1PCAP_NEXT_EX(3PCAP)                                        PCAP_NEXT_EX(3PCAP)
2
3
4

NAME

6       pcap_next_ex, pcap_next - read the next packet from a pcap_t
7

SYNOPSIS

9       #include <pcap/pcap.h>
10
11       int pcap_next_ex(pcap_t *p, struct pcap_pkthdr **pkt_header,
12               const u_char **pkt_data);
13       const u_char *pcap_next(pcap_t *p, struct pcap_pkthdr *h);
14

DESCRIPTION

16       pcap_next_ex()  reads  the  next  packet  and returns a success/failure
17       indication.  If the packet  was  read  without  problems,  the  pointer
18       pointed  to  by  the  pkt_header  argument  is  set  to  point  to  the
19       pcap_pkthdr struct for the packet, and the pointer pointed  to  by  the
20       pkt_data argument is set to point to the data in the packet.
21
22       pcap_next()  reads  the  next packet (by calling pcap_dispatch() with a
23       cnt of 1) and returns a u_char pointer to the data in that packet.  The
24       pcap_pkthdr structure pointed to by h is filled in with the appropriate
25       values for the packet.
26

RETURN VALUE

28       pcap_next_ex() returns 1 if the packet was read without problems, 0  if
29       packets are being read from a live capture, and the timeout expired, -1
30       if an error occurred while reading the packet, and -2  if  packets  are
31       being  read  from a ``savefile'', and there are no more packets to read
32       from the savefile.  If -1 is returned, pcap_geterr()  or  pcap_perror()
33       may be called with p as an argument to fetch or display the error text.
34
35       pcap_next()  returns  a  pointer  to  the  packet  data on success, and
36       returns NULL if an error occured, or if no packets  were  read  from  a
37       live  capture (if, for example, they were discarded because they didn't
38       pass the packet filter, or if, on platforms that support a read timeout
39       that  starts  before any packets arrive, the timeout expires before any
40       packets arrive, or if the file descriptor for the capture device is  in
41       non-blocking  mode  and no packets were available to be read), or if no
42       more packets are available in a ``savefile.''  Unfortunately, there  is
43       no way to determine whether an error occured or not.
44

SEE ALSO

46       pcap(3PCAP), pcap_geterr(3PCAP), pcap_dispatch(3PCAP)
47
48
49
50                                 5 April 2008              PCAP_NEXT_EX(3PCAP)
Impressum