Linux编程技术详解_之源代码（3章-4章）

PCAP

Section: C Library Functions (3)

Updated: 21 November 2003

Index

Return to Main Contents

󴖦

NAME

pcap - Packet Capture library 󴖦

SYNOPSIS

󴖦󴖦󴖦󴖦󴖦󴖦󴖦󴖦int promisc, int to_ms, char *errbuf)

pcap_t *pcap_open_dead(int linktype, int snaplen)

pcap_t *pcap_open_offline(const char *fname, char *errbuf)

pcap_dumper_t *pcap_dump_open(pcap_t *p, const char *fname)

int pcap_setnonblock(pcap_t *p, int nonblock, char *errbuf);

int pcap_getnonblock(pcap_t *p, char *errbuf);

int pcap_findalldevs(pcap_if_t **alldevsp, char *errbuf)

void pcap_freealldevs(pcap_if_t *alldevs)

󴖦󴖦󴖦󴖦󴖦󴖦󴖦󴖦pcap_handler callback, u_char *user)

int pcap_loop(pcap_t *p, int cnt,

󴖦󴖦󴖦󴖦󴖦󴖦󴖦󴖦pcap_handler callback, u_char *user)

void pcap_dump(u_char *user, struct pcap_pkthdr *h,

󴖦󴖦󴖦󴖦󴖦󴖦󴖦󴖦u_char *sp)

int pcap_compile(pcap_t *p, struct bpf_program *fp,

int pcap_next_ex(pcap_t *p, struct pcap_pkthdr **pkt_header,

󴖦󴖦󴖦󴖦󴖦󴖦󴖦󴖦const u_char **pkt_data)

void pcap_breakloop(pcap_t *)

int pcap_datalink(pcap_t *p)

int pcap_list_datalinks(pcap_t *p, int **dlt_buf);

int pcap_set_datalink(pcap_t *p, int dlt);

int pcap_datalink_name_to_val(const char *name);

int pcap_major_version(pcap_t *p)

int pcap_minor_version(pcap_t *p)

int pcap_stats(pcap_t *p, struct pcap_stat *ps)

FILE *pcap_file(pcap_t *p)

int pcap_fileno(pcap_t *p)

void pcap_perror(pcap_t *p, char *prefix)

char *pcap_geterr(pcap_t *p)

char *pcap_strerror(int error)

const char *pcap_lib_version(void)

The Packet Capture library provides a high level interface to packet capture systems. All packets

on the network, even those destined for other hosts, are accessible through this mechanism.

󴖦

ROUTINES

NOTE:

errbuf

in pcap_open_live(), pcap_open_dead(), pcap_open_offline(), pcap_setnonblock(),

pcap_getnonblock(), pcap_findalldevs(), pcap_lookupdev(), and pcap_lookupnet() is assumed to be

able to hold at least PCAP_ERRBUF_SIZE chars.

pcap_open_live() is used to obtain a packet capture descriptor to look at packets on the network.

device

is a string that specifies the network device to open; on Linux systems with 2.2 or later

kernels, a

into promiscuous mode. (Note that even if this parameter is false, the interface could well be in

promiscuous mode for some other reason.) For now, this doesn't work on the "any" device; if an

argument of "any" or NULL is supplied, the

to_ms

specifies the read

timeout in milliseconds. The read timeout is used to arrange that the read not necessarily return

immediately when a packet is seen, but that it wait for some amount of time to allow more packets

to arrive and to read multiple packets from the OS kernel in one operation. Not all platforms

support a read timeout; on platforms that don't, the read timeout is ignored. A zero value for

to_ms

, on platforms that support a read timeout, will cause a read to wait forever to allow

errbuf

before calling pcap_open_live() and display the warning to the user if

errbuf

is no longer a zero-length string.

pcap_open_dead() is used for creating a pcap_t structure to use when calling the other functions

in libpcap. It is typically used when just using libpcap for compiling BPF code.

pcap_open_offline() is called to open a ``savefile'' for reading.

fname

specifies the name of the

file to open. The file has the same format as those used by tcpdump

(1) and tcpslice(1). The name

"-" in a synonym for stdin.

errbuf

is used to return error text and is only set when

() can be used to get the error text.

pcap_setnonblock() puts a capture descriptor, opened with pcap_open_live(), into ``non-blocking''

mode, or takes it out of ``non-blocking'' mode, depending on whether the

nonblock

non-zero or zero. It has no effect on ``savefiles''. If there is an error, -1 is returned and

errbuf

is filled in with an appropriate error message; otherwise, 0 is returned. In ``non-

blocking'' mode, an attempt to read from the capture descriptor with pcap_dispatch() will, if no

packets are currently available to be read, return 0 immediately rather than blocking waiting for

packets to arrive. pcap_loop() and pcap_next() will not work in ``non-blocking'' mode.

pcap_getnonblock() returns the current ``non-blocking'' state of the capture descriptor; it

always returns 0 on ``savefiles''. If there is an error, -1 is returned and

with an appropriate error message.

next if not NULL, a pointer to the next element in the list; NULL for the last element of

the list

name a pointer to a string giving a name for the device to pass to pcap_open_live()

description

if not NULL, a pointer to a string giving a human-readable description of the device

addresses

a pointer to the first element of a list of addresses for the interface

flags interface flags:

set if the interface is a loopback interface