xref: /onnv-gate/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_capture.c (revision 2760:38f12e308f6d)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"	/* SunOS */

#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#include <setjmp.h>
#include <sys/types.h>
#include <sys/signal.h>
#include <sys/time.h>
#include <sys/socket.h>
#include <sys/sockio.h>
#include <net/if.h>
#include <netinet/in_systm.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <sys/pfmod.h>
#include <netinet/if_ether.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/stropts.h>
#include <sys/bufmod.h>
#include <sys/dlpi.h>

#include <unistd.h>
#include <stropts.h>
#include <stdlib.h>
#include <ctype.h>
#include <values.h>
#include <libdlpi.h>

#include "snoop.h"

/*
 * Old header format.
 * Actually two concatenated structs:  nit_bufhdr + nit_head
 */
struct ohdr {
	/* nit_bufhdr */
	int	o_msglen;
	int	o_totlen;
	/* nit_head */
	struct timeval o_time;
	int	o_drops;
	int	o_len;
};

static void scan(char *, int, int, int, int, void (*)(), int, int, int);
void convert_to_network();
void convert_from_network();
static void convert_old(struct ohdr *);
extern sigjmp_buf jmp_env, ojmp_env;
static int netfd;
static union DL_primitives netdl;		/* info_ack for interface */
static char *bufp;	/* pointer to read buffer */

static int strioctl(int, int, int, int, void *);

/*
 * Convert a device id to a ppa value
 * e.g. "le0" -> 0
 */
static int
device_ppa(char *device)
{
	char *p;
	char *tp;

	p = strpbrk(device, "0123456789");
	if (p == NULL)
		return (0);
	/* ignore numbers within device names */
	for (tp = p; *tp != '\0'; tp++)
		if (!isdigit(*tp))
			return (device_ppa(tp));
	return (atoi(p));
}

/*
 * Convert a device id to a pathname.
 * Level 1 devices: "le0" -> "/dev/le0".
 * Level 2 devices: "le0" -> "/dev/le".
 */
static char *
device_path(char *device)
{
	static char buff[IF_NAMESIZE + 1];
	struct stat st;
	char *p;

	(void) strcpy(buff, "/dev/");
	(void) strlcat(buff, device, IF_NAMESIZE);

	if (stat(buff, &st) == 0)
		return (buff);

	for (p = buff + (strlen(buff) - 1); p > buff; p--) {
		if (isdigit(*p))
			*p = '\0';
		else
			break;
	}
	return (buff);
}

/*
 * Open up the device, and start finding out something about it,
 * especially stuff about the data link headers.  We need that information
 * to build the proper packet filters.
 */
boolean_t
check_device(char **devicep, int *ppap)
{
	char *devname;
	/*
	 * Determine which network device
	 * to use if none given.
	 * Should get back a value like "le0".
	 */

	if (*devicep == NULL) {
		char *cbuf;
		static struct ifconf ifc;
		static struct ifreq *ifr;
		int s;
		int n;
		int numifs;
		unsigned bufsize;

		if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
		    pr_err("socket");

		if (ioctl(s, SIOCGIFNUM, (char *)&numifs) < 0) {
			pr_err("check_device: ioctl SIOCGIFNUM");
			(void) close(s);
			s = -1;
			return (B_FALSE);
		}

		bufsize = numifs * sizeof (struct ifreq);
		cbuf = (char *)malloc(bufsize);
		if (cbuf == NULL) {
			pr_err("out of memory\n");
			(void) close(s);
			s = -1;
			return (B_FALSE);
		}
		ifc.ifc_len = bufsize;
		ifc.ifc_buf = cbuf;
		if (ioctl(s, SIOCGIFCONF, (char *)&ifc) < 0) {
			pr_err("check_device: ioctl SIOCGIFCONF");
			(void) close(s);
			s = -1;
			(void) free(cbuf);
			return (B_FALSE);
		}
		n = ifc.ifc_len / sizeof (struct ifreq);
		ifr = ifc.ifc_req;
		for (; n > 0; n--, ifr++) {
			if (strchr(ifr->ifr_name, ':') != NULL)
				continue;
			if (ioctl(s, SIOCGIFFLAGS, (char *)ifr) < 0)
				pr_err("ioctl SIOCGIFFLAGS");
			if ((ifr->ifr_flags &
				(IFF_VIRTUAL|IFF_LOOPBACK|IFF_UP|
				IFF_RUNNING)) == (IFF_UP|IFF_RUNNING))
				break;
		}

		if (n == 0)
			pr_err("No network interface devices found");

		*devicep = ifr->ifr_name;
		(void) close(s);
	}

	devname = device_path(*devicep);
	if ((netfd = open(devname, O_RDWR)) < 0)
		pr_err("%s: %m", devname);

	*ppap = device_ppa(*devicep);

	/*
	 * Check for DLPI Version 2.
	 */
	dlinforeq(netfd, &netdl);
	if (netdl.info_ack.dl_version != DL_VERSION_2)
		pr_err("DL_INFO_ACK:  incompatible version %d",
		netdl.info_ack.dl_version);

	/*
	 * Attach for DLPI Style 2.
	 */
	if (netdl.info_ack.dl_provider_style == DL_STYLE2) {
		dlattachreq(netfd, *ppap);
		/* Reread more specific information */
		dlinforeq(netfd, &netdl);
	}

	/* Enable passive mode so that we can snoop on aggregated links. */
	dlpi_passive(netfd, -1);

	for (interface = &INTERFACES[0]; interface->mac_type != -1; interface++)
		if (interface->mac_type == netdl.info_ack.dl_mac_type)
			break;

	/* allow limited functionality even is interface isn't known */
	if (interface->mac_type == -1) {
		fprintf(stderr,
		    "snoop: WARNING: Mac Type = %lx not supported\n",
		    netdl.info_ack.dl_mac_type);
	}

	/* for backward compatibility, allow known interface mtu_sizes */
	if (interface->mtu_size > (uint_t)netdl.info_ack.dl_max_sdu)
		netdl.info_ack.dl_max_sdu = (t_scalar_t)interface->mtu_size;

	return (interface->try_kernel_filter);
}

/*
 * Do whatever is necessary to initialize the interface
 * for packet capture. Bind the device opened and attached (if DL_STYLE2)
 * in check_device(), request raw ethernet packets and set promiscuous mode,
 * push the streams buffer module and packet filter module, set various buffer
 * parameters.
 */
/* ARGSUSED */
void
initdevice(device, snaplen, chunksize, timeout, fp, ppa)
	char *device;
	ulong_t snaplen, chunksize;
	struct timeval *timeout;
	struct Pf_ext_packetfilt *fp;
	int ppa;
{
	extern int Pflg;

	/*
	 * Bind to SAP 2 on token ring, 0 on other interface types.
	 * (SAP 0 has special significance on token ring)
	 */
	if (interface->mac_type == DL_TPR)
		dlbindreq(netfd, 2, 0, DL_CLDLS, 0);
	else
		dlbindreq(netfd, 0, 0, DL_CLDLS, 0);

	(void) fprintf(stderr, "Using device %s ", device_path(device));

	/*
	 * If Pflg not set - use physical level
	 * promiscuous mode.  Otherwise - just SAP level.
	 */
	if (!Pflg) {
		(void) fprintf(stderr, "(promiscuous mode)\n");
		dlpromiscon(netfd, DL_PROMISC_PHYS);
	} else {
		(void) fprintf(stderr, "(non promiscuous)\n");
		dlpromiscon(netfd, DL_PROMISC_MULTI);
	}

	dlpromiscon(netfd, DL_PROMISC_SAP);

	if (ioctl(netfd, DLIOCRAW, 0) < 0) {
		(void) close(netfd);
		pr_err("ioctl: DLIOCRAW: %s: %m", device_path(device));
	}

	if (fp) {
		/*
		 * push and configure the packet filtering module
		 */
		if (ioctl(netfd, I_PUSH, "pfmod") < 0) {
			(void) close(netfd);
			pr_err("ioctl: I_PUSH pfmod: %s: %m",
			    device_path(device));
		}

		if (strioctl(netfd, PFIOCSETF, -1, sizeof (*fp),
		    (char *)fp) < 0) {
			(void) close(netfd);
			pr_err("PFIOCSETF: %s: %m", device_path(device));
		}
	}

	if (ioctl(netfd, I_PUSH, "bufmod") < 0) {
		(void) close(netfd);
		pr_err("push bufmod: %s: %m", device_path(device));
	}

	if (strioctl(netfd, SBIOCSTIME, -1, sizeof (struct timeval),
	    (char *)timeout) < 0) {
		(void) close(netfd);
		pr_err("SBIOCSTIME: %s: %m", device_path(device));
	}

	if (strioctl(netfd, SBIOCSCHUNK, -1, sizeof (uint_t),
	    (char *)&chunksize) < 0) {
		(void) close(netfd);
		pr_err("SBIOCGCHUNK: %s: %m", device_path(device));
	}

	if (strioctl(netfd, SBIOCSSNAP, -1, sizeof (uint_t),
	    (char *)&snaplen) < 0) {
		(void) close(netfd);
		pr_err("SBIOCSSNAP: %s: %m", device_path(device));
	}

	/*
	 * Flush the read queue, to get rid of anything that
	 * accumulated before the device reached its final configuration.
	 */
	if (ioctl(netfd, I_FLUSH, FLUSHR) < 0) {
		(void) close(netfd);
		pr_err("I_FLUSH: %s: %m", device_path(device));
	}
}

/*
 * Read packets from the network.  Initdevice is called in
 * here to set up the network interface for reading of
 * raw ethernet packets in promiscuous mode into a buffer.
 * Packets are read and either written directly to a file
 * or interpreted for display on the fly.
 */
void
net_read(chunksize, filter, proc, flags)
	int chunksize, filter;
	void (*proc)();
	int flags;
{
	int r = 0;
	struct strbuf data;
	int flgs;
	extern int count;

	data.len = 0;
	count = 0;

	/* allocate a read buffer */

	bufp = malloc(chunksize);
	if (bufp == NULL)
		pr_err("no memory for %dk buffer", chunksize);

	/*
	 *	read frames
	 */
	for (;;) {
		data.maxlen = chunksize;
		data.len = 0;
		data.buf = bufp;
		flgs = 0;

		r = getmsg(netfd, NULL, &data, &flgs);

		if (r < 0 || quitting)
			break;

		if (data.len <= 0)
			continue;

		scan(bufp, data.len, filter, 0, 0, proc, 0, 0, flags);
	}

	free(bufp);
	(void) close(netfd);

	if (!quitting) {
		if (r < 0)
			pr_err("network read failed: %m");
		else
			pr_err("network read returned %d", r);
	}
}

#ifdef DEBUG
/*
 * corrupt: simulate packet corruption for debugging interpreters
 */
void
corrupt(volatile char *pktp, volatile char *pstop, char *buf,
	volatile char *bufstop)
{
	int c;
	int i;
	int p;
	int li = rand() % (pstop - pktp - 1) + 1;
	volatile char *pp = pktp;
	volatile char *pe = bufstop < pstop ? bufstop : pstop;

	if (pktp < buf || pktp > bufstop)
		return;

	for (pp = pktp; pp < pe; pp += li) {
		c = ((pe - pp) < li ? pe - pp : li);
		i = (rand() % c)>>1;
		while (--i > 0) {
			p = (rand() % c);
			pp[p] = (unsigned char)(rand() & 0xFF);
		}
	}
}
#endif /* DEBUG */

static void
scan(char *buf, int len, int filter, int cap, int old, void (*proc)(),
    int first, int last, int flags)
{
	volatile char *bp, *bufstop;
	volatile struct sb_hdr *hdrp;
	volatile struct sb_hdr nhdr, *nhdrp;
	volatile char *pktp;
	volatile struct timeval last_timestamp;
	volatile int header_okay;
	extern int count, maxcount;
	extern int snoop_nrecover;
#ifdef	DEBUG
	extern int zflg;
#endif	/* DEBUG */

	proc(0, 0, 0);
	bufstop = buf + len;

	/*
	 *
	 * Loop through each packet in the buffer
	 */
	last_timestamp.tv_sec = 0;
	(void) memcpy((char *)ojmp_env, (char *)jmp_env, sizeof (jmp_env));
	for (bp = buf; bp < bufstop; bp += nhdrp->sbh_totlen) {
		/*
		 * Gracefully exit if user terminates
		 */
		if (quitting)
			break;
		/*
		 * Global error recocery: Prepare to continue when a corrupt
		 * packet or header is encountered.
		 */
		if (sigsetjmp(jmp_env, 1)) {
			goto err;
		}

		header_okay = 0;
		hdrp = (struct sb_hdr *)bp;
		nhdrp = hdrp;
		pktp = (char *)hdrp + sizeof (*hdrp);

		/*
		 * If reading a capture file
		 * convert the headers from network
		 * byte order (for little-endians like X86)
		 */
		if (cap) {
			/*
			 * If the packets come from an old
			 * capture file, convert the header.
			 */
			if (old) {
				convert_old((struct ohdr *)hdrp);
			}

			nhdrp = &nhdr;

			nhdrp->sbh_origlen = ntohl(hdrp->sbh_origlen);
			nhdrp->sbh_msglen = ntohl(hdrp->sbh_msglen);
			nhdrp->sbh_totlen = ntohl(hdrp->sbh_totlen);
			nhdrp->sbh_drops = ntohl(hdrp->sbh_drops);
			nhdrp->sbh_timestamp.tv_sec =
				ntohl(hdrp->sbh_timestamp.tv_sec);
			nhdrp->sbh_timestamp.tv_usec =
				ntohl(hdrp->sbh_timestamp.tv_usec);
		}

		/* Enhanced check for valid header */

		if ((nhdrp->sbh_totlen == 0) ||
		    (bp + nhdrp->sbh_totlen) < bp ||
		    (bp + nhdrp->sbh_totlen) > bufstop ||
		    (nhdrp->sbh_origlen == 0) ||
		    (bp + nhdrp->sbh_origlen) < bp ||
		    (nhdrp->sbh_msglen == 0) ||
		    (bp + nhdrp->sbh_msglen) < bp ||
		    (bp + nhdrp->sbh_msglen) > bufstop ||
		    (nhdrp->sbh_msglen > nhdrp->sbh_origlen) ||
		    (nhdrp->sbh_totlen < nhdrp->sbh_msglen) ||
		    (nhdrp->sbh_timestamp.tv_sec == 0)) {
			if (cap)
				fprintf(stderr, "(warning) bad packet header "
						"in capture file");
			else
				fprintf(stderr, "(warning) bad packet header "
						"in buffer");
			(void) fprintf(stderr, " offset %d: length=%d\n",
				bp - buf, nhdrp->sbh_totlen);
			goto err;
		}

		if (nhdrp->sbh_totlen >
		    (uint_t)(netdl.info_ack.dl_max_sdu + MAX_HDRTRAILER)) {
			if (cap)
				fprintf(stderr, "(warning) packet length "
					"greater than MTU in capture file");
			else
				fprintf(stderr, "(warning) packet length "
					"greater than MTU in buffer");

			(void) fprintf(stderr, " offset %d: length=%d\n",
				bp - buf, nhdrp->sbh_totlen);
		}

		/*
		 * Check for incomplete packet.  We are conservative here,
		 * since we don't know how good the checking is in other
		 * parts of the code.  We pass a partial packet, with
		 * a warning.
		 */
		if (pktp + nhdrp->sbh_msglen > bufstop) {
			fprintf(stderr, "truncated packet buffer\n");
			nhdrp->sbh_msglen = bufstop - pktp;
		}

#ifdef DEBUG
		if (zflg)
			corrupt(pktp, pktp + nhdrp->sbh_msglen, buf, bufstop);
#endif /* DEBUG */

		header_okay = 1;
		if (!filter ||
			want_packet(pktp,
				nhdrp->sbh_msglen,
				nhdrp->sbh_origlen)) {
			count++;

			/*
			 * Start deadman timer for interpreter processing
			 */
			(void) snoop_alarm(SNOOP_ALARM_GRAN*SNOOP_MAXRECOVER,
				NULL);

			encap_levels = 0;
			if (!cap || count >= first)
				proc(nhdrp, pktp, count, flags);

			if (cap && count >= last) {
				(void) snoop_alarm(0, NULL);
				break;
			}

			if (maxcount && count >= maxcount) {
				fprintf(stderr, "%d packets captured\n", count);
				exit(0);
			}

			snoop_nrecover = 0;			/* success */
			(void) snoop_alarm(0, NULL);
			last_timestamp = hdrp->sbh_timestamp;	/* save stamp */
		}
		continue;
err:
		/*
		 * Corruption has been detected. Reset errors.
		 */
		snoop_recover();

		/*
		 * packet header was apparently okay. Continue.
		 */
		if (header_okay)
			continue;

		/*
		 * Otherwise try to scan forward to the next packet, using
		 * the last known timestamp if it is available.
		 */
		nhdrp = &nhdr;
		nhdrp->sbh_totlen = 0;
		if (last_timestamp.tv_sec == 0) {
			bp += sizeof (int);
		} else {
			for (bp += sizeof (int); bp <= bufstop;
				bp += sizeof (int)) {
				hdrp = (struct sb_hdr *)bp;
				/* An approximate timestamp located */
				if ((hdrp->sbh_timestamp.tv_sec >> 8) ==
				    (last_timestamp.tv_sec >> 8))
					break;
			}
		}
	}
	/* reset jmp_env for program exit */
	(void) memcpy((char *)jmp_env, (char *)ojmp_env, sizeof (jmp_env));
	proc(0, -1, 0);
}

/*
 * Called if nwrite() encounters write problems.
 */
static void
cap_write_error(const char *msgtype)
{
	(void) fprintf(stderr,
		    "snoop: cannot write %s to capture file: %s\n",
		    msgtype, strerror(errno));
	exit(1);
}

/*
 * Writes target buffer to the open file descriptor. Upon detection of a short
 * write, an attempt to process the remaining bytes occurs until all anticipated
 * bytes are written. An error status is returned to indicate any serious write
 * failures.
 */
static int
nwrite(int fd, const void *buffer, size_t buflen)
{
	size_t nwritten;
	ssize_t nbytes = 0;
	const char *buf = buffer;

	for (nwritten = 0; nwritten < buflen; nwritten += nbytes) {
		nbytes = write(fd, &buf[nwritten], buflen - nwritten);
		if (nbytes == -1)
			return (-1);
		if (nbytes == 0) {
			errno = EIO;
			return (-1);
		}
	}
	return (0);
}

/*
 * Routines for opening, closing, reading and writing
 * a capture file of packets saved with the -o option.
 */
static int capfile_out;

/*
 * The snoop capture file has a header to identify
 * it as a capture file and record its version.
 * A file without this header is assumed to be an
 * old format snoop file.
 *
 * A version 1 header looks like this:
 *
 *   0   1   2   3   4   5   6   7   8   9  10  11
 * +---+---+---+---+---+---+---+---+---+---+---+---+---+
 * | s | n | o | o | p | \0| \0| \0|    version    |  data
 * +---+---+---+---+---+---+---+---+---+---+---+---+---+
 * |	 word 0	   |	 word 1	   |	 word 2	   |
 *
 *
 * A version 2 header adds a word that identifies the MAC type.
 * This allows for capture files from FDDI etc.
 *
 *   0   1   2   3   4   5   6   7   8   9  10  11  12  13  14  15
 * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
 * | s | n | o | o | p | \0| \0| \0|    version    |    MAC type   | data
 * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
 * |	 word 0	   |	 word 1	   |	 word 2	   |	 word 3
 *
 */
static const char *snoop_id = "snoop\0\0\0";
static const int snoop_idlen = 8;
static const int snoop_version = 2;

void
cap_open_write(name)
	char *name;
{
	int vers;

	capfile_out = open(name, O_CREAT | O_TRUNC | O_RDWR, 0666);
	if (capfile_out < 0)
		pr_err("%s: %m", name);

	vers = htonl(snoop_version);
	if (nwrite(capfile_out, snoop_id, snoop_idlen) == -1)
		cap_write_error("snoop_id");

	if (nwrite(capfile_out, &vers, sizeof (int)) == -1)
		cap_write_error("version");
}


void
cap_close(void)
{
	(void) close(capfile_out);
}

static char *cap_buffp = NULL;
static int cap_len = 0;
static int cap_new;

void
cap_open_read(name)
	char *name;
{
	struct stat st;
	int cap_vers;
	int *word, device_mac_type;
	int capfile_in;

	capfile_in = open(name, O_RDONLY);
	if (capfile_in < 0)
		pr_err("couldn't open %s: %m", name);

	if (fstat(capfile_in, &st) < 0)
		pr_err("couldn't stat %s: %m", name);
	cap_len = st.st_size;

	cap_buffp = mmap(0, cap_len, PROT_READ, MAP_PRIVATE, capfile_in, 0);
	(void) close(capfile_in);
	if ((int)cap_buffp == -1)
		pr_err("couldn't mmap %s: %m", name);

	/* Check if new snoop capture file format */

	cap_new = bcmp(cap_buffp, snoop_id, snoop_idlen) == 0;

	/*
	 * If new file - check version and
	 * set buffer pointer to point at first packet
	 */
	if (cap_new) {
		cap_vers = ntohl(*(int *)(cap_buffp + snoop_idlen));
		cap_buffp += snoop_idlen + sizeof (int);
		cap_len   -= snoop_idlen + sizeof (int);

		switch (cap_vers) {
		case 1:
			device_mac_type = DL_ETHER;
			break;

		case 2:
			device_mac_type = ntohl(*((int *)cap_buffp));
			cap_buffp += sizeof (int);
			cap_len   -= sizeof (int);
			break;

		default:
			pr_err("capture file: %s: Version %d unrecognized\n",
				name, cap_vers);
		}

		for (interface = &INTERFACES[0]; interface->mac_type != -1;
				interface++)
			if (interface->mac_type == device_mac_type)
				break;

		if (interface->mac_type == -1)
			pr_err("Mac Type = %x is not supported\n",
				device_mac_type);
	} else {
		/* Use heuristic to check if it's an old-style file */

		device_mac_type = DL_ETHER;
		word = (int *)cap_buffp;

		if (!((word[0] < 1600 && word[1] < 1600) &&
		    (word[0] < word[1]) &&
		    (word[2] > 610000000 && word[2] < 770000000)))
			pr_err("not a capture file: %s", name);

		/* Change protection so's we can fix the headers */

		if (mprotect(cap_buffp, cap_len, PROT_READ | PROT_WRITE) < 0)
			pr_err("mprotect: %s: %m", name);
	}
	netdl.info_ack.dl_max_sdu = MAXINT;	/* Decode any stored packet. */
}

void
cap_read(first, last, filter, proc, flags)
	int first, last;
	int filter;
	void (*proc)();
	int flags;
{
	extern int count;

	count = 0;

	scan(cap_buffp, cap_len, filter, 1, !cap_new, proc, first, last, flags);

	(void) munmap(cap_buffp, cap_len);
}

/* ARGSUSED */
void
cap_write(hdrp, pktp, num, flags)
	struct sb_hdr *hdrp;
	char *pktp;
	int num, flags;
{
	int pktlen, mac;
	static int first = 1;
	struct sb_hdr nhdr;
	extern boolean_t qflg;

	if (hdrp == NULL)
		return;

	if (first) {
		first = 0;
		mac = htonl(interface->mac_type);
		if (nwrite(capfile_out, &mac, sizeof (int)) == -1)
			cap_write_error("mac_type");
	}

	pktlen = hdrp->sbh_totlen - sizeof (*hdrp);

	/*
	 * Convert sb_hdr to network byte order
	 */
	nhdr.sbh_origlen = htonl(hdrp->sbh_origlen);
	nhdr.sbh_msglen = htonl(hdrp->sbh_msglen);
	nhdr.sbh_totlen = htonl(hdrp->sbh_totlen);
	nhdr.sbh_drops = htonl(hdrp->sbh_drops);
	nhdr.sbh_timestamp.tv_sec = htonl(hdrp->sbh_timestamp.tv_sec);
	nhdr.sbh_timestamp.tv_usec = htonl(hdrp->sbh_timestamp.tv_usec);

	if (nwrite(capfile_out, &nhdr, sizeof (nhdr)) == -1)
		cap_write_error("packet header");

	if (nwrite(capfile_out, pktp, pktlen) == -1)
		cap_write_error("packet");

	if (! qflg)
		show_count();
}

/*
 * Convert a packet header from
 * old to new format.
 */
static void
convert_old(struct ohdr *ohdrp)
{
	struct sb_hdr nhdr;

	nhdr.sbh_origlen = ohdrp->o_len;
	nhdr.sbh_msglen  = ohdrp->o_msglen;
	nhdr.sbh_totlen  = ohdrp->o_totlen;
	nhdr.sbh_drops   = ohdrp->o_drops;
	nhdr.sbh_timestamp = ohdrp->o_time;

	*(struct sb_hdr *)ohdrp = nhdr;
}

static int
strioctl(int fd, int cmd, int timout, int len, void *dp)
{
	struct	strioctl	sioc;
	int	rc;

	sioc.ic_cmd = cmd;
	sioc.ic_timout = timout;
	sioc.ic_len = len;
	sioc.ic_dp = dp;
	rc = ioctl(fd, I_STR, &sioc);

	if (rc < 0)
		return (rc);
	else
		return (sioc.ic_len);
}