| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
| |
Use the same indentation everywhere as in pcap_open_offline(3PCAP), this
results in slightly better plain text output and notably better HTML
output.
|
| |
|
| |
|
|
|
|
|
|
| |
As discussed on tcpdump-workers, move a paragraph to a new BACKWARD
COMPATIBILITY section and tell a specific libpcap version, also make
the formatting consistent.
|
|
|
|
|
|
|
| |
Some man pages used bold font for special meaning constants (e.g. -1 for
infinity, 0 for false, 1 for true, NULL), but some didn't. Make the
formatting consistently bold, but leave ordinary constants (number of
packets in a buffer, a timeout, a buffer size) intact.
|
|
|
|
|
|
| |
When we scold programmers don't to assume that everything is Ethernet,
mention both DLT_LINUX_SLL and DLT_LINUX_SLL2 as possible link types for
the "any" device.
|
|
|
|
|
|
|
|
| |
Use the BSD house style, in which, in
foobar() returns 17 on success and 137 on failure.
"foobar" is boldfaced but "()" isn't.
|
|
|
|
|
|
|
| |
All manpage references such as pcap_create(3PCAP) will now be formatted
with the identifier (e.g. "pcap_create") in **bold** and the section
name (e.g. "(3PCAP)") in roman (default) face. This is how most manpages
seem to be formatted and makes things more consistent.
|
|
|
|
| |
[skip ci]
|
|
|
|
| |
[skip ci]
|
|
|
|
| |
[skip ci]
|
|
|
|
|
|
|
|
|
| |
That should make it clearer that the timeout does *not* guarantee that a
call that reads packets will return within N milliseconds even if no
packets arrive.
In the pcap_open_live() and pcap_set_timeout() calls, point to the
detailed description of the packet buffer timeout in pcap(3PCAP).
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Note, in more places, that if you call pcap_dispatch() on a pcap_t for
which there's a read timeout, it might return 0 if the read timeout
expires and there are no packets to be read - but that this behavior is
not guaranteed (so write your code to be able to handle it if it does
happen but not to depend on it happening).
Note also that a select()/poll()/etc. on the selectable descriptor for
the pcap_t might report the descriptor as readable if the read timeout
expires, even if there are no packets available to read - but that it
might not (so write your code to be able to handle it if it does happen
but not to depend on it happening).
Also, note that pcap_t's start out blocking, so they don't think that a
0 return from pcap_dispatch() means it's non-blocking and that they need
to call pcap_setnonblock() to put it in blocking mode.
|
|
|
|
|
| |
This change reflects only meaningful (i.e. not purely editorial) changes
in the text.
|
|
|
|
|
|
| |
This change removes CVS keywords that express that the file belongs to
libpcap repository. All such keywords represented the revision and
timestamp by the end of 2008 or even older.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Note for pcap_loop()/pcap_dispatch(), and for
pcap_next()/pcap_next_ex(), that in order to interpret the packets you
have to know the link-layer header type for the pcap_t, as returned by
pcap_datalink().
Note in all the places we discuss the value returned by pcap_datalink()
that the program *MUST NOT ASSUME* that it will return a particular
value, and specifically note that the Linux "any" device has a
pcap_datalink() value of DLT_LINUX_SLL even if all the network
interfaces on the system happen to have some other link-layer header
type.
|
|
|
|
|
|
|
| |
Note that pcap_loop() can return 0 if you're reading from a savefile and
you hit the EOF.
Fix a typo while we're at it.
|
|
|
|
| |
(Yes, I know - I'm using "data" as a collective noun. :-))
|
| |
|
|
|
|
|
|
| |
concepts to the pcap(3PCAP) man page, refer people to the pcap(3PCAP)
man page from the man pages for libpcap functions, and clean up some
errors.
|
|
|
|
|
|
|
| |
to 1.0, might as well go with the place where Red Hat stuck the header
at one point and where the header "officially" resides.
(We should put a "backwards compatibility" note into pcap.3pcap.)
|
|
functions plus an overall man page for libpcap, and put them all into
section 3PCAP. That means you can actually do "man pcap_open_live" and
get something meaningful, rather than having to do "man pcap" and then
scroll through all the other stuff in the man page.
|