pfSense

function tcpdump_get_running_process($f){

	$processcheck = trim(shell_exec("/bin/ps axw -O pid= | /usr/bin/grep '/usr/sbin/[t]cpdump.*{$f}'"));

	return $processcheck;

}

$fe = "packetcapture.error";

$input_errors = array();

$do_tcpdump = false;

	$dnsquery = isset($_POST['dnsquery']);

	if ($_POST['startbtn'] != "") {

		$action = gettext("Start");

		// check for input errors

		if ($count == "") {// default is 100

			$count = 100;

		// process capture options only if no input errors

			if ($promiscuous) {

			if ($dnsquery) {

				$do_tcpdump = true;

				//Cature will be started, delete previous packet capture if it exists

				touch($fp.$fns);

				unlink_if_exists($fp.$fn);

		}

		/* check if nmap scan is already running */

		$processes_running = tcpdump_get_running_process($fn);

		$processisrunning = ($processes_running != "");

	} elseif ($_POST['viewbtn'] != "" || $_POST['refreshbtn'] != "") {

		$action = gettext("View");

		$action = gettext("Download");

	} elseif ($_POST['clearbtn'] != "") {

		$action = gettext("Delete");

		//delete previous packet capture if it exists

		unlink_if_exists($fp.$fn);

		unlink_if_exists($fp.$fe);

}

))->setHelp('Put the interface into promiscuous mode.%1$s' .

	'%2$sNon-promiscuous mode captures only traffic that is directly relevant to the host (sent by it, sent or broadcast to it, or routed through it) and ' .

	'does not show packets that are ignored at network adapter level.%3$s%4$sPromiscuous mode%5$s ("sniffing") captures all data seen by the adapter, whether ' .

	'or not it is valid or related to the host, but in some cases may have undesirable side effects and not all adapters support this option.%3$s' .

	'<span class="infoblock" style="font-size:90%"><br />',

	'<p style="margin:0px;padding:0px">',

	'<br />',

	'</p></span>');

))->setHelp('Select the protocol to capture, or "Any".');

))->setHelp('Source or Destination IP, subnet or MAC address.%1$s' .

			'%2$sThis value is either the Source or Destination IP address, subnet in CIDR notation, or MAC address.%3$s' .

			'Separating with a pipe ("|") performs a boolean "OR".%3$s' .

			'MAC addresses must be entered in colon-separated format, such as xx:xx:xx:xx:xx:xx or a partial address consisting of one (xx), two (xx:xx), or four (xx:xx:xx:xx) segments.%3$s' .

			'If this field is left blank, all packets on the specified interface will be captured.%4$s',

			'<span class="infoblock" style="font-size:90%"><br />',

			'<p style="margin:0px;padding:0px">',

			'<br />',

			'</p></span>');

))->setHelp('Port to match on either the source or destination.%1$s' .

			'%2$sThe port can be either the source or destination port. The packet capture will look for this port in either field.%3$s' .

			'Matching can be negated by preceding the value with "!". Multiple ports may be specified. Comma (",") separated values perform a boolean "AND". ' .

			'Separating with a pipe ("|") performs a boolean "OR". Leave blank if not filtering by port.%4$s',

			'<span class="infoblock" style="font-size:90%"><br />',

			'<p style="margin:0px;padding:0px">',

			'<br />',

			'</p></span>');

))->setHelp('Number of bytes to capture for each packet.%1$s' .

			'%2$sDefault value is 0, which will set capture size to 262144 bytes.%3$s' .

			'Note that taking larger snapshots both  increases the amount of time it takes to process packets and, effectively, ' .

			'decreases the amount of packet buffering. This may cause packets to be lost.%3$s' .

			'You should limit snaplen to the smallest number that will capture the protocol information you are interested in.%4$s',

			'<span class="infoblock" style="font-size:90%"><br />',

			'<p style="margin:0px;padding:0px">',

			'<br />',

			'</p></span>');

))->setHelp('Number of packets to capture before exiting (0 for no limit.)');

))->setHelp('Level of detail when viewing captured results.%s' .

			'It does not affect the level of detail when downloading the packet capture.',

	$dnsquery

))->setHelp('Perform a reverse DNS lookup for all captured IP addresses.%s' .

			'%2$sThe packet capture will perform a reverse DNS lookup associated with all IP addresses. It will also convert port numbers, protocols, etc. to names.%3$s' .

			'This option can cause delays for large packet captures especially if used to preview results while a scan is running.%4$s',

			'<span class="infoblock" style="font-size:90%"><br />',

			'<p style="margin:0px;padding:0px">',

			'<br />',

			'</p></span>');

$processes_running = tcpdump_get_running_process($fn);

$processisrunning = ($processes_running != "");

if ($processisrunning or $do_tcpdump) {

	$form->addGlobal(new Form_Button(

		'refreshbtn',

		'Refresh Results',

		null,

		'fa-retweet'

	))->addClass('btn-primary');

			'Capture started on',

} else {

	$form->addGlobal(new Form_Button(

		'startbtn',

		'Start',

		null,

		'fa-play-circle'

	))->addClass('btn-success');

	if (file_exists($fp.$fn) or file_exists($fp.$fe)) {

		$form->addGlobal(new Form_Button(

			'clearbtn',

			'Clear Capture',

			null,

			'fa-trash'

		))->addClass('btn-danger');

}

if (file_exists($fp.$fn)) {

		'Last Capture Results',

if ($do_tcpdump) {

	if (strlen($matchstr) !== 0) $matchstr = escapeshellarg($matchstr);

	$cmd = "/usr/sbin/tcpdump -i {$selectedif} {$disabledns} {$disablepromiscuous} {$searchcount} -s {$snaplen} -U -w {$fp}{$fn} {$matchstr} >/dev/null 2>{$fp}{$fe} &";

	exec($cmd);

} elseif ($action == gettext("View") || $action == gettext("Stop")) {

		if (file_exists($fp.$fe) && filesize($fp.$fe) > 0) {

?>

<div class="panel panel-default">

	<div class="panel-heading"><h2 class="panel-title"><?=gettext('Capture Summary')?></h2></div>

	<div class="panel-body">

		<div class="form-group">

<?php

			print('<textarea class="form-control" rows="10" style="font-size: 13px; font-family: consolas,monaco,roboto mono,liberation mono,courier;">');

			if (filesize($fp.$fe) > $max_display_size) {

				print(gettext("Packet Capture summary file is too large to display in the GUI.") .

					"\n" .

					gettext("Download the file, or view it in the console or ssh shell.") .

					"\n" .

					gettext("Summary file: {$fp}{$fe}"));

				print(file_get_contents($fp.$fe));

			}

			print('</textarea>');

		</div>

	</div>

</div>

<?php

		}

?>

		if ($proto == "carp") {

		$options_args = "";

				$options_args = "-vv -e";

				$options_args = "-vv";

				$options_args = "-v";

				$options_args = "-q";

        if ($dnsquery !== true) {

            $options_args .= " -n";

        }

				gettext("Download the file, or view it in the console or ssh shell.") .

				"\n" .

				gettext("Capture file: {$fp}{$fn}"));

		} elseif (!file_exists($fp.$fn) || (filesize($fp.$fn) === 0)) {

			print(gettext("No capture results to display."));

		} elseif ($detail === 'none') {

			system("/usr/sbin/tcpdump {$options_args} {$iscarp} -r {$fp}{$fn}");

}