pcap-int.h.html 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582
  1. <?xml version='1.0' encoding='iso-8859-1'?>
  2. <!doctype html public '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'>
  3. <html xmlns='http://www.w3c.org/1999/xhtml' lang='en-us'>
  4. <head>
  5. <title>
  6. pcap-int.h
  7. </title>
  8. <meta http-equiv='content-type' content='text/html;iso-8859-1'/>
  9. <meta name='generator' content='motley-tools 1.9.4 13:40:33 Feb 18 2015'/>
  10. <meta name='author' content='cmaier@cmassoc.net'/>
  11. <meta name='robots' content='noindex,nofollow'/>
  12. <link href='toolkit.css' rel='stylesheet' type='text/css'/>
  13. </head>
  14. <body>
  15. <div class='headerlink'>
  16. [<a href='pcap.h.html' title=' pcap.h '>PREV</a>]
  17. [<a href='toolkit.html' title=' Index '>HOME</a>]
  18. [<a href='pcap-stdinc.h.html' title=' pcap-stdinc.h '>NEXT</a>]
  19. </div>
  20. <pre>
  21. /*
  22. * Copyright (c) 1994, 1995, 1996
  23. * The Regents of the University of California. All rights reserved.
  24. *
  25. * Redistribution and use in source and binary forms, with or without
  26. * modification, are permitted provided that the following conditions
  27. * are met:
  28. * 1. Redistributions of source code must retain the above copyright
  29. * notice, this list of conditions and the following disclaimer.
  30. * 2. Redistributions in binary form must reproduce the above copyright
  31. * notice, this list of conditions and the following disclaimer in the
  32. * documentation and/or other materials provided with the distribution.
  33. * 3. All advertising materials mentioning features or use of this software
  34. * must display the following acknowledgement:
  35. * This product includes software developed by the Computer Systems
  36. * Engineering Group at Lawrence Berkeley Laboratory.
  37. * 4. Neither the name of the University nor of the Laboratory may be used
  38. * to endorse or promote products derived from this software without
  39. * specific prior written permission.
  40. *
  41. * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  42. * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44. * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  45. * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47. * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51. * SUCH DAMAGE.
  52. *
  53. * @(#) $Header: /home/cvs/plc-utils/VisualStudioNET/include/pcap-int.h,v 1.1.1.1 2011-08-27 15:30:16 cmaier Exp $ (LBL)
  54. */
  55. #ifndef pcap_int_h
  56. #define pcap_int_h
  57. #ifdef __cplusplus
  58. extern &quot;C&quot;
  59. {
  60. #endif
  61. #include &lt;pcap.h&gt;
  62. #ifdef WIN32
  63. #include &lt;Packet32.h&gt;
  64. #endif /* WIN32 */
  65. #ifdef MSDOS
  66. #include &lt;fcntl.h&gt;
  67. #include &lt;io.h&gt;
  68. #endif
  69. /*
  70. * Savefile
  71. */
  72. typedef enum
  73. {
  74. NOT_SWAPPED,
  75. SWAPPED,
  76. MAYBE_SWAPPED
  77. }
  78. swapped_type_t;
  79. struct pcap_sf
  80. {
  81. FILE *rfile;
  82. int swapped;
  83. int hdrsize;
  84. swapped_type_t lengths_swapped;
  85. int version_major;
  86. int version_minor;
  87. u_char *base;
  88. };
  89. struct pcap_md
  90. {
  91. struct pcap_stat stat;
  92. /*XXX*/
  93. int use_bpf;
  94. /* using kernel filter */
  95. u_long TotPkts;
  96. /* can't oflow for 79 hrs on ether */
  97. u_long TotAccepted;
  98. /* count accepted by filter */
  99. u_long TotDrops;
  100. /* count of dropped packets */
  101. long TotMissed;
  102. /* missed by i/f during this run */
  103. long OrigMissed;
  104. /* missed by i/f before this run */
  105. char *device;
  106. /* device name */
  107. #ifdef linux
  108. int sock_packet;
  109. /* using Linux 2.0 compatible interface */
  110. int timeout;
  111. /* timeout specified to pcap_open_live */
  112. int clear_promisc;
  113. /* must clear promiscuous mode when we close */
  114. int cooked;
  115. /* using SOCK_DGRAM rather than SOCK_RAW */
  116. int ifindex;
  117. /* interface index of device we're bound to */
  118. int lo_ifindex;
  119. /* interface index of the loopback device */
  120. struct pcap *next;
  121. /* list of open promiscuous sock_packet pcaps */
  122. u_int packets_read;
  123. /* count of packets read with recvfrom() */
  124. #endif
  125. #ifdef HAVE_DAG_API
  126. #ifdef HAVE_DAG_STREAMS_API
  127. u_char *dag_mem_bottom;
  128. /* DAG card current memory bottom pointer */
  129. u_char *dag_mem_top;
  130. /* DAG card current memory top pointer */
  131. #else
  132. void *dag_mem_base;
  133. /* DAG card memory base address */
  134. u_int dag_mem_bottom;
  135. /* DAG card current memory bottom offset */
  136. u_int dag_mem_top;
  137. /* DAG card current memory top offset */
  138. #endif /* HAVE_DAG_STREAMS_API */
  139. int dag_fcs_bits;
  140. /* Number of checksum bits from link layer */
  141. int dag_offset_flags;
  142. /* Flags to pass to dag_offset(). */
  143. int dag_stream;
  144. /* DAG stream number */
  145. int dag_timeout;
  146. /* timeout specified to pcap_open_live.
  147. * Same as in linux above, introduce
  148. * generally? */
  149. #endif /* HAVE_DAG_API */
  150. #ifdef HAVE_REMOTE
  151. /*!
  152. * There is really a mess with previous variables, and it seems to me that they are not used
  153. * (they are used in pcap_pf.c only). I think we have to start using them.
  154. * The meaning is the following:
  155. *
  156. * - TotPkts: the amount of packets received by the bpf filter, *before* applying the filter
  157. * - TotAccepted: the amount of packets that satisfies the filter
  158. * - TotDrops: the amount of packet that were dropped into the kernel buffer because of lack of space
  159. * - TotMissed: the amount of packets that were dropped by the physical interface; it is basically
  160. * the value of the hardware counter into the card. This number is never put to zero, so this number
  161. * takes into account the *total* number of interface drops starting from the interface power-on.
  162. * - OrigMissed: the amount of packets that were dropped by the interface *when the capture begins*.
  163. * This value is used to detect the number of packets dropped by the interface *during the present
  164. * capture*, so that (ps_ifdrops= TotMissed - OrigMissed).
  165. */
  166. unsigned int TotNetDrops;
  167. //!&lt; keeps the number of packets that have been dropped by the network
  168. /*!
  169. * \brief It keeps the number of packets that have been received by the application.
  170. *
  171. * Packets dropped by the kernel buffer are not counted in this variable. The variable is always
  172. * equal to (TotAccepted - TotDrops), exept for the case of remote capture, in which we have also
  173. * packets in fligh, i.e. that have been transmitted by the remote host, but that have not been
  174. * received (yet) from the client. In this case, (TotAccepted - TotDrops - TotNetDrops) gives a
  175. * wrong result, since this number does not corresponds always to the number of packet received by
  176. * the application. For this reason, in the remote capture we need another variable that takes
  177. * into account of the number of packets actually received by the application.
  178. */
  179. unsigned int TotCapt;
  180. #endif /* HAVE_REMOTE */
  181. };
  182. /*
  183. * Ultrix, DEC OSF/1^H^H^H^H^H^H^H^H^HDigital UNIX^H^H^H^H^H^H^H^H^H^H^H^H
  184. * Tru64 UNIX, and NetBSD pad to make everything line up on a nice boundary.
  185. */
  186. #if defined(ultrix) || defined(__osf__) || (defined(__NetBSD__) &amp;&amp; __NetBSD_Version__ &gt; 106000000)
  187. #define PCAP_FDDIPAD 3
  188. #endif
  189. struct pcap
  190. {
  191. #ifdef WIN32
  192. ADAPTER *adapter;
  193. LPPACKET Packet;
  194. int timeout;
  195. int nonblock;
  196. #else
  197. int fd;
  198. int selectable_fd;
  199. int send_fd;
  200. #endif /* WIN32 */
  201. int snapshot;
  202. int linktype;
  203. int tzoff;
  204. /* timezone offset */
  205. int offset;
  206. /* offset for proper alignment */
  207. int break_loop;
  208. /* flag set to force break from packet-reading loop */
  209. #ifdef PCAP_FDDIPAD
  210. int fddipad;
  211. #endif
  212. #ifdef MSDOS
  213. int inter_packet_wait;
  214. /* offline: wait between packets */
  215. void (*wait_proc)(void);
  216. /* call proc while waiting */
  217. #endif
  218. struct pcap_sf sf;
  219. struct pcap_md md;
  220. /*
  221. * Read buffer.
  222. */
  223. int bufsize;
  224. u_char *buffer;
  225. u_char *bp;
  226. int cc;
  227. /*
  228. * Place holder for pcap_next().
  229. */
  230. u_char *pkt;
  231. /* We're accepting only packets in this direction/these directions. */
  232. pcap_direction_t direction;
  233. /*
  234. * Methods.
  235. */
  236. int (*read_op)(pcap_t *, int cnt, pcap_handler, u_char *);
  237. int (*inject_op)(pcap_t *, const void *, size_t);
  238. int (*setfilter_op)(pcap_t *, struct bpf_program *);
  239. int (*setdirection_op)(pcap_t *, pcap_direction_t);
  240. int (*set_datalink_op)(pcap_t *, int);
  241. int (*getnonblock_op)(pcap_t *, char *);
  242. int (*setnonblock_op)(pcap_t *, int, char *);
  243. int (*stats_op)(pcap_t *, struct pcap_stat *);
  244. void (*close_op)(pcap_t *);
  245. /*
  246. * Placeholder for filter code if bpf not in kernel.
  247. */
  248. struct bpf_program fcode;
  249. char errbuf [PCAP_ERRBUF_SIZE + 1];
  250. int dlt_count;
  251. u_int *dlt_list;
  252. struct pcap_pkthdr pcap_header;
  253. /* This is needed for the pcap_next_ex() to work */
  254. #ifdef HAVE_REMOTE
  255. #ifndef WIN32 // Win32 already defines 'timeout'
  256. int timeout;
  257. //!&lt; timeout to be used in the pcap_open()
  258. #endif
  259. /*! \brief '1' if we're the network client; needed by several functions (like pcap_setfilter() ) to know if
  260. * they have to use the socket or they have to open the local adapter. */
  261. int rmt_clientside;
  262. SOCKET rmt_sockctrl;
  263. //!&lt; socket ID of the socket used for the control connection
  264. SOCKET rmt_sockdata;
  265. //!&lt; socket ID of the socket used for the data connection
  266. int rmt_flags;
  267. //!&lt; we have to save flags, since they are passed by the pcap_open_live(), but they are used by the pcap_startcapture()
  268. int rmt_capstarted;
  269. //!&lt; 'true' if the capture is already started (needed to knoe if we have to call the pcap_startcapture()
  270. struct pcap_samp rmt_samp;
  271. //!&lt; Keeps the parameters related to the sampling process.
  272. char *currentfilter;
  273. //!&lt; Pointer to a buffer (allocated at run-time) that stores the current filter. Needed when flag PCAP_OPENFLAG_NOCAPTURE_RPCAP is turned on.
  274. #endif /* HAVE_REMOTE */
  275. };
  276. /*
  277. * This is a timeval as stored in a savefile.
  278. * It has to use the same types everywhere, independent of the actual
  279. * `struct timeval'; `struct timeval' has 32-bit tv_sec values on some
  280. * platforms and 64-bit tv_sec values on other platforms, and writing
  281. * out native `struct timeval' values would mean files could only be
  282. * read on systems with the same tv_sec size as the system on which
  283. * the file was written.
  284. */
  285. struct pcap_timeval
  286. {
  287. bpf_int32 tv_sec;
  288. /* seconds */
  289. bpf_int32 tv_usec;
  290. /* microseconds */
  291. };
  292. /*
  293. * This is a `pcap_pkthdr' as actually stored in a savefile.
  294. *
  295. * Do not change the format of this structure, in any way (this includes
  296. * changes that only affect the length of fields in this structure),
  297. * and do not make the time stamp anything other than seconds and
  298. * microseconds (e.g., seconds and nanoseconds). Instead:
  299. *
  300. * introduce a new structure for the new format;
  301. *
  302. * send mail to &quot;tcpdump-workers@tcpdump.org&quot;, requesting a new
  303. * magic number for your new capture file format, and, when
  304. * you get the new magic number, put it in &quot;savefile.c&quot;;
  305. *
  306. * use that magic number for save files with the changed record
  307. * header;
  308. *
  309. * make the code in &quot;savefile.c&quot; capable of reading files with
  310. * the old record header as well as files with the new record header
  311. * (using the magic number to determine the header format).
  312. *
  313. * Then supply the changes to &quot;patches@tcpdump.org&quot;, so that future
  314. * versions of libpcap and programs that use it (such as tcpdump) will
  315. * be able to read your new capture file format.
  316. */
  317. struct pcap_sf_pkthdr
  318. {
  319. struct pcap_timeval ts;
  320. /* time stamp */
  321. bpf_u_int32 caplen;
  322. /* length of portion present */
  323. bpf_u_int32 len;
  324. /* length this packet (off wire) */
  325. };
  326. /*
  327. * How a `pcap_pkthdr' is actually stored in savefiles written
  328. * by some patched versions of libpcap (e.g. the ones in Red
  329. * Hat Linux 6.1 and 6.2).
  330. *
  331. * Do not change the format of this structure, in any way (this includes
  332. * changes that only affect the length of fields in this structure).
  333. * Instead, introduce a new structure, as per the above.
  334. */
  335. struct pcap_sf_patched_pkthdr
  336. {
  337. struct pcap_timeval ts;
  338. /* time stamp */
  339. bpf_u_int32 caplen;
  340. /* length of portion present */
  341. bpf_u_int32 len;
  342. /* length this packet (off wire) */
  343. int index;
  344. unsigned short protocol;
  345. unsigned char pkt_type;
  346. };
  347. int yylex (void);
  348. #ifndef min
  349. #define min(a, b) ((a) &gt; (b) ? (b) : (a))
  350. #endif
  351. /* XXX should these be in pcap.h? */
  352. int pcap_offline_read (pcap_t *, int, pcap_handler, u_char *);
  353. int pcap_read (pcap_t *, int cnt, pcap_handler, u_char *);
  354. #ifndef HAVE_STRLCPY
  355. #define strlcpy(x, y, z) \
  356. (strncpy ((x), (y), (z)), \ ((z) &lt;= 0? 0: ((x)[(z) - 1] = '\0')), \ strlen ((y)))
  357. #endif
  358. #include &lt;stdarg.h&gt;
  359. #if !defined(HAVE_SNPRINTF)
  360. #define snprintf pcap_snprintf
  361. extern int snprintf (char *, size_t, const char *, ...);
  362. #endif
  363. #if !defined(HAVE_VSNPRINTF)
  364. #define vsnprintf pcap_vsnprintf
  365. extern int vsnprintf (char *, size_t, const char *, va_list ap);
  366. #endif
  367. /*
  368. * Routines that most pcap implementations can use for non-blocking mode.
  369. */
  370. #if !defined(WIN32) &amp;&amp; !defined(MSDOS)
  371. int pcap_getnonblock_fd (pcap_t *, char *);
  372. int pcap_setnonblock_fd (pcap_t *p, int, char *);
  373. #endif
  374. void pcap_close_common (pcap_t *);
  375. /*
  376. * Internal interfaces for &quot;pcap_findalldevs()&quot;.
  377. *
  378. * &quot;pcap_platform_finddevs()&quot; is a platform-dependent routine to
  379. * add devices not found by the &quot;standard&quot; mechanisms (SIOCGIFCONF,
  380. * &quot;getifaddrs()&quot;, etc..
  381. *
  382. * &quot;pcap_add_if()&quot; adds an interface to the list of interfaces.
  383. */
  384. int pcap_platform_finddevs (pcap_if_t **, char *);
  385. int add_addr_to_iflist (pcap_if_t **, const char *, u_int, struct sockaddr *, size_t, struct sockaddr *, size_t, struct sockaddr *, size_t, struct sockaddr *, size_t, char *);
  386. int pcap_add_if (pcap_if_t **, const char *, u_int, const char *, char *);
  387. struct sockaddr *dup_sockaddr (struct sockaddr *, size_t);
  388. int add_or_find_if (pcap_if_t **, pcap_if_t **, const char *, u_int, const char *, char *);
  389. #ifdef WIN32
  390. char *pcap_win32strerror (void);
  391. #endif
  392. int install_bpf_program (pcap_t *, struct bpf_program *);
  393. int pcap_strcasecmp (const char *, const char *);
  394. #ifdef __cplusplus
  395. }
  396. #endif
  397. #endif
  398. </pre>
  399. <div class='footerlink'>
  400. [<a href='pcap.h.html' title=' pcap.h '>PREV</a>]
  401. [<a href='toolkit.html' title=' Index '>HOME</a>]
  402. [<a href='pcap-stdinc.h.html' title=' pcap-stdinc.h '>NEXT</a>]
  403. </div>
  404. </body>
  405. </html>