|
Packit |
209cc3 |
.\" Copyright (c) 1994, 1996, 1997
|
|
Packit |
209cc3 |
.\" The Regents of the University of California. All rights reserved.
|
|
Packit |
209cc3 |
.\"
|
|
Packit |
209cc3 |
.\" Redistribution and use in source and binary forms, with or without
|
|
Packit |
209cc3 |
.\" modification, are permitted provided that: (1) source code distributions
|
|
Packit |
209cc3 |
.\" retain the above copyright notice and this paragraph in its entirety, (2)
|
|
Packit |
209cc3 |
.\" distributions including binary code include the above copyright notice and
|
|
Packit |
209cc3 |
.\" this paragraph in its entirety in the documentation or other materials
|
|
Packit |
209cc3 |
.\" provided with the distribution, and (3) all advertising materials mentioning
|
|
Packit |
209cc3 |
.\" features or use of this software display the following acknowledgement:
|
|
Packit |
209cc3 |
.\" ``This product includes software developed by the University of California,
|
|
Packit |
209cc3 |
.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
|
|
Packit |
209cc3 |
.\" the University nor the names of its contributors may be used to endorse
|
|
Packit |
209cc3 |
.\" or promote products derived from this software without specific prior
|
|
Packit |
209cc3 |
.\" written permission.
|
|
Packit |
209cc3 |
.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
|
|
Packit |
209cc3 |
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
|
|
Packit |
209cc3 |
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
|
Packit |
209cc3 |
.\"
|
|
Packit |
209cc3 |
.TH PCAP_COMPILE 3PCAP "22 August 2018"
|
|
Packit |
209cc3 |
.SH NAME
|
|
Packit |
209cc3 |
pcap_compile \- compile a filter expression
|
|
Packit |
209cc3 |
.SH SYNOPSIS
|
|
Packit |
209cc3 |
.nf
|
|
Packit |
209cc3 |
.ft B
|
|
Packit |
209cc3 |
#include <pcap/pcap.h>
|
|
Packit |
209cc3 |
.ft
|
|
Packit |
209cc3 |
.LP
|
|
Packit |
209cc3 |
.ft B
|
|
Packit |
209cc3 |
int pcap_compile(pcap_t *p, struct bpf_program *fp,
|
|
Packit |
209cc3 |
.ti +8
|
|
Packit |
209cc3 |
const char *str, int optimize, bpf_u_int32 netmask);
|
|
Packit |
209cc3 |
.ft
|
|
Packit |
209cc3 |
.fi
|
|
Packit |
209cc3 |
.SH DESCRIPTION
|
|
Packit |
209cc3 |
.B pcap_compile()
|
|
Packit |
209cc3 |
is used to compile the string
|
|
Packit |
209cc3 |
.I str
|
|
Packit |
209cc3 |
into a filter program. See
|
|
Packit |
209cc3 |
.BR pcap-filter (@MAN_MISC_INFO@)
|
|
Packit |
209cc3 |
for the syntax of that string.
|
|
Packit |
209cc3 |
.I program
|
|
Packit |
209cc3 |
is a pointer to a
|
|
Packit |
209cc3 |
.I bpf_program
|
|
Packit |
209cc3 |
struct and is filled in by
|
|
Packit |
209cc3 |
.BR pcap_compile() .
|
|
Packit |
209cc3 |
.I optimize
|
|
Packit |
209cc3 |
controls whether optimization on the resulting code is performed.
|
|
Packit |
209cc3 |
.I netmask
|
|
Packit |
209cc3 |
specifies the IPv4 netmask of the network on which packets are being
|
|
Packit |
209cc3 |
captured; it is used only when checking for IPv4 broadcast addresses in
|
|
Packit |
209cc3 |
the filter program. If the netmask of the network on which packets are
|
|
Packit |
209cc3 |
being captured isn't known to the program, or if packets are being
|
|
Packit |
209cc3 |
captured on the Linux "any" pseudo-interface that can capture on more
|
|
Packit |
209cc3 |
than one network, a value of
|
|
Packit |
209cc3 |
.B PCAP_NETMASK_UNKNOWN
|
|
Packit |
209cc3 |
can be supplied; tests
|
|
Packit |
209cc3 |
for IPv4 broadcast addresses will fail to compile, but all other tests in
|
|
Packit |
209cc3 |
the filter program will be OK.
|
|
Packit |
209cc3 |
.LP
|
|
Packit |
209cc3 |
NOTE: in libpcap 1.8.0 and later,
|
|
Packit |
209cc3 |
.B pcap_compile()
|
|
Packit |
209cc3 |
can be used in multiple threads within a single process. However, in
|
|
Packit |
209cc3 |
earlier versions of libpcap, it is
|
|
Packit |
209cc3 |
.I not
|
|
Packit |
209cc3 |
safe to use
|
|
Packit |
209cc3 |
.B pcap_compile()
|
|
Packit |
209cc3 |
in multiple threads in a single process without some form of mutual
|
|
Packit |
209cc3 |
exclusion allowing only one thread to call it at any given time.
|
|
Packit |
209cc3 |
.SH RETURN VALUE
|
|
Packit |
209cc3 |
.B pcap_compile()
|
|
Packit |
209cc3 |
returns 0 on success and
|
|
Packit |
209cc3 |
.B PCAP_ERROR
|
|
Packit |
209cc3 |
on failure. If
|
|
Packit |
209cc3 |
.B PCAP_ERROR
|
|
Packit |
209cc3 |
is returned,
|
|
Packit |
209cc3 |
.B pcap_geterr(3PCAP)
|
|
Packit |
209cc3 |
or
|
|
Packit |
209cc3 |
.B pcap_perror(3PCAP)
|
|
Packit |
209cc3 |
may be called with
|
|
Packit |
209cc3 |
.I p
|
|
Packit |
209cc3 |
as an argument to fetch or display the error text.
|
|
Packit |
209cc3 |
.SH BACKWARD COMPATIBILITY
|
|
Packit |
209cc3 |
.PP
|
|
Packit |
209cc3 |
The
|
|
Packit |
209cc3 |
.B PCAP_NETMASK_UNKNOWN
|
|
Packit |
209cc3 |
constant became available in libpcap release 1.1.0.
|
|
Packit |
209cc3 |
.SH SEE ALSO
|
|
Packit |
209cc3 |
pcap(3PCAP), pcap_setfilter(3PCAP), pcap_freecode(3PCAP),
|