tcpdump mailing list archives
Re: pcap_next returns "Didn't grab packet"
From: Guy Harris <gharris () sonic net>
Date: Tue, 17 Dec 2002 03:41:31 -0800
On Mon, Dec 16, 2002 at 12:07:02PM -0800, Guy Harris wrote:
"pcap_next()" returns a null pointer if "pcap_dispatch()" returns a value <= 0. To quote the current CVS version of the libpcap man page:
And to quote the now-current version, with a change I checked in to make this clearer: pcap_next() reads the next packet (by calling pcap_dis- patch() with a cnt of 1) and returns a u_char pointer to the data in that packet. (The pcap_pkthdr struct for that packet is not supplied.) NULL is returned if an error occured, or if no packets were read from a live capture (if, for example, they were discarded because they didn't pass the packet filter, or if, on platforms that support a read timeout that starts before any packets arrive, the timeout expires before any packets arrive, or if the file descriptor for the capture device is in non-blocking mode and no packets were available to be read), or if no more packets are available in a ``savefile.'' Unfortunately, there is no way to determine whether an error occured or not. - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe
Current thread:
- pcap_next returns "Didn't grab packet" Sam Carleton (Dec 15)
- Re: pcap_next returns "Didn't grab packet" Guy Harris (Dec 16)
- Re: pcap_next returns "Didn't grab packet" Sam Carleton (Dec 16)
- Re: pcap_next returns "Didn't grab packet" Guy Harris (Dec 17)
- Re: pcap_next returns "Didn't grab packet" Guy Harris (Dec 16)