1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
|
#!/usr/bin/perl
#
# Module: vyatta-tshark-interface-port.pl
#
# **** License ****
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2 as
# published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# This code was originally developed by Vyatta, Inc.
# Portions created by Vyatta are Copyright (C) 2006, 2007, 2008 Vyatta, Inc.
# All Rights Reserved.
#
# Author: John Southworth
# Date: Sept. 2011
# Description: run tshark on a given interface with options
#
# **** End License ****
#
use lib "/opt/vyatta/share/perl5/";
use strict;
use warnings;
use Getopt::Long;
sub check_if_interface_is_tsharkable {
my $interface = shift;
my @grep_tshark_interfaces = `/usr/bin/tshark -D | grep $interface`;
my $any_interface;
for my $count (0 .. $#grep_tshark_interfaces) {
my @temp = split(/ /,$grep_tshark_interfaces[$count]);
chomp $temp[1];
$grep_tshark_interfaces[$count] = $temp[1];
}
my $exact_match = 0;
for my $count (0 .. $#grep_tshark_interfaces) {
if ($grep_tshark_interfaces[$count] eq $interface) {
$exact_match = 1;
$any_interface = $grep_tshark_interfaces[$count];
}
}
if ($exact_match == 0 || $any_interface eq 'any') {
print "Unable to capture traffic on $interface\n";
exit 1;
}
}
#
# main
#
my ($detail,$filter,$intf,$unlimited,$save);
GetOptions("detail!" => \$detail,
"filter=s" => \$filter,
"save=s" => \$save,
"intf=s" => \$intf,
"unlimited!" => \$unlimited);
check_if_interface_is_tsharkable($intf);
if (defined($save)){
if (!($save =~ /.*\.pcap/)) {
print("Please name your file <filename>.pcap\n");
exit 1;
}
exec "/usr/bin/tshark -i $intf -w '$save'";
exit 0;
}
if (defined($filter)) {
if (defined($detail)) {
if (defined($unlimited)){
print "Capturing traffic on $intf ...\n";
exec "/usr/bin/tshark -n -i $intf -V $filter 2> /dev/null";
} else {
print "Capturing traffic on $intf ...\n";
exec "/usr/bin/tshark -n -i $intf -c 1000 -V $filter 2> /dev/null";
}
} elsif (defined($unlimited)) {
print "Capturing traffic on $intf ...\n";
exec "/usr/bin/tshark -n -i $intf $filter 2> /dev/null";
} else {
print "Capturing traffic on $intf ...\n";
exec "/usr/bin/tshark -n -i $intf -c 1000 $filter 2> /dev/null";
}
} elsif (defined($detail)) {
if (defined($unlimited)) {
print "Capturing traffic on $intf ...\n";
exec "/usr/bin/tshark -n -i $intf -V 2> /dev/null";
} else {
print "Capturing traffic on $intf ...\n";
exec "/usr/bin/tshark -n -i $intf -c 1000 -V 2> /dev/null";
}
} elsif (defined($unlimited)) {
print "Capturing traffic on $intf ...\n";
exec "/usr/bin/tshark -n -i $intf 2> /dev/null";
} else {
print "Capturing traffic on $intf ...\n";
exec "/usr/bin/tshark -n -i $intf -c 1000 2> /dev/null";
}
exit 0;
#end of file
|
