Indicate when "pcap_next()" returns NULL, and that, unfortunately, you

don't know whether that happens because of an error or because no
packets were available at the time.

diff --git a/pcap.3 b/pcap.3
index 9b9f6f1e6aed6c7b40f3db2fe5b40707cc6aafec..517621d774124d0085413c392da7f97cfbd829b6 100644 (file)
--- a/pcap.3
+++ b/pcap.3
@@ -1,4 +1,4 @@
-.\" @(#) $Header: /tcpdump/master/libpcap/Attic/pcap.3,v 1.39 2002-10-18 08:46:15 guy Exp $
+.\" @(#) $Header: /tcpdump/master/libpcap/Attic/pcap.3,v 1.40 2002-12-17 07:32:55 guy Exp $

 .\"
 .\" Copyright (c) 1994, 1996, 1997
 .\"    The Regents of the University of California.  All rights reserved.
 .\"
 .\" Copyright (c) 1994, 1996, 1997
 .\"    The Regents of the University of California.  All rights reserved.


@@ -488,6 +488,15 @@ of 1) and returns a
 pointer to the data in that packet.  (The
 .I pcap_pkthdr
 struct for that packet is not supplied.)
 pointer to the data in that packet.  (The
 .I pcap_pkthdr
 struct for that packet is not supplied.)

+.B NULL
+is returned if an error occured, or if no packets were read from a live
+capture (if, for example, they were discarded because they didn't pass
+the packet filter, or if, on platforms that support a read timeout that
+starts before any packets arrive, the timeout expires before any packets
+arrive, or if the file descriptor for the capture device is in
+non-blocking mode and no packets were available to be read), or if no
+more packets are available in a ``savefile.''  Unfortunately, there is
+no way to determine whether an error occured or not.

 .PP
 .B pcap_dump()
 outputs a packet to the ``savefile'' opened with
 .PP
 .B pcap_dump()
 outputs a packet to the ``savefile'' opened with