Lines Matching +full:capture +full:- +full:only
1 /* -*- Mode: c; tab-width: 8; indent-tabs-mode: 1; c-basic-offset: 8; -*- */
36 * Remote packet capture mechanisms and extensions from WinPcap:
38 * Copyright (c) 2002 - 2003
74 * including pcap.h if it's not defined - and it defines it to 1500.
117 #include <pcap/pcap-inttypes.h>
130 #include <pcap/socket.h> /* for PCAP_SOCKET, as the active-mode rpcap APIs use it */
156 * predates the bpf typedefs for 64-bit support.
158 #if BPF_RELEASE - 0 < 199406
173 * Documentation: https://www.tcpdump.org/manpages/pcap-savefile.5.txt.
176 * changes that only affect the length of fields in this structure).
188 * send mail to "tcpdump-workers@lists.tcpdump.org", requesting
189 * a new magic number for your new capture file format, and, when
201 * https://github.com/the-tcpdump-group/libpcap/tree/master
205 * capture file format.
211 bpf_int32 thiszone; /* not used - SHOULD be filled with 0 */
212 bpf_u_int32 sigfigs; /* not used - SHOULD be filled with 0 */
218 * Subfields of the field containing the link-layer header type.
220 * Link-layer header types are assigned for both pcap and
222 * the link-layer header type field in an Interface Description
223 * Block is 16 bits, so only the bottommost 16 bits of the
224 * link-layer header type in a pcap file can be used for the
229 * A 4-bit "FCS length" field, to allow the FCS length to
242 * classes of link-layer types to be defined, with a class value
243 * of 0 indicating that the link-layer type is a LINKTYPE_ value.
248 * https://marc.info/?l=tcpdump-workers&m=98296750229149&w=2
250 * It's unknown whether those were ever used in capture files,
251 * or if the intent was just to use it as a link-layer type
254 * was ever used in capture files, or if classes other than
255 * "LINKTYPE_ value" are ever useful in capture files, we could
256 * re-enable this, and use the reserved 16 bits following the
257 * link-layer type in pcapng files to hold the class information
263 * values if "these are IPv{4,6} and only IPv{4,6} packets"
282 * Generic per-packet information, as supplied by libpcap.
285 * whether your system supports 32-bit tv_sec in "struct timeval",
286 * 64-bit tv_sec in "struct timeval", or both if it supports both 32-bit
287 * and 64-bit applications. The on-disk format of savefiles uses 32-bit
288 * tv_sec (and tv_usec); this structure is irrelevant to that. 32-bit
289 * and 64-bit versions of libpcap, even if they're on the same platform,
291 * that's not what the underlying packet capture mechanism supplies.
305 u_int ps_ifdrop; /* drops by interface -- only supported on some platforms */
360 #define PCAP_IF_WIRELESS 0x00000008 /* interface is wireless (*NOT* necessarily Wi-Fi!) */
387 #define PCAP_ERROR -1 /* generic error code */
388 #define PCAP_ERROR_BREAK -2 /* loop terminated by pcap_breakloop */
389 #define PCAP_ERROR_NOT_ACTIVATED -3 /* the capture needs to be activated */
390 #define PCAP_ERROR_ACTIVATED -4 /* the operation can't be performed on already activated captures …
391 #define PCAP_ERROR_NO_SUCH_DEVICE -5 /* no such device exists */
392 #define PCAP_ERROR_RFMON_NOTSUP -6 /* this device doesn't support rfmon (monitor) mode */
393 #define PCAP_ERROR_NOT_RFMON -7 /* operation supported only in monitor mode */
394 #define PCAP_ERROR_PERM_DENIED -8 /* no permission to open the device */
395 #define PCAP_ERROR_IFACE_NOT_UP -9 /* interface isn't up */
396 #define PCAP_ERROR_CANTSET_TSTAMP_TYPE -10 /* this device doesn't support setting the time stamp ty…
397 #define PCAP_ERROR_PROMISC_PERM_DENIED -11 /* you don't have permission to capture in promiscuous m…
398 #define PCAP_ERROR_TSTAMP_PRECISION_NOTSUP -12 /* the requested time stamp precision is not suppor…
399 #define PCAP_ERROR_CAPTURE_NOTSUP -13 /* capture mechanism not available */
403 * These will all be positive and non-zero, so they won't look like
418 * a mode source-compatible and binary-compatible with older versions
426 * On UNIX-like systems, the local character encoding is assumed to be
427 * UTF-8, so no character encoding transformations are done.
432 #define PCAP_CHAR_ENC_UTF_8 0x00000001U /* strings are in UTF-8 */
439 * thread-safe, can behave weirdly with WinPcap). Callers
510 * provided by the host machine, rather than by the capture device,
514 * that's low-precision but relatively cheap to fetch; it's normally done
519 * that's high-precision; it might be more expensive to fetch. It is
523 * machine, that's high-precision; it might be more expensive to fetch.
529 * PCAP_TSTAMP_ADAPTER is a high-precision time stamp supplied by the
530 * capture device; it's synchronized with the system clock.
532 * PCAP_TSTAMP_ADAPTER_UNSYNCED is a high-precision time stamp supplied by
533 * the capture device; it's not synchronized with the system clock.
541 * Note that host-provided time stamps generally correspond to the
542 * time when the time-stamping code sees the packet; this could
547 #define PCAP_TSTAMP_HOST 0 /* host-provided, unknown characteristics */
548 #define PCAP_TSTAMP_HOST_LOWPREC 1 /* host-provided, low precision, synced with the system clock */
549 #define PCAP_TSTAMP_HOST_HIPREC 2 /* host-provided, high precision, synced with the system clock …
550 #define PCAP_TSTAMP_ADAPTER 3 /* device-provided, synced with the system clock */
551 #define PCAP_TSTAMP_ADAPTER_UNSYNCED 4 /* device-provided, not synced with the system clock */
552 #define PCAP_TSTAMP_HOST_HIPREC_UNSYNCED 5 /* host-provided, high precision, not synced with the sy…
670 /* XXX - this took two arguments in 0.4 and 0.5 */
730 * a Windows-only pcap_handle() API that returns the HANDLE.
752 * If we're building libpcap, this is an internal routine in sf-pcap.c, so
884 * MS-DOS definitions
905 #if 0 /* Remote capture is disabled on FreeBSD */
907 * Remote capture definitions.
909 * These routines are only present if libpcap has been configured to
910 * include remote capture support.
931 * - file://path_and_filename [opens a local file]
932 …* - rpcap://devicename [opens the selected device available on the local host, without using the R…
933 * - rpcap://host/devicename [opens the selected device available on a remote host]
934 …* - rpcap://host:port/devicename [opens the selected device available on a remote host, using a no…
935 * - adaptername [to open a local adapter; kept for compatibility, but it is strongly discouraged]
936 …* - (NULL) [to open the first local adapter; kept for compatibility, but it is strongly discourage…
939 * - file://folder/ [lists all the files in the given folder]
940 * - rpcap:// [lists all local adapters]
941 * - rpcap://host:port/ [lists the devices available on a remote host]
949 * - host (literal): e.g. host.foo.bar
950 * - host (numeric IPv4): e.g. 10.11.12.13
951 * - host (numeric IPv4, IPv6 style): e.g. [10.11.12.13]
952 * - host (numeric IPv6): e.g. [1:2:3::4]
953 * - port: can be either numeric (e.g. '80') or literal (e.g. 'http')
956 * - rpcap://host.foo.bar/devicename [everything literal, no port number]
957 * - rpcap://host.foo.bar:1234/devicename [everything literal, with port number]
958 * - rpcap://10.11.12.13/devicename [IPv4 numeric, no port number]
959 * - rpcap://10.11.12.13:1234/devicename [IPv4 numeric, with port number]
960 * - rpcap://[10.11.12.13]:1234/devicename [IPv4 numeric with IPv6 format, with port number]
961 * - rpcap://[1:2:3::4]/devicename [IPv6 numeric, no port number]
962 * - rpcap://[1:2:3::4]:1234/devicename [IPv6 numeric, with port number]
963 * - rpcap://[1:2:3::4]:http/devicename [IPv6 numeric, with literal port number]
967 * URL schemes for capture source.
970 * This string indicates that the user wants to open a capture from a
975 * This string indicates that the user wants to open a capture from a
992 * Specifies, for an RPCAP capture, whether the data transfer (in
993 * case of a remote capture) has to be done with UDP protocol.
996 * a TCP data connection; control connection is always TCP-based.
1006 * Specifies whether the remote probe will capture its own generated
1009 * In case the remote probe uses the same interface to capture traffic
1012 * traffic is excluded from the capture, so that the trace returned
1020 * Specifies whether the local adapter will capture its own generated traffic.
1022 * This flag tells the underlying capture driver to drop the packets
1026 * Supported only on Windows.
1037 * sets the PCAP_OPENFLAG_MAX_RESPONSIVENESS flag, the capture driver will
1068 * are sent over the network to the capture server *IN CLEAR TEXT*. Don't
1100 * \brief Zero-terminated string containing the username that has to be
1108 * \brief Zero-terminated string containing the password that has to be
1129 * that pcap_open() supports, except for the Windows-only
1132 * For opening a remote capture, pcap_open() is currently the only
1148 * This routine can scan a directory for savefiles, list local capture
1149 * devices, or list capture devices on a remote machine running an RPCAP
1154 * the file as a savefile using pcap_open_offline(), and only includes
1159 * For listing local capture devices, it's just a wrapper around
1163 * For listing remote capture devices, pcap_findalldevs_ex() is currently
1164 * the only API available.
1174 * to see only a sample of packets, rather than all packets.
1176 * Currently, they work only on Windows local captures.
1180 * Specifies that no sampling is to be done on the current capture.
1182 * In this case, no sampling algorithms are applied to the current capture.
1187 * Specifies that only 1 out of N packets must be returned to the user.
1212 * only a subset of the packets coming from the source. The returned packets
1266 #endif /* Remote capture is disabled on FreeBSD */