|
Packit |
209cc3 |
.\" Copyright (c) 1994, 1996, 1997
|
|
Packit |
209cc3 |
.\" The Regents of the University of California. All rights reserved.
|
|
Packit |
209cc3 |
.\"
|
|
Packit |
209cc3 |
.\" Redistribution and use in source and binary forms, with or without
|
|
Packit |
209cc3 |
.\" modification, are permitted provided that: (1) source code distributions
|
|
Packit |
209cc3 |
.\" retain the above copyright notice and this paragraph in its entirety, (2)
|
|
Packit |
209cc3 |
.\" distributions including binary code include the above copyright notice and
|
|
Packit |
209cc3 |
.\" this paragraph in its entirety in the documentation or other materials
|
|
Packit |
209cc3 |
.\" provided with the distribution, and (3) all advertising materials mentioning
|
|
Packit |
209cc3 |
.\" features or use of this software display the following acknowledgement:
|
|
Packit |
209cc3 |
.\" ``This product includes software developed by the University of California,
|
|
Packit |
209cc3 |
.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
|
|
Packit |
209cc3 |
.\" the University nor the names of its contributors may be used to endorse
|
|
Packit |
209cc3 |
.\" or promote products derived from this software without specific prior
|
|
Packit |
209cc3 |
.\" written permission.
|
|
Packit |
209cc3 |
.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
|
|
Packit |
209cc3 |
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
|
|
Packit |
209cc3 |
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
|
Packit |
209cc3 |
.\"
|
|
Packit |
209cc3 |
.TH PCAP_DUMP_OPEN 3PCAP "22 August 2018"
|
|
Packit |
209cc3 |
.SH NAME
|
|
Packit |
209cc3 |
pcap_dump_open, pcap_dump_fopen \- open a file to which to write packets
|
|
Packit |
209cc3 |
.SH SYNOPSIS
|
|
Packit |
209cc3 |
.nf
|
|
Packit |
209cc3 |
.ft B
|
|
Packit |
209cc3 |
#include <pcap/pcap.h>
|
|
Packit |
209cc3 |
.ft
|
|
Packit |
209cc3 |
.nf
|
|
Packit |
209cc3 |
.LP
|
|
Packit |
209cc3 |
.ft B
|
|
Packit |
209cc3 |
pcap_dumper_t *pcap_dump_open(pcap_t *p, const char *fname);
|
|
Packit |
209cc3 |
pcap_dumper_t *pcap_dump_open_append(pcap_t *p, const char *fname);
|
|
Packit |
209cc3 |
pcap_dumper_t *pcap_dump_fopen(pcap_t *p, FILE *fp);
|
|
Packit |
209cc3 |
.ft
|
|
Packit |
209cc3 |
.fi
|
|
Packit |
209cc3 |
.SH DESCRIPTION
|
|
Packit |
209cc3 |
.B pcap_dump_open()
|
|
Packit |
209cc3 |
is called to open a ``savefile'' for writing.
|
|
Packit |
209cc3 |
.I fname
|
|
Packit |
209cc3 |
specifies the name of the file to open. The file will have
|
|
Packit |
209cc3 |
the same format as those used by
|
|
Packit |
209cc3 |
.BR tcpdump (1)
|
|
Packit |
209cc3 |
and
|
|
Packit |
209cc3 |
.BR tcpslice (1).
|
|
Packit |
209cc3 |
The name "-" is a synonym
|
|
Packit |
209cc3 |
for
|
|
Packit |
209cc3 |
.BR stdout .
|
|
Packit |
209cc3 |
.PP
|
|
Packit |
209cc3 |
.B pcap_dump_fopen()
|
|
Packit |
209cc3 |
is called to write data to an existing open stream
|
|
Packit |
209cc3 |
.IR fp ;
|
|
Packit |
209cc3 |
this stream will be closed by a subsequent call to
|
|
Packit |
209cc3 |
.BR pcap_dump_close(3PCAP) .
|
|
Packit |
209cc3 |
Note that on Windows, that stream should be opened in binary mode.
|
|
Packit |
209cc3 |
.PP
|
|
Packit |
209cc3 |
.I p
|
|
Packit |
209cc3 |
is a capture or ``savefile'' handle returned by an earlier call to
|
|
Packit |
209cc3 |
.B pcap_create(3PCAP)
|
|
Packit |
209cc3 |
and activated by an earlier call to
|
|
Packit |
209cc3 |
.BR \%pcap_activate(3PCAP) ,
|
|
Packit |
209cc3 |
or returned by an earlier call to
|
|
Packit |
209cc3 |
.BR \%pcap_open_offline(3PCAP) ,
|
|
Packit |
209cc3 |
.BR pcap_open_live(3PCAP) ,
|
|
Packit |
209cc3 |
or
|
|
Packit |
209cc3 |
.BR pcap_open_dead(3PCAP) .
|
|
Packit |
209cc3 |
The time stamp precision, link-layer type, and snapshot length from
|
|
Packit |
209cc3 |
.I p
|
|
Packit |
209cc3 |
are used as the link-layer type and snapshot length of the output file.
|
|
Packit |
209cc3 |
.PP
|
|
Packit |
209cc3 |
.B pcap_dump_open_append()
|
|
Packit |
209cc3 |
is like
|
|
Packit |
209cc3 |
.B pcap_dump_open()
|
|
Packit |
209cc3 |
but does not create the file if it does not exist and, if it does
|
|
Packit |
209cc3 |
already exist, and is a pcap file with the same byte order as the host
|
|
Packit |
209cc3 |
opening the file, and has the same time stamp precision, link-layer
|
|
Packit |
209cc3 |
header type, and snapshot length as
|
|
Packit |
209cc3 |
.IR p ,
|
|
Packit |
209cc3 |
it will write new packets at the end of the file.
|
|
Packit |
209cc3 |
.SH RETURN VALUES
|
|
Packit |
209cc3 |
A pointer to a
|
|
Packit |
209cc3 |
.B pcap_dumper_t
|
|
Packit |
209cc3 |
structure to use in subsequent
|
|
Packit |
209cc3 |
.B pcap_dump(3PCAP)
|
|
Packit |
209cc3 |
and
|
|
Packit |
209cc3 |
.B pcap_dump_close(3PCAP)
|
|
Packit |
209cc3 |
calls is returned on success.
|
|
Packit |
209cc3 |
.B NULL
|
|
Packit |
209cc3 |
is returned on failure.
|
|
Packit |
209cc3 |
If
|
|
Packit |
209cc3 |
.B NULL
|
|
Packit |
209cc3 |
is returned,
|
|
Packit |
209cc3 |
.B pcap_geterr(3PCAP)
|
|
Packit |
209cc3 |
can be used to get the error text.
|
|
Packit |
209cc3 |
.SH BACKWARD COMPATIBILITY
|
|
Packit |
209cc3 |
.PP
|
|
Packit |
209cc3 |
The
|
|
Packit |
209cc3 |
.B pcap_dump_open_append()
|
|
Packit |
209cc3 |
function became available in libpcap release 1.7.2. In previous
|
|
Packit |
209cc3 |
releases, there is no support for appending packets to an existing
|
|
Packit |
209cc3 |
savefile.
|
|
Packit |
209cc3 |
.SH SEE ALSO
|
|
Packit |
209cc3 |
pcap(3PCAP),
|
|
Packit |
209cc3 |
\%pcap-savefile(@MAN_FILE_FORMATS@)
|