| Wireshark 4.7.3 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
Functions
pcap-common.h File Reference
`#include "wtap.h"`

Go to the source code of this file.

## Functions
unsigned | wtap_max_snaplen_for_encap (int wtap_encap)
| Get the maximum snapshot length for a given capture encapsulation type.
int | pcap_process_pseudo_header (FILE_T fh, bool is_nokia, int wtap_encap, unsigned packet_size, wtap_rec *rec, int *err, char **err_info)
| Reads and processes the pseudo-header for a pcap packet record.
void | pcap_read_post_process (bool is_nokia, int wtap_encap, wtap_rec *rec, bool bytes_swapped, int fcs_len)
| Performs post-read fixups on a pcap packet record.
unsigned | pcap_get_phdr_size (int encap, const union wtap_pseudo_header *pseudo_header)
| Retrieves the size of the pseudo-header for a given encapsulation type and pseudo-header.
bool | pcap_write_phdr (wtap_dumper *wdh, int wtap_encap, const union wtap_pseudo_header *pseudo_header, int *err)
| Writes a packet header to a dump file.

## Detailed Description

Declarations for code common to pcap and pcapng file formats

Wiretap Library Copyright (c) 1998 by Gilbert Ramirez gram@.nosp@m.alum.nosp@m.ni.ri.nosp@m.ce.e.nosp@m.du

File format support for pcapng file format Copyright (c) 2007 by Ulf Lamping ulf.l.nosp@m.ampi.nosp@m.ng@we.nosp@m.b.de

SPDX-License-Identifier: GPL-2.0-or-later

## Function Documentation

## ◆ pcap_get_phdr_size()

unsigned pcap_get_phdr_size | ( | int | encap,
|  | const union wtap_pseudo_header * | pseudo_header )
| extern

Retrieves the size of the pseudo-header for a given encapsulation type and pseudo-header.

Parameters

  encap | The encapsulation type.
  pseudo_header | Pointer to the pseudo-header union.

Returns
  The size of the pseudo-header, or 0 if not applicable.

## ◆ pcap_process_pseudo_header()

int pcap_process_pseudo_header | ( | FILE_T | fh,
|  | bool | is_nokia,
|  | int | wtap_encap,
|  | unsigned | packet_size,
|  | wtap_rec * | rec,
|  | int * | err,
|  | char ** | err_info )
| extern

Reads and processes the pseudo-header for a pcap packet record.

Parameters

  fh | File handle positioned immediately after the pcap record header, at the start of any pseudo-header data.
  is_nokia | `true` if the file is a Nokia-variant pcap file, which uses a different pseudo-header layout.
  wtap_encap | Wiretap encapsulation type for this packet, used to select the correct pseudo-header format to read.
  packet_size | Total captured packet size in bytes including any pseudo-header; used for bounds checking.
  rec | wtap record structure whose pseudo-header fields are populated by this function.
  err | Set to a Wiretap or UNIX errno error code on failure.
  err_info | Set to a newly allocated error detail string on failure; the caller is responsible for freeing it.

Returns
  Number of pseudo-header bytes consumed on success; -1 on failure, with `err` and `err_info` set.

## ◆ pcap_read_post_process()

void pcap_read_post_process | ( | bool | is_nokia,
|  | int | wtap_encap,
|  | wtap_rec * | rec,
|  | bool | bytes_swapped,
|  | int | fcs_len )
| extern

Performs post-read fixups on a pcap packet record.

Parameters

  is_nokia | `true` if the file is a Nokia-variant pcap file, which requires Nokia-specific fixups.
  wtap_encap | Wiretap encapsulation type for this packet, used to determine which fields require post-processing.
  rec | wtap record structure to fix up in-place.
  bytes_swapped | `true` if the pcap file was written by a host with the opposite byte order, requiring byte-swapping of multi-byte pseudo-header fields.
  fcs_len | Frame Check Sequence length in bytes as recorded in the pcap file header; -1 if unknown.

## ◆ pcap_write_phdr()

bool pcap_write_phdr | ( | wtap_dumper * | wdh,
|  | int | wtap_encap,
|  | const union wtap_pseudo_header * | pseudo_header,
|  | int * | err )
| extern

Writes a packet header to a dump file.

Parameters

  wdh | Pointer to the wtap_dumper structure.
  wtap_encap | The encapsulation type of the packet.
  pseudo_header | Pointer to the pseudo-header of the packet.
  err | Pointer to an integer where any error code will be stored.

Returns
  true if the header was successfully written, false otherwise.

## ◆ wtap_max_snaplen_for_encap()

unsigned wtap_max_snaplen_for_encap | ( | int | wtap_encap | ) |
| extern

Get the maximum snapshot length for a given capture encapsulation type.

Parameters

  wtap_encap | The capture encapsulation type.

Returns
  unsigned The maximum snapshot length for the specified encapsulation type.