Home Explore Help
Sign In
leo-iot
/
vendor
2
0
Fork 0
Files Issues 5 Pull Requests 0 Wiki
Tree: 7bc6bf8272
Branches Tags
vendor
/
Windows
/
npcap-sdk-1.13
/
docs
/
wpcap
/
pcap_next_ex.html

pcap_next_ex.html 6.2 KB
History Raw

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071 
  1. <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
    2. 

  2.  "http://www.w3.org/TR/html4/loose.dtd">
    3. 

  3. <html><head>
    4. 

  4. <title>3PCAP man page</title>
    5. 

  5. <meta name="generator" content="roffit">
    6. 

  6. <STYLE type="text/css">
    7. 

  7. pre {
    8. 

  8.   overflow: auto;
    9. 

  9.   margin: 0;
    10. 

  10. }
    11. 

  11. 

  12. P.level0, pre.level0 {
    13. 

  13.  padding-left: 2em;
    14. 

  14. }
    15. 

  15. 

  16. P.level1, pre.level1 {
    17. 

  17.  padding-left: 4em;
    18. 

  18. }
    19. 

  19. 

  20. P.level2, pre.level2 {
    21. 

  21.  padding-left: 6em;
    22. 

  22. }
    23. 

  23. 

  24. span.emphasis {
    25. 

  25.  font-style: italic;
    26. 

  26. }
    27. 

  27. 

  28. span.bold {
    29. 

  29.  font-weight: bold;
    30. 

  30. }
    31. 

  31. 

  32. span.manpage {
    33. 

  33.  font-weight: bold;
    34. 

  34. }
    35. 

  35. 

  36. h2.nroffsh {
    37. 

  37.  background-color: #e0e0e0;
    38. 

  38. }
    39. 

  39. 

  40. span.nroffip {
    41. 

  41.  font-weight: bold;
    42. 

  42.  font-size: 120%;
    43. 

  43.  font-family: monospace;
    44. 

  44. }
    45. 

  45. 

  46. p.roffit {
    47. 

  47.  text-align: center;
    48. 

  48.  font-size: 80%;
    49. 

  49. }
    50. 

  50. </STYLE>
    51. 

  51. </head><body>
    52. 

  52. 

  53. <p class="level0"><a name="NAME"></a><h2 class="nroffsh">NAME</h2>
    54. 

  54. <p class="level0">pcap_next_ex, pcap_next - read the next packet from a pcap_t <a name="SYNOPSIS"></a><h2 class="nroffsh">SYNOPSIS</h2>
    55. 

  55. <p class="level0"><pre class="level0">
    56. 

  56. &#35;include &lt;pcap/pcap.h&gt;
    57. 

  57. int pcap_next_ex(pcap_t *p, struct pcap_pkthdr **pkt_header,
    58. 

  58. &nbsp;&nbsp;&nbsp;&nbsp;const u_char **pkt_data);
    59. 

  59. const u_char *pcap_next(pcap_t *p, struct pcap_pkthdr *h);
    60. 

  60. </pre>
    61. 

  61. 

  62. <p class="level0"><a name="DESCRIPTION"></a><h2 class="nroffsh">DESCRIPTION</h2>
    63. 

  63. <p class="level0"><span Class="bold">pcap_next_ex</span>() reads the next packet and returns a success/failure indication. If the packet was read without problems, the pointer pointed to by the <span Class="emphasis">pkt_header</span> argument is set to point to the <span Class="emphasis">pcap_pkthdr</span> struct for the packet, and the pointer pointed to by the <span Class="emphasis">pkt_data</span> argument is set to point to the data in the packet.  The <span Class="emphasis">struct pcap_pkthdr</span> and the packet data are not to be freed by the caller, and are not guaranteed to be valid after the next call to <span Class="bold">pcap_next_ex</span>(), <span Class="bold">pcap_next</span>(), <a Class="bold" href="./pcap_loop.html">pcap_loop</a>(3PCAP), or <span Class="bold">pcap_dispatch</span>(3PCAP); if the code needs them to remain valid, it must make a copy of them. 
    64. 

  64. <p class="level0"><span Class="bold">pcap_next</span>() reads the next packet (by calling <span Class="bold">pcap_dispatch</span>() with a <span Class="emphasis">cnt</span> of 1) and returns a <span Class="emphasis">u_char</span> pointer to the data in that packet.  The packet data is not to be freed by the caller, and is not guaranteed to be valid after the next call to <span Class="bold">pcap_next_ex</span>(), <span Class="bold">pcap_next</span>(), <span Class="bold">pcap_loop</span>(), or <span Class="bold">pcap_dispatch</span>(); if the code needs it to remain valid, it must make a copy of it. The <span Class="emphasis">pcap_pkthdr</span> structure pointed to by <span Class="emphasis">h</span> is filled in with the appropriate values for the packet. 
    65. 

  65. <p class="level0">The bytes of data from the packet begin with a link-layer header.  The format of the link-layer header is indicated by the return value of the <a Class="bold" href="./pcap_datalink.html">pcap_datalink</a>(3PCAP) routine when handed the <span Class="bold">pcap_t</span> value also passed to <span Class="bold">pcap_loop</span>() or <span Class="bold">pcap_dispatch</span>(). <span Class="emphasis"><a href="https://www.tcpdump.org/linktypes.html">https://www.tcpdump.org/linktypes.html</a></span> lists the values <span Class="bold">pcap_datalink</span>() can return and describes the packet formats that correspond to those values.  The value it returns will be valid for all packets received unless and until <a Class="bold" href="./pcap_set_datalink.html">pcap_set_datalink</a>(3PCAP) is called; after a successful call to <span Class="bold">pcap_set_datalink</span>(), all subsequent packets will have a link-layer header of the type specified by the link-layer header type value passed to <span Class="bold">pcap_set_datalink</span>(). 
    66. 

  66. <p class="level0">Do <span Class="bold">NOT</span> assume that the packets for a given capture or ``savefile`` will have any given link-layer header type, such as <span Class="bold">DLT_EN10MB</span> for Ethernet.  For example, the &quot;any&quot; device on Linux will have a link-layer header type of <span Class="bold">DLT_LINUX_SLL</span> or <span Class="bold">DLT_LINUX_SLL2</span> even if all devices on the system at the time the &quot;any&quot; device is opened have some other data link type, such as <span Class="bold">DLT_EN10MB</span> for Ethernet. <a name="RETURN"></a><h2 class="nroffsh">RETURN VALUE</h2>
    67. 

  67. <p class="level0"><span Class="bold">pcap_next_ex</span>() returns <span Class="bold">1</span> if the packet was read without problems, <span Class="bold">0</span> if packets are being read from a live capture and the packet buffer timeout expired, <span Class="bold">PCAP_ERROR_BREAK</span> if packets are being read from a ``savefile&#39;&#39; and there are no more packets to read from the savefile, <span Class="bold">PCAP_ERROR_NOT_ACTIVATED</span> if called on a capture handle that has been created but not activated, or <span Class="bold">PCAP_ERROR</span> if an error occurred while reading the packet.  If <span Class="bold">PCAP_ERROR</span> is returned, <a Class="bold" href="./pcap_geterr.html">pcap_geterr</a>(3PCAP) or <span Class="bold">pcap_perror</span>(3PCAP) may be called with <span Class="emphasis">p</span> as an argument to fetch or display the error text. 
    68. 

  68. <p class="level0"><span Class="bold">pcap_next</span>() returns a pointer to the packet data on success, and returns <span Class="bold">NULL</span> if an error occurred, or if no packets were read from a live capture (if, for example, they were discarded because they didn&#39;t pass the packet filter, or if, on platforms that support a packet buffer timeout that starts before any packets arrive, the timeout expires before any packets arrive, or if the file descriptor for the capture device is in non-blocking mode and no packets were available to be read), or if no more packets are available in a ``savefile.&#39;&#39; Unfortunately, there is no way to determine whether an error occurred or not. <a name="SEE"></a><h2 class="nroffsh">SEE ALSO</h2>
    69. 

  69. <p class="level0"><a Class="bold" href="./pcap.html">pcap</a>(3PCAP) <p class="roffit">
    70. 

  70.  This HTML page was made with <a href="http://daniel.haxx.se/projects/roffit/">roffit</a>.
    71. 

  71. </body></html>
    72.