fluffy

Network Archaeology tools for Unix
git clone https://git.woozle.org/neale/fluffy.git

Neale Pickett  ·  2013-01-29

puniq.c

 1#include <stdio.h>
 2#include <sysexits.h>
 3#include <string.h>
 4#include "pcap.h"
 5
 6int
 7main(int argc, char *argv[])
 8{
 9	int i;
10	struct pcap_pkthdr hdr[2];
11	char frame[2][MAXFRAME];
12	int cur = 0;
13	struct pcap_file out;
14
15	memset(&hdr, 0, sizeof(hdr));
16	memset(frame, 0, 2 * MAXFRAME);
17
18	if (-1 == pcap_open_out(&out, stdout)) {
19		perror("writing header");
20		return EX_IOERR;
21	}
22
23	i = 1;
24	do {
25		char *fn = argv[i];
26		FILE *f;
27		struct pcap_file p;
28
29		if ((!fn) || (0 == strcmp("-", fn))) {
30			f = stdin;
31		} else {
32			f = fopen(fn, "rb");
33			if (NULL == f) {
34				perror(fn);
35				return EX_IOERR;
36			}
37		}
38
39		if (-1 == pcap_open_in(&p, f)) {
40			fprintf(stderr, "%s: unable to process\n", fn);
41			return EX_IOERR;
42		}
43
44		while (1) {
45			if (-1 == pcap_read_pkthdr(&p, &hdr[cur]))
46				break;
47			if (1 != fread(frame[cur], hdr[cur].caplen, 1, p.f))
48				break;
49
50			if ((0 == memcmp(&hdr[0], &hdr[1], sizeof(hdr[0]))) && (0 == memcmp(frame[0], frame[1], hdr[cur].caplen))) {
51				/*
52				 * Skip this duplicate 
53				 */
54			} else {
55				if (-1 == pcap_write_pkthdr(&out, &hdr[cur]))
56					break;
57				if (1 != fwrite(frame[cur], hdr[cur].caplen, 1, out.f))
58					break;
59			}
60			cur = (1 - cur);
61		}
62		pcap_close(&p);
63
64		i += 1;
65	} while (i < argc);
66
67	return 0;
68}