diff options
Diffstat (limited to 'pcap.3pcap.in')
| -rw-r--r-- | pcap.3pcap.in | 54 |
1 files changed, 38 insertions, 16 deletions
diff --git a/pcap.3pcap.in b/pcap.3pcap.in index 6f99cc519de4..f5a7e0ca217a 100644 --- a/pcap.3pcap.in +++ b/pcap.3pcap.in @@ -1,5 +1,3 @@ -.\" @(#) $Header: /tcpdump/master/libpcap/pcap.3pcap.in,v 1.1 2008-10-21 07:33:01 guy Exp $ -.\" .\" Copyright (c) 1994, 1996, 1997 .\" The Regents of the University of California. All rights reserved. .\" @@ -19,7 +17,7 @@ .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. .\" -.TH PCAP 3PCAP "4 April 2008" +.TH PCAP 3PCAP "16 April 2014" .SH NAME pcap \- Packet Capture library .SH SYNOPSIS @@ -309,6 +307,19 @@ handle, call lists the values it returns and describes the packet formats that correspond to those values. .PP +Do +.B NOT +assume that the packets for a given capture or ``savefile`` will have +any given link-layer header type, such as +.B DLT_EN10MB +for Ethernet. For example, the "any" device on Linux will have a +link-layer header type of +.B DLT_LINUX_SLL +even if all devices on the system at the time the "any" device is opened +have some other data link type, such as +.B DLT_EN10MB +for Ethernet. +.PP To obtain the .B "FILE\ *" corresponding to a @@ -410,7 +421,7 @@ get name for a time stamp type .BR pcap_tstamp_type_val_to_description (3PCAP) get description for a time stamp type .TP -.BR pcap_tstamp_name_to_val (3PCAP) +.BR pcap_tstamp_type_name_to_val (3PCAP) get time stamp type corresponding to a name .TP .BR pcap_datalink (3PCAP) @@ -510,20 +521,13 @@ number of bytes available from the capture, if the length of the packet is larger than the maximum number of bytes to capture). .RE .PP -.BR pcap_next_ex () -supplies that pointer through a pointer argument. -.BR pcap_next () -is passed an argument that points to a -.I struct pcap_pkthdr -structure, and fills it in. -.PP The callback is also supplied a .I const u_char pointer to the first .B caplen (as given in the .I struct pcap_pkthdr -a pointer to which is passed to the callback routine) +mentioned above) bytes of data from the packet. This won't necessarily be the entire packet; to capture the entire packet, you will have to provide a value for @@ -534,10 +538,28 @@ that is sufficiently large to get all of the packet's data - a value of 65535 should be sufficient on most if not all networks). When reading from a ``savefile'', the snapshot length specified when the capture was performed will limit the amount of packet data available. +.PP .BR pcap_next () -returns that pointer; +is passed an argument that points to a +.I struct pcap_pkthdr +structure, and fills it in with the time stamp and length values for the +packet. It returns a +.I const u_char +to the first +.B caplen +bytes of the packet on success, and NULL on error. +.PP .BR pcap_next_ex () -supplies that pointer through a pointer argument. +is passed two pointer arguments, one of which points to a +.IR struct pcap_pkthdr * +and one of which points to a +.IR "const u_char" *. +It sets the first pointer to point to a +.I struct pcap_pkthdr +structure with the time stamp and length values for the packet, and sets +the second pointer to point to the first +.B caplen +bytes of the packet. .PP To force the loop in .BR pcap_dispatch () @@ -821,12 +843,12 @@ get a string for an error or warning status code .RE .SS Getting library version information To get a string giving version information about libpcap, call -.BR pcap_library_version (). +.BR pcap_lib_version (). .TP .B Routines .RS .TP -.BR pcap_library_version (3PCAP) +.BR pcap_lib_version (3PCAP) get library version string .RE .SH BACKWARDS COMPATIBILITY |