Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 1 | .\" Copyright (c) 1994, 1996, 1997 |
| 2 | .\" The Regents of the University of California. All rights reserved. |
| 3 | .\" |
| 4 | .\" Redistribution and use in source and binary forms, with or without |
| 5 | .\" modification, are permitted provided that: (1) source code distributions |
| 6 | .\" retain the above copyright notice and this paragraph in its entirety, (2) |
| 7 | .\" distributions including binary code include the above copyright notice and |
| 8 | .\" this paragraph in its entirety in the documentation or other materials |
| 9 | .\" provided with the distribution, and (3) all advertising materials mentioning |
| 10 | .\" features or use of this software display the following acknowledgement: |
| 11 | .\" ``This product includes software developed by the University of California, |
| 12 | .\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of |
| 13 | .\" the University nor the names of its contributors may be used to endorse |
| 14 | .\" or promote products derived from this software without specific prior |
| 15 | .\" written permission. |
| 16 | .\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED |
| 17 | .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF |
| 18 | .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. |
| 19 | .\" |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 20 | .TH PCAP_OPEN_OFFLINE 3PCAP "8 January 2018 " |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 21 | .SH NAME |
| 22 | pcap_open_offline, pcap_open_offline_with_tstamp_precision, |
| 23 | pcap_fopen_offline, pcap_fopen_offline_with_tstamp_precision \- open a saved capture file for reading |
| 24 | .SH SYNOPSIS |
| 25 | .nf |
| 26 | .ft B |
| 27 | #include <pcap/pcap.h> |
| 28 | .ft |
| 29 | .LP |
| 30 | .nf |
| 31 | .ft B |
| 32 | char errbuf[PCAP_ERRBUF_SIZE]; |
| 33 | .ft |
| 34 | .LP |
| 35 | .ft B |
| 36 | pcap_t *pcap_open_offline(const char *fname, char *errbuf); |
| 37 | pcap_t *pcap_open_offline_with_tstamp_precision(const char *fname, |
| 38 | u_int precision, char *errbuf); |
| 39 | pcap_t *pcap_fopen_offline(FILE *fp, char *errbuf); |
| 40 | pcap_t *pcap_fopen_offline_with_tstamp_precision(FILE *fp, |
| 41 | u_int precision, char *errbuf); |
| 42 | .ft |
| 43 | .fi |
| 44 | .SH DESCRIPTION |
| 45 | .B pcap_open_offline() |
| 46 | and |
| 47 | .B pcap_open_offline_with_tstamp_precision() |
| 48 | are called to open a ``savefile'' for reading. |
| 49 | .PP |
| 50 | .I fname |
| 51 | specifies the name of the file to open. The file can have the pcap file |
| 52 | format as described in |
| 53 | .BR pcap-savefile (5), |
| 54 | which is the file format used by, among other programs, |
| 55 | .BR tcpdump (1) |
| 56 | and |
| 57 | .BR tcpslice (1), |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 58 | or can have the pcapng file format, although not all pcapng files can |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 59 | be read. |
| 60 | The name "-" is a synonym for |
| 61 | .BR stdin . |
| 62 | .PP |
| 63 | .B pcap_open_offline_with_tstamp_precision() |
| 64 | takes an additional |
| 65 | .I precision |
| 66 | argument specifying the time stamp precision desired; |
| 67 | if |
| 68 | .B PCAP_TSTAMP_PRECISION_MICRO |
| 69 | is specified, packet time stamps will be supplied in seconds and |
| 70 | microseconds, |
| 71 | and if |
| 72 | .B PCAP_TSTAMP_PRECISION_NANO |
| 73 | is specified, packet time stamps will be supplied in seconds and |
| 74 | nanoseconds. If the time stamps in the file do not have the same |
| 75 | precision as the requested precision, they will be scaled up or down as |
| 76 | necessary before being supplied. |
| 77 | .PP |
| 78 | Alternatively, you may call |
| 79 | .B pcap_fopen_offline() |
| 80 | or |
| 81 | .B pcap_fopen_offline_with_tstamp_precision() |
| 82 | to read dumped data from an existing open stream |
| 83 | .IR fp . |
| 84 | .B pcap_fopen_offline_with_tstamp_precision() takes an additional |
| 85 | .I precision |
| 86 | argument as described above. |
| 87 | Note that on Windows, that stream should be opened in binary mode. |
| 88 | .SH RETURN VALUE |
| 89 | .BR pcap_open_offline() , |
| 90 | .BR pcap_open_offline_with_tstamp_precision() , |
| 91 | .BR pcap_fopen_offline() , |
| 92 | and |
| 93 | .B pcap_fopen_offline_with_tstamp_precision() |
| 94 | return a |
| 95 | .I pcap_t * |
| 96 | on success and |
| 97 | .B NULL |
| 98 | on failure. |
| 99 | If |
| 100 | .B NULL |
| 101 | is returned, |
| 102 | .I errbuf |
| 103 | is filled in with an appropriate error message. |
| 104 | .I errbuf |
| 105 | is assumed to be able to hold at least |
| 106 | .B PCAP_ERRBUF_SIZE |
| 107 | chars. |
| 108 | .SH SEE ALSO |
| 109 | pcap(3PCAP), pcap-savefile(5) |