Module org.jnetpcap

Package org.jnetpcap

Class Pcap0_5

java.lang.Object

org.jnetpcap.Pcap

org.jnetpcap.Pcap0_4

org.jnetpcap.Pcap0_5

All Implemented Interfaces:

AutoCloseable

Direct Known Subclasses:

Pcap0_6

public sealed class Pcap0_5
extends Pcap0_4
permits Pcap0_6

Provides Pcap API method calls for up to libpcap version 0.5

Author:

Sly Technologies Inc, repos@slytechs.com, mark

Nested Class Summary

Nested classes/interfaces inherited from class org.jnetpcap.Pcap0_4

Pcap0_4.PcapSupplier<T extends Pcap>

Nested classes/interfaces inherited from class org.jnetpcap.Pcap

Pcap.LibraryPolicy, Pcap.Linux, Pcap.Unix

Field Summary

Fields inherited from class org.jnetpcap.Pcap0_4

dispatcher

Fields inherited from class org.jnetpcap.Pcap

closed, pcapHeaderABI, POINTER_TO_POINTER1, POINTER_TO_POINTER2, POINTER_TO_POINTER3, VERSION

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	Pcap0_5(MemorySegment pcapHandle, String name, PcapHeaderABI abi)	Instantiates a new pcap 050.

Method Summary

Modifier and Type	Method	Description
static BpFilter	compileNoPcap(int snaplen, PcapDlt pcapDlt, String str, boolean optimize, int netmask)	Compile a filter expression against a dead handle opened using openDead.
static boolean	isSupported()	Checks if the Pcap subclass at a specific libpcap API version is natively supported.
static Pcap0_5	openLive(String device, int snaplen, boolean promisc, long timeout, TimeUnit unit)	Open a device for capturing.
static Pcap0_5	openOffline(String fname)	Open a saved capture file for reading.

Methods inherited from class org.jnetpcap.Pcap0_4

close, compile, datalink, datalinkGetAsInt, dispatch, dispatch, dispatch, dispatch, dumpOpen, file, fileno, getDispatcher, geterr, isInitialized, isSwapped, lookupDev, lookupNet, loop, loop, loop, loop, majorVersion, minorVersion, next, openLive, openOffline, perror, setDispatcher, setFilter, setUncaughtExceptionHandler, snapshot, stats, strerror

Methods inherited from class org.jnetpcap.Pcap

activate, breakloop, canSetRfmon, checkPcapVersion, compile, create, create, dataLinkExt, datalinkNameToVal, datalinkValToDescription, datalinkValToName, findAllDevs, findAllDevsEx, getErrorString, getName, getNonBlock, getPcapHandle, getPcapHeaderABI, getTstampPrecision, init, init, inject, inject, inject, inject, libVersion, listAllPcapIf, listDataLinks, listTstampTypes, loadNativePcapLibrary, lookupErrorString, lookupNet, newArena, nextEx, offlineFilter, openDead, openDeadWithTstampPrecision, openLive, openLive, openOffline, order, sendPacket, sendPacket, sendPacket, sendPacket, setBufferSize, setDatalink, setDatalink, setDatalink, setDirection, setDirection, setDirection, setFilter, setImmediateMode, setNonBlock, setPromisc, setRfmon, setSnaplen, setTimeout, setTstampPrecision, setTstampType, setUncaughtExceptionHandler, statusToStr, statusToStr, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Details

Pcap0_5

protected Pcap0_5(MemorySegment pcapHandle,
 String name,
 PcapHeaderABI abi)

Instantiates a new pcap 050.

Parameters:

pcapHandle - the pcap handle

name - the name

abi - the abi

Method Details

compileNoPcap

public static BpFilter compileNoPcap(int snaplen,
 PcapDlt pcapDlt,
 String str,
 boolean optimize,
 int netmask)
                              throws PcapException

Compile a filter expression against a dead handle opened using openDead.

pcap_compile() is used to compile the string str into a filter program. See pcap-filter(7) for the syntax of that string. fp is a pointer to a bpf_program struct and is filled in by pcap_compile(). optimize controls whether optimization on the resulting full is performed. netmask specifies the IPv4 netmask of the network on which packets are being captured; it is used only when checking for IPv4 broadcast addresses in the filter program. If the netmask of the network on which packets are being captured isn't known to the program, or if packets are being captured on the Linux "any" pseudo-interface that can capture on more than one network, a value of PCAP_NETMASK_UNKNOWN can be supplied; tests for IPv4 broadcast addresses will fail to compile, but all other tests in the filter program will be OK.

NOTE: in libpcap 1.8.0 and later, pcap_compile() can be used in multiple threads within a single process. However, in earlier versions of libpcap, it is not safe to use pcap_compile() in multiple threads in a single process without some form of mutual exclusion allowing only one thread to call it at any given time.

Parameters:

snaplen - the snaplen

pcapDlt - the dlt

str - filter expression to be compiled

optimize - controls whether optimization on the resulting full is performed

netmask - specifies the IPv4 netmask of the network on which packets are being captured; it is used only when checking for IPv4 broadcast addresses in the filter program. If the netmask of the network on which packets are being captured isn't known to the program, or if packets are being captured on the Linux "any" pseudo-interface that can capture on more than one network, a value of PCAP_NETMASK_UNKNOWN can be supplied; tests for IPv4 broadcast addresses will fail to compile, but all other tests in the filter program will be OK

Returns:

the compiled filter

Throws:

PcapException - any errors

isSupported

public static boolean isSupported()

Checks if the Pcap subclass at a specific libpcap API version is natively supported. This is a safe method to use anytime on any platform, weather native library is present or not.

For example, Pcap1_0.isSupported() will accurately ascertain if libpcap API version 1.0 level calls are supported by the system runtime. Also a call such as WinPcap.isSupported() will determine if WinPcap related calls, ie. native WinPcap 4.1.3 or less, are supported and by extension if this is a Microsoft Windows platform.

Due to libpcap API versioning, it is safe to assume that if Pcap1_10.isSupported() returns true, that at least libpcap API version 1.0 is installed on this platform, and that all lower version calls such as libpcap 0.8 and 0.9 are available as well. The subclass hierarchy of jNetPcap module reflects the versioning of libpcap and its derivatives and the public releases of the native libraries. For example Npcap class extends WinPcap class because Npcap project took over the support for WinPcap where it left off.

Implementation notes: The check is performed by verifying that certain, subclass specific native symbols were linked with Pcap full which was introduced at a specific libpcap or related API levels.

Returns:

true, if pcap is supported up to this specific version level, otherwise false

See Also:

• Pcap.LibraryPolicy.setDefault(LibraryPolicy)

openLive

public static Pcap0_5 openLive(String device,
 int snaplen,
 boolean promisc,
 long timeout,
 TimeUnit unit)
                        throws PcapException

Open a device for capturing.

openLive is used to obtain a packet capture handle to look at packets on the network. device is a string that specifies the network device to open; on Linux systems with 2.2 or later kernels, a device argument of "any" or NULL can be used to capture packets from all interfaces.

Parameters:

device - the device name

snaplen - specifies the snapshot length to be set on the handle

promisc - specifies whether the interface is to be put into promiscuous mode. If promisc is non-zero, promiscuous mode will be set, otherwise it will not be set

timeout - the packet buffer timeout, as a non-negative value, in units

unit - time timeout unit

Returns:

the pcap handle

Throws:

PcapException - any errors

Since:

libpcap 0.4

openOffline

public static Pcap0_5 openOffline(String fname)
                           throws PcapException

Open a saved capture file for reading.

pcap_open_offline() and pcap_open_offline_with_tstamp_precision() are called to open a ``savefile'' for reading.

Parameters:

fname - specifies the name of the file to open. The file can have the pcap file format as described in pcap-savefile(5), which is the file format used by, among other programs, tcpdump(1) and tcpslice(1), or can have the pcapng file format, although not all pcapng files can be read

Returns:

the pcap handle

Throws:

PcapException - any errors

Since:

libpcap 0.4