PCAP_NEXT_EX
Section: Misc. Reference Manual Pages (3PCAP)
Updated: 5 April 2008
Index
Return to Main Contents
NAME
pcap_next_ex, pcap_next - read the next packet from a pcap_t
SYNOPSIS
#include <pcap/pcap.h>
int pcap_next_ex(pcap_t *p, struct pcap_pkthdr **pkt_header,
const u_char **pkt_data);
const u_char *pcap_next(pcap_t *p, struct pcap_pkthdr *h);
DESCRIPTION
pcap_next_ex()
reads the next packet and returns a success/failure indication.
If the packet was read without problems, the pointer pointed to by the
pkt_header
argument is set to point to the
pcap_pkthdr
struct for the packet, and the
pointer pointed to by the
pkt_data
argument is set to point to the data in the packet.
pcap_next()
reads the next packet (by calling
pcap_dispatch()
with a
cnt
of 1) and returns a
u_char
pointer to the data in that packet.
The
pcap_pkthdr
structure pointed to by
h
is filled in with the appropriate values for the packet.
RETURN VALUE
pcap_next_ex()
returns 1 if the packet was read without problems, 0
if packets are being read from a live capture, and the timeout expired,
-1 if an error occurred while reading the packet, and -2 if
packets are being read from a ``savefile'', and there are no more
packets to read from the savefile.
If -1 is returned,
pcap_geterr()
or
pcap_perror()
may be called with
p
as an argument to fetch or display the error text.
pcap_next()
returns a pointer to the packet data on success, and returns
NULL
if an error occured, or if no packets were read from a live
capture (if, for example, they were discarded because they didn't pass
the packet filter, or if, on platforms that support a read timeout that
starts before any packets arrive, the timeout expires before any packets
arrive, or if the file descriptor for the capture device is in
non-blocking mode and no packets were available to be read), or if no
more packets are available in a ``savefile.'' Unfortunately, there is
no way to determine whether an error occured or not.
SEE ALSO
pcap(3PCAP), pcap_geterr(3PCAP), pcap_dispatch(3PCAP)