Windump colorized output. color_print.c should be put in 'win32/src'. Example output: http://www.watt-32.net/misc/windump-color-2.png

color_print.c

/*
 * Colourised output printer for tcpdump/windump.
 * For Win32 only.
 *
 * Written by G. Vanem <gvanem@yahoo.no> 2014.
 */

#ifdef HAVE_CONFIG_H
#include "config.h"
#endif

#include <assert.h>
#include <tcpdump-stdinc.h>

#include "netdissect.h"

int winpcap_trace_init (void)
{
  static int trace_level = -1;
  const char *env;

  if (trace_level == -1) {
    env = getenv("WINPCAP_TRACE");
    if (env)
       trace_level = *env - '0';
  }
  return (trace_level);
}

#if defined(WIN32_COLOR_PRINTF)   /* Rest of file */

static HANDLE stdout_hnd = INVALID_HANDLE_VALUE;
static BOOL   stdout_redirected = FALSE;

static CONSOLE_SCREEN_BUFFER_INFO console_info;

static void color_print_init (void)
{
  stdout_hnd = GetStdHandle (STD_OUTPUT_HANDLE);
  stdout_redirected = (stdout_hnd == INVALID_HANDLE_VALUE) ||
                      (!GetConsoleScreenBufferInfo(stdout_hnd, &console_info)) ||
                      (GetFileType(stdout_hnd) != FILE_TYPE_CHAR);
}

/*
 * todo: make this into a table (configurable from a .cfg-file?)
 */
static int lookup_color (const char *func)
{
  if (!strcmp(func,"ether_hdr_print"))
     return (FOREGROUND_INTENSITY + 3);

  if (!strcmp(func,"txtproto_print"))   /* this includes http_print() */
     return (FOREGROUND_INTENSITY | FOREGROUND_RED);

  if (!strcmp(func,"http_print"))       /* How to check if called from http_print() only? */
     return (FOREGROUND_INTENSITY | FOREGROUND_RED);      /* Bright red */

  if (!strcmp(func,"ts_print"))
     return (FOREGROUND_INTENSITY | FOREGROUND_GREEN | FOREGROUND_RED);  /* Yellow */

  if (!strcmp(func,"show_devices_and_exit"))
     return (FOREGROUND_INTENSITY | FOREGROUND_RED);  /* Bright red */

  if (!strcmp(func,"ip_print"))
     return (FOREGROUND_INTENSITY + 3);   /* Bright cyan */

  if (!strcmp(func,"syslog_print"))
     return (FOREGROUND_INTENSITY + 5);   /* Bright magenta */

  return (0);
}

int vcprintf (const struct netdissect_options *ndo, const char *fmt, va_list args)
{
  int ret, color = 0;
  static int init = 0;

  if (!init) {
    color_print_init();
    init = 1;
    WINPCAP_TRACE (2, "stdout_redirected: %d.\n", stdout_redirected);
  }

  WINPCAP_TRACE (2, "ndo->printf_func: %s.\n", ndo ? ndo->printf_func : "<none>??");

  if (!stdout_redirected && ndo) {
    color = lookup_color (ndo->printf_func);
    if (color && stdout_hnd != INVALID_HANDLE_VALUE) {
      SetConsoleTextAttribute (stdout_hnd, (console_info.wAttributes & ~7) | color);
    }
  }

  ret = vfprintf (stdout, fmt, args);
  if (color)
     SetConsoleTextAttribute (stdout_hnd, console_info.wAttributes);
  return (ret);
}
#endif  /* WIN32_COLOR_PRINTF */

netdissect.h.diff

--- a/netdissect.h     2014-05-06 18:41:43 +0000
+++ b/netdissect.h     2014-05-06 18:44:24 +0000
@@ -156,6 +156,10 @@
                     __attribute__ ((format (printf, 2, 3)))
 #endif
                     ;
+#ifdef WIN32_COLOR_PRINTF
+  const char *printf_func;
+  int ndo_color_flag;
+#endif
 };

 #define PT_VAT         1       /* Visual Audio Tool */
@@ -263,7 +267,13 @@
 /* Bail if "var" was not captured */
 #define ND_TCHECK(var) ND_TCHECK2(var, sizeof(var))

-#define ND_PRINT(STUFF) (*ndo->ndo_printf)STUFF
+#if defined(WIN32_COLOR_PRINTF)
+  #define ND_PRINT(STUFF) ( ndo->printf_func = __FUNCTION__, \
+                           (*ndo->ndo_printf)STUFF )
+#else
+  #define ND_PRINT(STUFF) (*ndo->ndo_printf)STUFF
+#endif
+
 #define ND_DEFAULTPRINT(ap, length) (*ndo->ndo_default_print)(ndo, ap, length)

 extern void ts_print(netdissect_options *, const struct timeval *);
@@ -609,4 +620,14 @@
 extern void geonet_print(netdissect_options *ndo,const u_char *eth_hdr,const u_char *geo_pck, u_int len);
 extern void calm_fast_print(netdissect_options *ndo,const u_char *eth_hdr,const u_char *calm_pck, u_int len);

+extern int winpcap_trace_init (void);
+
+#define WINPCAP_TRACE(level, fmt, ...)               \
+        do {                                         \
+          if (winpcap_trace_init() >= level) {       \
+            printf ("%s:%4u: ", __FILE__, __LINE__); \
+            printf (fmt, ##__VA_ARGS__);             \
+          }                                          \
+        } while (0)
+
 #endif  /* netdissect_h */
 

print.c.diff

--- a/print.c  2015-05-25 21:35:08 +0000
+++ b/print.c  2015-05-26 18:45:08 +0000
@@ -454,6 +462,11 @@
        }
 }

+#ifdef WIN32_COLOR_PRINTF
+extern int vcprintf (const struct netdissect_options *ndo,
+                     const char *fmt, va_list args);
+#endif
+
 static int
 tcpdump_printf(netdissect_options *ndo _U_, const char *fmt, ...)
 {
@@ -461,6 +474,11 @@
        int ret;

        va_start(args, fmt);
+#ifdef WIN32_COLOR_PRINTF
+       if (ndo->ndo_color_flag)
+               ret = vcprintf (ndo, fmt, args);
+       else
+#endif
        ret = vfprintf(stdout, fmt, args);
        va_end(args);

Example output from 1 console window (on Win-XP)

• http://www.watt-32.net/misc/windump-color.png

Example output from 2 slightly overlapping console windows (on Win-10):

• http://www.watt-32.net/misc/windump-color-2.png