Bash doesn't read .bashrc unless manually started

Question

I'm writing network analyzer and I need to filter packets saved in file, I have written some code to filter http packets but I'm not sure if it work as it should because when I use my code on a pcap dump the result is 5 packets but in wireshark writing http in filter gives me 2 packets and if I use:

tcpdump port http -r trace-1.pcap

it gives me 11 packets.

Well, 3 different results, that's a little confusing.

The filter and the packet processing in me code is:

...
if (pcap_compile(handle, &fcode, "tcp port 80", 1, netmask) < 0)
...
while ((packet = pcap_next(handle,&header))) {
    u_char *pkt_ptr = (u_char *)packet; 

    //parse the first (ethernet) header, grabbing the type field
    int ether_type = ((int)(pkt_ptr[12]) << 8) | (int)pkt_ptr[13];
    int ether_offset = 0;

    if (ether_type == ETHER_TYPE_IP) // ethernet II
        ether_offset = 14;
    else if (ether_type == ETHER_TYPE_8021Q) // 802
        ether_offset = 18;
    else
        fprintf(stderr, "Unknown ethernet type, %04X, skipping...\n", ether_type);

    //parse the IP header
    pkt_ptr += ether_offset;  //skip past the Ethernet II header
    struct ip_header *ip_hdr = (struct ip_header *)pkt_ptr; 
    int packet_length = ntohs(ip_hdr->tlen);

    printf("\n%d - packet length: %d, and the capture lenght: %d\n", cnt++,packet_length, header.caplen);

}

My question is why there are 3 different result when filtering the http? And/Or if I'm filtering it wrong then how can I do it right, also is there a way to filter http(or ssh, ftp, telnet ...) packets using something else than the port numbers?

Thanks

Solution 1

Why would it source it? Your default shell is not bash, but sh:

$ echo $SHELL
/bin/sh

In most modern systems, sh is a symlink to a basic shell. On my Debian for example:

$ ls -l /bin/sh 
lrwxrwxrwx 1 root root 4 Aug  1  2012 /bin/sh -> dash

In your case, sh is a link to bash but, as explained in man bash:

If bash is invoked with the name sh, it tries to mimic the startup behavior of historical versions of sh as closely as possible, while conforming to the POSIX standard as well. [...] When invoked as an interactive shell with the name sh, bash looks for the variable ENV, expands its value if it is defined, and uses the expanded value as the name of a file to read and execute. Since a shell invoked as sh does not attempt to read and execute commands from any other startup files, the --rcfile option has no effect.

and

--norc
Do not read and execute the system wide initialization file /etc/bash.bashrc and the personal initialization file ~/.bashrc if the shell is interactive. This option is on by default if the shell is invoked as sh.

So, since your default shell is sh, .bashrc is not read. Just set your default shell to bash using chsh -s /bin/bash.

Solution 2

In .bash_profile make sure you have the following:

# .bash_profile

# If .bash_profile exists, bash doesn't read .profile
if [[ -f ~/.profile ]]; then
  . ~/.profile
fi

# If the shell is interactive and .bashrc exists, get the aliases and functions
if [[ $- == *i* && -f ~/.bashrc ]]; then
    . ~/.bashrc
fi

Comments

[Sam Liao]

Did you compare the difference or the result? Or could you attach the pcap file link, or it's hard to tell the cause.

[Jeight]

@terdon Your answer is the correct one. My answer would only be valid if he was running bash. Nice catch, I missed that.

[haste]

Thank you. I assumed it didn't matter since /bin/sh pointed to /bin/bash. I suppose this issue stemmed from not explicitly assigning the shell to /bin/bash when I originally created the user account.

[kurtm]

Also, Debian/Ubuntu switched to dash for /bin/sh as part of the effort to reduce startup time. This was hilarious when my users started asking why their shell acted differently.

[Kusalananda]

This might give you a few headaches if you run bash alongside another shell, such as ksh93 which uses .profile by default.

[g007]

If ~/.bash_profile doesn't exist, you can create it.

[Mitoxys]

.bashrc in Debain-based OS, .bash_profile in CentOS/Fedora/Mac OS

[b-jazz]

@Mitoxys bashrc and bash_profile serve two different purposes irrespective of what distro/OS you are running bash in.