pcappp::PcapLive Class Reference

#include <PcapLive.h>

Inheritance diagram for pcappp::PcapLive:

List of all members.

Public Types

enum Direction {
  IN = PCAP_D_IN,
  OUT = PCAP_D_OUT,
  IN_OUT = PCAP_D_INOUT
}

Type of direction the packets will be captured. More...

Public Member Functions

std::string const & get_device () const

Gets the name of the device.

Direction get_direction () const

Gets the direction of the capture.

int get_fd () const

Gets the file descriptor number from which captured packets are read.

int get_selectable_fd () const

Gets the selectable file descriptor number.

Stats const & get_stats ()

Gets packet statistics.

int get_timeout () const

Gets the timeout, in miliseconds.

void inject (Packet const &packet)

Sends a raw packet through the network interface.

bool is_nonblock ()

Gets the current non-blocking state.

bool is_promiscuous () const

Gets the promiscuous state of the interface.

PcapLive (std::string const &device, unsigned int snaplen=MAX_SNAPLEN, bool promisc=true, unsigned int timeout_ms=0)

Creates a PcapLive object.

void set_direction (Direction direction)

Specifies a direction that packets will be captured.

void set_nonblock (bool set=true)

Puts the PcapLive into non-blocking mode, or takes it out of non-blocking mode.

virtual ~PcapLive ()

Destroys the PcapLive object.

Static Public Attributes

static unsigned int const MAX_SNAPLEN = 65535

Default snap length for PcapLive().

Friends

PcapLive & operator<< (PcapLive &pcap, Packet const &packet)

An alias for inject().

Detailed Description

A PcapLive is a Pcap suitable for live capture. This means that the packets are read from a network interface. Note that on some platforms, this may require special privileges.

Member Enumeration Documentation

enum pcappp::PcapLive::Direction

Type of direction the packets will be captured.

Enumerator:

IN	Packets received by the device.
OUT	Packets sent by the device.
IN_OUT	Packets received or sent by the device.

Constructor & Destructor Documentation

pcappp::PcapLive::PcapLive	(	std::string const &	device,
		unsigned int	snaplen = `MAX_SNAPLEN`,
		bool	promisc = `true`,
		unsigned int	timeout_ms = `0`
	)

Creates a PcapLive object.

Parameters:

	device	A string identifying the network device to open (e.g. "eth0"). On Linux systems with 2.2 or later kernels, a device string of "any" or "" (empty) can be used to capture packets from all interfaces
	snaplen	The maximum number of bytes to capture. If this value is less than the size of a packet that is captured, only the first snaplen bytes of that packet will be provided as packet data. The default value of PcapLive::MAX_SNAPLEN should be sufficient, on most if not all networks, to capture all the data available from the packet
	promisc	Whether the interface is to be put into promiscuous mode. (Note that even if this parameter is false, the interface could well be in promiscuous mode for some other reason.) For now, this doesn’t work on the "any" device; if an argument of "any" or empty is supplied, the promisc parameter is ignored
	timeout_ms	The read timeout, in miliseconds. It is used to arrange that the read not necessarily returns immediately when a packet is seen, but that it waits for some amount of time to allow more packets to arrive and to read multiple packets from the OS kernel in one operation. Not all platforms support a read timeout; on platforms that don’t, the read timeout is ignored. A timeout of zero, on platforms that support a read timeout, will cause a read to wait forever to allow enough packets to arrive, with no timeout

Exceptions:

PcapError

pcappp::PcapLive::~PcapLive ( ) [virtual]

Destroys the PcapLive object.

Member Function Documentation

std::string const& pcappp::PcapLive::get_device ( ) const [inline]

Gets the name of the device.

Direction pcappp::PcapLive::get_direction ( ) const [inline]

Gets the direction of the capture.

int pcappp::PcapLive::get_fd ( ) const

Gets the file descriptor number from which captured packets are read.

int pcappp::PcapLive::get_selectable_fd ( ) const

Gets the selectable file descriptor number.

Returns:: On UNIX, a file descriptor number for a file descriptor on which one can do a select() or poll() to wait for it to be possible to read packets without blocking, if such a descriptor exists, or -1, if no such descriptor exists. Some network devices do not support select() or poll() (for example, regular network devices on FreeBSD 4.3 and 4.4, and Endace DAG devices), so -1 is returned for those devices.

Note that on most versions of most BSDs (including MacOS X) select() and poll() do not work correctly on BPF devices; get_selectable_fd() will return a file descriptor on most of those versions (the exceptions being FreeBSD 4.3 and 4.4), a simple select() or poll() will not return even after a timeout specified in open() expires. To work around this, an application that uses select() or poll() to wait for packets to arrive must put the PcapLive in non-blocking mode, and must arrange that the select() or poll() have a timeout less than or equal to the timeout specified in open(), and must try to read packets after that timeout expires, regardless of whether select() or poll() indicated that the file descriptor for the PcapLive is ready to be read or not. (That workaround will not work in FreeBSD 4.3 and later; however, in FreeBSD 4.6 and later, select() and poll() work correctly on BPF devices, so the workaround isn’t necessary, although it does no harm)

Stats const & pcappp::PcapLive::get_stats ( )

Gets packet statistics.

Returns:: A Stats object containing the packet statistics from the start of the capture to the time of the call

Exceptions:

PcapError

int pcappp::PcapLive::get_timeout ( ) const [inline]

Gets the timeout, in miliseconds.

void pcappp::PcapLive::inject ( Packet const & packet )

Sends a raw packet through the network interface.

Note that, even if you successfully open the network interface, you might not have permission to send packets on it, or it might not support sending packets; as the PcapLive constructor doesn’t have a flag to indicate whether to open for capturing, sending, or capturing and sending, you cannot request a PcapLive that supports sending and be notified at construction time whether sending will be possible.
Note also that some devices might not support sending packets.

On some platforms, the link-layer header of the packet that’s sent might not be the same as the link-layer header of the packet supplied to inject(), as the source link-layer address, if the header contains such an address, might be changed to be the address assigned to the interface on which the packet it sent, if the platform doesn’t support sending completely raw and unchanged packets. Even worse, some drivers on some platforms might change the link-layer type field to whatever value libpcap used when attaching to the device, even on platforms that do nominally support sending completely raw and unchanged packets.

Parameters:

packet

The Packet to be sent

Exceptions:

PcapError

bool pcappp::PcapLive::is_nonblock ( )

Gets the current non-blocking state.

Returns:: Whether the capture is on non-blocking mode

Exceptions:

PcapError

bool pcappp::PcapLive::is_promiscuous ( ) const [inline]

Gets the promiscuous state of the interface.

Returns:: Whether the interface is put in promiscuous mode.

void pcappp::PcapLive::set_direction ( Direction direction )

Specifies a direction that packets will be captured.

In some platforms changing the direction of the capture might not be supported. In some other platforms the direction cannot be set to PcapLive::OUT. In both cases a PcapError exception is thrown.
The default setting is PcapLive::IN_OUT

Exceptions:

PcapError

void pcappp::PcapLive::set_nonblock ( bool set = true )

Puts the PcapLive into non-blocking mode, or takes it out of non-blocking mode.

In non-blocking mode, an attempt to read from the network interface with dispatch() will, if no packets are currently available to be read, return immediately rather than blocking waiting for packets to arrive. Note that loop() and next() will not work in non-blocking mode.

Parameters:

set

Whether the PcapLive is to be put into non-blocking mode

Exceptions:

PcapError

Friends And Related Function Documentation

PcapLive& operator<<	(	PcapLive &	pcap,
		Packet const &	packet
	)			`[friend]`

An alias for inject().

Parameters:

	pcap	The PcapLive object
	packet	The Packet to be sent

Exceptions:

PcapError

Member Data Documentation

unsigned int const pcappp::PcapLive::MAX_SNAPLEN = 65535 [static]

Default snap length for PcapLive().

The documentation for this class was generated from the following files:


Public Types
enum	Direction { IN = PCAP_D_IN, OUT = PCAP_D_OUT, IN_OUT = PCAP_D_INOUT }
	Type of direction the packets will be captured. More...
Public Member Functions
std::string const &	get_device () const
	Gets the name of the device.
Direction	get_direction () const
	Gets the direction of the capture.
int	get_fd () const
	Gets the file descriptor number from which captured packets are read.
int	get_selectable_fd () const
	Gets the selectable file descriptor number.
Stats const &	get_stats ()
	Gets packet statistics.
int	get_timeout () const
	Gets the timeout, in miliseconds.
void	inject (Packet const &packet)
	Sends a raw packet through the network interface.
bool	is_nonblock ()
	Gets the current non-blocking state.
bool	is_promiscuous () const
	Gets the promiscuous state of the interface.
	PcapLive (std::string const &device, unsigned int snaplen=MAX_SNAPLEN, bool promisc=true, unsigned int timeout_ms=0)
	Creates a PcapLive object.
void	set_direction (Direction direction)
	Specifies a direction that packets will be captured.
void	set_nonblock (bool set=true)
	Puts the PcapLive into non-blocking mode, or takes it out of non-blocking mode.
virtual	~PcapLive ()
	Destroys the PcapLive object.
Static Public Attributes
static unsigned int const	MAX_SNAPLEN = 65535
	Default snap length for PcapLive().
Friends
PcapLive &	operator<< (PcapLive &pcap, Packet const &packet)
	An alias for inject().