<--previous | contents | next-->

# pcap Feeds

PCap feeds come in two flavours - Live and Offline. Live feeds capture packets from a network interface, while Offline feeds capture packets from a file. The two types of feed share a common interface, which is documented below. The sections discussing Live and Offline themselves only document departures from and additions to this common interface.

## Interface

A PCap Feed has the following methods:

### dispatch(cnt, callback, interpret=0)

Collect and process packets. The cnt parameter specifies the number of packets to capture before returning. A cnt of -1 processes all the packets recieved in one buffer. A cnt of 0 processes all packets until an error occurs, EOF is reached, or the read times out (when doing Live feeds, and a non-zero timeout is specified). The callback parameter is a function with the interface callback(packet, tstamp, length). It is called for each packet recieved, where packet will be the packet captured (up to the specified snaplength), tstamp will be a timestamp of the format (seconds, useconds), and length will be the total length of the packet. If the interpret flag is true, an instantiated Packet (see the Packet subsystem documentation) is passed to the callback, instead of the binary packet data.

### loop(cnt, callback, interpret=0)

Similar to dispatch, except that it keeps reading packets until cnt packets are read, or an error occurs. If the interpret flag is true, an instantiated Packet (see the Packet subsystem documentation) is passed to the callback, instead of the binary packet data.

### next(interpret=0)

Retrieve the next packet, by calling dispatch with a cnt of 1. If the interpret flag is true, an instantiated Packet (see the Packet subsystem documentation) is passed to the callback, instead of the binary packet data.

### inject(packet)

Write a new packet through the network interface.

### datalink()

Returns the data link layer type. The following Data Link Types are defined in the pcap module (see include/net/bpf.h):

- DLT_NULL
- DLT_EN10MB
- DLT_EN3MB
- DLT_AX25
- DLT_PRONET
- DLT_CHAOS
- DLT_IEEE802
- DLT_ARCNET
- DLT_SLIP
- DLT_PPP
- DLT_FDDI
- DLT_ATM_RFC1483
- DLT_LOOP
- DLT_ENC
- DLT_RAW
- DLT_SLIP_BSDOS
- DLT_PPP_BSDOS
- DLT_IEEE802_11
- DLT_PFSYNC
- DLT_PFLOG

### filter(filterstr)

Apply a filter to the pcap feed. The syntax of filterstr is the same as that of tcpdump, and is documented extensively in the tcpdump(8) manpage.

### close()

Close the feed. For many applications you will not have to call this method explicitly - feeds will be closed automatically when they are collected by the Python garbage collector.

<--previous | contents | next--> | (12/21/04)

PyOpenbsd v0.1 Manual