pcap.h File Reference

PCAP utility definitions. More...

Include dependency graph for pcap.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures
struct	pcap_file_header_t
	File header struct. More...
struct	pcap_packet_header_t
	Packet header. More...
struct	pcap_main_t
	PCAP main state data structure. More...

Macros
#define	foreach_vnet_pcap_packet_type
	Known libpcap encap types. More...
#define	foreach_pcap_file_header
#define	foreach_pcap_packet_header
#define	PCAP_MAIN_INIT_DONE   (1 << 0)

Enumerations
enum	pcap_packet_type_t { foreach_vnet_pcap_packet_type }

Detailed Description

PCAP utility definitions.

Definition in file pcap.h.

Macro Definition Documentation

foreach_pcap_file_header

#define foreach_pcap_file_header

Value:

/** 0xa1b2c3d4 host byte order.                 \
     0xd4c3b2a1 => need to byte swap everything. */     \
  _ (u32, magic)                                        \
                                                        \
  /** Currently major 2 minor 4. */                     \
  _ (u16, major_version)                                \
  _ (u16, minor_version)                                \
                                                        \
  /** 0 for GMT. */                                     \
  _ (u32, time_zone)                                    \
                                                        \
  /** Accuracy of timestamps.  Typically set to 0. */   \
  _ (u32, sigfigs)                                      \
                                                        \
  /** Size of largest packet in file. */                \
  _ (u32, max_packet_size_in_bytes)                     \
                                                        \
  /** One of vnet_pcap_packet_type_t. */                \
  _ (u32, packet_type)

Definition at line 103 of file pcap.h.

foreach_pcap_packet_header

#define foreach_pcap_packet_header

Value:

/** Time stamp in seconds  */                                         \
  _ (u32, time_in_sec)                                                  \
  /** Time stamp in microseconds. */                                    \
  _ (u32, time_in_usec)                                                 \
                                                                        \
  /** Number of bytes stored in file. */                                \
  _ (u32, n_packet_bytes_stored_in_file)                                \
  /** Number of bytes in actual packet. */                              \
  _ (u32, n_bytes_in_packet)

Definition at line 132 of file pcap.h.

foreach_vnet_pcap_packet_type

#define foreach_vnet_pcap_packet_type

Value:

_ (null, 0)                                     \
  _ (ethernet, 1)                               \
  _ (ppp, 9)                                    \
  _ (ip, 12)                                    \
  _ (hdlc, 104)                                 \
  _ (user0,    147)                             \
  _ (user1,    148)                             \
  _ (user2,    149)                             \
  _ (user3,    150)                             \
  _ (user4,    151)                             \
  _ (user5,    152)                             \
  _ (user6,    153)                             \
  _ (user7,    154)                             \
  _ (user8,    155)                             \
  _ (user9,    156)                             \
  _ (user10,   157)                             \
  _ (user11,   158)                             \
  _ (user12,   159)                             \
  _ (user13,   160)                             \
  _ (user14,   161)                             \
  _ (user15,   162)                             \
  _ (vpp, 280)                                  \

Known libpcap encap types.

These codes end up in the pcap file header. If you decide to build a wireshark dissector, you'll need to know that these codes are mapped through the pcap_to_wtap_map[] array in .../wiretap/pcap-common.c.

For example:

{ 280, WTAP_ENCAP_VPP },

A file with the officially-allocated vpp packet type PCAP_PACKET_TYPE_vpp aka 280, will need a top-level dissector registered to deal with WTAP_ENCAP_VPP [=206].

Something like so:

dissector_add_uint("wtap_encap", WTAP_ENCAP_VPP, vpp_dissector_handle);

Definition at line 72 of file pcap.h.

PCAP_MAIN_INIT_DONE

#define PCAP_MAIN_INIT_DONE   (1 << 0)

Definition at line 175 of file pcap.h.

Enumeration Type Documentation

pcap_packet_type_t

enum pcap_packet_type_t

Enumerator
foreach_vnet_pcap_packet_type

Definition at line 96 of file pcap.h.