ngrep is like GNU grep applied to the network layer.
It's a PCAP-based tool that allows you to specify an extended regular or
hexadecimal expression to match against data payloads of packets.
It understands many kinds of protocols, including IPv4/6, TCP, UDP, ICMPv4/6,
IGMP and Raw, across a wide variety of interface types, and understands BPF
filter logic in the same fashion as more common packet sniffing tools, such as
tcpdump and snoop.
===> The following configuration options are available for ngrep-1.48.3_1:
CAPSICUM=on: Build with capsicum if kernel supports it
DOCS=on: Build and/or install documentation
IPV6=on: IPv6 protocol support
PCRE=on: Use PCRE2 instead of GNU regex
PORTS_PCAP=off: Use ports PCAP instead of system PCAP
===> Use 'make config' to modify these settings
net/ngrep: Fix Capsicum support
- Fix Capsicum sandbox crash when using -I (offline capture):
pcap_fileno() returns -1 for handles opened with pcap_open_offline().
cap_rights_limit(-1, ...) fails with EBADF rather than ENOSYS,
bypassing the guard and causing ngrep to exit with "unable to limit pcap
pcap descriptor" whenever -I is used.
Cache pcap_fileno(pd) and skip cap_rights_limit() and cap_ioctls_limit()
when the fd is -1. Offline handles do not need Capsicum fd sandboxing
at this point since the file is already open; live captures on a BPF
device are unaffected.
- Fix USE_CAPSICUM always defined:
patch-configure.ac never initialises USE_CAPSICUM to "0", so
AC_DEFINE_UNQUOTED emits "#define USE_CAPSICUM" (empty) regardless of
(Only the first 15 lines of the commit message are shown above )
