Indicate when "pcap_next()" returns NULL, and that, unfortunately, you

don't know whether that happens because of an error or because no
packets were available at the time.

1 files changed, 10 insertions, 1 deletions

diff --git a/pcap.3 b/pcap.3
index 9b9f6f1e..517621d7 100644
--- a/pcap.3
+++ b/pcap.3
@@ -1,4 +1,4 @@
-.\" @(#) $Header: /tcpdump/master/libpcap/Attic/pcap.3,v 1.39 2002-10-18 08:46:15 guy Exp $
+.\" @(#) $Header: /tcpdump/master/libpcap/Attic/pcap.3,v 1.40 2002-12-17 07:32:55 guy Exp $
 .\"
 .\" Copyright (c) 1994, 1996, 1997
 .\"	The Regents of the University of California.  All rights reserved.
@@ -488,6 +488,15 @@ of 1) and returns a
 pointer to the data in that packet.  (The
 .I pcap_pkthdr
 struct for that packet is not supplied.)
+.B NULL
+is returned if an error occured, or if no packets were read from a live
+capture (if, for example, they were discarded because they didn't pass
+the packet filter, or if, on platforms that support a read timeout that
+starts before any packets arrive, the timeout expires before any packets
+arrive, or if the file descriptor for the capture device is in
+non-blocking mode and no packets were available to be read), or if no
+more packets are available in a ``savefile.''  Unfortunately, there is
+no way to determine whether an error occured or not.
 .PP
 .B pcap_dump()
 outputs a packet to the ``savefile'' opened with