83 lines
2.5 KiB
Plaintext
83 lines
2.5 KiB
Plaintext
.\" @(#) $Header: /tcpdump/master/libpcap/pcap_open_offline.3pcap.in,v 1.1 2008-10-23 05:56:59 guy Exp $
|
|
.\"
|
|
.\" Copyright (c) 1994, 1996, 1997
|
|
.\" The Regents of the University of California. All rights reserved.
|
|
.\"
|
|
.\" Redistribution and use in source and binary forms, with or without
|
|
.\" modification, are permitted provided that: (1) source code distributions
|
|
.\" retain the above copyright notice and this paragraph in its entirety, (2)
|
|
.\" distributions including binary code include the above copyright notice and
|
|
.\" this paragraph in its entirety in the documentation or other materials
|
|
.\" provided with the distribution, and (3) all advertising materials mentioning
|
|
.\" features or use of this software display the following acknowledgement:
|
|
.\" ``This product includes software developed by the University of California,
|
|
.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
|
|
.\" the University nor the names of its contributors may be used to endorse
|
|
.\" or promote products derived from this software without specific prior
|
|
.\" written permission.
|
|
.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
|
|
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
|
|
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
|
.\"
|
|
.TH PCAP_OPEN_OFFLINE 3PCAP "5 April 2008"
|
|
.SH NAME
|
|
pcap_open_offline, pcap_fopen_offline \- open a saved capture file for reading
|
|
.SH SYNOPSIS
|
|
.nf
|
|
.ft B
|
|
#include <pcap/pcap.h>
|
|
.ft
|
|
.LP
|
|
.nf
|
|
.ft B
|
|
char errbuf[PCAP_ERRBUF_SIZE];
|
|
.ft
|
|
.LP
|
|
.ft B
|
|
pcap_t *pcap_open_offline(const char *fname, char *errbuf);
|
|
pcap_t *pcap_fopen_offline(FILE *fp, char *errbuf);
|
|
.ft
|
|
.fi
|
|
.SH DESCRIPTION
|
|
.B pcap_open_offline()
|
|
is called to open a ``savefile'' for reading.
|
|
.PP
|
|
.I fname
|
|
specifies the name of the file to open. The file can have the pcap file
|
|
format as described in
|
|
.BR pcap-savefile (5),
|
|
which is the file format used by, among other programs,
|
|
.BR tcpdump (1)
|
|
and
|
|
.BR tcpslice (1),
|
|
or can have the pcap-ng file format, although not all pcap-ng files can
|
|
be read.
|
|
The name "-" in a synonym for
|
|
.BR stdin .
|
|
.PP
|
|
Alternatively, you may call
|
|
.B pcap_fopen_offline()
|
|
to read dumped data from an existing open stream
|
|
.IR fp .
|
|
Note that on Windows, that stream should be opened in binary mode.
|
|
.SH RETURN VALUE
|
|
.B pcap_open_offline()
|
|
and
|
|
.B pcap_fopen_offline()
|
|
return a
|
|
.I pcap_t *
|
|
on success and
|
|
.B NULL
|
|
on failure.
|
|
If
|
|
.B NULL
|
|
is returned,
|
|
.I errbuf
|
|
is filled in with an appropriate error message.
|
|
.I errbuf
|
|
is assumed to be able to hold at least
|
|
.B PCAP_ERRBUF_SIZE
|
|
chars.
|
|
.SH SEE ALSO
|
|
pcap(3PCAP), pcap-savefile(5)
|