Wireshark-users: [Wireshark-users] Dumpcap batch file front-end with event notification and trigg
From: "Maynard, Chris" <Christopher.Maynard@xxxxxxxxx>
Date: Sat, 31 May 2014 12:20:36 -0400
Attached is a proof-of-concept Windows batch file, which serves as a front-end for dumpcap.exe. It supports triggered capturing and with the help of the external command-line mailsend tool, it supports
event notifications via e-mail as well. For additional flexibility, it also provides hooks for running your own arbitrary commands in addition to (or in lieu of) e-mail notifications. The attached batch file has been renamed as a .txt
file since many mail servers reject .bat files.
Why might you want a front-end for dumpcap.exe?
Forgetting about event notification and triggering for the moment, the batch file allows you to enter and save many dumpcap capture parameters, such as the capture interface, the capture filter (which might be quite complex), etc. By saving these settings
in separate configuration files, you can maintain a repository of potentially useful, reusable settings. Once you figure out your complicated capture filter, for example, you need not ever have to derive it again. You can also share these settings with colleagues
by sending them your configuration file. With perhaps a few minor tweaks to the configuration, they can more easily and more quickly start capturing using proven and pre-tested settings.
So what about event notification and triggered captures?
These are features that people have inquired about in the past, either through Bugzilla, the Wireshark Ask Q&A site, or via the Wireshark mailing lists. Let me be clear in that this batch file does not address the concerns and desires of all inquiries.
I believe it helps to address a number of them though, and *may* help others to fill the gap where this batch file falls short. There are almost certainly better long-term solutions than this, but you might find it at least somewhat useful in the interim.
I want to try it; how do I get started?
First, download the attached batch file, renaming it as dumpcap.bat. To experiment with event notification, you will need to download mailsend v1.17b14 (or later) from https://code.google.com/p/mailsend/
and save it in the same directory as the batch file; however, you must rename it to mailsend.exe. If you want to be able to attach small capture files to your e-mails, in some cases the batch file relies on handle.exe
from sysinternals, so I recommend that you download handle.exe v3.51 from http://technet.microsoft.com/en-us/sysinternals/bb896655.aspx
and also save it in the same directory as the batch file. Depending on your capture settings, you may need to run the command prompt as administrator in order to be able to attach certain capture files, such as temporary files or files created as part of a
ringbuffer.
I want to try it; how does it work?
There are 4 basic modes of operation; choose the one that best fits what you’re trying to accomplish:
- Dumpcap only: Use this mode if you’re not necessarily interested in separate event notifications or triggered captures. Perhaps you only want to take advantage of the stored configuration settings so you don’t have to keep re-typing complicated capture filters. Or maybe you want a basic notification of when the main capturing stops, for example after a certain number of packets have been captured and dumpcap terminates itself.
- Dumpcap+Event: This mode would be used if you wanted to capture arbitrary traffic, but you also wanted to know when a specific capture event occurred and possibly take some action once it did. Besides sending you a notification, you might want to terminate the main capturing, perhaps after a slight delay so you could continue capturing for some time period following the capture event of interest. If you’ve ever been looking for a needle in a haystack and had to leave dumpcap running for long periods of time waiting for that needle, this mode might be useful to you.
- Trigger: This mode would be used when you want to start capturing traffic following a particular capture event of interest. It should be noted however that the current implementation is such that the capture event itself won’t be included in the resulting capture file, since main capturing won’t be initiated until after the event occurs. To me, this makes the Trigger mode less useful, but it might serve someone’s purpose.
- Event only: The batch file currently does not support all dumpcap options. Of particular note, it doesn’t support capturing from multiple interfaces or specifying a different capture filter, snaplen, etc. for each of the different interfaces you might be interested in capturing packets from. If you have special capturing needs, but are still interested in capture event notifications, you can always launch your own dumpcap instance, and then run the batch file in “Event only” mode. In this mode, no main dumpcap capturing will be initiated either before or after the event, as presumably, you’ve already started it. If you wish, you can still terminate that capturing following the event however.
Run “dumpcap.bat –h” for some additional help, and read the batch file itself as there’s more information included there as well.
- Chris
Digests:
dumpcap.txt: 102,998 bytes
MD5(dumpcap.txt)= 2ee016a55e545b43082e63c611c7aad7
SHA1(dumpcap.txt)= 7cb14aff6f9a48803a5a46ff9de4fdb408720283
RIPEMD160(dumpcap.txt)= 9481bb71da59f72a7cdae506b79c2ae861009205
--
CONFIDENTIALITY NOTICE: The information contained in this email message is intended only for use of the intended recipient. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately delete it from your system and notify the sender by replying to this email. Â Thank you.
@ECHO OFF :: -------------------------------------------------------------------------- :: This program is free software; you can redistribute it and/or modify :: it under the terms of the GNU General Public License as published by :: the Free Software Foundation; either version 2 of the License, or :: (at your option) any later version. :: :: This program is distributed in the hope that it will be useful, :: but WITHOUT ANY WARRANTY; without even the implied warranty of :: MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the :: GNU General Public License for more details. :: :: You should have received a copy of the GNU General Public License along :: with this program; if not, write to the Free Software Foundation, Inc., :: 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. :: :: -------------------------------------------------------------------------- :: Dumpcap.bat batch file with optional capture event notification/trigger. :: By Christopher Maynard <Christopher.Maynard@xxxxxxxxx> :: Copyright 2014 Christopher Maynard :: :: $Id: dumpcap.bat,v 1.66 2014/05/30 17:28:20 cmaynard Exp $ :: :: Usage: GOTO USAGE :: :: Developed/tested on Microsoft Windows [Version 6.1.7601] (Windows 7 64-bit) :: :: Lightly tested on: :: Microsoft Windows [Version 6.3.9600] (Windows 8.1 64-bit) :: Microsoft Windows [Version 5.1.2600] (Windows XP 32-bit) :: :: Motivation: :: Bug reports: :: o https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2039 :: o https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3967 :: o https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4390 :: :: Questions: :: o http://ask.wireshark.org/questions/1019/trigger-a-script :: o http://ask.wireshark.org/questions/2049/trigger-a-capture :: o http://ask.wireshark.org/questions/6585/triggers-for-wireshark :: o http://ask.wireshark.org/questions/9682/trigger-an-executable-file-once-wireshark-finds-a-keyword-on-live-capture :: o http://ask.wireshark.org/questions/30118/email-function :: :: Discussions: :: o http://www.wireshark.org/lists/wireshark-dev/200804/msg00078.html :: :: Internal company inquiry: :: "I have been trying to see if Wireshark has a similar capability as my :: old Network General Sniffers. :: :: On the Sniffer I am able to set up a trigger based on many different :: requirements. The trigger I am using is based on bit patterns in two :: locations of the packet. Once the trigger pattern is found the Sniffer :: will then write some portion (in my case 50KB, and this is adjustable) :: of the contents of the trace memory prior to and up to the trigger to a :: file and then continue to capture. It will then continue this action :: writing new files until stopped. The number of files retained can be :: adjusted and once that number is reached it will delete the oldest file :: to keep the number of files constant. :: :: Is it possible to do this in Wireshark?" :: :: Requires: :: 1) dumpcap 1.10.0 (or later): http://www.wireshark.org/download.html :: It *might* work with older versions, but use at your own risk. Of note, :: capture filter verification will not be available for dumpcap prior to :: version 1.6.0. :: 2) WMIC is only available on Windows XP Professional and Windows 2003 or :: later versions of Windows. You must have administrator rights to run :: WMIC. :: 3) mailsend 1.17b14 (or later): https://code.google.com/p/mailsend/ :: After downloading it, rename it mailsend.exe and either copy it to a :: directory that is in your %PATH% or to the same directory in which this :: batch file resides. :: :: Note: Mailsend.exe is only needed if the user actually wants e-mail :: notifications of capture events. While this feature was one of the :: primary motivating factors for writing this batch script, it's :: technically not required, per se. It does help satisfy Letts' Law :: though: http://natpryce.com/articles/000749.html#letts :: :: 4) Handle v3.51: http://technet.microsoft.com/en-us/sysinternals/bb896655.aspx :: After downloading it, either copy it to a directory that is in your :: %PATH% or to the same directory in which this batch file resides. :: :: Notes: :: Handle.exe is only needed if the user wants to attach a capture file to :: the e-mail and either no capture file was specified so that we need to :: find the name of the temporary file, or if the user has chosen to use a :: ringbuffer with multiple files or autostop after <N> files, in which :: case we'll also need to use this to find the name of the capture file. :: :: Handle.exe can only be run from a command window that was "Run as :: administrator". This is most unfortunate. A possible alternative :: would be to use openfiles.exe /query instead, as that does not have to :: be run from an administrator's command window. There are 3 problems :: with openfiles.exe though: :: :: i) Local open files are not displayed by default, so you must first :: run openfiles.exe /local on, followed by a reboot. :: ii) It is super slow because there is unfortunately no way to query :: for open files for only a single process. :: iii) From my testing, openfiles.exe /query was unreliable. It would :: seem to work at first but then started failing for some unknown :: reason. This was the primary reason why I decided against using :: openfiles.exe. :: :: 5) ping.exe (Windows XP only). :: :: Files created: :: 1) Temporarily, the __tmpcfg.bat batch file for setting the environment :: variables. :: 2) If no configuration file is specified on the command-line, a default :: configuration file named dcdflts.cfg will be created. :: 3) Previously, a temporary __tmpbpf.txt file was being created for parsing :: "dumpcap.exe -d" output, but I've overcome the limitations of the bug :: indicated in CHECK_FILTER by removing the problematic double-quote (") :: characters from the filter expression, so this temporary file should no :: longer be needed. :: :: TODO list: (See also the various "TODO's" sprinkled within the batch file.) :: 1) Have the -d option delete *all* Wireshark-related temp files? :: 2) Properly handle all special characters. :: 3) WMIC: :: a) How to set the window title? :: b) How to avoid opening a new window if not needed? :: c) How to get the exit code (ERRORLEVEL) of a process started by WMIC? :: d) How to start a process minimized, hidden or in the background? :: 4) How to avoid prompting the user to "Terminate batch job (Y/N)? " after a :: <CTRL-BREAK>? :: 5) How to tell if the man page is already open to avoid opening multiple :: instances of the same page? (Is -m even worth it at all?) :: 6) Should we support any other mailsend.exe options? Such as: :: -d, -ct, -cs, -enc, -H (other than the 2 already supported: importance :: and sensitivity), -v, -auth-cram-md5, -auth-plain, -auth-login, -ehlo. :: 7) Should we support any other dumpcap.exe options? Such as: :: -y <link type>, -k, -S, -M, RPCAP options (-r, -u, -A <user:password>, :: -m <sampling type>), -g, -N <packet_limit>, -C <byte_limit>, -t, -q. :: 8) Add multi-interface capture support as well as multi-interface event :: support. :: 9) If this batch file is read-only, the COPY /Z will fail and CR won't be :: set. For now, I try to force it to NOT be read only, but there's :: probably a better way to fix/avoid this. :: :: Special thanks: :: A special thanks to Freddy Batista (Freddy.Batista@xxxxxxxxx). He found :: mailsend, which got me started on this whole batch file to begin with. :: He also found the safe history solution, assisted with line continuation :: problems I was having, offered some ideas for improvements to the batch :: file, such as being able to attach the capture file to the e-mail :: notification, and he helped me test the batch file throughout much of :: its development. This batch file might not exist without his help. :: :: Thanks also goes out to Vinod Richard for his involvement with testing :: this batch file and helping to uncover a number of bugs that I was able :: to fix before releasing it to a wider audience. :: :: Finally, thanks to the Notepad++ team. Notepad++ was the primary editor :: used in writing this file. The "Function List" feature in particular :: was quite helpful to me. http://notepad-plus-plus.org/contributors/ :: :: Disclaimer: :: I hope you find this batch file useful and enjoy using it as much as I :: detested writing it. This basically sums up my experience with batch :: scripting: http://xkcd.com/1349/ :: :: For Roland. :: -------------------------------------------------------------------------- :: Basic Flowchart of the 4 operating modes of this batch file, namely: :: :: 1) Dumpcap only 3) Trigger (i.e., Event+Dumpcap) :: 2) Dumpcap+Event 4) Event only :: :: (Start) :: | :: / Mode \ :: \ ? / :: Dumpcap Event | Dumpcap+ :: only only | Event Trigger :: +------------------+--------+---------+------------------+ :: | | | | :: +----+----+ | +----+----+ +---+---+ :: | dumpcap | | | dumpcap | | Event | :: +----+----+ | +----+----+ +---+---+ :: | | | | :: | +--------+---------+ +---+ :: | | | :: | +---+---+ +------+-------+ :: | | Event | | Event Action | :: | +---+---+ +------+-------+ :: | | | :: +------+-------+ +------+-------+ +-----+-----+ :: | Event Action | | Event Action | | mailsend* | :: +------+-------+ +------+-------+ +-----+-----+ :: | | | :: +-----+-----+ +-----+-----+ +----+----+ :: | mailsend* | | mailsend* | | dumpcap | :: +-----+-----+ +-----+-----+ +----+----+ :: | | | :: | +-----------+------------+ :: | | :: | / Delay \ :: | \ ? / :: | Yes | No :: | +-----------+-----------+ :: | | | :: | +---+---+ | :: | | Delay | | :: | +---+---+ | :: | | | :: +------+-------+ +------+-------+ +------+-------+ :: | Final Action | | Final Action | | Final Action | :: +------+-------+ +------+-------+ +------+-------+ :: | | | :: | +-----+-----+ | :: | | mailsend* | | :: | +-----+-----+ | :: | | | :: | +-----------+-----------+ :: | | :: | | :: +---------------------------+-----------+ :: | :: (Done) :: :: *mailsend is only called if it is enabled and mailsend.exe actually exists. :: The eventaction.bat and finalaction.bat files are only called if they exist. :: -------------------------------------------------------------------------- :: First things first, let's not pollute the history with user input. :: This has the unfortunate side-effect of requiring the user to press 'Y' :: twice after a <CTRL-C> for the 2 "Terminate batch job (Y/N)? " questions, :: but the alternative is the polluted history, so pick your poison or figure :: out how to avoid this some other way then delete the TODO #4 above. IF "%~1" == "HISTORYSAFE" GOTO HISTORYSAFE :: Clear the read-only attribute so the COPY /Z works and CR can be assigned. ATTRIB -R %~F0 :: We can't just use %* in case there are quotes, so sanitize the options. SET BAT=%~F0 SET DC_OPTS= :REBUILD_CMDLINE IF "%~1" == "" GOTO CALL_OURSELF SET DC_OPTS=%DC_OPTS% %1 SHIFT GOTO REBUILD_CMDLINE :CALL_OURSELF CMD /S /C ""%BAT%" HISTORYSAFE%DC_OPTS%" SET DC_OPTS= GOTO :EOF :: -------------------------------------------------------------------------- :USAGE ECHO. ECHO A command-line front-end for dumpcap.exe that allows you to store dumpcap.exe ECHO settings, be notified of capture events or trigger dumpcap.exe capturing ECHO after a capture event occurs. It also provides hooks for performing custom ECHO actions through user-defined batch files. ECHO. ECHO Usage: %BAT% [options] ... where options are: ECHO. ECHO [file.cfg] [-d] [-e ^<file.bat^>] [-f ^<file.bat^>] [-h] [-i] [-m] [-p ^<pid^>] ECHO [-s] ECHO. ECHO file.cfg An optional configuration file. If no configuration file is ECHO specified, the default file will be used, if found. REM TODO: Should -d also delete "%TEMP%\Wireshark IP Map *\, etc.? If so, then REM add support for it and then delete TODO #1 above. ECHO -d Delete any Wireshark-related left-over temporary capture files. ECHO -e file.bat User-defined event action batch file. (Default=eventaction.bat) ECHO -f file.bat User-defined final action batch file. (Default=finalaction.bat) ECHO -h Display this help and exit. ECHO -i Hide the list of available interfaces. ECHO -m Launch the default browser to display the dumpcap manpage. ECHO -p pid If running in "Event only" mode, the explicit process ID of the ECHO related dumpcap.exe capturing instance, if applicable. If the ECHO process ID is not specified, then an attempt will be made to ECHO determine the process ID once the event has occurred, but this ECHO will fail if there is more than 1 dumpcap.exe instance ECHO running, and in this case, you risk killing all dumpcap.exe ECHO instances after the event has occurred. ECHO -s Automatically start dumpcap using the configuration options ECHO from the file specified or from the default configuration ECHO options. GOTO :EOF :: -------------------------------------------------------------------------- :HISTORYSAFE REM SET > SETBEGIN.TXT SET BAT=%~F0 SHIFT :: Just in case, clear away any leftover breadcrumbs from prior runs. CALL :CLEAR_ENV SETLOCAL SETLOCAL ENABLEEXTENSIONS SETLOCAL ENABLEDELAYEDEXPANSION SET DC_VER=$Id: dumpcap.bat,v 1.66 2014/05/30 17:28:20 cmaynard Exp $ SET AUTOSTART=N SET DC_ENVFILE="" SET DISPLAY_IFACES=Y SET DC_PID= VER | FIND "5.1" > NUL IF %ERRORLEVEL% == 0 (SET WIN_XP=Y) ELSE (SET WIN_XP=N) :LOCATE_MAILSEND :: Look in the current directory first so we can even run mailsend.exe from a :: USB flash drive, for example, without necessarily having to add its location :: to the %PATH%. SET MAILSEND="%CD%\mailsend.exe" IF EXIST %MAILSEND% GOTO LOCATE_DUMPCAP :: Try to use mailsend from the PATH so it doesn't matter where it's installed. CALL :GETPATH MAILSEND,mailsend.exe IF DEFINED MAILSEND ( SET MAILSEND="%MAILSEND%" GOTO LOCATE_DUMPCAP ) SET MAILSEND= :LOCATE_DUMPCAP :: Look in the current directory first so we can even run dumpcap.exe from a :: USB flash drive, for example, without necessarily having to add its location :: to the %PATH%. SET DUMPCAP="%CD%\dumpcap.exe" IF EXIST %DUMPCAP% GOTO GET_DUMPCAP_VER :: Try to use dumpcap from the PATH so it doesn't matter where it's installed. CALL :GETPATH DUMPCAP,dumpcap.exe SET DUMPCAP="%DUMPCAP%" IF %DUMPCAP% NEQ "" GOTO GET_DUMPCAP_VER :: Dumpcap not found in the PATH. Try the usual places: SET DUMPCAP="%PROGRAMFILES%\Wireshark\dumpcap.exe" IF EXIST %DUMPCAP% GOTO GET_DUMPCAP_VER SET DUMPCAP="%PROGRAMFILES(X86)%\Wireshark\dumpcap.exe" IF EXIST %DUMPCAP% GOTO GET_DUMPCAP_VER ECHO ERROR^^! Dumpcap.exe not found. Aborting. GOTO :EOF :GET_DUMPCAP_VER :: Get the dumpcap version FOR /F "TOKENS=1,2 USEBACKQ DELIMS= " %%A IN (`%DUMPCAP% -v`) DO ( IF "%%A" == "Dumpcap" SET DUMPCAP_EXE_VER=%%A %%B ) :PARSE_OPTS IF "%~1" == "" GOTO SETCFGFILE IF "%~1" == "-?" GOTO USAGE IF /I "%~1" == "-h" GOTO USAGE IF /I "%~1" == "--help" GOTO USAGE IF /I "%~1" == "-d" ( CALL :DELETE_TEMP_FILES GOTO NEXT_OPT ) IF /I "%~1" == "-e" GOTO READ_EVENT_BAT IF /I "%~1" == "-f" GOTO READ_FINAL_BAT IF /I "%~1" == "-i" (SET DISPLAY_IFACES=N & GOTO NEXT_OPT) IF /I "%~1" == "-m" ( CALL :GETDRIVEANDPATH TMPVAL,%DUMPCAP% IF EXIST "!TMPVAL!dumpcap.html" ( START "" "file:///!TMPVAL!dumpcap.html" ) ELSE ( START "" "http://www.wireshark.org/docs/man-pages/dumpcap.html"; ) GOTO NEXT_OPT ) IF /I "%~1" == "-p" GOTO READ_PID IF /I "%~1" == "-s" (SET AUTOSTART=Y & GOTO NEXT_OPT) ECHO %~1|FINDSTR /R "^-" > NUL IF %ERRORLEVEL% EQU 0 ( ECHO ERROR^^! Unknown option: %1 GOTO USAGE ) :: This should never happen, but ... IF /I "%~1" == "HISTORYSAFE" (GOTO NEXT_OPT) SET DC_ENVFILE=%DC_ENVFILE:"=% SET DC_ENVFILE="%DC_ENVFILE%" IF %DC_ENVFILE% NEQ "" ( ECHO ERROR^^! Only 1 configuration file can be specified. GOTO USAGE ) CALL :GETFILE TMPVAL,"%~1" IF DEFINED TMPVAL SET DC_ENVFILE=%~1 GOTO NEXT_OPT :: -------------------------------------------------------------------------- :READ_PID SHIFT SET DC_PID=%~1 IF "%DC_PID%" == "" ( ECHO ERROR^^! No PID specified. GOTO USAGE ) ECHO %DC_PID%|FINDSTR /XR "[1-9][0-9]*$" > NUL IF %ERRORLEVEL% NEQ 0 ( ECHO ERROR^^! Invalid PID specified. GOTO USAGE ) CALL :GETPROCESS TMPVAL,%DC_PID% IF /I "%TMPVAL%" NEQ "DUMPCAP.EXE" ( ECHO ERROR^^! This PID does not correspond to a dumpcap.exe process. ECHO You can find the PID by running: ECHO. ECHO TASKLIST /FI "IMAGENAME EQ DUMPCAP.EXE" GOTO USAGE ) GOTO NEXT_OPT :: -------------------------------------------------------------------------- :READ_EVENT_BAT SHIFT SET EVENTBAT=%~1 IF "%EVENTBAT%" == "" ( ECHO ERROR^^! Missing file argument to -e. GOTO USAGE ) SET EVENTBAT=%EVENTBAT:"=% SET EVENTBAT="%EVENTBAT%" IF NOT EXIST %EVENTBAT% ( ECHO ERROR^^! The event action batch file specified does not exist. GOTO USAGE ) CALL :GETEXT EXT,%EVENTBAT% IF /I "%EXT%" NEQ ".bat" ( ECHO ERROR^^! The file argument to -e must be a batch file. GOTO USAGE ) GOTO NEXT_OPT :: -------------------------------------------------------------------------- :READ_FINAL_BAT SHIFT SET FINALBAT=%~1 IF "%FINALBAT%" == "" ( ECHO ERROR^^! Missing file argument to -f. GOTO USAGE ) SET FINALBAT=%FINALBAT:"=% SET FINALBAT="%FINALBAT%" IF NOT EXIST %FINALBAT% ( ECHO ERROR^^! The final action batch file specified does not exist. GOTO USAGE ) CALL :GETEXT EXT,%FINALBAT% IF /I "!EXT!" NEQ ".bat" ( ECHO ERROR^^! The file argument to -f must be a batch file. GOTO USAGE ) GOTO NEXT_OPT :: -------------------------------------------------------------------------- :NEXT_OPT SHIFT GOTO PARSE_OPTS :: -------------------------------------------------------------------------- :: TODO: For now, just delete any left-over temporary capture files. We could :: also delete other temporary files here too though. See TODO #1 above. :DELETE_TEMP_FILES DEL /F /Q "%TEMP%\wireshark_pcap*" GOTO :EOF :: -------------------------------------------------------------------------- :SETCFGFILE SET DC_ENVFILE=%DC_ENVFILE:"=% SET DC_ENVFILE="%DC_ENVFILE%" IF %DC_ENVFILE% == "" ( SET DC_ENVFILE="dcdflts.cfg" ) ELSE ( SET TMPVAL= CALL :GETDRIVEANDPATH TMPVAL,%DC_ENVFILE% IF NOT EXIST !TMPVAL! ( SET DC_ENVFILE="dcdflts.cfg" ECHO Warning^^! The specified configuration file is invalid: %DC_ENVFILE%. ECHO Using default configuration file instead: "!DC_ENVFILE!". CALL :TIMEOUT 4,NOBREAK,NUL ) ) REM Keep configuration file(s) in the same directory as the batch file? REM PUSHD "%~DP0" IF NOT EXIST %DC_ENVFILE% GOTO SETDEFAULTOPTS COPY /Y %DC_ENVFILE% __tmpcfg.bat > NUL CALL __tmpcfg.bat DEL __tmpcfg.bat :SETDEFAULTOPTS REM POPD IF NOT DEFINED EVENTBAT SET EVENTBAT="eventaction.bat" IF NOT DEFINED FINALBAT SET FINALBAT="finalaction.bat" IF NOT DEFINED DC_PRIORITY SET DC_PRIORITY=NORMAL IF NOT DEFINED DC_MODE SET DC_MODE=Dumpcap only :: Dumpcap settings: IF NOT DEFINED DC_INTERFACE SET DC_INTERFACE=1 REM IF NOT DEFINED DC_CAPFILE SET DC_CAPFILE= REM IF NOT DEFINED DC_CAPFILTER SET DC_CAPFILTER= REM IF NOT DEFINED DC_SNAPLEN SET DC_SNAPLEN= IF NOT DEFINED DC_PROMISC SET DC_PROMISC=Y REM IF NOT DEFINED DC_BUFSIZE SET DC_BUFSIZE= IF NOT DEFINED DC_PCAPNG SET DC_PCAPNG=Y :: Autostop conditions: REM IF NOT DEFINED DC_MAXPACKETS SET DC_MAXPACKETS= REM IF NOT DEFINED DC_MAXTIME SET DC_MAXTIME= REM IF NOT DEFINED DC_MAXSIZE SET DC_MAXSIZE= REM IF NOT DEFINED DC_MAXFILES SET DC_MAXFILES= :: Ringbuffer settings: REM IF NOT DEFINED DC_RINGTIME SET DC_RINGTIME= REM IF NOT DEFINED DC_RINGSIZE SET DC_RINGSIZE= REM IF NOT DEFINED DC_RINGFILES SET DC_RINGFILES= :: Capture event settings: REM IF NOT DEFINED DC_EV_INTERFACE SET DC_EV_INTERFACE= REM IF NOT DEFINED DC_EV_CAPFILTER SET DC_EV_CAPFILTER= IF NOT DEFINED DC_EV_COUNT SET DC_EV_COUNT=1 IF NOT DEFINED DC_EV_KILL SET DC_EV_KILL=N IF NOT DEFINED DC_EV_DELAY SET DC_EV_DELAY=0 :: Mailsend settings: IF NOT DEFINED MS SET MS=N IF NOT DEFINED MS_SMTP_SERVER SET MS_SMTP_SERVER=mail.domain IF NOT DEFINED MS_SMTP_PORT SET MS_SMTP_PORT=25 IF NOT DEFINED MS_SENDTO SET MS_SENDTO=user@domain REM IF NOT DEFINED MS_CC SET MS_CC= REM IF NOT DEFINED MS_BCC SET MS_BCC= REM IF NOT DEFINED MS_RRR SET MS_RRR= REM IF NOT DEFINED MS_FROM_NAME SET MS_FROM_NAME= REM IF NOT DEFINED MS_FROM SET MS_FROM= REM IF NOT DEFINED MS_REPLYTO SET MS_REPLYTO= REM IF NOT DEFINED MS_IMPORTANCE SET MS_IMPORTANCE= REM IF NOT DEFINED MS_SENSITIVITY SET MS_SENSITIVITY= REM IF NOT DEFINED MS_SECURITY SET MS_SECURITY= REM IF NOT DEFINED MS_USER SET MS_USER= :: NOTE: This batch file is not dealing with passwords at all. If you need to :: specify a password in order to send e-mail, set it via the :: SMTP_USER_PASS environment variable. IF NOT DEFINED SMTP_USER_PASS SET MS_SECURITY= IF NOT DEFINED MS_USER ( IF NOT DEFINED USERNAME ( SET MS_SECURITY= ) ) IF NOT DEFINED MS_ATTACH SET MS_ATTACH=N REM IF NOT DEFINED MS_MAXATTACH SET MS_MAXATTACH= GOTO ENUMERATE_IFACES :: -------------------------------------------------------------------------- :CLEAR_ENV SET DC_PRIORITY= SET DC_MODE= :: Dumpcap settings: SET DC_INTERFACE= SET DC_CAPFILE= SET DC_CAPFILTER= SET DC_SNAPLEN= SET DC_PROMISC= SET DC_BUFSIZE= SET DC_PCAPNG= :: Stop conditions: SET DC_MAXPACKETS= SET DC_MAXTIME= SET DC_MAXSIZE= SET DC_MAXFILES= :: Ringbuffer settings: SET DC_RINGTIME= SET DC_RINGSIZE= SET DC_RINGFILES= :: Capture event settings: SET DC_EV_INTERFACE= SET DC_EV_CAPFILTER= SET DC_EV_COUNT= SET DC_EV_KILL= SET DC_EV_DELAY= :: Mailsend settings: SET MS= SET MS_SMTP_SERVER= SET MS_SMTP_PORT= SET MS_SENDTO= SET MS_CC= SET MS_BCC= SET MS_RRR= SET MS_FROM_NAME= SET MS_FROM= SET MS_REPLYTO= SET MS_IMPORTANCE= SET MS_SENSITIVITY= SET MS_SECURITY= SET MS_USER= SET MS_ATTACH= SET MS_MAXATTACH= GOTO :EOF :: -------------------------------------------------------------------------- :SAVEOPTS SETLOCAL REM Keep configuration file(s) in the same directory as the batch file? REM PUSHD "%~DP0" ECHO > %DC_ENVFILE% @ECHO OFF ECHO >> %DC_ENVFILE% :: Dumpcap options created: %DATE%, %TIME% ECHO. >> %DC_ENVFILE% ECHO >> %DC_ENVFILE% SET DC_PRIORITY=%DC_PRIORITY% ECHO >> %DC_ENVFILE% SET DC_MODE=%DC_MODE% ECHO. >> %DC_ENVFILE% ECHO >> %DC_ENVFILE% :: Capture options: ECHO >> %DC_ENVFILE% SET DC_INTERFACE=%DC_INTERFACE% IF NOT DEFINED DC_CAPFILE ( ECHO >> %DC_ENVFILE% SET "DC_CAPFILE=" GOTO :SAVECAPFILTER ) SETLOCAL DISABLEDELAYEDEXPANSION SET "TMPVAR=%DC_CAPFILE:^=^^%" SET "TMPVAR=%TMPVAR:!=^!%" SETLOCAL ENABLEDELAYEDEXPANSION SET "TMPVAR=!TMPVAR:%%=%%%%!" ECHO >> %DC_ENVFILE% SET "DC_CAPFILE=!TMPVAR!" :SAVECAPFILTER SETLOCAL DISABLEDELAYEDEXPANSION SET "TMPVAR=%DC_CAPFILTER:!=^!%" SETLOCAL ENABLEDELAYEDEXPANSION ECHO >> %DC_ENVFILE% SET "DC_CAPFILTER=!TMPVAR!" ECHO >> %DC_ENVFILE% SET DC_SNAPLEN=%DC_SNAPLEN% ECHO >> %DC_ENVFILE% SET DC_PROMISC=%DC_PROMISC% ECHO >> %DC_ENVFILE% SET DC_BUFSIZE=%DC_BUFSIZE% ECHO >> %DC_ENVFILE% SET DC_PCAPNG=%DC_PCAPNG% ECHO. >> %DC_ENVFILE% ECHO >> %DC_ENVFILE% :: Autostop conditions: ECHO >> %DC_ENVFILE% SET DC_MAXPACKETS=%DC_MAXPACKETS% ECHO >> %DC_ENVFILE% SET DC_MAXTIME=%DC_MAXTIME% ECHO >> %DC_ENVFILE% SET DC_MAXSIZE=%DC_MAXSIZE% ECHO >> %DC_ENVFILE% SET DC_MAXFILES=%DC_MAXFILES% ECHO. >> %DC_ENVFILE% ECHO >> %DC_ENVFILE% :: Ringbuffer settings: ECHO >> %DC_ENVFILE% SET DC_RINGTIME=%DC_RINGTIME% ECHO >> %DC_ENVFILE% SET DC_RINGSIZE=%DC_RINGSIZE% ECHO >> %DC_ENVFILE% SET DC_RINGFILES=%DC_RINGFILES% ECHO. >> %DC_ENVFILE% ECHO >> %DC_ENVFILE% :: Capture event settings: ECHO >> %DC_ENVFILE% SET DC_EV_INTERFACE=%DC_EV_INTERFACE% SETLOCAL DISABLEDELAYEDEXPANSION SET "TMPVAR=%DC_EV_CAPFILTER:!=^!%" SETLOCAL ENABLEDELAYEDEXPANSION ECHO >> %DC_ENVFILE% SET "DC_EV_CAPFILTER=!TMPVAR!" ECHO >> %DC_ENVFILE% SET DC_EV_COUNT=%DC_EV_COUNT% ECHO >> %DC_ENVFILE% SET DC_EV_KILL=%DC_EV_KILL% ECHO >> %DC_ENVFILE% SET DC_EV_DELAY=%DC_EV_DELAY% ECHO. >> %DC_ENVFILE% ECHO >> %DC_ENVFILE% :: Mailsend-specific settings: ECHO >> %DC_ENVFILE% SET MS=%MS% ECHO >> %DC_ENVFILE% SET MS_SMTP_SERVER=%MS_SMTP_SERVER% ECHO >> %DC_ENVFILE% SET MS_SMTP_PORT=%MS_SMTP_PORT% ECHO >> %DC_ENVFILE% SET MS_SENDTO=%MS_SENDTO% ECHO >> %DC_ENVFILE% SET MS_CC=%MS_CC% ECHO >> %DC_ENVFILE% SET MS_BCC=%MS_BCC% ECHO >> %DC_ENVFILE% SET MS_RRR=%MS_RRR% ECHO >> %DC_ENVFILE% SET MS_FROM_NAME=%MS_FROM_NAME% ECHO >> %DC_ENVFILE% SET MS_FROM=%MS_FROM% ECHO >> %DC_ENVFILE% SET MS_REPLYTO=%MS_REPLYTO% ECHO >> %DC_ENVFILE% SET MS_IMPORTANCE=%MS_IMPORTANCE% ECHO >> %DC_ENVFILE% SET MS_SENSITIVITY=%MS_SENSITIVITY% ECHO >> %DC_ENVFILE% SET MS_SECURITY=%MS_SECURITY% IF NOT DEFINED MS_USER ( ECHO >> %DC_ENVFILE% SET "MS_USER=" GOTO :SAVEATTACH ) SETLOCAL DISABLEDELAYEDEXPANSION SET "TMPVAR=%MS_USER:^=^^%" SET "TMPVAR=%TMPVAR:!=^!%" SETLOCAL ENABLEDELAYEDEXPANSION SET "TMPVAR=!TMPVAR:%%=%%%%!" ECHO >> %DC_ENVFILE% SET "MS_USER=!TMPVAR!" :SAVEATTACH ECHO >> %DC_ENVFILE% SET MS_ATTACH=%MS_ATTACH% ECHO >> %DC_ENVFILE% SET MS_MAXATTACH=%MS_MAXATTACH% REM Keep configuration file(s) in the same directory as the batch file? REM POPD ENDLOCAL ECHO Configuration saved to %DC_ENVFILE%. GOTO :EOF :: -------------------------------------------------------------------------- :ENUMERATE_IFACES IF %AUTOSTART% == Y SET DISPLAY_IFACES=N IF %DISPLAY_IFACES% == Y GOTO BEGIN SET DC_IFACES=0 FOR /F "USEBACKQ DELIMS=" %%I IN (`%DUMPCAP% -D`) DO ( SET /A DC_IFACES=!DC_IFACES! + 1 ) :: -------------------------------------------------------------------------- :BEGIN IF %AUTOSTART% == N CLS IF %DISPLAY_IFACES% == N GOTO MENU :: Display the interfaces, nicely formatted for interfaces with IPv4 address. :: The current formatting will only retain alignment for up to 9 interfaces. :: NOTE: Because of the possibility of IPv6 or both IPv6 and IPv4 addresses :: being assigned to an interface, I'm grabbing the *LAST* 15 characters :: of the IP address field, rather than the first 15 characters, as this :: seems to be the placement location of the IPv4 address. :: NOTE: The delimiter used below is a <TAB> character, NOT spaces. :: Do not convert the <TAB> to spaces! ECHO ---------------------------[ AVAILABLE INTERFACES ]---------------------------- SET DC_IFACES=0 FOR /F "TOKENS=2,3,5 USEBACKQ DELIMS= " %%A IN (`%DUMPCAP% -DM`) DO ( SET /A DC_IFACES=!DC_IFACES! + 1 SET "IP= %%C" SET IP=!IP:~-15! SET "IP=!IP: =!" SET "IP=!IP! " SET IP=!IP:~0,15! SET TMPSTR=!DC_IFACES!^) !IP! ^| %%A %%B SET TMPSTR=!TMPSTR:~0,79! ECHO !TMPSTR! ) :: The main menu :MENU IF %DC_INTERFACE% GTR %DC_IFACES% ( ECHO. ECHO The previously selected interface, %DC_INTERFACE%, is now invalid. IF %AUTOSTART% == Y ( ECHO Fatal error - aborting. GOTO :EOF ) IF %DC_IFACES% EQU 0 ( SET DC_INTERFACE=0 SET DC_EV_INTERFACE= ) ELSE ( SET DC_INTERFACE=1 SET DC_EV_INTERFACE= ) ECHO It has been changed to !DC_INTERFACE!. This may not be the interface you want. PAUSE ) IF %DC_IFACES% EQU 0 ( SET DC_INTERFACE=0 SET DC_EV_INTERFACE= ) IF %AUTOSTART% == Y GOTO CHOICE_START :: 1 2 3 4 5 6 7 8 :: 12345678901234567890123456789012345678901234567890123456789012345678901234567890 ECHO -----------------------------------[ FILES ]----------------------------------- ECHO Configuration file %DC_ENVFILE% ECHO Event action batch file %EVENTBAT% ECHO Final action batch file %FINALBAT% ECHO ------------------------------------------------------------------------------- IF /I %DC_PRIORITY% == REALTIME ( ECHO 1^) Dumpcap runtime priority %DC_PRIORITY% (admin only; otherwise HIGH^) ) ELSE ( ECHO 1^) Dumpcap runtime priority %DC_PRIORITY% ) ECHO 2) Dumpcap Mode %DC_MODE% IF "%DC_MODE%" == "Event only" GOTO MENU_EVENT ECHO ------------------------------[ DUMPCAP OPTIONS ]------------------------------ ECHO 3) Interface %DC_INTERFACE% ECHO 4) Capture file !DC_CAPFILE! ECHO 5) Capture filter !DC_CAPFILTER! IF NOT DEFINED DC_SNAPLEN ( ECHO 6^) Snaplen Use default value ) ELSE ( ECHO 6^) Snaplen %DC_SNAPLEN% bytes ) ECHO 7) Promiscuous mode? %DC_PROMISC% IF NOT DEFINED DC_BUFSIZE ( ECHO 8^) Buffer size Use default value ) ELSE ( ECHO 8^) Buffer size %DC_BUFSIZE% MiB ) ECHO 9) Use pcapng format? %DC_PCAPNG% ECHO. ECHO Autostop conditions: IF NOT DEFINED DC_MAXPACKETS ( ECHO 10^) Stop after ^<infinite^> packets ) ELSE ( ECHO 10^) Stop after %DC_MAXPACKETS% packets ) IF NOT DEFINED DC_MAXTIME ( ECHO 11^) Stop after ^<infinite^> seconds ) ELSE ( ECHO 11^) Stop after %DC_MAXTIME% seconds ) IF NOT DEFINED DC_MAXSIZE ( ECHO 12^) Stop after ^<infinite^> kB ) ELSE ( ECHO 12^) Stop after %DC_MAXSIZE% kB ) IF NOT DEFINED DC_MAXFILES ( ECHO 13^) Stop after ^<infinite^> files ) ELSE ( ECHO 13^) Stop after %DC_MAXFILES% files ) ECHO. ECHO Ringbuffer settings: IF NOT DEFINED DC_RINGTIME ( ECHO 14^) Switch files after ^<infinite^> seconds ) ELSE ( ECHO 14^) Switch files after %DC_RINGTIME% seconds ) IF NOT DEFINED DC_RINGSIZE ( ECHO 15^) Switch files after ^<infinite^> kB ) ELSE ( ECHO 15^) Switch files after %DC_RINGSIZE% kB ) IF NOT DEFINED DC_RINGFILES ( ECHO 16^) Ringbuffer max files ^<infinite^> files ) ELSE ( ECHO 16^) Ringbuffer max files %DC_RINGFILES% files ) :MENU_EVENT IF "%DC_MODE%" == "Dumpcap only" GOTO MENU_MAILSEND ECHO ---------------------------[ CAPTURE EVENT OPTIONS ]--------------------------- IF DEFINED DC_EV_INTERFACE ( ECHO 17^) Event Interface %DC_EV_INTERFACE% ) ELSE ( ECHO 17^) Event Interface %DC_INTERFACE% (Same as capture interface^) ) ECHO 18) Event capture filter !DC_EV_CAPFILTER! ECHO 19) Event count %DC_EV_COUNT% IF "%DC_MODE%" == "Event only" ( IF %DC_EV_KILL% == N ( ECHO 20^) Event kills dumpcap? %DC_EV_KILL% ) ELSE ( IF NOT DEFINED DC_PID ( ECHO 20^) Event kills dumpcap? %DC_EV_KILL% ^(PID = unspecified^) ) ELSE ( ECHO 20^) Event kills dumpcap? %DC_EV_KILL% ^(PID = %DC_PID%^) ) ) ) ELSE ( ECHO 20^) Event kills dumpcap? %DC_EV_KILL% ) IF %DC_EV_DELAY% EQU -1 ( ECHO 21^) Delay before kill/action Wait indefinitely for keypress ) ELSE ( ECHO 21^) Delay before kill/action %DC_EV_DELAY% seconds ) :MENU_MAILSEND ECHO -----------------------------[ MAILSEND OPTIONS ]------------------------------ IF NOT DEFINED MAILSEND ( ECHO Mailsend.exe was not found; e-mail notifications will not be possible. If you ECHO want e-mail notifications, you need to download mailsend v1.17b14 ^(or later^) ECHO from https://code.google.com/p/mailsend/ then rename it as mailsend.exe and ECHO save it somewhere in your PATH or in the same directory as this batch file. GOTO MENU_END ) ECHO 22) Mailsend enabled? %MS% IF /I "%MS%" NEQ "Y" GOTO MENU_END ECHO 23) SMTP server %MS_SMTP_SERVER% ECHO 24) SMTP port %MS_SMTP_PORT% ECHO 25) Sendto address(es) !MS_SENDTO! ECHO 26) Cc address(es) !MS_CC! ECHO 27) Bcc address(es) !MS_BCC! ECHO 28) Read receipt address !MS_RRR! ECHO 29) From name %MS_FROM_NAME% IF NOT DEFINED MS_FROM ( ECHO 30^) From address !USERNAME!@!COMPUTERNAME!.!USERDNSDOMAIN! ) ELSE ( ECHO 30^) From address !MS_FROM! ) IF NOT DEFINED MS_REPLYTO ( IF NOT DEFINED MS_FROM ( ECHO 31^) Replyto address !MS_SENDTO! ) ELSE ( ECHO 31^) Replyto address !MS_FROM! ) ) ELSE ( ECHO 31^) Replyto address !MS_REPLYTO! ) ECHO 32) E-mail importance %MS_IMPORTANCE% ECHO 33) E-mail sensitivity %MS_SENSITIVITY% IF NOT DEFINED MS_SECURITY ( ECHO 34^) Security -- none -- ) ELSE ( ECHO 34^) Security %MS_SECURITY% ) IF NOT DEFINED MS_USER ( ECHO 35^) Username !USERNAME! REM ECHO 35^) Username !USERNAME! ^(%%USERNAME%%^) REM ECHO 35^) Username ^(%%USERNAME%%^) !USERNAME! ) ELSE ( ECHO 35^) Username !MS_USER! ) IF NOT DEFINED SMTP_USER_PASS ( ECHO Password -- SMTP_USER_PASS is not set -- ) ELSE ( ECHO Password ********** ) ECHO 36) Attach capture file? %MS_ATTACH% IF NOT DEFINED MS_MAXATTACH ( ECHO 37^) Attach size limit No limit ) ELSE ( ECHO 37^) Attach size limit %MS_MAXATTACH% kB ) :MENU_END ECHO ------------------------------------------------------------------------------- ECHO. IF NOT DEFINED MAILSEND ( IF "%DC_MODE%" == "Dumpcap only" ( SET MAX_CHOICE=16 ) ELSE ( SET MAX_CHOICE=21 ) ) ELSE ( IF /I "%MS%" NEQ "Y" ( SET MAX_CHOICE=22 ) ELSE ( SET MAX_CHOICE=37 ) ) :: Get the user input SET TMPCHOICE= SET /P TMPCHOICE="Enter choice (1-%MAX_CHOICE%, S: Save & Start, X: save & eXit, Q: Quit w/out saving): " IF NOT DEFINED TMPCHOICE GOTO BEGIN CALL :SANITIZE_INPUT TMPCHOICE IF /I [!TMPCHOICE!] == [S] GOTO CHOICE_START IF /I [!TMPCHOICE!] == [X] GOTO CHOICE_SAVE IF /I [!TMPCHOICE!] == [Q] GOTO CHOICE_QUIT SET /A TMPCHOICE=TMPCHOICE IF "%DC_MODE%" == "Event only" ( IF %TMPCHOICE% GEQ 3 ( IF %TMPCHOICE% LEQ 16 ( ECHO You entered an invalid choice^^! CALL :TIMEOUT 2,NOBREAK,NUL GOTO BEGIN ) ) ) IF "%DC_MODE%" == "Dumpcap only" ( IF %TMPCHOICE% GEQ 17 ( IF %TMPCHOICE% LEQ 21 ( ECHO You entered an invalid choice^^! CALL :TIMEOUT 2,NOBREAK,NUL GOTO BEGIN ) ) ) IF %TMPCHOICE% GEQ 1 ( IF %TMPCHOICE% LEQ %MAX_CHOICE% GOTO CHOICE_%TMPCHOICE% ) ECHO You entered an invalid choice^^! CALL :TIMEOUT 2,NOBREAK,NUL GOTO BEGIN :: 1) Dumpcap.exe priority: :CHOICE_1 SETLOCAL SET TMPVAL= CALL :GET_NUMERIC TMPVAL,"Priority (1=Low,2=Below Normal,3=Normal,4=Above Normal,5=High,6=Realtime): ",1,6 IF NOT DEFINED TMPVAL ( ENDLOCAL GOTO BEGIN ) IF !TMPVAL! EQU 6 ENDLOCAL & SET DC_PRIORITY=REALTIME IF !TMPVAL! EQU 5 ENDLOCAL & SET DC_PRIORITY=HIGH IF !TMPVAL! EQU 4 ENDLOCAL & SET DC_PRIORITY=ABOVENORMAL IF !TMPVAL! EQU 3 ENDLOCAL & SET DC_PRIORITY=NORMAL IF !TMPVAL! EQU 2 ENDLOCAL & SET DC_PRIORITY=BELOWNORMAL IF !TMPVAL! EQU 1 ENDLOCAL & SET DC_PRIORITY=LOW GOTO BEGIN :: 2) Dumpcap Mode: :CHOICE_2 SETLOCAL SET TMPVAL= CALL :GET_NUMERIC TMPVAL,"Mode (1=Dumpcap only, 2=Dumpcap+Event, 3=Trigger, 4=Event only): ",1,4 IF NOT DEFINED TMPVAL ( ENDLOCAL GOTO BEGIN ) IF !TMPVAL! EQU 1 ENDLOCAL & SET DC_MODE=Dumpcap only IF !TMPVAL! EQU 2 ENDLOCAL & SET DC_MODE=Dumpcap+Event IF !TMPVAL! EQU 3 ENDLOCAL & SET DC_MODE=Trigger IF !TMPVAL! EQU 4 ENDLOCAL & SET DC_MODE=Event only GOTO BEGIN :: --------------------------------------------------------------------------- :: ----------------------------- DUMPCAP OPTIONS ----------------------------- :: --------------------------------------------------------------------------- :: 3) Interface: :CHOICE_3 SETLOCAL SET TMPVAL= IF %DC_IFACES% EQU 0 ( ENDLOCAL & SET DC_INTERFACE=0 GOTO BEGIN ) IF %DC_IFACES% EQU 1 ( ENDLOCAL & SET DC_INTERFACE=1 GOTO BEGIN ) CALL :GET_NUMERIC TMPVAL,"Interface Number (1-%DC_IFACES%): ",1,%DC_IFACES% IF DEFINED TMPVAL ( ENDLOCAL & SET DC_INTERFACE=%TMPVAL% GOTO BEGIN ) ENDLOCAL GOTO BEGIN :: 4) Capture File: :CHOICE_4 SET TMPCHOICE= SET /P TMPCHOICE="Capture File (omit extension): " IF NOT DEFINED TMPCHOICE ( SET DC_CAPFILE= GOTO BEGIN ) :: Take a preliminary step to remove problematic quotes. :: TODO: In theory, we should reject the file name if it contain any double- :: quote characters rather than simply stripping them away. Maybe if we :: compute the strlen(TMPCHOICE) before/after the step to remove the :: double quotes and compare them we can tell if quotes were entered? SET TMPCHOICE=!TMPCHOICE:"=! CALL :SANITIZE_INPUT TMPCHOICE IF NOT DEFINED TMPCHOICE ( SET DC_CAPFILE= GOTO BEGIN ) :: Greater than symbol is also problematic. SET "TMPCHOICE=!TMPCHOICE:^>=^^>!" :: Search for illegal characters. :: See http://msdn.microsoft.com/en-us/library/windows/desktop/aa365247(v=vs.85).aspx :: TODO: I'm excluding the double-quote from the ILLEGAL_CHARS, even though it :: is, because it's already been stripped away above. The reason is :: because I can't figure out how to pipe the ECHO command output to :: FINDSTR without using double-quotes around the string. :: TODO: I'm also excluding the : and \ characters because those are acceptable :: characters for a path, which I'm allowing. Basically, the capture :: file name can be either a simple file name or a fully-qualified file :: name. Unfortunately, this means that someone could enter something :: like "file:foo" or "file\foo", both of which are invalid. The :: implication is that the call to dumpcap.exe will fail if such invalid :: file names are entered. How to allow e.g. C:\file but disallow fi:le? :: TODO: The ^ character is also problematic. You can successfully enter it, :: convert it to ^^ so it appears in the menu and can be written/read :: back from the configuration file, but it still gets removed from the :: file name when dumpcap.exe is called via WMIC. :: TODO: The comma , is also problematic when we try to run the WMIC command. :: I don't know why it fails or how to fix it, so for now, exclude the :: comma as well. SET "ILLEGAL_CHARS=<>/|?*,^^" ECHO "!TMPCHOICE!" | FINDSTR /R "[!ILLEGAL_CHARS!]" > NUL :REPORT_ILLEGAL_CHAR IF %ERRORLEVEL% EQU 0 ( ECHO. ECHO You entered one or more of these illegal characters: !ILLEGAL_CHARS!"\: See: ECHO http://msdn.microsoft.com/en-us/library/windows/desktop/aa365247(v=vs.85^).aspx ECHO (Note: The ^^ and , characters are only illegal because of this batch file.^) ECHO. REM CALL :TIMEOUT 2,NOBREAK,NUL PAUSE GOTO BEGIN ) :: Note: The open-parens ( closed-parens ) and ampersand & symbols are also :: problematic, but we need to fix them later in CHOICE_START; otherwise :: if we do it here, they won't be displayed properly on the menu. REM SET "TMPCHOICE=!TMPCHOICE:(=^(!" REM SET "TMPCHOICE=!TMPCHOICE:)=^)!" REM SET "TMPCHOICE=!TMPCHOICE:&=^&!" :: Remove the extension if it was entered. We'll auto-append the correct :: extension later depending on the file format selected, i.e., pcap or pcapng. :: Do this recursively to avoid multiple extensions, i.e., file.pcap.pcapng :REMOVE_EXT SET EXT=!TMPCHOICE:~-5! IF !EXT! == .pcap ( SET "TMPCHOICE=!TMPCHOICE:~0,-5!" GOTO REMOVE_EXT ) SET EXT=!TMPCHOICE:~-7! IF !EXT! == .pcapng ( SET "TMPCHOICE=!TMPCHOICE:~0,-7!" GOTO REMOVE_EXT ) CALL :GETDRIVEANDPATH TMPVAL,"!TMPCHOICE!" IF NOT EXIST !TMPVAL! ( ECHO Error^^! The specified capture file drive and/or path is invalid. REM CALL :TIMEOUT 2,NOBREAK,NUL PAUSE GOTO BEGIN ) SET "TMPVAL=!TMPCHOICE:(=^(!" CALL :GETFILE TMPVAL,"!TMPVAL!" IF NOT DEFINED TMPVAL ( ECHO Error^^! This is not a valid capture file name. REM CALL :TIMEOUT 2,NOBREAK,NUL PAUSE GOTO BEGIN ) SET DC_CAPFILE=!TMPCHOICE! GOTO BEGIN :: 5) Capture filter: :CHOICE_5 SET TMPFILTER= SET /P TMPFILTER="Capture filter: " IF NOT DEFINED TMPFILTER ( SET DC_CAPFILTER= GOTO BEGIN ) :: Take a preliminary step to remove problematic quotes :: TODO: In theory, we should reject the filter. Maybe if we compute the :: strlen(TMPCHOICE) before/after the step to remove the double quotes :: and compare them we can tell if quotes were entered? SET TMPFILTER=!TMPFILTER:"=! CALL :SANITIZE_INPUT TMPFILTER CALL :CHECK_FILTER TMPFILTER IF NOT DEFINED TMPFILTER ( SET DC_CAPFILTER= ) ELSE IF !TMPFILTER! NEQ ERROR ( SET "DC_CAPFILTER=!TMPFILTER!" ) GOTO BEGIN :: 6) Snaplen: :CHOICE_6 SETLOCAL SET TMPVAL= CALL :GET_NUMERIC TMPVAL,"Snaplen (bytes) (1-65535, blank=use default): ",1,65535 ENDLOCAL & SET DC_SNAPLEN=%TMPVAL% GOTO BEGIN :: 7) Promiscuous mode? :CHOICE_7 CALL :GET_YN DC_PROMISC,"Promiscuous Mode [Y,N]? " GOTO BEGIN :: 8) Buffer size: :CHOICE_8 SETLOCAL SET TMPVAL= CALL :GET_NUMERIC TMPVAL,"Buffer size (MiB) (1-1000, blank=use default): ",1,1000 ENDLOCAL & SET DC_BUFSIZE=%TMPVAL% GOTO BEGIN :: 9) Use pcapng format? :CHOICE_9 CALL :GET_YN DC_PCAPNG,"Use pcapng format [Y,N]? " GOTO BEGIN :: -----[ Begin autostop conditions ]----- :: 10) Stop after <N> packets :CHOICE_10 CALL :GET_NUMERIC DC_MAXPACKETS,"Max packets (1-2147483647, or blank): ",1 GOTO BEGIN :: 11) Stop after <N> seconds :CHOICE_11 CALL :GET_NUMERIC DC_MAXTIME,"Max time (seconds) (1-2147483647, or blank): ",1 GOTO BEGIN :: 12 Stop after file size exceeds <N> kB :CHOICE_12 CALL :GET_NUMERIC DC_MAXSIZE,"Max file size (kB) (1-2147483647, or blank): ",1 GOTO BEGIN :: 13) Stop after max number of files reaches <N> :CHOICE_13 CALL :GET_NUMERIC DC_MAXFILES,"Max files (1-2147483647, or blank): ",1 GOTO BEGIN :: -----[ End autostop conditions ]----- :: -----[ Begin ringbuffer settings ]----- :: 14) Switch after <N> seconds :CHOICE_14 CALL :GET_NUMERIC DC_RINGTIME,"Ringbuffer switch time (seconds) (1-2147483647, or blank): ",1 GOTO BEGIN :: 15) Switch after file size exceeds <N> kB :CHOICE_15 CALL :GET_NUMERIC DC_RINGSIZE,"Ringbuffer file size (kB) (1-2147483647, or blank): ",1 GOTO BEGIN :: 16) Ringbuffer max files :CHOICE_16 CALL :GET_NUMERIC DC_RINGFILES,"Ringbuffer max files (1-2147483647, or blank): ",1 GOTO BEGIN :: -----[ End ringbuffer settings ]----- :: --------------------------------------------------------------------------- :: -------------------------- CAPTURE EVENT OPTIONS -------------------------- :: --------------------------------------------------------------------------- :: 17) Event interface: :CHOICE_17 IF DEFINED DC_EV_INTERFACE ( IF %DC_IFACES% EQU 0 (SET DC_EV_INTERFACE=0 & GOTO BEGIN) IF %DC_IFACES% EQU 1 (SET DC_EV_INTERFACE=1 & GOTO BEGIN) ) SETLOCAL SET TMPVAL= CALL :GET_NUMERIC TMPVAL,"Interface Number (1-%DC_IFACES%, or blank to use capture interface): ",1,%DC_IFACES% ENDLOCAL & SET DC_EV_INTERFACE=%TMPVAL% GOTO BEGIN :: 18) Event capture filter: :CHOICE_18 SET TMPFILTER= SET /P TMPFILTER="Event capture filter: " :: Take a preliminary step to remove problematic quotes :: TODO: In theory, we should reject the filter. Maybe if we compute the :: strlen(TMPCHOICE) before/after the step to remove the double quotes :: and compare them we can tell if quotes were entered? IF NOT DEFINED TMPFILTER ( SET DC_EV_CAPFILTER= GOTO BEGIN ) SET TMPFILTER=!TMPFILTER:"=! CALL :SANITIZE_INPUT TMPFILTER CALL :CHECK_FILTER TMPFILTER IF NOT DEFINED TMPFILTER ( SET DC_EV_CAPFILTER= ) ELSE IF !TMPFILTER! NEQ ERROR ( SET "DC_EV_CAPFILTER=!TMPFILTER!" ) GOTO BEGIN :: 19) Event count: :CHOICE_19 SETLOCAL SET TMPVAL= CALL :GET_NUMERIC TMPVAL,"Event count: ",1 IF DEFINED TMPVAL ( ENDLOCAL & SET DC_EV_COUNT=%TMPVAL% GOTO BEGIN ) ENDLOCAL GOTO BEGIN :: 20) Event kills dumpcap? :CHOICE_20 CALL :GET_YN DC_EV_KILL,"Event kills dumpcap [Y,N]? " GOTO BEGIN :: 21) Delay before kill :CHOICE_21 SETLOCAL SET TMPVAL= CALL :GET_NUMERIC TMPVAL,"Delay before kill/action (0-99999, -1 for keypress): ",-1,99999 IF DEFINED TMPVAL ( ENDLOCAL & SET DC_EV_DELAY=%TMPVAL% GOTO BEGIN ) ENDLOCAL GOTO BEGIN :: -------------------------------------------------------------------------- :: ---------------------------- MAILSEND OPTIONS ---------------------------- :: -------------------------------------------------------------------------- :: 22) Mailsend enabled? :CHOICE_22 CALL :GET_YN MS,"Mailsend enabled [Y,N]? " GOTO BEGIN :: 23) SMTP server :: TODO: Validate IPv4, IPv6 addresses? :CHOICE_23 SETLOCAL SET TMPCHOICE= SET /P TMPCHOICE="SMTP server: " IF NOT DEFINED TMPCHOICE GOTO BEGIN :: A different, more robust approach to user input validation, the idea from: :: http://stackoverflow.com/questions/9231044/windows-batch-file-validate-user-input-environmental-variable-is-hexadecimal SET "TMPVAL=!TMPCHOICE!" FOR %%C IN (0 1 2 3 4 5 6 7 8 9 - ^ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z ^ a b c d e f g h i j k l m n o p q r s t u v w x y z) DO ( IF DEFINED TMPVAL SET "TMPVAL=!TMPVAL:%%C=!" ) IF DEFINED TMPVAL ( SET "DELIMS=!TMPVAL!" FOR %%C IN (. :) DO ( IF DEFINED DELIMS SET "DELIMS=!DELIMS:%%C=!" ) IF DEFINED DELIMS ( ECHO. ECHO You entered one or more illegal characters. Only -0-9A-Za-z are allowed. ECHO See: http://en.wikipedia.org/wiki/Hostname#Restrictions_on_valid_host_names ECHO. REM CALL :TIMEOUT 2,NOBREAK,NUL PAUSE GOTO BEGIN ) ) ECHO %TMPCHOICE% | FINDSTR /R "[\.:]" > NUL IF %ERRORLEVEL% NEQ 0 ( SET ERRMSG=You did not enter either a "." or ":". GOTO SMTP_SERVER_ERROR ) ECHO %TMPCHOICE% | FINDSTR /R "^[\.-]" > NUL IF %ERRORLEVEL% EQU 0 ( SET ERRMSG=The SMTP server address must not begin with a "." or "-". GOTO SMTP_SERVER_ERROR ) ECHO "%TMPCHOICE%" | FINDSTR /R "[\.-]\"" IF %ERRORLEVEL% EQU 0 ( SET ERRMSG=The SMTP server address must not end with a "." or "-". GOTO SMTP_SERVER_ERROR ) ECHO %TMPCHOICE% | FINDSTR /R "\.\." > NUL IF %ERRORLEVEL% EQU 0 ( SET ERRMSG=The SMTP server address must not contain adjacent "."s. GOTO SMTP_SERVER_ERROR ) ECHO %TMPCHOICE% | FINDSTR /R ":" > NUL IF %ERRORLEVEL% EQU 0 ( SET "TMPVAL=!TMPCHOICE!" FOR %%C IN (0 1 2 3 4 5 6 7 8 9 : A B C D E F a b c d e f) DO ( IF DEFINED TMPVAL SET "TMPVAL=!TMPVAL:%%C=!" ) IF DEFINED TMPVAL ( SET ERRMSG=Invalid IPv6 address. GOTO SMTP_SERVER_ERROR ) ) ENDLOCAL & SET "MS_SMTP_SERVER=%TMPCHOICE%" GOTO BEGIN :SMTP_SERVER_ERROR ECHO. ECHO %ERRMSG% ECHO. REM CALL :TIMEOUT 2,NOBREAK,NUL ENDLOCAL PAUSE GOTO BEGIN :: 24) SMTP port :CHOICE_24 SETLOCAL SET TMPVAL= CALL :GET_NUMERIC TMPVAL,"SMTP port (common ports: 25, 465 (ssl), 587 (starttls)): ",1,65535 IF DEFINED TMPVAL ( ENDLOCAL & SET MS_SMTP_PORT=%TMPVAL% GOTO BEGIN ) ENDLOCAL GOTO BEGIN :: 25) Send to address(es) :CHOICE_25 SETLOCAL SET TMPADDR= CALL :GET_ADDRESSES TMPADDR,"Sendto address(es): " IF NOT DEFINED TMPADDR ( ECHO The Sendto address can't be empty^^! PAUSE ) ELSE IF "%TMPADDR%" NEQ "ERROR" ( ENDLOCAL & SET MS_SENDTO=%TMPADDR% GOTO BEGIN ) ENDLOCAL GOTO BEGIN :: 26) Cc address(es) :CHOICE_26 SETLOCAL SET TMPADDR= CALL :GET_ADDRESSES TMPADDR,"Cc address(es): " IF "%TMPADDR%" NEQ "ERROR" ( ENDLOCAL & SET MS_CC=%TMPADDR% GOTO BEGIN ) ENDLOCAL GOTO BEGIN :: 27) Bcc address(es) :CHOICE_27 SETLOCAL SET TMPADDR= CALL :GET_ADDRESSES TMPADDR,"Bcc address(es): " IF "%TMPADDR%" NEQ "ERROR" ( ENDLOCAL & SET MS_BCC=%TMPADDR% GOTO BEGIN ) ENDLOCAL GOTO BEGIN :: 28) Read receipt address :CHOICE_28 SETLOCAL SET TMPADDR= CALL :GET_ADDRESSES TMPADDR,"Read receipt address: " IF "%TMPADDR%" EQU "ERROR" ( ENDLOCAL & GOTO BEGIN ) IF NOT DEFINED TMPADDR ( ENDLOCAL & SET MS_RRR=%TMPADDR% GOTO BEGIN ) IF "%TMPADDR:,=%" NEQ "%TMPADDR%" ( ECHO Error^^! Enter only 1 read receipt address. PAUSE ENDLOCAL & GOTO BEGIN ) ENDLOCAL & SET MS_RRR=%TMPADDR% GOTO BEGIN :: 29) From name :: TODO: I don't know which characters are definitively allowed for this field, :: but I tested a bunch and stayed away from the known batch problematic :: characters. Some (all?) of the ones being disallowed at the moment :: may be able to be supported in the future, but we'll likely have to :: perform some various escaping tricks. :CHOICE_29 SETLOCAL SET TMPCHOICE= SET /P TMPCHOICE="From name: " IF NOT DEFINED TMPCHOICE ( ENDLOCAL & SET MS_FROM_NAME= GOTO BEGIN ) :: Take a preliminary step to remove the problematic quote (") character. :: TODO: Figure out how to make (") work in the ECHO | FINDSTR line below, SET TMPCHOICE=!TMPCHOICE:"=! CALL :SANITIZE_INPUT TMPCHOICE IF NOT DEFINED TMPCHOICE ( ENDLOCAL & SET MS_FROM_NAME= GOTO BEGIN ) REM TODO: Retest all these. Maybe we can escape some and allow them? ECHO "!TMPCHOICE!" | FINDSTR /RC:"[^!%%&,:;<>@\\\^^_|]" > NUL SET ILLEGAL_CHARS="^!%%&,:;<^>@\^^_| IF %ERRORLEVEL% EQU 0 ( ECHO. ECHO You entered one or more of these illegal characters: !ILLEGAL_CHARS! ECHO. REM CALL :TIMEOUT 2,NOBREAK,NUL PAUSE GOTO BEGIN ) ENDLOCAL & SET "MS_FROM_NAME=%TMPCHOICE%" GOTO BEGIN :: 30) From address :CHOICE_30 SETLOCAL SET TMPCHOICE= SET /P TMPCHOICE="From address (blank to autofill): " SET TMPCHOICE="%TMPCHOICE%" SET TMPCHOICE=%TMPCHOICE:"=% IF NOT DEFINED TMPCHOICE ( ECHO From address will use: %USERNAME%@%COMPUTERNAME%.%USERDNSDOMAIN% CALL :TIMEOUT 2,NOBREAK,NUL ENDLOCAL & SET MS_FROM= GOTO BEGIN ) SET USER= SET DOMAIN= CALL :SPLIT_STR USER,DOMAIN,%TMPCHOICE%,"@," IF DEFINED USER ( IF DEFINED DOMAIN ( ENDLOCAL & SET MS_FROM=%TMPCHOICE% GOTO BEGIN ) ) ECHO You entered an invalid From address^^! REM CALL :TIMEOUT 2,NOBREAK,NUL ENDLOCAL PAUSE GOTO BEGIN :: 31) Reply to address :CHOICE_31 SETLOCAL SET TMPCHOICE= SET /P TMPCHOICE="Replyto address (blank to use from/to): " SET TMPCHOICE="%TMPCHOICE%" SET TMPCHOICE=%TMPCHOICE:"=% IF NOT DEFINED TMPCHOICE ( IF DEFINED MS_FROM ( ECHO Replyto address will use: %MS_FROM% ) ELSE ( ECHO Replyto address will use: %MS_SENDTO% ) CALL :TIMEOUT 2,NOBREAK,NUL ENDLOCAL & SET MS_REPLYTO= GOTO BEGIN ) SET USER= SET DOMAIN= CALL :SPLIT_STR USER,DOMAIN,%TMPCHOICE%,"@," IF DEFINED USER ( IF DEFINED DOMAIN ( ENDLOCAL & SET MS_REPLYTO=%TMPCHOICE% GOTO BEGIN ) ) ECHO You entered an invalid Replyto address^^! REM CALL :TIMEOUT 2,NOBREAK,NUL ENDLOCAL PAUSE GOTO BEGIN :: 32) E-mail importance :CHOICE_32 SETLOCAL SET TMPVAL= CALL :GET_NUMERIC TMPVAL,"E-mail importance (1=none, 2=low, 3=normal, 4=high): ",1,4 IF DEFINED TMPVAL ( IF !TMPVAL! EQU 1 ENDLOCAL & SET MS_IMPORTANCE= IF !TMPVAL! EQU 2 ENDLOCAL & SET MS_IMPORTANCE=low IF !TMPVAL! EQU 3 ENDLOCAL & SET MS_IMPORTANCE=normal IF !TMPVAL! EQU 4 ENDLOCAL & SET MS_IMPORTANCE=high GOTO BEGIN ) ENDLOCAL GOTO BEGIN :: 33) E-mail sensitivity :CHOICE_33 SETLOCAL SET TMPVAL= CALL :GET_NUMERIC TMPVAL,"E-mail sensitivity (1=none, 2=Personal, 3=Private, 4=Company-Confidential): ",1,4 SET /A TMPVAL=TMPVAL IF DEFINED TMPVAL ( IF !TMPVAL! EQU 1 ENDLOCAL & SET MS_SENSITIVITY= IF !TMPVAL! EQU 2 ENDLOCAL & SET MS_SENSITIVITY=Personal IF !TMPVAL! EQU 3 ENDLOCAL & SET MS_SENSITIVITY=Private IF !TMPVAL! EQU 4 ENDLOCAL & SET MS_SENSITIVITY=Company-Confidential GOTO BEGIN ) ENDLOCAL GOTO BEGIN :: 34) Security :CHOICE_34 SETLOCAL SET TMPVAL= CALL :GET_NUMERIC TMPVAL,"Security (1=none, 2=ssl, 3=starttls): ",1,3 IF NOT DEFINED TMPVAL ( ENDLOCAL GOTO BEGIN ) IF !TMPVAL! EQU 1 ( ENDLOCAL & SET MS_SECURITY= GOTO BEGIN ) IF NOT DEFINED SMTP_USER_PASS GOTO NOSECURITY IF NOT DEFINED MS_USER ( IF NOT DEFINED USERNAME GOTO NOSECURITY ) IF !TMPVAL! EQU 2 ENDLOCAL & SET MS_SECURITY=ssl IF !TMPVAL! EQU 3 ENDLOCAL & SET MS_SECURITY=starttls GOTO BEGIN :NOSECURITY ECHO. ECHO ERROR^^! You must first set your password through the SMTP_USER_PASS environment ECHO variable before launching this script. You must also set your ECHO username, either through the USERNAME environment variable or through ECHO the Username option. Until then, the "Security" option has been ECHO forcibly disabled. ECHO. REM CALL :TIMEOUT 2,NOBREAK,NUL PAUSE ENDLOCAL & SET MS_SECURITY= GOTO :BEGIN :: 35) Username :CHOICE_35 SET TMPCHOICE= SET /P TMPCHOICE="Username (blank to autofill): " CALL :SANITIZE_INPUT TMPCHOICE IF NOT DEFINED TMPCHOICE ( IF NOT DEFINED USERNAME ( ECHO. ECHO Warning^^! The USERNAME environment variable isn't set, so disabling ECHO the "Use STARTTLS" option. ECHO. PAUSE SET MS_SECURITY= ) ELSE ( ECHO Username will be set to: %USERNAME% CALL :TIMEOUT 2,NOBREAK,NUL SET MS_USER= ) GOTO BEGIN ) SET TMPCHOICE=!TMPCHOICE:"=! SET "MS_USER=!TMPCHOICE!" GOTO BEGIN :: 36) Attach capture file? :CHOICE_36 CALL :GET_YN MS_ATTACH,"Attach capture file [Y,N]? " GOTO BEGIN :: 37) Attach size limit :CHOICE_37 SETLOCAL SET TMPVAL= CALL :GET_NUMERIC TMPVAL,"Attach size limit (in kB, blank=no limit): ",1 ENDLOCAL & SET MS_MAXATTACH=%TMPVAL% GOTO BEGIN :: -------------------------------------------------------------------------- :: Now starts the meat of the batch file where we actually do something. :: -------------------------------------------------------------------------- :: Save options and begin capturing. :CHOICE_START IF %AUTOSTART% == N CALL :SAVEOPTS IF /I "%DC_MODE%" NEQ "Event only" ( IF %DC_INTERFACE% EQU 0 ( ECHO ERROR^^! No capture interfaces. GOTO :EOF ) ) IF NOT DEFINED DC_EV_INTERFACE SET DC_EV_INTERFACE=%DC_INTERFACE% IF /I "%DC_MODE%" EQU "Event only" ( SET DC_INTERFACE=Unknown ) IF /I "%DC_MODE%" NEQ "Dumpcap only" ( IF %DC_EV_INTERFACE% EQU 0 ( ECHO ERROR^^! No capture event interfaces. GOTO :EOF ) ) IF DEFINED MAILSEND ( IF "%MS%" NEQ "Y" SET MAILSEND= ) IF DEFINED MS_MAXATTACH SET /A MS_MAXATTACH=!MS_MAXATTACH! * 1000 IF /I "%DC_MODE%" == "Dumpcap only" ( CALL :DUMPCAP REM SET > SETEND.TXT GOTO :EOF ) IF /I "%DC_MODE%" EQU "Event only" SET DC_CAPFILE= SET HANDLE="%CD%\handle.exe" IF NOT EXIST %HANDLE% ( CALL :GETPATH HANDLE,handle.exe IF DEFINED HANDLE SET HANDLE="!HANDLE!" ) CALL :CHECK_IF_ADMIN ECHO %DATE% %TIME% IF /I "%DC_MODE%" == "Dumpcap+Event" ( CALL :START_MAIN_DUMPCAP CALL :EVENT ) IF /I "%DC_MODE%" == "Trigger" CALL :TRIGGER IF /I "%DC_MODE%" == "Event only" CALL :EVENT REM SET > SETEND.TXT GOTO :EOF :: -------------------------------------------------------------------------- :: Save and exit :CHOICE_SAVE CALL :SAVEOPTS GOTO :EOF :: Quit :CHOICE_QUIT ECHO Any configuration changes made have been discarded. GOTO :EOF :: -------------------------------------------------------------------------- :: Parameter getting/checking :: -------------------------------------------------------------------------- :GET_NUMERIC ret,str,min[,max] -- Prompt the user for a number within a range. :: -- ret [out] - the returned number, if it's valid; else unchanged :: -- str [in] - the string to print, prompting the user for input :: -- min [in] - the minimum number allowed :: -- max [in] - [optional] the maximum number allowed :: Note: If the user enters no input, the return value will be empty. SETLOCAL SET TMPCHOICE= SET /P TMPCHOICE=%2 CALL :SANITIZE_INPUT TMPCHOICE CALL :CHECK_NUMERIC TMPCHOICE,%~3,%~4 IF NOT DEFINED TMPCHOICE ( ENDLOCAL & SET %~1= ) ELSE ( ENDLOCAL & SET %~1=%TMPCHOICE% ) GOTO :EOF :: -------------------------------------------------------------------------- :CHECK_NUMERIC num,min[,max] -- Check that num is a valid number within min-max :: -- num [in/out] - the number to check; it will be undefined if invalid :: -- min [in] - the minimum number allowed :: -- max [in] - [optional] the maximum number allowed SETLOCAL SET "TMPVAL=!%~1!" IF NOT DEFINED TMPVAL ( ENDLOCAL & GOTO :EOF ) SET MIN=%2 SET MAX=%3 :: This appears to be the maximum value you can enter IF NOT DEFINED MAX ( IF %MIN% LSS 0 ( SET /A MAX=2147483647 + MIN ) ELSE ( SET /A MAX=2147483647 ) ) IF !TMPVAL! GEQ %MIN% ( IF !TMPVAL! LEQ %MAX% ( ENDLOCAL & SET "TMPVAL=!TMPVAL!" GOTO :EOF ) ELSE ( GOTO BAD_NUMERIC ) ) :BAD_NUMERIC ECHO You entered an invalid number: !TMPVAL!^^! Valid range: %MIN% - %MAX% ENDLOCAL & SET %~1= PAUSE GOTO :EOF :: -------------------------------------------------------------------------- :GET_YN ret -- Prompt the user for Y/N input :: -- ret [out] - the returned Y or N, if it's valid; else unchanged :: -- str [in] - the string to use as the user prompt :: Note: This function was added so it can work with versions of Windows, :: such as Windows XP, that don't have CHOICE. :: Note: To make the user experience the same on both versions of Windows, :: I'm forcing WIN_XP here. This also makes user entry consistent in :: that the YN parameters now require the user to hit <ENTER> like all :: other parameters. If this behavior isn't desirable, then simply :: remove the GOTO FORCE_XP. GOTO FORCE_XP_YN IF %WIN_XP% == Y ( :FORCE_XP_YN SETLOCAL SET TMPCHOICE= SET /P TMPCHOICE=%~2 CALL :SANITIZE_INPUT TMPCHOICE IF NOT DEFINED TMPCHOICE ( ENDLOCAL & GOTO :EOF ) IF /I !TMPCHOICE! == Y ( ENDLOCAL & SET %~1=Y ) ELSE IF /I !TMPCHOICE! == N ( ENDLOCAL & SET %~1=N ) ELSE ( ECHO You entered an invalid choice^^! Enter Y or N. ENDLOCAL PAUSE ) GOTO :EOF ) ELSE ( CHOICE /N /M "%~2" IF !ERRORLEVEL! EQU 2 SET %~1=N IF !ERRORLEVEL! EQU 1 SET %~1=Y ) GOTO :EOF :: -------------------------------------------------------------------------- :CHECK_FILTER filter -- Check if the capture filter is valid :: -- filter [in/out] - the capture filter to check :: TODO: This function suffers from 1 known problem: It fails if an odd number :: of double-quote (") characters are embedded in the filter. This :: causes stderr NOT to be redirected to stdout; therefore we don't find :: the "Invalid" string, so it appears to be a good filter. :: :: An earlier work-around was to use a temporary file to store both :: stdout and stderr output and then parse that instead; however, this :: isn't needed if the caller ensures that all quotes are removed from :: the filter before calling this function. This is OK because quotes :: are not used in capture filters anyway, as far as I know. SETLOCAL SET TMPFILTER=!%~1! IF NOT DEFINED TMPFILTER ( ENDLOCAL & GOTO :EOF ) REM We can't validate capture filters for versions prior to 1.6.0. IF "%DUMPCAP_EXE_VER%" LSS "1.6." ( ECHO DUMPCAP_EXE_VER=%DUMPCAP_EXE_VER% ENDLOCAL & GOTO :EOF ) SET TMPVAL= SET BUG=0 IF %BUG% EQU 1 GOTO BUG_WORKAROUND FOR /F "USEBACKQ" %%I IN (`CALL %DUMPCAP% -f "!TMPFILTER!" -d 2^>^&1 ^|FIND "Invalid"`) DO SET TMPVAL=%%I GOTO SKIP_WORKAROUND :BUG_WORKAROUND %DUMPCAP% -f "!TMPFILTER!" -d > __tmpbpf.txt 2>&1 FOR /F %%I IN (' FINDSTR Invalid __tmpbpf.txt ') DO SET TMPVAL=%%I DEL __tmpbpf.txt :SKIP_WORKAROUND IF "%TMPVAL%" NEQ "dumpcap:" (ENDLOCAL & GOTO :EOF) :BADFILTER ECHO Bad capture filter: !TMPFILTER! ECHO Refer to http://www.tcpdump.org/manpages/pcap-filter.7.html for help. ENDLOCAL & SET %~1=ERROR PAUSE GOTO :EOF :: -------------------------------------------------------------------------- :GET_ADDRESSES ret,str -- Prompt the user for an e-mail address(es) :: -- ret [out] - the returned address(es) or "ERROR" if invalid :: -- str [in] - the string to print, prompting the user for input SET TMPCHOICE= SET /P TMPCHOICE=%2 REM ECHO You entered !TMPCHOICE! REM CALL :SANITIZE_INPUT TMPCHOICE IF NOT DEFINED TMPCHOICE ( SET %~1= GOTO :EOF ) SET "TMPVAL=!TMPCHOICE!" FOR %%C IN (# $ ' + - . / 0 1 2 3 4 5 6 7 8 9 @ _ ` { } ^ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z ^ a b c d e f g h i j k l m n o p q r s t u v w x y z) DO ( IF DEFINED TMPVAL SET "TMPVAL=!TMPVAL:%%C=!" ) IF DEFINED TMPVAL SET TMPVAL=!TMPVAL:,=! IF DEFINED TMPVAL ( ECHO. ECHO You entered one or more illegal/unsupported characters. ECHO Only the following characters are currently supported: A-Za-z0-9#$'+-./_`{},@ ECHO. REM CALL :TIMEOUT 2,NOBREAK,NUL PAUSE SET %~1="ERROR" GOTO :EOF ) CALL :VALIDATE_ADDRESSES %~1,"%TMPCHOICE%" GOTO :EOF :: -------------------------------------------------------------------------- :VALIDATE_ADDRESSES ret,addr -- Validate the e-mail address(es) :: -- ret [out] - the returned address(es) or "ERROR" if any are invalid :: -- addr [in] - the address(es) to validate SET ADDRESSES=%~2 IF NOT DEFINED ADDRESSES ( SET %~1= GOTO :EOF ) :VALIDATE_ADDRESS SET USER= SET DOMAIN= SET RESULT="OK" FOR /F "TOKENS=1* DELIMS=," %%A IN ("%ADDRESSES%") DO ( CALL :SPLIT_STR USER,DOMAIN,%%A,@ IF NOT DEFINED USER GOTO BAD_ADDR IF NOT DEFINED DOMAIN GOTO BAD_ADDR CALL :VALIDATE_USER RESULT,!USER! IF !RESULT! == "ERROR" GOTO BAD_ADDR CALL :VALIDATE_DOMAIN RESULT,!DOMAIN! IF !RESULT! == "ERROR" GOTO BAD_ADDR SET ADDRESSES=%%B IF DEFINED ADDRESSES GOTO VALIDATE_ADDRESS ) SET %~1=%~2 GOTO :EOF :BAD_ADDR ECHO You entered an invalid address^^! REM CALL :TIMEOUT 2,NOBREAK,NUL PAUSE GOTO :EOF :: -------------------------------------------------------------------------- :VALIDATE_USER res,user -- Validate the username (local-part) of the email addr :: -- res [out] - the result of username validation as either "OK" or "ERROR" :: -- user [in] - the username to validate SET %~1="ERROR" SET "TMPVAL=%~2" ECHO %TMPVAL% | FINDSTR /R "^[\.]" > NUL IF %ERRORLEVEL% EQU 0 GOTO :EOF ECHO "%TMPVAL%" | FINDSTR /R "[\.]\"" IF %ERRORLEVEL% EQU 0 GOTO :EOF ECHO %TMPVAL% | FINDSTR /R "\.\." > NUL IF %ERRORLEVEL% EQU 0 GOTO :EOF SET %~1="OK" GOTO :EOF :: -------------------------------------------------------------------------- :VALIDATE_DOMAIN res,domain -- Validate the domain part of the email address :: -- res [out] - the result of domain validation as either "OK" or "ERROR" :: -- user [in] - the domain to validate SET %~1="ERROR" SET "TMPVAL=%~2" FOR %%C IN (0 1 2 3 4 5 6 7 8 9 . - ^ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z ^ a b c d e f g h i j k l m n o p q r s t u v w x y z) DO ( IF DEFINED TMPVAL SET "TMPVAL=!TMPVAL:%%C=!" ) IF DEFINED TMPVAL ( ECHO. ECHO You entered one or more illegal characters. Only -0-9A-Za-z are allowed. ECHO See: http://en.wikipedia.org/wiki/Hostname#Restrictions_on_valid_host_names ECHO. REM CALL :TIMEOUT 2,NOBREAK,NUL PAUSE GOTO :EOF ) SET "TMPVAL=%~2" ECHO %TMPVAL% | FINDSTR /R "[\.]" > NUL IF %ERRORLEVEL% NEQ 0 GOTO :EOF ECHO %TMPVAL% | FINDSTR /R "^[\.-]" > NUL IF %ERRORLEVEL% EQU 0 GOTO :EOF ECHO "%TMPVAL%" | FINDSTR /R "[\.-]\"" IF %ERRORLEVEL% EQU 0 GOTO :EOF ECHO %TMPVAL% | FINDSTR /R "\.\." > NUL IF %ERRORLEVEL% EQU 0 GOTO :EOF SET %~1="OK" GOTO :EOF :: -------------------------------------------------------------------------- :: Misc. helper functions :: -------------------------------------------------------------------------- :TIMEOUT secs,nobreak[,show] -- Wait for secs seconds or keypress if !nobreak. :: -- secs [in] - the amount of time, in seconds, to wait :: -- nobreak [in] - allow keypress or not via NOBREAK or BREAK :: -- show [in] - control whether we want to show output or not via NUL IF %~1 EQU 0 GOTO :EOF IF %WIN_XP% == Y ( CALL :DELAY %~1,%~3 GOTO :EOF ) SETLOCAL SET TMOCMD=TIMEOUT /T %1 IF %~2 == NOBREAK SET TMOCMD=!TMOCMD! /NOBREAK IF "%~3" == "NUL" SET TMOCMD=!TMOCMD! ^> NUL %TMOCMD% ENDLOCAL GOTO :EOF :: -------------------------------------------------------------------------- :DELAY num -- Delay by num seconds. For WinXP, mimicking TIMEOUT on Win7 :: -- num [in] - the number of seconds to delay :: -- show [in] - control whether we want to show output or not via NUL :: From: http://stackoverflow.com/questions/11972249/cls-clear-a-single-line SETLOCAL FOR /F %%A IN ('COPY /Z "%~F0" NUL') DO SET "CR=%%A" SET COUNT=%~1 :LOOP IF %COUNT% LSS 0 ( PAUSE ENDLOCAL & GOTO :EOF ) IF %COUNT% EQU 0 GOTO ENDDELAY IF "%~2" NEQ "NUL" <NUL SET /P "=Waiting for %COUNT% seconds ... !CR!" REM , press CTRL+C to quit ... CALL :PING,127.0.0.1,2,NUL REM CALL :TIMEOUT 1,NOBREAK,NUL SET /A COUNT=COUNT-1 GOTO :LOOP :ENDDELAY IF "%~2" NEQ "NUL" <NUL SET /P "=Timer has expired. " ENDLOCAL GOTO :EOF :: -------------------------------------------------------------------------- :PING addr,num,show -- Ping the addr num times. :: -- addr [in] - the IP address to ping :: -- num [in] - the number of times to ping :: -- show [in] - control whether we want to show output or not via NUL IF "%~3" == "NUL" ( START /B /WAIT /I PING.EXE -n %~2 %~1 > NUL ) ELSE ( START /B /WAIT /I PING.EXE -n %~2 %~1 ) GOTO :EOF :: -------------------------------------------------------------------------- :SPLIT_STR part1,part2,str,delims -- Split the string into 2 parts :: -- part1 [out] - the returned first portion of the string :: -- part2 [out] - the returned second portion of the string :: -- str [in] - the string to split, based on delims :: -- delims [in] - the delimiters, which indicate where to split the string SETLOCAL SET STR=%~3 FOR /F "TOKENS=1,2 DELIMS=%~4" %%A IN ("%STR%") DO ( ENDLOCAL & SET %~1=%%A & SET %~2=%%B ) GOTO :EOF ::---------------------------------------------------------------------------- :SANITIZE_INPUT str -- Sanitize the user's input string :: -- str [in/out] - the string to sanitize SETLOCAL SET "TMPVAL=!%~1!" IF NOT DEFINED TMPVAL ( ENDLOCAL & GOTO :EOF ) SET "TMPVAL=!TMPVAL:^=^^!" SET "TMPVAL=!TMPVAL:&=^&!" SET "TMPVAL=!TMPVAL:|=^|!" SET "TMPVAL=!TMPVAL:<=^<!" SET "TMPVAL=!TMPVAL:>=^>!" ENDLOCAL & SET "TMPVAL=!TMPVAL:"=^^"!" GOTO :EOF :: -------------------------------------------------------------------------- :CHECK_IF_ADMIN IF NOT DEFINED MAILSEND GOTO :EOF IF %MS_ATTACH% == N GOTO :EOF IF NOT DEFINED DC_CAPFILE ( IF NOT EXIST %HANDLE% ( CALL :WARN_NO_HANDLE ) ELSE ( CALL :WARN_NOT_ADMIN ) ) ELSE IF DEFINED DC_MAXFILES ( IF NOT EXIST %HANDLE% ( CALL :WARN_NO_HANDLE ) ELSE ( CALL :WARN_NOT_ADMIN ) ) ELSE IF DEFINED DC_RINGTIME ( IF NOT EXIST %HANDLE% ( CALL :WARN_NO_HANDLE ) ELSE ( CALL :WARN_NOT_ADMIN ) ) ELSE IF DEFINED DC_RINGSIZE ( IF NOT EXIST %HANDLE% ( CALL :WARN_NO_HANDLE ) ELSE ( CALL :WARN_NOT_ADMIN ) ) ELSE IF DEFINED DC_RINGFILES ( IF NOT EXIST %HANDLE% ( CALL :WARN_NO_HANDLE ) ELSE ( CALL :WARN_NOT_ADMIN ) ) GOTO :EOF :: -------------------------------------------------------------------------- :WARN_NO_HANDLE SET HANDLE= ECHO. ECHO Warning^^! Handle.exe was not found. You will be unable to attach capture files ECHO to notification e-mails. You can download handle.exe from: ECHO. ECHO http://technet.microsoft.com/en-us/sysinternals/bb896655.aspx ECHO. CALL :TIMEOUT 10,BREAK GOTO :EOF :: -------------------------------------------------------------------------- :: Idea from: http://www.robvanderwoude.com/clevertricks.php :WARN_NOT_ADMIN :: Don't bother attempting to call handle.exe later if we're not running as an :: administrator since it'll fail anyway, unfortunately. AT > NUL IF %ERRORLEVEL% NEQ 0 ( SET HANDLE= ECHO. ECHO Warning^^! You do not have administrator privileges. You will be unable to ECHO attach capture files to notification e-mails. ECHO. CALL :TIMEOUT 10,BREAK ) GOTO :EOF :: -------------------------------------------------------------------------- :: File-related helpers :: -------------------------------------------------------------------------- :FILESIZE ret,file -- Get the file size of the file :: - ret [out] - the returned file size :: - file [in] - the file, whose size we're going to return, if possible SET %~1=%~Z2 GOTO :EOF :: -------------------------------------------------------------------------- :ADDCAPFILEEXTENSION file -- Add extension to file as either .pcap or .pcapng :: -- file [in/out] - the file to which we'll append the correct extension IF %DC_PCAPNG% == Y ( SET "%~1=!%~1!.pcapng" ) ELSE ( SET "%~1=!%~1!.pcap" ) GOTO :EOF :: -------------------------------------------------------------------------- :GETPATH ret,file -- Use PATH to get the full path of the file, if possible :: -- ret [out] - the returned full path of the file as found through PATH :: -- file [in] - the file for which we're looking for the full path SET %~1=%~$PATH:2 GOTO :EOF :: -------------------------------------------------------------------------- :GETEXT ret,file -- Get the extension of the file :: -- ret [out] - the returned extension, including the '.' :: -- file [in] - the file for which we're looking for the extension SET %~1=%~X2 GOTO :EOF :: -------------------------------------------------------------------------- :GETFILE ret,file -- Get only the file name, stripping off folder and extension :: -- ret [out] - the returned file without folder or extension :: -- file [in] - the file, possibly with folder and extension specified SET %~1=%~N2 GOTO :EOF :: -------------------------------------------------------------------------- :GETDRIVEANDPATH ret,file -- Get only the drive and path of the file. :: -- ret [out] - the returned full path of the file :: -- file [in] - the file for which we're looking for the full path SET %~1=%~DP2 GOTO :EOF :: -------------------------------------------------------------------------- :GETFULLCAPFILENAME file -- Get the full capture file name, including the path :: - file [in/out] - the file, whose full path we're going to return :: Note: I assume that if the : or \ characters are present in the file that :: the full path has already been specified. SET TMPFILE=!%~1! ECHO !TMPFILE! | FINDSTR /R "[:\\]" IF %ERRORLEVEL% NEQ 0 ( SET "%~1=%CD%\!TMPFILE!" ) GOTO :EOF :: -------------------------------------------------------------------------- :: Process-related helpers :: -------------------------------------------------------------------------- :GETPID ret,process -- Get the process ID of the running process, if possible :: -- ret [out] - the returned PID of the process, or undefined :: -- process [in] - the process for which we're looking for the PID SETLOCAL SET TASK=%2 FOR /F "TOKENS=1,2,*" %%A IN ('TASKLIST /FI "IMAGENAME eq %TASK%"') DO SET MYPID=%%B IF "%MYPID%" == "No" SET MYPID= ENDLOCAL & SET %~1=%MYPID% GOTO :EOF :: -------------------------------------------------------------------------- :TRY_TO_GET_PID ret,process -- Try to get the process ID of the running process :: -- ret [out] - the returned PID of the process, or undefined :: -- process [in] - the process for which we're looking for the PID :: This function is similar to GETPID except that if there's more than 1 :: process by the same name, the PID returned will be undefined as we won't :: know which one should be returned. SETLOCAL SET TASK=%2 SET COUNT=-2 FOR /F "TOKENS=1,2,*" %%A IN ('TASKLIST /FI "IMAGENAME eq %TASK%"') DO ( SET MYPID=%%B SET /A COUNT=!COUNT! + 1 ) IF "%MYPID%" == "No" SET MYPID= IF %COUNT% GEQ 2 SET MYPID= ENDLOCAL & SET %~1=%MYPID% GOTO :EOF :: -------------------------------------------------------------------------- :GETPROCESS ret,pid -- Get the process name for the matching PID, if possible :: -- ret [out] - the returned process name :: -- pid [in] - the process ID for which we're looking for the process name SETLOCAL SET PID=%2 FOR /F "TOKENS=1,*" %%A IN ('TASKLIST /FI "PID eq %PID%"') DO SET MYNAME=%%A IF "%MYNAME%" == "INFO:" SET MYNAME= ENDLOCAL & SET %~1=%MYNAME% GOTO :EOF :: -------------------------------------------------------------------------- :PRIORITYLOOKUP -- Look up the value used to set the priority using WMIC :: -- ret [out] - the returned WMIC priority :: -- name [in] - the requested priority name :: :: DESIRED PRIORITY WMIC VALUE :: Realtime 24 256 (admin) :: High 13 128, 256 (non-admin) :: Above Normal 10 32768 :: Normal 8 32 :: Below Normal 6 16384 :: Low (Idle/Background) 4 64 SETLOCAL SET PRIORITY=%~2 IF NOT DEFINED PRIORITY ( ENDLOCAL & SET %~1=32 GOTO :EOF ) IF /I "%PRIORITY%" == "REALTIME" ( ENDLOCAL & SET %~1=256 GOTO :EOF ) IF /I "%PRIORITY%" == "HIGH" ( ENDLOCAL & SET %~1=128 GOTO :EOF ) IF /I "%PRIORITY%" == "ABOVENORMAL" ( ENDLOCAL & SET %~1=32768 GOTO :EOF ) IF /I "%PRIORITY%" == "NORMAL" ( ENDLOCAL & SET %~1=32 GOTO :EOF ) IF /I "%PRIORITY%" == "BELOWNORMAL" ( ENDLOCAL & SET %~1=16384 GOTO :EOF ) IF /I "%PRIORITY%" == "LOW" ( ENDLOCAL & SET %~1=64 GOTO :EOF ) ENDLOCAL & SET %~1=32 GOTO :EOF :: -------------------------------------------------------------------------- :BUILD_DC_CMD SET DC_CMD=%DUMPCAP% -i %DC_INTERFACE% IF DEFINED DC_SNAPLEN SET DC_CMD=%DC_CMD% -s %DC_SNAPLEN% IF %DC_PROMISC% == N SET DC_CMD=%DC_CMD% -p IF DEFINED DC_BUFSIZE SET DC_CMD=%DC_CMD% -B %DC_BUFSIZE% IF %DC_PCAPNG% == Y (SET DC_CMD=!DC_CMD! -n) ELSE (SET DC_CMD=!DC_CMD! -P) :: Autostop conditions: IF DEFINED DC_MAXPACKETS SET DC_CMD=%DC_CMD% -c %DC_MAXPACKETS% IF DEFINED DC_MAXTIME SET DC_CMD=%DC_CMD% -a duration:%DC_MAXTIME% IF DEFINED DC_MAXSIZE SET DC_CMD=%DC_CMD% -a filesize:%DC_MAXSIZE% IF DEFINED DC_MAXFILES SET DC_CMD=%DC_CMD% -a files:%DC_MAXFILES% :: Ringbuffer settings: IF DEFINED DC_RINGTIME SET DC_CMD=!DC_CMD! -b duration:%DC_RINGTIME% IF DEFINED DC_RINGSIZE SET DC_CMD=!DC_CMD! -b filesize:%DC_RINGSIZE% IF DEFINED DC_RINGFILES SET DC_CMD=!DC_CMD! -b files:%DC_RINGFILES% IF NOT DEFINED DC_CAPFILE GOTO NOCAPFILE CALL :ADDCAPFILEEXTENSION DC_CAPFILE REM Ampersand & is especially problematic here. We need to escape it now so REM GETFULLCAPFILENAME doesn't blow up, but then un-escape it as we assign it REM to ATTACH_CAPFILE so it's in the expected format. Holy $h!+ this sucks. SET "DC_CAPFILE=!DC_CAPFILE:&=^&!" CALL :GETFULLCAPFILENAME DC_CAPFILE SET "ATTACH_CAPFILE=!DC_CAPFILE:^&=&!" :: Escape the problematic symbols for the capture file name then update DC_CMD. REM SET "DC_CAPFILE=!DC_CAPFILE:&=^&!" SET "DC_CAPFILE=!DC_CAPFILE:(=^(!" SET "DC_CAPFILE=!DC_CAPFILE:)=^)!" REM SET "DC_CAPFILE=!DC_CAPFILE:\=^\!" SET DC_CMD=%DC_CMD% -w "!DC_CAPFILE!" SET "DC_CAPFILE=%DC_CAPFILE:!=^!%" SET "DC_CAPFILE=!DC_CAPFILE:%%=%%%%!" :NOCAPFILE :: Capture filter: IF NOT DEFINED DC_CAPFILTER GOTO :EOF :: Escape the problematic ) & < and > symbols for the capture filter now. SET "DC_CAPFILTER=!DC_CAPFILTER:)=^)!" SET "DC_CAPFILTER=!DC_CAPFILTER:&=^&!" SET "DC_CAPFILTER=!DC_CAPFILTER:<=^<!" SET "DC_CAPFILTER=!DC_CAPFILTER:>=^>!" SET DC_CMD=!DC_CMD! -f "!DC_CAPFILTER!" GOTO :EOF :: -------------------------------------------------------------------------- :DUMPCAP -- Build the dumpcap.exe command-line, start it up, and wait for it. SETLOCAL ECHO %DATE% %TIME% CALL :START_MAIN_DUMPCAP CALL :WAITFORDUMPCAP %DC_PID% ECHO. ECHO %DATE% %TIME% IF EXIST %EVENTBAT% CALL %EVENTBAT% SET DC_EV_INTERFACE=N/A SET DC_EV_CAPFILTER=N/A SET SUBJECT="Dumpcap termination notification" SET MSG="dumpcap has terminated." SET KILL_MSG="Dumpcap.exe(%DC_PID%) is no longer running." IF %MS_ATTACH% == Y ( IF DEFINED DC_CAPFILE ( SET NEED_TO_USE_HANDLE=N IF DEFINED DC_MAXFILES SET NEED_TO_USE_HANDLE=Y IF DEFINED DC_RINGTIME SET NEED_TO_USE_HANDLE=Y IF DEFINED DC_RINGSIZE SET NEED_TO_USE_HANDLE=Y IF DEFINED DC_RINGFILES SET NEED_TO_USE_HANDLE=Y IF !NEED_TO_USE_HANDLE! == Y ( CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"Capture file not attached - filename unknown.",N,N ) ELSE ( REM Just use the file specified. CALL :FILESIZE CAPSIZE,"!DC_CAPFILE!" IF DEFINED CAPSIZE ( IF DEFINED MS_MAXATTACH ( IF !CAPSIZE! LEQ !MS_MAXATTACH! ( SET SUBJECT=%SUBJECT:"=% SET SUBJECT=!SUBJECT! with attachment CALL :MAILSEND "!SUBJECT!",%MSG%,%KILL_MSG%,"Capture file attached.",Y,N ) ELSE ( CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"Capture file not attached - file size of !CAPSIZE! is too big.",N,N ) ) ELSE ( SET SUBJECT=%SUBJECT:"=% SET SUBJECT=!SUBJECT! with attachment CALL :MAILSEND "!SUBJECT!",%MSG%,%KILL_MSG%,"Capture file attached.",Y,N ) ) ELSE ( CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"Capture file not attached - file size unknown.",N,N ) ) ) ELSE ( REM A temporary capture file was being used CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"Capture file can't be attached - dumpcap.exe has already terminated.",N,N ) ) ELSE ( CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"",N,N ) IF EXIST %FINALBAT% CALL %FINALBAT% ENDLOCAL GOTO :EOF :: -------------------------------------------------------------------------- :WAITFORDUMPCAP pid -- Wait indefinitely for dumpcap to finish. :: -- pid [in] - the PID of the dumpcap process to wait for SETLOCAL FOR /F %%A IN ('COPY /Z "%~F0" NUL') DO SET "CR=%%A" SET COUNT=1 :WAITLOOP CALL :TIMEOUT 1,NOBREAK,NUL CALL :GETPROCESS NAME,%~1 IF NOT DEFINED NAME ENDLOCAL & GOTO :EOF <NUL SET /P "=Dumpcap.exe(%~1) has been running for !COUNT! seconds.!CR!" SET /A COUNT=COUNT+1 GOTO :WAITLOOP ENDLOCAL & GOTO :EOF :: -------------------------------------------------------------------------- :WAITFORDCOREV ret -- Wait indefinitely for either the main dumpcap capturing :: to finish or the event dumpcap instance to finish. :: -- ret [out] - the returned PID of the 1st process found to have ended :: :: SETLOCAL FOR /F %%A IN ('COPY /Z "%~F0" NUL') DO SET "CR=%%A" SET COUNT=1 :WAITDCEVLOOP CALL :TIMEOUT 1,NOBREAK,NUL CALL :GETPROCESS NAME,%DC_PID% IF NOT DEFINED NAME ( ENDLOCAL & SET %~1=%DC_PID% GOTO :EOF ) CALL :GETPROCESS NAME,%DC_EV_PID% IF NOT DEFINED NAME ( ENDLOCAL & SET %~1=%DC_EV_PID% GOTO :EOF ) <NUL SET /P "=Dumpcap.exe(%DC_PID%) has been running for !COUNT! seconds.!CR!" SET /A COUNT=COUNT+1 GOTO :WAITDCEVLOOP ENDLOCAL & GOTO :EOF :: -------------------------------------------------------------------------- :START_MAIN_DUMPCAP -- Start the main dumpcap.exe capturing. ECHO. ECHO ==========================[ MAIN DUMPCAP CAPTURING ]========================== ECHO Starting main dumpcap capturing. Press ^<Ctrl-C^> in new window to quit. ECHO. CALL :BUILD_DC_CMD REM Echo an un-escaped command SET "ECHO_CMD=!DC_CMD:^(=(!" SET "ECHO_CMD=!ECHO_CMD:^)=)!" SET "ECHO_CMD=!ECHO_CMD:^&=&!" SET "ECHO_CMD=!ECHO_CMD:^<=<!" SET "ECHO_CMD=!ECHO_CMD:^>=>!" ECHO !ECHO_CMD! :: New solution for easier PID assignment: WMIC :: Good news - we can use WMIC even outside of Sandusky, MI! :) SET DC_CMD=!DC_CMD:"=\"! FOR /F "TOKENS=2 DELIMS=;= " %%G IN ('WMIC PROCESS CALL CREATE "!DC_CMD!" ^|FIND "ProcessId"') DO SET /A DC_PID=%%G ECHO pid(dumpcap.exe) = %DC_PID% CALL :PRIORITYLOOKUP PRIORITY,%DC_PRIORITY% WMIC PROCESS WHERE PROCESSID=%DC_PID% CALL SETPRIORITY %PRIORITY% > NUL IF %ERRORLEVEL% NEQ 0 ( ECHO. ECHO Could not set dumpcap's priority to %DC_PRIORITY%. ) ECHO. GOTO :EOF :: -------------------------------------------------------------------------- :: Event handling/notification: :EVENT ECHO =============================[ EVENT MONITORING ]============================= SET DC_CMD=%DUMPCAP% -i %DC_EV_INTERFACE% -f "!DC_EV_CAPFILTER!" -c %DC_EV_COUNT% ECHO Starting dumpcap for event monitoring. Press ^<Ctrl-Break^> to quit. ECHO. ECHO !DC_CMD! ECHO. REM TODO: Should we just use this for "Event only" mode? We won't see the REM running time though. REM Changed this to WMIC solution so we can monitor both DC_PID and DC_EV_PID REM START "Capture event notification: dumpcap.exe -i %DC_EV_INTERFACE% -f !DC_EV_CAPFILTER! -c %DC_EV_COUNT%" ^ REM /B /WAIT /I /%DC_PRIORITY% !DC_CMD! REM TODO: Why wasn't DC_EV_CAPFILTER already sanitized? SET "DC_CMD=!DC_CMD:^=^^!" SET "DC_CMD=!DC_CMD:)=^)!" SET "DC_CMD=!DC_CMD:&=^&!" SET "DC_CMD=!DC_CMD:|=^|!" SET "DC_CMD=!DC_CMD:<=^<!" SET "DC_CMD=!DC_CMD:>=^>!" SET DC_CMD=!DC_CMD:"=\"! FOR /F "TOKENS=2 DELIMS=;= " %%G IN ('WMIC PROCESS CALL CREATE "!DC_CMD!" ^|FIND "ProcessId"') DO SET /A DC_EV_PID=%%G ECHO pid(dumpcap.exe) = %DC_EV_PID% CALL :PRIORITYLOOKUP PRIORITY,%DC_PRIORITY% WMIC PROCESS WHERE PROCESSID=%DC_EV_PID% CALL SETPRIORITY %PRIORITY% > NUL IF %ERRORLEVEL% NEQ 0 ( ECHO. ECHO Could not set dumpcap's priority to %DC_PRIORITY%. ) ECHO. IF "%DC_MODE%" == "Event only" ( CALL :WAITFORDUMPCAP %DC_EV_PID% ECHO. ECHO !DATE! !TIME! REM Even though we didn't start any dumpcap.exe instances ourselves, see REM if there's one instance running and if so, assume this is the one the REM user is interested in getting a capture file from. This may help the REM user by not requiring him/her to specify the PID on the dumpcap.bat REM command-line and also provide some flexibility in that the dumpcap.exe REM instance need not necessarily be started before dumpcap.bat is. IF NOT DEFINED DC_PID CALL :TRY_TO_GET_PID DC_PID dumpcap.exe IF EXIST %EVENTBAT% CALL %EVENTBAT% GOTO GOTEVENT ) CALL :WAITFORDCOREV PID ECHO %DATE% %TIME% IF %PID% EQU %DC_PID% ( ECHO Dumpcap.exe(%DC_PID%^) capturing ended before event occurred. ) IF EXIST %EVENTBAT% CALL %EVENTBAT% IF %PID% EQU %DC_PID% ( TASKKILL /F /PID %DC_EV_PID% SET SUBJECT="Notification of non-event" SET MSG="the event you were waiting for did not occur before capturing stopped." SET KILL_MSG="Dumpcap.exe(%DC_PID%) is not running." CALL :MAILSEND !SUBJECT!,!MSG!,!KILL_MSG!,"",N,N IF EXIST %FINALBAT% CALL %FINALBAT% GOTO :EOF ) :GOTEVENT ECHO. SET SUBJECT="Capture event notification" SET MSG="the event you were waiting for has occurred." IF DEFINED DC_PID ( SET KILL_MSG="Dumpcap.exe(%DC_PID%) may still be running." ) ELSE ( SET KILL_MSG="Dumpcap.exe may still be running." ) IF %DC_EV_DELAY% NEQ 0 ( CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"",N,Y IF %DC_EV_DELAY% EQU -1 ( IF %DC_EV_KILL% == Y ( SET SUBJECT="Capture termination after key press notification" ) ELSE ( SET SUBJECT="Capture delay after key press notification" ) SET MSG="someone pressed a key following the event." ) ELSE ( IF %DC_EV_KILL% == Y ( SET SUBJECT="Capture termination after %DC_EV_DELAY% seconds notification" ) ELSE ( SET SUBJECT="Capture delay after %DC_EV_DELAY% seconds notification" ) REM If we quote this, it breaks for some reason, so quote it after. SET MSG=either %DC_EV_DELAY% seconds have elapsed since the event ^ occurred or someone pressed a key to avoid waiting the entire ^ duration. SET MSG="!MSG!" ) CALL :TIMEOUT %DC_EV_DELAY%,BREAK ) IF EXIST %FINALBAT% CALL %FINALBAT% IF %DC_EV_KILL% == Y ( IF NOT DEFINED DC_PID ( SET KILL_MSG="All dumpcap.exe instances have been terminated." ) ELSE ( SET KILL_MSG="Dumpcap.exe(%DC_PID%^) has been terminated." ) ) CALL :COMMON GOTO :EOF :: -------------------------------------------------------------------------- :: Capture triggering :TRIGGER ECHO =============================[ EVENT TRIGGERING ]============================= SET DC_CMD=%DUMPCAP% -i %DC_EV_INTERFACE% -f "!DC_EV_CAPFILTER!" -c %DC_EV_COUNT% ECHO Starting dumpcap for event triggering. Press ^<Ctrl-Break^> to quit. ECHO. ECHO !DC_CMD! ECHO. START "Capture event trigger: dumpcap.exe -i %DC_EV_INTERFACE% -f !DC_EV_CAPFILTER! -c %DC_EV_COUNT%" ^ /B /WAIT /I /%DC_PRIORITY% !DC_CMD! ECHO %DATE% %TIME% IF EXIST %EVENTBAT% CALL %EVENTBAT% ECHO. SET SUBJECT="Trigger event notification" SET MSG="the event you were waiting for has occurred." SET KILL_MSG="Dumpcap.exe has not been started." IF %DC_EV_DELAY% EQU 0 ( IF %DC_EV_KILL% == Y ( IF EXIST %FINALBAT% CALL %FINALBAT% CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"",N,N ) ELSE ( CALL :START_MAIN_DUMPCAP IF EXIST %FINALBAT% CALL %FINALBAT% IF DEFINED DC_PID ( SET KILL_MSG="Dumpcap.exe(%DC_PID%) has been started." ) ELSE ( SET KILL_MSG="Dumpcap.exe has been started." ) CALL :MAILSEND %SUBJECT%,%MSG%,!KILL_MSG!,"",N,N ) GOTO :EOF ) CALL :START_MAIN_DUMPCAP IF DEFINED DC_PID ( SET KILL_MSG="Dumpcap.exe(%DC_PID%) has been started." ) ELSE ( SET KILL_MSG="Dumpcap.exe has been started." ) CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"",N,Y CALL :TIMEOUT %DC_EV_DELAY%,BREAK IF EXIST %FINALBAT% CALL %FINALBAT% IF %DC_EV_KILL% == Y ( IF %DC_EV_DELAY% EQU -1 ( SET SUBJECT="Capture termination after key press notification" ) ELSE ( SET SUBJECT="Capture termination after %DC_EV_DELAY% seconds notification" ) IF NOT DEFINED DC_PID ( SET KILL_MSG="All dumpcap.exe instances have been terminated." ) ELSE ( SET KILL_MSG="Dumpcap.exe(%DC_PID%^) has been terminated." ) ) ELSE ( IF %DC_EV_DELAY% EQU -1 ( SET SUBJECT="Capture delay after key press notification" ) ELSE ( SET SUBJECT="Capture delay after %DC_EV_DELAY% seconds notification" ) IF DEFINED DC_PID ( SET KILL_MSG="Dumpcap.exe(%DC_PID%) may still be running." ) ELSE ( SET KILL_MSG="Dumpcap.exe may still be running." ) ) CALL :COMMON GOTO :EOF :: -------------------------------------------------------------------------- :: The common part for all modes except for "Dumpcap only". :COMMON IF %DC_EV_DELAY% EQU -1 ( SET MSG="someone pressed a key following the event." ) ELSE ( REM If we quote this, it breaks for some reason, so quote it afterwards. SET MSG=either %DC_EV_DELAY% seconds have elapsed since the event ^ occurred or someone pressed a key to avoid waiting the entire ^ duration. SET MSG="!MSG!" ) IF DEFINED HANDLE SET HANDLE=%HANDLE:"=% IF %MS_ATTACH% == Y ( IF DEFINED DC_CAPFILE ( SET NEED_TO_USE_HANDLE=N IF DEFINED DC_MAXFILES SET NEED_TO_USE_HANDLE=Y IF DEFINED DC_RINGTIME SET NEED_TO_USE_HANDLE=Y IF DEFINED DC_RINGSIZE SET NEED_TO_USE_HANDLE=Y IF DEFINED DC_RINGFILES SET NEED_TO_USE_HANDLE=Y IF !NEED_TO_USE_HANDLE! == Y ( IF DEFINED HANDLE ( IF DEFINED DC_PID ( FOR /F "TOKENS=4* USEBACKQ" %%I IN (`%HANDLE% -P %DC_PID% ^| FINDSTR /R "pcap"`) DO ( REM TODO: If the file has an exclamation point ! in it, REM we'll never read it. I have wasted too much REM time trying to figure out how to get it, so I REM leave this one as an exercise for the reader. IF "%%J" NEQ "" ( SET DC_CAPFILE=%%I %%J ) ELSE ( SET DC_CAPFILE=%%I ) ) CALL :KILL_IF_NEEDED IF DEFINED DC_CAPFILE ( SET "ATTACH_CAPFILE=!DC_CAPFILE!" SET "DC_CAPFILE=!DC_CAPFILE:%%=%%%%!" CALL :FILESIZE CAPSIZE,"!DC_CAPFILE!" IF DEFINED CAPSIZE ( IF DEFINED MS_MAXATTACH ( IF !CAPSIZE! LEQ !MS_MAXATTACH! ( SET SUBJECT=%SUBJECT:"=% SET SUBJECT=!SUBJECT! with attachment CALL :MAILSEND "!SUBJECT!",%MSG%,%KILL_MSG%,"Capture file attached.",Y,N ) ELSE ( CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"Capture file not attached - file size of !CAPSIZE! is too big.",N,N ) ) ELSE ( SET SUBJECT=%SUBJECT:"=% SET SUBJECT=!SUBJECT! with attachment CALL :MAILSEND "!SUBJECT!",%MSG%,%KILL_MSG%,"Capture file attached.",Y,N ) ) ELSE ( CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"Capture file not attached - file size unknown.",N,N ) ) ELSE ( CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"Capture file not attached - handle.exe failure.",N,N ) ) ELSE ( CALL :KILL_IF_NEEDED CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"Capture file not attached - dumpcap.exe PID is unknown.",N,N ) ) ELSE ( CALL :KILL_IF_NEEDED CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"Capture file not attached - no handle.exe found or not admin.",N,N ) ) ELSE ( REM Just use the file specified. CALL :KILL_IF_NEEDED CALL :FILESIZE CAPSIZE,"!DC_CAPFILE!" IF DEFINED CAPSIZE ( IF DEFINED MS_MAXATTACH ( IF !CAPSIZE! LEQ !MS_MAXATTACH! ( SET SUBJECT=%SUBJECT:"=% SET SUBJECT=!SUBJECT! with attachment CALL :MAILSEND "!SUBJECT!",%MSG%,%KILL_MSG%,"Capture file attached.",Y,N ) ELSE ( CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"Capture file not attached - file size of !CAPSIZE! is too big.",N,N ) ) ELSE ( SET SUBJECT=%SUBJECT:"=% SET SUBJECT=!SUBJECT! with attachment CALL :MAILSEND "!SUBJECT!",%MSG%,%KILL_MSG%,"Capture file attached.",Y,N ) ) ELSE ( CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"Capture file not attached - file size unknown.",N,N ) ) ) ELSE ( REM A temporary capture file is being used IF DEFINED HANDLE ( IF DEFINED DC_PID ( FOR /F "TOKENS=4* USEBACKQ" %%I IN (`%HANDLE% -p %DC_PID% ^| FINDSTR /R "pcap"`) DO ( IF "%%J" NEQ "" ( SET DC_CAPFILE=%%I %%J ) ELSE ( SET DC_CAPFILE=%%I ) ) IF DEFINED DC_CAPFILE ( CALL :FILESIZE CAPSIZE,"!DC_CAPFILE!" IF DEFINED CAPSIZE ( IF DEFINED MS_MAXATTACH ( IF !CAPSIZE! LEQ !MS_MAXATTACH! ( SET SUBJECT=%SUBJECT:"=% SET SUBJECT=!SUBJECT! with attachment CALL :MAILSEND "!SUBJECT!",%MSG%,%KILL_MSG%,"Capture file attached.",Y,N REM NOTE: Kill *after* sending or we'll lose the temp file! CALL :KILL_IF_NEEDED ) ELSE ( CALL :KILL_IF_NEEDED CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"Capture file not attached - file size of !CAPSIZE! is too big.",N,N ) ) ELSE ( SET SUBJECT=%SUBJECT:"=% SET SUBJECT=!SUBJECT! with attachment CALL :MAILSEND "!SUBJECT!",%MSG%,%KILL_MSG%,"Capture file attached.",Y,N REM NOTE: Kill *after* sending or we'll lose the temp file! CALL :KILL_IF_NEEDED ) ) ELSE ( CALL :KILL_IF_NEEDED CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"Capture file not attached - file size unknown.",N,N ) ) ELSE ( CALL :KILL_IF_NEEDED CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"Capture file not attached - handle.exe failure.",N,N ) ) ELSE ( CALL :KILL_IF_NEEDED CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"Capture file not attached - dumpcap.exe PID is unknown.",N,N ) ) ELSE ( CALL :KILL_IF_NEEDED CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"Capture file not attached - no handle.exe found or not admin.",N,N ) ) ) ELSE ( REM Things are so much easier when we're not attaching a capture file. CALL :KILL_IF_NEEDED CALL :MAILSEND %SUBJECT%,%MSG%,%KILL_MSG%,"Capture file attachment not requested.",N,N ) GOTO :EOF :: -------------------------------------------------------------------------- :KILL_IF_NEEDED IF %DC_EV_KILL% == Y ( CALL :TIMEOUT 1,NOBREAK,NUL IF NOT DEFINED DC_PID ( TASKKILL /F /IM DUMPCAP.EXE ) ELSE ( TASKKILL /F /PID %DC_PID% ) ) GOTO :EOF :: -------------------------------------------------------------------------- :: mailsend subject,msg,kill_msg,attach_msg,attach,parallel -- Build and send :: an e-mail message using the mailsend.exe utility. :: -- subject [in] - The subject line of the e-mail message :: -- msg [in] - The message body. :: -- kill_msg [in] - Whether dumpcap.exe has been killed or may be running :: -- attach_msg [in] - A message about the attached capture file, if any :: -- attach [in] - A Boolean Y/N flag for whether to attach a pcap or not :: -- parallel [in] - A Boolean Y/N flag for whether to run mailsend.exe in :: parallel with this batch file or not :MAILSEND IF NOT DEFINED MAILSEND GOTO :EOF SETLOCAL :: Set FROM, REPLYTO and USER based on certain criteria IF NOT DEFINED MS_FROM ( SET FROM=%USERNAME%@%COMPUTERNAME%.%USERDNSDOMAIN% ) ELSE ( SET FROM=%MS_FROM% ) IF DEFINED MS_REPLYTO ( SET REPLYTO=%MS_REPLYTO% ) ELSE ( IF NOT DEFINED MS_FROM ( SET REPLYTO=%MS_SENDTO% ) ELSE ( SET REPLYTO=%MS_FROM% ) ) IF NOT DEFINED MS_USER ( SET "USER=%USERNAME%" ) ELSE ( SET "USER=!MS_USER!" ) :: Build the mailsend command (Use -v to help with debugging.) SET MSCMD=%MAILSEND% -smtp %MS_SMTP_SERVER% -port %MS_SMTP_PORT% ^ -to !MS_SENDTO! ^ -from !FROM! ^ -rt !REPLYTO! ^ -sub %1 IF DEFINED MS_CC SET MSCMD=!MSCMD! -cc "!MS_CC!" IF DEFINED MS_BCC SET MSCMD=!MSCMD! -bc "!MS_BCC!" IF DEFINED MS_RRR SET MSCMD=!MSCMD! -rrr "!MS_RRR!" IF DEFINED MS_FROM_NAME SET MSCMD=!MSCMD! -name "%MS_FROM_NAME%" IF DEFINED MS_IMPORTANCE SET MSCMD=!MSCMD! -H "Importance: %MS_IMPORTANCE%" IF DEFINED MS_SENSITIVITY SET MSCMD=!MSCMD! -H "Sensitivity: %MS_SENSITIVITY%" REM TODO: Try again to escape the problematic characters for USER. IF DEFINED MS_SECURITY SET MSCMD=!MSCMD! -%MS_SECURITY% -user "!USER!" -auth IF DEFINED DC_VER SET MSCMD=!MSCMD! -M ^"%DC_VER%^" -M ^" ^" SET MSCMD=!MSCMD! -M ^"%DATE%, %TIME%^" ^ -M ^"Machine: %COMPUTERNAME%.%USERDNSDOMAIN%^" ^ -M ^"Capture interface: %DC_INTERFACE%^" ^ -M ^"Event interface: %DC_EV_INTERFACE%^" ^ -M ^"Event: !DC_EV_CAPFILTER!^" ^ -M ^" ^" ^ -M ^"This is to inform you that %~2^" ^ -M ^" ^" ^ -M ^"%~3^" ^ -M ^" ^" ^ -M ^"%~4^" SET MSCMD=!MSCMD: =! IF NOT DEFINED ATTACH_CAPFILE SET "ATTACH_CAPFILE=!DC_CAPFILE!" IF %5 == Y ( REM For now, use vnd.tcpdump.pcap for either pcap or pcapng files. SET MSCMD=!MSCMD! -attach "!ATTACH_CAPFILE!,application/vnd.tcpdump.pcap" ) REM Run mailsend.exe in parallel? IF %6 == Y ( START "mailsend.exe" /HIGH !MSCMD! REM How do we get success/failure notification? ECHO Mailsend.exe was called. It might have even succeeded. ENDLOCAL & GOTO :EOF ) ECHO About to call mailsend.exe - this can sometimes take a little while ... REM The above "ECHO" is to temporarily force ERRORLEVEL=0 !MSCMD! IF %ERRORLEVEL% EQU 0 ( ECHO Success: Notification sent to !MS_SENDTO!. ) ELSE ( ECHO Failure: No notification sent. ) ENDLOCAL GOTO :EOF :: -------------------------------------------------------------------------- :: Editor modelines - http://www.wireshark.org/tools/modelines.html :: :: Surely you jest? :: Well, we're using ::'s instead of REM's but nope, I'm not jesting. :: :: Local variables: :: c-basic-offset: 4 :: tab-width: 4 :: indent-tabs-mode: nil :: End: :: :: vi: set shiftwidth=4 tabstop=4 expandtab: :: :indentSize=4:tabSize=4:noTabs=true: ::
- Follow-Ups:
- Prev by Date: Re: [Wireshark-users] Sniffing LACP traffic with wireshark
- Next by Date: Re: [Wireshark-users] Dumpcap batch file front-end with event notification and triggered capturing for the Windows platform
- Previous by thread: Re: [Wireshark-users] Sniffing LACP traffic with wireshark
- Next by thread: Re: [Wireshark-users] Dumpcap batch file front-end with event notification and triggered capturing for the Windows platform
- Index(es):