Main Page | Modules | Data Structures | File List | Data Fields | Globals | Related Pages

pcap.h File Reference

Go to the source code of this file.

Basic functions

This section lists the most important functions exported by the WinPcap library.

typedef void(* pcap_handler )(u_char *user, const struct pcap_pkthdr *pkt_header, const u_char *pkt_data)
 Prototype of the callback function that receives the packets.

void pcap_freealldevs (pcap_if_t *alldevsp)
 Frees an interface list returned by pcap_findalldevs().

int pcap_compile (pcap_t *p, struct bpf_program *fp, char *str, int optimize, bpf_u_int32 netmask)
 Compiles a packet filter. Converts an high level filtering expression (see Filtering expression syntax) in a program that can be interpreted by the kernel-level filtering engine.

int pcap_compile_nopcap (int snaplen_arg, int linktype_arg, struct bpf_program *program, char *buf, int optimize, bpf_u_int32 mask)
 Compiles a packet filter without the need of opening an adapter. Converts an high level filtering expression (see Filtering expression syntax) in a program that can be interpreted by the kernel-level filtering engine.

int pcap_setfilter (pcap_t *p, struct bpf_program *fp)
 Associates a filter to a capture.

void pcap_freecode (struct bpf_program *fp)
 Frees a filter.

bool pcap_offline_filter (struct bpf_program *prog, const struct pcap_pkthdr *header, const u_char *pkt_data)
  Win32 Specific. It returns if a given filter applies to an offline packet.

pcap_dumper_tpcap_dump_open (pcap_t *p, const char *fname)
 Opens a file to write the network traffic.

void pcap_dump (u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
 Saves a packet to disk.

void pcap_close (pcap_t *p)
 closes the files associated with p and deallocates resources.

void pcap_dump_close (pcap_dumper_t *p)
 pcap_dump_close() closes the "savefile".

int pcap_next_ex (pcap_t *p, struct pcap_pkthdr **pkt_header, const u_char **pkt_data)
 Read a packet from an interface or from an offline capture.

int pcap_live_dump (pcap_t *p, char *filename, int maxsize, int maxpacks)
 Win32 Specific. Saves a capture to file.

int pcap_live_dump_ended (pcap_t *p, int sync)
 Win32 Specific. Returns the status of the kernel dump process, i.e. tells if one of the limits defined with pcap_live_dump() has been reached.

pcap_statpcap_stats_ex (pcap_t *p, int *pcap_stat_size)
  Win32 Specific. Returns statistics on current capture.


Deprecated Functions

These functions should be avoided because they have been replaced with something else.

pcap_tpcap_open_live (const char *device, int snaplen, int promisc, int to_ms, char *ebuf)
 It opens a live capture from the network.

pcap_tpcap_open_dead (int linktype, int snaplen)
 It creates a pcap_t structure without starting a capture.

pcap_tpcap_open_offline (const char *fname, char *errbuf)
 It opens a savefile in the tcpdump/libpcap format to read the packets.

int pcap_findalldevs (pcap_if_t **alldevsp, char *errbuf)
 Deprecated

char * pcap_lookupdev (char *errbuf)
 It returns the first valid device in the system.

int pcap_lookupnet (const char *device, bpf_u_int32 *netp, bpf_u_int32 *maskp, char *errbuf)
 It returns the subnet and netmask of an interface.


Discouraged Functions

These functions are still valid, but we suggest to avoid their use and replace these calls with something else.

int pcap_dispatch (pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 It collects a group of packets.

int pcap_loop (pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 It collects a group of packets.

u_char * pcap_next (pcap_t *p, struct pcap_pkthdr *h)
 It returns the next available packet.

int pcap_stats (pcap_t *p, struct pcap_stat *ps)
 It returns statistics on current capture.

FILE * pcap_file (pcap_t *p)
 It returns the stdio stream of an offile capture.

int pcap_fileno (pcap_t *p)
 It returns the file descriptor of a capture device.


Miscellaneous functions

This section lists the helper functions exported by the WinPcap library.

int pcap_setnonblock (pcap_t *p, int nonblock, char *errbuf)
 Switches between blocking and nonblocking mode.

int pcap_getnonblock (pcap_t *p, char *errbuf)
 Gets the "non-blocking" state of an interface.

int pcap_setbuff (pcap_t *p, int dim)
 Win32 Specific. Sets the size of the kernel buffer associated with an adapter.

int pcap_setmode (pcap_t *p, int mode)
 Win32 Specific. Sets the working mode of the interface p to mode.

int pcap_setmintocopy (pcap_t *p, int size)
 Win32 Specific. Sets the minumum amount of data received by the kernel in a single call.

int pcap_datalink (pcap_t *p)
 Returns the link layer of an adapter.

int pcap_snapshot (pcap_t *p)
 Returns the dimension of the packet portion (in bytes) that is delivered to the application.

int pcap_is_swapped (pcap_t *p)
 returns true if the current savefile uses a different byte order than the current system.

int pcap_major_version (pcap_t *p)
 returns the major version number of the pcap library used to write the savefile.

int pcap_minor_version (pcap_t *p)
 returns the minor version number of the pcap library used to write the savefile.

HANDLE pcap_getevent (pcap_t *p)
 Win32 Specific. Returns the handle of the event associated with the interface p.

void pcap_perror (pcap_t *p, char *prefix)
 prints the text of the last pcap library error on stderr, prefixed by prefix.

char * pcap_geterr (pcap_t *p)
 returns the error text pertaining to the last pcap library error.

char * pcap_strerror (int error)
 pcap_strerror() is provided in case strerror() isn't available.


Sending functions

This section lists the functions that are available for sending raw packets on the network. These functions are WinPcap specific.

int pcap_sendpacket (pcap_t *p, u_char *buf, int size)
 Win32 Specific. Sends a raw packet.

pcap_send_queuepcap_sendqueue_alloc (u_int memsize)
 Win32 Specific. Allocate a send queue.

void pcap_sendqueue_destroy (pcap_send_queue *queue)
 Win32 Specific. Destroy a send queue.

int pcap_sendqueue_queue (pcap_send_queue *queue, const struct pcap_pkthdr *pkt_header, const u_char *pkt_data)
 Win32 Specific. Add a packet to a send queue.

u_int pcap_sendqueue_transmit (pcap_t *p, pcap_send_queue *queue, int sync)
 Win32 Specific. Sends a queue of raw packets to the network.


documentation. Copyright (c) 2002-2003 Politecnico di Torino. All rights reserved.