PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-02-03 03:59:02 +00:00
Code Issues Projects Releases Wiki Activity

Update libpcap to 1.9.0 (no patches applied yet)

Browse Source
This commit is contained in:
dmiller
2019-03-30 03:24:44 +00:00
parent 7d860b04e5
commit a2442ea29f
197 changed files with 26419 additions and 22082 deletions
Download Patch File Download Diff File Expand all files Collapse all files

92
libpcap/pcap.3pcap.in
View File

@@ -17,7 +17,7 @@
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
.\"
.TH PCAP 3PCAP "8 March 2015"
.TH PCAP 3PCAP "20 April 2018"
.SH NAME
pcap \- Packet Capture library
.SH SYNOPSIS
@@ -150,45 +150,46 @@ and
.BR pcap_can_set_rfmon ()
can be used to determine whether an adapter can be put into monitor
mode.
.IP "read timeout"
.IP "packet buffer timeout"
If, when capturing, packets are delivered as soon as they arrive, the
application capturing the packets will be woken up for each packet as it
arrives, and might have to make one or more calls to the operating
system to fetch each packet.
.IP
If, instead, packets are not delivered as soon as they arrive, but are
delivered after a short delay (called a "read timeout"), more than one
packet can be accumulated before the packets are delivered, so that a
single wakeup would be done for multiple packets, and each set of calls
made to the operating system would supply multiple packets, rather than
a single packet. This reduces the per-packet CPU overhead if packets
are arriving at a high rate, increasing the number of packets per second
that can be captured.
delivered after a short delay (called a "packet buffer timeout"), more
than one packet can be accumulated before the packets are delivered, so
that a single wakeup would be done for multiple packets, and each set of
calls made to the operating system would supply multiple packets, rather
than a single packet. This reduces the per-packet CPU overhead if
packets are arriving at a high rate, increasing the number of packets
per second that can be captured.
.IP
The read timeout is required so that an application won't wait for the
operating system's capture buffer to fill up before packets are
The packet buffer timeout is required so that an application won't wait
for the operating system's capture buffer to fill up before packets are
delivered; if packets are arriving slowly, that wait could take an
arbitrarily long period of time.
.IP
Not all platforms support a read timeout; on platforms that
don't, the read timeout is ignored. A zero value for the timeout,
on platforms that support a read timeout,
will cause a read to wait forever to allow enough packets to
arrive, with no timeout.
Not all platforms support a packet buffer timeout; on platforms that
don't, the packet buffer timeout is ignored. A zero value for the
timeout, on platforms that support a packet buffer timeout, will cause a
read to wait forever to allow enough packets to arrive, with no timeout.
A negative value is invalid; the result of setting the timeout to a
negative value is unpredictable.
.IP
.BR NOTE :
the read timeout cannot be used to cause calls that read
the packet buffer timeout cannot be used to cause calls that read
packets to return within a limited period of time, because, on some
platforms, the read timeout isn't supported, and, on other platforms,
the timer doesn't start until at least one packet arrives. This means
that the read timeout should
platforms, the packet buffer timeout isn't supported, and, on other
platforms, the timer doesn't start until at least one packet arrives.
This means that the packet buffer timeout should
.B NOT
be used, for example, in an interactive application to allow the packet
capture loop to ``poll'' for user input periodically, as there's no
guarantee that a call reading packets will return after the timeout
expires even if no packets have arrived.
.IP
The read timeout is set with
The packet buffer timeout is set with
.BR pcap_set_timeout ().
.IP "buffer size"
Packets that arrive for a capture are stored in a buffer, so that they
@@ -244,7 +245,7 @@ that device. A user can be given that privilege by, for example, adding
that privilege to the user's
.B defaultpriv
key with the
.B usermod (1M)
.B usermod (@MAN_ADMIN_COMMANDS@)
command.
.TP
.B Under HP-UX with DLPI:
@@ -282,13 +283,13 @@ packet capture on an interface probably requires that either
promiscuous-mode or copy-all-mode operation, or both modes of
operation, be enabled on that interface.
.TP
.B Under BSD (this includes Mac OS X):
.B Under BSD (this includes macOS):
You must have read access to
.I /dev/bpf*
on systems that don't have a cloning BPF device, or to
.I /dev/bpf
on systems that do.
On BSDs with a devfs (this includes Mac OS X), this might involve more
On BSDs with a devfs (this includes macOS), this might involve more
than just having somebody with super-user access setting the ownership
or permissions on the BPF devices - it might involve configuring devfs
to set the ownership or permissions every time the system is booted,
@@ -303,7 +304,7 @@ link-layer header whose contents can differ for different network
interfaces. To determine the format of the packets supplied by the
handle, call
.BR pcap_datalink ();
.I http://www.tcpdump.org/linktypes.html
.I https://www.tcpdump.org/linktypes.html
lists the values it returns and describes the packet formats that
correspond to those values.
.PP
@@ -395,6 +396,11 @@ set promiscuous mode for a not-yet-activated
.B pcap_t
for live capture
.TP
.BR pcap_set_protocol_linux (3PCAP)
set capture protocol for a not-yet-activated
.B pcap_t
for live capture (Linux only)
.TP
.BR pcap_set_rfmon (3PCAP)
set monitor mode for a not-yet-activated
.B pcap_t
@@ -406,7 +412,7 @@ determine whether monitor mode can be set for a
for live capture
.TP
.BR pcap_set_timeout (3PCAP)
set read timeout for a not-yet-activated
set packet buffer timeout for a not-yet-activated
.B pcap_t
for live capture
.TP
@@ -600,12 +606,13 @@ and
will, if no packets are currently available to be read, block waiting
for packets to become available. On some, but
.I not
all, platforms, if a read timeout was specified, the wait will terminate
after the read timeout expires; applications should be prepared for
this, as it happens on some platforms, but should not rely on it, as it
does not happen on other platforms. Note that the wait might, or might
not, terminate even if no packets are available; applications should be
prepared for this to happen, but must not rely on it happening.
all, platforms, if a packet buffer timeout was specified, the wait will
terminate after the packet buffer timeout expires; applications should
be prepared for this, as it happens on some platforms, but should not
rely on it, as it does not happen on other platforms. Note that the
wait might, or might not, terminate even if no packets are available;
applications should be prepared for this to happen, but must not rely on
it happening.
.PP
A handle can be put into ``non-blocking mode'', so that those routines
will, rather than blocking, return an indication that no packets are
@@ -633,12 +640,12 @@ descriptor; the documentation for
.BR pcap_get_selectable_fd ()
gives details. Note that, just as an attempt to read packets from a
.B pcap_t
may not return any packets if the read timeout expires, a
may not return any packets if the packet buffer timeout expires, a
.BR select (),
.BR poll (),
or other such call may, if the read timeout expires, indicate that a
descriptor is ready to read even if there are no packets available to
read.
or other such call may, if the packet buffer timeout expires, indicate
that a descriptor is ready to read even if there are no packets
available to read.
.TP
.B Routines
.RS
@@ -915,7 +922,7 @@ script or some other configuration script to check whether the libpcap
1.0 APIs are available and use them only if they are.
.SH SEE ALSO
autoconf(1), tcpdump(1), tcpslice(1), pcap-filter(@MAN_MISC_INFO@), pfconfig(8),
usermod(1M)
usermod(@MAN_ADMIN_COMMANDS@)
.SH AUTHORS
The original authors of libpcap are:
.LP
@@ -927,11 +934,12 @@ Lawrence Berkeley National Laboratory, University of California, Berkeley, CA.
The current version is available from "The Tcpdump Group"'s Web site at
.LP
.RS
.I http://www.tcpdump.org/
.I https://www.tcpdump.org/
.RE
.SH BUGS
Please send problems, bugs, questions, desirable enhancements, etc. to:
To report a security issue please send an e-mail to security@tcpdump.org.
.LP
.RS
tcpdump-workers@lists.tcpdump.org
.RE
To report bugs and other problems, contribute patches, request a
feature, provide generic feedback etc please see the file
.I CONTRIBUTING
in the libpcap source tree root.