Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 1 | .\" Copyright (c) 1994, 1996, 1997 |
| 2 | .\" The Regents of the University of California. All rights reserved. |
| 3 | .\" |
| 4 | .\" Redistribution and use in source and binary forms, with or without |
| 5 | .\" modification, are permitted provided that: (1) source code distributions |
| 6 | .\" retain the above copyright notice and this paragraph in its entirety, (2) |
| 7 | .\" distributions including binary code include the above copyright notice and |
| 8 | .\" this paragraph in its entirety in the documentation or other materials |
| 9 | .\" provided with the distribution, and (3) all advertising materials mentioning |
| 10 | .\" features or use of this software display the following acknowledgement: |
| 11 | .\" ``This product includes software developed by the University of California, |
| 12 | .\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of |
| 13 | .\" the University nor the names of its contributors may be used to endorse |
| 14 | .\" or promote products derived from this software without specific prior |
| 15 | .\" written permission. |
| 16 | .\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED |
| 17 | .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF |
| 18 | .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. |
| 19 | .\" |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 20 | .TH PCAP_COMPILE 3PCAP "24 March 2017" |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 21 | .SH NAME |
| 22 | pcap_compile \- compile a filter expression |
| 23 | .SH SYNOPSIS |
| 24 | .nf |
| 25 | .ft B |
| 26 | #include <pcap/pcap.h> |
| 27 | .ft |
| 28 | .LP |
| 29 | .ft B |
| 30 | int pcap_compile(pcap_t *p, struct bpf_program *fp, |
| 31 | .ti +8 |
| 32 | const char *str, int optimize, bpf_u_int32 netmask); |
| 33 | .ft |
| 34 | .fi |
| 35 | .SH DESCRIPTION |
| 36 | .B pcap_compile() |
| 37 | is used to compile the string |
| 38 | .I str |
| 39 | into a filter program. See |
| 40 | .BR pcap-filter (7) |
| 41 | for the syntax of that string. |
| 42 | .I program |
| 43 | is a pointer to a |
| 44 | .I bpf_program |
| 45 | struct and is filled in by |
| 46 | .BR pcap_compile() . |
| 47 | .I optimize |
| 48 | controls whether optimization on the resulting code is performed. |
| 49 | .I netmask |
| 50 | specifies the IPv4 netmask of the network on which packets are being |
| 51 | captured; it is used only when checking for IPv4 broadcast addresses in |
| 52 | the filter program. If the netmask of the network on which packets are |
| 53 | being captured isn't known to the program, or if packets are being |
| 54 | captured on the Linux "any" pseudo-interface that can capture on more |
| 55 | than one network, a value of PCAP_NETMASK_UNKNOWN can be supplied; tests |
| 56 | for IPv4 broadcast addresses will fail to compile, but all other tests in |
| 57 | the filter program will be OK. |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 58 | .LP |
| 59 | NOTE: in libpcap 1.8.0 and later, |
| 60 | .B pcap_compile() |
| 61 | can be used in multiple threads within a single process. However, in |
| 62 | earlier versions of libpcap, it is |
| 63 | .I not |
| 64 | safe to use |
| 65 | .B pcap_compile() |
| 66 | in multiple threads in a single process without some form of mutual |
| 67 | exclusion allowing only one thread to call it at any given time. |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 68 | .SH RETURN VALUE |
| 69 | .B pcap_compile() |
| 70 | returns 0 on success and \-1 on failure. |
| 71 | If \-1 is returned, |
| 72 | .B pcap_geterr() |
| 73 | or |
| 74 | .B pcap_perror() |
| 75 | may be called with |
| 76 | .I p |
| 77 | as an argument to fetch or display the error text. |
| 78 | .SH SEE ALSO |
| 79 | pcap(3PCAP), pcap_setfilter(3PCAP), pcap_freecode(3PCAP), |
| 80 | pcap_geterr(3PCAP), pcap-filter(7) |