pcap_next_ex man page on Darwin

Man page or keyword search:  
man Server   23457 pages
apropos Keyword Search (all sections)
Output format
Darwin logo
[printable version]

PCAP_NEXT_EX(3PCAP)					   PCAP_NEXT_EX(3PCAP)

NAME
       pcap_next_ex, pcap_next - read the next packet from a pcap_t

SYNOPSIS
       #include <pcap/pcap.h>

       int pcap_next_ex(pcap_t *p, struct pcap_pkthdr **pkt_header,
	       const u_char **pkt_data);
       const u_char *pcap_next(pcap_t *p, struct pcap_pkthdr *h);

DESCRIPTION
       pcap_next_ex()  reads  the  next	 packet	 and returns a success/failure
       indication.  If the packet  was	read  without  problems,  the  pointer
       pointed	to  by	the  pkt_header	 argument  is  set  to	point  to  the
       pcap_pkthdr struct for the packet, and the pointer pointed  to  by  the
       pkt_data	 argument  is  set  to	point  to the data in the packet.  The
       struct pcap_pkthdr and the packet data are not to be freed by the call‐
       er,  and	 are  not  guaranteed  to  be  valid  after  the  next call to
       pcap_next_ex(), pcap_next(), pcap_loop(), or  pcap_dispatch();  if  the
       code needs them to remain valid, it must make a copy of them.

       pcap_next()  reads  the	next packet (by calling pcap_dispatch() with a
       cnt of 1) and returns a u_char pointer to the data in that packet.  The
       packet  data is not to be freed by the caller, and is not guaranteed to
       be  valid  after	 the  next  call   to	pcap_next_ex(),	  pcap_next(),
       pcap_loop(),  or pcap_dispatch(); if the code needs it to remain valid,
       it must make a copy of it.  The pcap_pkthdr structure pointed to	 by  h
       is filled in with the appropriate values for the packet.

RETURN VALUE
       pcap_next_ex()  returns 1 if the packet was read without problems, 0 if
       packets are being read from a live capture, and the timeout expired, -1
       if  an  error  occurred while reading the packet, and -2 if packets are
       being read from a ``savefile'', and there are no more packets  to  read
       from  the  savefile.  If -1 is returned, pcap_geterr() or pcap_perror()
       may be called with p as an argument to fetch or display the error text.

       pcap_next() returns a pointer  to  the  packet  data  on	 success,  and
       returns	NULL  if  an error occurred, or if no packets were read from a
       live capture (if, for example, they were discarded because they	didn't
       pass the packet filter, or if, on platforms that support a read timeout
       that starts before any packets arrive, the timeout expires  before  any
       packets	arrive, or if the file descriptor for the capture device is in
       non-blocking mode and no packets were available to be read), or	if  no
       more  packets are available in a ``savefile.''  Unfortunately, there is
       no way to determine whether an error occurred or not.

SEE ALSO
       pcap(3PCAP), pcap_geterr(3PCAP), pcap_dispatch(3PCAP)

				 5 April 2008		   PCAP_NEXT_EX(3PCAP)
[top]

List of man pages available for Darwin

Copyright (c) for man pages and the logo by the respective OS vendor.

For those who want to learn more, the polarhome community provides shell access and support.

[legal] [privacy] [GNU] [policy] [cookies] [netiquette] [sponsors] [FAQ]
Tweet
Polarhome, production since 1999.
Member of Polarhome portal.
Based on Fawad Halim's script.
....................................................................
Vote for polarhome
Free Shell Accounts :: the biggest list on the net