| blob | 02fc611e8c8904cac3a1ba92a58a12c56324eb42 |
1 .\" Copyright (c) 1994, 1996, 1997
2 .\" The Regents of the University of California. All rights reserved.
3 .\"
4 .\" Redistribution and use in source and binary forms, with or without
5 .\" modification, are permitted provided that: (1) source code distributions
6 .\" retain the above copyright notice and this paragraph in its entirety, (2)
7 .\" distributions including binary code include the above copyright notice and
8 .\" this paragraph in its entirety in the documentation or other materials
9 .\" provided with the distribution, and (3) all advertising materials mentioning
10 .\" features or use of this software display the following acknowledgement:
11 .\" ``This product includes software developed by the University of California,
12 .\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
13 .\" the University nor the names of its contributors may be used to endorse
14 .\" or promote products derived from this software without specific prior
15 .\" written permission.
16 .\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
17 .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
18 .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
19 .\"
20 .TH PCAP_OPEN_OFFLINE 3PCAP "1 July 2013"
21 .SH NAME
22 pcap_open_offline, pcap_open_offline_with_tstamp_precision,
23 pcap_fopen_offline, pcap_fopen_offline_with_tstamp_precision \- open a saved capture file for reading
24 .SH SYNOPSIS
25 .nf
26 .ft B
27 #include <pcap/pcap.h>
28 .ft
29 .LP
30 .nf
31 .ft B
32 char errbuf[PCAP_ERRBUF_SIZE];
33 .ft
34 .LP
35 .ft B
36 pcap_t *pcap_open_offline(const char *fname, char *errbuf);
37 pcap_t *pcap_open_offline_with_tstamp_precision(const char *fname,
38 u_int precision, char *errbuf);
39 pcap_t *pcap_fopen_offline(FILE *fp, char *errbuf);
40 pcap_t *pcap_fopen_offline_with_tstamp_precision(FILE *fp,
41 u_int precision, char *errbuf);
42 .ft
43 .fi
44 .SH DESCRIPTION
45 .B pcap_open_offline()
46 and
47 .B pcap_open_offline_with_tstamp_precision()
48 are called to open a ``savefile'' for reading.
49 .PP
50 .I fname
51 specifies the name of the file to open. The file can have the pcap file
52 format as described in
53 .BR pcap-savefile (5),
54 which is the file format used by, among other programs,
55 .BR tcpdump (1)
56 and
57 .BR tcpslice (1),
58 or can have the pcap-ng file format, although not all pcap-ng files can
59 be read.
60 The name "-" is a synonym for
61 .BR stdin .
62 .PP
63 .B pcap_open_offline_with_tstamp_precision()
64 takes an additional
65 .I precision
66 argument specifying the time stamp precision desired;
67 if
68 .B PCAP_TSTAMP_PRECISION_MICRO
69 is specified, packet time stamps will be supplied in seconds and
70 microseconds,
71 and if
72 .B PCAP_TSTAMP_PRECISION_NANO
73 is specified, packet time stamps will be supplied in seconds and
74 nanoseconds. If the time stamps in the file do not have the same
75 precision as the requested precision, they will be scaled up or down as
76 necessary before being supplied.
77 .PP
78 Alternatively, you may call
79 .B pcap_fopen_offline()
80 or
81 .B pcap_fopen_offline_with_tstamp_precision()
82 to read dumped data from an existing open stream
83 .IR fp .
84 .B pcap_fopen_offline_with_tstamp_precision() takes an additional
85 .I precision
86 argument as described above.
87 Note that on Windows, that stream should be opened in binary mode.
88 .SH RETURN VALUE
89 .BR pcap_open_offline() ,
90 .BR pcap_open_offline_with_tstamp_precision() ,
91 .BR pcap_fopen_offline() ,
92 and
93 .B pcap_fopen_offline_with_tstamp_precision()
94 return a
95 .I pcap_t *
96 on success and
97 .B NULL
98 on failure.
99 If
100 .B NULL
101 is returned,
102 .I errbuf
103 is filled in with an appropriate error message.
104 .I errbuf
105 is assumed to be able to hold at least
106 .B PCAP_ERRBUF_SIZE
107 chars.
108 .SH SEE ALSO
109 pcap(3PCAP), pcap-savefile(5)