.SH DESCRIPTION
.B pcap_findalldevs()
constructs a list of network devices that can be opened with
-.B pcap_create()
+.B pcap_create(3PCAP)
and
-.B pcap_activate()
+.B pcap_activate(3PCAP)
or with
-.BR pcap_open_live() .
+.BR pcap_open_live(3PCAP) .
(Note that there may be network devices that cannot be opened by the
process calling
.BR pcap_findalldevs() ,
.BR "struct sockaddr_in6".
.PP
The list of devices must be freed with
-.BR pcap_freealldevs() ,
+.BR pcap_freealldevs(3PCAP) ,
which frees the list pointed to by
.IR alldevs .
.SH RETURN VALUE
.B PCAP_ERRBUF_SIZE
chars.
.SH SEE ALSO
-pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP),
-pcap_open_live(3PCAP)
+pcap(3PCAP)
is used to free up allocated memory pointed to by a
.I bpf_program
struct generated by
-.B pcap_compile()
+.B pcap_compile(3PCAP)
when that BPF program is no longer needed, for example after it
has been made the filter program for a pcap structure by a call to
-.BR pcap_setfilter() .
+.BR pcap_setfilter(3PCAP) .
.SH SEE ALSO
-pcap(3PCAP), pcap_compile(3PCAP), pcap_setfilter(3PCAP)
+pcap(3PCAP)
returns, on UNIX, a pointer to a
.B struct timeval
containing a value that must be used as the minimum timeout in
-.BR select() ,
-.BR poll() ,
-.BR epoll_wait() ,
+.BR select(2) ,
+.BR poll(2) ,
+.BR epoll_wait(2) ,
and
.B kevent()
calls if
-.B pcap_get_selectable_fd()
+.B pcap_get_selectable_fd(3PCAP)
returns \-1.
.PP
The timeout that should be used in those calls must be no larger than
the smallest of all timeouts returned by
-.B pcap_get_required_select_timeout()
+.B \%pcap_get_required_select_timeout()
for devices from which packets will be captured.
.PP
The device for which
.B pcap_get_selectable_fd()
returned \-1 must be put in non-blocking mode with
-.BR pcap_setnonblock() ,
+.BR pcap_setnonblock(3PCAP) ,
and an attempt must always be made to read packets from the device
when the
.BR select() ,
Note that a device on which a read can be done without blocking may,
on some platforms, not have any packets to read if the packet buffer
timeout has expired. A call to
-.B pcap_dispatch()
+.B pcap_dispatch(3PCAP)
or
-.B pcap_next_ex()
+.B pcap_next_ex(3PCAP)
will return 0 in this case, but will not block.
.PP
.B pcap_get_required_select_timeout()
.B NULL
is returned.
.SH SEE ALSO
-pcap(3PCAP), pcap_get_selectable_fd(3PCAP), select(2), poll(2),
-epoll_wait(2), kqueue(2)
+pcap(3PCAP), kqueue(2)
returns, on UNIX, a file descriptor number for a file descriptor on
which one can
do a
-.BR select() ,
-.BR poll() ,
-.BR epoll_wait() ,
+.BR select(2) ,
+.BR poll(2) ,
+.BR epoll_wait(2) ,
.BR kevent() ,
or other such call
to wait for it to be possible to read packets without blocking, if such
a descriptor exists, or \-1, if no such descriptor exists.
.PP
Some network devices opened with
-.B pcap_create()
+.B pcap_create(3PCAP)
and
-.BR pcap_activate() ,
+.BR pcap_activate(3PCAP) ,
or with
-.BR pcap_open_live() ,
+.BR pcap_open_live(3PCAP) ,
do not support those calls (for example, regular network devices on
FreeBSD 4.3 and 4.4, and Endace DAG devices), so \-1 is returned for
those devices. In that case, those calls must be given a timeout less
than or equal to the timeout returned by
-.B pcap_get_required_select_timeout()
+.B pcap_get_required_select_timeout(3PCAP)
for the device for which
.B pcap_get_selectable_fd()
returned \-1, the device must be put in non-blocking mode with a call to
-.BR pcap_setnonblock() ,
+.BR pcap_setnonblock(3PCAP) ,
and an attempt must always be made to read packets from the device
when the call returns. If
.B pcap_get_required_select_timeout()
Note that a device on which a read can be done without blocking may,
on some platforms, not have any packets to read if the packet buffer
timeout has expired. A call to
-.B pcap_dispatch()
+.B pcap_dispatch(3PCAP)
or
-.B pcap_next_ex()
+.B pcap_next_ex(3PCAP)
will return 0 in this case, but will not block.
.PP
Note that in:
A selectable file descriptor is returned if one exists; otherwise, \-1
is returned.
.SH SEE ALSO
-pcap(3PCAP), pcap_get_required_select_timeout(3PCAP),
-pcap_setnonblock(3PCAP), select(2), poll(2), epoll_wait(2), kqueue(2)
+pcap(3PCAP), kqueue(2)
Note that, even if you successfully open the network interface, you
might not have permission to send packets on it, or it might not support
sending packets; as
-.I pcap_open_live()
+.B pcap_open_live(3PCAP)
doesn't have a flag to indicate whether to open for capturing, sending,
or capturing and sending, you cannot request an open that supports
sending and be notified at open time whether sending will be possible.
returns 0 on success and \-1 on failure.
.PP
If \-1 is returned,
-.B pcap_geterr()
+.B pcap_geterr(3PCAP)
or
-.B pcap_perror()
+.B pcap_perror(3PCAP)
may be called with
.I p
as an argument to fetch or display the error text.
.SH SEE ALSO
-pcap(3PCAP), pcap_geterr(3PCAP)
+pcap(3PCAP)
(0).
.PP
It must not be called on a pcap descriptor created by
-.B pcap_create()
+.B \%pcap_create(3PCAP)
that has not yet been activated by
-.BR pcap_activate() .
+.BR \%pcap_activate(3PCAP) .
.SH RETURN VALUE
.B pcap_is_swapped()
returns true (1) or false (0) on success and
.IR dlt_list .
.LP
It must not be called on a pcap descriptor created by
-.B pcap_create()
+.B \%pcap_create(3PCAP)
that has not yet been activated by
-.BR pcap_activate() .
+.BR \%pcap_activate(3PCAP) .
.SH RETURN VALUE
.B pcap_list_datalinks()
returns the number of link-layer header types in the array on success,
If
.B PCAP_ERROR
is returned,
-.B pcap_geterr()
+.B pcap_geterr(3PCAP)
or
-.B pcap_perror()
+.B \%pcap_perror(3PCAP)
may be called with
.I p
as an argument to fetch or display the error text.
.SH SEE ALSO
-pcap(3PCAP), pcap_geterr(3PCAP),
+pcap(3PCAP),
pcap_datalink_val_to_name(3PCAP),
pcap-linktype(@MAN_MISC_INFO@)
If
.B PCAP_ERROR
is returned,
-.B pcap_geterr()
+.B pcap_geterr(3PCAP)
or
-.B pcap_perror()
+.B pcap_perror(3PCAP)
may be called with
.I p
as an argument to fetch or display the error text.
.SH SEE ALSO
-pcap(3PCAP), pcap_geterr(3PCAP), pcap_tstamp_type_val_to_name(3PCAP),
+pcap(3PCAP), pcap_tstamp_type_val_to_name(3PCAP),
pcap-tstamp(@MAN_MISC_INFO@)
.B pcap_lookupdev()
returns a pointer to a string giving the name of a network device
suitable for use with
-.B pcap_create()
+.B pcap_create(3PCAP)
and
-.BR pcap_activate() ,
+.BR \%pcap_activate(3PCAP) ,
or with
-.BR pcap_open_live() ,
+.BR pcap_open_live(3PCAP) ,
and with
-.BR pcap_lookupnet() .
+.BR pcap_lookupnet(3PCAP) .
If there is an error,
.B NULL
is returned and
.B PCAP_ERRBUF_SIZE
chars.
.SH SEE ALSO
-pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP),
-pcap_open_live(3PCAP), pcap_lookupnet(3PCAP)
+pcap(3PCAP)
.SH BUGS
The pointer returned by
.B pcap_lookupdev()
.I cnt
packets are processed, the end of the ``savefile'' is
reached when reading from a ``savefile'',
-.B pcap_breakloop()
+.B pcap_breakloop(3PCAP)
is called, or an error occurs.
It does
.B not
.PP
The bytes of data from the packet begin with a link-layer header. The
format of the link-layer header is indicated by the return value of the
-.B pcap_datalink()
+.B pcap_datalink(3PCAP)
routine when handed the
.B pcap_t
value also passed to
can return and describes the packet formats that
correspond to those values. The value it returns will be valid for all
packets received unless and until
-.B pcap_set_datalink()
+.B pcap_set_datalink(3PCAP)
is called; after a successful call to
.BR pcap_set_datalink() ,
all subsequent packets will have a link-layer header of the type
.ft R
.PP
If \-1 is returned,
-.B pcap_geterr()
+.B pcap_geterr(3PCAP)
or
-.B pcap_perror()
+.B pcap_perror(3PCAP)
may be called with
.I p
as an argument to fetch or display the error text.
.SH SEE ALSO
-pcap(3PCAP), pcap_geterr(3PCAP), pcap_breakloop(3PCAP),
-pcap_datalink(3PCAP)
+pcap(3PCAP)
guaranteed to be valid after the next call to
.BR pcap_next_ex() ,
.BR pcap_next() ,
-.BR pcap_loop() ,
+.BR pcap_loop(3PCAP) ,
or
-.BR pcap_dispatch() ;
+.BR pcap_dispatch(3PCAP) ;
if the code needs them to remain valid, it must make a copy of them.
.PP
.B pcap_next()
.PP
The bytes of data from the packet begin with a link-layer header. The
format of the link-layer header is indicated by the return value of the
-.B pcap_datalink()
+.B pcap_datalink(PCAP)
routine when handed the
.B pcap_t
value also passed to
can return and describes the packet formats that
correspond to those values. The value it returns will be valid for all
packets received unless and until
-.B pcap_set_datalink()
+.B pcap_set_datalink(3PCAP)
is called; after a successful call to
.BR pcap_set_datalink() ,
all subsequent packets will have a link-layer header of the type
\-1 if an error occurred while reading the packet, and \-2 if packets
are being read from a ``savefile'' and there are no more packets to read
from the savefile. If \-1 is returned,
-.B pcap_geterr()
+.B pcap_geterr(3PCAP)
or
-.B pcap_perror()
+.B pcap_perror(3PCAP)
may be called with
.I p
as an argument to fetch or display the error text.
more packets are available in a ``savefile.'' Unfortunately, there is no
way to determine whether an error occurred or not.
.SH SEE ALSO
-pcap(3PCAP), pcap_geterr(3PCAP), pcap_dispatch(3PCAP),
-pcap_datalink(3PCAP)
+pcap(3PCAP)
is a pointer to a
.I bpf_program
struct, usually the result of a call to
-.BR pcap_compile() .
+.BR pcap_compile(3PCAP) .
.I h
points to the
.I pcap_pkthdr
the packet doesn't match the filter and non-zero if the packet matches
the filter.
.SH SEE ALSO
-pcap(3PCAP), pcap_compile(3PCAP)
+pcap(3PCAP)
structure to use when calling the other functions in libpcap. It is
typically used when just using libpcap for compiling BPF code; it can
also be used if using
-.BR pcap_dump_open() ,
-.BR pcap_dump() ,
+.BR pcap_dump_open(3PCAP) ,
+.BR pcap_dump(3PCAP) ,
and
-.B pcap_dump_close()
+.B pcap_dump_close(3PCAP)
to write a savefile if there is no
.B pcap_t
that supplies the packets to be written.
.B PCAP_TSTAMP_PRECISION_NANO
should be specified if the packets to be written have time stamps in
seconds and nanoseconds. Its value does not affect
-.BR pcap_compile() .
+.BR pcap_compile(3PCAP) .
.SH SEE ALSO
-pcap(3PCAP), pcap_compile(3PCAP), pcap_dump_open(3PCAP),
-\%pcap-linktype(@MAN_MISC_INFO@)
+pcap(3PCAP), \%pcap-linktype(@MAN_MISC_INFO@)
.B pcap_set_datalink()
returns 0 on success and \-1 on failure.
If \-1 is returned,
-.B pcap_geterr()
+.B pcap_geterr(3PCAP)
or
-.B pcap_perror()
+.B pcap_perror(3PCAP)
may be called with
.I p
as an argument to fetch or display the error text.
.SH SEE ALSO
-pcap(3PCAP), pcap_geterr(3PCAP),
-pcap_datalink_name_to_val(3PCAP)
+pcap(3PCAP), pcap_datalink_name_to_val(3PCAP)