contrib/libpcap/pcap-rpcap.c

116 	char *currentfilter;		/* Pointer to a buffer (allocated at run-time) that stores the current filter. Needed when flag PCAP_OPENFLAG_NOCAPTURE_RPCAP is turned on. */
154 static void pcap_save_current_filter_rpcap(pcap_t *fp, const char *filter);
1177 	/* Pack the capture filter */
1342 	 * In case the user does not want to capture RPCAP packets, let's update the filter
1409  * - pcap_startcapture_remote() is called (we have to send the filter
1411  * - we want to udpate the filter during a capture (i.e. pcap_setfilter()
1414  * This function serializes the filter into the sending buffer ('sendbuf',
1431 	struct rpcap_filter *filter;
1434 	struct bpf_program fake_prog;		/* To be used just in case the user forgot to set a filter */
1437 	if (prog->bf_len == 0)	/* No filters have been specified; so, let's apply a "fake" filter */
1445 	filter = (struct rpcap_filter *) sendbuf;
1451 	filter->filtertype = htons(RPCAP_UPDATEFILTER_BPF);
1452 	filter->nitems = htonl((int32)prog->bf_len);
1458 	insn = (struct rpcap_filterbpf_insn *) (filter + 1);
1476  * This function updates a filter on a remote host.
1478  * It is called when the user wants to update a filter.
1479  * In case we're capturing from the network, it sends the filter to our
1487  *   stores the filter into the pcap_t structure, and then the filter is
1492  * that are related to the previous filter.  If you want to discard all
1493  * the packets before applying a new filter, you have to close the
1497  * received with the old filter, and have a separate pcap_setfilter_noflush()
1537 pcap_save_current_filter_rpcap(pcap_t *fp, const char *filter)
1546 	 * If so, we have to save the current filter, because we have to
1555 		if (filter == NULL)
1556 			filter = "";
1558 		pr->currentfilter = strdup(filter);
1563  * This function sends a filter to a remote host.
1565  * This function is called when the user wants to set a filter.
1566  * It sends the filter to our peer.
1577 		/* copy filter into the pcap_t structure */
1583 	/* we have to update a filter during run-time */
1591  * This function updates the current filter in order not to capture rpcap
1605 	/* We do not want to capture our RPCAP traffic. So, let's update the filter */
1665 			 * We have a current filter; add items to it to
1666 			 * filter out this rpcap session.
1676 				    "Can't allocate memory for new filter");
1683 			 * We have no current filter; construct a filter to
1684 			 * filter out this rpcap session.
1693 				    "Can't allocate memory for new filter");
1701 		 * from saving the modified filter.
2159  * has a NULL filter) the new traffic can saturate the network.
2182  * been started, the filter will be saved into the pcap_t structure,