Lines Matching +full:wait +full:- +full:on +full:- +full:read

22 pcap \- Packet Capture library
34 on the network, even those destined for other hosts, are accessible
49 caller, as being in UTF-8.
51 On UNIX-like systems, the local character encoding is assumed to be
52 UTF-8, so no character encoding transformations are done.
54 On Windows, the local character encoding is the local ANSI code page.
60 routine always fails, so it should not be used, and, on Windows,
62 does not attempt to handle UTF-16LE strings.
67 on Windows,
69 will succeed if there is a device on which to capture, and
72 UTF-16LE string - note that this attempt is unsafe, as it may run past
73 the end of the string - to handle
75 returning a UTF-16LE string. Programs that don't call
77 should, on Windows, call
83 will initialize Winsock itself on Windows.
93 other interface on which the capture should be done, call
95 set the appropriate options on the handle, and then activate it with
109 will return the first device on that list that is not a ``loopback``
112 To open a handle for a ``savefile'' from which to read packets, given the
141 The options that can be set on a capture handle include
147 contents of the packet - for example, if you are only interested in the
148 TCP headers of packets - you can set the "snapshot length" for the
158 A snapshot length of 65535 should be sufficient, on most if not all
164 On broadcast LANs such as Ethernet, if the network isn't switched, or if
165 the adapter is connected to a "mirror port" on a switch to which all
167 all packets on the LAN, including unicast or multicast packets not sent
180 For now, this doesn't work on the "any" device; if an argument of "any"
188 On IEEE 802.11 wireless LANs, even if an adapter is in promiscuous mode,
192 information pseudo-header for those frames.
196 receives, with 802.11 headers, and might supply a pseudo-header with
202 files on a network server, or resolving host names or network addresses,
223 than a single packet.  This reduces the per-packet CPU overhead if
227 The packet buffer timeout is required so that an application won't wait
229 delivered; if packets are arriving slowly, that wait could take an
232 Not all platforms support a packet buffer timeout; on platforms that
234 timeout, on platforms that support a packet buffer timeout, will cause a
235 read to wait forever to allow enough packets to arrive, with no timeout.
240 the packet buffer timeout cannot be used to cause calls that read
241 packets to return within a limited period of time, because, on some
242 platforms, the packet buffer timeout isn't supported, and, on other
259 do not have to be read by the application as soon as they arrive.  On
263 be dropped if the buffer fills up before the application can read
265 non-pageable operating system memory than is necessary to prevent
271 On some platforms, the time stamp given to packets on live captures can
274 supplied by routines on the native operating system.  See
275 .BR \%pcap-tstamp (@MAN_MISC_INFO@)
285 You must have read access to
291 You must have read/write access to the network pseudo device, e.g.
293 On at least some versions of Solaris, however, this is not sufficient to
296 to capture in promiscuous mode; on those versions of Solaris, you must
299 mode.  Note that, on many (perhaps all) interfaces, if you don't capture
306 network pseudo-device - there is no need to change the privileges on
314 .B Under HP-UX with DLPI:
327 those bits to be set on a user's initial processes when they log in, in
332 However, no user (not even the super-user) can capture in promiscuous
333 mode on an interface unless the super-user has enabled promiscuous-mode
334 operation on that interface using
336 and no user (not even the super-user) can capture unicast traffic
337 received by or sent by the machine on an interface unless the super-user
338 has enabled copy-all-mode operation on that interface using
342 packet capture on an interface probably requires that either
343 promiscuous-mode or copy-all-mode operation, or both modes of
344 operation, be enabled on that interface.
347 You must have read access to
349 on systems that don't have a cloning BPF device, or to
351 on systems that do.
352 On BSDs with a devfs (this includes macOS), this might involve more
353 than just having somebody with super-user access setting the ownership
354 or permissions on the BPF devices - it might involve configuring devfs
361 The packets read from the handle may include a ``pseudo-header''
362 containing various forms of packet meta-data, and probably includes a
363 link-layer header whose contents can differ for different network
374 any given link-layer header type, such as
376 for Ethernet.  For example, the "any" device on Linux will have a
377 link-layer header type of
381 even if all devices on the system at the time the "any" device is opened
413 get first non-loopback device on that list
448 set the snapshot length for a not-yet-activated
457 set promiscuous mode for a not-yet-activated
462 set capture protocol for a not-yet-activated
467 set monitor mode for a not-yet-activated
477 set packet buffer timeout for a not-yet-activated
482 set immediate mode for a not-yet-activated
487 set buffer size for a not-yet-activated
492 set time stamp type for a not-yet-activated
497 get list of available time stamp types for a not-yet-activated
514 set time stamp precision for a not-yet-activated
524 get link-layer header type for a
535 determine whether a ``savefile'' being read came from a machine with the
546 .SS Selecting a link-layer header type for a live capture
547 Some devices may provide more than one link-layer header type.  To
548 obtain a list of all link-layer header types provided by a device, call
550 on an activated
553 To free a list of link-layer header types, call
555 To set the link-layer header type for a device, call
558 packets are read and before any filters are compiled or installed.
564 get a list of link-layer header types for a device
567 free list of link-layer header types
570 set link-layer header type for a device
573 get name for a link-layer header type
579 get description for a link-layer header type
583 get link-layer header type corresponding to a name
586 Packets are read with
637 that is sufficiently large to get all of the packet's data - a value of
638 65535 should be sufficient on most if not all networks).  When reading
650 bytes of the packet on success, and
652 on error.
679 will, if no packets are currently available to be read, block waiting
680 for packets to become available.  On some, but
682 all, platforms, if a packet buffer timeout was specified, the wait will
684 be prepared for this, as it happens on some platforms, but should not
685 rely on it, as it does not happen on other platforms.  Note that the
686 wait might, or might not, terminate even if no packets are available;
687 applications should be prepared for this to happen, but must not rely on
690 A handle can be put into ``non-blocking mode'', so that those routines
692 available to read.  Call
694 to put a handle into non-blocking mode or to take it out of non-blocking
697 to determine whether a handle is in non-blocking mode.  Note that
698 non-blocking mode does not work correctly in Mac OS X 10.6.
700 Non-blocking mode is often combined with routines such as
704 or other routines a platform offers to wait for any of a set of
705 descriptors to be ready to read.  To obtain, for a handle, a descriptor
709 available to read on the descriptor, an attempt should be made to read
715 .B \-1
723 routine returns, an attempt should be made to read packets from the
735 gives details.  Note that, just as an attempt to read packets from a
741 that a descriptor is ready to read even if there are no packets
742 available to read.
748 read a bufferful of packets from a
755 read packets from a
760 read the next packet from a
765 read the next packet from a
767 with an error indication on an error
776 set or clear non-blocking mode on a
780 get the state of non-blocking mode for a
801 packets, a filter can be set on a handle.  For a live capture, the
807 .BR \%pcap-filter (@MAN_MISC_INFO@).
808 A filter string is compiled into a program in a pseudo-machine-language
824 read using
831 compile filter expression to a pseudo-machine-language code program
932 will cause all buffered-but-not-yet-written packets to be written to the
1008 directory on most platforms; if you are writing an application that must
1009 work on versions of libpcap prior to 1.0, include
1020 writing an application that must work on versions of libpcap prior to
1036 .BR \%pcap-filter (@MAN_MISC_INFO@),
1053 To report a security issue please send an e-mail to \%security@tcpdump.org.