contrib/network/analyzer/dsniff/files/03_pcap_read_dump.patch

diff -Nur dsniff-2.4-old/dsniff.8 dsniff-2.4/dsniff.8
--- dsniff-2.4-old/dsniff.8	2009-09-15 00:11:17.159202783 +0300
+++ dsniff-2.4/dsniff.8	2009-09-15 00:11:20.297202352 +0300
@@ -10,7 +10,7 @@
 .nf
 .fi
 \fBdsniff\fR [\fB-c\fR] [\fB-d\fR] [\fB-m\fR] [\fB-n\fR] [\fB-i
-\fIinterface\fR] [\fB-s \fIsnaplen\fR] [\fB-f \fIservices\fR]
+\fIinterface\fR | \fB-p \fIpcapfile\fR] [\fB-s \fIsnaplen\fR] [\fB-f \fIservices\fR]
 [\fB-t \fItrigger[,...]\fR]]
 [\fB-r\fR|\fB-w\fR \fIsavefile\fR] [\fIexpression\fR]
 .SH DESCRIPTION
@@ -45,6 +45,9 @@
 Do not resolve IP addresses to hostnames.
 .IP "\fB-i \fIinterface\fR"
 Specify the interface to listen on.
+.IP "\fB-p \fIpcapfile\fR"
+Rather than processing the contents of packets observed upon the network 
+process the given PCAP capture file.
 .IP "\fB-s \fIsnaplen\fR"
 Analyze at most the first \fIsnaplen\fR bytes of each TCP connection,
 rather than the default of 1024.
diff -Nur dsniff-2.4-old/dsniff.c dsniff-2.4/dsniff.c
--- dsniff-2.4-old/dsniff.c	2009-09-15 00:11:17.158475246 +0300
+++ dsniff-2.4/dsniff.c	2009-09-15 00:11:20.298202201 +0300
@@ -46,8 +46,9 @@
 usage(void)
 {
 	fprintf(stderr, "Version: " VERSION "\n"
-		"Usage: dsniff [-cdmn] [-i interface] [-s snaplen] [-f services]\n"
-		"              [-t trigger[,...]] [-r|-w savefile] [expression]\n");
+		"Usage: dsniff [-cdmn] [-i interface | -p pcapfile] [-s snaplen]\n"
+		"              [-f services] [-t trigger[,...]] [-r|-w savefile]\n"
+		"              [expression]\n");
 	exit(1);
 }
 
@@ -79,7 +80,7 @@
 
 	services = savefile = triggers = NULL;
 	
-	while ((c = getopt(argc, argv, "cdf:i:mnr:s:t:w:h?V")) != -1) {
+	while ((c = getopt(argc, argv, "cdf:i:mnp:r:s:t:w:h?V")) != -1) {
 		switch (c) {
 		case 'c':
 			Opt_client = 1;
@@ -99,6 +100,9 @@
 		case 'n':
 			Opt_dns = 0;
 			break;
+		case 'p':
+			nids_params.filename = optarg;
+			break;
 		case 'r':
 			Opt_read = 1;
 			savefile = optarg;
@@ -168,10 +172,23 @@
 	else nids_register_tcp(trigger_tcp);
 	
 	if (nids_params.pcap_filter != NULL) {
-		warnx("listening on %s [%s]", nids_params.device,
-		      nids_params.pcap_filter);
+		if (nids_params.filename == NULL) {
+			warnx("listening on %s [%s]", nids_params.device,
+		        nids_params.pcap_filter);
+		}
+		else {
+			warnx("using %s [%s]", nids_params.filename,
+		        nids_params.pcap_filter);
+		}
+	}
+	else {
+		if (nids_params.filename == NULL) {
+			warnx("listening on %s", nids_params.device);
+		}
+		else {
+			warnx("using %s", nids_params.filename);
+		}
 	}
-	else warnx("listening on %s", nids_params.device);
 	
 	nids_run();
 	
diff -Nur dsniff-2.4-old/filesnarf.8 dsniff-2.4/filesnarf.8
--- dsniff-2.4-old/filesnarf.8	2009-09-15 00:11:17.164203350 +0300
+++ dsniff-2.4/filesnarf.8	2009-09-15 00:11:20.298202201 +0300
@@ -9,7 +9,7 @@
 .na
 .nf
 .fi
-\fBfilesnarf\fR [\fB-i \fIinterface\fR] [[\fB-v\fR] \fIpattern [\fIexpression\fR]]
+\fBfilesnarf\fR [\fB-i \fIinterface\fR | \fB-p \fIpcapfile\fR] [[\fB-v\fR] \fIpattern [\fIexpression\fR]]
 .SH DESCRIPTION
 .ad
 .fi
@@ -18,6 +18,8 @@
 .SH OPTIONS
 .IP "\fB-i \fIinterface\fR"
 Specify the interface to listen on.
+.IP "\fB-p \fIpcapfile\fR"
+Process packets from the specified PCAP capture file instead of the network.
 .IP \fB-v\fR
 "Versus" mode. Invert the sense of matching, to select non-matching
 files.
diff -Nur dsniff-2.4-old/filesnarf.c dsniff-2.4/filesnarf.c
--- dsniff-2.4-old/filesnarf.c	2009-09-15 00:11:17.157475747 +0300
+++ dsniff-2.4/filesnarf.c	2009-09-15 00:11:20.299201839 +0300
@@ -51,7 +51,7 @@
 usage(void)
 {
 	fprintf(stderr, "Version: " VERSION "\n"
-		"Usage: filesnarf [-i interface] [[-v] pattern [expression]]\n");
+		"Usage: filesnarf [-i interface | -p pcapfile] [[-v] pattern [expression]]\n");
 	exit(1);
 }
 
@@ -464,11 +464,14 @@
 	extern int optind;
 	int c;
 
-	while ((c = getopt(argc, argv, "i:vh?V")) != -1) {
+	while ((c = getopt(argc, argv, "i:p:vh?V")) != -1) {
 		switch (c) {
 		case 'i':
 			nids_params.device = optarg;
 			break;
+		case 'p':
+			nids_params.filename = optarg;
+			break;
 		case 'v':
 			Opt_invert = 1;
 			break;
@@ -498,11 +501,24 @@
 	nids_register_ip(decode_udp_nfs);
 	nids_register_tcp(decode_tcp_nfs);
 
-	if (nids_params.pcap_filter != NULL) {
-		warnx("listening on %s [%s]", nids_params.device,
-		      nids_params.pcap_filter);
-	}
-	else warnx("listening on %s", nids_params.device);
+        if (nids_params.pcap_filter != NULL) {
+                if (nids_params.filename == NULL) {
+                        warnx("listening on %s [%s]", nids_params.device,
+                              nids_params.pcap_filter);
+                }
+                else {
+                        warnx("using %s [%s]", nids_params.filename,
+                              nids_params.pcap_filter);
+                }
+        }
+        else {
+                if (nids_params.filename == NULL) {
+                        warnx("listening on %s", nids_params.device);
+                }
+                else {
+                        warnx("using %s", nids_params.filename);
+                }
+        }
 
 	nids_run();
 
diff -Nur dsniff-2.4-old/mailsnarf.8 dsniff-2.4/mailsnarf.8
--- dsniff-2.4-old/mailsnarf.8	2009-09-15 00:11:17.157475747 +0300
+++ dsniff-2.4/mailsnarf.8	2009-09-15 00:11:20.299201839 +0300
@@ -9,7 +9,7 @@
 .na
 .nf
 .fi
-\fBmailsnarf\fR [\fB-i \fIinterface\fR] [[\fB-v\fR] \fIpattern [\fIexpression\fR]]
+\fBmailsnarf\fR [\fB-i \fIinterface\fR | \fB-p \fIpcapfile\fR] [[\fB-v\fR] \fIpattern [\fIexpression\fR]]
 .SH DESCRIPTION
 .ad
 .fi
@@ -19,6 +19,8 @@
 .SH OPTIONS
 .IP "\fB-i \fIinterface\fR"
 Specify the interface to listen on.
+.IP "\fB-p \fIpcapfile\fR"
+Process packets from the specified PCAP capture file instead of the network.
 .IP \fB-v\fR
 "Versus" mode. Invert the sense of matching, to select non-matching
 messages.
diff -Nur dsniff-2.4-old/mailsnarf.c dsniff-2.4/mailsnarf.c
--- dsniff-2.4-old/mailsnarf.c	2009-09-15 00:11:20.295203843 +0300
+++ dsniff-2.4/mailsnarf.c	2009-09-15 00:11:20.300202037 +0300
@@ -59,7 +59,7 @@
 usage(void)
 {
 	fprintf(stderr, "Version: " VERSION "\n"
-		"Usage: mailsnarf [-i interface] [[-v] pattern [expression]]\n");
+		"Usage: mailsnarf [-i interface | -p pcapfile] [[-v] pattern [expression]]\n");
 	exit(1);
 }
 
@@ -344,11 +344,14 @@
 	extern int optind;
 	int c;
 	
-	while ((c = getopt(argc, argv, "i:vh?V")) != -1) {
+	while ((c = getopt(argc, argv, "i:p:vh?V")) != -1) {
 		switch (c) {
 		case 'i':
 			nids_params.device = optarg;
 			break;
+                case 'p':
+                        nids_params.filename = optarg;
+                        break;
 		case 'v':
 			Opt_invert = 1;
 			break;
@@ -378,10 +381,23 @@
 	nids_register_tcp(sniff_pop_session);
 
 	if (nids_params.pcap_filter != NULL) {
-		warnx("listening on %s [%s]", nids_params.device,
-		      nids_params.pcap_filter);
-	}
-	else warnx("listening on %s", nids_params.device);
+                if (nids_params.filename == NULL) {
+		        warnx("listening on %s [%s]", nids_params.device,
+		              nids_params.pcap_filter);
+                }
+                else {
+		        warnx("using %s [%s]", nids_params.filename,
+		              nids_params.pcap_filter);
+                }
+	}
+	else {
+                if (nids_params.filename == NULL) {
+                    warnx("listening on %s", nids_params.device);
+                }
+                else {
+                    warnx("using %s", nids_params.filename);
+                }
+        }
 	
 	nids_run();
 	
diff -Nur dsniff-2.4-old/msgsnarf.8 dsniff-2.4/msgsnarf.8
--- dsniff-2.4-old/msgsnarf.8	2009-09-15 00:11:17.161202828 +0300
+++ dsniff-2.4/msgsnarf.8	2009-09-15 00:11:20.300202037 +0300
@@ -9,7 +9,7 @@
 .na
 .nf
 .fi
-\fBmsgsnarf\fR [\fB-i \fIinterface\fR] [[\fB-v\fR] \fIpattern [\fIexpression\fR]]
+\fBmsgsnarf\fR [\fB-i \fIinterface\fR | \fB-p \fIpcapfile\fR] [[\fB-v\fR] \fIpattern [\fIexpression\fR]]
 .SH DESCRIPTION
 .ad
 .fi
@@ -19,6 +19,8 @@
 .SH OPTIONS
 .IP "\fB-i \fIinterface\fR"
 Specify the interface to listen on.
+.IP "\fB-p \fIpcapfile\fR"
+Process packets from the specified PCAP capture file instead of the network.
 .IP \fB-v\fR
 "Versus" mode. Invert the sense of matching, to select non-matching
 messages.
diff -Nur dsniff-2.4-old/msgsnarf.c dsniff-2.4/msgsnarf.c
--- dsniff-2.4-old/msgsnarf.c	2009-09-15 00:11:20.231202323 +0300
+++ dsniff-2.4/msgsnarf.c	2009-09-15 00:11:20.301201954 +0300
@@ -45,7 +45,7 @@
 usage(void)
 {
 	fprintf(stderr, "Version: " VERSION "\n"
-		"Usage: msgsnarf [-i interface] [[-v] pattern [expression]]\n");
+		"Usage: msgsnarf [-i interface | -p pcapfile] [[-v] pattern [expression]]\n");
 	exit(1);
 }
 
@@ -633,11 +633,14 @@
 	extern int optind;
 	int c;
 	
-	while ((c = getopt(argc, argv, "i:hv?V")) != -1) {
+	while ((c = getopt(argc, argv, "i:p:hv?V")) != -1) {
 		switch (c) {
 		case 'i':
 			nids_params.device = optarg;
 			break;
+		case 'p':
+			nids_params.filename = optarg;
+			break;
 		case 'v':
 			Opt_invert = 1;
 			break;
@@ -666,11 +669,24 @@
 	
 	nids_register_tcp(sniff_msgs);
 
-	if (nids_params.pcap_filter != NULL) {
-		warnx("listening on %s [%s]", nids_params.device,
-		      nids_params.pcap_filter);
-	}
-	else warnx("listening on %s", nids_params.device);
+        if (nids_params.pcap_filter != NULL) {
+                if (nids_params.filename == NULL) {
+                        warnx("listening on %s [%s]", nids_params.device,
+                              nids_params.pcap_filter);
+                }
+                else {
+                        warnx("using %s [%s]", nids_params.filename,
+                              nids_params.pcap_filter);
+                }
+        }
+        else {
+                if (nids_params.filename == NULL) {
+                    warnx("listening on %s", nids_params.device);
+                }
+                else {
+                    warnx("using %s", nids_params.filename);
+                }
+        }
 
 	nids_run();
 	
diff -Nur dsniff-2.4-old/sshow.8 dsniff-2.4/sshow.8
--- dsniff-2.4-old/sshow.8	2009-09-15 00:11:17.168204279 +0300
+++ dsniff-2.4/sshow.8	2009-09-15 00:11:20.301201954 +0300
@@ -9,7 +9,7 @@
 .na
 .nf
 .fi
-\fBsshow\fR [\fB-d\fR] [\fB-i \fIinterface\fR] [\fIexpression\fR]
+\fBsshow\fR [\fB-d\fR] [\fB-i \fIinterface\fR | \fB-p \fIpcapfile\fR] [\fIexpression\fR]
 .SH DESCRIPTION
 .ad
 .fi
@@ -28,6 +28,8 @@
 Enable verbose debugging output.
 .IP "\fB-i \fIinterface\fR"
 Specify the interface to listen on.
+.IP "\fB-p \fIpcapfile\fR"
+Process packets from the specified PCAP capture file instead of the network.
 .IP "\fIexpression\fR"
 Specify a tcpdump(8) filter expression to select traffic to sniff.
 .SH "SEE ALSO"
diff -Nur dsniff-2.4-old/sshow.c dsniff-2.4/sshow.c
--- dsniff-2.4-old/sshow.c	2009-09-15 00:11:20.265201767 +0300
+++ dsniff-2.4/sshow.c	2009-09-15 00:11:20.302201942 +0300
@@ -82,7 +82,7 @@
 static void
 usage(void)
 {
-	fprintf(stderr, "Usage: sshow [-d] [-i interface]\n");
+	fprintf(stderr, "Usage: sshow [-d] [-i interface | -p pcapfile]\n");
 	exit(1);
 }
 
@@ -616,7 +616,7 @@
 	extern int optind;
 	int c;
 	
-	while ((c = getopt(argc, argv, "di:h?")) != -1) {
+	while ((c = getopt(argc, argv, "di:p:h?")) != -1) {
 		switch (c) {
 		case 'd':
 			debug++;
@@ -624,6 +624,9 @@
 		case 'i':
 			nids_params.device = optarg;
 			break;
+		case 'p':
+			nids_params.filename = optarg;
+			break;
 		default:
 			usage();
 			break;
@@ -652,11 +655,24 @@
 	
 	nids_register_tcp(process_event);
 
-	if (nids_params.pcap_filter != NULL) {
-		warnx("listening on %s [%s]", nids_params.device,
-		      nids_params.pcap_filter);
-	}
-	else warnx("listening on %s", nids_params.device);
+        if (nids_params.pcap_filter != NULL) {
+                if (nids_params.filename == NULL) {
+                        warnx("listening on %s [%s]", nids_params.device,
+                              nids_params.pcap_filter);
+                }
+                else {
+                        warnx("using %s [%s]", nids_params.filename,
+                              nids_params.pcap_filter);
+                }
+        }
+        else {
+                if (nids_params.filename == NULL) {
+                    warnx("listening on %s", nids_params.device);
+                }
+                else {
+                    warnx("using %s", nids_params.filename);
+                }
+        }
 
 	nids_run();
 	
diff -Nur dsniff-2.4-old/urlsnarf.8 dsniff-2.4/urlsnarf.8
--- dsniff-2.4-old/urlsnarf.8	2009-09-15 00:11:17.162203445 +0300
+++ dsniff-2.4/urlsnarf.8	2009-09-15 00:11:20.302201942 +0300
@@ -9,7 +9,7 @@
 .na
 .nf
 .fi
-\fBurlsnarf\fR [\fB-n\fR] [\fB-i \fIinterface\fR]  [[\fB-v\fR] \fIpattern [\fIexpression\fR]]
+\fBurlsnarf\fR [\fB-n\fR] [\fB-i \fIinterface\fR | \fB-p \fIpcapfile\fR]  [[\fB-v\fR] \fIpattern [\fIexpression\fR]]
 .SH DESCRIPTION
 .ad
 .fi
@@ -21,6 +21,9 @@
 .IP \fB-n\fR
 Do not resolve IP addresses to hostnames.
 .IP "\fB-i \fIinterface\fR"
+Specify the interface to listen on.
+.IP "\fB-p \fIpcapfile\fR"
+Process packets from the specified PCAP capture file instead of the network.
 .IP \fB-v\fR
 "Versus" mode. Invert the sense of matching, to select non-matching
 URLs.
diff -Nur dsniff-2.4-old/urlsnarf.c dsniff-2.4/urlsnarf.c
--- dsniff-2.4-old/urlsnarf.c	2009-09-15 00:11:17.168204279 +0300
+++ dsniff-2.4/urlsnarf.c	2009-09-15 00:11:20.302201942 +0300
@@ -41,7 +41,7 @@
 usage(void)
 {
 	fprintf(stderr, "Version: " VERSION "\n"
-		"Usage: urlsnarf [-n] [-i interface] [[-v] pattern [expression]]\n");
+		"Usage: urlsnarf [-n] [-i interface | -p pcapfile] [[-v] pattern [expression]]\n");
 	exit(1);
 }
 
@@ -201,11 +201,14 @@
 	extern int optind;
 	int c;
 	
-	while ((c = getopt(argc, argv, "i:nvh?V")) != -1) {
+	while ((c = getopt(argc, argv, "i:p:nvh?V")) != -1) {
 		switch (c) {
 		case 'i':
 			nids_params.device = optarg;
 			break;
+		case 'p':
+			nids_params.filename = optarg;
+			break;
 		case 'n':
 			Opt_dns = 0;
 			break;
@@ -238,8 +241,24 @@
 	
 	nids_register_tcp(sniff_http_client);
 
-	warnx("listening on %s [%s]", nids_params.device,
-	      nids_params.pcap_filter);
+        if (nids_params.pcap_filter != NULL) {
+                if (nids_params.filename == NULL) {
+                        warnx("listening on %s [%s]", nids_params.device,
+                              nids_params.pcap_filter);
+                }
+                else {
+                        warnx("using %s [%s]", nids_params.filename,
+                              nids_params.pcap_filter);
+                }
+        }
+        else {
+                if (nids_params.filename == NULL) {
+                    warnx("listening on %s", nids_params.device);
+                }
+                else {
+                    warnx("using %s", nids_params.filename);
+                }
+        }
 
 	nids_run();
 	
diff -Nur dsniff-2.4-old/webspy.8 dsniff-2.4/webspy.8
--- dsniff-2.4-old/webspy.8	2009-09-15 00:11:17.162203445 +0300
+++ dsniff-2.4/webspy.8	2009-09-15 00:11:20.303201929 +0300
@@ -9,7 +9,7 @@
 .na
 .nf
 .fi
-\fBwebspy\fR [\fB-i \fIinterface\fR] \fIhost\fR
+\fBwebspy\fR [\fB-i \fIinterface\fR | \fB-p \fIpcapfile\fR] \fIhost\fR
 .SH DESCRIPTION
 .ad
 .fi
@@ -20,6 +20,8 @@
 .SH OPTIONS
 .IP "\fB-i \fIinterface\fR"
 Specify the interface to listen on.
+.IP "\fB-p \fIpcapfile\fR"
+Process packets from the specified PCAP capture file instead of the network.
 .IP \fIhost\fR
 Specify the web client to spy on.
 .SH "SEE ALSO"
diff -Nur dsniff-2.4-old/webspy.c dsniff-2.4/webspy.c
--- dsniff-2.4-old/webspy.c	2009-09-15 00:11:17.167204361 +0300
+++ dsniff-2.4/webspy.c	2009-09-15 00:11:20.303201929 +0300
@@ -42,7 +42,7 @@
 usage(void)
 {
 	fprintf(stderr, "Version: " VERSION "\n"
-		"Usage: %s [-i interface] host\n", progname);
+		"Usage: %s [-i interface | -p pcapfile] host\n", progname);
 	exit(1);
 }
 
@@ -184,11 +184,14 @@
 	extern int optind;
 	int c;
 	
-	while ((c = getopt(argc, argv, "i:h?V")) != -1) {
+	while ((c = getopt(argc, argv, "i:p:h?V")) != -1) {
 		switch (c) {
 		case 'i':
 			nids_params.device = optarg;
 			break;
+		case 'p':
+			nids_params.filename = optarg;
+			break;
 		default:
 			usage();
 		}
@@ -216,7 +219,13 @@
 	
 	nids_register_tcp(sniff_http_client);
 
-	warnx("listening on %s", nids_params.device);
+        if (nids_params.filename == NULL) {
+                warnx("listening on %s", nids_params.device);
+        }
+        else {
+                warnx("using %s", nids_params.filename);
+        }
+
 
 	nids_run();