Project

General

Profile

Download (9.97 KB) Statistics
| Branch: | Tag: | Revision:
1
<?php
2
/*
3

    
4
	Redistribution and use in source and binary forms, with or without
5
	modification, are permitted provided that the following conditions are met:
6

    
7
	1. Redistributions of source code must retain the above copyright notice,
8
	this list of conditions and the following disclaimer.
9

    
10
	2. Redistributions in binary form must reproduce the above copyright
11
	notice, this list of conditions and the following disclaimer in the
12
	documentation and/or other materials provided with the distribution.
13

    
14
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
15
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
16
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
17
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
18
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
19
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
20
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
21
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
22
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
23
	POSSIBILITY OF SUCH DAMAGE.
24
*/
25

    
26
$pgtitle = "Diagnostics: Packet Capture";
27
require_once("guiconfig.inc");
28
require_once("pfsense-utils.inc");
29

    
30
$fp = "/tmp/";
31
$fn = "packetcapture.cap";
32
$snaplen = 1500;//default packet length
33
$count = 100;//default number of packets to capture
34

    
35
function get_interface_addr($if) {
36
	global $config;
37

    
38
	$ifdescr = convert_friendly_interface_to_friendly_descr($if);
39

    
40
	/* find out interface name */
41
	if ($ifdescr == "wan")
42
		$if = get_real_wan_interface();
43
	else
44
		$if = $config['interfaces'][$ifdescr];
45

    
46
	return $if;
47

    
48
}
49

    
50
if ($_POST) {
51
	$do_tcpdump = true;
52
	$host = $_POST['host'];
53
	$selectedif = $_POST['interface'];
54
	$count = $_POST['count'];
55
	$packetlength = $_POST['snaplen'];
56
	$port = $_POST['port'];
57
	$detail = $_POST['detail'];
58

    
59
	if ($_POST['dnsquery'])//if dns lookup is checked
60
	{
61
		$disabledns = "";
62
	}
63
	else //if dns lookup is unchecked
64
	{
65
		$disabledns = "-n";
66
	}
67

    
68
	if ($_POST['startbtn'] != "" )
69
	{
70
		$action = "Start";
71
		
72
	 	//delete previous packet capture if it exists
73
	 	if (file_exists($fp.$fn))
74
	 		unlink ($fp.$fn);
75

    
76
	}
77
	elseif ($_POST['stopbtn']!= "")
78
	{
79
		$action = "Stop";
80
		$processes_running = trim(shell_exec("ps axw -O pid= | grep tcpdump | grep $fn | grep -v pflog"));
81

    
82
		//explode processes into an array, (delimiter is new line)
83
		$processes_running_array = explode("\n", $processes_running);
84

    
85
		//kill each of the packetcapture processes
86
		foreach ($processes_running_array as $process)
87
		{
88
			$process_id_pos = strpos($process, ' ');
89
			$process_id = substr($process, 0, $process_id_pos);
90
			exec("kill $process_id");
91
		}
92

    
93
	}
94
	else //download file
95
	{
96
		$fs = filesize($fp.$fn);
97
		header("Content-Type: application/octet-stream");
98
        header("Content-Disposition: attachment; filename=$fn");
99
		header("Content-Length: $fs");
100
		readfile($fp.$fn);
101
	}
102
}
103
else
104
{
105
	$do_tcpdump = false;
106

    
107
}
108

    
109
include("head.inc"); ?>
110
<body link="#000000" vlink="#0000CC" alink="#0000CC">
111
<? include("fbegin.inc"); ?>
112
<p class="pgtitle"><?=$pgtitle?></p>
113
<table width="100%" border="0" cellpadding="0" cellspacing="0">
114
        <tr>
115
          <td>
116
			<form action="diag_packet_capture.php" method="post" name="iform" id="iform">
117
			  <table width="100%" border="0" cellpadding="6" cellspacing="0">
118
               	<tr>
119
				  <td width="17%" valign="top" class="vncellreq">Interface</td>
120
				  <td width="83%" class="vtable">
121
				<select name="interface" class="formfld">
122
                     <?php $interfaces = array('wan' => 'WAN', 'lan' => 'LAN');
123
					  for ($i = 1; isset($config['interfaces']['opt' . $i]); $i++) {
124
					    if (isset($config['interfaces']['opt' . $i]['enable']) &&
125
							!$config['interfaces']['opt' . $i]['bridge'])
126
					  		$interfaces['opt' . $i] = $config['interfaces']['opt' . $i]['descr'];
127
					  }
128
					  foreach ($interfaces as $iface => $ifacename): ?>
129
                      <option value="<?=$iface;?>" <?php if ($selectedif == $iface) echo "selected"; ?>>
130
                      <?php echo $ifacename;?>
131
                      </option>
132
                      <?php endforeach;?>
133
                    </select>
134
                    <br/>Select the interface the traffic will be passing through. Typically this will be the WAN interface.
135
				  </td>
136
				</tr>
137
			    <tr>
138
				  <td width="17%" valign="top" class="vncellreq">Host Address</td>
139
				  <td width="83%" class="vtable">
140
                    <input name="host" type="text" class="formfld" id="host" size="20" value="<?=htmlspecialchars($host);?>">
141
					<br/>This value is either the Source or Destination IP address. The packet capture will look for this address in either field.
142
					<br/>This value can be a domain name or IP address.
143
					<br/>If you leave this field blank all packets on the specified interface will be captured 
144
					</td>
145
				</tr>
146
				<tr>
147
				  <td width="17%" valign="top" class="vncellreq">Port</td>
148
				  <td width="83%" class="vtable">
149
                    <input name="port" type="text" class="formfld" id="port" size="5" value="<?=$port;?>">
150
					<br/>The port can be either the source or destination port. The packet capture will look for this port in either field.
151
					<br/>Leave blank if you do not want to the capture to filter by port.
152
					</td>
153
				</tr>
154
				<tr>
155
				  <td width="17%" valign="top" class="vncellreq">Packet Length</td>
156
				  <td width="83%" class="vtable">
157
                    <input name="snaplen" type="text" class="formfld" id="snaplen" size="5" value="<?=$snaplen;?>">
158
					<br/>The Packet length is the number of bytes the packet will capture for each payload. Default value is 1500.
159
					<br/>This value should be the same as the MTU of the Interface selected above.
160
					</td>
161
				</tr>
162
				<tr>
163
				  <td width="17%" valign="top" class="vncellreq">Count</td>
164
				  <td width="83%" class="vtable">
165
                    <input name="count" type="text" class="formfld" id="count" size="5" value="<?=$count;?>">
166
					<br/>This is the number of packets the packet capture will grab. Default value is 100. <br/>Enter 0 (zero) for no count limit.
167
				</tr>
168
				<tr>
169
				  <td width="17%" valign="top" class="vncellreq">Level of Detail</td>
170
				  <td width="83%" class="vtable">
171
                    <select name="detail" type="text" class="formfld" id="detail" size="1">
172
						<option value="-q" <?php if ($detail == "-q") echo "selected"; ?>>Normal</option>
173
						<option value="-v" <?php if ($detail == "-v") echo "selected"; ?>>Medium</option>
174
						<option value="-vv" <?php if ($detail == "-vv") echo "selected"; ?>>High</option>
175
						<option value="-vv -e" <?php if ($detail == "-vv -e") echo "selected"; ?>>Full</option>
176
					</select>
177
					<br/>This is the level of detail that will be displayed after hitting 'Stop' when the packets have been captured. <br/><b>Note:</b> This option does not affect the level of detail when downloading the packet capture.
178
				</tr>
179
				<tr>
180
				  <td width="17%" valign="top" class="vncellreq">Reverse DNS Lookup</td>
181
				  <td width="83%" class="vtable">
182
					<input name="dnsquery" type="checkbox"<?php if($_POST['dnsquery']) echo " CHECKED"; ?>>
183
					<br/>This check box will cause the packet capture to perform a reverse DNS lookup associated with all IP addresses.
184
					<br/><b>Note: </b>This option can be CPU intensive for large packet captures.
185
					</td>
186
				</tr>
187
				<tr>
188
				  <td width="17%" valign="top">&nbsp;</td>
189
				  <td width="83%">
190
                    <?php
191

    
192
                    /*check to see if packet capture tcpdump is already running*/
193
					$processcheck = (trim(shell_exec("ps axw -O pid= | grep tcpdump | grep $fn | grep -v pflog")));
194
					
195
					$processisrunning = false;
196

    
197
					if ($processcheck != false)
198
						$processisrunning = true;
199
						
200
					if (($action == "Stop" or $action == "") and $processisrunning != true)
201
						echo "<input type=\"submit\" name=\"startbtn\" value=\"Start\">&nbsp;";
202
				  	else{
203
					  	echo "<input type=\"submit\" name=\"stopbtn\" value=\"Stop\">&nbsp;";
204
				  	}
205
					if (file_exists($fp.$fn)){
206
						echo "<input type=\"submit\" name=\"downloadbtn\" value=\"Download Capture\">";
207
						echo "&nbsp;&nbsp;(The packet capture file was last updated: " . date("F jS, Y g:i:s a.", filemtime($fp.$fn)) . ")";
208
					}
209
					?>
210
				  </td>
211
				</tr>
212
				<tr>
213
				<td valign="top" colspan="2">
214
				<?php
215
				echo "<font face='terminal' size='2'>";
216
				if ($processisrunning == true)
217
						echo("<strong>Packet Capture is running.</strong><br/>");
218
						
219
				if ($do_tcpdump) {					
220

    
221
					if ($port != "")
222
                    {
223
                       $searchport = "and port ".$port;
224
                       if($host <> "")                        
225
							$searchport = "and port ".$port;
226
						else
227
							$searchport = "port ".$port;
228
                    }
229
                    else
230
                    {
231
                        $searchport = "";
232
                    }
233

    
234
       				if ($host != "")
235
         	       {
236
             	       $searchhost = "host " . $host;
237
            	   }
238
             	   else
239
                	{
240
                       $searchhost = "";
241
             		}
242
             		if ($count != "0" )
243
             		{
244
             			 $searchcount = "-c " . $count;
245
             		}
246
             		else
247
             		{
248
             			$searchcount = "";
249
             		}
250

    
251
					$selectedif = convert_friendly_interface_to_real_interface_name($selectedif);
252
				
253
					
254
						
255
					if ($action == "Start")
256
					{
257
						echo("<strong>Packet Capture is running.</strong><br/>");
258
					 	mwexec_bg ("/usr/sbin/tcpdump -i $selectedif $searchcount -s $packetlength -w $fp$fn $searchhost $searchport");
259
						}
260
					else  //action = stop
261
					{
262

    
263
						echo("<strong>Packet Capture stopped. <br/><br/>Packets Captured:</strong><br/>");
264
						?>
265
						<textarea style="width:98%" name="code" rows="15" cols="66" wrap="off" readonly="readonly">
266
						<?php
267
						system ("/usr/sbin/tcpdump $disabledns $detail -r $fp$fn");?>
268
						</textarea><?php
269
					}
270
				}?>
271
				</td>
272
				</tr>
273
				<tr>
274

    
275
		</table>
276
</form>
277
</td></tr></table>
278
<?php include("fend.inc"); ?>
(25-25/175)