The Tcpdump Group git mirrors - libpcap/blob - pcap_loop.3pcap

   1 .\" Copyright (c) 1994, 1996, 1997
   2 .\"     The Regents of the University of California.  All rights reserved.
   3 .\"
   4 .\" Redistribution and use in source and binary forms, with or without
   5 .\" modification, are permitted provided that: (1) source code distributions
   6 .\" retain the above copyright notice and this paragraph in its entirety, (2)
   7 .\" distributions including binary code include the above copyright notice and
   8 .\" this paragraph in its entirety in the documentation or other materials
   9 .\" provided with the distribution, and (3) all advertising materials mentioning
  10 .\" features or use of this software display the following acknowledgement:
  11 .\" ``This product includes software developed by the University of California,
  12 .\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  13 .\" the University nor the names of its contributors may be used to endorse
  14 .\" or promote products derived from this software without specific prior
  15 .\" written permission.
  16 .\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  17 .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  18 .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  19 .\"
  20 .TH PCAP_LOOP 3PCAP "24 December 2008"
  21 .SH NAME
  22 pcap_loop, pcap_dispatch \- process packets from a live capture or savefile
  23 .SH SYNOPSIS
  24 .nf
  25 .ft B
  26 #include <pcap/pcap.h>
  27 .ft
  28 .LP
  29 .ft B
  30 typedef void (*pcap_handler)(u_char *user, const struct pcap_pkthdr *h,
  31 .ti +8
  32                              const u_char *bytes);
  33 .ft
  34 .LP
  35 .ft B
  36 int pcap_loop(pcap_t *p, int cnt,
  37 .ti +8
  38 pcap_handler callback, u_char *user);
  39 int pcap_dispatch(pcap_t *p, int cnt,
  40 .ti +8
  41 pcap_handler callback, u_char *user);
  42 .ft
  43 .fi
  44 .SH DESCRIPTION
  45 .B pcap_loop()
  46 processes packets from a live capture or ``savefile'' until
  47 .I cnt
  48 packets are processed, the end of the ``savefile'' is
  49 reached when reading from a ``savefile'',
  50 .B pcap_breakloop()
  51 is called, or an error occurs.
  52 It does
  53 .B not
  54 return when live read timeouts occur.
  55 A value of \-1 or 0 for
  56 .I cnt
  57 is equivalent to infinity, so that packets are processed until another
  58 ending condition occurs.
  59 .PP
  60 .B pcap_dispatch()
  61 processes packets from a live capture or ``savefile'' until
  62 .I cnt
  63 packets are processed, the end of the current bufferful of packets is
  64 reached when doing a live capture, the end of the ``savefile'' is
  65 reached when reading from a ``savefile'',
  66 .B pcap_breakloop()
  67 is called, or an error occurs.
  68 Thus, when doing a live capture,
  69 .I cnt
  70 is the maximum number of packets to process before returning, but is not
  71 a minimum number; when reading a live capture, only one
  72 bufferful of packets is read at a time, so fewer than
  73 .I cnt
  74 packets may be processed. A value of \-1 or 0 for
  75 .I cnt
  76 causes all the packets received in one buffer to be processed when
  77 reading a live capture, and causes all the packets in the file to be
  78 processed when reading a ``savefile''.
  79 .PP
  80 .ft B
  81 (In older versions of libpcap, the behavior when
  82 \fIcnt\fP
  83 was 0 was undefined; different platforms and devices behaved
  84 differently, so code that must work with older versions of libpcap
  85 should use \-1, not 0, as the value of
  86 \fIcnt\fP.)
  87 .ft R
  88 .PP
  89 .I callback
  90 specifies a
  91 .I pcap_handler
  92 routine to be called with three arguments:
  93 a
  94 .I u_char
  95 pointer which is passed in the
  96 .I user
  97 argument to
  98 .B pcap_loop()
  99 or
 100 .BR pcap_dispatch() ,
 101 a
 102 .I const struct pcap_pkthdr
 103 pointer pointing to the packet time stamp and lengths, and a
 104 .I const u_char
 105 pointer to the first
 106 .B caplen
 107 (as given in the
 108 .I struct pcap_pkthdr
 109 a pointer to which is passed to the callback routine)
 110 bytes of data from the packet.  The
 111 .I struct pcap_pkthdr
 112 and the packet data are not to be freed by the callback routine, and are
 113 not guaranteed to be valid after the callback routine returns; if the
 114 code needs them to be valid after the callback, it must make a copy of
 115 them.
 116 .PP
 117 The bytes of data from the packet begin with a link-layer header.  The
 118 format of the link-layer header is indicated by the return value of the
 119 .B pcap_datalink()
 120 routine when handed the
 121 .B pcap_t
 122 value also passed to
 123 .B pcap_loop()
 124 or
 125 .BR pcap_dispatch() .
 126 .I http://www.tcpdump.org/linktypes.html
 127 lists the values
 128 .B pcap_datalink()
 129 can return and describes the packet formats that
 130 correspond to those values.  The value it returns will be valid for all
 131 packets received unless and until
 132 .B pcap_set_datalink()
 133 is called; after a successful call to
 134 .BR pcap_set_datalink() ,
 135 all subsequent packets will have a link-layer header of the type
 136 specified by the link-layer header type value passed to
 137 .BR pcap_set_datalink() .
 138 .PP
 139 Do
 140 .B NOT
 141 assume that the packets for a given capture or ``savefile`` will have
 142 any given link-layer header type, such as
 143 .B DLT_EN10MB
 144 for Ethernet.  For example, the "any" device on Linux will have a
 145 link-layer header type of
 146 .B DLT_LINUX_SLL
 147 even if all devices on the system at the time the "any" device is opened
 148 have some other data link type, such as
 149 .B DLT_EN10MB
 150 for Ethernet.
 151 .SH RETURN VALUE
 152 .B pcap_loop()
 153 returns 0 if
 154 .I cnt
 155 is exhausted or if, when reading from a ``savefile'', no more packets
 156 are available.  It returns \-1 if an error occurs or \-2 if the loop
 157 terminated due to a call to
 158 .B pcap_breakloop()
 159 before any packets were processed.
 160 It does
 161 .B not
 162 return when live read timeouts occur; instead, it attempts to read more
 163 packets.
 164 .PP
 165 .B pcap_dispatch()
 166 returns the number of packets processed on success; this can be 0 if no
 167 packets were read from a live capture (if, for example, they were
 168 discarded because they didn't pass the packet filter, or if, on
 169 platforms that support a read timeout that starts before any packets
 170 arrive, the timeout expires before any packets arrive, or if the file
 171 descriptor for the capture device is in non-blocking mode and no packets
 172 were available to be read) or if no more packets are available in a
 173 ``savefile.''  It returns \-1 if an error occurs or \-2 if the loop
 174 terminated due to a call to
 175 .B pcap_breakloop()
 176 before any packets were processed.
 177 .ft B
 178 If your application uses pcap_breakloop(),
 179 make sure that you explicitly check for \-1 and \-2, rather than just
 180 checking for a return value < 0.
 181 .ft R
 182 .PP
 183 If \-1 is returned,
 184 .B pcap_geterr()
 185 or
 186 .B pcap_perror()
 187 may be called with
 188 .I p
 189 as an argument to fetch or display the error text.
 190 .SH SEE ALSO
 191 pcap(3PCAP), pcap_geterr(3PCAP), pcap_breakloop(3PCAP),
 192 pcap_datalink(3PCAP)