diff options
Diffstat (limited to 'contrib/libpcap/pcap_next_ex.3pcap')
| -rw-r--r-- | contrib/libpcap/pcap_next_ex.3pcap | 46 |
1 files changed, 40 insertions, 6 deletions
diff --git a/contrib/libpcap/pcap_next_ex.3pcap b/contrib/libpcap/pcap_next_ex.3pcap index 7373836..c310c2f 100644 --- a/contrib/libpcap/pcap_next_ex.3pcap +++ b/contrib/libpcap/pcap_next_ex.3pcap @@ -1,5 +1,3 @@ -.\" @(#) $Header: /tcpdump/master/libpcap/pcap_next_ex.3pcap,v 1.3 2008-04-06 02:53:22 guy Exp $ -.\" .\" Copyright (c) 1994, 1996, 1997 .\" The Regents of the University of California. All rights reserved. .\" @@ -19,7 +17,7 @@ .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. .\" -.TH PCAP_NEXT_EX 3PCAP "5 April 2008" +.TH PCAP_NEXT_EX 3PCAP "13 October 2013" .SH NAME pcap_next_ex, pcap_next \- read the next packet from a pcap_t .SH SYNOPSIS @@ -77,12 +75,47 @@ The structure pointed to by .I h is filled in with the appropriate values for the packet. +.PP +The bytes of data from the packet begin with a link-layer header. The +format of the link-layer header is indicated by the return value of the +.B pcap_datalink() +routine when handed the +.B pcap_t +value also passed to +.B pcap_loop() +or +.BR pcap_dispatch() . +.I http://www.tcpdump.org/linktypes.html +lists the values +.B pcap_datalink() +can return and describes the packet formats that +correspond to those values. The value it returns will be valid for all +packets received unless and until +.B pcap_set_datalink() +is called; after a successful call to +.BR pcap_set_datalink() , +all subsequent packets will have a link-layer header of the type +specified by the link-layer header type value passed to +.BR pcap_set_datalink() . +.PP +Do +.B NOT +assume that the packets for a given capture or ``savefile`` will have +any given link-layer header type, such as +.B DLT_EN10MB +for Ethernet. For example, the "any" device on Linux will have a +link-layer header type of +.B DLT_LINUX_SLL +even if all devices on the system at the time the "any" device is opened +have some other data link type, such as +.B DLT_EN10MB +for Ethernet. .SH RETURN VALUE .B pcap_next_ex() returns 1 if the packet was read without problems, 0 -if packets are being read from a live capture, and the timeout expired, +if packets are being read from a live capture and the timeout expired, \-1 if an error occurred while reading the packet, and \-2 if -packets are being read from a ``savefile'', and there are no more +packets are being read from a ``savefile'' and there are no more packets to read from the savefile. If \-1 is returned, .B pcap_geterr() @@ -104,4 +137,5 @@ non-blocking mode and no packets were available to be read), or if no more packets are available in a ``savefile.'' Unfortunately, there is no way to determine whether an error occurred or not. .SH SEE ALSO -pcap(3PCAP), pcap_geterr(3PCAP), pcap_dispatch(3PCAP) +pcap(3PCAP), pcap_geterr(3PCAP), pcap_dispatch(3PCAP), +pcap_datalink(3PCAP) |
