script or some other configuration script to check whether the libpcap
1.0 APIs are available and use them only if they are.
.SH SEE ALSO
-autoconf(1), tcpdump(1), tcpslice(1), pcap-filter(@MAN_MISC_INFO@), pfconfig(8),
-usermod(@MAN_ADMIN_COMMANDS@)
+.BR autoconf (1),
+.BR tcpdump (1),
+.BR tcpslice (1),
+.BR pcap-filter (@MAN_MISC_INFO@),
+.BR pfconfig (8),
+.BR usermod (@MAN_ADMIN_COMMANDS@)
.SH AUTHORS
The original authors of libpcap are:
.LP
.TP
.B PCAP_WARNING_TSTAMP_TYPE_NOTSUP
The time stamp type specified in a previous
-.B pcap_set_tstamp_type(3PCAP)
+.BR pcap_set_tstamp_type (3PCAP)
call isn't supported by the capture source (the time stamp type is
left as the default),
.TP
.B PCAP_WARNING
Another warning condition occurred;
-.B pcap_geterr(3PCAP)
+.BR pcap_geterr (3PCAP)
or
-.B pcap_perror(3PCAP)
+.BR pcap_perror (3PCAP)
may be called with
.I p
as an argument to fetch or display a message describing the warning
should check for positive, negative, and zero return codes, and treat
all positive return codes as warnings and all negative return
codes as errors.
-.B pcap_statustostr(3PCAP)
+.BR pcap_statustostr (3PCAP)
can be called, with a warning or error code as an argument, to fetch a
message describing the warning or error code.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
.SH DESCRIPTION
.B pcap_breakloop()
sets a flag that will force
-.B pcap_dispatch(3PCAP)
+.BR pcap_dispatch (3PCAP)
or
-.B pcap_loop(3PCAP)
+.BR pcap_loop (3PCAP)
to return rather than looping; they will return the number of packets
that have been processed so far, or
.B PCAP_ERROR_BREAK
.B PCAP_ERROR_BREAK
and clear the flag.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
.TP
.B PCAP_ERROR
Another error occurred.
-.B pcap_geterr(3PCAP)
+.BR pcap_geterr (3PCAP)
or
-.B \%pcap_perror(3PCAP)
+.BR \%pcap_perror (3PCAP)
may be called with
.I p
as an argument to fetch or display a message describing the error.
Additional error codes may be added in the future; a program should
check for 0, 1, and negative, return codes, and treat all negative
return codes as errors.
-.B pcap_statustostr(3PCAP)
+.BR pcap_statustostr (3PCAP)
can be called, with a warning or error code as an argument, to fetch a
message describing the warning or error code.
.SH SEE ALSO
-pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP),
-pcap_set_rfmon(3PCAP)
+.BR pcap (3PCAP),
+.BR pcap_create (3PCAP),
+.BR pcap_activate (3PCAP),
+.BR pcap_set_rfmon (3PCAP)
.I p
and deallocates resources.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
on failure. If
.B PCAP_ERROR
is returned,
-.B pcap_geterr(3PCAP)
+.BR pcap_geterr (3PCAP)
or
-.B pcap_perror(3PCAP)
+.BR pcap_perror (3PCAP)
may be called with
.I p
as an argument to fetch or display the error text.
.B PCAP_NETMASK_UNKNOWN
constant became available in libpcap release 1.1.0.
.SH SEE ALSO
-pcap(3PCAP), pcap_setfilter(3PCAP), pcap_freecode(3PCAP),
+.BR pcap (3PCAP),
+.BR pcap_setfilter (3PCAP),
+.BR pcap_freecode (3PCAP)
can be used to capture packets from all interfaces.
.PP
The returned handle must be activated with
-.B pcap_activate(3PCAP)
+.BR pcap_activate (3PCAP)
before packets can be captured
with it; options for the capture, such as promiscuous mode, can be set
on the handle before activating it.
.B PCAP_ERRBUF_SIZE
chars.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
.IR p .
.PP
It must not be called on a pcap descriptor created by
-.B \%pcap_create(3PCAP)
+.BR \%pcap_create (3PCAP)
that has not yet been activated by
-.BR \%pcap_activate(3PCAP) .
+.BR \%pcap_activate (3PCAP).
.PP
.I https://www.tcpdump.org/linktypes.html
lists the values
.B PCAP_ERROR_NOT_ACTIVATED
if called on a capture handle that has been created but not activated.
.SH SEE ALSO
-pcap(3PCAP), pcap-linktype(@MAN_MISC_INFO@)
+.BR pcap (3PCAP),
+.BR pcap-linktype (@MAN_MISC_INFO@)
if the name is not a known
type name..
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
.SH DESCRIPTION
.B pcap_dump()
outputs a packet to the ``savefile'' opened with
-.BR pcap_dump_open(3PCAP) .
+.BR pcap_dump_open (3PCAP).
Note that its calling arguments are suitable for use with
-.B pcap_dispatch(3PCAP)
+.BR pcap_dispatch (3PCAP)
or
-.BR pcap_loop(3PCAP) .
+.BR pcap_loop (3PCAP).
If called directly, the
.I user
parameter is of type
as returned by
.BR pcap_dump_open() .
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
.B pcap_dump_close()
closes the ``savefile.''
.SH SEE ALSO
-pcap(3PCAP), pcap_dump_open(3PCAP), pcap_dump(3PCAP)
+.BR pcap (3PCAP),
+.BR pcap_dump_open (3PCAP),
+.BR pcap_dump (3PCAP)
.SH DESCRIPTION
.B pcap_dump_file()
returns the standard I/O stream of the ``savefile'' opened by
-.BR pcap_dump_open(3PCAP) .
+.BR pcap_dump_open (3PCAP).
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
.B pcap_dump_flush()
flushes the output buffer to the ``savefile,'' so that any packets
written with
-.B pcap_dump(3PCAP)
+.BR pcap_dump (3PCAP)
but not yet written to the ``savefile'' will be written.
.SH RETURN VALUE
.B pcap_dump_flush()
.B PCAP_ERROR
on failure.
.SH SEE ALSO
-pcap(3PCAP), pcap_dump_open(3PCAP)
+.BR pcap (3PCAP),
+.BR pcap_dump_open (3PCAP)
.B pcap_dump_ftell()
returns the current file position for the ``savefile'', representing the
number of bytes written by
-.B pcap_dump_open(3PCAP)
+.BR pcap_dump_open (3PCAP)
and
-.BR pcap_dump(3PCAP) .
+.BR pcap_dump (3PCAP).
.B PCAP_ERROR
is returned on error. If the current file position does not fit in a
.BR long ,
.B PCAP_ERROR
is returned on error.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
is called to write data to an existing open stream
.IR fp ;
this stream will be closed by a subsequent call to
-.BR pcap_dump_close(3PCAP) .
+.BR pcap_dump_close (3PCAP).
Note that on Windows, that stream should be opened in binary mode.
.PP
.I p
is a capture or ``savefile'' handle returned by an earlier call to
-.B pcap_create(3PCAP)
+.BR pcap_create (3PCAP)
and activated by an earlier call to
-.BR \%pcap_activate(3PCAP) ,
+.BR \%pcap_activate (3PCAP),
or returned by an earlier call to
-.BR \%pcap_open_offline(3PCAP) ,
-.BR pcap_open_live(3PCAP) ,
+.BR \%pcap_open_offline (3PCAP),
+.BR pcap_open_live (3PCAP),
or
-.BR pcap_open_dead(3PCAP) .
+.BR pcap_open_dead (3PCAP).
The time stamp precision, link-layer type, and snapshot length from
.I p
are used as the link-layer type and snapshot length of the output file.
A pointer to a
.B pcap_dumper_t
structure to use in subsequent
-.B pcap_dump(3PCAP)
+.BR pcap_dump (3PCAP)
and
-.B pcap_dump_close(3PCAP)
+.BR pcap_dump_close (3PCAP)
calls is returned on success.
.B NULL
is returned on failure.
If
.B NULL
is returned,
-.B pcap_geterr(3PCAP)
+.BR pcap_geterr (3PCAP)
can be used to get the error text.
.SH BACKWARD COMPATIBILITY
.PP
releases, there is no support for appending packets to an existing
savefile.
.SH SEE ALSO
-pcap(3PCAP),
-\%pcap-savefile(@MAN_FILE_FORMATS@)
+.BR pcap (3PCAP),
+.BR \%pcap-savefile (@MAN_FILE_FORMATS@)
.B pcap_file()
returns the standard I/O stream of the ``savefile,'' if a ``savefile''
was opened with
-.BR pcap_open_offline(3PCAP) ,
+.BR pcap_open_offline (3PCAP),
or
.BR NULL ,
if a network device was opened with
-.B pcap_create(3PCAP)
+.BR pcap_create (3PCAP)
and
-.BR \%pcap_activate(3PCAP) ,
+.BR \%pcap_activate (3PCAP),
or with
-.BR pcap_open_live(3PCAP) .
+.BR pcap_open_live (3PCAP).
.PP
Note that the Packet Capture library is usually built with large file
support, so the standard I/O stream of the ``savefile'' might refer to
value of
.B pcap_file()
or the value returned by
-.B fileno(3)
+.BR fileno (3)
when passed the return value of
.BR pcap_file() .
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
.I p
refers to a network device that was opened for a live capture using
a combination of
-.B pcap_create(3PCAP)
+.BR pcap_create (3PCAP)
and
-.BR pcap_activate(3PCAP) ,
+.BR pcap_activate (3PCAP),
or using
-.BR pcap_open_live(3PCAP) ,
+.BR pcap_open_live (3PCAP),
.B pcap_fileno()
returns the file descriptor from which captured packets are read.
.LP
If
.I p
refers to a ``savefile'' that was opened using functions such as
-.BR pcap_open_offline(3PCAP)
+.BR pcap_open_offline (3PCAP)
or
-.BR pcap_fopen_offline(3PCAP) ,
+.BR pcap_fopen_offline (3PCAP),
a ``dead''
.B pcap_t
opened using
-.BR pcap_open_dead(3PCAP) ,
+.BR pcap_open_dead (3PCAP),
or a
.B pcap_t
that was created with
it returns
.BR PCAP_ERROR .
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
.SH DESCRIPTION
.B pcap_findalldevs()
constructs a list of network devices that can be opened with
-.B pcap_create(3PCAP)
+.BR pcap_create (3PCAP)
and
-.B pcap_activate(3PCAP)
+.BR pcap_activate (3PCAP)
or with
-.BR pcap_open_live(3PCAP) .
+.BR pcap_open_live (3PCAP).
(Note that there may be network devices that cannot be opened by the
process calling
.BR pcap_findalldevs() ,
.BR "struct sockaddr_in6".
.PP
The list of devices must be freed with
-.BR pcap_freealldevs(3PCAP) ,
+.BR pcap_freealldevs (3PCAP),
which frees the list pointed to by
.IR alldevs .
.SH RETURN VALUE
.B PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE
constants became available in libpcap release 1.9.0.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
is used to free up allocated memory pointed to by a
.I bpf_program
struct generated by
-.B pcap_compile(3PCAP)
+.BR pcap_compile (3PCAP)
when that BPF program is no longer needed, for example after it
has been made the filter program for a pcap structure by a call to
-.BR pcap_setfilter(3PCAP) .
+.BR pcap_setfilter (3PCAP).
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
returns, on UNIX, a pointer to a
.B struct timeval
containing a value that must be used as the minimum timeout in
-.BR select(2) ,
-.BR poll(2) ,
-.BR epoll_wait(2) ,
+.BR select (2),
+.BR poll (2),
+.BR epoll_wait (2),
and
-.B kevent()
+.BR kevent (2)
calls if
-.B pcap_get_selectable_fd(3PCAP)
+.BR pcap_get_selectable_fd (3PCAP)
returns
.BR PCAP_ERROR .
.PP
returned
.B PCAP_ERROR
must be put in non-blocking mode with
-.BR pcap_setnonblock(3PCAP) ,
+.BR pcap_setnonblock (3PCAP),
and an attempt must always be made to read packets from the device
when the
.BR select() ,
Note that a device on which a read can be done without blocking may,
on some platforms, not have any packets to read if the packet buffer
timeout has expired. A call to
-.B pcap_dispatch(3PCAP)
+.BR pcap_dispatch (3PCAP)
or
-.B pcap_next_ex(3PCAP)
+.BR pcap_next_ex (3PCAP)
will return 0 in this case, but will not block.
.PP
.B pcap_get_required_select_timeout()
.B pcap_get_selectable_fd
returns \-1.
.SH SEE ALSO
-pcap(3PCAP), pcap_get_selectable_fd(3PCAP), select(2), poll(2),
-epoll_wait(2), kqueue(2)
+.BR pcap (3PCAP),
+.BR pcap_get_selectable_fd (3PCAP),
+.BR select (2),
+.BR poll (2),
+.BR epoll_wait (2),
+.BR kqueue (2)
returns, on UNIX, a file descriptor number for a file descriptor on
which one can
do a
-.BR select(2) ,
-.BR poll(2) ,
-.BR epoll_wait(2) ,
-.BR kevent() ,
+.BR select (2),
+.BR poll (2),
+.BR epoll_wait (2),
+.BR kevent (2),
or other such call
to wait for it to be possible to read packets without blocking, if such
a descriptor exists, or
if no such descriptor exists.
.PP
Some network devices opened with
-.B pcap_create(3PCAP)
+.BR pcap_create (3PCAP)
and
.BR pcap_activate(3PCAP) ,
or with
is returned for
those devices. In that case, those calls must be given a timeout less
than or equal to the timeout returned by
-.B pcap_get_required_select_timeout(3PCAP)
+.BR pcap_get_required_select_timeout (3PCAP)
for the device for which
.B pcap_get_selectable_fd()
returned
Note that a device on which a read can be done without blocking may,
on some platforms, not have any packets to read if the packet buffer
timeout has expired. A call to
-.B pcap_dispatch(3PCAP)
+.BR pcap_dispatch (3PCAP)
or
-.B pcap_next_ex(3PCAP)
+.BR pcap_next_ex (3PCAP)
will return 0 in this case, but will not block.
.PP
Note that in:
.B PCAP_ERROR
is returned.
.SH SEE ALSO
-pcap(3PCAP), kqueue(2)
+.BR pcap (3PCAP),
+.BR kqueue (2)
releases, time stamps from a capture device or savefile are always given
in seconds and microseconds.
.SH SEE ALSO
-pcap(3PCAP),
-pcap_set_tstamp_precision(3PCAP),
-pcap-tstamp(@MAN_MISC_INFO@)
+.BR pcap (3PCAP),
+.BR pcap_set_tstamp_precision (3PCAP),
+.BR pcap-tstamp (@MAN_MISC_INFO@)
prefixed by
.IR prefix .
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
Note that, even if you successfully open the network interface, you
might not have permission to send packets on it, or it might not support
sending packets; as
-.B pcap_open_live(3PCAP)
+.BR pcap_open_live (3PCAP)
doesn't have a flag to indicate whether to open for capturing, sending,
or capturing and sending, you cannot request an open that supports
sending and be notified at open time whether sending will be possible.
If
.B PCAP_ERROR
is returned,
-.B pcap_geterr(3PCAP)
+.BR pcap_geterr (3PCAP)
or
-.B pcap_perror(3PCAP)
+.BR pcap_perror (3PCAP)
may be called with
.I p
as an argument to fetch or display the error text.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
(0).
.PP
It must not be called on a pcap descriptor created by
-.B \%pcap_create(3PCAP)
+.BR \%pcap_create (3PCAP)
that has not yet been activated by
-.BR \%pcap_activate(3PCAP) .
+.BR \%pcap_activate (3PCAP).
.SH RETURN VALUE
.B pcap_is_swapped()
returns true (1) or false (0) on success and
.B PCAP_ERROR_NOT_ACTIVATED
if called on a capture handle that has been created but not activated.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
the libpcap library being used; note that it contains more information
than just a version number.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
.IR dlt_list .
.LP
It must not be called on a pcap descriptor created by
-.B \%pcap_create(3PCAP)
+.BR \%pcap_create (3PCAP)
that has not yet been activated by
-.BR \%pcap_activate(3PCAP) .
+.BR \%pcap_activate (3PCAP).
.SH RETURN VALUE
.B pcap_list_datalinks()
returns the number of link-layer header types in the array on success,
If
.B PCAP_ERROR
is returned,
-.B pcap_geterr(3PCAP)
+.BR pcap_geterr (3PCAP)
or
-.B \%pcap_perror(3PCAP)
+.BR \%pcap_perror (3PCAP)
may be called with
.I p
as an argument to fetch or display the error text.
.SH SEE ALSO
-pcap(3PCAP),
-pcap_datalink_val_to_name(3PCAP),
-pcap-linktype(@MAN_MISC_INFO@)
+.BR pcap (3PCAP),
+.BR pcap_datalink_val_to_name (3PCAP),
+.BR pcap-linktype (@MAN_MISC_INFO@)
If
.B PCAP_ERROR
is returned,
-.B pcap_geterr(3PCAP)
+.BR pcap_geterr (3PCAP)
or
-.B pcap_perror(3PCAP)
+.BR pcap_perror (3PCAP)
may be called with
.I p
as an argument to fetch or display the error text.
releases, the time stamp type cannot be set; only the default time stamp
type offered by a capture source is available.
.SH SEE ALSO
-pcap(3PCAP), pcap_tstamp_type_val_to_name(3PCAP),
-pcap-tstamp(@MAN_MISC_INFO@)
+.BR pcap (3PCAP),
+.BR pcap_tstamp_type_val_to_name (3PCAP),
+.BR pcap-tstamp (@MAN_MISC_INFO@)
.B pcap_lookupdev()
returns a pointer to a string giving the name of a network device
suitable for use with
-.B pcap_create(3PCAP)
+.BR pcap_create (3PCAP)
and
-.BR \%pcap_activate(3PCAP) ,
+.BR \%pcap_activate (3PCAP),
or with
-.BR pcap_open_live(3PCAP) ,
+.BR pcap_open_live (3PCAP),
and with
-.BR pcap_lookupnet(3PCAP) .
+.BR pcap_lookupnet (3PCAP).
If there is an error,
.B NULL
is returned and
.B PCAP_ERRBUF_SIZE
chars.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
.SH BUGS
The pointer returned by
.B pcap_lookupdev()
.B PCAP_ERRBUF_SIZE
chars.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
.I cnt
packets are processed, the end of the ``savefile'' is
reached when reading from a ``savefile'',
-.B pcap_breakloop(3PCAP)
+.BR pcap_breakloop (3PCAP)
is called, or an error occurs.
It does
.B not
.PP
The bytes of data from the packet begin with a link-layer header. The
format of the link-layer header is indicated by the return value of the
-.B pcap_datalink(3PCAP)
+.BR pcap_datalink (3PCAP)
routine when handed the
.B pcap_t
value also passed to
can return and describes the packet formats that
correspond to those values. The value it returns will be valid for all
packets received unless and until
-.B pcap_set_datalink(3PCAP)
+.BR pcap_set_datalink (3PCAP)
is called; after a successful call to
.BR pcap_set_datalink() ,
all subsequent packets will have a link-layer header of the type
If
.B PCAP_ERROR
is returned,
-.B pcap_geterr(3PCAP)
+.BR pcap_geterr (3PCAP)
or
-.B pcap_perror(3PCAP)
+.BR pcap_perror (3PCAP)
may be called with
.I p
as an argument to fetch or display the error text.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
.B pcap_minor_version()
are not meaningful.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
guaranteed to be valid after the next call to
.BR pcap_next_ex() ,
.BR pcap_next() ,
-.BR pcap_loop(3PCAP) ,
+.BR pcap_loop (3PCAP),
or
-.BR pcap_dispatch(3PCAP) ;
+.BR pcap_dispatch (3PCAP);
if the code needs them to remain valid, it must make a copy of them.
.PP
.B pcap_next()
.PP
The bytes of data from the packet begin with a link-layer header. The
format of the link-layer header is indicated by the return value of the
-.B pcap_datalink(PCAP)
+.BR pcap_datalink (3PCAP)
routine when handed the
.B pcap_t
value also passed to
can return and describes the packet formats that
correspond to those values. The value it returns will be valid for all
packets received unless and until
-.B pcap_set_datalink(3PCAP)
+.BR pcap_set_datalink (3PCAP)
is called; after a successful call to
.BR pcap_set_datalink() ,
all subsequent packets will have a link-layer header of the type
from the savefile. If
.B PCAP_ERROR
is returned,
-.B pcap_geterr(3PCAP)
+.BR pcap_geterr (3PCAP)
or
-.B pcap_perror(3PCAP)
+.BR pcap_perror (3PCAP)
may be called with
.I p
as an argument to fetch or display the error text.
more packets are available in a ``savefile.'' Unfortunately, there is no
way to determine whether an error occurred or not.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
is a pointer to a
.I bpf_program
struct, usually the result of a call to
-.BR pcap_compile(3PCAP) .
+.BR pcap_compile (3PCAP).
.I h
points to the
.I pcap_pkthdr
the packet doesn't match the filter and non-zero if the packet matches
the filter.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
structure to use when calling the other functions in libpcap. It is
typically used when just using libpcap for compiling BPF code; it can
also be used if using
-.BR pcap_dump_open(3PCAP) ,
-.BR pcap_dump(3PCAP) ,
+.BR pcap_dump_open (3PCAP),
+.BR pcap_dump (3PCAP),
and
-.B pcap_dump_close(3PCAP)
+.BR pcap_dump_close (3PCAP)
to write a savefile if there is no
.B pcap_t
that supplies the packets to be written.
.B PCAP_TSTAMP_PRECISION_NANO
should be specified if the packets to be written have time stamps in
seconds and nanoseconds. Its value does not affect
-.BR pcap_compile(3PCAP) .
+.BR pcap_compile (3PCAP).
.SH SEE ALSO
-pcap(3PCAP), \%pcap-linktype(@MAN_MISC_INFO@)
+.BR pcap (3PCAP),
+.BR \%pcap-linktype (@MAN_MISC_INFO@)
.B PCAP_ERRBUF_SIZE
chars.
.SH SEE ALSO
-pcap_create(3PCAP), pcap_activate(3PCAP)
+.BR pcap_create (3PCAP),
+.BR pcap_activate (3PCAP)
became available in libpcap release 1.5.1. In previous releases, time
stamps from a savefile are always given in seconds and microseconds.
.SH SEE ALSO
-pcap(3PCAP), pcap-savefile(@MAN_FILE_FORMATS@)
+.BR pcap (3PCAP),
+.BR pcap-savefile (@MAN_FILE_FORMATS@)
.B PCAP_ERROR_ACTIVATED
if called on a capture handle that has been activated.
.SH SEE ALSO
-pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP)
+.BR pcap (3PCAP),
+.BR pcap_create (3PCAP),
+.BR pcap_activate (3PCAP)
on failure. If
.B PCAP_ERROR
is returned,
-.B pcap_geterr(3PCAP)
+.BR pcap_geterr (3PCAP)
or
-.B pcap_perror(3PCAP)
+.BR pcap_perror (3PCAP)
may be called with
.I p
as an argument to fetch or display the error text.
.SH SEE ALSO
-pcap(3PCAP), pcap_datalink_name_to_val(3PCAP)
+.BR pcap (3PCAP),
+.BR pcap_datalink_name_to_val (3PCAP)
.B BIOCIMMEDIATE
.BR ioctl (2),
as documented in
-.BR bpf(@MAN_DEVICES@) ,
+.BR bpf (@MAN_DEVICES@),
on the descriptor returned by
-.B pcap_fileno(3PCAP),
+.BR pcap_fileno (3PCAP),
after
-.BR pcap_activate(3PCAP)
+.BR pcap_activate (3PCAP)
is called;
.IP
on Solaris 10 and earlier versions of Solaris, immediate mode must be
.B BIOCMBIC
.BR ioctl ,
as documented in
-.BR packetfilter(7) ,
+.BR packetfilter (7),
to clear the
.B ENBATCH
flag on the descriptor returned by
-.B pcap_fileno(3PCAP),
+.BR pcap_fileno (3PCAP),
after
-.BR pcap_activate(3PCAP)
+.BR pcap_activate (3PCAP)
is called;
.IP
on Windows, immediate mode must be turned on by calling
.PP
On other platforms, capture devices are always in immediate mode.
.SH SEE ALSO
-pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP)
+.BR pcap (3PCAP),
+.BR pcap_create (3PCAP),
+.BR pcap_activate (3PCAP)
.B PCAP_ERROR_ACTIVATED
if called on a capture handle that has been activated.
.SH SEE ALSO
-pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP)
+.BR pcap (3PCAP),
+.BR pcap_create (3PCAP),
+.BR pcap_activate (3PCAP)
.LP
It should not be used in portable code; instead, a filter should be
specified with
-.BR pcap_setfilter(3PCAP) .
+.BR pcap_setfilter (3PCAP).
.LP
If a given network interface provides a standard link-layer header, with
a standard packet type, but provides some packet types with a different
.SH BACKWARD COMPATIBILITY
This function became available in libpcap release 1.9.0.
.SH SEE ALSO
-pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP)
+.BR pcap (3PCAP),
+.BR pcap_create (3PCAP),
+.BR pcap_activate (3PCAP)
.B PCAP_ERROR_ACTIVATED
if called on a capture handle that has been activated.
.SH SEE ALSO
-pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP),
-pcap_can_set_rfmon(3PCAP)
+.BR pcap (3PCAP),
+.BR pcap_create (3PCAP),
+.BR pcap_activate (3PCAP),
+.BR pcap_can_set_rfmon (3PCAP)
.B PCAP_ERROR_ACTIVATED
if called on a capture handle that has been activated.
.SH SEE ALSO
-pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP)
+.BR pcap (3PCAP),
+.BR pcap_create (3PCAP),
+.BR pcap_activate (3PCAP)
.B PCAP_ERROR_ACTIVATED
if called on a capture handle that has been activated.
.SH SEE ALSO
-pcap_create(3PCAP), pcap_activate(3PCAP),
-\%pcap_set_immediate_mode(3PCAP)
+.BR pcap_create (3PCAP),
+.BR pcap_activate (3PCAP),
+.BR \%pcap_set_immediate_mode (3PCAP)
descriptor to the type specified by
.IR tstamp_precision .
It must be called on a pcap descriptor created by
-.B pcap_create(3PCAP)
+.BR pcap_create (3PCAP)
that has not yet been activated by
-.BR pcap_activate(3PCAP) .
+.BR pcap_activate (3PCAP).
Two time stamp precisions are supported, microseconds and nanoseconds. One can
use options
.B PCAP_TSTAMP_PRECISION_MICRO and
releases, time stamps from a capture device or savefile are always given
in seconds and microseconds.
.SH SEE ALSO
-pcap(3PCAP),
-pcap_get_tstamp_precision(3PCAP),
-pcap-tstamp(@MAN_MISC_INFO@)
+.BR pcap (3PCAP),
+.BR pcap_get_tstamp_precision (3PCAP),
+.BR pcap-tstamp (@MAN_MISC_INFO@)
descriptor to the type specified by
.IR tstamp_type .
It must be called on a pcap descriptor created by
-.B pcap_create(3PCAP)
+.BR pcap_create (3PCAP)
that has not yet been activated by
-.BR pcap_activate(3PCAP) .
-.B pcap_list_tstamp_types(3PCAP)
+.BR pcap_activate (3PCAP).
+.BR pcap_list_tstamp_types (3PCAP)
will give a list of the time stamp types supported by a given capture
device.
See
releases, the time stamp type cannot be set; only the default time stamp
type offered by a capture source is available.
.SH SEE ALSO
-pcap(3PCAP),
-pcap_tstamp_type_name_to_val(3PCAP)
+.BR pcap (3PCAP),
+.BR pcap_tstamp_type_name_to_val (3PCAP)
on failure. If
.B PCAP_ERROR
is returned,
-.B pcap_geterr(3PCAP)
+.BR pcap_geterr (3PCAP)
or
-.B pcap_perror(3PCAP)
+.BR pcap_perror (3PCAP)
may be called with
.I p
as an argument to fetch or display the error text.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
is a pointer to a
.I bpf_program
struct, usually the result of a call to
-.BR \%pcap_compile(3PCAP) .
+.BR \%pcap_compile (3PCAP).
.SH RETURN VALUE
.B pcap_setfilter()
returns 0 on success and
on failure. If
.B PCAP_ERROR
is returned,
-.B pcap_geterr(3PCAP)
+.BR pcap_geterr (3PCAP)
or
-.B pcap_perror(3PCAP)
+.BR pcap_perror (3PCAP)
may be called with
.I p
as an argument to fetch or display the error text.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
In
``non-blocking'' mode, an attempt to read from the capture descriptor
with
-.B pcap_dispatch(3PCAP)
+.BR pcap_dispatch (3PCAP)
will, if no packets are currently available to be read, return 0
immediately rather than blocking waiting for packets to arrive.
-.B pcap_loop(3PCAP)
+.BR pcap_loop (3PCAP)
and
-.B pcap_next(3PCAP)
+.BR pcap_next (3PCAP)
will not work in ``non-blocking'' mode.
.PP
When first activated with
-.B pcap_activate(3PCAP)
+.BR pcap_activate (3PCAP)
or opened with
-.B pcap_open_live(3PCAP) ,
+.BR pcap_open_live (3PCAP) ,
a capture handle is not in ``non-blocking mode''; a call to
.B pcap_setnonblock()
is required in order to put it into ``non-blocking'' mode.
.B PCAP_ERRBUF_SIZE
chars.
.SH SEE ALSO
-pcap(3PCAP), pcap_next_ex(3PCAP), pcap_geterr(3PCAP)
+.BR pcap (3PCAP),
+.BR pcap_next_ex (3PCAP),
+.BR pcap_geterr (3PCAP)
.SH DESCRIPTION
.B pcap_snapshot()
returns the snapshot length specified when
-.B pcap_set_snaplen(3PCAP)
+.BR pcap_set_snaplen (3PCAP)
or
-.B pcap_open_live(3PCAP)
+.BR pcap_open_live (3PCAP)
was called, for a live capture, or the snapshot length from the capture
file, for a ``savefile''.
.PP
It must not be called on a pcap descriptor created by
-.B \%pcap_create(3PCAP)
+.BR \%pcap_create (3PCAP)
that has not yet been activated by
-.BR \%pcap_activate(3PCAP) .
+.BR \%pcap_activate (3PCAP).
.SH RETURN VALUE
.B pcap_snapshot()
returns the snapshot length on success and
.B PCAP_ERROR_NOT_ACTIVATED
if called on a capture handle that has been created but not activated.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
doesn't support packet statistics. If
.B PCAP_ERROR
is returned,
-.B pcap_geterr(3PCAP)
+.BR pcap_geterr (3PCAP)
or
-.B pcap_perror(3PCAP)
+.BR pcap_perror (3PCAP)
may be called with
.I p
as an argument to fetch or display the error text.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
.B PCAP_WARNING_
value returned by a libpcap routine to an error string.
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
isn't available. It returns an error message string corresponding to
.IR error .
.SH SEE ALSO
-pcap(3PCAP)
+.BR pcap (3PCAP)
.PP
This function became available in libpcap release 1.2.1.
.SH SEE ALSO
-pcap(3PCAP), pcap_tstamp_type_val_to_name(3PCAP)
+.BR pcap (3PCAP),
+.BR pcap_tstamp_type_val_to_name (3PCAP)
.PP
These functions became available in libpcap release 1.2.1.
.SH SEE ALSO
-pcap(3PCAP), pcap_tstamp_type_name_to_val(3PCAP)
+.BR pcap (3PCAP),
+.BR pcap_tstamp_type_name_to_val (3PCAP)