gate 		 * Otherwise try to scan forward to the next packet, using
4960Sstevel@tonic-gate 		 * the last known timestamp if it is available.
4970Sstevel@tonic-gate 		 */
4980Sstevel@tonic-gate 		nhdrp = &nhdr;
4990Sstevel@tonic-gate 		nhdrp->sbh_totlen = 0;
5000Sstevel@tonic-gate 		if (last_timestamp.tv_sec == 0) {
5010Sstevel@tonic-gate 			bp += sizeof (int);
5020Sstevel@tonic-gate 		} else {
5030Sstevel@tonic-gate 			for (bp += sizeof (int); bp <= bufstop;
5048023SPhil.Kirk@Sun.COM 			    bp += sizeof (int)) {
5050Sstevel@tonic-gate 				hdrp = (struct sb_hdr *)bp;
5060Sstevel@tonic-gate 				/* An approximate timestamp located */
5070Sstevel@tonic-gate 				if ((hdrp->sbh_timestamp.tv_sec >> 8) ==
5080Sstevel@tonic-gate 				    (last_timestamp.tv_sec >> 8))
5090Sstevel@tonic-gate 					break;
5100Sstevel@tonic-gate 			}
5110Sstevel@tonic-gate 		}
5120Sstevel@tonic-gate 	}
5130Sstevel@tonic-gate 	/* reset jmp_env for program exit */
5140Sstevel@tonic-gate 	(void) memcpy((char *)jmp_env, (char *)ojmp_env, sizeof (jmp_env));
5150Sstevel@tonic-gate 	proc(0, -1, 0);
5160Sstevel@tonic-gate }
5170Sstevel@tonic-gate 
5180Sstevel@tonic-gate /*
5190Sstevel@tonic-gate  * Called if nwrite() encounters write problems.
5200Sstevel@tonic-gate  */
5210Sstevel@tonic-gate static void
5220Sstevel@tonic-gate cap_write_error(const char *msgtype)
5230Sstevel@tonic-gate {
5240Sstevel@tonic-gate 	(void) fprintf(stderr,
5258023SPhil.Kirk@Sun.COM 	    "snoop: cannot write %s to capture file: %s\n",
5268023SPhil.Kirk@Sun.COM 	    msgtype, strerror(errno));
5270Sstevel@tonic-gate 	exit(1);
5280Sstevel@tonic-gate }
5290Sstevel@tonic-gate 
5300Sstevel@tonic-gate /*
5310Sstevel@tonic-gate  * Writes target buffer to the open file descriptor. Upon detection of a short
5320Sstevel@tonic-gate  * write, an attempt to process the remaining bytes occurs until all anticipated
5330Sstevel@tonic-gate  * bytes are written. An error status is returned to indicate any serious write
5340Sstevel@tonic-gate  * failures.
5350Sstevel@tonic-gate  */
5360Sstevel@tonic-gate static int
5370Sstevel@tonic-gate nwrite(int fd, const void *buffer, size_t buflen)
5380Sstevel@tonic-gate {
5390Sstevel@tonic-gate 	size_t nwritten;
5400Sstevel@tonic-gate 	ssize_t nbytes = 0;
5410Sstevel@tonic-gate 	const char *buf = buffer;
5420Sstevel@tonic-gate 
5430Sstevel@tonic-gate 	for (nwritten = 0; nwritten < buflen; nwritten += nbytes) {
5440Sstevel@tonic-gate 		nbytes = write(fd, &buf[nwritten], buflen - nwritten);
5450Sstevel@tonic-gate 		if (nbytes == -1)
5460Sstevel@tonic-gate 			return (-1);
5470Sstevel@tonic-gate 		if (nbytes == 0) {
5480Sstevel@tonic-gate 			errno = EIO;
5490Sstevel@tonic-gate 			return (-1);
5500Sstevel@tonic-gate 		}
5510Sstevel@tonic-gate 	}
5520Sstevel@tonic-gate 	return (0);
5530Sstevel@tonic-gate }
5540Sstevel@tonic-gate 
5550Sstevel@tonic-gate /*
5560Sstevel@tonic-gate  * Routines for opening, closing, reading and writing
5570Sstevel@tonic-gate  * a capture file of packets saved with the -o option.
5580Sstevel@tonic-gate  */
5590Sstevel@tonic-gate static int capfile_out;
5600Sstevel@tonic-gate 
5610Sstevel@tonic-gate /*
5620Sstevel@tonic-gate  * The snoop capture file has a header to identify
5630Sstevel@tonic-gate  * it as a capture file and record its version.
5640Sstevel@tonic-gate  * A file without this header is assumed to be an
5650Sstevel@tonic-gate  * old format snoop file.
5660Sstevel@tonic-gate  *
5670Sstevel@tonic-gate  * A version 1 header looks like this:
5680Sstevel@tonic-gate  *
5690Sstevel@tonic-gate  *   0   1   2   3   4   5   6   7   8   9  10  11
5700Sstevel@tonic-gate  * +---+---+---+---+---+---+---+---+---+---+---+---+---+
5710Sstevel@tonic-gate  * | s | n | o | o | p | \0| \0| \0|    version    |  data
5720Sstevel@tonic-gate  * +---+---+---+---+---+---+---+---+---+---+---+---+---+
5730Sstevel@tonic-gate  * |	 word 0	   |	 word 1	   |	 word 2	   |
5740Sstevel@tonic-gate  *
5750Sstevel@tonic-gate  *
5760Sstevel@tonic-gate  * A version 2 header adds a word that identifies the MAC type.
5770Sstevel@tonic-gate  * This allows for capture files from FDDI etc.
5780Sstevel@tonic-gate  *
5790Sstevel@tonic-gate  *   0   1   2   3   4   5   6   7   8   9  10  11  12  13  14  15
5800Sstevel@tonic-gate  * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
5810Sstevel@tonic-gate  * | s | n | o | o | p | \0| \0| \0|    version    |    MAC type   | data
5820Sstevel@tonic-gate  * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
5830Sstevel@tonic-gate  * |	 word 0	   |	 word 1	   |	 word 2	   |	 word 3
5840Sstevel@tonic-gate  *
5850Sstevel@tonic-gate  */
5861676Sjpk static const char *snoop_id = "snoop\0\0\0";
5871676Sjpk static const int snoop_idlen = 8;
5881676Sjpk static const int snoop_version = 2;
5890Sstevel@tonic-gate 
5900Sstevel@tonic-gate void
5913628Sss150715 cap_open_write(const char *name)
5920Sstevel@tonic-gate {
5930Sstevel@tonic-gate 	int vers;
5940Sstevel@tonic-gate 
5950Sstevel@tonic-gate 	capfile_out = open(name, O_CREAT | O_TRUNC | O_RDWR, 0666);
5960Sstevel@tonic-gate 	if (capfile_out < 0)
5970Sstevel@tonic-gate 		pr_err("%s: %m", name);
5980Sstevel@tonic-gate 
5990Sstevel@tonic-gate 	vers = htonl(snoop_version);
6001676Sjpk 	if (nwrite(capfile_out, snoop_id, snoop_idlen) == -1)
6010Sstevel@tonic-gate 		cap_write_error("snoop_id");
6020Sstevel@tonic-gate 
6031676Sjpk 	if (nwrite(capfile_out, &vers, sizeof (int)) == -1)
6040Sstevel@tonic-gate 		cap_write_error("version");
6050Sstevel@tonic-gate }
6060Sstevel@tonic-gate 
6070Sstevel@tonic-gate 
6080Sstevel@tonic-gate void
6091676Sjpk cap_close(void)
6100Sstevel@tonic-gate {
6111676Sjpk 	(void) close(capfile_out);
6120Sstevel@tonic-gate }
6130Sstevel@tonic-gate 
6140Sstevel@tonic-gate static char *cap_buffp = NULL;
6150Sstevel@tonic-gate static int cap_len = 0;
6160Sstevel@tonic-gate static int cap_new;
6170Sstevel@tonic-gate 
6180Sstevel@tonic-gate void
6193628Sss150715 cap_open_read(const char *name)
6200Sstevel@tonic-gate {
6210Sstevel@tonic-gate 	struct stat st;
6220Sstevel@tonic-gate 	int cap_vers;
6230Sstevel@tonic-gate 	int *word, device_mac_type;
6240Sstevel@tonic-gate 	int capfile_in;
6250Sstevel@tonic-gate 
6260Sstevel@tonic-gate 	capfile_in = open(name, O_RDONLY);
6270Sstevel@tonic-gate 	if (capfile_in < 0)
6280Sstevel@tonic-gate 		pr_err("couldn't open %s: %m", name);
6290Sstevel@tonic-gate 
6300Sstevel@tonic-gate 	if (fstat(capfile_in, &st) < 0)
6310Sstevel@tonic-gate 		pr_err("couldn't stat %s: %m", name);
6320Sstevel@tonic-gate 	cap_len = st.st_size;
6330Sstevel@tonic-gate 
6340Sstevel@tonic-gate 	cap_buffp = mmap(0, cap_len, PROT_READ, MAP_PRIVATE, capfile_in, 0);
6351676Sjpk 	(void) close(capfile_in);
6360Sstevel@tonic-gate 	if ((int)cap_buffp == -1)
6370Sstevel@tonic-gate 		pr_err("couldn't mmap %s: %m", name);
6380Sstevel@tonic-gate 
6390Sstevel@tonic-gate 	/* Check if new snoop capture file format */
6400Sstevel@tonic-gate 
6410Sstevel@tonic-gate 	cap_new = bcmp(cap_buffp, snoop_id, snoop_idlen) == 0;
6420Sstevel@tonic-gate 
6430Sstevel@tonic-gate 	/*
6440Sstevel@tonic-gate 	 * If new file - check version and
6450Sstevel@tonic-gate 	 * set buffer pointer to point at first packet
6460Sstevel@tonic-gate 	 */
6470Sstevel@tonic-gate 	if (cap_new) {
6480Sstevel@tonic-gate 		cap_vers = ntohl(*(int *)(cap_buffp + snoop_idlen));
6490Sstevel@tonic-gate 		cap_buffp += snoop_idlen + sizeof (int);
6500Sstevel@tonic-gate 		cap_len   -= snoop_idlen + sizeof (int);
6510Sstevel@tonic-gate 
6520Sstevel@tonic-gate 		switch (cap_vers) {
6530Sstevel@tonic-gate 		case 1:
6540Sstevel@tonic-gate 			device_mac_type = DL_ETHER;
6550Sstevel@tonic-gate 			break;
6560Sstevel@tonic-gate 
6570Sstevel@tonic-gate 		case 2:
6580Sstevel@tonic-gate 			device_mac_type = ntohl(*((int *)cap_buffp));
6590Sstevel@tonic-gate 			cap_buffp += sizeof (int);
6600Sstevel@tonic-gate 			cap_len   -= sizeof (int);
6610Sstevel@tonic-gate 			break;
6620Sstevel@tonic-gate 
6630Sstevel@tonic-gate 		default:
6640Sstevel@tonic-gate 			pr_err("capture file: %s: Version %d unrecognized\n",
6658023SPhil.Kirk@Sun.COM 			    name, cap_vers);
6660Sstevel@tonic-gate 		}
6670Sstevel@tonic-gate 
6680Sstevel@tonic-gate 		for (interface = &INTERFACES[0]; interface->mac_type != -1;
6698023SPhil.Kirk@Sun.COM 		    interface++)
6700Sstevel@tonic-gate 			if (interface->mac_type == device_mac_type)
6710Sstevel@tonic-gate 				break;
6720Sstevel@tonic-gate 
6730Sstevel@tonic-gate 		if (interface->mac_type == -1)
6740Sstevel@tonic-gate 			pr_err("Mac Type = %x is not supported\n",
6758023SPhil.Kirk@Sun.COM 			    device_mac_type);
6760Sstevel@tonic-gate 	} else {
6770Sstevel@tonic-gate 		/* Use heuristic to check if it's an old-style file */
6780Sstevel@tonic-gate 
6790Sstevel@tonic-gate 		device_mac_type = DL_ETHER;
6800Sstevel@tonic-gate 		word = (int *)cap_buffp;
6810Sstevel@tonic-gate 
6820Sstevel@tonic-gate 		if (!((word[0] < 1600 && word[1] < 1600) &&
6830Sstevel@tonic-gate 		    (word[0] < word[1]) &&
6840Sstevel@tonic-gate 		    (word[2] > 610000000 && word[2] < 770000000)))
6850Sstevel@tonic-gate 			pr_err("not a capture file: %s", name);
6860Sstevel@tonic-gate 
6870Sstevel@tonic-gate 		/* Change protection so's we can fix the headers */
6880Sstevel@tonic-gate 
6890Sstevel@tonic-gate 		if (mprotect(cap_buffp, cap_len, PROT_READ | PROT_WRITE) < 0)
6900Sstevel@tonic-gate 			pr_err("mprotect: %s: %m", name);
6910Sstevel@tonic-gate 	}
6923628Sss150715 	dlinfo.di_max_sdu = MAXINT;	/* Decode any stored packet. */
6930Sstevel@tonic-gate }
6940Sstevel@tonic-gate 
6950Sstevel@tonic-gate void
6963628Sss150715 cap_read(int first, int last, int filter, void (*proc)(), int flags)
6970Sstevel@tonic-gate {
6980Sstevel@tonic-gate 	extern int count;
6990Sstevel@tonic-gate 
7000Sstevel@tonic-gate 	count = 0;
7010Sstevel@tonic-gate 
7020Sstevel@tonic-gate 	scan(cap_buffp, cap_len, filter, 1, !cap_new, proc, first, last, flags);
7030Sstevel@tonic-gate 
7041676Sjpk 	(void) munmap(cap_buffp, cap_len);
7050Sstevel@tonic-gate }
7060Sstevel@tonic-gate 
7071676Sjpk /* ARGSUSED */
7080Sstevel@tonic-gate void
7093628Sss150715 cap_write(struct sb_hdr *hdrp, char *pktp, int num, int flags)
7100Sstevel@tonic-gate {
7110Sstevel@tonic-gate 	int pktlen, mac;
7120Sstevel@tonic-gate 	static int first = 1;
7130Sstevel@tonic-gate 	struct sb_hdr nhdr;
7140Sstevel@tonic-gate 	extern boolean_t qflg;
7150Sstevel@tonic-gate 
7160Sstevel@tonic-gate 	if (hdrp == NULL)
7170Sstevel@tonic-gate 		return;
7180Sstevel@tonic-gate 
7190Sstevel@tonic-gate 	if (first) {
7200Sstevel@tonic-gate 		first = 0;
7210Sstevel@tonic-gate 		mac = htonl(interface->mac_type);
7221676Sjpk 		if (nwrite(capfile_out, &mac, sizeof (int)) == -1)
7230Sstevel@tonic-gate 			cap_write_error("mac_type");
7240Sstevel@tonic-gate 	}
7250Sstevel@tonic-gate 
7260Sstevel@tonic-gate 	pktlen = hdrp->sbh_totlen - sizeof (*hdrp);
7270Sstevel@tonic-gate 
7280Sstevel@tonic-gate 	/*
7290Sstevel@tonic-gate 	 * Convert sb_hdr to network byte order
7300Sstevel@tonic-gate 	 */
7310Sstevel@tonic-gate 	nhdr.sbh_origlen = htonl(hdrp->sbh_origlen);
7320Sstevel@tonic-gate 	nhdr.sbh_msglen = htonl(hdrp->sbh_msglen);
7330Sstevel@tonic-gate 	nhdr.sbh_totlen = htonl(hdrp->sbh_totlen);
7340Sstevel@tonic-gate 	nhdr.sbh_drops = htonl(hdrp->sbh_drops);
7350Sstevel@tonic-gate 	nhdr.sbh_timestamp.tv_sec = htonl(hdrp->sbh_timestamp.tv_sec);
7360Sstevel@tonic-gate 	nhdr.sbh_timestamp.tv_usec = htonl(hdrp->sbh_timestamp.tv_usec);
7370Sstevel@tonic-gate 
7381676Sjpk 	if (nwrite(capfile_out, &nhdr, sizeof (nhdr)) == -1)
7390Sstevel@tonic-gate 		cap_write_error("packet header");
7400Sstevel@tonic-gate 
7411676Sjpk 	if (nwrite(capfile_out, pktp, pktlen) == -1)
7420Sstevel@tonic-gate 		cap_write_error("packet");
7430Sstevel@tonic-gate 
7440Sstevel@tonic-gate 	if (! qflg)
7450Sstevel@tonic-gate 		show_count();
7460Sstevel@tonic-gate }
7470Sstevel@tonic-gate 
7480Sstevel@tonic-gate /*
7490Sstevel@tonic-gate  * Convert a packet header from
7500Sstevel@tonic-gate  * old to new format.
7510Sstevel@tonic-gate  */
7521676Sjpk static void
7531676Sjpk convert_old(struct ohdr *ohdrp)
7540Sstevel@tonic-gate {
7550Sstevel@tonic-gate 	struct sb_hdr nhdr;
7560Sstevel@tonic-gate 
7570Sstevel@tonic-gate 	nhdr.sbh_origlen = ohdrp->o_len;
7580Sstevel@tonic-gate 	nhdr.sbh_msglen  = ohdrp->o_msglen;
7590Sstevel@tonic-gate 	nhdr.sbh_totlen  = ohdrp->o_totlen;
7600Sstevel@tonic-gate 	nhdr.sbh_drops   = ohdrp->o_drops;
7610Sstevel@tonic-gate 	nhdr.sbh_timestamp = ohdrp->o_time;
7620Sstevel@tonic-gate 
7630Sstevel@tonic-gate 	*(struct sb_hdr *)ohdrp = nhdr;
7640Sstevel@tonic-gate }
7650Sstevel@tonic-gate 
766410Skcpoon static int
7671676Sjpk strioctl(int fd, int cmd, int timout, int len, void *dp)
7680Sstevel@tonic-gate {
7690Sstevel@tonic-gate 	struct	strioctl	sioc;
7700Sstevel@tonic-gate 	int	rc;
7710Sstevel@tonic-gate 
7720Sstevel@tonic-gate 	sioc.ic_cmd = cmd;
7730Sstevel@tonic-gate 	sioc.ic_timout = timout;
7740Sstevel@tonic-gate 	sioc.ic_len = len;
7750Sstevel@tonic-gate 	sioc.ic_dp = dp;
7760Sstevel@tonic-gate 	rc = ioctl(fd, I_STR, &sioc);
7770Sstevel@tonic-gate 
7780Sstevel@tonic-gate 	if (rc < 0)
7790Sstevel@tonic-gate 		return (rc);
7800Sstevel@tonic-gate 	else
7810Sstevel@tonic-gate 		return (sioc.ic_len);
7820Sstevel@tonic-gate }
783