pcap.h

Go to the documentation of this file.

/*
 * Copyright (C) 2011-2012 IITiS PAN Gliwice <http://www.iitis.pl/>
 * Author: Paweł Foremski <pjf@iitis.pl>
 * Licensed under GNU GPL v. 3
 */

#ifndef _PCAP_H_
#define _PCAP_H_

#include "tracedump.h"

struct pcap {
        int fd;                
        pthread_t reader;      
        FILE *fp;              
};

/* From http://wiki.wireshark.org/Development/LibpcapFileFormat */
#ifndef PCAP_MAGIC_NUMBER
#define PCAP_MAGIC_NUMBER 0xa1b2c3d4
#endif
#ifndef LINKTYPE_LINUX_SLL
#define LINKTYPE_LINUX_SLL 113
#endif
struct pcap_file_hdr {
        uint32_t magic_number;   /* magic number */
        uint16_t version_major;  /* major version number */
        uint16_t version_minor;  /* minor version number */
        int32_t  thiszone;       /* GMT to local correction */
        uint32_t sigfigs;        /* accuracy of timestamps */
        uint32_t snaplen;        /* max length of captured packets, in octets */
        uint32_t network;        /* data link type */
};
struct pcap_pkt_hdr {
        uint32_t ts_sec;         /* timestamp seconds */
        uint32_t ts_usec;        /* timestamp microseconds */
        uint32_t incl_len;       /* number of octets of packet saved in file */
        uint32_t orig_len;       /* actual length of packet */
};
struct pcap_sll_hdr {
        uint16_t sll_pkttype;
        uint16_t sll_hatype;
        uint16_t sll_halen;
        uint8_t  sll_addr[8];
        uint16_t sll_protocol;
};

void pcap_init(struct tracedump *td);

void pcap_deinit(struct tracedump *td);

void pcap_update(struct tracedump *td);

#endif