diff options
Diffstat (limited to 'pcap_open_live.3pcap')
| -rw-r--r-- | pcap_open_live.3pcap | 32 |
1 files changed, 7 insertions, 25 deletions
diff --git a/pcap_open_live.3pcap b/pcap_open_live.3pcap index a4d0b760..623f0986 100644 --- a/pcap_open_live.3pcap +++ b/pcap_open_live.3pcap @@ -1,4 +1,4 @@ -.\" @(#) $Header: /tcpdump/master/libpcap/pcap_open_live.3pcap,v 1.2 2008-04-05 20:26:56 guy Exp $ +.\" @(#) $Header: /tcpdump/master/libpcap/pcap_open_live.3pcap,v 1.3 2008-04-06 02:53:22 guy Exp $ .\" .\" Copyright (c) 1994, 1996, 1997 .\" The Regents of the University of California. All rights reserved. @@ -19,7 +19,7 @@ .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. .\" -.TH PCAP_OPEN_LIVE 3PCAP "4 April 2008" +.TH PCAP_OPEN_LIVE 3PCAP "5 April 2008" .SH NAME pcap_open_live \- open a device for capturing .SH SYNOPSIS @@ -41,7 +41,7 @@ int promisc, int to_ms, char *errbuf); .fi .SH DESCRIPTION .B pcap_open_live() -is used to obtain a packet capture descriptor to look +is used to obtain a packet capture handle to look at packets on the network. .I device is a string that specifies the network device to open; on Linux systems @@ -52,33 +52,13 @@ argument of "any" or can be used to capture packets from all interfaces. .PP .I snaplen -specifies the maximum number of bytes to capture. If this value is less -than the size of a packet that is captured, only the first -.I snaplen -bytes of that packet will be captured and provided as packet data. A -value of 65535 should be sufficient, on most if not all networks, to -capture all the data available from the packet. +specifies the snapshot length to be set on the handle. .PP .I promisc specifies if the interface is to be put into promiscuous mode. -(Note that even if this parameter is false, the interface -could well be in promiscuous mode for some other reason.) For now, this -doesn't work on the "any" device; if an argument of "any" or NULL is -supplied, the -.I promisc -flag is ignored. .PP .I to_ms -specifies the read timeout in milliseconds. The read timeout is used to -arrange that the read not necessarily return immediately when a packet -is seen, but that it wait for some amount of time to allow more packets -to arrive and to read multiple packets from the OS kernel in one -operation. Not all platforms support a read timeout; on platforms that -don't, the read timeout is ignored. A zero value for -.IR to_ms , -on platforms that support a read timeout, -will cause a read to wait forever to allow enough packets to -arrive, with no timeout. +specifies the read timeout in milliseconds. .SH RETURN VALUE .B pcap_open_live() returns a @@ -105,3 +85,5 @@ is no longer a zero-length string. is assumed to be able to hold at least .B PCAP_ERRBUF_SIZE chars. +.SH SEE ALSO +pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP) |