Packet capture descriptor.

Dump file descriptor.

Compiled Berkeley Packet Filter program.

the type of the callback function passed to dispatch or loop.

The direction in which packets are to be captured. See setDirection.

Datalink types.

This covers all of the datalink types defined in bpf.h. Types defined on your system may vary.

The interface structure.

The address structure.

The socket address record. Note that this is not the same as SockAddr from Socket. (That is a Haskell version of C's struct sockaddr_in. This is the real struct sockaddr from the BSD network stack.)

The network address record. Both the address and mask are in network byte order.

openOffline opens a dump file for reading. The file format is the same as used by tcpdump and Wireshark. The string "-" is a synonym for stdin.

openLive is used to get a packet descriptor that can be used to look at packets on the network. The arguments are the device name, the snapshot length (in bytes), the promiscuity of the interface (True == promiscuous) and a timeout in milliseconds.

Using "any" as the device name will capture packets from all interfaces. On some systems, reading from the "any" device is incompatible with setting the interfaces into promiscuous mode. In that case, only packets whose link layer addresses match those of the interfaces are captured.

openDead is used to get a packet capture descriptor without opening a file or device. It is typically used to test packet filter compilation by setFilter. The arguments are the link type and the snapshot length.

openDump opens a dump file for writing. This dump file is written to by the dump function. The arguments are a raw packet capture descriptor and the file name, with "-" as a synonym for stdout.

Set a filter on the specified packet capture descriptor. Valid filter strings are those accepted by tcpdump.

Compile a filter for use by another program using the Berkeley Packet Filter library.

lookupDev returns the name of a device suitable for use with openLive and lookupNet. If you only have one interface, it is the function of choice. If not, see findAllDevs.

findAllDevs returns a list of all the network devices that can be opened by openLive. It returns only those devices that the calling process has sufficient privileges to open, so it may not find every device on the system.

Return the network address and mask for the specified interface name. Only valid for IPv4. For other protocols, use findAllDevs and search the Interface list for the associated network mask.

Set a packet capture descriptor into non-blocking mode if the second argument is True, otherwise put it in blocking mode. Note that the packet capture descriptor must have been obtained from openLive.

Return the blocking status of the packet capture descriptor. True indicates that the descriptor is non-blocking. Descriptors referring to dump files opened by openDump always return False.

Specify the direction in which packets are to be captured. Complete functionality is not necessarily available on all platforms.

Returns the datalink type associated with the given pcap descriptor.

Sets the datalink type for a given pcap descriptor.

List all the datalink types supported by a pcap descriptor. Entries from the resulting list are valid arguments to setDatalink.

Collect and process packets. The arguments are the packet capture descriptor, the count and a callback function.

The count is the maximum number of packets to process before returning. A count of -1 means process all of the packets received in one buffer (if a live capture) or all of the packets in a dump file (if offline).

The callback function is passed two arguments, a packet header record and a pointer to the packet data (Ptr Word8). The header record contains the number of bytes captured, which can be used to marshal the data into a list or array.

Similar to dispatch, but loop until the number of packets specified by the second argument are read. A negative value loops forever.

This function does not return when a live read timeout occurs. Use dispatch instead if you want to specify a timeout.

Read the next packet (equivalent to calling dispatch with a count of 1).

Write the packet data given by the second and third arguments to a dump file opened by openDead. dump is designed so it can be easily used as a default callback function by dispatch or loop.

Send a raw packet through the network interface.

Returns the number of packets received, the number of packets dropped by the packet filter and the number of packets dropped by the interface (before processing by the packet filter).

Version of the library. The returned pair consists of the major and minor version numbers.

isSwapped returns True if the current dump file uses a different byte order than the one native to the system.

The snapshot length that was used in the call to openLive.