2 * iwcap.c - A simply radiotap capture utility outputting pcap dumps
4 * Copyright 2012 Jo-Philipp Wich <jow@openwrt.org>
6 * Licensed under the Apache License, Version 2.0 (the "License");
7 * you may not use this file except in compliance with the License.
8 * You may obtain a copy of the License at
10 * http://www.apache.org/licenses/LICENSE-2.0
12 * Unless required by applicable law or agreed to in writing, software
13 * distributed under the License is distributed on an "AS IS" BASIS,
14 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 * See the License for the specific language governing permissions and
16 * limitations under the License.
31 #include <sys/ioctl.h>
32 #include <sys/socket.h>
33 #include <net/ethernet.h>
35 #include <netinet/in.h>
36 #include <linux/if_packet.h>
38 #define ARPHRD_IEEE80211_RADIOTAP 803
40 #define DLT_IEEE802_11_RADIO 127
41 #define LEN_IEEE802_11_HDR 32
43 #define FRAMETYPE_MASK 0xFC
44 #define FRAMETYPE_BEACON 0x80
45 #define FRAMETYPE_DATA 0x08
47 #if __BYTE_ORDER == __BIG_ENDIAN
48 #define le16(x) __bswap_16(x)
55 uint8_t run_daemon = 0;
57 uint32_t frames_captured = 0;
58 uint32_t frames_filtered = 0;
60 int capture_sock = -1;
61 const char *ifname = NULL;
65 uint32_t len; /* number of slots */
66 uint32_t fill; /* last used slot */
67 uint32_t slen; /* slot size */
68 void *buf; /* ring memory */
71 struct ringbuf_entry {
72 uint32_t len; /* used slot memory */
73 uint32_t olen; /* original data size */
74 uint32_t sec; /* epoch of slot creation */
75 uint32_t usec; /* epoch microseconds */
78 typedef struct pcap_hdr_s {
79 uint32_t magic_number; /* magic number */
80 uint16_t version_major; /* major version number */
81 uint16_t version_minor; /* minor version number */
82 int32_t thiszone; /* GMT to local correction */
83 uint32_t sigfigs; /* accuracy of timestamps */
84 uint32_t snaplen; /* max length of captured packets, in octets */
85 uint32_t network; /* data link type */
88 typedef struct pcaprec_hdr_s {
89 uint32_t ts_sec; /* timestamp seconds */
90 uint32_t ts_usec; /* timestamp microseconds */
91 uint32_t incl_len; /* number of octets of packet saved in file */
92 uint32_t orig_len; /* actual length of packet */
95 typedef struct ieee80211_radiotap_header {
96 u_int8_t it_version; /* set to 0 */
98 u_int16_t it_len; /* entire length */
99 u_int32_t it_present; /* fields present */
100 } __attribute__((__packed__)) radiotap_hdr_t;
107 strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
109 if (ioctl(capture_sock, SIOCGIFHWADDR, &ifr) < 0)
112 return (ifr.ifr_hwaddr.sa_family == ARPHRD_IEEE80211_RADIOTAP);
115 int set_promisc(int on)
119 strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
121 if (ioctl(capture_sock, SIOCGIFFLAGS, &ifr) < 0)
124 if (on && !(ifr.ifr_flags & IFF_PROMISC))
126 ifr.ifr_flags |= IFF_PROMISC;
128 if (ioctl(capture_sock, SIOCSIFFLAGS, &ifr))
133 else if (!on && (ifr.ifr_flags & IFF_PROMISC))
135 ifr.ifr_flags &= ~IFF_PROMISC;
137 if (ioctl(capture_sock, SIOCSIFFLAGS, &ifr))
147 void sig_dump(int sig)
152 void sig_teardown(int sig)
158 void write_pcap_header(FILE *o)
161 .magic_number = 0xa1b2c3d4,
167 .network = DLT_IEEE802_11_RADIO
170 fwrite(&ghdr, 1, sizeof(ghdr), o);
173 void write_pcap_frame(FILE *o, uint32_t *sec, uint32_t *usec,
174 uint16_t len, uint16_t olen)
181 gettimeofday(&tv, NULL);
189 fhdr.ts_sec = tv.tv_sec;
190 fhdr.ts_usec = tv.tv_usec;
192 fhdr.orig_len = olen;
194 fwrite(&fhdr, 1, sizeof(fhdr), o);
198 struct ringbuf * ringbuf_init(uint32_t num_item, uint16_t len_item)
200 static struct ringbuf r;
205 r.buf = malloc(num_item * (len_item + sizeof(struct ringbuf_entry)));
211 r.slen = (len_item + sizeof(struct ringbuf_entry));
213 memset(r.buf, 0, num_item * len_item);
221 struct ringbuf_entry * ringbuf_add(struct ringbuf *r)
224 struct ringbuf_entry *e;
226 gettimeofday(&t, NULL);
228 e = r->buf + (r->fill++ * r->slen);
231 memset(e, 0, r->slen);
239 struct ringbuf_entry * ringbuf_get(struct ringbuf *r, int i)
241 struct ringbuf_entry *e = r->buf + (((r->fill + i) % r->len) * r->slen);
249 void ringbuf_free(struct ringbuf *r)
252 memset(r, 0, sizeof(*r));
256 void msg(const char *fmt, ...)
262 vsyslog(LOG_INFO | LOG_USER, fmt, ap);
264 vfprintf(stderr, fmt, ap);
270 int main(int argc, char **argv)
273 struct ringbuf *ring;
274 struct ringbuf_entry *e;
275 struct sockaddr_ll local = {
276 .sll_family = AF_PACKET,
277 .sll_protocol = htons(ETH_P_ALL)
280 radiotap_hdr_t *rhdr;
283 uint8_t pktbuf[0xFFFF];
291 uint8_t streaming = 0;
292 uint8_t foreground = 0;
293 uint8_t filter_data = 0;
294 uint8_t filter_beacon = 0;
295 uint8_t header_written = 0;
297 uint32_t ringsz = 1024 * 1024; /* 1 Mbyte ring buffer */
298 uint16_t pktcap = 256; /* truncate frames after 265KB */
300 const char *output = NULL;
303 while ((opt = getopt(argc, argv, "i:r:c:o:sfhBD")) != -1)
309 if (!(local.sll_ifindex = if_nametoindex(ifname)))
311 msg("Unknown interface '%s'\n", ifname);
317 ringsz = atoi(optarg);
318 if (ringsz < (3 * pktcap))
320 msg("Ring size of %d bytes is too short, "
321 "must be at least %d bytes\n", ringsz, 3 * pktcap);
327 pktcap = atoi(optarg);
328 if (pktcap <= (sizeof(radiotap_hdr_t) + LEN_IEEE802_11_HDR))
330 msg("Packet truncate after %d bytes is too short, "
331 "must be at least %d bytes\n",
332 pktcap, sizeof(radiotap_hdr_t) + LEN_IEEE802_11_HDR);
360 " %s -i {iface} -s [-b] [-d]\n"
361 " %s -i {iface} -o {file} [-r len] [-c len] [-B] [-D] [-f]\n"
364 " Specify interface to use, must be in monitor mode and\n"
365 " produce IEEE 802.11 Radiotap headers.\n\n"
367 " Stream to stdout instead of Dumping to file on USR1.\n\n"
369 " Write current ringbuffer contents to given output file\n"
370 " on receipt of SIGUSR1.\n\n"
372 " Specify the amount of bytes to use for the ringbuffer.\n"
373 " The default length is %d bytes.\n\n"
375 " Truncate captured packets after given amount of bytes.\n"
376 " The default size limit is %d bytes.\n\n"
378 " Don't store beacon frames in ring, default is keep.\n\n"
380 " Don't store data frames in ring, default is keep.\n\n"
382 " Do not daemonize but keep running in foreground.\n\n"
384 " Display this help.\n\n",
385 argv[0], argv[0], ringsz, pktcap);
391 if (!streaming && !output)
393 msg("No output file specified\n");
397 if (streaming && output)
399 msg("The -s and -o options are exclusive\n");
403 if (streaming && isatty(1))
405 msg("Refusing to stream into a terminal\n");
409 if (!local.sll_ifindex)
411 msg("No interface specified\n");
417 msg("Bad interface: not ARPHRD_IEEE80211_RADIOTAP\n");
421 if ((capture_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL))) < 0)
423 msg("Unable to create raw socket: %s\n",
428 if (bind(capture_sock, (struct sockaddr *)&local, sizeof(local)) == -1)
430 msg("Unable to bind to interface: %s\n",
442 msg("Unable to fork: %s\n", strerror(errno));
448 freopen("/dev/null", "r", stdin);
449 freopen("/dev/null", "w", stdout);
450 freopen("/dev/null", "w", stderr);
455 msg("Daemon launched ...\n");
460 msg("Monitoring interface %s ...\n", ifname);
462 if (!(ring = ringbuf_init(ringsz / pktcap, pktcap)))
464 msg("Unable to allocate ring buffer: %s\n",
469 msg(" * Using %d bytes ringbuffer with %d slots\n", ringsz, ring->len);
470 msg(" * Truncating frames at %d bytes\n", pktcap);
471 msg(" * Dumping data to file %s\n", output);
473 signal(SIGUSR1, sig_dump);
477 msg("Monitoring interface %s ...\n", ifname);
478 msg(" * Streaming data to stdout\n");
481 msg(" * Beacon frames are %sfiltered\n", filter_beacon ? "" : "not ");
482 msg(" * Data frames are %sfiltered\n", filter_data ? "" : "not ");
484 signal(SIGINT, sig_teardown);
485 signal(SIGTERM, sig_teardown);
487 promisc = set_promisc(1);
494 msg("Shutting down ...\n");
506 msg("Dumping ring to %s ...\n", output);
508 if (!(o = fopen(output, "w")))
510 msg("Unable to open %s: %s\n",
511 output, strerror(errno));
515 write_pcap_header(o);
517 /* sig_dump packet buffer */
518 for (i = 0, n = 0; i < ring->len; i++)
520 if (!(e = ringbuf_get(ring, i)))
523 write_pcap_frame(o, &(e->sec), &(e->usec), e->len, e->olen);
524 fwrite((void *)e + sizeof(*e), 1, e->len, o);
530 msg(" * %d frames captured\n", frames_captured);
531 msg(" * %d frames filtered\n", frames_filtered);
532 msg(" * %d frames dumped\n", n);
538 pktlen = recvfrom(capture_sock, pktbuf, sizeof(pktbuf), 0, NULL, 0);
541 /* check received frametype, if we should filter it, rewind the ring */
542 rhdr = (radiotap_hdr_t *)pktbuf;
544 if (pktlen <= sizeof(radiotap_hdr_t) || le16(rhdr->it_len) >= pktlen)
550 frametype = *(uint8_t *)(pktbuf + le16(rhdr->it_len));
552 if ((filter_data && (frametype & FRAMETYPE_MASK) == FRAMETYPE_DATA) ||
553 (filter_beacon && (frametype & FRAMETYPE_MASK) == FRAMETYPE_BEACON))
563 write_pcap_header(stdout);
567 write_pcap_frame(stdout, NULL, NULL, pktlen, pktlen);
568 fwrite(pktbuf, 1, pktlen, stdout);
573 e = ringbuf_add(ring);
575 e->len = (pktlen > pktcap) ? pktcap : pktlen;
577 memcpy((void *)e + sizeof(*e), pktbuf, e->len);